Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity

Craig Peterson

Listen up, folks! At Craig Peterson's one-stop virtual corner, we distill gems from the comically chaotic world of tech and security. It's like grabbing a cuppa joe with your good old buddy, who just happens to be a guru in cybersecurity! From tackling the unseen dangers lurking in your smartphone to unmasking the secrets of ransomware, Craig's podcast shines a light on the stuff you need to know. Zero-day vulnerabilities? Yep, we got that covered. Mastering the art of patching or baffled by 2FA/MFA verifications? Say no more! Whether you're a cybersecurity novice or a savvy netizen, there's something for everyone. Gear up for entertaining, engaging, and most importantly, enlightening conversations about taking charge of your digital life. 🎧☕🔒. Makes sense, yeah? Drop by and join the conversation!

  1. 5d ago

    6 Million People Were Hit by Chrome Extensions That Redirect Searches. The Most Common One Is a PDF Reader.

    Craig said about 6 million people have been affected by Chrome browser extensions that change your settings so that searches and website visits are redirected, first to a site that pays the extension's makers for traffic. Each redirect carries a code in the web address telling the search engine, mostly Bing, who sent the visitor. The result, he said, is poorer search results, and criminals getting paid. There have been thousands of these extensions, and the most common one he has seen used for the hijacking is a PDF reader. Modern browsers all read PDFs and fill out PDF forms, so you don't need a separate PDF Reader. His explanation of how it gets through: Google looks at an extension when it is submitted and approves it, "and then that's it," and later versions can redirect to different sites. Chrome updates do not cover extensions. He gave a second route, a security extension he had recommended whose developer sold it to someone who turned it into "a piece of nastyware." His advice: if you installed extensions you don't need, get rid of them, and delete any app you don't use. He backed it with a count. More than 600 to 700 listeners have run Reveal scan that he wrote over a year ago, and six out of ten programs, on average, on those computers are not Microsoft programs and don't get updates, because Windows Update doesn't update them. The scan lists the software to delete and the software that needs upgrading. Craig said it covers Windows computers, not Mac or Linux right now. Also in this segment: Jim's opening: "socialized medicine" and Craig's line about it, "the efficiency of the post office combined with the love and care of the IRS" Jim's habit of DuckDuckGo, and "if you're not paying for something, you're the product" as applied to Chrome and Microsoft's browser A mention of the Boston Scientific article in this week's Insider Notes; Jim has a friend who works there Jim, who was in France for the 2022 elections, asking how Canada votes, and Craig's answer on how a prime minister is chosen there The riots in France, the economies of Portugal, Italy, Greece, and Spain, and China buying stock in their companies Craig and Jim on the GM and Chrysler bailouts, and what happens when AI companies fail Newsletter and Insider Session announcements: CraigPeterson.com

  2. Oct 28

    Only 1% of Businesses Saw a Financial Benefit From AI, Craig Says, as a Half-Trillion-Dollar IPO Looms

    Craig cited a study he read the day before, which he thought came out of MIT: of the businesses polled and analyzed, only 1% found a real financial benefit in using AI. Matt put the other side of it to him. Everybody uses AI, voters tell pollsters they don't want data centers built (Matt's figure: about 80%), and the company behind one of the leading models is heading toward an IPO that Matt put at half a trillion dollars. Craig noted that Anthropic's founders are reported to keep 50.1% of control no matter how many shares are sold. The practical example was Matt's own new website on Maine election results going back to 1820. Matt insisted it be human-built: the design, the formulas behind his metrics, and the calls on discrepancies in the Secretary of State's data were his. The AI processed the data, organized it in a database, and helped display it. He said it would have taken closer to a year by hand, through handwritten returns from the 1950s and 1960s in tens of thousands of races. Craig agreed that is the right use: aiding the person, not thinking for them. He also pointed out that projects like this often make more work, and that anyone can now generate a 10-page PDF report, which leaves someone to read it and check it. Craig's turn was the data centers. SpaceX has satellites that already reach rural areas, connect phones for emergency texting, and link to each other with lasers. Data centers in space still have a heat problem, since there is no air to carry heat away, but they have plenty of solar power and, with Musk's satellite network, a way to talk to each other, to the internet, and to people on the ground at high speed. "Nobody else has this." Also in this segment: Matt asks what to make of a country where people use chatbots daily, even for pictures of rashes, while objecting to the data centers that make it possible Craig on the NIMBY objection to data centers: "I get that. I can see that." Craig's view that China is putting material online to influence opinion about AI Craig on SpaceX's record IPO and why he thinks the company "might be a crazy winner" Matt has more questions than time; they will talk after the election Newsletter and Insider Session announcements: CraigPeterson.com

  3. Oct 27

    The "I'm Not a Robot" Box Now Asks You to Paste Text Into Your Computer

    Jim asked about the "prove you're not a robot" box, and Craig explained what has changed. The picture puzzles, "which one has the bicycles in it," were once you training Google's search and maps, marking where the streets and crosswalks are. Website owners put human checks on forums to stop abuse, and people are used to doing what the box tells them. Craig said attackers have figured that out: a fake check now asks you to copy some text and paste it into your computer, with versions for Mac and Windows. What you are doing then, he said, is giving them control of your computer, and it is happening right now. His rule: don't copy and paste text from a random website, including a captcha, into your computer. He followed it with a case. A company asked Craig to look at "weirdness" in its emails. He and the company went in and found that someone who had gotten into its systems was sending emails as the company to its regulatory board, trying to get it to lose its license. Craig said he is hearing from more businesses with this kind of weirdness, and that cheap Chinese AI tools without safeguards are being used for it. His call to listeners: if you see odd email behavior, send a note to me@CraigPeterson.com or reply to one of his weekly emails. He also said 70 percent of all websites online are running compromised software, and described a scan he wrote a year ago that looks for indications of compromise. Also in this segment: A personal story from Craig: his mother in Canada waited four months to see a dermatologist for a painful growth on her neck, was told the biopsy results would take up to four more months, and the follow-up appointment would be scheduled after that; his grandfather in British Columbia waited three months for an appointment about a foot, which by then needed to be amputated Craig's family: he and his wife have had families living with them for more than half of their marriage, in addition to their eight kids, and he taught the men computer skills and helped them get jobs Craig leaving Canada in the 1970s with $20 in his pocket and sleeping on a friend's concrete floor in a sleeping bag for 18 months The Canadian election and how a prime minister is chosen there The hosers still posting on Craig's forums, and office-cleaning companies filling in his forms Newsletter and Insider Session announcements: CraigPeterson.com

  4. Oct 20

    Hackers Ran Freezers in Hundreds of French Grocery Stores Up to 104 Degrees Fahrenheit

    Hannaford, Stop and Shop, and Food Lion kept their stores open last week while their websites, apps, and online ordering went dark for days. Craig started there and went to France, where hackers attacked connected commercial refrigeration systems across hundreds of grocery stores, including the country's largest. The freezers were run up to 104 degrees Fahrenheit. A friend of Craig's in Paris told him it happened on October 11, a Sunday, when many stores were closed. The mechanism, as Craig explained it: the refrigeration systems are all controlled by one central company. The stores installed them, connected them to the internet, and the units called home to find out what cycle to run. Craig compared it to the frost-free cycle in a home refrigerator, which melts frost on a daily schedule. Many such systems run Java, which also runs on Android phones, car entertainment systems, and smart refrigerators, and Java was getting its next batch of fixes that day. Embedded systems rarely get updated, so Craig's advice to any business was to check whether firmware updates exist for its equipment. He then ran through the week's other dates and counts. Chrome shipped 37 security fixes, Firefox 158, and Edge had two updates. Microsoft had over 1,500 fixes the Tuesday before. On October 13, Windows 11 Home and Pro 24H2 got their last security update. The segment ended on data: a Revolut outage that stopped card payments at gas stations and airports, traced by Craig to a Google outage that Google blamed on power, and data centers hit in the Russia and Ukraine war. Also in this segment: Jim up in New Hampshire on Sunday visiting nephews and nieces, and the beautiful weather A pipeline into New England that was shut down by a hack a couple of years ago, as an example of infrastructure Craig's comment that about 80% of Android phones never get security updates A Ukrainian drone strike on Russia's largest data center, after strikes on three Yandex data centers, and three Amazon Web Services data centers in the Middle East hit during the Iran war Starlink, from RVs and airline Wi-Fi to Ukraine's drones and missile intercepts, and the speed cap Craig says was put on it Craig's tip: carry cash, a credit card, and a phone wallet Newsletter and Insider Session announcements: CraigPeterson.com

  5. Oct 14

    A GM Dealership's Chatbot Sold a Yukon for One Dollar. Craig's Worry Is What Comes Next.

    A GM dealership put a chatbot on its website last year, vetted the information it was given, and let it loose. A customer talked it into selling a brand new Yukon for $1, and the bot closed with "no tixie-baxies." Craig opened with that story because it sits next to the numbers he is watching: about $20 trillion invested in AI by the private sector, not one leading large language model company turning a profit, and business AI projects failing 80% of the time or more. Craig's explanation of why the answers keep fooling people: they look correct. The AI companies are spending twice the resources to process a prompt and getting answers about 50% more accurate, so the models appear to be getting better without actually getting better. He took it back to VisiCalc, the first computerized spreadsheet on the Apple II. Studies of spreadsheets find big mistakes in 80% of them, yet every number is there and the total adds up. His keynote makes the same point about AI today: it is still slop, and it still looks right. Matt brought the math. OpenAI released proofs for roughly 700 hard problems, and a Fields Medal winner told reporters he will stop sharing his own problems with other academics. The proofs run thousands of pages, a couple have already turned out to contain mistakes, and Craig said verifying some of them could take 20 years. Matt's worry was decades of science built on a proof nobody had time to check. Craig's was government agencies, school funding, and decisions about children made on the same output. Also in this segment: Election-season banter at the top, and politicians giving opinions on technology without doing the research Craig's worry about AI companies becoming too big to fail, and his refusal to buy a Chrysler or a GM car because of the earlier bailouts A story from Craig's high school days: the school's access to the university mainframes, and his parents asking him to "ask the computer" a general-knowledge question The America.gov announcement about the AI work being done there "We don't even know how these AIs work, and neither does OpenAI": Craig calls it an association machine that makes its own associations Matt had several more questions and ran out of time; Craig is back next Wednesday Newsletter and Insider Session announcements: CraigPeterson.com

  6. Oct 13

    A Chatbot Sold a Yukon for $1. Craig's Case That the $20 Trillion Chasing AI Won't Come Back.

    Craig opened with a prediction: roughly $20 trillion is chasing AI, there has not yet been a profitable AI company, and the money keeps going into what he called "yesterday's technology." He put it next to GM and Chrysler, which he said were bailed out because they were too big to fail, and said 80% of the business projects started around AI have failed. His point was not that AI is useless. He uses it every day. It is that the spending has run ahead of what it has proven. His example of the gap was a car dealer that put a chatbot on its website to negotiate. A shopper bargained it down on a Yukon, which Craig said costs 60 to 80 grand, and bought it for $1. The chatbot's reply, per Craig: "no takesy-backsies." He also explained why AI looks like it is improving every month or two. In his telling, it is using double the processing power to get answers 50% better, because it is checking itself, which is a different curve from the one in Moore's law, where computers double in power every 12 to 18 months. Craig then connected power to the same story. His 100-kilowatt, three-phase diesel generator, bought from the U.S. military, carried a $200 tax because it doesn't meet emission standards, which the military doesn't have to meet. The follow-up on nuclear: Craig said the military plans to buy small modular reactors for every base, which will fund companies to build and test them before they reach towns. His estimate is five to ten years, maybe longer, before electricity prices fall and power is steady around the clock for the data centers. Also in this segment: Jim's "scary prediction" setup, and his line that maybe the machines are already smarter than we are because they got us to spend tens of trillions on them The three steps Craig laid out: AI today, AGI (artificial general intelligence, a machine that reasons like a human), and ASI (superintelligence), and where we are now Craig's comparison of the federal debt as reported (about $30 trillion, "last I checked") with how he says public companies would have to count it ($70 to $80 trillion) Jim offering to make a phone call about the generator, and the Einstein story about not clouding your brain with your own address Craig looking out the window at his data center generator while recording, and Jim's lost voice ("Get that voice back") A new article coming later in the week on Microsoft software that is no longer supported Newsletter and Insider Session announcements: CraigPeterson.com

  7. Oct 6

    "Do Not Keep Data You Do Not Have to Keep": Craig's Rule After the People's Bank Vendor Breach

    People's Bank in Holyoke wanted to do the right thing and hold the information the government requires, including driver's license numbers. So it went to professionals, and the professional, a company called IDscan.net, kept that data and was breached. Craig's read on the bank: many breaches arise "not because of anything you particularly did wrong." He tied it to the federal government, which he said had the same third-party-vendor problem: he cited the personal information of 2.5 million federal employees and the driver's licenses and passport photos of 120 million people. Craig's lesson for any business is to audit your vendors, and he was candid that this is hard when the vendor is bigger than you and runs systems you don't understand. The number one thing, he said, is to not keep data you do not have to keep: years of customer records, names, addresses, and phone numbers that have nothing to do with your current business. Get them off your machines, so that if someone breaks in they get less. He added that every state sets its own threshold for how many stolen records trigger a report to the attorney general. Then the turn, from Craig's own younger days. Two men showed up at one of his businesses saying the landlord had asked them to inspect the air conditioning. They looked at the air conditioner and the computers, came back in the middle of the night, and took the computers and typewriters. When did he buy the burglar alarm? After the break-in. Craig and Jim agreed that security, privacy, and regulation are one more hat for a business owner, and get attention when an insurance provider starts asking questions. Also in this segment: Jim just back from Ireland, where his 41 listeners on the trip had "access to me the entire time" and asked about Craig; Jim told them Craig is "a minimum of five years ahead" Craig on being on the internet since 1981, and pushing businesses to get online in 1991 Jim's description of Craig's Insider Notes as his show prep Next week, some Microsoft software gets its last update, and the scan Craig wrote flags software that is vulnerable or about to lose support Jim's burglar-alarm analogy: the best neighborhood to sell one is a street that has just had break-ins Newsletter and Insider Session announcements: CraigPeterson.com

  8. Oct 6

    Over 120 Million ID Scans Stolen. Craig: "You Can't Change Your Eyeballs."

    Craig counted more than 120 million people, apparently, whose driver's licenses, passports, or selfies have been stolen after they used them to prove who they are online. One example in this week's newsletter was a small bank in Holyoke, Massachusetts: People's Bank used an ID vendor, and the vendor, which held information about the bank's clients, was hacked. A second story has the same root: background-check files on most FBI agents were stolen, and Craig said it looks like a third-party vendor used by the federal government in a number of roles. His point was that the thief often does not go through the organization you trust. A small business sends banking to a bank, taxes to an accounting firm, and a dozen other jobs to outside vendors, and cannot audit any of them. If a vendor loses personal information, the business still has to tell the attorney general, and every customer, that their data was taken, even though it was never on the business's own computers. Craig's advice was to put business partnership agreements in place so the vendors accept the liability. On identity, he said a password or a name can be changed, but "you can't change your eyeballs," which is his objection to the iris scanners at airports. Jeff then asked whether a computer bought in 2025 has the same exposure as one from three years ago. Craig's answer: the CVE database lists new vulnerabilities every day, about 1,700 a week right now, and hackers are using AI to find holes in software that has sat there for 20 or 30 years. A new computer with Windows updates on and nothing installed, "including Microsoft software," might be okay. Antivirus only catches a problem once it is on the machine. Also in this segment: Jeff's opening: he has his driver's license scanned at the bank, and wants to be told it's fine Windows Update does not update all of Windows; next week some major versions of Windows and Office products stop getting updates, with millions of people still using them Craig's advice to turn updates on for Windows and Mac and install them as soon as they arrive; he says 70 to 80% of Android phones never get security updates A no-charge DNS filtering service that Craig suggested to catch an infected computer trying to phone home (see Field Notes) Craig plans to send newsletter subscribers a special version of his computer scan that checks for the newly unsupported Microsoft software Jeff's signoff: the newsletter "has helped out those of us here inside of Casa Cats" Craig pointed listeners to CraigPeterson.com for the newsletter and the scan of their computer. Newsletter and Insider Session announcements: CraigPeterson.com

See All (499)

5
out of 5
23 Ratings

About

Listen up, folks! At Craig Peterson's one-stop virtual corner, we distill gems from the comically chaotic world of tech and security. It's like grabbing a cuppa joe with your good old buddy, who just happens to be a guru in cybersecurity! From tackling the unseen dangers lurking in your smartphone to unmasking the secrets of ransomware, Craig's podcast shines a light on the stuff you need to know. Zero-day vulnerabilities? Yep, we got that covered. Mastering the art of patching or baffled by 2FA/MFA verifications? Say no more! Whether you're a cybersecurity novice or a savvy netizen, there's something for everyone. Gear up for entertaining, engaging, and most importantly, enlightening conversations about taking charge of your digital life. 🎧☕🔒. Makes sense, yeah? Drop by and join the conversation!

Information