Cybersecurity today, we'd like to thank Meter for their support in bringing you.
This podcast Meter delivers a complete networking stack, wired, wireless and
cellular in one integrated solution that's built for performance and scale.
You can find them at meter.com/cst.
An info Steeler grabs open claws, soul tokens, keys,
and your entire digital life.
A hobby coder accidentally builds a robot vacuum.
Army.
Best Buy cases show why Zero.
Trust is about behavior, not just rules.
And Canada Goose breach.
That wasn't when your supplier gets hacked instead.
This is Cybersecurity today.
I'm your host, Jim Love.
We've warned before about OpenClaw's security weaknesses, but Hudson Rock,
a cybersecurity firm that tracks info stealer malware, now has documented
exactly what one of those attacks looks like in the real world, and it builds
layer by layer into something that is.
Actually quite frightening.
An info stealer is a malware that quietly vacuums up sensitive data
from your computer and sends it to attackers, and you probably never
know it happened, but in this case, a standard file grabbing routine swept up.
Everything in the victim's OpenClaw directory.
First, it grabbed tokens, authentication credentials that give whoever
holds them access to everything.
The user can access a master key that's bad enough on its own.
Then it grabbed the device's, private cryptographic keys.
The keys used to sign and verify that communications are
genuinely coming from your device.
With those, an attacker can obviously impersonate your device, completely
bypassing security checks and potentially accessing encrypted logs and even paired
cloud services, the digital equivalent of stealing your identity at the hardware
level, but then came the Cuda gra.
Open claw agents are built around files called soul.md.
Yeah.
That's the actual name which defines the agent's personality.
Its behavioral rules, what access it has in your life and
to the events in your life.
Calendar events, private messages, daily activity logs.
The attacker doesn't just get your credentials as Hudson Rock put it.
They get a mirror of your life.
And here's what should concern everyone in security.
This wasn't even a targeted attack, just a broad malware sweeping for anything
sensitive that happened to hit the jackpot with a poorly designed piece of software.
Hudson Rock is now warning that dedicated open claw modules malware
built specifically to hunt and parse.
These files are almost certainly on their way, just as we already
have specialized Steelers for Chrome and Telegram and others.
If you're running open claw, this is another reason to take a hard look at
what you've given your agent access to because apparently so are the criminals.
A hobbyist coder wanted to drive his robot vacuum with a PlayStation controller.
Why?
Who knows, but what he accidentally did was build an army of robot vacuums.
Sammy Azdoufal, had just bought a DJI Romo and thought it would
be fun to control it manually.
So he used an AI coding tool to reverse engineer the devices communication
protocols, and he built his own app.
And when he connected to DJI servers, roughly 7,000 robot vacuums across
24 countries started answering.
He found he could watch live camera feeds inside stranger's homes listed
through onboard microphones, generate accurate floor plans using just a fort.
14 digit serial number.
He pinpointed a journalist's robot vacuum, confirmed it was cleaning the living
room at 80% battery and produced a map of their house from another country.
The technical failure was almost embarrassingly basic.
DJI systems had no access controls at the messaging level.
Authenticate with one device token, and you could see traffic from
every other device in plain text.
It wasn't just vacuums, DJ's, portable home battery stations run on the same
infrastructure and they showed up too.
DJI initially told journalists the flaw had been fixed.
That statement arrived about 30 minutes before Azdoufal, demonstrated.
Thousands of robots including the journalists' own device,
still reporting in live.
Now, this isn't the first vacuum hack.
In 2024, hackers took over ecova vacuums across US cities, shouting slurs
through the speakers, and chasing pets.
Security testing of six vacuum brands last year found serious
flaws in three Chinese models.
More and more connected devices show little evidence of security
being considered until somebody out there discovers the weakness,
and with the number of devices we have, cameras, doorbells, home
battery systems, and now vacuums.
Well, that just sucks.
There's a story coming out of Florida where police say, A Best Buy employee
used a manager's override code.
Which he was entitled to do, but he did it 149 times to buy high-end
electronics, including MacBook Pros at discounts as steep as 99%.
The alleged scheme ran from March to December, 2024 and cost the
store roughly $120,000 before it was uncovered, and investigators traced
the fraud not because of a security breach warning, but after discounted
merchandise began appearing in pawn shops.
Think about it.
One employee using high privileged override credentials nearly
150 times over nine months.
That's not damaged box discounts.
That's a pattern, and the fact that it went unnoticed for so long just simply
encouraged more of that behavior.
There's another case that we found as well in the same story, a Georgia case, another
Best Buy employee was arrested after more than $40,000 in merchandise, allegedly
walked out of the store over two weeks.
Police reports say that he initially told investigators he was being blackmailed
by a hacker group, threatening to release intimate images unless he
cooperated, though he later disputed parts of that account in interviews.
But.
Two different stories, same underlying lesson, and we all know it.
Security isn't just about whether credentials work.
It's about whether the behavior makes sense in context.
Just because the device or the login is validated.
We should still be asking should this action be happening.
This often under these circumstances by this person.
In both cases, the systems allowed it.
What failed though, was the contextual oversight.
As we put our controls together and we tend to focus outward or on absolute
controls, it's something to think about.
Shiny hunters is back with another data dump, and this time it's Canada Goose,
a Canadian clothing company that had 600,000 customer records, including
names, addresses, order histories, and partial payment card information leaked.
But here's where it gets interesting.
Canada Goose was investigating and said they could find no evidence
of a breach on their own systems.
And then according to bleeping computer, when they were asked directly
shiny hunters told them the data didn't come from Canada Goose at all.
It came from a third party payment processor and a breach
dating back to August, 2025.
When you look at it, the structure of the leaked records backs that up.
Security researchers noted that the dataset, schema, field names like
checkout id, shipping lines, cart token, closely resemble e-commerce
checkout exports from hosted storefront and payment processing platforms.
So if you're Canada Goose, you just found out your customer data was leaked,
but you had nothing to do with it.
You weren't breached, your security held, but your customer's information
is out there anyway because somebody in your supply chain didn't measure up.
And if you're in payment processing or e-commerce platform operations,
this should get your attention because you might be using one of the same
suppliers or service providers as Canada Goose, and you may wanna find
out where that breach actually happened and whether you were part of it.
The data, thankfully, is old.
Most of it dates back to 2021 to 2023, but old data still enables phishing, fraud
and identity theft just with a little less urgency than fresh information.
once again, third party breaches are becoming part of
a pattern, not the exception.
And that's our show.
We'd like to thank Meter for their support in bringing you.
The podcast Meter delivers full stack networking infrastructure,
wired, wireless, and cellular to leading enterprises.
Working with their partners meter designs, deploys and manages
everything required to get performant, reliable and secure connectivity in
a space they design the hardware.
The firmware, they build the software.
They manage deployments, they run support.
They do it all.
It's a single integrated solution that scales from branch offices,
warehouses, and large campuses, all the way to data centers.
Book a demo at meter.com/cst.
That's METE r.com/cst.
I'm your host, Jim Love.
Thanks for listening.