Show Notes
There was a pen on the table at a workshop. Placed next to an unlocked phone, it opened the browser and loaded the facilitator’s website, with nobody tapping anything and nobody agreeing to anything.
David Hill was in the room, at the back, and what he noticed first was the noise. When the facilitator stopped to explain why people had started talking, the reaction arrived in two parts: delight at a clever piece of marketing kit, then unease at what it had just done without being asked.
Recorded at AdelaideSEC, David joins David Savva-Willett to describe what happened next. He is an export adviser with the South Australian Department of State Development rather than a security practitioner, speaking here in a personal capacity, and he is open about how long he spent working out whether he was even entitled to take the pen apart, and what the right thing to do about it was.
Taking it apart revealed an NFC tag under the sleeve at the top. It also revealed that the tag had been left writable, so anyone who pocketed one could change where it pointed. He worked out how to do that from a search engine and a free app, with no prior experience of either.
The conversation covers why a workshop is precisely the room where your guard is lowest; why NFC has no equivalent of a Wi-Fi password, a Bluetooth PIN or the deliberate act of pointing a camera at a QR code; how cheaply programmable tags can be bought in bulk; and the finding he considers most important, which is that the phone most likely to react is the personal one nobody manages or trains anyone about.
He also describes how he raised it with the facilitator, in the first break, as an attendee asking about informed consent rather than an expert catching someone out.
More from Cyber Voices
Recorded on the CyberCon 2026 expo floor in Melbourne, this episode sees host David Savva-Willett sit down with Keren Elazari, the friendly hacker, the day after her keynote closed out day one of the conference. Keren is the founder of BSidesTLV and Leading Cyber Ladies, a senior researcher at Tel Aviv University, and the speaker behind one of TED's most watched talks on why the world needs hackers.
Recorded on day three of CyberCon 2026 in Melbourne, the first episode of the Cyber Voices CyberCon series brings AISA Chair Michael Burchell back into the booth with host David Savva-Willett. Close to 5,800 delegates came through the doors this year, a record for the conference, and the pair reflect on what made it work: a program with a record number of speakers presenting for the first time, a deliberate focus on cyber while a global trend pulls conferences towards AI, and a community that turns up to share what it has learned.
Information stealing malware is not new and not sophisticated. That is precisely what worries Jesse Hoppo, who leads the open source intelligence and cyber crime team within Telstra's Threat Research and Intelligence Group, and who spends a good deal of his time reading what these things send home.
Governance, risk and compliance generates a great deal of manual work, and not all of it is work anyone would miss. Ian Yip's argument is that this is exactly where AI earns its place in a security team, provided nobody mistakes it for judgment.
Threat actors are already using large language models to accelerate the early stages of a compromise. Josh Lemon wanted to know what the same tools could do for the responders on the other side.