Flight bomb threats and hacked fridges: A new frontier of cyber warfare

0:02The Telegraph.

0:30and lines moving. Call 1-800-GRAINGER, click grainger.com, or just stop by. Grainger, for the ones who get it done. The quarter pound of a cheese is made with 100 % fresh beef, cooked when you order it. Then comes the melted cheese, the slivered onions, the pickles, the ketchup, and the mustard. Add hot, crispy fries and an ice-cold Coke, all for$8. And if things go well, one loose fry at the bottom of the bag. The quarter pounder with cheese meal, now$8.

1:12Nuclear alert hoaxes, flight takeovers and even hacks on fridges. A new frontier of cyber attacks is upon us and it seems no facet of technology is exempt. Why are we seeing such a rise and can we even keep ourselves safe? Welcome to this cybersecurity special daily tea with me, Camilla Tominy. It is perfectly feasible to think that the machines could take over the controls of a plane. I don't want to be all about the doom and gloom that is possible. We've seen the movies. We know what they're writing about. But really, we've got to act now. This is a government level, a company level and on us as individuals, making sure we are doing the best we can to protect what we've got in front of us.

1:55Because there is this big AI vulnerability scanning tool that is now available. Jake Moore, thank you for joining me on The Daily Tea, says here you're a cyber security specialist at ESET, an internet security company. So I'm thinking if you're an expert on hacking, can you also hack? Well, ironically, the police taught me. Did they? Yeah, I spent 14 years in Dorset Police in digital forensics and the cyber crime team. But to work in the cyber crime team, they send you on a hacking course. Oh, had it? All right. And we're going to get into kind of fridge freezers and the hacking of those and flight hoaxes and all the rest of it.

2:30But as part of your day to day job, how are you assessing the threat posed by hackers to different companies? Yeah, so I'm researching all the weird and wonderful things that hackers are doing today, trying to predict what they're going to do in the next 12 months. And then often I get to test what they are actually doing, which might mean creating malware and sending that to see if it can actually do anything that it's been asked to do right the way through to sending phishing emails to people and seeing if they're clicking on them or offering up one time passcode. So a lot of the social engineering side of things and that can really help with companies realize where their threats really lie.

3:07And so they can learn from that in a safe environment. I mean, we're all used to big companies suffering data breaches and all the rest of it. I suppose normal people that don't have that much of an insight into kind of the cyber world go about their daily lives thinking that big businesses would be well protected. And then we hear things like fridge freezers being turned off across Europe. And many people who aren't that tech savvy will go, well, I didn't even know fridge freezers were linked to Wi-Fi or the internet. I thought they were just plugged in at the wall and turned on and on. And I know that sounds a bit naive.

3:39but what's going on here because it's one thing to say oh no we've had a password breach and can everybody please be vigilant and quite another to suggest that hackers have the capacity to basically shut down supermarkets and goodness knows what else well the worrying thing is it's actually extremely easy to do what they have done so if you think about it these appliances these freezers, they need to be on the internet. So the engineers can, at scale, look after thousands of appliances at once from a remote location. They can check the temperatures, they can move them up or down if they need to, and making sure everything's working, making sure they are actually still on, for example.

4:21But with that, there is a level of risk. And so ideally, that should be on a private network, so it then can't be hacked. They also need to be updated, like our phones and our laptops. they come with updates quite regularly. It might feel like a bit of a pain, but they're packed with security features that make them much, much safer. So anything that's on the internet, whether it's a fridge freezer, a toaster, or your phone, they need to be updated. Now, unfortunately, at this commercial level, you'd assume they'd be updated, but unfortunately they weren't. And then hackers were able to scan the internet, look for those vulnerabilities, very quickly spot that they're out of date or they're old machines, and therefore they're able to send what they want to them, in this case, turn them up using the defrosting mode.

5:05And that's what destroyed all the food. Okay, so just to reiterate, what happened was that refrigeration systems were attacked in Ireland, Sweden, Belgium, Luxembourg, the Netherlands and Estonia. That's less than a month after a similar incident that affected hundreds of supermarkets in France. So this has become some kind of, I don't know, phase, hacking phase. You'd ask yourself, why? What's the point of it? That's a good question. We're so used to seeing criminals looking to financially gain from a hack. So they might have a ransom demand on data that they've stolen and say, we're going to release this unless you pay us the two million pound ransom that we're giving you.

5:41And often they might pay up or they might not. But you've also got opportunistic hackers, often quite young. So talking teenagers, they might just look for the fun of it. And I say that with knowing that we do have young hackers that want to test and they get kudos from their friends and their peer groups online. And if they can say one, well, amongst those peer groups that they've done this, they get a lot of kudos to be able to say how easy it was. And it's even laughable amongst these hackers. But that's a real worry because it's causing mass disruption. There's potentially no end in sight.

6:20They're only going to scour what is available to see what is possible. And if they can do this now, I'd expect they're going to be even more creative over the next few years. Yeah, it's almost as if it's kind of the elaborate pranks that we've witnessed on YouTube taking on a whole new meaning now. At huge scales. When it comes to major businesses like that, you mentioned private networks earlier. I mean, first of all, again, it's generalised, but can any online network ever be truly safe from harm? No, but there is so much they can do to make it much safer. So there's a report that some of these devices had admin level passwords.

7:04So very simple to guess passwords, just a few numbers. One, two, three, four, five or something like that. Even less than that. And that's embarrassing on their half. But at the same time, you've got to realise why they do this. They're looking for convenience. And they're also potentially thinking no one would ever do this. At most, they might have thought that someone might have turned off the freezers, if possible. And if you turn off a freezer, you generally have 24 hours to move that food to another freezer that might be on. By turning them up, you destroy the food. And that's, in my view, potentially something that they never thought was on their radar.

7:39But they've missed so many of these securities that are available. They are costly, though. So just like your phone, after, say, six, maybe seven years, your phone won't be given the security updates. But with freezers, with any appliances that's given software inbuilt to it, it will have a use-by date. And therefore, those fridge freezers might come to the end of their life when they're not updated. But like an older person might think to themselves, and we have this all the time, people writing into the Telegraph, raging against the machine, literally. be it parking apps or online banking systems and question whether this is progress.

8:19I mean, presumably the supermarkets of Europe used to survive perfectly happily plugging fridges and freezers in, not having them on any kind of online network at all. Presumably a man or a woman would go around with a clipboard, check the temperature. I mean, are we actually sort of putting ourselves in danger by having so much hinged on the internet. Another example has been given in recent days about, I think, new Google technology, which might allow somebody to press a button and open their front door. Look, we all know about ring technology, and that may have advanced the case for home security.

8:54But at the same time, are we just basically kiboshing ourselves with this constant chase for new technology? It's a great question. There's a lot going on. People want to have the latest technology on an individual level. But if you look at it on a commercial level, they're looking at cost savings. Being able to control thousands of freezers that are looking after these products, not actually in the supermarkets, but elsewhere, it's much easier to control them from a single point miles away. And then they control all of those locations at once. So anything like that, to them, cost saving, it's technology that is helping them out, making them more efficient.

9:34And by the way, that probably outstrips a week's worth of lost stock. Yes, but they equally try to cut corners on security. We know this. There are decision makers that think, well, it might not happen. Let's wait to see if it does or it won't be as bad as what we've maybe thought of. You'll have security teams that are giving all of these scenarios to the decision makers always, because they're the ones that are saying this is possible and they might give it a risk value. But if they're not accepting that risk and they're not, say, defending against it, which will have a cost associated with it, then unfortunately they'll look for that cheaper option and hope for the best.

10:13But that's not an option when it comes to security. We know we need to resource it better. Also, consumers will be like, well, fine, if you've taken some shortcuts and it's lost you some fish fingers and some petit pois, that's your problem. What about if companies are taking shortcuts with our own data? Well, we know that they do. So when it comes to data, what you'll find on a consumer market, fridge freezers, for example, will often come with Internet connectivity. and they'll offer some sort of function that sounds really cool to the user. Like you'll be able to start the defrosting from a different location when you're not at home.

10:49By the way, I do question that. Why do we need to do this? Why on earth would you decide to defrost your fridge from? Do you know what I'm saying? It's marketing there, right? I know I get it, but sometimes some of these functions, oh, get a camera and have a look inside your fridge and see whether you've got enough brie left. or alternatively, get home, have a look at the cheese compartment and maybe go to the supermarket the following day. There's actually another point to this. When I actually looked into this about five years ago, when the Internet of Things was really taking off in the kitchen, I started to spot that some of the Internet-connected devices were actually cheaper.

11:24Now, I don't know for sure, but my assumption into this research was they were making those ones cheaper because they wanted you to buy the Internet-connected appliance. because if you do, you then give them your data. You then tell them not only your price bracket, but maybe what's going in that fridge if it's got a link. It might tell you when you use your dishwasher. It might tell you how often you defrost. It might be able to guess when you're going to do something. But the manufacturers, they are not the ones that look after the data. A third-party company is the one in control of it. So when we hear of these data breaches, they're often not the big manufacturers.

12:01They're the separate third-party data handling company. Similarly, what we saw with ASOS recently, another company's brought in that holds all that data. But once that's breached, you lose everything. So tell us about ASOS. I mean, for the uninitiated, it stands for as seen on screen. It's a longstanding internet clothing company, beloved by men, women, girls, boys everywhere. What happened? This was a really strange hack, actually. It was the first time that I've ever seen the ransom note sent out as a notification to all of their customers that had notifications on their phone. So the note went to them to say, hey, IT, we've got your data, effectively pay up.

12:45And assuming that's when the rest of the company and all the customers knew that their data had been breached. Now, in the hours and the days after that, there was a huge panic about what level of data was stolen. Was it just username? Maybe was it financial? Maybe passwords? It wasn't financial data and it wasn't password data, which is great. They're usually kept in a separate, more encrypted, more secure department. but the data on what you might have been looking for or what you might have even purchased owned by a third-party company was siphoned out from the employee's account that was hacked and then they got hold of this data that's valuable to people that are sending phishing emails that might now be targeted by saying i know your username and i know what type of what type of clothing you've been looking up and what you've been buying and therefore we must be ASOS.

13:37So click on this link. So it's like using intel to convince people that they are who they say they are, even though they're obviously not. Yes. And this works very well because when you get a phishing email, it's often quite obvious. But when they know so much about you, the last four digits of your card, your address, the last few items that you've bought, you let your guard down a little bit less each time you think it must be them. And that's when they strike. Although whenever you receive a dodgy email, don't you always just go to the sender and check whether it is actually from ebay.co.uk or somebody else.

14:10That's a perfect world. And I get it. There are people that don't because they don't have the time to do that, for example. Who doesn't have the time to check whether an email is coming through from somebody calling themselves happy dogster 1586 or an actual legitimate company? Well, that email is often hidden because they are saving space on your screen for other things. So an example is, I love this, that my dad sent me what was clearly a phishing email from eBay. And he said, is this a phishing email? I said, Dad, have you got eBay? He said, no, I did wonder. I know, but this is when boomers send stuff through to their kids going, is this AI?

14:48It's like a talking baby. Yeah. And you're saying, guys. Okay, so there are vulnerable people out there. And we're talking on a very kind of commercial consumer level here. Let's go a bit more macro and talk about flight hoaxes. I ask about the jumbo jets, Jake, because we've had seven flights across Europe targeted by suspected bomb threats. So, again, this is about sowing the seed of fear. These were hoaxes. They ground flights. They then ruin holidays for people. They ruin business trips. This is the other worry that we have, that there is the capacity to keep planes on the ground, let alone take them out of the sky.

15:28Yeah. And this is a fear tactic, again, and it's worked in their eyes remarkably well. We don't want to see planes grounded. We definitely don't want to see planes in trouble once they're in the sky. So this is another way to learn from it. And I always try and be positive from any attack or any compromise is to learn from it. Hopefully we can divulge into the weeds of this. Some of the best companies out there that have been hacked will actually blog exactly what's happened. One of those great examples is actually Binance now are really trying to delve into the weeds of what the supposed North Koreans have done with that employee's laptop.

16:10By learning that themselves is brilliant. But by sharing that knowledge with every other company, so by sharing how they were able to send that message to those airlines, That makes every other airline understand what the threat landscape is like for others and for everyone currently. And we can all work together. And this is about shared intelligence, which is a vital part in this whole landscape that we're seeing.

16:51is uniquely connected to its destination, delivering local experiences and memorable stays, while being backed by the quality, reliability, and Marriott Bonvoy benefits travelers know and trust. Experience the destination without the compromise. Series by Marriott is part of Marriott Bonvoy. Book direct at Marriott.com or on the Marriott Bonvoy app. If you've ever sent a cold email, you know how it goes. Figuring out who to email, where their contact info is, and what messaging will land. It takes time and sometimes dozens of tabs. I've been there. That's why I use Apollo. Apollo is an all-in-one system for data enrichment, sequencing, automated messaging, and intelligence, powered by AI that helps do the work, so you can do everything from finding prospects to closing deals, all in one place.

17:39Head to Apollo.io and sign up for free. That's Apollo.io. Grainger knows if you're a procurement manager at an industrial manufacturing facility, you're balancing inventory and budget while sourcing critical supplies across the operation. Too much inventory? Costs climb. Too little? Production slows. Grainger's$2 billion in on-hand inventory helps you get what you need when you need it, so you can help keep budgets balanced and lines moving. Call 1-800-GRAINGER, click grainger.com, or just stop by. Grainger, for the ones who get it done.

18:22Is there a possibility that hacking could become so sophisticated that, God forbid, it brings down a jumbo jet? I think that's a bit extreme. And I don't want to be all about the doom and gloom that is possible. We've seen the movies. We know what they're writing about. But really, we've got to act now. This is a government level, company level and on us as individuals, making sure we are doing the best we can to protect what we've got in front of us. Because there is this big AI vulnerability scanning tool that is now available. An AI vulnerability scanning tool is a technology that uses superpowered intelligence to look for vulnerabilities in software or in a website or in a database.

19:13Humans can do this. It takes time. AI has come along and it can very quickly just find those vulnerabilities. Now, somebody's developed the AI to do that, by the way. Not somebody. We have by giving data. The engine is the data that's on the internet, and we have created that and shown them. And that's going through forums like Reddit. It's going through research papers, university data. So much data is there. I know, but this is, first of all, I'm noting something quite scary. You're not saying no to the question of whether hackers could bring down a jumbo jet, which then puts kind of global terrorism in a completely new light.

19:52Because traditionally, we have expected human agents to bring down planes by hijacking them or in the case recently of training as a co-pilot and trying to attack them with an axe held in the cockpit and all the rest of it. I mean, it's perfectly feasible without turning into Linda Hamilton from Terminator. It is perfectly feasible to think that the machines could take over the controls of the plane. Well, that's why we give so many human overriding tools. So the human in the loop, as we call it, on a plane could take over that plane if the machines are playing up. And this is where machines work well with humans.

20:34We still have them in other areas, but less and less are humans needed. But there's still often an override button that effectively says, I don't like what you're doing. This is out of control. the human takes back the control. It's like an autonomous car. If it feels like it's speeding up, the human in the car should be able to tap on the brake and it works. But the suspicion is that technology is advancing at such a pace that it might outpace human override. I suppose that is the Terminator theory, right? Yes, but I think we're so many years off that. Yeah, but it still could happen. Yeah, that's not going to happen in the next 10 years, but it might happen in the next 50.

21:12And that's why we've got to work now. Well, yeah, but then, Jake, at the end of the day, we're getting back to the kind of anthropic and other warnings that we're all going to be killed by the AI that we have ourselves developed. So isn't it astonishing? AI is feeding off human nature, human intelligence, human research, human knowledge, and potentially poised to use it against us to create an existential threat for life on Earth. Yes, but that's why we have to build those safeguards in now. We've heard the warnings. I don't think it's too late. We know of many people that have left those huge AI companies.

21:51But often you've got to remember that some of them have gone and created startup companies that want the marketing and free advertising. So we've got to think that, yes, the technology is possible. And again, we've seen the movies. But by building into this software, the human in the hope, the safeguards that should hopefully be far better than what we have seen. But it is improving in those areas. So two years ago, I was able to get AI to make me malware, for example. Now, it won't. Maybe a year ago, you could bend the rules and say, oh, and I did this. I said, oh, I'm a security researcher. He said, oh, why didn't you say so?

22:29And it would then help me out. But now, and I continually test these things out. And now if you try any of these rule bendings, it says, no, we're taught not to do this. And so it feels like the curve will flatten off. And that's where we all play our part in this. I mean, I would say to anyone that's listening to this is learn as much as you can about AI because it's not going away. And the more we know about it, I think the safer we'll actually become. We are moving to a world where these AI agents are coming in. It's not just talking to an AI chatbot like we would Google and just ask a question and come back with an answer.

23:08We're looking in the future that AI agents will be acting on our behalf in whatever we offer it to. OK, well, why don't we get into then sort of cyber cosplay? So we have this situation where we've got fake nuclear warnings being issued after Ukrainian and Russian air alerts apps were hacked. because the other effect of this is something might not have happened at all, but there is the potential for some bad actors to spread terror across the world simply by hacking and then having a situation unfold where people are being given false information. Yeah, actually, I see this as really bad, actually, because this is hacking trust and it's weaponising fear.

23:50And for me, that's what really damages the future Because once you damage trust, you don't then trust a genuine notification that says you've got to move or you've got to stockpile. We want to be able to trust what we hear and what we are seeing as breaking. And once fear has come into being weaponized, I think people then really panic. And that can cause a wave of other effects. We all saw what happened in COVID when we thought that toilet paper might go off the shelves. People ran to get toilet paper. And that's something that moves away from teenage hackers having just a bit of a laugh, may point towards, say, state-sponsored attackers, or it may go further to those criminal groups that are looking to potentially break financial departments and steal huge amounts of money.

24:42On top of that, yeah, we have to make sure critical infrastructure is secure. Breaching, I would say, moving away from the supermarkets for one moment, not to call that critical infrastructure just for this, moving into what we really see, national grid and so on. We want to make sure they are the best protected. But if we bring in AI as a worry here, we are equally using AI to protect. So we're having fire being fought with fire. And that's where we're moving to. We've seen what we call machine learning over the last 20, 30 years. So it's building on learning data and helping look for anomalies or anything that might be something that is a worry.

25:27And now we're letting those models decide for us, but still working alongside humans. And with that, I think we could be able to protect the future. But when we talk about state-sponsored hacking, let's also look at North Korea being forced to deny that it was behind this record 6.3 billion hack of Binance, which has affected a great many people. This is a cryptocurrency giant and its digital assets were impacted by what is thought to have been the biggest crypto hack on record. Now, this is the other concern, of course. It's all very well what we're regulating both in Europe and America and what we're working on in the so-called right-minded Western world.

26:10We have no idea what Kim Jong-un and others are up to. What could they be doing on AI or any of this stuff behind extremely closed doors in total secrecy? Yeah, so what we're looking at here is very sophisticated ways in. So what it looks like with the Binance attack, it is impressive on a criminal level. I have to take my hat off if I'm thinking like a criminal, like I used to in the police force. But at the same time, Binance had a lot of privilege access within the terminal, so the computer, that the employee who was targeted had to offer. So if the North Koreans or the alleged North Koreans sent this link with an executable file to download onto that machine, often packaged in a way that there is a job interview at the end of it.

27:09So it might even look like Zoom or an equivalent of Zoom. That's quite normal. Many companies say we don't use Zoom or Teams. We use our own bespoke software. when you're dangled a carrot that says we've got a 300 ,000 pound job which will be perfect for you because they've looked them up on LinkedIn we know that they're looking through LinkedIn looking for people with the right skills looking to see where they work it's open source research at their fingertips they pick the right person they dangle the carrot they say let's go for the job interview when they click on that link they download what looks like a video conferencing call piece of software.

27:45But in the background, when the research has been thrown at it, it is doing so much more. It is stealing data. It's looking for passwords, looking for Bitcoin and other cryptocurrency wallets that might give them access. But if they're able to then act as that employee on that laptop, they can do so much more. So really, it's the sophistication of how they're getting to the human. But we need to learn from this. Again, it's all a big learning surface here that we shouldn't have just privileged access on one person's laptop that can open up billions of dollars of loss. And this is where we should have more fail safes.

28:23But I think up until now, we never thought it would happen. And I think in the last month, if anything's been taught to us, it's expect the unexpected. Isn't it astonishing as well how I think when people think of hackers, They're kind of thinking about Matthew Broderick in war games or something. And actually, some of the conduits into these big businesses are so basic and straightforward, targeting an individual employee who research has revealed might be job hunting and then send them a speculative email. Like it's so tapping into, funny enough, it's to hack into the technology through very human roots.

29:03So then, and how do you ward against that? But of course, even at this company, you know, we get little test emails where the data department sees if we're going to click on something phishing and then you'll be taken to a page saying, why have you clicked on this? And let's re-educate the staff about cybersecurity. But human beings will tend to click on things mistakenly. And this is it. I'm fascinated by this. This is the psychology of humans and it's called hacking the human. And criminals have been doing this for years. We're talking hundreds of years. You look at the old classic con on the street, the whole follow the ball under the three cups.

29:40It's wonderful how they're using this. They're using other people that are in the crowd who might win just before they actually go for the target, who then loses everything, of course. The same thing has just moved onto the internet. And if you can target someone's brain through psychology, you can get so much further. And these are being tweaked all the time. The software in the background, which is now the malware, yeah, that's been around for a while, but they're just fine-tuning it. So it's not just cyber warfare, it's psychological warfare in a way. Yeah, and they're very good at it. And unfortunately, humans think they are their best advocate of being secure.

30:21They think they're foolproof. But if you package it up correctly enough, everyone's got their limit of where they might think, well, that makes sense. Because if you get an email from your bank, sorry, if you get an email from a bank that you don't bank with, that you know straight away, that's a phishing email. But if you get an email from your bank that you've just moved to, and it says there's a problem with your bank account, without any numbers in there or anything, you put that into the narrative that you've got in your mind of, well, I have just moved bank, and there might be an issue. I better call the number on the back of my card, but it says I can just chat to someone here on this link.

30:59So, you know what? That's easy. All right. I'll click that. But has Jake got any rules for life that he lives by in order to protect himself? Yeah. I mean, are you somebody who is literally tapping in an 18-digit code into their iPhone in order to open it and all this kind of stuff? Not far off. Really? How long is your code to open your iPhone? I don't want to say. Go on, please. Ten. Is it? Yeah. Mine's six. Face ID, though. Right. Face ID is wonderful to get into a phone. Yeah. You never type in that six-digit code, I imagine. Sometimes I do. Maybe if you turn the phone off. You know when it doesn't recognize you or when my glasses late at night, no makeup on.

31:33It's like, who the hell is this ugly bird? But the fact is you don't type in that number often. Why keep it short? Some people will actually override an iPhone pin code and make it just the four digits or not even have one because they want ease. And this is the security versus convenience. But are people who don't have a code on their phones total maniacs? Yes. Yes. If you have a code that is related to you, I would say that you are falling at the first hurdle. OK. All right. And then tell me some other Jake rules for life, because I presume that if you're in this world, you're not a Luddite, right?

32:09You must embrace this terminology. So, well, first of all, I would say zero trust. We use zero trust as a rule in business where we just don't trust anything until we really have proof that there's authentication and verifying who that is or what that is. but in the real world it's a few rules. So passwords. Passwords need to be unique. Many people are still using the same two or three passwords or derivatives of because they can remember them. No, they're not, honestly. So are you telling me you've got a different complicated including special characters password? They're all 20 characters long.

32:47I don't know any of them. I keep them in a password manager and this is kept on a secure cloud that only me, my devices using biometrics can get into. But after that, you then need multi-factor authentication. Yes. With multi-factor authentication, so at the very minimum, a one-time code sent by text message that comes to you. That's the base level. Is that an OTP? Yeah, that's right. But hang on a minute. So Jake is just trying to put a shop in at Ocado. And doesn't Jake have a moment where, for some reason, this bloody app doesn't recognize the password that you know you've put in, that you know is true, because it's been saved in a password manager.

33:28And then you're jumping through 15 other hoops, trying to get a password through to another laptop, through to another phone. And by the end of it, you're wondering why you didn't just put my dog's name, 123. No, never ever use anything connected to you. Because if you're using your dog's name, I've done this. I mean, it was one of my party tricks at a wedding, sitting on a table and guessing people's passwords or codes to get into their phone, just purely because I've looked them up on social media in the 10 minute break. So if you're pasting your dog on Facebook and then using it as your password, you're pasting your password on the internet for everyone to see.

34:05And people will always do this. And it's because, again, it comes down to security versus convenience. And we want things to be convenient. but at the risk of convenience you then get rid of security okay so we've got a rule for life which is a 10 digit code to open the iphone or android we've got a no trust policy do not trust anything you're ever sent check check and check again journalistic mantra yeah third of all minimum 10 digit passwords they must all be different they must be securely locked up now sorry i'm gonna i'm going to say minimum 16 characters. It doesn't matter though, because you're not creating it.

34:44The password manager will create it for you. Got it. Even better than that. So you do get the password. So when people go, no, override, I'm not getting this bizarre password manager to give me a bizarre thing with amphosans and explanation marks and goodness knows what else in. You opt for that every time, save it in the separate manager. Okay. So Android and iPhone will help you out with that. All right. Give me another Jake rule for life. So on top of that, then pass keys. So pass keys are the latest thing that say, you know what? We know that you can't remember all your passwords. So would you like to transfer to a pass key?

35:18Let's say WhatsApp offers it, social media, your email. These are the core functions of your everyday life that you might go to every day. They're offering you pass keys. They use the biometrics from your phone. So if you have a face ID or a fingerprint ID phone, it takes that. and it keeps it nice and secure and encrypted, it then knows your device. So it means that only you and your device can get into that account. So if I were to somehow get your password and I'd get it onto a different device and I'd try and log into your email, it's just going to say, no, we're not allowing this because we need a passkey.

35:54And the passkey only works with your face on that device and maybe your laptop, because they're the only two devices that you said can go into your email. Anyone else is locked out. Gotcha. It's perfect. But do you know the irony of this is pass keys are so good that people think they can't be secure because they're too convenient. Oh, OK. All right. And then finally, when people say, well, nobody's interested in hacking me because I'm just a nobody. Well, that's when I would say, make sure you're doing all your updates. So when phones and laptops are saying, please update me, please do that, because you are not who you might think you are.

36:33you are a number. So when criminals are looking at information on the internet or looking at IP addresses, you are literally numbers. So in the case of the fridge freezers, they would see each of those fridge freezers as a number and they would know that they are not updated. They can then read the software remotely and send some information to it. In this case, turn it up. So in an individual case, it knows that you are out of security updates. Yes. So you have not patched a vulnerability that Apple or Google have found. And therefore, I can then take control of that device. So when they are offering you these updates, do it.

37:18All right. Final question. Do I need to start doing push-ups, get myself a white singlet vest, and know how to operate a pump-action shotgun with one hand, Linda Hamilton style? Whatever you do in your free time, that's up to you. Well, thank you very much indeed for joining us on today's Daily Tea. Thank you.

38:05Some travelers want the charm of an independent hotel. Others want the confidence of a trusted global brand. With Series by Marriott, you get both. Each property is uniquely connected to its destination, delivering local experiences and memorable stays, while being backed by the quality, reliability, and Marriott Bonvoy benefits travelers know and trust. Experience the destination without the compromise. Series by Marriott is part of Marriott Bonvoy. Book direct at Marriott.com or on the Marriott Bonvoy app. The holidays bring brand new gadgets, bigger spending, and even more on your to-do list.

38:42Good thing Verizon gives you more than just a great network. We give you a whole lineup of products and services. Like a protection plan for your family's home tech that covers everyday mishaps. A credit card that rewards holiday shopping with real savings. and a smartwatch built specifically for keeping up with your kids. Take the stress out of the season. Pick what works for you at verizon.com slash extras.