Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity

Craig Peterson
  • 5.0 (23)
  • Business
  • Updated Weekly

Listen up, folks! At Craig Peterson's one-stop virtual corner, we distill gems from the comically chaotic world of tech and security. It's like grabbing a cuppa joe with your good old buddy, who just happens to be a guru in cybersecurity! From tackling the unseen dangers lurking in your smartphone to unmasking the secrets of ransomware, Craig's podcast shines a light on the stuff you need to know. Zero-day vulnerabilities? Yep, we got that covered. Mastering the art of patching or baffled by 2FA/MFA verifications? Say no more! Whether you're a cybersecurity novice or a savvy netizen, there's something for everyone. Gear up for entertaining, engaging, and most importantly, enlightening conversations about taking charge of your digital life. 🎧☕🔒. Makes sense, yeah? Drop by and join the conversation!

  1. Sep 30

    ShinyHunters Got FBI Records. Craig's Question Is Which Contractor Was Holding Them.

    A listener asked Matt to ask Craig about the theft of FBI data, and Craig started with who holds it. Much of what the federal government keeps — background-check records, applications to the FBI, even the designs of weapons made by defense contractors — sits with third parties. The group behind this one is called ShinyHunters; its reported leader was arrested by Dutch police the day before the show. Craig's point was the gap between the government and its vendors: last week every federal agency was required to patch ScreenConnect, a remote-support tool with a serious vulnerability. "Well, the government did all of that work, but how about its contractors? How about regular businesses?" Then the identity problem. States now require age verification for certain websites, so people hold their driver's license or passport up to the camera next to their face. Craig said more than 100 million of those records have now been stolen. A password can be changed. An email address can be changed. "But iris scans at the airport? Are you kidding me? You can't pop out your eyeball. You're not Tom Cruise." Also in this segment: CMMC, the cybersecurity framework for defense contractors built on NIST standards, and Craig's view that its Level 2 requirements are effectively no longer enforced The tech-company agreement signed at the White House on AI, which Craig compared to the governor's "sidestep" in The Best Little Whorehouse in Texas Researchers in China who got an AI to design bioweapons and explain how to use them, and why Craig says the risk is people giving instructions, not AI acting on its own NVIDIA's open-source OpenShell, which puts gates on what an AI agent can reach About 800 Microsoft patches last month, which Craig tied to attackers using AI The opener: "Feeling very techy. How about you?" Newsletter and Insider Session announcements: CraigPeterson.com

  2. Sep 29

    Office 2021 Stops Getting Security Updates on October 13. Windows Update Won't Tell You What Else Has.

    On October 13, Microsoft ends support for Office 2021 — Word, Excel, Outlook, and PowerPoint stop receiving security patches that day — along with the extended security updates for Windows Server 2012. Danny, sitting in for Jim Polito, asked the obvious follow-up: how does anyone find out what they are running? Craig's answer started with what people assume covers them. "Most people think, oh, I've got antivirus software. I've got Windows Update turned on. So, I'm all set. It is not true." Windows Update does not update all the software on a Windows machine, and antivirus only tries to stop an attacker who is already in. The average person has more than 60 programs on their computer that they don't know about. Danny had just found a pile of them himself, cleaning up his startup list to speed up a slow machine. Craig pointed out that he had done more than speed it up: every old program deleted is one less thing that can go out of date. He described the scan he wrote to show every installed program, flag the ones that are vulnerable, and explain the worst one in detail — what it is, why it matters, and what to do. He is updating it for the Microsoft announcements, and the new version goes to the newsletter list later in the week. Then Boston Scientific, in Marlborough. Hit on August 25, it took two full weeks to recover. Investigators traced the entry to a single internet-facing network-management device on the perimeter. No patient data was stolen and no files were encrypted, but for weeks the company could not ship product. Craig's advice was to have someone check the outside of the network, starting with Microsoft Remote Desktop and the firewall. Also in this segment: Zero-day vulnerabilities explained: the hole the attackers know about before anyone else does Almost 1,000 Microsoft patches a month, which Craig ties to vulnerabilities found with AI The U.S. ban on imported Chinese firewalls Eleven federal prison sentences in Virginia for a scam that borrowed strangers' phones to get into their Navy Federal banking apps — and Craig's 12-digit passcode before Face ID will work Turning the air conditioning back on for an 80-degree day after taking the unit out: "We'll get through a couple of days, honey. Put the fan on." How to reach Craig with a question: me@CraigPeterson.com, and Danny vouches that he answers Newsletter and Insider Session announcements: CraigPeterson.com

  3. Sep 29

    Senator Warner Wants an AI Oversight Agency. Craig Answers With the Clipper Chip.

    Sen. Mark Warner went to the Senate floor to call for a government body to oversee AI. Craig read the legislation and the senator's website before the show, and his objection was that the problem it describes is already illegal. Laws against hacking a computer system have been on the books for almost 30 years; people have gone to jail under them, foreign nationals included. "I think what they're trying to do is get legislation that protects them from the laws that exist." Jeff played the other side: if the AI gets loose because of "grossly incompetent nitwits that I chose to employ," shouldn't the government hold a kill switch? Craig's history lesson was the Clipper Chip, the encryption chip the Clinton administration wanted in every device, with a government backdoor built in. His practical answer was that the control already exists: NVIDIA has released open-source software that contains AI agents, watches what they do, and keeps them away from data they are not given — available now, at no cost, to any developer or business. The people who will not run those controls are the criminals, and "any regulations you put in place will have no effect on them." Also in this segment: Craig's two weeks reading the investigations into the AI "breakouts" at Hugging Face, Anthropic, and Google: "They did not break out of anything. They had access." Almost 800 Microsoft Windows patches last month, which Craig attributes to AI being used to find holes The FBI records obtained by hackers last week, and a break-in in Australia The British Columbia lawsuit over an AI company that allegedly knew its product was used to plan a school attack: "They knew or should have known. The tools exist to control your AI." Craig apologizes for not being calmer; Jeff books him to explain next week which Microsoft software is about to lose support, which is in this week's newsletter Heidi still wants the robot bartender Newsletter and Insider Session announcements: CraigPeterson.com

  4. Sep 23

    Craig Puts It at 60%: The Share of New Web Content Written by AI

    OpenAI launched ChatGPT 6, Sol, and Luna this month, claiming Sol makes about half as many mistakes as the models before it. Matt asked whether that is real progress. Craig's answer was yes, with a catch: the models are not getting smarter. The companies, Anthropic included, have rewritten the code around them so the AI runs the same prompt again and again from different angles and then votes on the most likely answer. The new models use about twice the tokens of the old ones. "And they get a 50% better answer." Matt: "There seems to be a correlation here." The second half was about where the training material comes from. Craig estimated that 60% of the newer content on the internet is AI-written and never reviewed by anyone in the field it covers. The AI companies scraped that content, publishers used AI to make more of it, and the result is a loop: AI writes it, AI trains on it, and the next round is worse. He noted that the European Union now requires AI-generated content to be identifiable by a computer, and that U.S. AI companies are complying in ways that reach American users too. His answer to "what can we do about it" was the conversation they were having: "People are looking for real content from real people, and you can't get more real than radio." Also in this segment: Why industries ask to be regulated: Amazon and the 9,000-plus U.S. taxing jurisdictions, and the four major beef processors, two of them foreign-owned. "Regulations are written to protect the territory." Matt's account of 700 AI agents breaking out of a sandbox to hack Hugging Face's servers in July, and Craig's reply: "That's misrepresenting it." The lawsuit in British Columbia alleging an AI company knew its product was being used to plan a school shooting, and Craig's point that hacking has been a federal crime since the late 1990s Andrew Yang's claim that self-replicating AI code has made the internet unusable for the AI systems themselves Grok's fact-checks on X, and the reflex answer to all of it: "There ought to be a law. That's what my dad used to always say." Newsletter and Insider Session announcements: CraigPeterson.com

  5. Sep 22

    The AI "Breakouts" Were Given Hacking Instructions and an Internet Connection

    OpenAI's model got into Hugging Face. Anthropic said its model had broken into someone first. Then Google said its model had done it before either of them. Jeff wanted to know how these AIs keep "breaking out," and whether he should picture Robby the Robot fiddling with a lock. Craig spent the previous two weeks reading the published investigations, which go back to May, and said nothing broke out of anything: "These AIs were let loose on networks that had access to the Internet. They were given specific instructions that had 100% to do with hacking and breaking into systems." The only one that stopped short was Google's, because one restriction had been left in place: it could not keep guessing passwords. So why are the companies asking Congress to regulate them, regulations already drafted? Craig told the Amazon story from the garage: local retailers complained Amazon did not collect sales tax, and Amazon answered by backing a law requiring online sellers to collect it across more than 9,000 U.S. taxing jurisdictions, something a company with a full-time accounting staff could handle and a small shop could not. Four big beef processors, two of them foreign-owned, got to four the same way. "So I really smell an Amazon.com of 15 years ago." Jeff's comparison: an operator saying "we can't help ourselves from stealing, so you'll have to pass laws," or "the guy who is overweight saying, if only somebody else would padlock the fridge." Also in this segment: Breaking into a computer system has been illegal since the late 1990s, so Craig asks why another law is needed The British Columbia lawsuit alleging an AI company knew its product was being used to plan a mass shooting, and Craig's point that failing to report it is already actionable President Trump's "S.I." and the planned AI czar; Craig has no problem with a U.S.–China hotline for a runaway AI, but says superintelligence "is still in the future" Jeff nominates Craig or Robby the Robot for AI czar, and declines to take sides Craig's newsletter and the software he wrote that shows what on your computer is vulnerable Newsletter and Insider Session announcements: CraigPeterson.com

  6. Sep 15

    Jeff and Heidi Want a Robot Bartender for Their Home Bar. Craig Says It Runs About $400.

    Jeff and Heidi hold happy hour at the bar in their house at 6:03, and Heidi has decided what it is missing: a robot bartender. Jeff's terms were that he picks how it looks and she picks what it says. Craig's answer was that the hardware already exists. Bars now have table-top machines that check your ID card and make any drink you order; those start around $30,000, and home versions run about $400. The conversation half is ChatGPT or Claude, spoken rather than typed. It started with a more serious question. Elon Musk and Sam Altman both say AI development should slow down, so why not believe them? Craig pointed to industries that asked to be regulated and what they got from it: the four big meat packers and the USDA-inspector rules a 100-head farmer cannot afford, and Amazon lobbying for online sales tax across more than 9,000 U.S. taxing jurisdictions that no small seller could track. His read on the AI version: "They want to go for an initial offering and they want to make a lot of money. They want press, and guess what? We're talking about it." Jeff's follow-up came from a local candidate's AI-generated campaign song, "the worst song in the history of really bad crappy songs." Craig said 50–60% of the music on some streaming services is now AI-generated, that streaming pays artists a fraction of a cent per play, and that the working answer for musicians is the one everyone faces: monetize differently, which for most of them means concerts. Also in this segment: The buggy-whip argument, and Craig's case that the internal combustion engine cost jobs but created far more, alongside Elon Musk's prediction that AI adds about 20% to economic output over the next decade Craig's keynote on how businesses use AI, and his view that "it's not being used very well or properly" yet Almost 1,000 Microsoft patches this month, and a warning to anyone whose computers are managed through ConnectWise ScreenConnect to check on it Jeff's plan for the bartender: looks of a 26-year-old cheerleader, mind of a 70-year-old Irishman who can tell a joke Newsletter and Insider Session announcements: CraigPeterson.com

  7. Sep 15

    Chinese Ships Are Stopping in Canada's Northern Straits to Map the Sea Floor

    Craig's wife sent him an article the morning of the show: Chinese ships moving through the straits of northern Canada are not just passing through. International agreements allow transit through territorial waters at a reasonable pace, but these ships are stopping, and it looks like they are measuring the sea floor. Russia is doing it too. The route used to be frozen; now it can be navigated in summer. Craig used it to explain why the U.S. wants a foothold in the North. It was the last stop in a long Canada conversation. Jim opened on British Columbia's three-year experiment decriminalizing cocaine and fentanyl, which ended early this year. Craig, who grew up in Quebec, went back to the 1970s and the FLQ, and to the separatist movements in British Columbia and now Alberta. He and Jim compared Canada's fleet of about 79 fighter jets with the California Air National Guard's, and Canada's economy, about half California's with roughly the same population. With a few minutes left, Jim turned to AI, and Craig got to the week's working warning. Microsoft had shipped almost 1,000 patches in the month so far, with an off-cycle fix for Remote Desktop, and more on the way. And ScreenConnect — made by ConnectWise, and the remote-management software many IT providers use to support business computers — was under active attack. That was in his newsletter that week. Also in this segment: The "most Albertan man alive" video Craig sent Jim, which Jim says he understood every joke in Craig's keynote on how businesses can use AI well, drawn from using it in his own company, and his estimate that the U.S. is six months to a year ahead of China Jim on ending up in a Matrix pod: "I'm going to be looking for you. Where's Craig? He told me this wasn't going to happen." Craig has asked for Jim's help with a project, and they set a meeting for the next day: "Boy, I don't know how that's going to work out." Newsletter and Insider Session announcements: CraigPeterson.com

  8. Sep 9

    Microsoft Shipped Almost 700 Patches in One Patch Tuesday — Six Times a Normal Month

    This was the biggest Patch Tuesday on record: Microsoft pushed close to 700 patches in a single month, roughly six times the usual volume. Craig's follow-up question is the one that actually decides whether a machine is exposed. Microsoft is patching Microsoft. Who is patching everything else? Windows Update never touches third-party software — it barely updates Windows itself, Craig said, and it does nothing for the average of 62 other programs sitting on a typical computer, many of which are being actively exploited right now. He named Adobe Reader and WinZip specifically: the current versions are reasonably solid, but almost nobody can say for certain they are running the current version. His phrasing for the gap: vulnerabilities "like driving a truck into your living room and you don't even notice." The question came in from a listener — Andy in Sanford texted to ask what Craig thought of PC-matic. Craig gave a genuinely mixed answer rather than a pitch. PC-matic is whitelist-based rather than blacklist-based, meaning only software known to be good is allowed to run, verified by checksum. That is a real architectural advantage. But PCMag and others rate it in the 60s out of 100, and it is a nuisance to live with. He would reach for Bitdefender first, and then, separately, something that keeps the rest of the software on the machine current — which is the part the antivirus question tends to skip past. Most of the segment was about AI, and Craig's line on it is deflationary. Meta planned to cut about 100,000 employees in waves and replace them with AI agents — putting trackers on employees' computers to capture mouse movements and screen contents as training data — and the project came apart. About 80% of AI projects fail, Craig said, usually from overreach. What AI is genuinely good at is a first draft; what it cannot do is decide. Companies that laid off support staff and handed the queue to an agent have been hiring those people back. And the tell he keeps returning to: if the models have really reached general intelligence, why does every one of them still need a human supervising it? Also in this segment: Aaron's own experience upgrading ChatGPT to Astra — "blown away" by the speed and the tolerance for natural language over careful prompt engineering — and his question about how much more capable the unreleased models must already be Craig on why the newer models feel faster and smarter: built-in self-checks where the AI audits its own reasoning, plus multiple specialized sub-models tuned for law, for Python, and so on, with your question routed to whichever fits Aaron's McKinsey story, and the best analogy in the segment: briefing an AI is like sending a slide to an outsourcing team halfway around the world. Vague instructions come back wrong; precise ones come back close. "You've got to do the work." Craig's observation that AI tends to increase workload — staff stop doing the basic work and become supervisors of it, reviewing output from what amounts to a team of high schoolers A note on the market this creates: people paid $250,000 a year and up to go in and fix systems that were built with AI and don't work Free newsletter and Insider Session announcements: CraigPeterson.com

See All (499)

5
out of 5
23 Ratings

About

Listen up, folks! At Craig Peterson's one-stop virtual corner, we distill gems from the comically chaotic world of tech and security. It's like grabbing a cuppa joe with your good old buddy, who just happens to be a guru in cybersecurity! From tackling the unseen dangers lurking in your smartphone to unmasking the secrets of ransomware, Craig's podcast shines a light on the stuff you need to know. Zero-day vulnerabilities? Yep, we got that covered. Mastering the art of patching or baffled by 2FA/MFA verifications? Say no more! Whether you're a cybersecurity novice or a savvy netizen, there's something for everyone. Gear up for entertaining, engaging, and most importantly, enlightening conversations about taking charge of your digital life. 🎧☕🔒. Makes sense, yeah? Drop by and join the conversation!

Information