Go back

Flight bomb threats and hacked fridges: A new frontier of cyber warfare

35m 21s

Flight bomb threats and hacked fridges: A new frontier of cyber warfare

This Telegraph Cyber Security Special features Camilla Tomini interviewing Jake Moore, a cyber security specialist at ESET and former Dorset Police digital forensics officer. The discussion highlights a rising wave of cyber attacks targeting unexpected areas, from supermarket refrigeration systems to flight bomb hoaxes and fake nuclear alerts. Moore explains that hacking internet-connected freezers was alarmingly easy because commercial operators used weak default passwords and failed to apply security updates, allowing attackers to switch systems into defrost mode and destroy food across several European countries. He notes that motivations vary from financial ransom to opportunistic teenagers seeking online kudos, while state-sponsored and criminal groups pose more sophisticated threats, as seen in the alleged North Korean-linked Binance hack that used a fake job interview to compromise an employee. The conversation also covers how attackers exploit human psychology through phishing, the role of AI vulnerability scanning tools, and the importance of human override safeguards in aviation and autonomous systems. Moore stresses shared intelligence and learning from breaches. He advises individuals to use unique long passwords stored in password managers, enable multi-factor authentication and passkeys, adopt a zero-trust mindset, and always install updates promptly.

Transcription

6593 Words, 35232 Characters

English
Speaker 1The Telegraph Nuclear alert hoaxes, flight takeovers and even hacks on fridges. A new frontier of cyber attacks is upon us and it seems no facet of technology is exempt. Why are we seeing such a rise and can we even keep ourselves safe? Welcome to this Cyber Security Special Daily Tea with me, Camilla Tomini. It is perfectly feasible to think that the machines could take over the controls of a plane.
Speaker 2I don't want to be all about the doom and gloom that is possible. We've seen the movies, we know what they're writing about. But really we've got to act now, this is at a government level, a company level and on us as individuals. Making sure we are doing the best we can to protect what we've got in front of us. Because there is this big AI vulnerability scanning tool. That is now available.
Speaker 1Jake Moore, thank you for joining me on the Daily Tea, says here you're a cyber security specialist at ESET, an internet security company. So I'm thinking if you're an expert on hacking, can you also hack?
Speaker 2Well, ironically, the police taught me. Did they? Yeah, I spent 14 years in Dorset Police in digital forensics and the cybercrime team. But to work in the cybercrime team, they send you on a hacking course. Oh, handy, alright and we're going
Speaker 1to get into kind of fridge freezers and the hacking of those and flight hoaxes and all the rest of that. But as part of your day to day job, how are you assessing the threat posed by hackers to different companies?
Speaker 2Yeah, so I'm researching all the weird and wonderful things that hackers are doing today, trying to predict what they're going to do in the next 12 months. And then often I get to test what they are actually doing, which might mean creating malware and sending that to see if it can actually do anything that it's been asked to do right the way through to sending phishing emails to people and seeing if they're clicking on them. Or offering up one time passcodes. So a lot of the social engineering side of things and that can really help with companies realise where their threats really lie and so they can learn from that in a safe environment.
Speaker 1I mean, we're all used to big companies suffering data breaches and all the rest of it. I suppose normal people that don't have that much of an insight into kind of the cyber world go about their daily lives thinking that big businesses would be well protected. And then we hear things like fridge freezers being turned off across Europe and many people who aren't there. Who aren't that tech savvy will go, well, I didn't even know fridge freezers were linked to Wi-Fi or the internet. I thought they were just plugged in at the wall and turned on and on. And I know that sounds a bit naive, but what's going on here? Because it's one thing to say, oh, no, we've had a password breach and can everybody please be vigilant? And quite another to suggest that hackers have the capacity to basically shut down supermarkets and goodness knows what else.
Speaker 2Well, the worrying thing is it's actually extremely easy to do what they have done. So if you think about it, these appliances, these freezers, they need to be on the internet. So the engineers can, at scale, look after thousands of appliances at once from a remote location. They can check the temperatures, they can move them up or down if they need to, and making sure everything's working, making sure they are actually still on, for example. But with that, there is a level of risk. And so ideally, that should be on a private network. So it then can't be hacked. They also need to be up. They need to be updated, like our phones and our laptops. They come with updates quite regularly. It might feel like a bit of a pain, but they're packed with security features that make them much, much safer. So anything that's on the internet, whether it's a fridge freezer, a toaster or your phone, they need to be updated. And unfortunately, at this commercial level, you'd assume they'd be updated, but unfortunately they weren't. And then hackers were able to scan the internet, look for those vulnerabilities, very quickly spot that they're out of date or they're using old machines, and therefore they're able to send what they want to them, in this case, turn them up using the defrosting mode. And that's what destroyed all the food.
Speaker 1Okay. So just to reiterate, what happened was that refrigeration systems were attacked in Ireland, Sweden, Belgium, Luxembourg, the Netherlands and Estonia. That's less than a month after a similar incident had affected hundreds of supermarkets in France. So this has become some kind of, I don't know, phase, hacking phase. You'd ask yourself, why? What's the point of it?
Speaker 2That's a good question. We're so used to seeing criminals looking to financially gain from a hack. So they might have a ransom demand on data that they've stolen and say, we're going to release this unless you pay us the £2 million ransom that we're giving you. And often they might pay up or they might not. But you've also got opportunistic hackers, often quite young. So talking teenagers, they might just look for the fun of it. And I say that with knowing that we do have young hackers that want to test. And they. They get kudos from their friends and their peer groups online. And if they can say, well, amongst those peer groups that they've done this, they get a lot of kudos to be able to say how easy it was. And it's even laughable amongst these hackers. But that's a real worry because it's causing mass disruption. There's potentially no end in sight. They're only going to scour what is available to see what is possible. And if they can do this now, I'd expect. They're going to be even more creative over the next few years.
Speaker 1Yeah, it's almost as if it's kind of the elaborate pranks that we've witnessed on YouTube taking on a whole new meaning now.
Speaker 2At huge scales.
Speaker 1When it comes to major businesses like that, you mentioned private networks earlier. I mean, first of all, again, it's generalised, but can any online network ever be truly safe from harm?
Speaker 2No, but there is so much they can do to make it much safer. There's a report that some of these devices had admin level passwords. So very simple to guess passwords, just a few numbers.
Speaker 1One, two, three, four, five or something like that.
Speaker 2Yeah, even less than that. And that's embarrassing on their half. But at the same time, you've got to realise why they do this. They're looking for convenience. And they're also potentially thinking no one would ever do this. At most, they might have thought that someone might have turned off the freezers, if possible. And if you turn off a freezer, you generally have 24 hours to move that food to another freezer that might be on. By turning them up, you destroy the food. And that's, in my view, potentially something that they never thought was on their radar. But they've missed so many of these securities that are available. They are costly, though. So just like your phone, after, say, six, maybe seven years, your phone won't be given the security updates. But with freezers, with any appliances that's given software inbuilt to it, it will have. a use-by date. And therefore, those fridge freezers might come to the end of their life when they're not updated.
Speaker 1But, like, an older person might think to themselves, and we have this all the time, people writing into the Telegraph raging against the machine, literally, be it parking apps or online banking systems, and question whether this is progress. I mean, presumably, the supermarkets of Europe used to survive perfectly happily plugging fridges and freezers in, not having them on any. any kind of online network at all. Presumably, a man or a woman would go around with a clipboard, check the temperature. I mean, are we actually sort of putting ourselves in danger by having so much hinged on the Internet? Another example has been given in recent days about, I think, new Google technology, which might allow somebody to press a button and open their front door. Look, we all know about Ring technology, and that may have advanced the case for home security. But at the same time, are we just basically kiboshing? Are we kiboshing ourselves with this constant chase for new technology?
Speaker 2It's a great question. There's a lot going on. People want to have the latest technology on an individual level. But if you look at it on a commercial level, they're looking at cost savings. Being able to control thousands of freezers that are looking after these products, not actually in the supermarkets, but elsewhere, it's much easier to control them from a single point miles away. And then they control all of those locations at once. So anything like that, to them, cost-saving, it's technology that is helping them out, making them more efficient.
Speaker 1And by the way, that probably outstrips a week's worth of lost stock.
Speaker 2Yes, but they equally try to cut corners on security. We know this. There are decision makers that think, well, it might not happen. Let's wait to see if it does, or it won't be as bad as what we've maybe thought of. You have security teams that are giving all of these scenarios to the decision makers. Yes, always. Because they're the ones that are saying this is possible, and they might give it a risk value. But if they're not accepting that risk, and they're not, say, defending against it, which will have a cost associated with it, then unfortunately, they'll look for that cheaper option and hope for the best. But that's not an option when it comes to security. We know we need to resource it better.
Speaker 1Also, consumers will be like, well, fine, if you've taken some shortcuts and it's lost you some fish fingers and some petit pois, that's your problem. What about if companies are taking shortcuts? Well, we know
Speaker 2that they do. So when it comes to data, what you'll find on the consumer market, fridge freezers, for example, will often come with internet connectivity. And they'll offer some sort of function that sounds really cool to the user. Like, you'll be able to start the defrosting from a different location when you're not at home.
Speaker 1By the way, I do question that. Why do we need to do this? Why on earth would you decide to defrost your fridge from mud? Do you know, all I'm saying is. It's marketing there, right? I know, I get it. But sometimes some of these functions, oh, get a camera and have a look inside your fridge and see whether you've got. got enough brie left or alternatively get home have a look at the cheese compartment and maybe go to the supermarket the following day
Speaker 2there's actually another point to this when i actually looked into this uh about five years ago when the internet of things was really taking off in the kitchen i started to spot that some of the internet connected devices were actually cheaper now i don't know for sure but my assumption into this research was they were making those ones cheaper because they wanted you to buy the internet connected appliance because if you do you then give them your data you you then tell them uh not only your price bracket but maybe what's going in that fridge if it's got a link it it might tell you when you use your dishwasher it might tell you how often you defrost it might be able to guess when you're going to do something but they the uh manufacturers they are not the ones that look after the data a third party company is the one in control of it so when we hear of these data breaches they're often not the big manufacturers they're the separate third party uh data handling company similarly what we saw with asos recently another company's brought in it holds all that data but once that's breached you lose everything so
Speaker 1tell us about asos i mean for the uninitiated it stands for as seen on screen it's a long-standing internet clothing company beloved by men women girls boys everywhere yeah what happened this
Speaker 2was a really strange hack actually it was the first time that i've ever seen um the ransom note sent out as a notification to all of their customers that had notifications on on their phone so the note went to them to say hey it we've got your data effectively pay up and assuming that's when the rest of the company and all the customers knew that their data had been breached now in the hours and the days after that there was a huge panic about what level of data was stolen was it just username maybe was it financial uh maybe password passwords it wasn't financial data and it wasn't password data which is great they usually kept in a separate uh more encrypted more secure department but the uh data on what you might have been looking for or what you might have even purchased owned by a third-party company was siphoned out uh from the employee's account that was hacked and then they got hold of this data that's valuable to people that are sending phishing emails that might now be targeted by saying i know your username and what type of uh what type of clothing you've been looking up and what you've been buying and therefore we must be asos so click on this link so
Speaker 1it's like using intel to convince people that they are who they say they are even though they're
Speaker 2obviously not yes and this works very well uh because when you uh get a phishing email it's often quite obvious but when they know so much about you the last four digits of your card uh your address the last few items that you've bought you let your guard down a little bit less each time you think it must be them
Speaker 1and that's when they strike although whenever you receive a dodgy email don't you always just go to the sender and check whether it is actually from ebay.co.uk or somebody else that's a perfect
Speaker 2world and i get it there are people that um that don't because they don't have the time to do that for example they might doesn't
Speaker 1have the time to check whether an email is coming through from somebody calling themselves happy dogster 1586 or an actual legitimate company well that email is
Speaker 2often hidden because they're safe they are saving space on your screen for other things yeah so an example is uh i love this that my dad sent me what was clearly a phishing email uh from ebay and he said is this a phishing email i said dad have you got ebay he said no i i did wonder i know but this is
Speaker 1when boomers send stuff through to their kids going is this ai it's like a talking baby yeah and you're saying guys okay so there are vulnerable people out there and we're talking on a very kind of commercial consumer level here let's go a bit more macro and talk about flight hoaxes i ask about the jumbo jets jake because we've had seven flights across europe targeted by suspected bomb threats so again this is about sowing the seed of fear um these were hoaxes they ground flights they then ruin holidays for people they ruin business trips this is the other worry that we have that there is the capacity to keep planes on the ground let alone take them out of the sky
Speaker 2yeah and this is a fear tactic again and it's worked in their eyes remarkably well we don't want to see planes grounded uh we definitely don't want to see planes in trouble once they're in the in the sky so this is another way to learn from it and i always try and be positive from any attack or any compromise is to learn from it yeah hopefully we can divulge into the weeds of this some of the best companies out there that have been hacked will actually blog exactly what's happened uh one of those examples is actually binance now are really trying to to delve into the weeds of what uh the supposed north koreans have done with that employee's laptop by learning that themselves is brilliant but by sharing that knowledge with every other company so by sharing how they were able to send that message to those airlines that makes every other airline understand what those what the threat landscape is like for others and for everyone currently and we can all work together and this is about shared intelligence which is a vital part in this whole landscape that we're seeing is there a possibility that hacking could
Speaker 1become so sophisticated that god forbid it brings down a jumbo jet i think
Speaker 2that's a bit extreme and i don't want to be all about the doom and gloom that is possible we've seen the movies we know what they're writing about but really we've got to act now uh this is a government level uh company level and on us as individuals making sure we are doing the best we can to protect what we've got in front of us because there is this big ai vulnerability scanning tool that is now available an ai vulnerability scanning tool is a technology that uses super powered uh intelligence to look for vulnerabilities in software or in a website or in a database humans can do this it takes time ai has come along and it can very quickly just find those vulnerabilities now
Speaker 1somebody's developed the ai to do that
Speaker 2by the way not somebody we have by giving data ai is is it's the engine is the data that's on the internet and we have created that and shown them and that's that's going through forums like reddit it's going through research papers uh university data so much data is there but this is first
Speaker 1of all i'm noting something quite scary you're not saying no to the question of whether hackers could bring down a jumbo jet which then puts kind of global terrorism in a completely new light because traditionally we have expected human agents to bring down planes by hijacking them or in the case recently of you know training as a co-pilot and trying to attack them with an axe held in the cockpit and all the rest of it i mean it's perfectly fine but it's not going to work and it's not going to work and it's not going to be feasible without turning into linda hamilton from terminator it is perfectly feasible to think that the machines could take over the controls of a plane
Speaker 2that's why we give so many human overriding tools so the human in the loop as we call it on a plane could uh take over that plane if the machines are playing up and this is where machines work well with humans we still have them in other areas but less and less are humans needed but there's still often an override button that effectively says i don't like what you're doing uh this is out of control the human takes back the control it's like an autonomous car if if it feels like it's speeding up there should be able the human in the car should be able to tap on the brake yes and it work but
Speaker 1the suspicion is that technology is advancing at such a pace that it might outpace human override i suppose that is the terminator
Speaker 2theory right yes but i think we're so many years off that now but if we're
Speaker 1it still could happen yeah that's not going to happen in the next 10 years but it might happen in the next 50 and that's what i've got right now well well yeah but then then then jake at the end of the day we're getting back to the kind of anthropic and other warnings that we're all going to be killed by the ai that we have ourselves developed so isn't it astonishing ai is feeding off human nature human intelligence human research human knowledge and potentially poised to use it against us to create an existential threat for life on earth yes but
Speaker 2that's why we have to build those safeguards in now we've heard the warnings i don't think it's too late we we know of many people that have left those huge ai companies but often you've got to remember that some of them have gone and created startup companies that want the marketing and free advertising so we've got to think that yes the technology is possible and again we've seen the movies but by building into this software the human in the hope the the safeguards that are that should hopefully be far better than what we have seen but it is improving in those areas so two years ago uh i was able to get ai to make me malware uh for example now it won't maybe a year ago you could bend the rules and say oh and i did this i said oh i'm a security researcher he said oh why didn't you say so and it would then help me out but now and i continually continually test these things out and now if you try any of these rule bendings uh it says no we're taught not to do this and so it feels like the curve will flatten off right and that's what where we all play our part in this i mean i would say to anyone that's listening to this is learn as much as you can about ai because it's not going away and the more we know about it i think the safer we'll actually become we are moving to a world where these ai agents are coming in so it's not just talking to an ai chatbot like we would google and just ask a question and come back with an answer we're looking in the future that ai agents will be acting on our behalf in whatever we offer it to okay
Speaker 1well why don't we get into then sort of cyber cosplay so we have this situation where we've got fake nuclear warnings being issued after ukrainian and russian air alerts apps were hacked because the other effect of this is something might not have happened at all yeah but there is the potential for some bad actors to spread terror across the world simply by hacking and then having a situation where they're not able to do anything about it and then they're not able to do anything where people are being given false information
Speaker 2yeah actually i see this is really bad actually because this is hacking trust and it's weaponizing fear and for me that's what really damages the future because once you damage trust you don't then trust a genuine notification that says you've got to move or you've got to stockpile we want to be able to trust what we hear and what we are seeing as as breaking and once fear has has come into being weaponized i think people then really panic and that can cause a wave of other effects we all saw what happened in covid when we thought that toilet paper might go off the shelves people ran to get toilet paper and that's something that that moves away from teenage hackers having just a bit of a laugh may point towards, say, state-sponsored attackers, or it may go further to those criminal groups that are looking to potentially break financial departments and steal huge amounts of money. On top of that, yeah, we have to make sure critical infrastructure is secure. Breaching, I would say, moving away from the supermarkets for one moment, not to call that critical infrastructure, just for this, moving into what we really see, grid and so on we want to make sure they are the best protected but if we bring in ai as a worry here we are equally using ai to protect so we're having uh fire being fought with fire and and that's where we're moving to we've seen what we call machine learning over the last 20 30 years so it's building on learning data and helping look for anomalies or anything that might be something that is a worry. And now we're letting those models decide for us, but still working alongside humans. And with that, I think we could be able to protect the future.
Speaker 1But when we talk about state-sponsored hacking, let's also look at North Korea being forced to deny that it was behind this record 6.3 billion hack of Binance, which has affected a great many people. This is a cryptocurrency giant and its digital assets were impacted by what is thought to have been the biggest crypto hack on record. Now, this is the other concern, of course. It's all very well what we're regulating both in Europe and America and what we're working on in the we have no idea what kim jong-un and others are up to what could they be doing on ai or any of this stuff behind extremely closed doors in total secrecy yeah so what
Speaker 2we're looking at here is very sophisticated uh ways in so what it looks like with the the binance attack it is impressive on a criminal level i have to take my hat off if i'm thinking like a criminal like i used to in the time binance had a lot of uh privilege privilege access within the terminal so the computer that the employee who was targeted uh had to offer so if the north koreans or the alleged north koreans sent this uh link with an um an executable file to download onto that machine often packaged in a way that there is um a job interview at the end of it so it might even look like zoom or an equivalent of zoom that's quite normal many companies say we don't use zoom or teams we use our own bespoke software when you're dangled a carrot that says we've got a three hundred thousand pound job which will be perfect for you because they've looked them up on linkedin we know that they're looking through linkedin looking for people with the right skills looking to see where they work it's open source research at their fingertips they pick the right person they dangle the carrot they say let's go for the job interview when they click on that link download uh what looks like a video conferencing cool piece of software but in the background when the research has been thrown at it it is doing so much more it is stealing data it's looking for passwords looking for uh bitcoin and other cryptocurrency wallets that might give them access but if they're able to then act as that employee on that laptop they can do so much more so really it's the sophistication of how they're getting to the human but we need to learn from this again it's all about how they're getting to the human and how they're getting to the human it's all a big learning uh surface here that we shouldn't have just privileged access on one person's laptop that can open up billions of dollars of loss and this is where we should have more fail safes but i think up until now we never thought it would happen and i think in the last month if anything's being uh taught to us it's expect the unexpected isn't it astonishing
Speaker 1as well how i think when people think of hackers they're kind of thinking about matthew broderick in war games or something and actually some of the conduits into these big businesses are so basic and straightforward targeting an individual employee who research has revealed might be job hunting and then send them a speculative email like it's so tapping into funny enough it's it's it's to hack into the technology through very human routes so then and how do you ward against that but of course even at this company you know we get little test emails where the data department sees if we're going to click on something phishing and then you'll be taken to a page saying why have you clicked on this and let's re-educate the the staff about cyber security but human beings will tend to click on things mistakenly and this
Speaker 2is it i'm fascinated by this this is the psychology of humans and it's called hacking the human and criminals have been doing this for years we're talking hundreds of years you look at the old classic khan on the street the whole follow the ball under the three cups it's wonderful how they're using this they're using other people that are in the crowd who might win just before they actually go for the target who then loses everything of course the same thing has just moved on to the onto the internet and if you can target someone's brain through psychology you can get so much further and these are being tweaked all the time the software in the background which is now the malware yeah that's
Speaker 1that's been around for a while it's been around for a while now it's been around for a while now it's been around for a while
Speaker 2yeah and they're very good at it and unfortunately humans think they are their their best uh advocate of being secure they think they're they're foolproof but if you package it up correctly enough everyone's got their limit of where they might think well that makes sense because if you get an email from your bank um that you sorry if you get an email from a bank that you don't bank with that you know straight away yeah that's a phishing email but if you get an email that's from your bank that you've just moved to and it says there's a there's a problem with your bank account without any numbers in there anything you put that into the narrative that you've got in your mind of well i have just moved bank and there might be an issue yeah i better call the number on the back of my card but it says i can just chat to someone here on this link so yeah you know what
Speaker 1that's easy all right i'll click that but has jake got any rules for life that he lives by in order to protect himself yeah i mean are you somebody who is literally tapping in an 18 digit code into their iphone in order to open it and all this kind of stuff not far off really how long is your code to open your iphone i don't want to say go on please 10
Speaker 2is it yeah but my six face id though right face id is wonderful to get into a phone yeah you never type in that six digit code i imagine sometimes maybe
Speaker 1you know when it doesn't recognize your friend with my glasses late at night no makeup on it but who the hell is this ugly bird but the
Speaker 2fact is you don't type in that number often why why keep it short some people will actually override an iphone pin code and make it just the four digits or not even have one because they want ease and this is the security people who
Speaker 1don't have a code on their phones total
Speaker 2maniacs uh yes um if you're if you have a code that is related to you uh i would i would say that you are uh falling at the first hurdle
Speaker 1okay all right and then tell me some other jake rules for life because i presume that if you're in this world you're not going to embrace this
Speaker 2technology so well first of all i would say zero trust we use zero trust as a rule in business where we just don't trust anything and until we really have proof there's authentication and verifying who that is or what that is but um in the real world it's uh it's a few rules so passwords passwords need to be unique many people are still using the same two or three passwords or derivatives of because they can remember them no
Speaker 1they're not honestly So, are you telling me you've got a different complicated including special characters password they're all
Speaker 220 characters long i don't know any of them i keep them in a password manager and this is kept on a secure cloud that only me my devices using biometrics can get into but after that you then need multi-factor authentication yes and with multi-factor authentication so at the very minimum a one-time code sent by text message that comes to
Speaker 1you at the base level is that an otp
Speaker 2yeah that's right um
Speaker 1but hang on a minute so jake is just trying to put a shop in a cardo and doesn't jake have a moment where for some reason this bloody app doesn't recognize the password that you know you've put in that you know is true because it's been saved in a password manager and then you're jumping through 15 other hoops trying to get a password through to another laptop through to another phone and by the end of it you're wondering why you didn't just put my dog's name one two three and then you're trying to get a password and then you're trying to get a password through to another laptop through to another phone and by the end of it you're wondering why you didn't just put my dog's name one two three and then you're trying to get a password through to another laptop through to another phone
Speaker 2three no never ever use anything connected to you because if you're using your dog's name i've done this i mean it was one of my party tricks at a wedding sitting on a table and guessing people's passwords or codes to get into their phone because just purely because i've i've looked them up on social media in the 10 minute break so really if you're if you're pasting um your dog on facebook and then using it as your password you're you're pasting your password on the internet for everyone to see yeah and people will always do this and it's because again it comes down to security versus convenience and we want things to be convenient but uh at the risk of convenience you then get rid of security okay
Speaker 1so we've got a rule for life which is a 10 digit code to open the iphone or android we've got a no trust policy do not trust anything you're ever sent check check and check again journalistic mantra yeah third of all minimum 10 digit passwords they must all be different they must be securely locked up
Speaker 2now sorry i'm gonna i'm gonna say minimum 16 characters it doesn't matter though because you're not creating it the password manager will create it for you got it even
Speaker 1better you do get the password so when people go no override i'm not getting this bizarre password manager to give me a bizarre thing with and for sands and explanation marks and goodness knows what else in you opt for that every time save it in the separate manager okay
Speaker 2android and iphone will help you out with
Speaker 1that all right give me another jake rule for life
Speaker 2so on top of that then pass keys so pass keys are the latest thing that say you know what we know that you can't remember all your passwords so would you like to transfer to a pass key lots let's say uh whatsapp offers it uh social media your email these are the right the the core functions of like your everyday life that you might go to every day they're offering you pass keys they use the biometrics uh from your phone so if you have a face id or a fingerprint id phone um it takes that and it keeps it nice and secure and encrypted and then you can use the pass keys to transfer to a pass key it then knows your device so it means that only you and your device can get into that account so if i were to somehow get your password and i'd get it onto a different device and i try and log into your email it's just going to say no we're not allowing this because we need a pass key and the pass key only works with your face on that device because they're the only and maybe your laptop because they're the only two devices that you said can go into your email anyone else is locked out gotcha it's perfect but you know the irony of this is pass keys are the only devices are so good that people think they can't be secure because they're
Speaker 1too convenient oh okay all right and then finally when people say well nobody's interested in hacking me because i'm just a nobody well that's when
Speaker 2i would say make sure you're doing all your updates so when phones and laptops are saying please update me please do that because you are not who you might think you are you are a number so when criminals are looking at information on the internet or looking at ip addresses you are literally numbers so in the case of the fridge freezers they would see each of those fridge freezers as a number and they would know that they are not updated they can then read the uh the software remotely and send some information to it in this case turn it up so in an individual case it knows that you are out of security updates yes so there's you have not patched a vulnerability that apple or google have found and therefore i can then take control of that device so when they are offering you these updates do it all
Speaker 1right final question do i need to start doing push-ups get myself a white singlet vest and know how to operate a pump action shotgun with one hand linda hamilton style whatever you do in
Speaker 2your free time that's up to you
Speaker 1well thank you very much indeed for joining us on today's
Speaker 2daily tea thank you you

Podcast Summary

Key Points:

  1. Cyber attacks are expanding into everyday and industrial technology, including supermarket refrigeration systems, flight hoaxes, and internet-connected appliances.
  2. Jake Moore, a cyber security specialist at ESET and former Dorset Police digital forensics officer, explains that many attacks exploit simple weaknesses such as default passwords and outdated software.
  3. Hackers turned up defrosting modes on internet-connected freezers across several European countries, destroying food and exposing poor security in commercial supply chains.
  4. Motivations range from financial ransom demands to opportunistic teenage hackers seeking kudos, with state-sponsored actors and criminal groups posing more sophisticated threats.
  5. The Binance hack, allegedly linked to North Korea, involved targeting an employee through a fake job interview and malicious download, showing how human psychology is exploited.
  6. Fake nuclear alerts and flight bomb hoaxes weaponize fear and erode public trust in genuine emergency notifications.
  7. AI vulnerability scanning tools accelerate the discovery of weaknesses, but AI safeguards are improving and human oversight remains essential.
  8. Individuals should use unique long passwords, password managers, multi-factor authentication, passkeys, zero-trust habits, and regular updates to stay safer.

Summary:

This Telegraph Cyber Security Special features Camilla Tomini interviewing Jake Moore, a cyber security specialist at ESET and former Dorset Police digital forensics officer. The discussion highlights a rising wave of cyber attacks targeting unexpected areas, from supermarket refrigeration systems to flight bomb hoaxes and fake nuclear alerts. Moore explains that hacking internet-connected freezers was alarmingly easy because commercial operators used weak default passwords and failed to apply security updates, allowing attackers to switch systems into defrost mode and destroy food across several European countries.

He notes that motivations vary from financial ransom to opportunistic teenagers seeking online kudos, while state-sponsored and criminal groups pose more sophisticated threats, as seen in the alleged North Korean-linked Binance hack that used a fake job interview to compromise an employee. The conversation also covers how attackers exploit human psychology through phishing, the role of AI vulnerability scanning tools, and the importance of human override safeguards in aviation and autonomous systems. Moore stresses shared intelligence and learning from breaches.

He advises individuals to use unique long passwords stored in password managers, enable multi-factor authentication and passkeys, adopt a zero-trust mindset, and always install updates promptly.

FAQs

These appliances are online so engineers can remotely monitor and control thousands of them at once for efficiency. When they are left on public networks with weak passwords and outdated software, hackers can easily find and exploit them.

Not all hackers are motivated by money. Some are opportunistic, often young, and do it for fun, kudos, and peer recognition, even though it causes mass disruption and food loss.

It was unusual because the ransom note was sent directly as a notification to customers' phones. The stolen data came from a third-party company that handled it, and while financial and password data were not taken, the breach enabled more convincing targeted phishing.

Jake Moore says it is feasible in theory that machines could take over a plane's controls, but aircraft include human override tools so a pilot can retake control. He considers full machine takeover an extreme, longer-term concern rather than an imminent one.

It is AI-powered technology that quickly finds vulnerabilities in software, websites, or databases that would take humans much longer to find. Because it lowers the skill and time needed to find weaknesses, it makes attacks easier and faster.

Attackers researched employees on LinkedIn and sent a targeted link disguised as a job interview or video-conferencing tool. Once downloaded, it stole data and credentials, and because the targeted employee had privileged access, it opened the way to a massive loss.

Chat with AI

Loading...

Pro features

Go deeper with this episode

Unlock creator-grade tools that turn any transcript into show notes and subtitle files.