Episode 166 - The Potato Quality Episode

This week in InfoSec (11:51)With content liberated from the “today in infosec” twitter account and further afield6th September 1987: Thomas Haynie was accused of intentionally jamming Playboy's satellite network with a text-only message. Haynie was an uplink engineer at the Christian Broadcasting Network and was on duty at the time of the jamming. He received 3 years of probation. CBN engineer denies pre-empting soft-porn movieshttps://twitter.com/todayininfosec/status/1302620593322438656 Rant of the Week (20:12)If you like to play along with the illusion of privacy, smart devices are a dumb ideaDepressingly predictable research from Which? serves as another reminder, if one was needed, that furnishing your home with internet-connected "smart" devices could be a dumb idea if you'd rather try to preserve your privacy.The consumer rights organization's analysis of a number of IoT products – from speakers and security cameras to TVs and washing machines – found that they all demand customer data above and beyond what is needed for the product to perform its function, and then distribute that information to a horde of faceless corporations.Consumer campaign group Which? pointed out that this means consumers are not only in many cases paying thousands for the product itself, with all its "smart" connected bells and whistles, but continue to pay in the form of their personal data.The outfit broke down what information is required to set up an account with the product manufacturers, what permissions the associated apps request, and what customer activity companies are tapping into.Spoiler alert: it's all for ads and marketing.Disturbingly, every single brand examined required both exact and approximate location data – as though your fancy washing machine needed to "know" where it is to clean your clothes. Billy Big Balls of the Week (28:52)Guy who ran Bitcoins4Less tells Feds he had less than zero laundering protectionsA California man has admitted he failed to bake anti-money laundering protections into his cryptocurrency exchange, thus allowing scammers and drug traffickers to launder millions of dollars through the service.Charles James Randol, 33, who is now due to be sentenced, faces a maximum of five years in federal prison and three years supervised release, plus a fine of up to $250,000 or twice the total illicit proceeds from the scams, whichever amount is greater.Randol provided cryptocurrency exchange services in various ways, including via the post, ATMs, and occasionally in person, prosecutors told a Los Angeles federal court on Tuesday. The Santa Monica man would handle crypto-cash transactions exceeding $10,000 without knowing who his customers were – folks known only as "Puppet Shariff," "White Jetta," "Aaavvv," "Aaaa," and "Yogurt Monster," for example – which is hardly in line with regulatory requirements.To stay on the right side of American law, Randol should have verified and recorded their identities.In his plea agreement, the cryptocurrency dealer admitted to three in-person transactions between October 2020 to January 2021 in which he gave an undercover FBI agent a total of $273,940 in cash for Bitcoin, and kept a four percent commission fee. Randol "did not request a name, proof of identity, social security number, or any other information about [the undercover agent] or the source of the funds being exchanged," the plea agreement says.[Good comment]: Working for an American financial institution, we must go through mandatory AML (anti money laundering) training each year, and the consequences for the firm if an audit finds a violation tend to be in the high 6-digit payouts.With that in mind, a kid operating a blatantly open money laundering gig takes a proportionally much smaller punishment (assuming white-glove inmates usually manage to leave the can way before their time is served)] Industry News (36:14)UK Electoral Commission Fails Cybersecurity Test Amid Data BreachCrypto Casino Stake.com Back Online After $40m HeistUK Government Backs Down on Anti-Encryption StanceHundreds of Scam Pages Uncovered in Major Investment Fraud CampaignThink Tank Urges Labour to Promote “Securonomics” AgendaChinese Hacker Steals Microsoft Signing Key, Spies on US GovernmentIBM Reports Patient Data Breach at Johnson & Johnson SubsidiaryUK and US Sanction 11 Russians Tied to Conti/TrickBot RansomwareZero-Day Flaw Exposes Atlas VPN User IPs Tweet of the Week (44:39)https://twitter.com/KimZetter/status/1699546860187472034 Come on! Like and bloody well subscribe!