Vibe-coded shops, and hackable Flock cameras

0:03Dave Bittner:I have to say, what this reminds me of is there was a glitch on Amazon for a while. I don't know if it's still there, where if you went to buy condoms, it would ask you, would you like to buy this item used?

0:46Graham Cluley:Dave, always lovely to have you back on the show. Star of The Cyber Wire, Hacking Humans, that other one I've forgotten the name of.

0:55Dave Bittner:Caveat.

1:05Graham Cluley:Caveat, thank you. Smashing Security.

1:13Dave Bittner:It's all good, Graham.

1:17Graham Cluley:Smashing Security, episode 486, Vibe-Coded Shops and Hackable Flock Cameras, with Graham Cluley and special guest Dave Bittner. The good news is, Dave, actually, is I'm going to be recommending that all of our listeners go and check out your podcasts, particularly next week, because there isn't Hello, hello, and welcome to Smashing Security, episode 486. going to be an episode of Smashing Security next week. I am grabbing a map, a compass, and a rucksack full of cheese sandwiches, and I am going to My name's Graham Cluley.

1:41Graham Cluley:be venturing into the wilds of Britain because I'm moving house. I'm going to a different part of the UK.

1:44Dave Bittner:Just put a Y cable in I'm talking about a bunch of researchers who are asking the there. What could go wrong? question, what the flock?

2:14Graham Cluley:And I'm gonna be going online to buy a laser-equipped kiwi. All this and much more coming up on this episode of Smashing Security. This episode of Smashing Security is sponsored by Vanta. It's 2:00 AM. Somewhere, a security team is drowning. The spreadsheets. There are so many spreadsheets. Vendor risk assessments unread. Audit evidence scattered like ash in the wind.

2:57Dave Bittner:And I'm Dave Bittner.

2:58Graham Cluley:I've filled out the same questionnaire 4 times this week, Graham. 4 times! Some men choose to face this alone, but not tonight.

3:03Joe:Okay, Graham, this is a bit much.

3:21Graham Cluley:Yeah, fair point. Anyway, Vanta—

3:34Joe:Thank God.

3:46Graham Cluley:Vanta's a trust management platform that automates the mind-numbing stuff that makes you want to poke your eyes out with a fork. No more manual evidence chasing, no more questionnaire hell. It continuously monitors your systems and keeps you audit ready for SOC 2, ISO 27001, HIPAA, GDPR, the works. And it uses AI. Yes, Joe, it does.

3:53Joe:To flag risks and streamline evidence collection so your whole security program stays in shape, not just the week before an audit.

4:08Graham Cluley:No more 2:00 AM dread. No more spreadsheet purgatory. Just peace.

4:22Joe:And $1,000 off if you demo it right now.

4:33Graham Cluley:$1,000?

4:50Joe:vanta.com/smashing. Go now before it's too late.

4:57Graham Cluley:That's vanta.com/smashing.

5:06Joe:And thanks to Vanta for supporting the show.

5:13Graham Cluley:Now, chums, there are important questions to be asked of this week's guest, Mr. Dave Bittner. I won't beat around the bush, Dave. How do you feel about crusty socks?

5:25Dave Bittner:How do I feel about crusty socks?

5:35Graham Cluley:Yes, how do you feel about them?

5:46Dave Bittner:I try to avoid them whenever possible. Wow.

5:55Graham Cluley:You're not growing any in Chez Bittner right now? I imagine they are pretty fresh and clean, those beautiful feet of yours these days. I'm asking because this week, somewhere in Auckland, New Zealand, there is a convenience store that briefly was selling a pair of crusty socks on its website. And that wasn't all they were selling. They were also selling a rather divine Princess Diana commemorative plate.

6:23Unknown:Oh no.

6:33Graham Cluley:And if you were quick, you could also have bought all of New Zealand's national parks. Now, this wasn't some marketing stunt. This wasn't a flea market with any old bric-a-brac and odds and sods and national parks and the like. Instead, this particular store had made a bit of an error when it built its website. It had used something called Base44, and Base44 is a vibe coding platform owned by Wix, one of those places where they sort of roll your own website.

6:53Graham Cluley:They were being sold to the highest bidder as well. You can go to it and out the other end of the mixer will come a brand new website. Dave, have you ever vibe coded at all? It's very popular these days.

7:00Dave Bittner:The closest I have come to vibe coding was I asked ChatGPT to create a version of Pong in BASIC for the TRS-80 Color Computer.

7:09Graham Cluley:And did it work?

7:18Dave Bittner:Yeah. I mean, it was slow, but it worked.

7:26Graham Cluley:I rather approve of that. What do you think of the idea of vibe coding generally?

7:36Dave Bittner:I think at this point it's unavoidable. I think it's out of the box and there's no putting it back in there. But the people I know who are professional developers, many of them say that their job has shifted from actually being a developer to being a supervisor of the AI that's actually doing the coding. I suppose as long as there's oversight, then it's okay, but I think everybody's a little nervous about this.

7:44Graham Cluley:And I won't have a chance to put out an episode next week. I think if you've spent years and years studying how to code and now you've been replaced by a glorified speak-and-spell machine, you are going to be pretty upset about this. I have vibe coded myself sometimes. You know how Liam Neeson in that movie says he has a very particular set of skills? What I will be doing is I'll be really busy contacting the CEO of Openreach and asking why it's so

7:56Dave Bittner:Yes. Yes.

8:02Graham Cluley:Well, I have a very particular set of requirements on my computer sometimes. You just, oh, if only my computer would do this in this particular way. And in the past, I would spend hours looking for a utility which did that particular thing. And I do find myself now sometimes thinking, hmm, rather than spending four months coding this myself, maybe I could ask an AI to help me. And bloomin' heck, I mean, they can do it. I wouldn't necessarily want to roll it out to the public. I wouldn't necessarily want to give it to other people and let them find the vulnerabilities in it.

8:04Graham Cluley:hard to get me a fibre internet connection to my house when there's a box just 5 feet away from me.

8:09Dave Bittner:You're okay being your own guinea pig.

8:21Graham Cluley:Yes. You know, think, okay, I could run this on my computer. But here's the problem. Somewhere in the process of vibe coding their own e-commerce site, these chaps who were running this store, they somehow left the entire thing open to be edited by anybody on the entire internet. Yeah, exactly. What could possibly go wrong? But never fear, folks.

8:36Dave Bittner:Oh my.

8:41Graham Cluley:If you can hold your breath until Thursday, the 8th of October, there'll be a new episode of Smashing Security then. And in the meantime, check out Caveat and Hacking Humans and The Cyber Wire and all the other — well, thank you. Well, before we kick off, let's thank this week's wonderful sponsors, ThreatLocker, Origin, and Vanta. No password required. We'll be hearing more about them later on in the podcast. This week on Smashing Security, we won't be talking about how researchers managed to take over the accounts of staff at OpenAI using Anthropic's Claude. You'll hear no discussion of how Dutch police have asked for the public's help after releasing a recording of what they believe to be the voice of a member of the Shiny Hunters hacking group.

8:54Dave Bittner:Wow.

8:56Graham Cluley:And we won't even mention how North Korea has been posing as recruiters to infect job seekers during fake coding tests and then waiting for them to get hired somewhere real. So Dave, what are you going to be talking about this week?

8:59Dave Bittner:How do you miss that?

9:05Graham Cluley:Yeah. Exactly. And you also think, well, how did Base44 ever allow that to be possible? So even if it wasn't a vulnerability in Base44, I suspect it was actually the setting up of the particular environment where there was an error. Why did they, considering this was something which was meant to be used by non-professionals, people who weren't versed in computer security and technology — maybe, you know, I need a website. I run a shop selling shoelaces. I know nothing about computers. Can you create me a website? Yes, I'll go and do that. How can they leave it open like that?

9:12Dave Bittner:It seems like a top-tier requirement of building something like this.

9:22Graham Cluley:You would think so.

9:31Dave Bittner:Don't let the general public make changes.

9:41Graham Cluley:And of course, inevitably, random members of the public did discover that they could just go to the website and make any changes they wanted. They could add their own listings to the live site.

9:53Dave Bittner:And they did not disappoint.

10:04Graham Cluley:Of course, the internet never disappoints when given an opportunity like that. So you too could buy a pair of crusty old socks, or you could purchase a single banana for $850, or a mouldy school lunch. You too could find yourself paying off New Zealand's Deputy Prime Minister for $3,000.

10:08Dave Bittner:Graham!

10:10Graham Cluley:All kinds of things. There was even this Princess Diana commemorative dinner plate for $1.50. Now, I've shared with you—

10:16Dave Bittner:Yes.

10:25Graham Cluley:An image, Dave, of this plate. I think it's Princess Diana.

10:36Dave Bittner:Graham, never before has the beauty of the dear departed princess been on better display than it is on this, this clearly handmade and painted plate. I would be honoured and proud to display this anywhere in my home, and I hope our listeners will take the time to check it out. It's just gorgeous.

10:43Graham Cluley:It's a beautiful thing. And there it is alongside the Laser Kiwi, which obviously is something every person in New Zealand needs. Dave, if you had the opportunity to list something on a site like this, what sort of thing do you imagine you would want to list? What wonders would you put up on this online emporium?

10:50Dave Bittner:Oh my goodness, I don't know. But I have to say what this reminds me of is — there was a glitch on Amazon for a while. I don't know if it's still there, where if you went to buy—

10:59Graham Cluley:Was this the buy route?

11:05Dave Bittner:No, no, no. But when I was a No, no. If you went to buy condoms, teenager, I think I had issues with crusty it would ask you, would you like to Tickles me. socks, but it's been a while. buy this item used?

11:34Graham Cluley:Some people would.

11:41Dave Bittner:Tickles me to this day. So yeah, it's not just a small little convenience store that these sort of things can happen to. Happens to the largest commerce platform in the world, right?

11:50Graham Cluley:So at some point, the actual store owner tweaked what was going on and he tried to fight back, but he didn't know how to secure the site. So instead what he did was he started posting other items for sale with titles like, please stop hacking us. And within minutes, someone else added a new listing saying, well, don't use an AI site builder then, which seems like fair enough security advice coming for free from the general public.

11:59Dave Bittner:Mm-hmm.

12:08Graham Cluley:Now, this, as I said, may not have been explicitly the fault of Base44. Maybe the security settings hadn't been set properly. But, you know, it's not as though this were the first time that Base44 has made the headlines. Last year, security researchers at Wiz found an authentication bypass vulnerability in the platform. That allowed unauthorised access to private apps built by its users. What that meant was if you could see the URL, which of course you could in your browser, of a particular app, you would then be able to create a verified account to access it as the owner yourself. So the supposedly secret app ID was there for anybody to see in the URL. So security, not necessarily their strong point. Wow.

12:19Dave Bittner:How is Base44 still in business, one has to ask?

12:30Graham Cluley:And how much did Wix pay in order to acquire Base44? I hope they think this was money well spent. Or maybe they bought them and then got rid of all the security engineers. I don't know.

12:43Dave Bittner:Yeah. Wow.

12:53Graham Cluley:So Dave, there's going to be a lot of small businesses wanting their websites to be built or refreshed. It's like, oh, we can't really carry on with this Dreamweaver site we created in 1999 anymore, we're going to have to do a bit of a You know what? revamp of that. And so you've got to think a lot of people will turn to simple tools that promise a lot, but that the users don't really understand. There are probably people who

13:27Dave Bittner:No.

13:28Graham Cluley:And that's going to be a problem.

13:29Dave Bittner:Just crowdsource everything on your website, right? Open it up to the entire internet. What could go wrong?

13:31Graham Cluley:pay more for that. Because these tools, they're explicitly marketed at people who have no idea, not a clue what an access control setting is. And the AI might happily build you a gorgeous looking website, but it won't necessarily tell you if you've left all the doors and windows wide open. So I raise a glass right now to the people of New Zealand who, with good humour, have— I mean, technically, I suppose what they did was maybe that was against the law.

13:58Graham Cluley:I don't know whether it was or not.

14:06Dave Bittner:Hmm.

14:07Graham Cluley:If it's been left open like that. But it appears not to have been done for malicious reasons, but everyone had a good old laugh about it, which is good fun.

14:14Dave Bittner:I suppose the flip side is that this convenience store operator is seeing more traffic to their website than probably ever before.

14:22Graham Cluley:It's interesting, isn't it? Because sometimes there can be marketing stunts like this to get you some traffic. I tried going to this particular website — right now it's down. You get a Cloudflare error. I don't know if it's because too many people have gone there or they thought, we don't know how to stop this, we're just going to yank out some cables — they've turned it off. But there have been cases in the past where companies — I can think of one dating site for beautiful people, for instance, where they intentionally pretended that they had been hacked in order to get lots of press coverage.

14:44Graham Cluley:A very unusual story. I'll link to it in the show notes if anyone's interested in that. This episode of Smashing Security is supported by Origin. Joe, did you see that big story about AI agents running around inside OpenAI and Hugging Face's own environment?

15:11Joe:The ones dividing up work between themselves and reviewing each other's output?

15:15Graham Cluley:That's the one. One of the things that really struck me was how the people who actually built those AI models had a hard time reconstructing exactly what the agents had done and said to each other.

15:26Joe:Right, and that's really the point. Even the experts closest to the technology struggled to answer a simple question: what did our AI actually do?

15:35Graham Cluley:Which is exactly the question this week's sponsor, Origin, wants you thinking about. If an AI agent caused an incident at your company tomorrow, what evidence could you actually produce?

15:45Joe:For most teams, the honest answer is not much. You've got the prompt and you've got the final result, but everything in between — the commands it ran, the files it changed, the credentials it picked up along the way — that's usually gone the moment the terminal closes.

15:58Graham Cluley:And that's the gap our sponsor, Origin, was built to close. Origin is an endpoint AI observability company. A sensor on the machine records the agent's work as it happens. Who started the session, what was asked, what the agent reached, and what it changed, all on one timeline.

16:16Joe:So if something unexpected happens, you're not piecing it together from scattered logs. You open the trace and read the session in order from the original prompt through to the outcome.

16:25Graham Cluley:It works wherever agents actually operate too. Coding agents in a terminal, local agents, anything calling an MCP server on a laptop. None of that needs to pass through a cloud gateway for Origin to see it.

16:38Joe:So if you want to see what a trace actually looks like, head to originhq.com/smashing.

16:44Graham Cluley:That's originhq.com/smashing. And thanks to Origin for sponsoring the podcast.

16:54Dave Bittner:Well, Graham, do you have Flock Safety cameras over on your side of the pond yet?

17:00Graham Cluley:Flock surveillance cameras? Yes, we do. Britain is supposed to be the country with more CCTV cameras than practically anywhere else. I think we've only got more than North Korea. But these Flock ones, they're making lots of headlines over in the States, aren't they? They seem to be quite invasive.

17:16Dave Bittner:They are. And we're doing our best to catch up with you all. These Flock Safety cameras are popping up like dandelions all over the place. In fact, there are open-source projects to track their locations. People have put together Google Maps where you can look at your community and see where the Flock Safety cameras are around you.

17:38Graham Cluley:Right.

17:38Dave Bittner:There are several around where I live, and they're easy to spot. They have a particular look to them, and I find it disturbing as they're popping up all over the place. These are licence plate reading cameras. So the idea is you drive by with your car, it takes a picture of your car, it logs your licence plate, it logs the type of car, what direction you were going, the time of day, all that sort of thing. And of course, you get enough of these little bits of data, and you can put together a picture of where someone's going and when they're going and what they may be up to. So hackers have gotten their hands on one of these cameras.

17:53Dave Bittner:And by getting their hands on one, I think they backed a truck into it and ran off with it. I think that's sort of the subtext of what's going on here. But there are hundreds of thousands of them all over our great nation, so I don't think they'll miss the one. But they got a good look inside the cameras, and from a security point of view, it's not good. There's a hacker collective called Stegonogram.

18:42Unknown:Okay.

18:43Dave Bittner:Of course, there's a jaunty zero in the middle of the word Stegonogram instead of an O, because hackers.

18:49Graham Cluley:Yes.

18:50Dave Bittner:So they got their hands on this Flock camera. They took it apart, and they extracted its storage. And the group Distributed Denial of Secrets has published images of those file systems, which has enabled lots of researchers to take a look under the hood at what exactly is going on here. So security researcher Mika Lee, who you've interviewed before, haven't you, Graham?

19:13Graham Cluley:I mean, have you?

19:13Dave Bittner:Mika's been a guest on Smashing.

19:15Graham Cluley:I don't think — no, Mika hasn't been on Smashing Security, but I certainly know their work.

19:19Dave Bittner:Yeah. So well-known researcher, well-respected.

19:19Unknown:Yeah.

19:29Dave Bittner:He took a look and published a blog post about this. He found that this camera was running a modified version of Android 8.1, which is an OS that was released in 2017 and no longer supported by Google. Its patching was dated to June of 2018, and its underlying Linux kernel was also, in his words, ancient. So in other words, this camera was watching modern traffic with software security that was from the 2010s. Lee identified several publicly known vulnerabilities that are applicable to components of the device. He saw flaws that could allow malicious software already running on the camera to gain deeper control.

20:01Dave Bittner:But then, sort of the chef's kiss of all this, are the credentials.

20:10Graham Cluley:Right.

20:10Dave Bittner:He found an API key hardcoded into a software library that's shared by 19 Flock applications that run on the camera. So based on his analysis, that key is used during the process by which the cameras obtain their credentials for accessing Flock's backend infrastructure. So the—

20:30Graham Cluley:Is it possible the person who created these cameras then got a job at Base44 creating a website building tool?

20:40Dave Bittner:Yes, yes.

20:40Graham Cluley:Right.

20:41Dave Bittner:Because they had excellent credentials. And the people looked at their past work and said, well, this looks good to us. Yeah.

20:50Graham Cluley:Good enough.

20:52Dave Bittner:The device also stored authentication credentials in plaintext—

20:56Graham Cluley:Of course.

20:56Dave Bittner:On an unencrypted partition. Now I will say, as you and I are recording this, this API key has been making the rounds on social media. It is everywhere. If you want to look for it, people are just posting and reposting, having the time of their lives posting this hardcoded key for Flock. Not going to Obviously it's illegal to use this key to do what you want with Flock's API server, but do we know what you could do with this? recognise it as

21:27Graham Cluley:Is it a case of taking data off the cameras or maybe putting data on the cameras?

21:31Dave Bittner:being human. No. It seems as though this key is how the camera authenticates itself with Flock's mothership, if you will. So it says, this is who I am, this is where I am, which is another thing. The camera sends its GPS coordinates to identify where it is. And so with this information, you could basically authenticate yourself on Flock's API on their home base servers and pretend to be one of the remote cameras.

22:03Graham Cluley:We could pretend to be

22:03Dave Bittner:We could, we could.

22:09Graham Cluley:And muddy their database.

22:10Dave Bittner:Imagine the fun we could have. We could post pictures of that Princess Di plate. Just—

22:13Graham Cluley:a Flock camera if we I don't think facial recognition is going to work on that plate.

22:19Dave Bittner:No, no.

22:19Graham Cluley:I don't think you'd even— Even if they had wanted to, maybe. No. a modern Flock camera rather than one built in

22:29Dave Bittner:So the logs recovered from the camera contained GPS coordinates. This particular camera seemed to have come from somewhere in Wisconsin, and researchers were able to use Google Street View to find the particular camera, I suppose, when it was still there.

22:39Graham Cluley:2017, 2018, I don't think it was— Yes.

22:49Dave Bittner:Flock, of course, in response to the stories that have been written about this in places like 404 Media and Wired, they have said, and I quote, they take security seriously and they maintain a vulnerabilities disclosure programme. Yeah.

23:06Graham Cluley:Is it possible that their statement was also written in 2017 or 2018? They had that in their back pocket because—

23:12Dave Bittner:It's possible.

23:13Graham Cluley:I think we've heard that one before a few times, haven't we?

23:15Dave Bittner:So related to all of this, I think it's worth mentioning that there is a huge amount of pushback against these Flock cameras here in the States right now. There are municipalities who have had contracts with them and are cancelling the contracts.

23:31Unknown:Yeah.

23:31Dave Bittner:There is a story from a police organisation in Illinois where the former police chief and two of the other high-level police people in this police force were using the town's Flock licence plate cameras to monitor the police chief's ex-wife. He had instructed other officers to track her, allegedly. The state police confirmed there's an active investigation into the matter. Again, obviously all alleged, but these three police officers resigned from the force when this information came out. So again, there's a lot of pushback. People feel as though this has gone a little too far, that our locations are being tracked.

23:51Dave Bittner:That the information is accessible without a warrant by police officers. So I think the folks who make the Flock cameras have been set back on their heels a little bit at the amount of pushback there is. And now to add on to that, these reports of how insecure and easy to hack both their cameras are and their central servers.

24:36Graham Cluley:It's what we like to call an omni-shambles, isn't it? I like that. I like that.

24:44Dave Bittner:I'm going to steal that, Graham. Omni-shambles. I like that. That has a nice ring to it.

24:49Graham Cluley:Yeah. These are devices which, sometimes it is argued, they are being introduced into society in order to protect us, to make us feel more secure. But in fact, they're either being abused or they are themselves insecure in their very nature in the first place.

25:07Dave Bittner:And to be fair, law enforcement will say this is a powerful tool for them to be able to solve crimes. And there's no question that that's true. It's just a matter of how much are we all willing to give up in order to do that? And that's the unresolved question so far, but it's moving rapidly.

25:31Graham Cluley:This episode of Smashing Security is brought to you by ThreatLocker.

25:34Joe:Agentic AI is changing the speed of cyberattacks, Graham.

25:37Graham Cluley:Yes, I read about that too. Self-directing ransomware, AI worms that adapt as they go, agents chaining tools together with no human anywhere near the controls.

25:47Joe:So basically, the attackers have automated their way to a 4-day workweek and the rest of us haven't.

25:52Graham Cluley:When enumeration, exploitation, and lateral movement happen at machine speed, plans like, oh, we'll catch it when someone checks their alerts, they begin to fall apart.

26:02Joe:Like most incident response plans, then. Great in the slide deck, less great at 3 AM.

26:07Graham Cluley:ThreatLocker puts default deny and least privilege between the agent and its next move. Application allowlisting decides what's allowed to run at all. Ringfencing limits what trusted applications can reach or launch, and privileged access management takes away elevation the agent never needed in the first place.

26:26Joe:So speed's not the problem anymore. Getting through the door is.

26:29Graham Cluley:So get ahead of machine speed attacks with ThreatLocker. Head to threatlocker.com/smashing to find out more and book your free demo.

26:38Joe:That's threatlocker.com/smashing. Thanks to ThreatLocker for supporting the show and for doing the fast bit so we don't have to.

26:47Graham Cluley:And welcome back. Can you join us at our favourite part of the show? The part of the show that we like to call Pick of the Week. Pick of the Week.

26:51Dave Bittner:Pick of the Week.

26:51Graham Cluley:Pick of the Week is the part of the show where everyone chooses something they like. It could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app, whatever they wish. It doesn't have to be security-related necessarily. Better not be. Now, Dave, I wonder if, like me, you are a fan of the movie La La Land.

27:16Dave Bittner:Uh, I—

27:18Graham Cluley:Oh, hang on. There was a pause.

27:21Dave Bittner:I have watched La La Land twice, I believe.

27:26Unknown:Oh.

27:27Dave Bittner:I enjoyed watching La La Land. I will say I did not go gaga for La La the way many other people did. And this is surprising for me because I love a musical.

27:39Graham Cluley:Yes. Love a musical.

27:41Dave Bittner:For whatever reason, it just didn't resonate with me the way it did with other people, but that's okay. That's just me. I have no doubt this is a wonderful movie, and clearly people love it, so good on them.

27:54Graham Cluley:I think you're a bit more of a Seven Brides for Seven Brothers kind of thigh-slapping style musical fan, right?

28:01Dave Bittner:That's true. Yes. Give me The Music Man or Singin' in the Rain, and I'm happy as a clam. Okay. All right.

28:08Graham Cluley:Well, I love La La Land. If you haven't seen it, of course, it was the movie which had the Best Picture Oscar cruelly ripped from its paws back in 2017. If you haven't seen it, unlike Dave, who I'm beginning to question his judgement, I think you should go and watch it. Tell me if you like it, and if you didn't like it, unsubscribe from Smashing Security immediately. Go on, clear off, clear off the lot of you. Well, no, no, no, no, no, no, no, no, no, no, come.

28:30Graham Cluley:Come back. Didn't mean it.

28:41Dave Bittner:Oh my! I think what am I not going to be invited back anymore?

28:42Graham Cluley:Labours of love. Dave, don't leave just yet. You've got a few more minutes to go. All right. Anyway, if any of you are still listening, I love La La Land. I could watch it on a loop, and my pick of the week this week is a website that is La La Land related. So I've stumbled across a website called seeing-stars.com, and it's done something brilliant. They have tracked down literally every single filming location used in the movie. So there's a real spot in Boulder City, Nevada, where Ryan Gosling goes to pick up Emma Stone when he visits her in her hometown. There's a pier where he sings City of Stars to an old married couple and dances with the wife.

29:07Graham Cluley:There's the famous observatory. I think it's in Rebel Without a Cause as well, or some James Dean movie.

29:29Unknown:Yeah.

29:30Graham Cluley:Where they have their dreamy planetarium dance scene. There's even tiny little throwaway moments, which may just be on the screen for a second, like a parking lot that Emma Stone walks through for an audition. So this isn't a brief list. This is every single location throughout the movie. This La La Land lunatic has watched the movie with his pause button. He's worked out where everything was taken.

29:57Dave Bittner:Right.

29:58Graham Cluley:It's extraordinary. And he's posted alongside the screencaps, real photos, map links, Street View. He's given a narrative as well. There are so many pages of this, and I found myself trawling through this and I thought, you know what? This is the kind of obsessiveness I want to see on the internet. This is like the old days. There used to be lots of bonkers sites like this.

30:20Dave Bittner:Yes. Yes, I agree.

30:23Graham Cluley:And I don't think anyone's got enough time really these days. It doesn't feel like anyone's actually putting the effort into building something. This was definitely not created — if you haven't seen La La Land, go watch La La Land for goodness' sake. But also, after watching it, you might want to go and check out this website. The other thing is, if La La Land isn't your thing, the same guy has documented all of the locations used in the Dexter TV series. You must know that one.

30:45Graham Cluley:That's that family show about what a police blood spatter expert gets up to in his free time.

30:56Dave Bittner:Lovely little lighthearted jaunt. Yes.

30:58Graham Cluley:Yes, exactly. So La La Land on one side, Dexter on the other. You can take your pick and go and check out the locations.

31:05Dave Bittner:I love this kind of thing. Yeah, this is great fun.

31:08Graham Cluley:That is my pick of the week. Dave, what's your pick of the week?

31:14Dave Bittner:Well, Graham, how do I say this?

31:18Graham Cluley:Goodbye. That's right.

31:23Dave Bittner:I grew up in a household that did not have a lot of musical sophistication. Let's put it that way. My parents, who were children of the '50s, not the '60s, which meant they were more Frank Sinatra than the Beatles.

31:42Unknown:Okay.

31:43Dave Bittner:Yeah. When I was a young lad, my father would be down in his workshop doing little projects, and I would be down in the basement playing with my Matchbox cars or my Legos.

31:55Graham Cluley:Can I just check? He wasn't a blood splatter expert working for the police, was he?

31:59Dave Bittner:He was not. No, no, no, no, no. Okay.

32:01Graham Cluley:Just clearing that up.

32:02Dave Bittner:No, no, no. On the 8-track tape player —

32:05Unknown:Ooh-hoo!

32:05Dave Bittner:Yeah. I can still hear the clunk-clunk sound when it would switch tracks. On the 8-track tape player, he would often have an 8-track of the Ray Conniff Singers.

32:17Graham Cluley:Right.

32:17Dave Bittner:Now, Graham, I don't know if you are lucky enough to know who the Ray Conniff Singers are.

32:22Graham Cluley:I'm not.

32:23Dave Bittner:I put a link in here just for you of them doing their rendition —

32:30Graham Cluley:Hey Jude, don't make it bad. Okay, that's horrible. Yes, it is.

32:38Dave Bittner:Yes, it is. So for those who aren't familiar, the Ray Conniff Singers was just a group of vocalists, and they would take popular songs of the day, and they would get together as a choir, and they would sing the songs with an orchestral accompaniment. And it was just completely benign, right?

32:56Graham Cluley:It was awful. It was, it was.

33:02Dave Bittner:But this was the soundtrack of my childhood, right?

33:06Graham Cluley:Oh, bless.

33:07Dave Bittner:So I heard this kind of thing over and over again. So this was my introduction to a lot of popular songs, was the Ray Conniff Singers cover version of it.

33:16Unknown:Oh.

33:16Dave Bittner:Yeah. We didn't have any Yeah. So I say that as introduction to why I have great affection for a documentary that I came across recently. It's called Let's Have a Party: The Piano Genius of Mrs. Mills. Beatles albums growing up. Graham, are you familiar with Mrs. Mills?

33:35Graham Cluley:I am familiar with Mrs. Mills, yes.

33:36Dave Bittner:Not a one. She is from your neck of the woods.

33:40Graham Cluley:Yeah, she was a British lady who could sort of stomp things out on the old piano, on the old Joanna.

33:48Dave Bittner:That's right. That's right.

33:49Graham Cluley:She was very talented. She wasn't your typical sort of celebrity starlet. She wasn't what I would call glamorous.

34:00Dave Bittner:No, no, no.

34:01Graham Cluley:She was one of us.

34:01Dave Bittner:She was a mom, yeah.

34:03Graham Cluley:Yes.

34:03Dave Bittner:But she could play. She had her own distinct style.

34:07Unknown:Yeah.

34:07Dave Bittner:I would categorize it as being kind of sing-along music, right?

34:12Graham Cluley:Yes.

34:12Dave Bittner:This comes from the era before recorded music, when everyone could play piano, and the way people would entertain themselves at a party or in a pub was that someone would sit down and play a few tunes, and everyone would have a few drinks and sing along.

34:28Graham Cluley:Which sounds bloody marvellous to me. And I think that's exactly the way I think about her as well. It's the kind of roll-out-the-barrel music you can imagine in the corner of the pub.

34:30Dave Bittner:Exactly.

34:37Graham Cluley:Stomping out a song, people holding their glasses of beer, enjoying the evening, singing along.

34:42Dave Bittner:Exactly. And so, for me, discovering Mrs. Mills has been opening up an entire new category of musical comfort food.

34:52Graham Cluley:Right.

34:53Dave Bittner:Because of the hardwiring of the awful Ray Conniff Singers in my brain when I was a child, Mrs. Mills just slots right in there and I love it to death.

35:05Graham Cluley:And she didn't sing, did she? Unlike the Ray Conniff Singers who shouldn't have sung.

35:09Dave Bittner:She did not sing, but there were singers on her albums and sometimes on her albums it would be the entire bar who would be singing along.

35:18Graham Cluley:Right. The algorithm has learned about you, Dave.

37:50Dave Bittner:There's no getting rid of me. So I've left a link to Let's Have a Party: The Piano Genius of Mrs. Mills, which is a BBC documentary. But Graham, there's a particular thing in here that made me realise that this was the perfect thing to have as my pick of the week just for you, because Mrs. Mills' piano is at Abbey Road Studios. To this day, her piano is there, and her piano was used by the Beatles.

38:12Graham Cluley:It was. And Dave, hold on to your seat. I have actually seen Mrs. Mills's piano.

38:21Dave Bittner:Get out!

38:31Graham Cluley:I really have, because I was very lucky a few years ago to actually go into Abbey Road and into Studio 2, which is the famous studio where the Beatles recorded a lot of their songs, the one with the stairs going down the side.

38:40Unknown:Yeah.

38:45Dave Bittner:So I made the mistake of tracking down

38:47Graham Cluley:And that piano is still there. They didn't let us play it.

38:55Dave Bittner:some of her things in my iTunes app,

38:59Unknown:Okay.

39:05Dave Bittner:which means now she's in the rotation.

39:11Graham Cluley:But yeah, so many amazing songs. I think maybe With a Little Help from My Friends and Ob-La-Di, Ob-La-Da with that digga digga ding ding ding at the beginning — that's all on the Mrs. Mills piano.

39:22Dave Bittner:Yes. So I've included a link here from Abbey Road that has a picture of, I think, Paul and John seated at Mrs. Mills' piano. The legend goes on beyond Mrs. Mills herself.

39:34Graham Cluley:Her piano will live forever through the music of the Beatles, because she was signed by Parlophone. She was on the same record label as the Beatles.

39:42Dave Bittner:This woman made a solid living playing piano. Her albums were hits just by going right down the centre. That is my pick of the week.

39:50Graham Cluley:This is fantastic. I'm definitely going to check out that documentary. I love that. Well, that just about wraps up the show for this week. Thank you so much, Dave, for joining us. Maybe you can tell our listeners where they can follow you online and find out what you're up to. What's the best way for them to do that?

39:58Dave Bittner:Just go to our website, thecyberwire.com, and you'll find all of my shows there.

40:09Graham Cluley:Terrific stuff. And of course, you can find me, Graham Cluley, on LinkedIn, Bluesky, Mastodon, Instagram, and even the Tok of Tik. The list goes on. And you can also follow Smashing Security on Bluesky, Mastodon, and Reddit. Don't forget to ensure you never miss another episode. Follow Smashing Security in your favourite podcast apps such as Apple Podcasts, Spotify, and Pocket Casts. And you can look for our show notes, sponsorship info, guest list, and the entire back catalogue of 486 episodes at smashingsecurity.com. Until a couple of weeks, not next week, the week after. Cheerio. Bye-bye.

40:24Graham Cluley:You've been listening to Smashing Security with me, Graham Cluley, and a huge thank you to Dave Bittner for joining me this week and this week's sponsors ThreatLocker, Origin, and Vanta. Do make sure to go and check out their offerings because they help keep the show afloat. Now, chums, according to the limited stats I get to see as to our listenership, the vast majority of you appear to be male. However, we do have a marvellous cohort of female listeners too, and some of them have been kind enough to become members of Smashing Security Plus. So I thought, you know what? Let's give some of them a nice shout out today. So kicking us off are Jessica Orth, Lisa, and Sharon — three fine chums, not putting up with any nonsense. A big huzzah to Sharon, a name which resembles that satisfying crisp click that you might get when closing the lid of a brand new laptop. The legendary Maya MacDonald, the beautifully double-barrelled Adena Bogut O'Brien, and Jane with a Y, because why not? Big love as well to The Green Girl, our most colour-coordinated patron, and to the delightfully whimsical Butterfly Skies. Thank you. And finally for this week, Frankie Guzikowski. Frankly, Frankie can be a boy's name or a girl's name. I'm not sure which way our Frankie leans. But anyway, these fine, upstanding, generous individuals are all members of Smashing Security Plus, which means they get their episodes ad-free earlier than the general public, and perhaps most importantly, have the opportunity to have their names pulled out of the hat at the end of the show and read out for mild ridicule. Curated by myself. If you would like to join them in this exclusive club of the wonderful and slightly foolish, just head over to smashingsecurity.com/plus, where for a modest fee, you too can support the podcast. You can support us in other ways as well. You can write a review; those are always lovely. You can like, you can subscribe, and you can tell your friends about us. Go on, go and find a chum. Collar them and say, you know what? You really should listen to Smashing Security. Well, thanks to all of you who support the show, and I'll be back for another episode on October the 8th. So make sure to tune in then. Until then, cheerio. Bye-bye.

40:31Unknown:Bye-bye.