The Host Unknown Podcast - Episode 153 - The Poorly Planned Episode

Episode Date: May 26, 2023

This week in InfoSec (09:59)With content liberated from the “today in infosec” twitter account and further afield26th May 2006: BackTrack v1.0 was released.https://twitter.com/todayininfosec/status/126547168776142438421st May 2012: Nmap 6.00 was released. https://nmap.org/6/https://twitter.com/todayininfosec/status/126358991810779136223rd May 1997: Carlos Felipe Salgado Jr. (aka "Smak"), who allegedly stole 100,000 credit cards from an Internet provider was granted bail on the condition he not go "anywhere near a computer." He was arrested after trying to sell it to the FBI.Hacker gets conditional bailhttps://twitter.com/todayininfosec/status/1264033568436568070 Rant of the Week (16:25)Dish confirms 300,000 people's data was exposed in February's attackBut don't worry – we know it was deleted.Dish Network has admitted that a February cybersecurity incident and associated multi-day outage led to the extraction of data on nearly 300,000 people, while also appearing to indirectly admit it may have paid cybercriminals to delete said data.Dish customers can rest easy, at the very least, as the telco said in a sample letter posted to the Maine Attorney General's breach notification website that customer databases weren't accessed and the stolen data belonged instead to employees both past and present, their family members, "and a limited number of other individuals" that Dish didn't specify.The satellite TV company also didn't say what sorts of personal information was stolen from those 296,851 individuals in the attack, aside from driver's license and non-driver ID card numbers.Dish never went on the record to publicly state the attack was caused by ransomware, though internal sources who contacted The Register, did report that ransomware was involved. Dish also made mention of ransomware in its SEC filing.Reports from February citing internal Dish sources claim the Black Basta ransomware gang was behind the break-in at Dish, and in its template letter [PDF] notifying affected individuals of the incident, the company sought to reassure recipients that there's no evidence the extracted data has been misused, and that it believes the data has been deleted.Er, who confirmed that again?"We have received confirmation that the extracted data has been deleted," Dish said, adding that it has been monitoring the dark web and criminal forums for signs the data is available online. "The results of the monitoring are consistent with the confirmation that the extracted data has been deleted," it added. That, as Emsisoft security analyst Brett Callow has pointed out, could be interpreted as an admission that Dish paid whatever ransom was demanded of it because "totally untrustworthy cybercriminals assured us the data would be deleted if we paid the ransom," Callow tweeted.  Billy Big Balls of the Week (26:30)Ads for lucrative jobs in Asia fail to mention chance of slavery as crypto-scammerThe FBI has issued a warning about fake job ads that recruit workers into forced labor operations in Southeast Asia – some of which enslave visitors and force them to participate in cryptocurrency scams.The warning follows reports of multi-storey slave compounds housing unwilling workers in places like Cambodia.The FBI's advice suggests those scams are ongoing."Criminal actors assign debts to victims under the guise of travel fees and room and board, and use victims' mounting debt and fear of local law enforcement as additional means to control victims. Trafficked victims are sometimes sold and transferred between compounds, further adding to their debt," said the FBI.Advocacy groups and media report similar tactics, with victims targeted online and promised lucrative jobs abroad with travel fees and other benefits paid.Upon arrival in a foreign country – which may not even be the one jobseekers were told they'd visit – workers' passports and travel documents may be confiscated, and the victim coerced to conduct scams under the threat of violence.The scams the slaves conduct often involve "pig butchering" tactics that see perpetrators encourage victims to make investments in cryptocurrency. Once payments are made, the scammer ceases communication with the victim and their cash disappears. Pig butchering perps often use romance scams, promises of sex, or illegal gambling as lures. Industry News (32:53)Meta Fined €1.2bn for Violating GDPRChina Issues Ban on US Chipmaker ProductsTwo-Thirds of IT Leaders Say GDPR Has Reduced Consumer TrustDiversity advocate and renowned practitioner, Becky Pinkard, to be Inaugurated into Infosecurity Europe's Hall of FamePrivate Sector Cybersecurity Task Force Called for to Defend DemocraciesUS Sanctions North Korean Entities Training Expat IT Workers in Russia, China and LaosSMBs Targeted by State-Aligned Actors for Financial Theft and Supply Chain AttacksNCSC Warns Against Chinese Cyber Attacks on Critical InfrastructureExpo Framework API Flaw Reveals User Data in Online Services Tweet of the Week (39:35)https://twitter.com/ireteeh/status/1661635416204648448https://twitter.com/VladCraita/status/1661461184665604096?s=20https://twitter.com/primevideouk/status/1661760395659321346 Come on! Like and bloody well subscribe!

No, it's a Wes Anderson movie. It's got three brothers. One's Owen Wilson. One's Adrian Brody. I can't remember who the third one, what his name is. But they're just like on a... So their dad died a year ago. And they're sort of like not together.

But they end up on a train together in India. And it's sort of like one of those chilled out movies about bonding and finding purpose in life and what have you again. And like in Wes Anderson's style, it's very visually engaging. So I really enjoyed it. Wow. You absolutely sold that one to me. You're welcome.

That was a terrible in You're listening to the Host Unknown Podcast Hello, hello, hello, good morning, good afternoon, good evening from wherever you are joining us And welcome to episode 153 157 of the host unknown podcast gents that was a terrible cold open i have to say i i just started the jingle out of desperation well yeah had we actually planned something then uh you know it could have been a bit more dynamic and started with a bit more upbeat energy and, like, you know, really got into it. Plan something. Plan, you say.

We're dangerously bowling towards the weekend, losing steam. Yeah. Next week, I suggest we start talking about the weather and how it's very uncharacteristic for May, or very characteristic for May, or actually it'll be June next week. And, in fact, how long I had to wait for a bus the other day. Yes, yes. That was if you take a bus.

No, no, it's just like in the Langford family house, the chauffeur, the limo is actually nicknamed the bus. If there's more than one family member in it, it's known as the bus. Yes, exactly. The limo. Oh, God. You're one of those dreadful Americans, aren't you? Okay, please correct me.

What is it that you refer to your stretch car as? The Royce, darling. Ah, okay. One drives the Bentley, one gets driven in the Royce. Oh, dear. Anyway, Jeff, how are you this morning? Good. I woke up and I was like, it took me like five minutes to remember it was actually Friday today.

For some reason, I woke up thinking it must be Wednesday. I don't know. Days all blend into one. Yeah. But other than that, it's been good. Nothing. You know, across the road, there has been a case of fly tipping. No.

Did your cameras pick anything up? No. So, you know, I'm quite respectful like that. My camera only covers like till the end of my drive. No, but what about the, you know, the extra special, you know, the extra camera, you know, the one you haven't told anybody about. See, I'm thinking, because it was a small tip, I'm thinking it was a move by someone to force my hand into revealing I have my extra special camera.

Did somebody just basically empty the car ashtray on the pavement? No, it was a bit more than that. It was like a few black bags worth. And so I wrote a strongly worded email to the council this morning um and so you know i'm doing my part for society i'd like to think and that that was in addition to the reports of three new potholes that have appeared over the last couple of weeks you are the social justice warrior of north london aren't you i am i am i mean like i'm just doing my job like any good citizen would i mean like i keep telling my neighbors no need to thank me but

you know they constantly do do they no but i can see it in their eyes i can see it when they see me it's almost like they don't actually verbalize it but they do it's that respectful nod where they're even scared to make eye contact for too long out of respect in case you might engage in conversation look i love how you just make up these wild accusations about me i'm i'm an outstanding member of society a pillar of the community making up these accusations about you about your made-up life anyway talking of made-up lives uh andy what about you how are you doing sir good thank you i can't complain i've got uh i've got a temporary crown uh fitted in my mouth oh not the one on your head not the one on my head that is not temporary yeah no that is not

temporary i am a permanent member of the royal family uh i just you know obviously one of the working royals unlike uh you know harry and and megan and the likes you know i still still slam it with the with the common folk well i understand andrew's working as hard as possible to stay in his 30 bedroom house hey let's not let's not you not confuse my namesake with we may have some similarities in terms of taste and I'm talking about

the duty brand of nothing else. We're going to have to ax all this. It's going down a very dark hole. Yeah, this is like, yeah, it sounds, you think it's going to be funny and then everyone's like, uh-oh.

Yeah, that's right. So, yeah, moving. Let's just do what we do to Jav and avoid eye contact and smile and nod. Yeah, that's right. Exactly, like Jav walking through passport control. Jav walking through TSA in New York on 9-11. Jav, how was your, no Jav, how was your week? Do you know what? I've been off work. I've been so unwell, actually.

So, yeah, you can probably hear it in my voice. It's still hanging around like a bad infection, basically. I did get back to work for half a day yesterday and was absolutely exhausted. So a full week for you then? Well, yes, exactly. A bit of a full week. Yeah, we did. Don't make me laugh.

If you hear long pauses, it's me coughing my guts up in the background. Honestly, you've done enough of those last week, Tom. You don't need to milk it. You were like like did you not get enough sympathy that's the problem that that's the question because like you were you were playing at this hand last week then you even went as far as to write a blog about it during the week and then now you're back on this podcast again yeah my my uh highly acclaimed and uh well, I've got two whole comments on it, for goodness sake, on LinkedIn. It must have done well.

So, yeah, I don't know. I just, I've been doing some inner wrestling with myself and about, you know, should I be going back to work and all that sort of thing. And I thought I'd just write about it, you know, because there's a guilt thing going on, you know. But then I think, but I'm unwell. So, that doesn't put that doesn't that hasn't put me off coming onto this show for you so i mean what what you know what more do you want man i even sent you a care package you did well when you say care package you mean box of shit okay fine it had a dirty comb in it that's just insulting man it is it is in fairness the other

stuff looked quite useful you know some punch down tools and rj45 crimpers and um uh plugs and boots and stuff which you know goes with my other collection obviously but and some some lovely cost Costa Rican coffee. You're welcome. Can't go wrong. So thank you. Thank you very much. What crap did he send you, Andy?

Absolutely nothing. I have sent you something. Absolutely nothing. Oh, is it in your hallway? It's probably in his hallway. Absolutely nothing. I even wrote my name and address on the back so that you would... I bet you put your name and address on both sides. I wanted to make sure you could

see it, make sure that you knew it was from me. No, but did you even pay for tracking? Because that would be the teller of where it is. No, I paid for... I posted it the same day I sent. Yeah, mine arrived yesterday, and I'm miles away. Is it Courier or Royal Mail?

Royal Mail. Not going to see it for weeks. Really? I got mine yesterday, and he sent it the day before. No, the sorting office where I am, they've got no staff. It's legit. We get posts like once a month at the moment. Bloody hell.

Yeah. So I got one. I opened up like a switch on my online accounts and this guy was going on about how you know it's all secure everything can be sent separately um you know like the the card the uh the code for the online account and all this other everything comes in one package it literally like post like, post gets dumped in one go. Yeah, they do the gags, like, the local groups, like, don't forget. Like, you know, there's only seven days until the last Christmas post. You know, that sort of stuff.

Which isn't far off. Well, talking of disappointing deliveries, shall we see what we've got coming up for you today let's do it let's do it this week in infosec shows that may has historically been a good year for hacker tools rant of the week is a dishy story putting faith in the bad guys really big balls is a warning for digital nomads industry news brings us the latest great security news stories from around the world and tweet of the week is a job transition hack for those new to the industry. So let's move on shall we to our favorite part of the show this is the part of the show that we like to call this week in InfoSec. And so I did actually have a couple of historical events to walk down,

but I'm just going to focus on one story because time is against me today. I'm not going to take us back 17 years to the 26th of May 2006 when Backtrack 1 was released. Obviously a tool of choice for penetration testers and enthusiastic hackers. And I shall neither talk about 11 years ago on the 21st of May 2012 when Nmap6 was released, thus enforcing the fact that May is a good month for your arsenal that you carry with you um and i will not talk about the 22nd of may 2010 which was a mere 13 years ago when that computer developer named laszlo haniec bought two pizzas at papa john's for 10 000 bitcoin i'm glad you're not talking about that one because that's not in the show notes

no that's that's something i saw in in LinkedIn earlier this week. Just a reminder. It comes around every year. We actually covered it last year and possibly two years before that. Possibly the year before that. Yeah, exactly. No, so I'm going to focus on how long? Twenty-six years. I'm going to take us back 26 years to the 23rd of May, 1997.

I need to start adding these dates in the show notes. When Carlos Felipe Salgado Jr., a.k.a. Smack, who stole 100,000 credit cards from an internet provider, was granted bail on the condition that he not go anywhere near a computer, which is obviously one of those things that was uh back in the day when they sort of had hackers on tv programs and things they said oh you know stay away from computers um like these days you've got a computer in your pocket all the time right so that just doesn't happen anymore but uh anyway salgado jr had acquired like 100,000 credit card numbers by a sort of jump box from his university into Internet service providers.

Doesn't know how. And he used what they call a packet sniffer to intercept credit cards that have been processed by these ISPs. credit cards that have been processed by these ISPs. And there's a great article, I think I've linked to it, it says that he boasted about his exploits on internet relay chat, which is IRC to those of us in the know.

But he made the mistake of offering to sell his booty to someone else on the internet. And it turned out that person he was selling to was an FBI agent. And it turned out that person he was selling to was an FBI agent. And so whilst he conducted all his communications and negotiations using encrypted emails, which is, you know, back in 97 was pretty. Quite impressive.

Yeah, absolutely. Tough stuff to use, encryption. Oh, God, PTP. Here's my, you know, which key do I send you? Here's both my keys. Use one. If it doesn't work use the other um but yeah so he made a uh an initial payment via anonymous western union because that's uh what was anonymous back then um but yeah he'd walk straight into an fbi sting um you know he agreed to meet with this guy um for he was going to exchange 100,000 credit card numbers

on an encrypted CD-ROM in exchange for $260,000. So he actually encrypted the data when the ISPs didn't. So this guy really did take security seriously. What's interesting, though, is nowadays you think, well, why did he meet him and give him the CDs? Because transmitting that data at that time would have taken, like, four weeks. Yeah. God, imagine if your modem dropped as well

or someone tried calling you at the same time. Yeah. If he was a bit clever with today's financial sense, he would have said, subscribe for 20 a month and i'll send you like three credit cards a week it's all about the gig economy there it is the as a service isn't it um but yeah no this there was i mean there's a whole thing on the new york times you can look at their article covering it in 97 and at the time the special agent with the fbi sort of said um obviously because they like

putting a number on these things back then uh so we say 100 000 credit cards the fbi said he had access to one billion dollars in credit okay which is you know technically probably accurate it's probably the same yeah yeah if you worked out the credit limit of everyone. So hang on, a billion dollars. So that's what? That's nine zeros, 100,000 credit cards. Oh, see, my brain's foggy already. Come on, why don't you get your calculator out, Andy? What are you trying to get to? What's the average credit limit on each?

Oh, Jesus, I'm not going to work that out. There's too many edge cases on that. You can have like two high net worth individuals with AMX blacks and they skew the whole thing compared to someone who's got a cap one starter credit builder. God, I'm talking about somebody who overthinks it. I'm just, this isn't Countdown, man.

I'm not Rachel Riley standing at the whiteboard doing sums for you. I can tell you that. The way you're bulging out of that dress at the moment. And in all the right places. Thank you, Andy, for this week's... This week in InfoSort. 30% nostalgic 30% ranty 30% ballsy

and 30% terrible at maths you're listening to the award winning post unknown podcast and now it's time for the slightly slower, slightly hoarser but still just as angry. Listen up! Rant of the week.

It's time for mother f***ing rage. And I shall do my best to avoid coughing in anger. So, headline reads, Dish confirms 300,000 people's data was exposed in February's attack. So far, so normal. Lots of companies get attacked. Some of them have very good security practices. Some of them don't. Not even suggesting which one is which at this point.

But there was an attack on Dish. Dish is a U.S. satellite um media company isn't it they yeah it's a bit like sky i guess you know you get your dish you're quite literally you get your satellite dish and you get your services down um so they admitted that a february cyber security incident and associated multi-day outage led to the extraction of data on nearly 300,000 people. They, again, so far so normal. However, what they have said is, or indirectly admitted, is that they have paid the cyber criminals to delete that data. So they can rest easy at the very least.

So they took proactive. They did. Because the telco said in a in a sample letter posted to the main attorney uh attorney general's breach notification website that's main as in you know on the east coast not not the main one um that customer databases weren't accessed and the stolen data belonged instead to employees both past and present their family members and a limited number of other individuals well limited only to about 300 000 uh that dish didn't specify satellite tv company also didn't say what sorts of personal information was stolen so they didn't even say

um you know whether there was financial data or whatever but it was aside from driver's license and non-driver ID card numbers. Why they're holding on to driver license data, I don't know. They never went on record to publicly state the attack was caused by ransomware, although internal sources who have been in touch with the register who ran this story

did report that ransomware was involved. So Dish, it seems at the moment, are playing their cards pretty close to their chest. We're not saying it's ransomware, but it is ransomware. Yeah. Dish also made mention of ransomware and its SEC filings. So, I mean, it's ridiculous. Dish are all over the place can anyone see our secs filings is this public record like yeah i think exactly

reports uh from february citing internal dish sources claim that the black basta ransomware gang was behind the breaking and in its template letter notifying affected individuals of the incident, the company sought to reassure recipients that there's no evidence the extracted data has been misused and that it believes the data has been deleted. So what we've got here is a ransomware gang who paid probably a fair amount of money on on some tools to to attack dish who then got 300 000 records um of unknown nature but probably includes a bunch you know driver's license etc etc and then decided to not do anything with it that's that's basically dish's defense at the moment and then delete it and then delete the data uh so we have received confirmation that

the extracted data has been deleted dish said adding that has been monitoring the dark web and criminal forums for signs that data is available online. Results of the monitoring are consistent with the confirmation that the extracted data has been deleted, it added. Basically what they're saying is we can't find it, therefore it doesn't exist. Absolutely ridiculous. So this is obviously interpreted as a mission that Dish paid whatever ransom was demanded

because it was totally untrustworthy. Cyber criminals assured us the data would be deleted if we paid the ransom. This is utterly ridiculous. So one, we've got the attack in the first place. So this isn't Billy Big Balls. We don't victim blame here. But for Dish to then go off and give conflicting reports

of what actually happened, claim somewhat baselessly that the data has been deleted, take what is in effect a cursory glance because they've they've basically paid someone to take it to scan what they can in the dark web to see if the data is there and it's not and now they've said oh it's been deleted obviously um and not even just you know disclose exactly what was what was removed and tell their um their customers or whoever it was that had the data stolen that it's fine, the data's been stolen.

But also, and I don't blame them for paying the ransom because sometimes, you know, you've got to just get the services back up and running, right? That's not a problem. But to believe the criminals when there is so much evidence that data is resold and repurposed, et cetera, et cetera, i find this absolutely stunning i think they're uh they're comms and marketing folks really need to take a closer look at this their security folks need to take a look at this and i think even the um you know whatever regulators need to ask dish for a far more in-depth and more detailed understanding of what went on.

It's appalling, absolutely appalling. And if I had the breath in my lungs, I'd be shouting and banging my desk right now. Wow. Thank God you don't have the breath in your lungs. Yeah. Because I don't know whether it's the meds you're on or something, but for the second week in a row, I agree with your stance, Tom. This is, like, really scary.

But, yeah, this is a classic example of how not to do media comms or PR following a breach. Okay, right, before we get into this, okay, is it just the comms that you have an issue with or do you have an issue with the fact they paid the ransom no i don't have an issue with the fact they got they got attacked or the fact they paid because sometimes you just got to get shit done right everybody says don't pay the ransom sometimes you know if there's no alternative you just got to pay the ransom right um although did they pay the ransom because their systems were out of action as a result

or did they pay the ransom to have the data deleted we don't know i don't think that's clear yet yeah so but i it's but you know the vast majority of the of my ire is is aimed at um the fact that their comms is absolutely dreadful and the fact that they are taking well-known uh cyber well not even cyber criminals just criminals at their word when when there's been ample evidence that that data is always resold and reused elsewhere by criminals you know we need we need like a trip advisor for criminal gangs, for ransomware groups. You know, like the Trust Pilot. Yeah, Trust Pilot.

Nine out of ten. Yeah, exactly. Would it be five stars for these are untrustworthy or five stars for they are trustworthy? Well, so paid the ransom it's been 12 months data wasn't released so grateful you know and then five stars five stars because excellent ransomware okay excellent ransomware would would pay ransom again would pay yeah absolutely i think that would be very handy actually actually. Because, you know, you'd be entering into more of a business engagement

with these people rather than a lottery. It did. And so just, I know it's slightly off topic, but I did see something on LinkedIn this week from Halcyon, where they'd done like a Gartner Tragic Quadrant for the ransomware as a service ecosystem. And they had like the challengers and the leaders and the niche players and the visionaries it was like brilliant it's uh yeah so lock bit three up there in the leaders uh with black cat and black bastard um and niche players like lapsus uh you know that sort of stuff but

you got your challenges with Rebuild. Jav, you were agreeing there. Niche players like Lapsus. Because you know those folks. Yeah, I know those folks. I know these niche players, these little boutiques. Yeah, I'm on their board of advisors, helping them black guy.

Brilliant. So Dish, come on, dude. Sort it out. And, you know, I don't know. I'm so angry. I'm just exhausted now. Excellent. This is what we'd like to hear.

Rant of the week. People who prefer other security podcasts are statistically more likely to eject usb devices safely for those who live life dangerously you're in good company with the award-winning host unknown podcast doesn't feel very dangerous at the moment though does it does it? OK, Jav, it's time for you now and for your wonderfully smooth and spherical... So, the FBI has issued a warning about fake job ads that recruit workers into forced labour operations in Southeast Asia, some of which enslave visitors and force them to participate in cryptocurrency scams.

The FBI further on went to say that America does not like competition from Southeast Asia in forced labour operations. The warning follows reports of multi--story slave compounds housing unwilling workers in places like cambodia um so the the the they they suggest the scams are ongoing criminal actors assign debts to victims under the guise of travel fees and room and board and use victims mounting debt and fear of local law enforcement as additional means to control victims and to top it all off the trafficked victims are sometimes sold and transferred between compounds further adding to their debt said the FBI so if the three of us went to Cambodia for example there's there's like someone saying, oh, we love Host Unknown.

Come over here. We will pay you like each half a million dollars each year to do the podcast from here. We'd be like, cool, let's go over. We go over there. We get locked up and said, OK, now you owe us like half a million pounds worth of scams if you want to ever be released. And then after like two months, they'll be like, the fat one, he's useless. Let's move him to the other operations over there and let's cut some of our losses and they'll sell him over for like a quarter of a million or something like that. A bit like, you know, footballers,

how they're traded when they're not performing well. I'm glad we haven't specified which one of us that is. No, that could be any of us. Well, it could be two out of three, I suppose. It's two of us, yeah. It's not Andy anymore. No, it's be any of us. Well, it could be two out of three. It's not Andy anymore. No, it's not Andy. No. And actually, you know, when I was reading this story, I thought this sounded familiar. about 130 Indians who were forced to work in Myanmar, Laos and Cambodia after they were lured by agents who had offered well-paying job opportunities in IT.

That turned out to be fake and, you know, they were held captive and forced to commit cyber fraud for companies. So it seems like the FBI are, you know, days late and dollars short, as you'd expect. So isn't this, you know, like how people work for hacking groups without realising they're working for hacking groups? Yeah. Isn't this just like the Asian knockoff equivalent where people are like they're applying thinking they're going for a proper job and it's not until they actually get there? Yes, that's right so sometimes they're sent their airfare and you know they're packed up and they're like oh yes and their family's really happy finally my my useless son at the age of like 30 he's getting his first job and he's going abroad and he goes abroad and then like you know

he's basically whipped and uh put into a basically a jail and said okay now you've got to phone up these people pretend to be from microsoft and that they've got a virus on their computer or whatever the scam might be or you know cryptocurrency and they have targets they have to meet and it's um really horrible conditions i i mean i really feel bad for these people who get caught up in these who just literally they're just trying to find a job. I have questions. Okay. One, is this a security story?

It's on the register, so it must be. Oh, okay, that's fine. Okay, that one's answered. Well, you know, secondly, you know, we get all of these calls coming, like nearly everyone. Secondly, we get all of these calls coming, like nearly everyone. Most people have received an email, an SMS, or a phone call from someone claiming to be from HMRC or from Microsoft or from Amazon or your bank.

And a lot of them, a large percentage, might be driven by people who are unwittingly forced to work in these conditions so now i have to find you know tap once if you're being held against your will tap one it's a jesus yeah so now now you can't now you feel doubly bad for being rude to them when they phone up and you start swearing at them and everything in fact you say like look i know You say, like, look, I know you're not the one to blame here, but to your handler, screw you. Yeah. And, you know.

So I have to treat them like I treat British Gas, basically. Yes, yes, exactly. Don't go all Les Grossman on them. Yeah. So my other question is, who are the owners of said Billyy big balls in this story the uh the the criminal organizers who are putting out job ads and recruiting people to come from even outside of the country and locking them up in their prisons off their making most likely bribing local police and and government officials to turn

a blind eye if that's it's a slick operation tommy you gotta admit it is it is i mean it is sort of like straight from a small dictator's playbook kind of thing it's at a smaller scale but it's just as effective and you can't help but sort of admire that stop i would stop right there if i were you holy moly i'm i'm i'm speeches okay billy big balls of the week if good security content were bottled like ketchup this podcast would be the watery juice which comes out when you don't shake properly in a niche of our own you're listening to the award-winning host unknown podcast time is running out for andy he needs to move on so andy what time is it it is that time of the show where we head over to our news sources

over the InfoSec PA Newswire, who have been very busy bringing us the latest and greatest security news from around the globe. Industry News. Meta fined €1.2 billion for violating GDPR. Industry News. China issues ban on US chipmaker products. Two-thirds of IT leaders say GDPR has reduced customer trust. Diversity advocate and renowned practitioner Becky Pinkard to be inaugurated into InfoSecurity Europe's Hall of Fame.

Industry News. Private sector cyber security task force called for to defend democracies. Industry News. US sanctions North Korean entities training expat IT workers in Russia, China and Laos. Industry news. SMBs targeted by state-aligned actors for financial theft and supply chain attacks. Industry news. NCSE warns against Chinese cyber attacks on critical infrastructure. Industry news. Expo framework API flaw reveals user data in online services.

Industry news. And that was this week's... Industry news. Huge if true. Huge. Huge if true. Right, straight off. Meta fined 1.2 billion for violating GDPR. Well, colour me shocked.

Oh, wow. Yeah. They're just, I think Metro just like, whatever. It's actually easier to pay the fines. Exactly. Exactly. It's a big number, but it ain't anywhere near big enough. No.

I do like just the headline, China issues ban on US chip maker products. That's like how the turns have tabled. Exactly. Exactly. Exactly. So those two niche companies in China that are importing US chips are out of business. They could. You just imagine, was it President Xi getting up there saying,

America, it comes from America. We don't want it. Yeah, I wonder if they're going to ban Facebook and things like that, Twitter from devices and all, you know, go the full hog. I love this story about two thirds of IT leaders saying that GDPR has reduced customer trust because now they have to be transparent and people are now asking questions as to like what are you doing with our data yeah it's it's reduced consumer trust because you've been doing

dodgy shit yeah exactly uh we should also congratulate friends of the show becky pinkard yeah inaugurated into the infosecurity europe's hall of fame i think that's uh well deserved becky's definitely's definitely one of the good ones, I think. Exactly. It's the first one in... I'm not going to say. I think last year it was Jenny, wasn't it?

I'm trying to find a list of who the past ones are and then we can rip them all apart. There's only one that... I'm not even going to name the person I know there's only one that's... I'm not even going to name the person, but there's one that came out of nowhere.

Not really a cybersecurity or any sort of background in security. And it's disappeared. Yes. And I wouldn't even say security adjacent either. But yes, it's very... I'm sure everyone knows what i'm talking about but uh this the private sector cyber security task force called for in order to defend democracies um isn't this like what blackwater did in the us aren't they like don't they hide behind

um like the defending democracies and they do some pretty shady it's like who the cia contract to carry out and the Wagner group yeah exactly well isn't this just what that is yeah I think so it's it's basically mercenary mercenaries right yeah it is yeah privateers they're put they're paid to carry out what you would normally be done by the governments and armies yeah but as long as you're defending democracy it's okay yeah yeah that's the right kind of democracy yes yes this is true defending freedom the type of democracy that has a you know a big bald eagle on the front of it and um standing on top of um a steaming mum's apple pie yeah and loves oil loves oil he loves oil well i think we've i think we have actually exhausted this week so i think we've we've basically agreed with everything or just discounted everything

one or the other pretty much excellent well thank you for this week's industry news we're not lazy when it comes to researching stories no we're just energy efficient like and subscribe to the host unknown podcast for more esg adjacent tips the irony of that jingle is not lost on me so whenever i mention anything that you know i might have spoken about on this show elsewhere you two come at me like a pack of wolves yeah wait what it's our content content jeez it is i'm just being efficient you're allowed to use a third of it you're allowed to use every third word of what we say and you know yeah i was

actually thinking yesterday tom i know you're looking for a spare panelist uh at short notice and jab obviously volunteered um and then for various reasons he couldn't make it and it's probably lucky because then i saw chat GPT went down worldwide. And so Jav would have been struggling for responses, you know, on your panel. No, no, no, no, no. Even, no, no, no. So chat GPT, it makes things a lot easier. But even my kids now say to me, like, you know, they understand that my I've built a career at being a professional bullshitter.

And I can go on these panels and discussions where Tom has like called me in for the last minute and said, like, can you do this topic? And I know nothing about the topic and still make it seem credible. So I'm not accepting the accusation, Andy. Says Jav GPT. Yeah. incredible so i'm not accepting that accusation andy yeah says jav gpt yeah right andy if he's still with us and if you can take us home it's time for sweet of the week i always play that one twice sweet of the week uh so i have uh jumped into tweet of the week and we have an alternative so what we said we were going to do, uh, absolutely changing.

Cause I think Java's posted something else, which is, uh, I think funnier. Uh, and it's a tweet from unusual Wales and they say breaking news. Microsoft has said that Chinese hackers have attacked critical us software infrastructure.

And there is a reply saying, how did they get past Windows Defender? I love that one. It's a fair point, P&I. It's a fair point. Oh, dear. Very good. Very good.

Thank you, Andy, for... Tweet of the Week. Right, we've come barrelling in. I know Andy is getting ready to jump into into the cab to scream his way to work uh with his head out of the window like a happy dog um so yes gentlemen thank you so much for your time this week uh jav thank you uh well Well, I say you're welcome, but this was really not an enjoyable show for me today. Okay. And Andy, thank you. Stay secure,

my friend. Stay secure. You've been listening to the Host Unknown Podcast. If you enjoyed what you heard, comment and subscribe. If you hated it, please leave your best insults on our Reddit channel. The worst episode ever. r slash Smashing Security. Why didn't you enjoy it, Jav? I thought it was wonderful.

Yeah, wonderful when, you know, it's like when you're the punch bag, it's not very enjoyable. When you're the one doing the punching, it's very enjoyable. Hey, you're the one who likes to big up the criminals in this. Oh, really? Really? We're going down that road, Mr Lionel. Oh, that wasn't the part you were being punched in? No.