Digest

This episode of Smashing Security explores the controversial new "Recall" feature from Microsoft, which records everything a user does on their computer. The feature has raised privacy concerns, as it could be used by abusive partners or governments to access sensitive information. The episode also features a discussion about a recent Department of Justice indictment against a woman accused of helping North Korean spies infiltrate US companies. The spies allegedly used fake identities to obtain jobs at major companies, then used remote access to steal data and money. Finally, the episode covers the top ten companies most impersonated in scams, with Best Buy Geek Squad, Amazon, and PayPal topping the list. The FTC recommends that people independently verify any communication that appears to come from a company, rather than relying on the information provided in the initial contact.

Outlines

00:00:31

Introduction

This Chapter introduces the episode of Smashing Security, hosted by Graham Cluley and Carol Terrio, and welcomes special guest Jeff White, author and journalist.

00:00:53

Jeff White's New Book

This Chapter discusses Jeff White's new book, "Rinse," which explores the world of money laundering and how technology is changing the industry. White discusses his interest in the topic, which stemmed from his previous work on "The Lazarus Heist," and highlights the importance of collaboration between cybercrime and financial crime experts.

00:02:30

The Recall Feature

This Chapter delves into the controversial "Recall" feature being built into Microsoft's new AI-augmented PCs. The feature records everything a user does on their computer, including screenshots, typed text, and web pages visited. The hosts discuss the potential privacy implications of this feature, particularly for users in countries with totalitarian governments or overreaching intelligence agencies.

00:21:01

North Korean Insider Threat

This Chapter explores a recent Department of Justice indictment against a woman accused of helping North Korean spies infiltrate US companies. The spies allegedly used fake identities to obtain jobs at major companies, then used remote access to steal data and money. The hosts discuss the implications of this case for cybersecurity and the importance of being aware of potential insider threats.

00:29:33

Top Impersonated Companies

This Chapter examines a report from the Federal Trade Commission (FTC) on impersonation scams. The hosts discuss the rise of impersonation scams, particularly those targeting businesses and government agencies. They also explore the top ten companies most impersonated in scams, with Best Buy Geek Squad, Amazon, and PayPal topping the list.

00:42:05

Pick of the Week

This Chapter features the "Pick of the Week" segment, where the hosts share their recommendations for books, movies, podcasts, and other media. Graham Cluley shares his experience with AI music generation, while Jeff White recommends a book called "Nuclear War" by Annie Jacobson. Carol Terrio recommends a television series called "The Patient" starring Steve Carell.

Keywords

Q&A

• What is Microsoft's new "Recall" feature and what are the privacy concerns surrounding it?

  Microsoft's "Recall" feature records everything a user does on their computer, including screenshots, typed text, and web pages visited. This has raised privacy concerns, as it could be used by abusive partners or governments to access sensitive information.

• What is the recent Department of Justice indictment against a woman accused of helping North Korean spies infiltrate US companies?

  The woman is accused of helping North Korean spies obtain jobs at major US companies using fake identities. The spies then used remote access to steal data and money from these companies.

• What are the top ten companies most impersonated in scams?

  The top ten companies most impersonated in scams, according to the FTC, are Best Buy Geek Squad, Amazon, PayPal, Microsoft, Publishers Clearing House, Wells Fargo, Apple, Comcast, Bank of America, and Norton and LifeLock.

• What advice does the FTC give to people who receive communication that appears to come from a company?

  The FTC recommends that people independently verify any communication that appears to come from a company, rather than relying on the information provided in the initial contact. This can be done by going to the company's own website or calling their official phone number.

• What is AI music generation and how does it work?

  AI music generation uses artificial intelligence to create music. Graham Cluley shares his experience with a service called "Udo" that allows users to create songs by providing a short text prompt. The AI is trained on a vast collection of musical styles and can generate music in various genres.

• What is the book "Nuclear War" by Annie Jacobson about?

  The book provides a hypothetical minute-by-minute play of what happens if North Korea launches a nuclear weapon. It explores the complex chain of events that would unfold, including the activation of various defense systems and the potential consequences for the world.

• What is the television series "The Patient" about?

  The series follows a therapist, played by Steve Carell, who is held prisoner by a patient with unusual therapeutic demands. The therapist is tasked with unwinding the patient's disturbed mind while also grappling with his own life and decisions.

• What is an insider threat and how can organizations protect themselves from them?

  An insider threat is a threat to an organization's security that comes from within the organization itself. This can include employees, contractors, or other individuals with access to sensitive information. Organizations can protect themselves from insider threats by implementing strong security policies, conducting regular security audits, and providing employees with security awareness training.

• What are some of the financial crime aspects of the North Korean spy case?

  The spies are accused of using fake identities to obtain jobs at US companies and then using remote access to steal data and money. This involves financial crimes such as identity theft, fraud, and money laundering.

• Why is cybersecurity important in protecting against both external and internal threats?

  Cybersecurity is important in protecting against both external and internal threats because it helps to ensure the confidentiality, integrity, and availability of an organization's data and systems. External threats can come from hackers, malware, and other malicious actors, while internal threats can come from employees, contractors, or other individuals with access to sensitive information.

Show Notes