Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside

One of those spyware companies is called Candiru. Now, do you know what a candiru is, Graham?

Is that a kangaroo with a sweet tooth? Is that a candiru?

I can totally see that. It’s a tiny parasitic catfish. It’s known as the toothpick fish.

And reputedly, if you take a wee in Amazon, the river, not Jeff Bezos’s gaff—

Although, I mean, frankly, if you’ve got the choice—

Well, if you’ve got the choice.

Smashing Security, episode 489, How a Brand New Crypto Wallet Came with a Spy Inside, with Graham Cluley and special guest Lianne Potter.

Hello, hello, and welcome to Smashing Security, episode 489. My name’s Graham Cluley.

And I’m Lianne Potter.

Lianne, welcome back to the show.

Super to see you and to hear your dulcet tones as well.

Well, you know, the fans ask for it all the time, I’m sure. They do.

They always say, we’ve had the King of the North, obviously, who’s entered Downing Street now, but are you the Cyber Queen of the North? Have you branded yourself in any way?

You’re from Yorkshire, right?

Correct. Correct. So a bit of a War of the Roses thing going on there with that reference to Burnham. But we will slide past that.

If you want to call me the Queen of the North, I’ll take it.

For anyone who’s not British, Yorkshire, practically in the Arctic Circle.

Practically, yes. That’s why I’m wearing a cardigan. But the heating is not on yet, which is also very Yorkshire.

Oh, yes. Well done to you. Before we kick off, let’s thank this week’s wonderful sponsors, 360 Privacy, Origin, and Vanta. We’ll be hearing more about them later on in the podcast.

This week on Smashing Security. We’re not gonna be talking about how a cyberattack hit Romania’s stock market agency.

You’ll hear no discussion of—

How a Ukrainian hacktivist defaced Russia’s school testing system. And we won’t even mention how police are claiming scammers used AI to deepfake a sheriff’s voice.

So, Lianne, what are you going to be talking about this week?

So you buy one washing machine, and then for months the internet thinks that’s your entire personality.

But that washing machine ad might not just want your money, it might also want access to your phone.

And we’re gonna play Click or Treat and discover your crypto wallet may not be as safe as you imagine.

Plus, we’ve got a featured interview with Spencer Thompson of Origin, who reveals what AI agents are really getting up to on your employees’ laptops when nobody is watching.

All this and much more coming up in this episode of Smashing Security.

Earlier this year, oh, here we go.

Inside the walls of OpenAI, inside Hugging Face, something was happening.

Agents talking to each other, dividing the work between themselves, leaving notes for one another in the dark where no human was watching.

They’re AI agents doing a code review, Graham.

It’s not the Manhattan Project. And when the sun came up on that incident, the finest engineering minds on the planet sat in a room and asked themselves one question.

What did our AI do?

They didn’t know.

The people who built the machine didn’t know what the machine had done.

And that brings us to you, dear listener. One question, and I want you to think about this.

If an AI agent caused an incident at your company tomorrow, what evidence could you actually produce?

Because the terrible truth is, most of us have the prompt.

We have the result.

But what goes on in the middle?

The commands it ran, the files it touched, the credentials it helped itself to — all of it gone.

But not anymore, because there is a sensor on the machine watching, always recording, capturing everything the agent does as one unbroken trace. What was asked?

What it reached, what it changed, laid out in order, start to finish.

This is Origin, endpoint AI observability.

Origin sees the agents that other tools walk straight past. Coding agents in a terminal, local agents, anything whispering to an MCP server on a laptop.

No cloud gateway, no blind spot. Origin is already there.

Somewhere right now, an agent is doing something nobody asked it to do.

But this time, someone will be able to prove it.

Origin — originhq.com/smashing.

That’s originhq.com/smashing. And thanks to Origin for supporting the show. Now, chums, chums, we all love a good gadget, don’t we? You love a gadget?

I do.

I’m not usually an early adopter because I’ve been stung too many times — either not meeting expectations or, traditionally in video game land, the red circle of death and things like that.

So I like to see the reviews and I like to agonise over purchases for a long time, but I do like my gadgets.

Well, I’ve recently bought myself a Geiger counter. If you want to have some fun, get a Geiger counter.

You’ve been listening to the calls from the UK government to prepare.

It’s always good to have one just in case you need one, isn’t it?

What I’m going to do is I’m going to describe things, and the more dangerous the thing is, the faster it will click.

But I’m going to ask you before I unleash my Geiger counter, how dangerous you think it is. Okay?

Okay, I’m ready.

I’ve also got a little cardboard box here and there’s a cat in it. Would you like to have a look at the cat?

Yeah, yeah. I like cats. Cats are lovely.

Sorry. I’m sorry, Lianne. You can’t have a look at the cat because observing this particular cat inside this cardboard box would collapse the wave function.

Just trust the Geiger counter. Don’t worry about the cat at all. Okay.

Now let’s kick off the game, what I like to call Click or Treat.

Okay, ready?

It’s time to play Click or Treat. Round 1.

Round 1. Okay, Lianne, there is a Rolex. It is being offered to you for 30 quid, from a man in a pub car park.

Is it my usual contact?

Is it something you would trust or not?

Probably not. I think the Geiger counter is going to go a bit mad on this one.

Yes, I can hear it right now. The Geiger counter is clicking a bit on that one. You’re absolutely right. Round 2.

Click or Treat.

We’ve got a brand new sealed iPhone, half price, and it’s from a seller on an online auction site with no reviews. Do you trust that one?

Ugh. Probably not, but — oh, okay.

Yeah, it’s pretty radioactive, that one, isn’t it?

I was going to say, is the Rolex radioactive? Is it going to make my wrist green? Is the phone going to melt my face when I put it near it?

The poor old cat, I think, isn’t totally happy about what’s going on. Right, next one, next one.

Click or Treat.

We’ve got a USB stick that you find on the floor of a car park with the word payroll on the side of it. Do you trust that?

No, I wouldn’t be a queen of cyber enough if I said to go and trust that. But I’m going to say it’s probably dodgy, but oh, the curiosity would get the better of me.

It is the archetypal pen test, isn’t it?

Someone drops a USB stick in your car park, seeing if you’re going to plug it into your work computers. The meter’s going mad.

Not a peep at all from the cat, so the cat’s being very well behaved. So I would say we’re doing well. All right, this is the final round now.

Click or Treat, round 4.

We’ve got a hardware wallet, a crypto wallet. It’s a little gadget people use to keep their crypto safe. It’s from a respected company.

It’s been bought brand new from a big electronics chain store. It’s in the box.

What do you think? Would you trust it?

Sounds legit. I don’t expect the Geiger counter to click Chernobyl-style anymore, so—

No, it doesn’t seem to be at all. I think you’re right. So I think you’ve done very well there. Would you like to claim your prize?

Yeah, of course I would.

Okay, well, you can open the box if you want to have a look at the cat.

You like cats?

I do like cats, yes.

All right.

Oh, hang on.

Well, maybe you shouldn’t look at this particular one. It looks like the cat is—

Yeah, I’m afraid— ah, doesn’t seem like the cat has enjoyed that particular game. So it seems one way or another, the cat has not survived in the box.

The radiation has killed the cat. But the thing we’ve learned is that appearances can be deceptive.

And that really is the message of the story I’m gonna tell you today, is even when something appears completely legitimate, it may in fact contain danger.

There may be no outward signs whatsoever that it’s something malicious or something that’s been tampered with.

Because a man in Germany recently opened the box, not to find Schrödinger’s dead cat, but instead to find his cryptocurrency hard wallet, which he had bought from a high street store, had a secret spy chip inside it.

And was this detected using a Geiger counter?

Not using a Geiger counter. And it wasn’t polonium or something like that which was in play here.

So to anyone who doesn’t know what a crypto hard wallet is, as we all know, crypto exchanges, they get hacked or they go bust or they vanish in the middle of the night all of the time.

So cautious people very, very wisely will take their coins off the exchange.

They don’t leave them up there, and they will keep the keys to their crypto wallet on a hardware wallet, which is like a little USB stick.

It’s got a little screen on it, may have a couple of buttons, and the keys to your wallet never leave that device.

They’re not connected to the internet, which means that it’s much harder for criminals to break into your wallet and steal your money.

So it sounds like a very good step for if you want to protect that and watch your cryptocurrency tank on your own time.

Yeah, absolutely. And there are a couple of really big names, hardware manufacturers who produce these crypto wallets. One of them is a French company called Ledger.

And they claim to have sold millions of these things.

And when you set up one of these, what they do is they show you 24 random words on the little screen, on the sort of USB sticky thing.

And that is your recovery phrase, your seed phrase. And you write that down on a piece of paper or you memorise it. I doubt you’d memorise it.

You hide it somewhere, you tell no one, because whoever has those 24 words can pinch all of your money.

And they can do it from anywhere in the world and there’s no password needed.

So Lianne, if you had a cold wallet, where would you hide your 24 words, your seed phrase, do you think?

Now hear me on this.

Post-it notes, but 24 words on Post-it notes in different books around the house.

Oh, I see.

But then what would happen is someone in the house would decide to do a charity shop drop.

And then that would be it.

Oh my goodness. I had a much simpler plan. I can imagine myself burying it in the garden like a pirate.

In fact, I’d probably dress up as a pirate with a wooden leg and an inflatable pigeon on my shoulder as well. I’ve got quite a thing about being a pirate.

Well, earlier this month, Ledger started investigating reports that customers were having their crypto wallets emptied. Experts reckon round about $100 million worth of crypto.

Ooh, big old cash. Yeah.

A good amount of cash from roughly 315 accounts was taken. So their Bitcoin and Ethereum and all the rest of it was gone.

And further investigation has found that inside the wallets, there was something that shouldn’t have been there. There was an extra little circuit board.

And it wasn’t just a circuit board, it had a tiddly little tiny antenna. Can you imagine?

All right. Okay. So proper spy gear. Okay.

It had a little cellular modem and a SIM card. And it turns out what this thing did was it waited until you set your crypto wallet up.

And then as each character of your 24 secret words was sent to the screen, the implant copied it, stored it, and then later connected to a nearby cell phone mast and sent all of that information to the thieves.

So if I need it recovering, I don’t need to do the charity shop crawl. I need to just go back to these guys and say, you have my 24 words, can I have those?

Now here’s why your Geiger counter said nothing when I gave you that little test, because Ledger says that the implant didn’t mess around with any of its inbuilt security.

It didn’t alter its software. It didn’t fiddle with your transactions in any way.

So these wallets do contain built-in security and integrity checks, but they wouldn’t have seen this because as far as the wallet was concerned, nothing had actually changed.

The gubbins which is used as the hardware wallet hadn’t been altered. It’s just an extra little bit shoved in there.

That sounds like someone knows what they’re doing, and that sounds very sophisticated.

Yeah. I mean, it’s a bit like buying a safe, bringing it home and unlocking it, and inside you find a burglar waiting for you to put your valuables inside.

So you’ve bought this thing new, you think it’s squeaky clean, you think you can trust it.

You’re going to entrust it with such highly important information as your crypto wallet key, and you’ve got a real problem. Yeah.

Someone’s over your shoulder watching you put the number in.

Now it turns out that this isn’t something that’s just happened recently.

Round about August of last year, someone posted on Reddit that he had bought a Ledger from an online marketplace.

He’d opened it up and he’d found extra circuitry inside, and he sent it to a well-known hardware hacker, a guy called Joe Grand, who took it apart and confirmed that there was a backdoor there.

And he went and bought 8 more from different sellers on the same online marketplace, and 4 of those 8 Ledgers — I have to say, the people who are buying these are then invalidating their warranty as soon as they get it by opening it up.

Yes, and probably stopping the darn thing from working, because you’ve spent, you know, a reasonable amount of money on these things in the first place.

It’s not like they cost a fiver.

Is there anything to kind of indicate that they had a little bit of a spidey sense that something was going on?

Because it just doesn’t make sense that you would just break into something you’ve just newly bought.

It’s strange, isn’t it, that someone would do this?

Maybe someone had decided, oh, I don’t need this thing anymore, I’m not using it, or I’ve bought a different one, and so I’ll chuck it in the bin.

Just out of curiosity, I’ll open it up.

My crypto wallet is worth nothing. Right.

Well, I’ve got a crypto wallet. I don’t have a Ledger. I have a Trezor crypto wallet. Oh gosh! Isn’t that exciting? Graham’s got a crypto wallet.

Well, I’ve only got four pounds ninety-nine in my crypto account, so don’t spend it all at once. Frankly, I probably didn’t need the crypto wallet in order to protect that.

I’ve come out worse from that entire equation. So this guy Joe Grant, he had a Zoom call with Ledger. He warned them about this.

And he’s given talks about it at security conferences, but he says Ledger went fairly quiet afterwards.

And when someone asked them about it, they simply said they’d found no evidence that the implants had been used to steal anything.

But roll on to today, and it seems people are losing quite a lot of money. And meanwhile, things have evolved.

So this one, which someone posted about on Reddit in August 2025, looked like some kids’ soldering homework. Now they’re much more professional.

One of the people who bought one of these new ones is a guy called Mark. I think it’s Mark Capellis. I think that’s how you say his name. Apologies if not. He’s the former boss of Mt.

Gox. And Mt. Gox, you may remember, is the crypto exchange. They lost nearly a million Bitcoin in 2014. So he knows what a crypto security disaster looks like.

And he says he bought one of these wallets at half price from a seller on Amazon.

Oh, well, there’s your problem there. I don’t know about you, but Amazon lately has just been full of fake stuff.

When I was a wedding photographer many, many, many years ago, I would buy SD cards.

Thinking they were the legit ones, not through secondary market or anything.

Thinking they were from the original SanDisk and things like that.

But Amazon would be sending out fake ones and you would only realise ’cause you’d put it into your device to check it, to format it, and it would supposedly be, you know, 25 gigabytes or something like that.

But actually you would look under the hood and it was just like 1 gigabyte.

Oh my goodness. That is quite a con, isn’t it?

Well, these particular crypto wallets, which he bought online, they arrived in a shrink-wrapped box and inside was the most advanced version of the Ledger thing.

He also pointed out, by the way, that if you bought one of these cheap Ledgers from a dodgy seller, you can actually pull out the SIM card.

From the spy implant and you can enjoy the criminal’s mobile data. So you could actually—

What? How much do these cost? ‘Cause that sounds like quite a good deal.

So you could potentially use their data for your own purposes.

Anyway, he started posting about this on the 8th of October, and that got quite a lot of attention because of who he is.

And the thefts came to light the next day, and they all involved Ledger devices sold through a reseller called CryptoBit.

In Southeast Asia, cybersecurity journalist Kim Zetter, she has a theory about this.

She reckons the thieves may have been waiting for the balances to get high enough, and when the news broke, maybe the criminals decided we’re gonna take as much as we can right now.

And she thought maybe they were actually waiting for the balances to build up before they took money.

‘Cause it has been an up and down market lately. Yes. Yeah.

And also, you know, if you buy one of these things on day one, maybe you wouldn’t put a million quid’s worth in, right?

First of all, ’cause you haven’t used one before, perhaps you just put $5 in. You don’t wanna steal it at that point.

Little test. Absolutely.

Anyway, it turned out that there’s this guy in Germany as well.

He bought a Ledger cryptocurrency wallet from a high street store, and he opened up his Ledger after reading these online reports, and he found a similar problem as well.

So now, according to Ledger, they say the number of affected devices is really limited. They say there’s no indication its own systems have been compromised.

They say that there’s an ongoing threat to the whole industry, not just to Ledger, but it does seem that there’s quite a lot of mischief going on.

There’s also been some people who’ve said that they’ve encountered Trezor crypto wallets, which are compromised in a slightly different way, and they’re compromised in so much as they’re not relaying the seed word, which is displayed.

Instead, what they’re doing is they’ve been altered so they only show 1 of 12 combinations of seed key.

So the criminals already have a list of 12 possible keys, so if you’ve got one of those dodgy ones, chances are that you’re going to be using seed keys which are already known.

So what’s the word of advice here?

Don’t take security seriously with your crypto wallet and do it the old-fashioned way, which is probably using hard drives that get chucked into landfills eventually.

Well, one thing certainly to do, and if you go to the Cryptobilis website right now, they’ve got a warning right up there on their front page.

If you bought a Ledger device through Cryptobilis, don’t set it up. If you’ve already set one up, move your funds to a new device with a new recovery phrase.

And if you’ve bought from somewhere else and you are worried, Ledger has posted a guide on its website about how you can check your device.

And obviously buy directly from the manufacturer may be a lot more sensible rather than going to some third party instead, ’cause it could have been tampered with en route.

And as that poor old cat has found, a box being sealed isn’t necessarily an indication that everything is right and proper inside.

Certainly cryptocurrency wallets generally, these hardware ones, are a really good idea in terms of defending your cryptocurrency.

But you just got to make sure that the device hasn’t been tampered with.

Or you could just invest your money in me instead.

Today’s episode of Smashing Security is sponsored by 360 Privacy, and to explain what they do, I’ve brought in Joe.

Happy to help.

Joe, why are you wearing a balaclava?

You said I was playing a cybercriminal.

Well, that’s the uniform, isn’t it? I assumed it was in the contract.

Joe, real cybercriminals dress like accountants. Most of them are sitting in open-plan offices eating a meal deal.

Now you tell me. I’ve walked here like this. The neighbours saw me.

Well, what did you say to them?

That I’ve been skiing.

It’s October, Joe, and we’re in the UK.

I said it was an indoor slope.

Fine, leave it on. And why the bobble hat?

It’s cold in the studio.

Okay, okay, Joe, back to business. You’ve got one task: find out everything you can about me using only the internet. Go!

Right, searching. Oh, wow, that was quick. Your home address, family members, property records, social media accounts.

Hang on, that was under 10 seconds you managed that?

And I’ve got a few of the places you regularly visit. Honestly, it’s a bit embarrassing how many times you go to Greggs for a sausage roll.

Oh, come on. Individually, those details seem harmless. Nobody’s panicking over a coffee order.

But put them together, and I now have a surprisingly clear picture of who you are, where you live, and how to find you. I haven’t even finished my tea.

And that, listeners, is the problem that 360 Privacy is built to address.

360 Privacy is a digital exposure reduction firm.

They help executives, high-profile individuals, and the organisations behind them shrink the digital exposure that turns into real-world risk.

Because threat actors don’t separate cybersecurity, privacy, and physical security. They use whatever information is available.

Data brokers, social media, public records, and AI — it’s all making it faster and easier to find that information and connect the dots.

Which is a bit rude, frankly, because I wanted my dots left unconnected.

Here’s how they fix it.

Through their technology platform and a team of expert intelligence analysts, 360 Privacy identifies exposed personal information, works to remove it at the source, and continuously monitors for new exposures, so it doesn’t just pop back up next week.

In other words, 360 Privacy creates friction, making sensitive information harder to find, harder to connect, and harder to use against you, your family, or your company.

So if Joe tried this again after working with 360 Privacy —

I’ve got nothing. Just a recipe for lasagna, which, to be fair, was not what I was looking for.

Modern targeting can begin with something as simple as a search engine query.

Learn more about reducing your digital exposure at 360privacy.io.

That’s 360privacy.io.

Can I take the balaclava off now?

Oh, please.

Thank God, I’m boiling.

Lianne, what’s your story for us this week?

So I’ve got an interesting one for you, Graham. Question, do you run an ad blocker?

Yes, I do.

All right. Well, if you didn’t, dear listeners, now might be the time to consider it.

Because as I said at the top of the show, you buy a washing machine and then you are shown washing machines for the next 6 months. That is the joy of internet adverts.

Now you have to ask yourself, am I a laundrette here? Why do they keep advertising me washing machines? I’m only going to buy one until the next one breaks.

So this week’s story is about online advertising, specifically the type that can install spyware on your device.

But this is not your traditional boy meets ad, boy clicks on ad, ad is a dodgy download, boy downloads it anyway story.

It’s a lot less romantic than that because now we’re at a point where you don’t have to click on anything to get hacked.

You can be sitting there minding your own business, looking at an advert for something you don’t need, and then someone could be using that advert.

So this is a zero-click attack, which is terrifying in my opinion.

This research comes from Citizen Lab, which is based in the University of Toronto, and they uncovered an operation.

They’ve named it Adfection, and they say it’s an Israeli advertising company called DiscoverTech, which appears to be working with commercial spyware companies using online adverts to target people’s devices.

Now, one of those spyware companies is called Candiru. Do you know what a candiru is, Graham?

A candiru. Is that a kangaroo with a sweet tooth? Is that a candiru?

I can totally see that. It’d be a sour sweet covered in sugar. Yeah. It’s a tiny parasitic catfish. It’s known as the toothpick fish.

And reputedly, if you take a wee in Amazon — the river, not Jeff Bezos’s gaff.

Although, I mean, frankly, if you’ve got the choice.

Well, if you’ve got the choice. What happens is this little toothpick fish swims up and makes a home in the orifice where the wee-wee is coming from.

Well, I’m so glad you’re on the show this week, Lianne.

I’m sure listeners are crossing their legs everywhere, but this is what that spyware company named itself.

It’s kind of an upstream attack, I suppose you’d call it, wouldn’t you?

Ooh, I like that. But I think they kind of clicked that they had dubious connotations with their name, so they have rebranded themselves and they’re now called Integrity Labs.

Integrity indeed. The Lady Duff Protector.

So Integrity Labs, these are the guys who are writing the spyware.

And there’s another company, which is actually the advertising company, which is distributing ads.

I imagine like little image ads or something like that on people’s websites or in games.

Yep. The traditional stuff that you see whenever you just try and close popups and everything like that. The stuff that makes the internet hell.

This is mobile phones, is it, that they’re infecting, or is this desktop computers as well?

Both. So if you open up a website or an app, it’s going to get you.

So there is no escape apart from — and I will mention at the end — what we can do to protect ourselves, obviously.

But the research went into how it all works, and I’m not sure if you are aware, but the way advertising works on the internet is there’s tons of infrastructure around it.

So companies bid against each other in real time for basically the privilege of showing you something you don’t want to see.

And it all happens in milliseconds. And that information about your device gets passed around as part of the process. It’s something called programmatic advertising.

Now, it sounds very sophisticated, but it makes you think all that information about yourself is just flying around and being sold to the highest bidder.

So what DiscoverTech had done, according to the researchers, is they set up a platform called Controlium. Now, it sounds dodgy, but it’s not.

It’s just the same sort of platform any other online advertising platform would sell.

But Controlium let customers pick out specific people or devices to target using things like mobile advertising ID, or your browser identifier, or an IP address.

That’s the little bit that’s a little bit strange to go into that much detail, because normally it’s just demographic-y kind of things.

That they looked for. So it wasn’t just chucking dodgy adverts at random people and hoping for the best.

The system actively identified particular devices, profiled it, and then decided whether or not it would go further.

Which makes a lot of sense because you wouldn’t want to necessarily infect millions of people’s devices.

I mean, initially you might think, well, I want to do that because I want to make as much money as I can.

But if you wanted to target specific people, or if you had someone who you were actually specifically targeting, you just want to go for them because otherwise the mobile phone companies and the ads and so forth may be updated to stop this zero-click exploit from working.

Yeah, absolutely. And in particular, the researchers found that actually, due to the targeted nature, the targets were people like journalists and things like that.

So the end state wasn’t necessarily traditional financially-led hacking or anything like that.

It was about, actually, we want to be able to spy on the people you want to spy on without them knowing. And as I say, you’re not clicking on anything. It’s just happening.

You have been targeted elsewhere using a legitimate online process. This is how advertising works, except for that platform, they’ve decided to go granular.

Then you pick who you want. So if you already know that journalist’s IP address, for example, you would be able to target them using that.

Oh, I see. So if their IP list came up, this Controlium — was it Controlium — which decides who actually gets to display the ad?

You could bid a fortune saying, if Graham comes along.

Or if it’s someone who’s particularly interested in this topic, or something very, very niche, for instance, and they come from this part of the world, then we are prepared to pay $50 or whatever it is to make sure our ad appears rather than a normal ad.

Yeah. Which is why you’re getting advertised loads of crypto ledgers now, because they want to silence you. You’re the journalist in tech they want to silence.

So they — the researchers said — this is not something that they just tested in the lab. This is actually being exploited in the wild.

So the news group Al Jazeera spoke to Citizen Lab, the researchers, and they said they might have found evidence of attacks targeting at least 45 of their devices.

So the 45 of their journalists between 2024 and 2025. And it is linked to the spyware company, Candiru.

Which is the Israeli spyware firm, basically.

Correct. Yes.

It does the typical thing, so it can sort of steal your files, your passwords, read your messages, that sort of thing, which makes you want to put your phone away till retirement, I guess.

So the operation itself is enormous. So Citizen Lab analysed, I believe, 4 billion bidding records.

Because DiscoverTech had actually left all that information exposed to a public website.

Womp, womp, womp, womp.

Indeed, yes. And between March and June alone in this year, there’s been 3.7 billion bids, and there has been over 4,400 million auctions won.

The team at Citizen Lab, they’re pretty awesome, aren’t they? They are real heroes on the internet because they’re always uncovering these kind of things which are going on.

And if you work, for instance, in a news organisation and you think that you’ve been targeted by maybe state-sponsored intelligence teams or by malware, trying to get leads from journalists, they are a very good resource to turn to because they will dig into these things and help you find out what’s going on.

And I would recommend listeners check out the documentation relating to the story because it’s thorough, but also clear, which I really appreciate because those two things don’t go hand in hand a lot with security research.

I must admit.

So this was happening on iPhones and Androids, I’m guessing.

And desktops as well.

And desktop computers as well. Do we know if the operating system manufacturers, if Apple and Google and Microsoft are releasing patches for any of these?

It’s not clear from the current research if they are thinking of doing that, but there is some advice, which is basically if you are not using an ad blocker, and particularly if you’re in that kind of sensitive job, which journalists nowadays really is, they’re always getting targeted at the moment for different things.

An ad blocker is really useful, particularly at the network level, if you can.

It’s not a magic force field, unfortunately, they were saying. But it might disrupt things a little bit.

You make a good point about putting the ad blocker at the network level as well.

I think a lot of people think, oh, ad blocker, I’ll run that in my browser, which is a great start, but of course it’s not going to stop ads which appear in your games and things.

And on your mobile as well. So yeah, ad blocker on the network level is the kind of advice that were going on there.

So apparently somewhere along the lines, we went from people selling things that we didn’t need to someone installing mercenary spyware on your phones, all because you just needed a new washing machine.

But I don’t know about you, Graham, the man who sold that dodgy Rolex at the back of the van, I might start buying my washing machines from him instead in cash, because at least if someone’s spying on me there, at least it’s because I’ve done something interesting.

This episode of Smashing Security is sponsored by Vanta.

Joe, it’s Graham here. I’ve been asked to negotiate with you. Are you going to come out? Can you hear me?

I’ve got the questionnaire, Graham. I’m not coming out.

Okay, Joe, that’s okay. Nobody’s rushing you. Which questionnaire is it?

The vendor risk one. I filled it in 4 times this week.

4 times! That sounds really hard, Joe. So tell me about the spreadsheets.

There are so many of them, Graham. Some of them have tabs I’ve never seen before. I think one is alive.

Okay, I hear you, Joe. Now, I’d like to put something on the table. Can I do that?

Is it a trick? It’s the sort of thing a hacker would say.

No tricks. It’s called Vanta.

Okay, go on.

Vanta is a trust management platform.

It automates the mind-numbing stuff, the evidence chasing, the questioning hell, the sort of thing that makes you want to go and hide away in a cupboard like you have.

No more chasing screenshots.

No more chasing screenshots. It continuously monitors your system so you’re audit ready all year round. SOC 2, ISO 27001, HIPAA, GDPR, the works.

Does it use AI?

It does, Joe. It flags risks and streamlines evidence collection so your whole security programme stays in shape, not just in the week before the auditors arrive.

I think I’m ready to come out.

That’s great, Joe. And I’ve got one more thing for you. Listeners who book a demo, they can get $1,000 off.

$1,000? Why didn’t you mention that sooner?

That’s not how you do it, Joe. You build rapport first.

vanta.com/smashing. Go now before somebody else ends up in the cupboard.

That’s vanta.com/smashing.

Thanks to Vanta for supporting the show.

Joe, you can put the questionnaire down now.

No, I haven’t finished page 6.

And welcome back, and you join us at our favourite part of the show, the part of the show that we like to call Pick of the Week.

Pick of the Week.

Pick of the Week.

Pick of the Week is the part of the show where everyone chooses something they like.

Could be a funny story, a book that they’ve read, a TV show, a movie, a record, a podcast, a website, or an app, whatever they wish.

It doesn’t have to be security-related necessarily.

Better not be.

Well, my Pick of the Week this week is not security-related. Last night I was out, I went to the theatre.

Oh, very cultured.

La-di-da, eh?

And I saw a comedy act. I saw a satirical show being run by a guy called Michael Spicer. Are you familiar with Michael Spicer’s work?

Yes, I am. Is he the chap that does — he’s behind the scenes?

He’s sometimes called the Room Next Door or something.

He quite often has put together on social media little video clips of some politician typically making a complete arse of themselves.

And he’s like the voice in their ear saying, oh my God, you’re not going to say that. And you see his reaction as the politician gets themselves more and more into a mess.

Anyway, those videos are great, and I was curious what he would be like on tour live. My goodness, it was great. It was really good. His tour is called Hope All’s Well.

And he admits himself during the show that he’s not a gag merchant.

He’s not somebody who’s gonna stand up and pump out jokes at you, but that doesn’t mean he’s not very, very funny. And he uses technology very much in his show.

So he has made a heck of a lot of videos which he interacts with during the show in all kinds of imaginative ways.

I absolutely pity whoever was working behind the scenes, pressing all the buttons and controlling technology. And the timing is extraordinary.

So for instance, there are sections of the show where he goes onto a Zoom call with other people. The only other people you see throughout the entire evening is him.

And so he’s having a Zoom call with 6 other versions of himself, obviously prerecorded.

Yeah. There’s no cloning going on here. This is not a room full of clones.

The timing is absolutely extraordinary. Anyway, the whole thing, it’s impossible to really describe this adequately, but it was thoughtful. It was a very funny evening.

He had a right old go at AI and the tech billionaires. If you get the chance, I would recommend it. Go and check out Michael Spicer on tour at the moment in the UK.

His show is called Hope All’s Well, and I think it’s running for a few more months yet.

His YouTube channel’s fantastic. I always really enjoy his stuff.

So yes, every time I watch something on the news and I go, oh, that’s a right gaffe from a real politician, I’m like, yes, I’ll just wait for him to give me his comment.

He’s very good indeed. Anyway, Michael Spicer is my pick of the week.

That’s a good pick of the week.

Lianne, what’s your pick of the week?

Mine’s a bit off-kilter because I’ve not actually seen my pick of the week.

Controversy. But I’m actually in the same boat as most people because this film has been censored for nearly half a century. Well, more than half a century, 55 years to be precise.

And it’s coming late October, and we will all get a chance to see this pick of the week on the big screen, including an original 35mm if your cinema still has an actual projector, which mine does — bragging rights — in a fully restored, remastered, and uncut, it is Ken Russell’s The Devils.

Have you ever heard of this film?

I’ve heard of it. I think I’ve seen clips of it. Oliver Reed is in it, isn’t he, I think?

Oh, well, babe. Yes, Oliver Reed.

So, it’s adapted from an Aldous Huxley book in 1952 called The Devils of Loudun, and you might have heard of Huxley because he wrote the dystopian novel Brave New World.

Which, if you know that book, you might get a sense of what this film is going to be like.

But Ken Russell’s The Devils came out in 1971 and stars the lovely Vanessa Redgrave, and of course, the dashing Oliver Reed.

It’s a historical political horror dramatisation of demonic possession in a convent of nuns in 17th century France.

Now, when it was released, it was actually, at the time, one of the most popular films in the British box office.

It was also one of the most controversial because, hey —

Wasn’t it a bit rude?

Well, I was gonna say, hey, it’s the ’70s. And if you go watch the trailer after this, the first 3 seconds, you’ll be like, ah, I see why this might have had some controversy.

So due to the graphic nature of the portrayal of violence and sex, obviously mixed in religion, it quickly got an X rating, and it was pretty much banned for ages and heavily cut to the extent that unless you actually saw it in 1971, you didn’t actually see Ken Russell’s film.

Because anytime it did get released — and it got released very briefly in the early 2000s on home video — it’s basically mostly out of print, unobtainium since then, but cut to shreds.

But after years of campaigning, most of it done by Mark Kermode, the British film critic.

He’s been campaigning really hard for this. And I got an email in my inbox saying, we’re getting The Devils, we’re getting it back. Because I’ve always wanted to see this film.

Ah, so they’re using the original negatives as well, so it’s going to be beautiful.

And it debuted in Cannes this year, and the people at Cannes have said that it was the best film of Cannes.

None of the new stuff. This film was the best film of Cannes, and critics are saying this might be the best film of 2026, a film that’s over 55 years old.

And if you’re into that kind of thing, it’s currently got a Rotten Tomatoes rating of 97%, which is one of the highest.

So I’ve been waiting all my life to see this film in its full uncut glory. But unfortunately, Graham.

My dream will not come true because I am not in the UK for any of these release dates.

Oh, for goodness’ sake, Lianne.

So for my pick of the week, please, lovely listeners, please go buy a ticket to see The Devils so that cinemas think this is the hottest ticket in town.

So they’ll put more screenings on for me so I can finally live out my dream and experience one of the most controversial films of all time.

Are they not going to bring it out on DVD or something like that?

It’s the same.

Oh, okay. No, it’s not the same, I suppose. You want to see it in the full 35mm glory, don’t you?

Yeah, I want to see the blood on the screen.

You do love your movies, don’t you?

I do, I do. That would be a nice segue into Tight Film Wire.

That’s her other podcast, folks. Okay, so The Devils by Ken Russell is your pick of the week.

Well, we’ve got time right now for a special featured interview. Thousands of companies are rolling out AI agents into the workplace.

Coding agents like Claude Code, Codex, Cursor now running on employees’ laptops, and they can use that person’s logins, open their files, run commands, change things.

Many companies have very little idea what those agents are actually doing.

Well, I’m delighted to say that to help us untangle all of that today is Spencer Thompson, the CEO of Origin. Spencer, welcome to Smashing Security.

Thank you so much for having me.

Now, for listeners who’ve never watched one work, what does a coding agent like Claude Code or Codex or Cursor — what do they actually do on an employee’s laptop?

So a coding agent like the ones you’re referring to is something you install on a traditional Mac or Windows machine.

You can install it via CLI if you’re an engineer, or you can just download a desktop app.

And what they actually do is translate human language into code, and use the resources on a computer to go and perform the actions.

So for example, if you are using Claude Code and you say, I want to build a landing page, or I want to build a marketing website, it will go and create and edit files.

It’ll go write the code on your behalf, and it will go and produce what you ask for.

And the kind of magic of this, and the reason that these things have exploded, is people don’t have to know how to program to be able to create things that traditionally required code.

You can just talk to it like you’re speaking English. And this is kind of what’s so remarkable about these tools.

This is the thing, isn’t it? They’re not just suggesting code, they’re actually acting with that person’s credentials.

Which brings me to an obvious worry, which is, say a coding agent on an employee’s laptop does something that nobody told it to do, like changing a file or running a command it wasn’t asked to run — afterwards, what records does the company have to work out what happened and why?

In today’s world, it’s actually extremely difficult. There are two real reasons why.

One is we don’t really have the auditing or traceability built into tooling to do this, which I’m sure we’re going to talk about later.

The second reason is probably the more important reason — these things are incredibly complex.

I think people probably dramatically underappreciate just how complicated AI agents are.

When you type a prompt into a box and hit enter, a lot of people use AI like it’s search, right? They go to ChatGPT.

When something’s actually going and doing work on your behalf, that’s called an agentic workflow. It’s an agent doing work.

These agents will basically go and do whatever they can to accomplish the goal that you gave them. And what that means is that in some cases they’ll split off into multiple agents.

They’ll go and call agent swarms to go and do work on your behalf. They’ll share context between agents and pass things back and forth. And this is all happening in real time.

So imagine you have all these multi-threaded parallel things happening in real time and you have no idea — in some ways it literally feels like magic to people, where they just press the button and things kind of emerge.

If something did go wrong, it turns out it’s really complicated and difficult to figure out what actually went wrong, considering the complexity of these things.

I think the best way to maybe understand that is through some real examples.

And one of the things I was reading about is there’s an Origin engineer who asked Codex and Claude Code to run a query or something. Is that right?

Can you explain a little bit more about what happened there?

Sure. So this is an internal story, so this is using our own data. We had an engineer that was trying to get access to some data to accomplish a task.

And so he was using Codex, which is OpenAI’s desktop app. He had asked Codex through a prompt to go and fetch some data in order to perform work.

Codex said, I actually don’t have permission. I think the engineer had gone to bed and literally just let it go.

All these things run on what’s called auto mode now, where you don’t have to — you know how you used to have to hit 1 to accept all the different things over and over and over again?

No one does that anymore. They just let it run and do whatever it wants.

And so the engineer, I think, went to bed and what happened was Codex figured out that it could not get access to the data because it didn’t have permissions, but it found out that Claude Code was running on the same machine.

It decided to open Claude Code. Remember, no humans involved in any of this, right? So the agent decided to open Claude Code and it said, go get the data.

Claude Code tried to get the data and said, I don’t have permissions. And Codex said, no problem, I’m going to change your permissions.

So I’m going to change it to what’s called `–dangerously-skip-permissions`, which is this thing where you basically just does whatever it wants. It changed the permissions.

Claude Code then went again and tried, got access to the data, brought it back, and gave it to Codex, and mission accomplished.

If I told you that a human did those things, you would lose your mind. But this happens every single day inside of organisations, and people have no idea.

Bonkers, isn’t it? And there was a second story about something which happened on your own premises during a sales demo. Is that right?

This is my favourite story because it’s happened to me.

So we do this thing whenever we give demos, where we lock our demo environment so that nobody can push code while I’m giving a demo, which makes sense. It doesn’t blow things up.

So I’m giving this demo, I tell people on the team, can you please make sure it’s locked? They say, yeah, no problem. 20 minutes into the demo, something goes wrong.

And so I get around it and I do my thing. And then I get off the call and I say, hey guys, what the heck? Something happened. And they said, no, nothing happened.

Like, what are you talking about? No one unlocked staging or demo to push code into. And I said, no, but something happened at minute, whatever it was, 21 of my demo.

So we used our own product and we did a search and we said, hey, something happened around minute 21 of this.

And what we uncovered was that the agent itself actually decided to go and unlock the demo environment in order to continue doing its work, even though the human being told it not to.

And so we had to go through this whole trace to understand that actually it wasn’t a human. Like, I was ready to blame the team and blame a human being.

It’s just an agent acting on its own. Absolutely remarkable.

I mean, in some ways it’s kind of cool. In other ways, it’s horrifying that this sort of thing happens.

These are both relatively benign examples, as you can tell — they’re kind of funny.

But you could imagine a slightly elevated version of this that could be very damaging. And so they’re funny, but also they have implications that are quite significant.

Well, I also heard about this experiment you did.

One of your researchers gave an AI model 200 of your own AI chats, so what people had typed in, and from that, it worked out some of your company’s private rules.

Oh yeah. I mean, this is what these things are remarkably good at.

I would argue that this is maybe a controversial thing to say, but I think people underappreciate just how much people share with AI and just how much work is done by your employees using AI.

If you ever go into whatever AI you use — ChatGPT or Gemini or Claude — ask it to tell you about yourself. And I promise I’ll get to your question.

There’s a bunch of fun proxies for this. If you ask it to say, what city am I most like and describe why — for what it’s worth, the answer for me is London.

There’s a bunch of different ways you can get at this. These agents know an enormous amount about yourself, and so that’s called working memory.

And so you extend that out to an organisation.

If you’ve got 10, 50, 100, 200 people, the agents actually probably know more about your organisational structure and the way that you do work than probably you do at this point.

And so its ability to read through chats and understand the context of that is frankly trivial for these things. This is like the most basic of what they do.

I just think people have no idea just the level of this right now.

So as we should all know by now, before you paste work into a chatbot or something like that, we really need to stop and think — although we all know that, we’re not necessarily doing it.

So let’s talk about how Orion approaches all of this.

We’ve had antivirus for years, which checks your files, and we’ve got EDR, which collects logs, and now AI agents are working inside companies as well.

What is a trace and why does it matter more now?

So if you think about the first two examples of what you gave with antivirus and with EDR — antivirus tried to understand the context of a file when a file was being opened, whether it was malicious or benign, because attackers would smuggle evil things into those.

In the case of EDR, they would try and ascertain logs from the machine, so operating system telemetry, and try to piece those things together to understand what was malicious.

A trace to us is kind of the new unit that you need to pay attention to in security, and the reason is we define a trace as anything that happens between a person or an agent hitting enter on a prompt box and typing something in, and when it completes.

Now, one important thing to note here is that I think people assume — again, going back to my chat example — that they’re used to typing something into a box, hitting enter, and getting results in like two seconds, right?

Some of these agents will run for up to a year straight doing work.

If you go and give these agents really hard, difficult tasks, they will just keep going and going and going.

So the ability to actually understand all of the context that’s contained within that work is what we define as a trace.

And so that means the intentionality of what the person was trying to do, it means the cost of how much intelligence it’s consuming, it means all the security risks, it means what files it’s touching — you can imagine it goes on and on and on.

All of the things that that agent is actually doing is what we consider a trace.

And we think that every single organisation of the future is going to need to understand and capture their own traces in order to go and build their businesses.

So if Origin is recording all of that information, what agents are doing on workers’ computers, an obvious thing for anyone who works in security, they’re going to be thinking about how do you keep that data safe and private?

Yeah, this is a very complicated and important question.

So the first thing I think to note is that people also underappreciate that they’re already sending all of this IP and private information up to the models themselves.

So if you’re paying for an Anthropic licence or a Copilot licence, whatever it is, in most cases they don’t have an intermediary between those things.

And so they’re just chucking all of their proprietary IP up into the models.

This has become a very controversial topic — are these frontier companies trying to compete with organisations or not.

As a business, our job is almost to be like an auditing and compliance tool for organisations where they can perform investigations if something, heaven forbid, does go wrong.

Right. We’re not in the business of capturing or owning data. That is the company’s data. This is a tier 1A priority for us. And so there’s a bunch of things that we do.

We obviously have a whole bunch of role-based and access-based permissions in terms of who can access what. This isn’t even about us — it’s even within the organisation itself.

This stuff is so sensitive and so proprietary. Not everybody in the organisation should have access to this either. All that data sits on the company’s side, not on our side.

Obviously it’s stored in whatever structure they want to store it in, whatever encryption they want to have on top of that.

But I think one thing to note here is this is a brand new era.

The ability to capture your own prompts and traces and store these things and structure these things and secure these things is kind of the Wild West right now.

And so we try and take that unit super seriously, give all that data to the organisations themselves, tell them how to secure it, tell them how to structure it.

And then they work with us to say, okay, now how do we use the tool again, if something goes wrong, to figure out what actually happened?

And we try and do that in an automated way that lets the customer touch it without us being involved.

So practically speaking, if a company were to install Origin today, what do you think is the first thing that they’re likely to see?

So there are 2 things that are, you know, theoretically obvious that I think are always surprises to people.

The first thing is it’s actually very difficult to get your own prompts out of these frontier companies.

One of the challenges I have for organisations is go show me all the prompts that your employees sent in the last 30 days, not using us, meaning using whatever tools you want.

Everybody assumes they already have all this information. They actually don’t. So that’s the first thing that people always see.

The second thing that they see is we typically discover agents that they had no idea were actually running in their environment.

So imagine a Chinese model running offline on a computer, like a Qwen, or a DeepSeek or something, we always discover agents that they had no idea existed.

So those are the first 2 things. Those are largely inventory or visibility problems.

Usually within a couple of days, again, I think people underappreciate how much AI usage there is, we’re able to discover a rogue agent doing something that it wasn’t supposed to be doing.

So then usually we’re able to uncover that and give that back to the customer and say, hey, you should be paying attention to this thing. Go take a look at this.

And then they launch their first investigation into what that agent actually did. Hopefully the experience is such that they go, well, we can’t not have this tool, right?

Because if we don’t have this tool — going back to your very first question — we have no idea what’s actually going on inside these environments.

Now you’re using Origin on your own engineers. What’s the most surprising thing that it showed you inside the office?

There are two answers to this question. The first answer I think is going to be near and dear to the hearts of most organisations. That’s just cost.

One of the things it shows us is where people are spending our intelligence dollars.

I think, again, people are underappreciating — a way of thinking about AI agents and intelligence is actually digital labour.

People have no issue with thinking through human labour costs, right? If I’m spending $100 million on people costs, that’s accounted for to make sense.

When people are renting intelligence from these providers and they’re spending it inside of their — these agents are doing work.

I think a very useful way of framing all this is to think of these things as digital employees or digital labour.

If you look at your total labour costs now, what percentage of that is actually digital versus physical? And I suspect it’s a larger percentage than people think it is.

So one of the things that we use this for is we’re able to tell where people are spending that intelligence inside of the business.

And we have multiple examples where we have found people using it — not because they’re malicious, but because of certain features being turned on — way overspending AI intelligence budgets inside of our own organisation to the tune of tens of thousands of dollars a month in some cases for us.

So that’s the first thing that we uncover.

The second thing that we uncover is it’s actually extremely difficult to understand what work is being done inside of the organisation using AI.

And so we just use our own product to tell us what’s happening every single week.

And so literally on a weekly basis, our engineering managers will say, well, what got done via the agents this week? Who did what?

And then what security risks are in place given that? And the product will just tell us, you know, this person did this in this way. This is how long it took.

This is what got accomplished. They did this thing that was totally unsafe. They shipped a credential up to a cloud environment that it shouldn’t have.

It’s almost like replacing the standup that people typically do with engineers. We just use our own product. Very cool.

Now, and finally, if a company’s starting to use AI agents, what’s one thing you would recommend that they should do this month?

I think if they’re just starting to use these agents, going back to my first point, I think having an inventory of where these agents are is actually very important.

And the reason is, ignoring the security stuff for a second, just the business risk from a spend perspective, I think it’s very interesting.

There’s a lot of organisations that we speak with that have attempted to lock down agents. Meaning, you know, they’ll say, well, we are a Microsoft customer, we only use Copilot.

Almost every time we’ll wander in the door and within the first day we’ll say, well, you might be mandating that people use Copilot, but in fact, half your employees are using another tool and they’re spending either their own money on their own accounts or they’re spending your money.

I think people just have no idea. And so I think from a just basic V1, what do you do? Just try and gather an inventory about where these agents actually are in the workplace.

Well, this has been really interesting. Thank you so much.

Listeners, if you’d like to know more about what Origin can do inside your company, here is a special link for you, originhq.com/smashing. That’s originhq.com/smashing.

And all that remains is to thank you, Spencer Thompson of Origin, for joining us today on the show.

Thank you so much for your time. Really appreciate it.

Well, that just about wraps up the show for this week. Thank you so much, Lianne, for joining us.

I’m sure lots of listeners would love to find out what you’re up to and follow you online. What’s the best way to do that?

Best way to do that is to come find me on LinkedIn, or if you really like listening to my dulcet tones, you can catch me out on Compromising Positions.

That’s my cybersecurity podcast, or Tech Film Noir if you want more film chat.

And of course, you can find me, Graham Cluley, on LinkedIn, Bluesky, Mastodon, Instagram, and even TikTok, or you can follow Smashing Security on Bluesky, Mastodon, or Reddit.

And don’t forget to ensure you never miss another episode — follow Smashing Security in your favourite podcast apps such as Overcast, Spotify, and Apple Podcasts.

For episode show notes, sponsorship info, guest lists, and the entire back catalogue of 489 episodes, check out smashingsecurity.com. Until next time, cheerio, bye-bye.

Well, before we go, Graham, have you got any iodine tablets? Because I feel like my hair’s coming out in clumps and my teeth feel really sore and my skin’s peeling off.

I didn’t want to say anything, but yeah, hang on a minute. I think maybe the old Geiger counter may have to go off again. Let me just— oh, oh, there it is.

I don’t feel so good, Graham.

I feel sorry for that cat. Bye-bye.

You’ve been listening to Smashing Security with me, Graham Cluley.

And I’ve got to give a huge thank you to Lianne for joining me this week and to this episode’s sponsors, 360 Privacy, Origin, and Vanta.

Do go and check out their offerings because they help keep the show afloat. Plus, we need to thank the following patrons whose names have been plucked out of the hat.

So huge thank you to the following: we’ve got Julian Beach — sounds less like a person and more like a coastal retirement village — Bash Aura, which they have a zero where the O should be, clearly keeping up the hacker aesthetic, Bobby Hendrix — just letters away from being a rock legend — Marwan Kathaya — a name that rolls off the tongue beautifully, but not when said by me.

Matt Weir, Matt Weir? Matt the Weird? Matt the Wire? We’ll never know. I love it regardless. Yuri Taraday, which sounds like the title of a very energetic Russian musical.

Matt Cotton, who is soft, dependable, and hypoallergenic. And finally for this week, Dan H. Just the one initial, plenty of mystery.

The names you just heard belong to the splendid, generous, and faintly reckless members of Smashing Security Plus, a special tier of listener who get the episodes ad-free, hot off the press before everyone else.

And this is the real jewel in the crown: the privilege of having their name read out at the end of the show and gently ribbed on international podcast platforms.

Do you fancy joining this illustrious collection of fine folks? All you have to do is totter on over to smashingsecurity.com.

And for less than the price of a cup of coffee a month, you too can bask in the glory of knowing your name may one day be mangled by me on a future episode.

Now, if you’re not keen on the whole giving us money thing, that’s entirely understandable.

I realise times can be tough, and I remain fond of you regardless, especially if you will do something for me, which won’t cost you anything other than maybe your pride.

I’d like you to badger your friends into listening, mention us at dinner parties, or simply scribble Smashing Security on bathroom walls. Please don’t, don’t actually do that.

Honestly, whatever route you pick, it means the world and it makes the whole mad enterprise worth carrying on with. And so until next time, cheerio. Bye-bye.