Dishy DDoS dramas, and mining our minds for data
34:52 Share

These, these is actually appalling behavior, both by your friend and mine. I mean, that is abid diablo. And listeners do not do that.

This was thirty years ago, and everyone was idiots.

right? And of course, people are so much more sensible now. Yes, smashing security episode three hundred and twenty six D D D O S dramas and mining our minds data with Carol tario and grand clue. Hello hello, welcome to smashing security at three hundred .

nine six nine .

no guest I know and i'm very .

sorry for this listeners that love and we are a three and on the show but as we are near in Christmas, people schedules are getting busy but you have us were here yeah.

we're still here.

Um how about we kick this off? Let's take this week's wonderful sponsors, one password, blackberry and threat locker is there. Help us give you this show for free. Now coming up on today, show gram what he got.

Well, you ve had a risky business. I'm onna. Tell you about dishy business instead.

And employees the world over are changing how we work and it's not all rosy all this and much more coming up up in this episode of smashing security.

Now, jumps, jumps. Thirty yards. Years ago, I had a friend.

Just one, yeah.

just the one is pretty sure, actually, yeah. He was about ten years old than me. And i've going to visit him in south london. They drive me around the town. You know, we'd get up to our antics.

He wasn't glooming you anything?

No, no, no, no, no. Very nice guy. Very nice guy. I'm in his name was and he'd checking away. He be laughing away and everything and you know in the passenger seat and I think he be listening to on the radio because because I could here some sort of sick comi was listening to some sort of radio show. I realized I was dada's army that he was listening to.

couldn't hear IT on the radio.

was working out what I was that are me, as people all know, IT is an old vintage T. V show from the U. K.

Which did have a radio in corn as well. But I was mostly known for the T. V.

And I looked across at him, and I saw he was balancing a tiny, portable T. V. On his steering wheel, he was driving me around.

And just checking, wait, because he he loved, he loved that, tell me so much. And I obviously I made representation. So explain that maybe this wasn't a good thing to this.

Maybe should stop doing that. Be he loved T. V. He actually adored IT. This was before the days of smart point and things. This.

this was A T, V, with an area. He said.

thirty years. I okay.

Is that Better of worse? I had a teacher friend he regret drove me from, were taught english. And but he then told me that when I wasn't in the car, when he drove, he would make cigarettes. I want his lap right.

roll them up. Yet.

this little weird mechanical machine that you kind of flip the lid, turn this look IT done. And so he would do this more day. He literally went through someone's front window.

like the bay window.

Oh my god, he, he the last control. And he went over the front garden and into the house.

And this, this is actually appalling behavior. Your friend and mine, I mean, that is ability. Diablo and listeners do not do that.

This was thirty years ago, and everyone was idiots.

right? And of course, people are so much more sensible now.

Yes, very sensible.

But my friend diamond, he loved T. V, he adored IT. Yet this garden office, but in the garden you go down the path thon, yet hundreds and hundreds of video types, all kinds of shows that IT recorded.

And because he was a syrian, he loved to know what was going on the middle. And IT was round about the time that iraq invaded kuwait. IT was the golf for IT was all kicking off, and he'd be up overnight and it'd be recorded in all the news broadcasts, said watching middle east n comedy shows and did this. But there's enormous satellite dish.

I was just going ask.

Massive IT was absolutely huge. Yeah, I don't say .

six feet across. There are big. They quote.

yeah, IT IT was really big. And the U. K, this was not something you Normally saw in people's backyards. no.

And so we tune into these shows that watching news reports would be video otp and everything that was going on. And IT must have cost her a small fortune. This dish.

And you don't really see satellite dishes like that around anymore. Do don't really. I think they're still attach to the side of buildings here in the U. K. Many people will have one which they had put up in the nineties, maybe, but a lot of people don't use satellite T, V and along to do that because they're on broadband instead.

I don't know. Yeah, no idea.

I think that's the case. I think maybe your grand may have a television attached to the side of the roof for down the bottom one up. Most people are probably now streaming instead, rather than having TV beamed down from a satellite.

What I didn't know was that south korea, which is the home of cape up and king chand, things like that, is also apparently hoped. The satellite receiver manufacturing till this day. And there are companies out there still doing that, and they have been doing if he is.

So this is the story of two companies. okay? One was called company a image.

And the other one company be, I agree, these aren't the best names. These are the names which have been released by the police. Uh, I don't know what the real name.

Let's come algona and barry, right? And alga. He's a CoOperation which is known for illegal broadcasting. Okay, so there are companies now who are beaming out I ve via satellite dishes or by the internet streams of T, V channels and things that you Normally would have up by a subscription for mean pie T.

V types, right? Yeah OK. okay. They're not license .

to do what they are doing right? And the other company company be or barriers, we call that that is A A self cream form that manufactures satellite dishes and accordance to cream, please. They are a midd sized player in the global satellite dish market.

Who knew barry? Such a big plan? And this week, south cream police have arrested five key individuals from barry.

But it's not barry in self wales. This is barriers, just the code name for company be yeah yes. And they have issued. You got to have you they have issued. I don't if you have have been to barry in south wales this little fun for the no, it's alright theyve issued at the international warrant that someone linked to company a agosta as well and they froze six billion korean dollars .

belonging to company barrier, right? So varies as its are all seed up and vary saying we need someone from company a to chat about this, right?

Well, well what actually turns out is that this money, six billion Green dollars, I don't know much, is I think is about three million pounds. IT said that these are the proceeds of illegal exports, which barry made to algitha, selling the satellite dishes to algitha. Now, what's wrong with exporting satellite dishes? You may ask, even if egta does end up using them illegally, you would think the sale of those satellite dishes is legal. I would think so.

So it's up to the companies .

who buy them, what they end up doing with them. I would think so. I that's my hunch. I not a lawyer.

I do you really.

really think about anything, really. These satellite dishes were being shipped for almost six years. And IT turns out that backing, november twenty eighteen, ega, the illegal broadcast company I told you about, they believed they were being targeted by some of their business rivals. And so they made a special request of barry, the korean satellite dish manufacturer, and they said to a barry, can you build a, say, a special satellite dish, one that can launch d dos attacks, one that can retaliate against our business rivals?

And because algitha is such a valued ed customer who is company, barry, to say no, exactly.

Barry said, yes, of course. Yeah, you're gonna give us millions of pounds. Of course we will do these billions of korean dollars. Yeah, absolutely. We're on IT. And they went ahead and integrated into the satellite dishes, malicious functionality, which could launch deal tax, which, as you know, can bombard the system, can clogged IT up with so much traffic. You could do IT against the website, can do that with other things which connect the internet as well.

And IT not only shipped satellite dishes which had this hidden d dos attack functionality, but they also pushed out to other users, other customers of its devices firm where updates which added the d dos functionality. I guess, my guessing that is that is easier for a satellite device manufacturer to give everybody the same functionality. You just don't necessary have to tell everyone about IT. So it's there he is in a way, but doesn't necessarily have to be used.

You don't have to advertise that fact that oh, no, if you dos pay bill.

yes, right? Maybe you could do something else. Maybe could turn off the devices remotely. Maybe you could. Zk mile, now the current they uncovered this scheme after, while they received some intelligence from interpol, and apparently one of the suspects was placed on an international wanted list. And so cream, please, all over this theyve arrested people IT turns out the between january twenty nine to september twenty, twenty four, five years, the manufacturer, barry, a bit more than five years, almost six years, the manufacturer shipped a quarter of a million satellite receivers. OK, well.

i'm going to guess it's in all llay. Yes.

the ones which didn't have IT built in didn't have IT preinstalled. They were updated as IT were with where update to include this d dos functionality. I would imagine many of these devices are connected to the internet because that's an easier way to update the firm way. But if they're not IT may be that the owners of these devices totally out with the U S. B to and install the latest firm update and aren't aware of everything that is doing.

But like IT was company algaas a that is streaming all the non paid for .

stuff yeah that that's right on the interpol. Now after some of these remaining suspects connected with company ega, I is not a real company.

I by the way, that's why don't know anything .

about OK cover. There's still working on IT. So I think the thing generally is so met most listeners to the show know that you need to be really careful about the software that you install.

But I think most of us probably don't think so much about now where that can be brought in the hardware that you purchase. I member, years and years ago working for a data recovery company where we bought a new hard drive, and the drivers which came with the hard drive were already infected with my every accident. But not, I imagine IT was accidental.

But in this case, IT was deliberate. IT was intentional. And to launch these criminal attacks. And I think often people just think of have not you mean I worry about what the hardware brings in because it's so hard to managing control that particular problem, i'm gona worry more about traditional attack vectors instead. Yeah, you wouldn't .

think about satellite, but then I haven't thought about satellite. And dishes are on strapped side of housing. I think if you've got any .

friends through out there in the canadian outback grow, I think it's called the outback is the boon deck. So whatever you call IT now in the international who done have decent internet connection, they might a satellite dish if they have done of an internet connection. How are they launched in the D. S. attack? Is IT being beat up to the satellite? There's so many questions here.

We wish you knew. I don't read korea and growth. Have you heard of google translate?

Yeah, it's it's a bloody pd. It's A P, D, F, I, C, korean. Trying to get that into google translate has been a nightmare.

So i've done the best I can. This is what we have to do to get the show to each week. So what have you got for us this week?

So work, working life. And I would say I ve not seen such a rapid change in such a short period time in terms of the work ethic in the work environment, like the number of people I speak to now who should be at the top of their game, because they are talented and good at what they do think they are dead nervous about losing their job.

Yes.

one was offered voluntary redundancy with a two week servants. And on this side of the pond, that's considered pretty easily.

Yeah no, not good.

Yeah so so the institute for the future of work. So the I F O W, they have issued a very interesting report published this week and IT talks about the advancement in digital profiling, thanks to algorithms and data sets.

And by digital profiling, they're talking about collected a blood of data on you and your activities for all manner of reasons, right? So I want to talk about both are now gram, I left work to work for ourselves before boss war became a thing, or I was very satisfied. I'm sure they were, some ways they were monitoring us. He was pretty regiment mentally.

compared to what there is today. They would have had to employ so many people to monitor us. Scroll can imagine how.

We did work hard.

Probably there were other people who were made or redundant because they no longer had to employ people to keep an eye.

The thing is as boss for has been around what five years are more than .

that a bit more? Yeah, I think.

yeah, you're right. In twenty nine, gartner surveyed hundreds of big corporations and more than half for using some form of non traditional monitoring, such as analyzing the text of workers, emails and social media use, and even gathering some biometric data. But of course, things accelerated, right? The rise of remote working and a reduction in human contact during COVID locked down its mistakes at all.

But anyway, so this was a big growth period for a boss war. And presume, because bosses were panicking, that their workers are going, na take the Mickey. They wanted to know who was working, what they were working on, how long they're working on at the exeter.

And why not use this wonderful boys wear stuff to monchy all of this for you? Um so we have the obvious here why they do this right keep types on worker productivity and work behaviors. But there were other rationales for boss swear that have been made.

So there's like health and safety, you know monitoring wellness and fitness, protecting trade secrets. So make sure someone's not cutting and pasting something that they shouldn't be spotting devient of sight behavior. So I guess that someone not showing up.

not doing any work, I don't know this raising devient of sight behavior.

the vian. I know I didn't like IT either. Yeah improving team performance and of course, security, right? Cyber security. So so remember early I mention the concern over advancement in digital profiling, thanks to algorithm s in data set here. So the paper raises concerns about this recent edition of effective algorithmic management. A A M and A M introduces new types of tracking, so i'll list out a few that the paper outlines and you tell me how uncomfortable you are with this, maybe from a scale like one of five OK five being the creepers, yes, crepy creeps.

alright, right? All my have being or a bone dependent .

on weather on okay. So there's technology such such as are fit tags and I movement monitoring that can be used to check workplace practices and how specific procedures are undertaken. So same track and swipe sense. That's a really bad name. Swipe sense, uh, both have systems that can be deployed in hospitals to aid hype e management .

u hence the swift and staffs .

time management by monitoring how longer suspend with patients or whether they're washing their hands .

in part the body may can you imagine if there's like .

a microphone sending little gentle reminders like publicly, like employee eight, three, nine, wash your hands like or maybe it's like sing song to keep spirits light. Remember, got you reckon? Well.

I guess that's more important in a health facility than maybe IT is if you're working remotely at home. sure. Yes.

I think a lot of these things we have to think about in terms of this is maybe why IT was intended to be to exist. This was the use case. But if we take IT out of that use case, there's nothing stopping another .

company using this kind of stuff. I don't really like this.

Yeah ah what what about fatigue monitoring technologies? This is used as a safety measures, crashes or poor usage of heavy machinery by alerting workers that they're getting drowsy.

Oh, I thought this was going to be people set of desks and are are they looking tired enough? And I think if they're not looking tired, then clearly they're not working hard enough.

But however, most of this fatigue monitoring technology comes with a connected cloud based platform for managers to track workers in real time and gain analytics on fatigue management initiatives and productivity optimization. George is yon ten times in the last five minutes.

I'm thinking if you get cool to a zoom call at nine o'clock in the morning and you arrive there looking unshaven, rule in the side.

your face and you .

know you you know the rest of IT.

but untucked right.

Are they going to be thinking? I think it's not even sure he's got out of bed.

And when you're saying they thinking it's not anybody thinking it's an algorithm session, roughness is part of A A M. So out of five fatigue monitoring.

yeah, not keen on that. Not again. I'm onna give that a slight bang.

okay. What about tech? The collect biometric data, uh, that can be deployed to enhance wellness programs or aid worker safety. So there's a company called emotive with A V E offers a workplace wellness, safety and productivity neuro tech solution.

When you say a motive with a thee, I can't think how else you would spell in motive. You mean there's no e on the end I like, okay, against this.

Yeah, well, you you got to go .

to see o somehow. Gram, the domain name wasn't available. I'm not happened to that.

okay. I want you to check this little product out. Could buy this grab. You could buy that. I put IT into the showing. Tes, so for our listeners, basically looks like very Normal little ear buds, right?

Expensive though, four hundred dollars.

I'll see what he does. And the ideas you, where they throw out the day. And what does that tell you, you can do if you buy this for yourself.

get real time brain data and insights we got in your cognitive fitness stress baLanced meant collect, hang on. So you have to wear this. And it's monitoring how hard your brain is working.

Yes, but like, you know, people using the apple watches and be able look at their data.

But .

okay, now now i've put another link in the show notes, right? This is what they tell enterprises because, of course, is available for companies as well to buy for their employees. They say our team of pg neutral scientists, data scientists and eeg technologists are dedicated to accelerating your research and product development, offering you a bridge to the untapped potential of the human mind. And guess who your ginny pigs are? Mister enterprise, your workers.

So this is a little bit like where, in a headset.

little air buds, you got them from their employers single, by the way, the where these yes, they also have with like transistors across the head like yes, more advanced model.

it's rapped all around the head. It's like a john spider is scary apparently.

Gram sap that german business process management class m they've collaborated with emotive with A V no e to integrate the computing interface to analyze worker's brain states and give real time feedback on stress levels to employees and their managers.

Sure is gonna quite stressful knowing that you employer is monitoring and sting interest. You think that .

there's just a few more microsoft copilot can be configured to allow employers to monitor worker's health with an integrated well being function. Zoom has added a feature that detects emotional states via emotion A I, which involves machine learning to detect and analyze human emotions, typically through facial expressions, voice stones and body language and virtual communication. I'm sure they never get IT wrong.

Am I just old fashioned? I am. I just a bit of imagine that I I kind of think there's no real need for this.

I was going to ask you if you were bit jealous that you couldn't work in one of these environments. Now you could go back to the office of a Young boss, a WIP er snapp er boss.

ah, can you imagine .

giving you a little headset? Gram, god, you're huffing and puffing a lot there. You seem really grumpy.

Here's your cubicle. Gram, going to sit there, put this on your head, but millions and millions .

of people are going to do. And the thing as you say, right as you say, you can guess and listeners of guess that all this monitoring and prompting and analyzing is not necessarily very good for the well being of the worker. Right in the report states, as much IT seems, the most employees believe that A M has forced them to work faster, to do more than they can handle, to meet tiger deadlines and to change their work rabbits. Slightly more than half of the respondents believe their personal life is invaded by work technologies.

I expect the other half, the two, nervous to actually think such a thing in case, get picked up by the device.

They were right. But there is a little weird. Catch twenty two. So the surveilLance tech dresses you out and then they measure that you're stressed out and they gathered that information processed to tell you stressed out and that you're not performing. Like, you know.

this is the loop of IT. It's me. Don't panpan panic or don't get stressed somewhere.

Stop stressing. So calm down, calm down back because that's how you get people distressed. Calm down.

And just before the show, we were talking about that apple employee who is basically suing apple four kids effective boss wear stuff, saying it's breaking california law by you preventing me from doing things like I think they have stopped him from putting information on linked in that he actually worked to the apple wow because .

they installed this on his personal device. I believe, and you know that I I presume that their condition of employment, yet you're going up to install this on your device.

Exactly that. That seems to be true for a lot of companies is like, look, when not going ship you a computer but here, can you just install this stuff, right? And there are many questions about the legality of at all.

Some people are questioning IT very strongly. Some people were saying they're already laws in place that people could be using. There's actually a fab a long form blog from our friends at one password that's worth checking out a links in the show notes all about this in legality of IT.

But in short, i'm on a fan. I think boss war might be an A K A spyware. Mean.

let's be honest.

it's spyware. They just gave IT a gentleman, me. And why are orgues doing IT? Because data is a gold mine. And right now, whether or not their laws in place, no one seems serious about stopping IT yet. I haven't seen any big kind of we're going after the .

boss where when you can argue that they are all legitimate uses for this, I could be helpful in some circumstances. But unfortunate there will be pressure upon employees to go with that and agree to do this, makes that otherwise by one of a job.

I wonder how many employees have blissful, given their consent for the murad of surveilLance technologies the company has imposed on them? Yeah, they may just say, you mind if we watch you bit, you know, check here. great.

Thank goodness we left industry when we did crow to work for ourselves because we would be so much trouble. Wouldn't IT be nice to have secure communications .

through a critical event, be at a siber attack, extreme weather event or even civil and unrest? Wouldn't IT be nice to know that you are communicating to the right people so you can deploy resources to areas where they are most needed. And wouldn't IT be nice to have all this delivered out of band.

So there is a continued communication, even if your own infrastructure is compromise. The answer is yes. yes. IT was, say hello to blackberry seu sweet certified to meet the highest security requirements. Seu suite protects against threats to enterprise and local and national security by enabling secure communications on conventional mobile devices with blackberry, sexy sweet employees can make secure phone calls and exchange secure messages, including group chats on the devices that they already Carry. Cool, find out more at smashing security dot com slash blackberry and thanks to blackberry for sponsoring the show.

Quick question. Do your end users always and I mean always, without exception, work on company owned devices and I T approved apps? I didn't think so.

So my next question is, how do you keep your company's data safe when it's sitting on all of those unmanned up and devices? Well, one password has an answer this question, and it's called extended access management. One password extended access management helps you secure every signing, the every APP on every device.

Because IT solves the problems. Traditional I A M and M D M can touch, go and check that out for yourself at one password dot come slashed smashing. That's one password, not com slashed smashing. And thanks to the folks of one password, the support in the show.

Do zero day exploits and supply in attacks keep you up at night? Worry no more, you can harden your security with threat locker. Imagine taking a proactive, denied by default approach sey every action process and user, unless specifically authorized by your team.

Thread locker helps you do this and enjoy full audit of every action for risk management and compliance on boarding and Operation is fully supported by their U. S. Based support team. Stop the exploiting of trusted applications within your organization to keep you running efficiently and securely worldwide. Companies like jet blue trust threat locker to secure their data and keep their business Operations flying high. To learn more about how threat locker can medicate unknown threats, ensure complaints for your organization, visit smashing security dot com slash threat locker that smashing security 点 com slash threat locker and thank key to threat locker for sponsoring the show。

And welcome back, and you join itself a favorite part of the show, the police show that we d like to call, pick as a week. Look at me. good.

Big the week is the about the show, everyone to send the right to be a funny story, a book that they were at, A T, V, show, a movie, a record to podcast, to website, or an APP, whatever they wish. IT doesn't have to be security related necessarily. That does not be.

Well, my pic the week, this week is not security related. good. My pic the week this week is a documentary, couple of documentary that I think I was on blue sky, checking out the feed loving blue sky.

And someone posted a link to a documentary all about a retail department store in the united states. Now most retail stores are pretty blind on these days, corporate and dying. If you've into one test goes or walk out, you been to them all, turns out, doesn't have to be that way. There was, between the mid seventies and the nineteen nineties, a company which had over two hundred stores across america. And its features stores were quite unique in terms .

of architects.

I have you have been two. MaDonna's, no.

they have weird architecture back there.

Anyway, best products company. Have you heard the best?

Me that they would outside would .

have been terrible for S, I would know they .

went background .

bed in the nineteen nineteen. And sadly, the buildings were not preserved, which is a shame, because the buildings were extraordinary. And there are a few documentaries up on youtube about these buildings and crown what up down this.

I'm sharing a few photographs of some of these buildings with these. They can check them out and wow, yeah, yeah, yeah. So you're looking, for instance, right now, add an image of a big concrete store, right? You can imagine that gravely cube or red tg, you know q boy kind of thing.

And it's like a piece of lego. There's a kind of IT which has been sort of ripped out. You can see all the jigged pieces, right? You're actually look at our photograph there of the opening day when .

the let off floats are blue to say, really, really wonderful. Pick the week. And this is basically gram trying to get to follow them on blue sky because i'm sure to show the.

But when the interesting things was, the guy who was in charge of the stores said, if I want to protect my store from people breaking in at night, what Better way than to have concrete walls all the way around the building rather than doors? So that bit you can see of the corner used to come out on tracks at the open, in the store, and then would close to make a perfect that there was another building where everything's slanted on the outside.

There was another one where IT looks like the buildings fall apart. There was another one I saw, which was actually sort of built in a forest. See, at the front of the store and behind IT is the forest. So you go through the front of the store and then you're in a forest and you Carry on and then you walk .

into the store and it's like all open up to the government. Disgusting that weren't even any.

I don't know, they are works of art. And there in the documentary you hear about people who to go to the fibre guy instead of gripping pass that be a stranger to the towns. Oh my god, I think this building is falling down.

It's sort of peeling away from itself and that, oh, no, hung on. No, no, no, you have to worry. Wow, that's how the building looks.

It's been built like that, and I think it's fantastic. I didn't know about this before. Love to watching the documentaries.

Super creative. We'll put the links in the show notes, uh, where people can learn more. What's your pick the week?

So my pick of the week was inspired by one of our listeners, one of you there, I shout out to mark o from bc, fellow canuck and fellow create lover, who wrote in about a recent pick of the week of mine, the cards cabage, which I still played very regularly and he also recently learned about the game uh, during covered, locked down and his preening usia tic just like me and mark o recommends a book called play winning created ge by dlink covert so link in the show notes and he's advising me to read this so I can kick my husband's boat at the game so love that strategy because we're planning a mini tournament over .

the cream bo holes. Don't let your husband .

know that you've got the book. He, he's too busy, so I don't have to worry, but I can let you guys all know, and you guys can do the same. And as an extra pic of the week, I have found a much Better crypt APP than the I recommended two months ago, where you can play with hints or with muggins muggs, where you get penalty.

Zed, if you can count properly, which turns out that happens to me all the time. But the APP is called crib ge. Classic by games, by post. L. C.

So link in the showers for that too.

and that song for android, apple, for sure. So the crib ge classic APP and play winning crib ge by dlink covert. Thank you very much, mark. Oh, that's my picture weeks.

Lovely stuff. And that just might wrapped up the shows this week. You can find smashing security on blue sky, unlike twitter, which wouldn't have have A G and don't forget to ensure you never is another episode low smash security in your favorite podcast step, such as apple podcast motifs .

and pocket costs, and shut out to our episode sponsors thread locker, blackberry and one password. And of course, they're wonderful. Take on community.

It's their support that helps us give you this show for free for expresso show notes, sponsorship for guys list and the entire pack. Catoche won three hundred and ninety four episodes. Check out smashing security com .

until next time. Cheerio, bye.

bye, bye E.

I got that wrong, three, nine.

five episodes.

many of the songs, grape is too many, too many.