Distant-control rickshaws and rogue e-book entrepreneurs • Graham Cluley

Hi there, whats up, and welcome to Smashing Safety episode 476. My identify’s Graham Cluley.

Now, you have been a busy chap, have not you, within the final week or two along with your newest — effectively, do you take into account your self a content material creator or does that gag barely behind your throat?

It simply sounds a bit medical, you already know, an actual individual.

However sure, I have been creating content material, particularly a brand new sequence of what was the Lazarus Heist podcast and has now been renamed Cyber Hack.

We’re on season 4 of Cyber Hack now, truly. So simply printed, which is all a couple of gang that shall be very acquainted to you, Graham, the Conti ransomware gang.

It is all the time irked me that there was this superb leak of inner chats from Conti.

All of the issues they typed to one another for 2 years mainly spilled all around the web, for causes that we go into within the podcast.

And I would all the time kind of puzzled — I would seen folks like Brian Krebs had achieved articles and folks had kind of achieved issues with it, however no one appeared to form of actually do one thing thrilling with it and familiarize yourself with it.

So I believed, effectively, that is nice. The podcast has received a possibility to return to these leaks and actually mine them.

And I immediately realised why nobody had achieved something with it actually spectacular — it is as a result of it is horrible. It is all in Russian. It is hacker slang Russian.

As a substitute of getting the chats although, they chatted to one another, it is simply multi functional steady order. It’s truthfully eye-bleedingly troublesome to undergo.

I went via 47,000 of the messages earlier than I gave up. I used to be like, I’ve achieved sufficient. I’ve achieved my job. However what you get is superb.

You get the precise folks speaking themselves as they had been doing the crime, bitching, slagging one another off, speaking about their wives, their girlfriends. It is superb stuff.

It’s genuinely superb.

We’ll be listening to about them some extra afterward within the podcast.

This week on Smashing Safety, we can’t be speaking about how a ransomware negotiator has been jailed after working with hackers to extort shoppers.

You may hear no dialogue of how customers of LastPass and Bitwarden have been focused with faux safety alerts.

And we can’t even point out how a German textile agency has filed for insolvency, blaming a ransomware assault which shut down manufacturing.

So Geoff, what are you going to be speaking about this week?

And what I have been doing again to the scammers.

All this and far more developing on this episode of Smashing Safety.

NordLayer is a community safety platform constructed for companies. Proper.

It is a scary world on the market for travelling employees.

Nevertheless it goes effectively past simply encrypting the connection.

You get centralised management over who can entry what primarily based on their identification, their machine, whether or not their machine is definitely compliant.

And if somebody leaves the corporate, you revoke their entry instantly.

So if somebody in your workforce has began utilizing some AI software that your safety workforce hasn’t accredited—

Use the code NLsummer26 at checkout.

When any individual’s been silly sufficient to depart their telephone unlocked on the desk subsequent to me, I’ve often taken a few suspect selfies or one thing, or despatched a silly message to any individual.

Simply to remind them that you must lock your telephone when it is not attended. That degree.

And I believed, effectively, it form of makes the purpose, however on the identical time, it is a bit of a dickish transfer. I do not—

I imply, you might take another person’s telephone, you might change their autocorrect settings. So each time they sort “regards”, it modifications it to “love and kisses” or one thing.

One I heard about is you may take a screenshot of somebody’s dwelling display screen on their telephone and set it as their wallpaper.

So their wallpaper is all their icons, and you then transfer all their apps right into a folder on their very own. And naturally they’re clicking on issues, pondering, why does not this work?

Why, what’s incorrect with my telephone? Is my display screen not working?

I tut away and shake my head disapprovingly. It is all very juvenile. You should not fiddle with another person’s telephone.

However what if folks had been to make use of their very own telephone to drag a prank on another person? That’s one thing which has been taking place recently in India.

The truth is, a couple of thousand folks in India came upon in current weeks that one thing somewhat dangerous has been happening.

And it has been somewhat worse than altering somebody’s telephone so it rings an alarm at 3 o’clock within the morning and wakes them up.

You realize, it is worse than that form of soiled trick you are able to do. What they’re doing is that they’re standing on a busy avenue, proper? Think about the scene.

You are in North India, you are standing on a busy avenue. Noticed the site visitors going previous. And—

That could be a actually, actually busy avenue probably.

Properly, one thing a bit of bit like that has been happening as a result of there have been individuals who discovered that each one they should do is open up an app after which with a single faucet, they’ll cease a stranger’s automobile lifeless in its tracks because it goes previous them.

They usually do not want any particular privileges. They do not want any particular permissions. They needn’t know any passwords or something like that. You simply faucet.

And the actual sort of car that they’ve been stopping lifeless in its tracks is an e-rickshaw. I did not know that e-rickshaws existed.

It is the identical form of factor. However that is one which is powered by a battery somewhat than by a bit of petrol motor. And it is a three-wheeled little automobile.

And these are actually standard in South Asia. They’re light-weight. They don’t seem to be very costly. They’re powered by battery.

And for tens of millions of individuals throughout North India, together with Delhi and the like, they’re a part of folks’s every day commute.

And for the drivers of those autos, that’s their livelihood.

If their rickshaw is not working they usually do not earn a wage, which means they don’t seem to be incomes any money, not in a position to purchase any meals.

It is fairly critical if somebody can cease it lifeless in its tracks with out you anticipating it whilst you’re driving alongside.

Probably additionally a security hazard as effectively, as a result of if you’re going a good clip on one among this stuff and it screeches to a halt, due to course, you already know, consider what electrical motors are like.

It is not like, you already know, you are— it is lifeless. It is not transferring any longer. So it is a prank which has emerged.

Youngsters standing close to transferring e-rickshaws open an app on their smartphone. They remotely reduce off the automobile’s energy. Immediately stops.

And should not shock you to know that lots of people assume this isn’t one thing to be universally applauded.

Some individuals are even saying that is the worst factor to have occurred since hoodie-wearing, happy-slapping youngsters began downloading ringtones.

This appears to be the brand new behavior which has emerged, and it is made all attainable, Geoff, by an app known as BatBMS.

It was truly constructed for photo voltaic panels and marine batteries, off-grid energy methods. So for those who, as an example, Geoff, I can think about you happening very glamorous holidays.

And you’ll have this app as a result of what this app lets you do is to manage its administration system through Bluetooth.

So that they’re working on appropriate {hardware}, identical form of factor which you may be discovering somewhere else.

And so a wonderfully respectable app, which you should utilize for checking your photo voltaic battery storage, can find yourself being a weapon within the palms of a pedestrian or the individual behind you who desires to — gosh, you already know, desires to trigger your little e-rickshaw to come back crashing to a halt within the streets of Delhi.

And also you assume, effectively, yeah, I am going to want to observe the battery, and there is most likely a bit of gentle on the battery someplace, however it’s a lot simpler.

And you’ll think about how the one that bought you the battery would say, effectively, don’t fret, there’s an app, you may simply monitor the batteries in your telephone.

And also you assume, that is nice, it is like a dashboard readout of how my battery’s doing. I am going to set up it.

However what they do not let you know is, oh, there is a perform there that may kill the battery.

However how are the strangers connecting to another person’s rickshaws’ Bluetooth to get to the battery. Is Bluetooth simply connectable by anyone?

After which you may simply merely scan for close by batteries and say, which one do you wish to hook up with?

Properly, hopefully not increase, however you have received full entry to the management panel and you may immediately disable it.

And the agency that made this battery system, they clearly assumed that whoever was standing close to the battery was the one that owned it.

They usually thought, effectively, why would we put a password on it?

I’ve achieved a little bit of looking out on YouTube and Instagram and the like and the TikToks, and many individuals are posting up movies now of this happening.

And a few of them are portray it as, I can get revenge now on these rickshaw drivers, ‘trigger I get fed up, you already know, you get fed up with the opposite rickshaw drivers or how they’re driving or no matter.

And so you may cease them of their tracks. And a few individuals are even reportedly paying strangers in order that the drivers get stranded, proper? They simply assume, effectively, what is going on on?

I do not perceive why my rickshaw retains conking out.

They usually’re charging 200-odd rupees or no matter for the repair. However after all, it is them who’ve truly achieved the darn factor.

There is a video of 1 man, he seems to be like an aged chap, he is driving round his little rickshaw, and also you see him pushing it by hand for about 3 kilometres within the warmth of Delhi.

I suppose only for the clicks as a result of individuals are sharing them and watching them and being outraged by them. All due to an app. An app, Geoff.

The thought that goes to my thoughts is, if this was the UK, for instance, you have received a automobile on the road, autos on the road are beneath the Freeway Code, they’re typically licensed and controlled.

If there is a element within the autos that is that susceptible, I believe that may fall beneath some form of UK laws.

We now have UK laws about default passwords, I am fairly positive that received handed just lately. However instantly I am pondering India. I imply, for a begin, Indian states work otherwise.

It is a federal, you already know, factor. And secondly, from my visits to India, the writ of the federal government and its laws enforcement doesn’t run very far.

So the thought of regulating all of the rickshaw drivers, I do not know legally the place you’d — and to be sincere, I do not assume anybody’s received any authorized comeback on anyone for this.

It simply looks as if a type of gray areas.

There’s some kind of computing machine in there which is managing the battery, and anybody accessing it with out the permission and information of the proprietor of that machine is committing an offence.

So technically it’s a crime, so we now have to do our tut-tutting. Sure.

And the Chinese language makers of this battery system have apparently pushed down an replace which patches the app, and now requires a password to be entered to entry the battery.

Now the issue is, the firmware on the rickshaws, on their batteries — how’s that going to get up to date?

And are folks going to know to replace it in order that it requires the password? So it is all very effectively updating the app.

And by the best way, with the intention to talk along with your battery, plug within the battery and add the — are you able to do one thing like that? I do not know.

And, you already know, is that this going to trigger us extra help queries? I do not know if it will occur or not. The excellent news shouldn’t be all e-rickshaws are affected.

If anybody on the market has even known as Eric — sure, if we now have an Eric Shaw listening.

They’ve simply printed a brand new report, 2026 State of the Cybersecurity Assault Floor, they usually analysed over 800,000 actual IT belongings to learn how uncovered organisations truly are.

No person added him, no one eliminated him, and he is been quietly in there for 11 years downloading maps of Paraguay.

That is the trail of least resistance.

And the report is free to obtain.

And please keep watch over your IT belongings and retired geography lecturers.

As you already know, Graham, I’m an internationally famend writer with a string of immensely profitable books to my identify. Which implies, after all, I’m swimming in cash.

No, clearly that is all — look, I’ve written 3 books they usually’ve achieved fairly effectively by all requirements.

However for those who purchase a replica of my paperback e-book for like 7 or 8 quid on Amazon, I believe I possibly get about 50p, 70p, one thing like that.

So, you already know, you actually wouldn’t make some huge cash, which is why it has been intriguing over the previous few months to start out receiving message upon message upon message from e-book advertising and marketing specialists as they declare themselves.

They usually’re actually attention-grabbing as a result of all of them form of run to a sample. Emails are clearly AI-generated as a result of there’s a great deal of it.

I believe one of many giveaways now with AI-generated messages is no one writes that a lot, you already know?

And it begins out with, “Geoff White, your books take care of the intersection of organised crime and know-how.

You could have lined fraud and cash laundering and stuff.” And I am like, yeah, I do know, as a result of I wrote them. I wrote that blurb.

They usually say, “However Geoff, you are lacking out on an enormous viewers of individuals.

And we e-book advertising and marketing specialists can, you already know, hyperlink you in with this as effectively.” So I did return to one among these folks at one stage and kind of mentioned, effectively, what does this kind of contain?

The reply to my messages once more was so painfully AI-generated.

It is one among my favorite inquiries to reply.” And mainly it was a form of stage one, pay us $500, we’ll do a e-book competitors market evaluation.

They’re mainly making an attempt to escalate you up. Now, studying round this, I would not say that is essentially a rip-off per se.

A few of it’s simply shoddy, you already know, you are getting simply dangerous service, crap service, and also you’re paying via the nostril for it.

Which already makes me assume, why have they recognized authors for this? We do not have some huge cash, you already know.

However apparently, after I requested what titles this individual had labored with, they gave me a complete bunch of Kickstarter titles, you already know, authors who’ve gone on Kickstarter.

And I believe on Kickstarter, some authors possibly do have the concept that for those who pay for advertising and marketing, you may by some means promote a great deal of books and be the subsequent Dan Brown or no matter, you already know.

Anyway, I began seeing these coming via and I discovered them fairly intriguing. After which one among them received in contact with me and mentioned, “My identify is Robert.

I run the London Wine and Dine E book Membership.”

In the meantime, I discovered the actual London Wine and Dine E book Membership, which is an actual e-book membership and does exist and is run by a person known as Robert.

I’ve nothing to do with this in any way.” So I went again to Faux Robert and mentioned, you already know, how does this e-book membership alternative kind of work?

And Faux Robert mentioned, effectively, what I do is I organise a Zoom assembly with all of my 1000’s of members and also you seem on the Zoom assembly and you may discuss your e-book after which I’ll purchase your e-book.

And I mentioned, “Oh, proper. Will you be at this Zoom assembly? Are you asking the questions?” And Faux Robert mentioned sure.

Now, frustratingly, what I wished to do was clearly not pay them earlier than this occurred.

You realize, “I am a Nigerian prince, I’ve received one million kilos. I must get out the nation.

For those who will pay me $1,000, I’ll get the cash out and I am going to pay you.” I imply, these are actually lots of of years previous, these scams. So that is an advance price rip-off.

They need cash up entrance after which they’re gonna give me the Zoom session afterward.

What I wished to do was attempt to egg them alongside and see if I might nail them to do the Zoom session earlier than paying them cash.

Have you ever received one other means that I will pay you?” And they also got here again and I saved delaying it, delaying it until the Zoom assembly received nearer and nearer.

Frustratingly, I mentioned, “Look, let’s simply do the Zoom session. I am going to pay you afterwards.” Proper.

They usually mentioned, “No, there’s a complete bunch of preparation we now have to do for this Zoom assembly.” So that they’d sussed out they should not do the Zoom assembly earlier than they received the cash.

Nevertheless, there’s a kind of postscript to this, which is sort of intriguing. They’ve thus far given me a minimum of 5 completely different financial institution accounts and cost strategies, proper, to pay them.

All of which, after all, I’ve prima facie proof, are getting used to launder the cash from a fraud. Clear proof they don’t seem to be the London Wine and Dime Field Membership.

And due to this fact, my subsequent step, clearly, is to go and report every of those accounts to the related banks and get them shut down in reference to cash laundering.

I then intend to contact faux Robert and say, “Did you Google me earlier than you bought in contact with me to seek out out the stuff that I do?” ‘Trigger I am fairly positive Robert goes to shit his pants — fuck off.

Sorry, you may should bleep that out, however I simply hate folks like this.

This poor man, Robert — he arrange this e-book membership and now his good identify and his — I’ve met Robert, we met nose to nose in London.

I met the e-book membership members and their identify is now being utilized by some slummy scammer to defraud e-book authors.

I hate all of this and the extra ache I may cause this individual, the higher. So for listeners, please be careful for my submit on LinkedIn.

For those who’re linked to one of many banks or know somebody at one of many banks that I submit, ‘trigger I will be posting the names of them.

Let me know who’s within the fraud division or the AML division so I can get these accounts shut down so we are able to a minimum of trigger this man some ache.

And once more, I’ve achieved the identical factor, however this time I mentioned to them originally, “Have you ever Googled me? Have you learnt who I’m and what I do?

And are you assured you wish to give me your cost particulars?” They got here straight again with a checking account and I’ve gone again and mentioned, “I want one other one,” and I’ll preserve rinsing them for checking account after checking account.

I do know I can not cease the issue. I do know it is a Sisyphean process, however rattling it, if simply to trigger them a little bit of ache and make their day worse, I simply can’t resist.

That is V-A-N-T-A.com/smashing. And listeners, you may get $1,000 off.

Decide of the Week is the a part of the present the place everybody chooses one thing they like.

It might be a shaggy dog story, a e-book that they’ve learn, a TV present, a film, a document, a podcast, a web site, or an app, no matter they need.

It does not should be security-related essentially. Properly, my Decide of the Week this week shouldn’t be security-related.

My Decide of the Week this week is a bit of gadget which I’ve in my workplace. You realize, I am form of in opposition to all this IoT stuff, Geoff, you already know.

Properly, sure, I’m a little bit of a late adopter, however I discovered it somewhat helpful. So I’ve a nice-ish DSLR digital camera, proper?

Which I exploit as my webcam, which is again there someplace, behind this display screen. That is fabulous, however it’s all the best way again there.

And to attempt to flip it on and off, I’ve received to seek out the little on/off button.

And after I attempt to hit it on the digital camera, I inevitably change the zoom or I fiddle round with it or I knock it so it is now not pointing in the best route, which meant that I used to be simply leaving my digital camera on on a regular basis and it was plugged into the mains or no matter, however it was simply all the time on.

After which I believed, effectively, I do not need my digital camera on on a regular basis. That is not an excellent concept for a safety skilled, is it? Exactly.

And so I believed, oh, what I am going to do is I am going to have a wise plug which I can programmatically activate and off.

And so I did a bit of little bit of vibe coding with the previous AI, and I wrote myself a bit of software which may flip that plug on and off once more.

I’ve received a bit of factor in my menu bar and it is flashing a pink digital camera icon in my menu bar in the intervening time, which says, your digital camera is on, Graham. And I can simply flick it off once more.

So with the good plug, I can management this machine and I’ve discovered it fairly useful. So I’ve truly discovered a use for it. Whereas usually I believe, who wants a wise plug?

However truly, yeah, it is one thing that is been helpful to me. And so that’s my choose of the week. It’s from Tapo. Others can be found.

I am positive it did not value very a lot cash, however it was truly actually the coding — it was doing all of the work with the bits of string and the pipe cleaner.

That was the fascinating bit, truly getting the code to work correctly.

With numerous assist from AI to do the coding for me, to programmatically get it to work effectively and successfully and reliably as effectively.

I used to be on OnlyFans with it, I had a few different platforms, and now the effectively has run dry.

And oh, it is simply sensible when you might have break day, as a result of I received up within the morning, had a crumpet and a cup of tea, and I sat on the couch with my little niece watching satisfying movies on YouTube.

Have you ever come throughout these, the satisfying movies?

It goes over into kind of slime and gunk movies as a result of a few of it is about folks digging their palms into slime or making slime.

There’s a complete rug cleansing YouTube tradition the place folks get rugs which can be soiled after which clear them with issues.

After which there’s this complete different meta layer the place there are individuals who have whole YouTube careers commenting on different folks’s YouTube movies of cleansing rugs.

We’re simply via the rabbit gap, however I gotta say, it is a hell of a option to spend 3 hours within the morning. It is actually, actually nice.

I can not consider that I did not do this.

I am positive a number of our listeners would like to observe you and discover out what you are as much as — what’s one of the simplest ways for them to try this?

And remember to make sure that you by no means miss one other episode.

Observe Smashing Safety in your favorite podcast app, equivalent to Apple Podcasts, Spotify, and Pocket Casts — for episode present notes, sponsorship information, and the again catalog of 476 episodes, take a look at smashingsecurity.com.

Till subsequent time, cheerio. Bye-bye. Bye. You have been listening to Smashing Safety with me, Graham Cluley. Enormous thanks, after all, to Geoff White for becoming a member of us this week.

Marvellous stuff as all the time. Thanks, Geoff. And likewise huge thanks as effectively to this episode’s sponsors, Arctic Wolf, NordLayer, and Vanta.

And likewise to the next high-quality of us who’re amongst our incredible Smashing Safety patrons. So huge cheers go to Saitel, Andrew Davison, Lisa.

Thanks to Robert Øjdegård — his surname seems to be prefer it was assembled by somebody who actually wished to make use of up all their vowels.

Robert Martin, proof which you can have two Roberts in a shout-out, each equally appreciated.

Enormous thanks additionally to Scotia, Greg Bailey, Christof Goossens, and remaining one for this week, Bravo Whiskey. We salute you in no matter phonetic alphabet you like.

These are just some members of Smashing Safety Plus, which implies that they get their episodes ad-free, sooner than most of the people as effectively, by a few days, they usually can have their names pulled out at random to be mercilessly mocked on the finish of the present.

For those who fancy a little bit of that, simply head over to smashingsecurity.com/plus for all the small print the place you may grow to be a patron.

And there are different methods you may help the present as effectively, after all. Like you may, effectively, just like the podcast, subscribe, depart a 5-star evaluate — go on, why do not you do it?

I do know I say this each week, however it actually does make an enormous distinction. And inform your folks concerning the podcast as effectively. Go on, unfold the phrase.

The extra individuals who pay attention, the extra inspired we shall be to stand up to quantity 500. Not too far off, are we? So till subsequent week, thanks for tuning in.

Till subsequent time, toodaloo, bye-bye.