Smashing Security podcast #492: How hackers turned Russian cars into pumpkins

You can take screenshots on a car if you press down the clutch pedal while inserting a thumb down the exhaust pipe. I think I'm not suggesting people try this.

And also, you'd have to be a bit like Mr. Tickle to reach so far around.

Smashing Security, episode 492. How Hackers Turned Russian Cars into Pumpkins with Graham Cluley and special guest Danny Palmer.

Hello, hello, and welcome to Smashing Security episode 492. My name's Graham Cluley.

Quite a lot's been going on, and we'll be talking about some of those things which have been going on this week, including some things which maybe haven't been making the headlines quite as much.

But before we kick off, let's thank this week's wonderful sponsors, HackTheBox, Dropzone AI, and Vanta. We'll be hearing more about them later on in the podcast.

And I'm going to be discussing how Russian cars are being turned into pumpkins — well, metaphorical pumpkins at least — and why a stranger on the phone is selling the owners their keys back.

All this and much more coming up on this episode of Smashing Security.

Somewhere in your security team right now, there's a worker who's never slept, never taken a holiday, never once said, I'll leave this until Monday.

Now, chums, imagine you find yourself in this situation.

You've just bought yourself a rather lovely Chinese electric SUV, and you're driving it along, dumpty dumpty dum, singing a little song.

I tune into Tumty Tumty Tum FM, as opposed to Tumty Tumty Tum Gold. Of course, I'm not so much into that era. But anyway, you're driving along.

Suddenly, the dashboard goes completely dark, and you think, "Oh, this is no good." And you assume it's some kind of glitch because it's scary these days, isn't it?

Driving a car and the electrics go. You think, "Oh, can I trust anything?" So you switch off the car and you switch it on again, and up pops on your dashboard a QR code.

With a Chinese message telling you to reactivate your car, and you've got one of these newfangled cars, which of course has an app.

And you have it on your mobile phone. Of course. And what you discover when you open the app is that your car isn't listed in the app anymore, so you're not able to re-enable it.

And ten minutes later, your phone rings, and a stranger says, "Hello, hello, hello. I've got the digital key to your car. Would you like it back?"

Yes, please is the obvious answer. But then they ask for 45,000 rubles. Which sounds like an awful lot — well, it is quite a lot. It's $550.

And this is happening right now to owners of Li Auto cars in Russia.

Li Auto is a Chinese manufacturer of motor vehicles, and this is all according to a story in the Russian outlet Auto News. So here's how all of this works.

The key to one of these cars isn't really a key at all. It's actually an account in the app.

Start the engine, and things like that. So if you control that account, the car thinks that you are the owner rather than maybe the genuine owner.

So the criminals aren't hacking into the cars themselves. They're taking over the accounts. And those accounts with these particular cars are linked to a phone number.

But you remember I said that these were Chinese SUVs?

That's right. And many of these cars have actually been hardcoded, it turns out, to require, at least for the app, a Chinese phone number.

So these cars are often being grey imported into Russia and people are using them, but they don't have a Chinese phone number.

So what they do is they rent those Chinese phone numbers online, often through a middleman. So there is a Chinese phone number connected to this, yes.

Nobody yet knows how the criminals are breaking into these accounts, and even the owners who feel like they've done everything right to protect themselves seem to be getting hit.

And this same scam of basically messing around with people's cars is not actually that new.

It hit Li Auto owners in Russia last summer. So, Danny, is there anything which hackers aren't attacking at the moment? I mean, we've seen freezers being attacked.

We've seen blood banks being attacked.

Yeah, I think that's quite a common trick by pranksters, I think you call them.

As we've seen this week, so much is just connected now to the internet and everything is almost hackable.

Cars have been connected to the internet in one way or another for at least a decade now.

I seem to remember about 10 years ago, there was a story where some ethical hackers managed to, in a test environment, make an internet-connected car basically control the steering.

Well, they have. This is interesting, isn't it? So the official fix through the dealers back then cost about 18,000 rubles, which is about $220.

And some of those hackers were remotely opening windows and doors and starting engines, almost as if they were taunting the owners.

Yeah. Anyway, back last year, Russian owners were told how to protect themselves. They were told, look, register your Chinese phone number in your own name. Don't use a middleman.

Keep it paid up. So keep on paying for the account. Don't let it expire in any way.

Make sure that you don't lose control over that account because the number is what the car's digital key relies upon.

The twist this year seems to have been that the attackers have moved on. So the car owners who followed the previous advice, they did everything right.

You know, they paid for their Chinese phone number, they registered it in their own name. They're still being hit. And the ransom demand has, as we mentioned, it's crashed in price.

So previously, rather than the equivalent of about $3,000, they're asking for $550 instead after they've been immobilised.

So I'm always kind of encouraged when the cybercriminals think, oh, market forces, bloody hell, we're gonna have to lower our prices. I mean, that's got to be good news, hasn't it?

You'd hope so, because with things like ransomware, it's just been going the other way, is it?

I remember when ransomware cost you £500 for an attack, and now you're lucky if it's £5 million.

Yes. So a story where it's actually reducing is good, but still, your screen on your car is going dark, the climate control stops.

Some drivers are saying they can't start their engines at all. Others say that they could still run the car if they used an old-fashioned physical key.

My goodness, who starts a car with a key? I think it's a bloody good idea if you keep your key, to be honest. As far as all the reports I've heard, nobody's car has been driven away.

But if they are able to remotely unlock it, I suppose there is the possibility if they work out where it's physically located, they could go round and pinch it as well.

But often it's just left sitting there like an expensive paperweight. One of the Russian headlines actually said it's kind of like being turned into Cinderella's pumpkin.

So how are the hackers doing this? Well, nobody knows.

The founder of the Owners Club thinks the attackers are looking up the VIN, the vehicle identification numbers, in leaked insurance documents and databases to find the owners.

He thinks it's unlikely to be a lone hacker because of the need for all of these Chinese SIM card details, the leaked data, and of course, having people to do the ransom negotiation.

But reports are also saying that these attacks are mostly happening at night. So it could be just someone's side hustle, for a bit of extra cash. I don't know.

The victims, though, they say that Li Auto aren't being helpful. They say the phone number providers aren't being any help either.

The company itself, they say they're building a fix that swaps out the requirement for a Chinese phone number for an email address.

I wonder if it was an attempt to prevent too much grey importing, to have a little bit more control over who might be selling the cars, to make sure that you went through official distributors instead of— I don't know.

I don't know what their thinking was.

Yes, you'll have to listen to another very niche podcast for that, I suspect.

Anyway, the advice, of course, is don't pay because paying doesn't actually guarantee you get access back to your car.

It looks like dealers are actually able to do this for less money than the blackmailers are requiring. But you should be reporting it to police.

And the other piece of advice that's just been given is take screenshots. I guess as evidence as to what's happened.

You can take screenshots on a car. If you press down the clutch pedal while inserting a thumb down the exhaust pipe — I'm not suggesting people try this.

And also you'd have to be a bit like Mr. Tickle to reach so far around.

I suppose screenshot of any messages you might receive, but maybe just a photograph. A shot of the screen in your car, yes, perhaps.

If a remote off switch for a car sounds like a brand new problem, it isn't.

For instance, back in 2010 in Austin, Texas, there was a dealership there which fitted some of its cars with a little sort of GPS box.

And they had some control over things.

So if a buyer of the car fell behind on their payments, the dealer could actually remotely stop the car from starting and could even set off the horn.

So then repossession agents could find the car and retrieve it.

Yes. But from the car dealership's point of view, really handy. Until, of course, the wrong person got hold of the password.

And one day what happened was that more than 100 owners of these particular cars found their cars wouldn't start.

And in the middle of the night, all over Austin, horns were going off, which is obviously quite a problem. And some owners were disconnecting their batteries just to get some sleep.

Right. Anyway, it turned out a 20-year-old who'd lost his job at the dealership. This is a familiar story, isn't it?

Logged back into the system using a password and went down the customer list.

All too common. It's that or they haven't reset the password. Now, interestingly, the criminals aren't the only ones with access to the car's off switch of these Li Autos.

In May 2025, Li Auto's Russian distributor said it was considering remotely blocking the screens of cars.

So they were actually thinking of doing it if those cars had been brought in via grey imports again. So they don't like the idea of these cars being imported into Russia on the sly.

And so that summer, Russian dealers claimed that a firmware update was turning some grey import Li Auto cars into bricks.

And they worked on an unblock tool to deal with that. So it's pretty tough being the owner of one of these cars in Russia.

On one side, you've got a manufacturer who's talked about switching off your screen. On the other hand, you've got criminals who are stealing your digital keys.

It's causing all sorts of nuisance. Danny, should manufacturers of anything hold the ability to turn off your device remotely, do you think, on something you've bought?

Sounds like it's asking for trouble. It's the way things are. It's annoying. You don't really need to own anything these days.

I mean, my wife recently passed a driving test and bought a car, and it's a Mini, and it's pre-smart stuff.

We're not having these problems here, but it's just — this whole thing's like people say, oh, you got your internet-connected fridge and it tells you when your milk's about to run out.

Well, I could do that myself by looking in the fridge. There's been a few cases where PlayStation games, the company's gone, oh wait, no, we're taking this game offline now.

Then all your stuff is gone.

Yeah. It's annoying for consumers that this is happening and even more so in the physical realm, I suspect.

What has me thinking in this story is there seems to be no indication as to who is conducting this campaign either, which is interesting because you don't often hear about cyberattacks targeting targets in Russia.

Oh dear, oh dear, oh dear. Answers I would've accepted include an odd sign-in from abroad or someone clicking a dodgy-looking email.

Question 3: what does each alert need before anyone knows that it matters?

No, Joe, that's what they get now. With Dropzone AI, they get a finding with the reasoning and evidence already assembled. It shows its work.

So checking a finding becomes a decision rather than a second investigation. And who decides where the agents stop?

No, Joe. The team decides where the agents stop, and the analysts own every verdict. Now, final, final question. Finish this quote.

Kevin Turnbull, global IT director at Asala Energy, says, with Dropzone, we don't get, this is a problem. We get—

As much as I am loath to admit it, when there are still so many issues around cybersecurity which come down to the basics not being done, it's impossible to ignore how the rise of AI has had an impact on cyberattacks.

Because, you know, who would have predicted that cybercriminals would almost immediately latch onto a new technology to do bad things?

As if. Yeah.

I mean, imagine the internet being used for crime, let alone write better, more convincing phishing emails or use ever more readily available deepfake tools to pose as celebrities, CEOs, and other well-known individuals to trick people, right?

Who'd have thought that could be a thing? Not possible. Alas, it is the case.

And last year alone, it's estimated that fraudsters used audio and video deepfakes to successfully steal over $1.5 billion in total. And that's just the cases we know about.

Yeah, that's just last year. It's likely going to be more this year as well. So yeah, it's tricky out there.

And one of the most common methods of this is known as CEO fraud, which I'm sure listeners of Smashing Security don't need me to explain.

But just in case, as a quick rundown, as the name suggests, it sees scammers using AI deepfakes to look or sound like the CEO, an executive, or someone else important at a major company, call up another executive or an employee with the voice and the face of the person they're impersonating and say, oh, could you make this urgent business transaction please to this bank account?

I mean, it's essentially the evolution of the old business email compromise attacks, which, you know, are very lucrative in themselves.

Except in this case, they're not just using email to coerce employees into making payments — they're also using the audio and video as well.

Often these requests come with claims that, oh, it's a secret but important deal, so you must not tell anyone about this in order to make sure it goes through.

There are two things here that make these work.

One is often they work because they're deepfakes of CEOs and other public figures who by their very nature are public-facing, so audio and video of them speaking is out there.

They've really changed from just the last few years ago.

I saw something a friend of mine posted on LinkedIn — he was doing some work and he posted a deepfake of himself he'd made.

I've known this guy for 30 years and I couldn't tell the difference, which was scary.

And she was apologising for not being able to be there in person. First of all, it seemed like a very standard kind of message.

And then she said, oh, while I'm here, I also want to tell you the new rules regarding the use of the coffee machine.

And it got more and more absurd over time with the things that she was saying, and people began to twig in the audience, hang on, this can't really be her.

And then she came out from behind the scenes, but it had been completely and utterly faked.

It was amusing, but it could have so easily been convincing and used for this kind of fraud.

Yeah, that's the problem with this now. A lot of this technology is so convincing, even just compared to a few years ago.

A lot of the software out there to be able to make it is more easily available, it doesn't take as long.

I mean, even just a few years ago, apparently it'd take a good few days to make a convincing deepfake. Now you can do it basically instantly.

But yes, one of the key problems here with this type of CEO fraud attack is that you mentioned the big boss there. If the big boss calls you and says, can you do this?

Most people aren't going to want to get in trouble for not doing an important task or questioning their boss.

So with all this in mind, this week the United States Department of Justice unsealed an indictment announcing that 3 men have been charged with stealing over $100 million from companies that they defrauded with the aid of deepfakes.

2 of the men were arrested in Spain, and one was arrested here in the UK, which shows this is a global problem as well. You can steal from anyone anywhere nowadays.

The US Department of Justice put out a press release on this.

In it, they refer to AI as superintelligence and SI, but I'm going to choose to ignore that because that's just ridiculous, isn't it?

They're really trying, aren't they? They've got to keep the boss happy. Again, this is actually evidence of what we've just been talking about.

If the boss says something stupid, in many organisations, people think, well, we've got to go along with it, haven't we?

Speaking when the indictment was unsealed, US Attorney James McDonald said the accused abused groundbreaking technology to impersonate real people and deceive executives into sending them and their co-conspirators approximately $129 million, which obviously is quite a lot.

I'm not going to try and work out percentages of that $1.5 billion figure we mentioned earlier, but it's quite a significant chunk of that, really.

So how do the attacks operate?

Well, to begin with, the attackers used deepfakes to pretend they're the CEO of a company, and they called employees to say that, oh, I need your help with these confidential transactions.

So that could have been over the phone, or could have been on Teams or any other video call as well.

But these people on the line would provide the victim with the information on how to make the transaction, which sends the money to a bank account owned by the fraudsters.

And I guess the problem here is for the victim organisations, by the time they've realised something was wrong, the money is already long gone, and $130 million stolen from victims across the United States and the wider world.

That's a significant chunk of coin for allegedly three guys running this scam.

So according to the US Department of Justice, some of the most lucrative attacks in this case — oh, here's some examples.

One resulted in over $5 million being stolen from a pet food company based in Florida. The same amount was stolen from a hospital and healthcare group in Missouri.

No, I suppose banks typically have more security policies and tests and checks in place, and maybe there's more limits.

You'd like to think that they're more experienced about defending against all kinds of fraud and theft.

Yeah.

The victim which the attackers stole the most from was from what's described as a financial technology company here in the UK, which lost over $11.5 million to the scammers, which works out in pounds £8.5 million, which is not an insignificant amount of money at all, is it?

I know, I know. But if word got round the company, the staff would obviously find out that there'd been a big scam going on inevitably.

And even if the company was very gracious and said, look, we're not going to name who it was, you would feel it on your shoulders, wouldn't you?

I think something to consider here as well is these are large amounts of money, but it seems that the authorisation to make these payments just can be done by one person, which is maybe something to be looking at.

That's $11.5 million stolen from a fintech company in the UK, which has not been a good few weeks really for financial technology and cryptocurrency firms.

So yeah, it was the bank with its traditional security which had the least stolen from it, I suppose.

But anyway, those charged, if they're convicted, they'll be facing significant jail time. And I believe all of them are currently waiting for extradition to the United States.

Now, we're all innocent until proven guilty, but I suggest things might not be looking great for the defendants because, according to the court documents, one has previously boasted about being involved with money laundering — laundering hundreds of millions since 1994.

He's also previously convicted of fraud in 2008. I mean, innocent until proven guilty.

Despite the apparent anonymity the internet offers cyber fraudsters, it does always seem to be hubris and boasting which plays a part in them getting caught.

I don't think he was posing with wads of cash in front of a Lamborghini, this one.

You know, that's a really good point because so often I hear about these hacks and sometimes they make the national newspapers.

We're seeing at the moment that there are all these hoax bomb threats going through to airlines. Planes are being diverted and things.

And I'm always thinking, firstly, what is the point of this? But also, it's not as though you can really boast about it to your mates.

It's not as though you can say, oh yeah, that was me who wrote that particular worm, or that was me who stole $6.5 billion from this company.

You know, even in your hacking circle, you've got to be really careful.

And it must eat away inside at you thinking, you know, oh, I did this thing, but I can't really tell anyone about it. At least it's not going to be safe if I do.

But I think this whole case is a reminder that AI technology like deepfakes — they're getting increasingly more powerful, hard to tell what is real and what is not, as their creators seemingly continue to put new, more advanced versions of these out into the world without really thinking about the consequences of doing that.

Oh, look, we can make these super powerful deepfakes, or look, our AI can now hack governments.

Have you really thought about if this is a good idea, putting this out there for everyone to use? But that's another story.

But yeah, it's becoming more difficult to identify the fakes. There are companies out there which say they can use technology to help businesses detect deepfakes.

But even as technology gets more powerful, it's still often the human which is the last line of defence.

There was a story a while back about fraudsters who used deepfake phone calls to pose as a company executive of an auto manufacturer — in fact, call another member of the leadership team to try and trick them into making a major financial transaction.

The person on the receiving end said, okay then, what was the book you recommended to me last week? The attacker didn't know the answer to this, so the attack was thwarted.

So it was just a simple little human interaction.

I think some of the advice that these companies give — like, do have those little backups, have those little phrases or questions to ask to just double-check things.

I mean, that might be difficult for an employee who feels like they're questioning their boss, but no, that's exactly what the attackers want.

They want the victim to feel they don't have any power to reject the request and transfer the money.

So you are saying that you could say to your boss, for instance, yeah, just before I transfer that $10 million, can you remember precisely what happened at the Christmas party?

Didn't you spill something over my jacket, or you insulted me in some fashion?

Yes, exactly that sort of thing.

At a time when the technology is getting more powerful, it is still the little human intuition and connections that can help us defend against these.

It's going to become more important as deepfakes continue to evolve.

And I'm sure we'll probably end up seeing that they cost even more than $1.5 billion this year as the problem keeps going.

So yeah, fingers crossed for anyone out there and just be careful who might be telling you to do the thing.

And maybe Tom Cruise doesn't want you to transfer all that money to invest in some new cryptocurrency. This episode of Smashing Security is sponsored by Vanta.

It's 2 AM. Somewhere, a security team is drowning. Graham, the spreadsheets. There are so many spreadsheets. Vendor risk assessments unread.

Audit evidence scattered like ash in the wind. You've filled out the same questionnaire 4 times this week, Graham. 4 times! Some men choose to face this alone, but not tonight.

Yeah, fair point. Anyway, Vanta — thank God. Vanta's a trust management platform that automates the mind-numbing stuff that makes you want to poke your eyes out with a fork.

No more manual evidence chasing, no more questionnaire hell. It continuously monitors your systems and keeps you audit-ready for SOC 2, ISO 27001, HIPAA, GDPR, the works.

And it uses AI. Yes, Joe, it does.

Pick of the Week is the part of the show where everyone chooses something they like.

Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app. Whatever they wish.

It doesn't have to be security-related necessarily. Well, my Pick of the Week this week is not security-related. My Pick of the Week this week is a TV show.

I know some people will know from last week's episode that I've hurt my back a little bit. And so there's been a bit of TV being watched to try and distract myself from the pain.

And I've been watching a TV show called Lupin. It is a French TV show, the télévision, and it is about— I wish I hadn't started doing this French accent now.

You've committed now. Okay. It is a man. He set out to avenge his father who was accused of stealing a necklace, an incredibly valuable necklace.

And that happened years and years ago when he was a little boy. And it had a huge impact upon the rest of his life.

And in the first episode, as a grown-up man, he ingeniously steals the necklace himself from the Louvre. And it's a great fun show.

He is apparently inspired by a fictional character called Arsène Lupin, who is a gentleman thief and master of disguise.

And it turns out this Arsène Lupin character, there really are books. These books exist. They were written by a chap called Maurice Leblanc.

This came out in the early 1900s, and they're sort of like the cornerstone of the TV show.

The TV show's full of action, it's full of heists, it's full of disguises, all sorts of shenanigans going on.

Oh yes, sorry, I haven't explained that.

The TV show is set in the modern day, but this guy's a huge fan of the books, and they have inspired him and influenced his life in how he lives.

And he's the hero of the show because he's getting away with all these things, but he has actually got a good cause. It's not as though he's doing these things to profit himself.

He's actually righting wrongs with his thievery, with his pickpocketry, and his ability to inveigle his way into organisations. So it's all really entertaining stuff.

And by the way, in the books, apparently in an early one of these books in the early 1900s, Sherlock Holmes appears.

And what apparently happened is that Arthur Conan Doyle or his publishers or something weren't very happy about Sherlock Holmes appearing in someone else's books.

And so Maurice Leblanc, who was writing these books, apparently changed the character's name to Herlock Sholmes.

Which for someone who claimed to be the master of disguise was maybe not— taking the mickey a bit, was Maurice Leblanc.

But anyway, the TV show has now— I've only watched the first series. It's up on Netflix and elsewhere. But there are 4 series so far.

The 4th series has just been put out and it's good fun. I love a show with subtitles anyway, because I feel like—

That's the only way — you can't watch dubbed things. You have to watch them with subtitles.

I mean, I watch English things with subtitles, so I've got no problem watching a French thing with subtitles. It's called Lupin, L-U-P-I-N. Go and check it out.

I guarantee you'll have a fun time. It's a good fun watch. And that is my Pick of the Week. Danny, what's your Pick of the Week?

My pick of the week is not cybersecurity related. I guess it's sort of related in a way, actually, weirdly. It's a video game. It's called Two Point Museum. It isn't new.

It first came out last year, but the premise is it's a management sandbox game where you're building a museum.

Yeah. So you employ the staff, the security guards to stop thefts of necklaces and things as well. The burglars all come in.

You know, when they're detected, they are wearing black and white striped things with swag on and that sort of thing.

You find museum relics and artifacts, learn more about them in order to build the best museum possible, while also making money doing it.

It's by British game developers, Two Point Studios. It's very silly and it's kind of got a cartoony style and it's very Monty Python in the way it does humour.

These are just some of the randomly generated names for some of the museum employees and visitors in a game I was playing last night. One of the visitors was called Horatio Fingers.

One was called Clementine Slime. And then Lionel Mayonnaise also came to pay a visit. I just love all the stupid names.

So it's good-natured, silly fun, as were the two previous titles by the studio, which were Two Point Hospital and Two Point Campus, which had you managing a hospital and university respectively.

Some of the team behind Two Point Museum and the other Two Point games worked on Theme Park and Theme Hospital back in the 1990s.

Fun fact, the lead programmer of Theme Park was a name listeners to Smashing Security might recognise.

It was one Demis Hassabis, who at 17 was the lead programmer of Theme Park, but he left Bullfrog to go to Cambridge University to study computer science.

Then went on to found some company called DeepMind or something.

Apparently he initially started working there even younger. He won a competition to basically get a job at a game company in the early '90s.

Getting a job was easier back then, I guess. But that's probably the reason I love this. It's nostalgic. It's fun. It's quite relaxing. There's no real jeopardy in it.

It's just a nice time and it's my pick of the week. So that's Two Point Museum developed by Two Point Studios, which is published by Sega.

Which is why there's a bunch of Sonic the Hedgehog stuff in my museum. And it's available on PC, PlayStation, Xbox, and Nintendo consoles.

Sounds good fun. And that just about wraps up the show for this week. Thank you so much, Danny, for joining us.

Where can folks find you online and follow you to learn what you are up to?

Yes, annoyingly stereotypical of a freelance writer. Yeah, I set up a Substack which I called Lingua Cyberneticus.

Now when I'm saying it out loud, it's probably not that easy to Google.

Or you can just find me on social media because I'm spamming links to it like there's no tomorrow at the moment.

And of course you can find me, Graham Cluley, on LinkedIn, Bluesky, Mastodon, Instagram, and even on the talk of TikTok.

The list goes on, or follow Smashing Security on Bluesky, Mastodon, or Reddit. And don't forget to ensure that you never miss another episode.

Follow Smashing Security in your favourite podcast app, such as Apple Podcasts, Spotify, and Pocket Casts.

The episode show notes, sponsorship info, guest lists, and the entire back catalogue of 492-ish episodes. Check out smashingsecurity.com. Until next time. Cheerio, bye-bye.

You've been listening to Smashing Security with me, Graham Cluley, and a huge thank you to Danny for joining me this week, and of course to this week's sponsors, Dropzone AI, Hack the Box, and Vanta.

Also thanks to Joe for helping out with the ads. And not being too upset whenever someone writes in accusing him of being an AI. He's not an AI. Joe does really exist.

And huge thanks to the delightful Amanda, who did 95% of the editing this week because of, well, you know, I mustn't keep boring you with stories of how I've done something terrible to my back.

Oops, there I go again.

Anyway, seriously, thanks to all the listeners who dropped me a line about it with their suggestions of what medication I should or should not be taking, what stretch exercises I absolutely must do or absolutely must not do, many of which intersected to add to the challenge.

But it really is lovely to know there are so many kind folks out there prepared to share their war stories of sciatica.

And speaking of lovely people, huge thanks to these brilliant Smashing Security patrons who I plucked out of the hat this week.

The effortlessly cool Jane with a Y — I mean, the Y is in the middle of her name, not at the start. Otherwise, she'd be a Yane.

Vladimir Jirasek, the kind of name that would strike fear into me at a chess tournament.

Ragnar Karlsson, normally found captaining a longboat along the crinkly coastline of Scandinavia. Skadone, whose name reads like a cryptic crossword clue.

Heisenberg, either a physicist or a drug kingpin, or maybe both. We're not asking.

Darryl Green sounds like a reassuring weatherman on a regional news programme and a much more sensible name, if you ask me, than all of the other ones we've had so far today.

And finally, Sital, or is it Sital? All in lowercase. Very, very mysterious.

Anyway, those fine, upstanding individuals are members of Smashing Security Plus, which means that they get their episodes ad-free, earlier than the general public, and perhaps most importantly, get their names read out at the end of the show.

If you would like to join them, all you've got to do is head over to smashingsecurity.com/plus, where for the cost of maybe a fancy coffee every month, you too can be publicly mocked by me.

And so all that's left for me to do is to say thank you very much, and I hope you'll tune in again next week for another episode of Smashing Security. Thank you.