Transcript
A (0:04)
Hey, everyone, and welcome along to Risky Business. My name is Amberly Jack, and this is, I believe, the first time that a Risky Business weekly show has been produced without Patrick Gray at the helm. But Pat's on holiday for a couple of weeks and regular listeners of the show will be aware of, I guess you could call it the Risky Business curse, where the idea is if Pat goes away, the Internet will go boom in his absence and there'll be no one to talk about it. So we figured we'd do what we can and keep the show going in his absence. So joining me in his regular spot behind the microphone is Mr. Adam Boileau. Adam, thank you so much for joining me.
B (0:41)
Yeah, it's great to be here, Amberly. And you're right, this is, you know, it's historic. Pat and I have been doing the show. I think I've been here more than 15 years, and Pat's been doing it before that without me. So, yeah, a Pat free show is. It's pretty miraculous. So let's give it a go. I guess we should also point out this is not sponsored. This is just us kind of doing it for fun because, you know, we're sitting around the office anyway, we're already talking about the news in chat, so why not get in front of the microphone and do what we always do?
A (1:11)
Yeah, for sure. And I want to jump straight into it, actually, with a news that, as a journalist, really piqued my interest when I saw it this week.
B (1:21)
Journalists love money.
A (1:23)
Journalists love money. But a BBC reporter, Joe Tidey, has written a first person piece about being contacted on signal by hackers who asked him to hand over his BBC credentials in exchange for a percentage of whatever the hackers would manage to extort from BBC. And this one made me laugh because. And it also made me a little bit envious as a journalist, because if I was still working in a newsroom and I received a message like that, my first thought would not be, how can I extort my company and make lots of money? My first thought would be, I'm going to run straight to my editor and say, look at this great story that I have in my hot little hands. How would you like to approach this? But, Adam, the question I wanted to ask you is, as a journalist, we don't have a lot of permissions with our accounts. I mean, if you hacked into a journalist account, you could maybe, I don't know, add some typos to a story or a cab picture on the front page. But it's not about that, is it? It's just literally about getting access.
B (2:34)
Yeah, I mean, of the things that ransomware crews are good at, one of their core competencies is taking any sort of initial access and turning that into, you know, enterprise wide compromise and onwards to ransom and getting access to any one individual user's account, be it, you know, a journalist or a janitor or a receptionist or you know, a call center person, that's where they land anyway. If they're fishing, you know, for code execution, if they're phishing for credentials, whatever initial entry access route that they are going after, typically they're not going to be landing into a privileged, you know, an IT privileged account. And so turning that, you know, turning any regular account into the kind of privilege they need to do ransomware. That's what they're good at. And the avenues for doing it are, you know, very well understood in terms of attacking Windows domain environments and so on and so forth. So the fact that it's a journalist and if anything they probably should have paid more attention to that because I think of all the sorts of, you know, roles and industries and people you could go after with this kind of like, hey, we'll just give you, we'll cut you in on the ransom. Journalists seem to me to be the one that's least likely to work because, you know, as you suggested, like journalists are not there for the money. They are there because they want stories. If they were willing to do journalism for money, they'd be in corporate comms instead. Right. Getting paid fat bank. And instead, no, they are there because they want the stories. And so the fact that Joe Tidy immediately turned around to his editor and said, let's write a story about this, 100% predictable. So yeah, I don't know, I don't know what else we expected. I don't know what they expected out of this whole process.