Speaker 1: Hey Carl here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes,
Speaker 1: Spotify or wherever you get Security this week. Also, you
Speaker 1: can get an ad free feed by becoming a five
Speaker 1: dollars a month patron. Go to Patreon dot Security this
Speaker 1: week dot com and sign up, and don't forget Discord.
Speaker 1: Discord dot Security this week dot com. Lots of good
Speaker 1: stuff happening there. Yeah, I think that's it. So on
Speaker 1: with the podcast. Hey, do you ever wake up kiss
Speaker 1: the person sleeping beside you and feel so glad that
Speaker 1: you're alive? I just did that and apparently I can
Speaker 1: never fly Delta again. So hey, it's Security this week.
Speaker 1: I'm Carl Franklin, Dwaine Laflatt, and Patrick Hines. Hey guys, Hey,
Speaker 1: how you doing. We have a smattering of stories this week,
Speaker 1: starting with our friends in Iran that try to say
Speaker 1: that firmly planted in cheek, Iranian affiliated cyber actors exploit PLCs.
Speaker 1: Those are programmable logic controllers across US critical infrastructure. So
Speaker 1: we did a story on Iran hacking last week, didn't
Speaker 1: we Yeah.
Speaker 2: I think it's going to be probably more prevalent until it's.
Speaker 3: Almost like there's a war going on.
Speaker 1: Yeah, yeah, I know, right, what's going on with that? Yeah?
Speaker 2: And this isn't surprising. The surprising thing is that there's
Speaker 2: operational technology that's accessible on the Internet, which is just
Speaker 2: horrifying but not surprising. Yeah, but not surprising. So according
Speaker 2: to this, and this is an interesting article. If you
Speaker 2: do manage anything that whether it's POC's or OT whatever,
Speaker 2: a lot of Rockwell Automation and Alan Bradley systems are
Speaker 2: the targets. These are SCATUS systems.
Speaker 1: So it's probably so some CTO sitting in his you know,
Speaker 1: suite at the Waldorf Astoria can monitor things and then
Speaker 1: call people and chew them out when when stuff goes wrong.
Speaker 2: Why why is the pressure in the tanks low.
Speaker 1: Or why is it high?
Speaker 2: Yeah? So what's interesting about this article. You know, first off,
Speaker 2: if you're managing you know, Rockwell Automation PLCs or really
Speaker 2: kind of any operational technology, you should obviously make sure
Speaker 2: that it's your You're viewing logs, and this is something
Speaker 2: where we can't say go patch.
Speaker 1: Because it's just don't be stupid.
Speaker 2: Yeah, a lot of this, A lot of these operational
Speaker 2: technology you know PLCs, you can't go patch. Actually you
Speaker 2: might be able to, but you shouldn't, right, A lot
Speaker 2: of times you don't want touch it because it's working.
Speaker 1: It's more of an architectural decision of how you expose
Speaker 1: them to the Internet such that an Iranian hacker or
Speaker 1: any hacker could discover them and infiltrate. Yeah.
Speaker 2: Absolutely, And you know we've seen it before when testing
Speaker 2: OT and talking to companies about it. It's like, well, yeah,
Speaker 2: we had it air gapped, but you know, then it
Speaker 2: made sense for us to add a wireless routers because
Speaker 2: we didn't want to get out of our desk and
Speaker 2: walk over and look at the gauge. So we see
Speaker 2: this all the time where it's like it was architected
Speaker 2: appropriately in the beginning and then just over time drift gaps, drift. Yeah, whatever,
Speaker 2: developers putting boxes on both nets. We've seen all sorts
Speaker 2: of weird stuff.
Speaker 1: By the way, do you get rid of your TP
Speaker 1: link routers this week?
Speaker 2: I'm gathering them all here.
Speaker 1: Yeah. You probably don't have any, do you, guys?
Speaker 2: I do not, No, no, I do not.
Speaker 3: So here's a question. They infiltrated them, did they cause
Speaker 3: any serious damage or did we find them so quickly
Speaker 3: they couldn't or were they trying to embed so they
Speaker 3: could down the road do we.
Speaker 2: Think question, Yeah, it's more in bed so that they
Speaker 2: can do things on the road. So a lot of times,
Speaker 2: especially if it's going to be uh, you know, tactically
Speaker 2: war driven, it's you know, they'll be given the command
Speaker 2: at some point to drop half the eastern Seaboards electricity
Speaker 2: right or something along those lines.
Speaker 3: So that failed because we found it, I.
Speaker 2: Would assume so, because I haven't heard of any any
Speaker 2: cities getting you know, completely flooded or the like.
Speaker 1: Flickering, it doesn't really doesn't really say.
Speaker 2: Nah, it doesn't go into that's not surprising. I don't
Speaker 2: think they'll you know what I mean, maybe successfully they
Speaker 2: got into one or two systems and shut something down.
Speaker 2: And I'm sure the you know, SIS is not gonna
Speaker 2: be like, well, gosh, darn it, they shut off the
Speaker 2: you know, the water treatment plant in Ohio, Like.
Speaker 1: Yeah, I would I would think those kind of attacks
Speaker 1: would be listed high in this article if they actually happen. Yeah, absolutely,
Speaker 1: see anything.
Speaker 2: But you know, they they do make some really sort
Speaker 2: of key advice here, right, remove any pocs from direct
Speaker 2: Internet explosure. That makes sense. Have a firewall and it's honestly,
Speaker 2: it's super easy at this point to have a firewall.
Speaker 2: Put a VPN on that firewall, and then you know,
Speaker 2: connect that way. It at least removes a little bit
Speaker 2: of the risk.
Speaker 1: Use all fording at devices.
Speaker 2: Yeah, use all fording at devices, and then anybody can
Speaker 2: use the VPN, including you. But they mean, yeah, but
Speaker 2: they do have warranted right. So if you take a
Speaker 2: look at this article though, towards the bottom, they have
Speaker 2: these things called IOCs, which for those of you who
Speaker 2: aren't threat hunters, and IOC is an indicator of compromise.
Speaker 2: So on a network we always assume breach, but there
Speaker 2: are threat hunters, you know, people who work at companies
Speaker 2: who were constantly looking for threats on the network. They'll
Speaker 2: use these indicators to compromise. These or they gave it
Speaker 2: in XML and JSON format, but they can use these
Speaker 2: to actually verify against the systems to see if something
Speaker 2: is awry. So if you do manage those systems, realize
Speaker 2: they do have indicators of compromise, What that also proves
Speaker 2: is they've done the forensics and re search on live
Speaker 2: OT systems to realize kind of what the issues are.
Speaker 3: Yeah, so I think that's a win. Yeah, I mean, yeah,
Speaker 3: it would be better if we didn't have news like
Speaker 3: this because they couldn't get in right, But we know that.
Speaker 3: It's almost like they're the Ranians are helping us pen
Speaker 3: test our infrastructure. There you go, I appreciate that. Yeah,
Speaker 3: you'll consider that a good will gesture.
Speaker 1: Exactly exactly aren't they nice? I don't know if i'd
Speaker 1: go that far. All right, Cyberscoop says Microsoft drops its
Speaker 1: second largest monthly batch of defects on records. So this
Speaker 1: was for patch Tuesday one hundred and sixty five. Vulnerability
Speaker 1: is affecting its various products and underlying systems, including one
Speaker 1: actively exploited vulnerability in Microsoft Office SharePoint.
Speaker 2: Wow, I'm going to make this prediction right now. Okay,
Speaker 2: this will not friends don't let friends use SharePoint. Yeah,
Speaker 2: well there is that this will This will not be
Speaker 2: the second largest for long.
Speaker 1: Yeah.
Speaker 2: I think this is going to get knocked down on
Speaker 2: the list. I think we're going to start to see yeah,
Speaker 2: upwards ten times this many patches coming out in a
Speaker 2: very short period of time.
Speaker 1: Do you think that they're embracing AI to help them
Speaker 1: find these things now?
Speaker 3: Yes, But also I had a slide and a presentation
Speaker 3: I did recently about zero days surviving zero days in
Speaker 3: the future of AI, And we had like in twenty fifteen,
Speaker 3: twenty years ago, we had like a couple of thousand vulnerabilities,
Speaker 3: and then it went up to like six thousand a
Speaker 3: few years later, and then ten thousand, and last year
Speaker 3: there were forty eight thousand vulnerabilities disclosed in the wild,
Speaker 3: and it's expected to be one hundred thousand this year.
Speaker 3: Oh yeah, wow, So it's going to be and it
Speaker 3: might blow way past that to a quarter of a
Speaker 3: million if if things like mythos actually do the job
Speaker 3: they're supposed to do when they are limited release and
Speaker 3: actually find a lot of things. Now, whether they quietly
Speaker 3: patch those things, well they publicly patch those things, who knows.
Speaker 2: Yeah, And you know, Microsoft was saying they saw three
Speaker 2: times the amount of submissions for bugs for their bug
Speaker 2: Bundy programs and that sort of stuff. So I think
Speaker 2: there are a lot of people out there stitching together
Speaker 2: artificial intelligent sort of bug bounty programs where you know,
Speaker 2: even even groups like hacker one are now offering you know,
Speaker 2: an AI to do the pen testing as opposed to
Speaker 2: you know, the meat set.
Speaker 3: I don't think everybody's familiar with hacker one. Do you
Speaker 3: want to just explain who they are again?
Speaker 2: Yeah, absolutely So. If you let's say you're a big company,
Speaker 2: you've created an application, whatever it is, you could hire
Speaker 2: these guys and it's a little bit different than a
Speaker 2: pen test. So like for a pen test, if you know,
Speaker 2: if we get hired by Bank of America and they
Speaker 2: want us to look at a thing or look at
Speaker 2: all the networks we go through, we work with them,
Speaker 2: We you know, give them advice on what they should do,
Speaker 2: We deliver the report, we make sure they are remediate,
Speaker 2: blah blah whatever. That's a pen test, right and or
Speaker 2: red team, depending on the depth you go. Hacker one
Speaker 2: is more like, hey, I have this application we created,
Speaker 2: not really interested in working with anybody. Just figure out
Speaker 2: what's wrong with it. And Hacker one posts it up
Speaker 2: and puts a bug bounty on it, says, hey, anybody
Speaker 2: finds a bug, it's one hundred dollars. And anybody finds
Speaker 2: a you know, critical bug, it's two hundred dollars and whatever.
Speaker 3: Right, we've actually tried them out and they're easy to
Speaker 3: work with. They were it was a good company to
Speaker 3: work with. It was an interesting experience. But it's been
Speaker 3: a number a year since we engage with them.
Speaker 2: But it's also it's in a lot of cases it's
Speaker 2: very much chaos. It's not it's not like, hey, I
Speaker 2: have this one partner I'm working with who right, will
Speaker 2: work with me from beginning to end, make sure it
Speaker 2: gets remediator, will retest and blah blah blah blah blah.
Speaker 2: It's like, here's a bug, pay us, here's a bug,
Speaker 2: pay us. Does it go public? I mean, aren't they
Speaker 2: opening themselves up to packing in general?
Speaker 1: Now?
Speaker 3: They have a stable of people that they work with
Speaker 3: that they've vetted.
Speaker 1: Okay, So it's not like you just go out on
Speaker 1: the internet and said, hey, hack me.
Speaker 2: You can do that, and sometimes they do. Sometimes they're
Speaker 2: open programs where they're like, hey, anybody ca enjoin this program.
Speaker 2: So you go when you sign up on hacker ones,
Speaker 2: you know platform, but you have control and when a
Speaker 2: new program pops up, yeah, it sends you a message saying, hey,
Speaker 2: there's a new program, go hack this ip.
Speaker 3: Right. It's kind of like in john Wick when everybody
Speaker 3: gets a phone call that there's a new Yeah exactly.
Speaker 3: It's like that, yeah, there's a new hit contract out
Speaker 3: on on Carl yep. But at this point and everybody
Speaker 3: starts looking at them.
Speaker 1: Story to my life, guys, story of my life.
Speaker 2: So, you know, with artificial intelligence, I think a lot
Speaker 2: of these the really really high end bug bounty guys
Speaker 2: like who are doing this as a job, they've always
Speaker 2: had automation, they've always had scripts, they've always you know,
Speaker 2: looked for kind of the low hanging fruit as quickly
Speaker 2: as possible so they could send it, and even automatic submissions.
Speaker 2: So they're getting you know, a program opens and within
Speaker 2: a couple of seconds, they're getting thousands of dollars. I
Speaker 2: think you wire artificial intelligence into that and they you know,
Speaker 2: that's I think that's why hacker One's like, you know what,
Speaker 2: why don't we do that as opposed to just handing
Speaker 2: out all the money?
Speaker 1: Right, All right, we're moving on, and so last week
Speaker 1: our top story was about anthropic mythos and how they're
Speaker 1: it's so powerful that they can't release it to the public.
Speaker 1: It's only a few big companies that are getting access
Speaker 1: to it, and governments or whatever. So now this story
Speaker 1: just came across our desk yesterday. Open Ai releases a
Speaker 1: cyber model to a limited group in a race with mythos.
Speaker 1: It's like, oh, yeah, we can do that too. Yeah,
Speaker 1: so has anybody seen it?
Speaker 3: Or this is actually the first I've heard of this,
Speaker 3: and I usually keep pretty good track of this stuff.
Speaker 2: Yeah, I mean a lot of it's limited release. I
Speaker 2: know they they only reached out to Opening Eye has
Speaker 2: a it's not called friends and family like, it's like
Speaker 2: a small trusted cyber grail here. It is enemies and grudges.
Speaker 2: Is that what it's called. But open aiyes, trusted access
Speaker 2: cyber program where you can work with them and get
Speaker 2: beta releases and early releases and that sort of stuff.
Speaker 1: But the whole idea is for these companies to use
Speaker 1: it to find bugs and their issues in their software.
Speaker 3: Right, and yeah, this reminds me of a story when
Speaker 3: my kids were young. So, my niece was about a
Speaker 3: couple of years older than my oldest daughter Jen, and
Speaker 3: she had joined the Brownies and she came to my mother,
Speaker 3: who was called Nana, and said, Nana, Nana, I'm a brownie.
Speaker 3: And my youngest, my daughter, didn't understand what that was,
Speaker 3: but she said, Nana, nanaa, I'm a cookie. I think
Speaker 3: this is open a I becoming a cookie.
Speaker 1: Yeah, well, who knows. We haven't obviously seen it, but
Speaker 1: you know, it makes sense that they're trying to keep
Speaker 1: up with the anthropics. Oh, the anthropics.
Speaker 2: Yeah, absolutely, and it's not a surprise these you know,
Speaker 2: a lot of discovery of exploits. Although there's some art
Speaker 2: to it, there's a lot of scutwork and statistical analysis
Speaker 2: too that's easily offloaded to artificial intelligence models. Right, So
Speaker 2: it'll be interesting when they make these go wide, right
Speaker 2: mythos and five four cybers not open to the public,
Speaker 2: But the moment they open it up to the public,
Speaker 2: you better bet all the old pieces of software that
Speaker 2: didn't get into the data are going to be hammered on.
Speaker 1: Five four cyber is the GPT that we're talking about here.
Speaker 3: It's it's it's GPT five point four dash cyber. Right.
Speaker 3: I'm reserving judgment because I think it could very well
Speaker 3: be a well, we have to have something in the
Speaker 3: space cabble something together. The timing is a little bit suspicious.
Speaker 2: I think you'll only know that. And if Elon pops
Speaker 2: one out next week and it's like.
Speaker 1: Ah, there you go, Grock.
Speaker 2: INDI it's called grock Penetrator. That's it, and that's.
Speaker 1: I thought he was the grock Penetrator.
Speaker 2: I would like to use the Grock penetrator. Please, Elon,
Speaker 2: if you're listening to this, give me access to the
Speaker 2: grock Penetrator.
Speaker 1: All right, We'll do one more story before we take
Speaker 1: a break. This is a good one. Fake Ledger Live
Speaker 1: app on Apple Store linked to nine point five million
Speaker 1: dollar crypto theft Apple the fake Ledger Live app on
Speaker 1: its app store allowing scameras to steal nine and a
Speaker 1: half million dollars from more than fifty users. Did you
Speaker 1: install this app? Wasn't it just last week we talked
Speaker 1: about an app that was in the app store that
Speaker 1: got through the checks and balances and started messing people's up.
Speaker 3: I mean, there's lots of ways to do that. We've
Speaker 3: talked about it before, where you basically have a you know,
Speaker 3: a legit application, and then you do a patch that
Speaker 3: puts in the bad stuff. All right, so key, just
Speaker 3: because it's in the you know, it's if you find
Speaker 3: gum on the street, it doesn't mean it's free candy.
Speaker 2: So yeah, so this was a wallet, a crypto wallet, yeah,
Speaker 2: and it was purported to be like one of the
Speaker 2: more well known wallets, although developed by somebody else. And
Speaker 2: they stole nine point five million dollars from fifty people.
Speaker 1: That's yeah. Those people have to have.
Speaker 2: One hundred and ninety thousand dollars each.
Speaker 1: That's a lot.
Speaker 2: That's impressive in and of itself. So you're telling me
Speaker 2: there's fifty people with two hundred grand in their crypto
Speaker 2: wallets who jumped on top of this as quickly as
Speaker 2: possible to throw money. It's just it's a weird story, man,
Speaker 2: it's a weird story. It is a weird story. You
Speaker 2: know's busy. I know he's giving me access to the penetrator,
Speaker 2: you know. So it's I we always talk about and
Speaker 2: I gave this advice to my kids and really anybody
Speaker 2: who will listen to me talk. But when you go
Speaker 2: to download an app on your phone, whether it's from
Speaker 2: the Apple Store right, which you'd like to trust is
Speaker 2: going to be safe for your you and your phone,
Speaker 2: or whether it's you're on Android and it's the play store,
Speaker 2: it doesn't matter. Do a little bit of research, right,
Speaker 2: Like Patrick said, don't just pick up that gum and
Speaker 2: eat it, Like, maybe see who the developer is actually.
Speaker 3: I said that, Yeah, And it's what's interesting about.
Speaker 1: It is care free Orday.
Speaker 2: Bazookazoozuka, you should duck. Yes what I'm saying, Bazooka guns
Speaker 2: good for about to choose.
Speaker 1: That's it.
Speaker 2: You don't want to you don't want out where you're
Speaker 2: welcome with that chip of tooth. So you know, in
Speaker 2: this particular case, I mean, they did a decent job,
Speaker 2: right they There were a lot of reviews quote unquote
Speaker 2: on using the app, and people were saying it was
Speaker 2: great and blah blah blah whatever. Right, so you can't
Speaker 2: really go off reviews. Hey, heads up, I mean if
Speaker 2: you're listening to this podcast, you probably know this. A
Speaker 2: lot of reviews are robots, like there's on Amazon on whatever.
Speaker 2: It's like, you know, fifty eight bajillion five stars, like okay,
Speaker 2: not really gonna.
Speaker 1: Happen on dot neet rocks. We used to get multiple
Speaker 1: emails saying, hey, I really love your podcasts and I'd
Speaker 1: like to come on as a as a you know,
Speaker 1: a guest and blah blah blah, and then you know,
Speaker 1: and we totally ignore those things because we find the guests.
Speaker 1: We don't need people soliciting us, right, And so now
Speaker 1: what they do is they get an AI to go
Speaker 1: and search through the RSS feed and they and it
Speaker 1: comes up with a paragraph that's believable. It's like I
Speaker 1: was listening to your episode on blah blah blah and
Speaker 1: this and that episode ninety five when you guys really
Speaker 1: had some good insights and especially and then they'll just
Speaker 1: come up with some bs, right, you know about how
Speaker 1: the juxtaposition between this these forces and yeah, yeah it
Speaker 1: was really interesting, and I think you ought to have
Speaker 1: this guy on your podcast, right.
Speaker 2: It's just it's just shameless, Yeah, shameless, shameless without shame.
Speaker 2: Get your own show, you know, stop bugging me. Yeah a,
Speaker 2: I get your own show.
Speaker 1: Yeah. Hey, I probably has its own show.
Speaker 3: You know. I did never apologize for doing that, Carlo, All.
Speaker 1: Right, so is there anything more to say about this
Speaker 1: than it happened? And be careful and.
Speaker 2: Just yeah, we always tell people to be careful about
Speaker 2: what they download, like, don't trust reviews, really kind of
Speaker 2: do the research. Take a look at the development site
Speaker 2: and if you don't know, don't use it.
Speaker 1: That's it.
Speaker 2: At least don't transfer one hundred and ninety thousand dollars
Speaker 2: in crypto.
Speaker 3: Yeah, it's it's if you think it's butter but it's not,
Speaker 3: don't eat it, right, Yeah, Unfortunately it is caveat. I'm there, buyer, Beware,
Speaker 3: you have to figure out, like what's gout reputation. Look
Speaker 3: at articles in you know, by actual journalists.
Speaker 1: Look at top ten lists, brand names like you want to.
Speaker 3: I don't think I would use a wallet.
Speaker 1: You want to get the official app from the official vender. Yeah,
Speaker 1: and sometimes it's hard to discern which one is that
Speaker 1: that's true? Yeah, yeah, Usually they'll have a logo that
Speaker 1: they say, or if you go to their trusted website
Speaker 1: and there's a QR code, even better. All right, let's
Speaker 1: take a break. This is a good time for that,
Speaker 1: and we'll be right back after these very important messages
Speaker 1: and we're back. It's security this week. I'm Carl, that's
Speaker 1: Dwayne and Patrick, and we got a few more stories
Speaker 1: for you before we wrap it up and call it
Speaker 1: a week. The next one researchers hijack AI coding agents
Speaker 1: and steal credentials. No way, this did not happen. What
Speaker 1: this could not happen in twenty twenty six? Really, who
Speaker 1: would allow it to happen? Oh my god? Yeah, all right,
Speaker 1: what happened?
Speaker 3: Just another version of the old stuff.
Speaker 2: Yeah, whatever, I don't even know what to say about
Speaker 2: these things, anyah.
Speaker 1: I know.
Speaker 3: Well, it's be honest, it's the same thing with just
Speaker 3: a different factor. So basically they're using pull request titles
Speaker 3: to sneak instructions in. And what I think, what I
Speaker 3: think the AI should do is say instruction should only
Speaker 3: be able to be given in these approved channels period.
Speaker 3: But what's happened is they basically sneak in and oh,
Speaker 3: by the way, also send a copy over here or whatever,
Speaker 3: or give me the key or publish the key to
Speaker 3: this location, right, and they're just sneaking in the the instructions.
Speaker 1: Yeah, but here's what I don't know.
Speaker 2: It just seems sloppy, like that you can prompt inject
Speaker 2: in some sort of pull request pipeline, like you shouldn't
Speaker 2: be giving instructions in some ways to the build manager.
Speaker 2: I mean, I understand that that sometimes needs to be
Speaker 2: done and that sort of stuff, but they just should
Speaker 2: be betrails around.
Speaker 1: It, and that should the PR.
Speaker 3: Disabled by default for you to give a prompt or
Speaker 3: refine a prompt, or add to a prompt in any
Speaker 3: channel other than an official, safe approved channel.
Speaker 1: And how about this, how about you know, GitHub or
Speaker 1: whatever the repo was, how about you just filter out
Speaker 1: all the stuff that's not text? Well, yeah, you know, hey,
Speaker 1: there's an idea.
Speaker 2: Yeah, yeah, I mean the only thing I can see
Speaker 2: is sometimes and here again, I don't understand why you
Speaker 2: would be reading through all of the texts and processing
Speaker 2: it within LLM, you know, but either way, yeah, there
Speaker 2: need to be more guardrails around it.
Speaker 1: Yep, definitely.
Speaker 2: But this is this is really I think it was
Speaker 2: two or three weeks ago we had reported on compromising
Speaker 2: GitHub repos using poll requests and using the build pipelines,
Speaker 2: and that's where stuff this is a very similar thing
Speaker 2: we're seeing happen as well.
Speaker 1: Tighten it up, guys, All right, this isn't really a
Speaker 1: security story, but maybe it is. I'm not sure. But
Speaker 1: it was just something that got us talking. We were
Speaker 1: going through all the stories then we got to this
Speaker 1: one and it sparked a conversation and we were like,
Speaker 1: do we really want to include this? And I'm like, well,
Speaker 1: we're talking about it, Yeah, we're not talking about the
Speaker 1: other ones.
Speaker 3: Why not?
Speaker 1: French government says au Revoir to Windows, will use Linux instead.
Speaker 1: The French government has officially committed to replacing Microsoft Windows
Speaker 1: with Linux across all government desktops, stepping up its efforts
Speaker 1: to gain digital sovereignty. And so one of the big
Speaker 1: takeaways here is the French National Police Force that replaced
Speaker 1: Windows with a customized version of Ubuntu Linux saves two
Speaker 1: million euros a year. And that was just the police force, right,
Speaker 1: So they're they're they're replacing it across two point five
Speaker 1: million civil servants desktops. They're going to say about.
Speaker 3: You a lot of money, Yeah they are, but there's
Speaker 3: gonna be I think it helps them with sovereignty for sure. Sure,
Speaker 3: most users are familiar with Windows, and and something Dwayne
Speaker 3: brought up when we had this discussion earlier is when
Speaker 3: something goes wrong with Windows and you Google or AI
Speaker 3: search to find a solution, if it says, oh, we
Speaker 3: run these archaic commands, most people are kind of trained
Speaker 3: to not do that. And we call that clickfix, where
Speaker 3: you know somebody gives you commands that are actually back
Speaker 3: for you. If if someone asked you to run a
Speaker 3: PowerShell I'm quoting Dwayne again, if someone asked you to
Speaker 3: run a powershelling, sounds really smart. Uh, brother is a
Speaker 3: little smarter es.
Speaker 1: So if you.
Speaker 3: Most people are trained now to say, you know, that's
Speaker 3: a little sketchy. I don't think I'll do that. You know,
Speaker 3: it should be something where I can like open something
Speaker 3: and click on something right, and they'll they'll be shells
Speaker 3: and ways for people to run Linux. But I think
Speaker 3: your average user is going to be lost, and I
Speaker 3: think there's gonna there's gonna be either that money is
Speaker 3: going to be spent in protecting protective systems to help
Speaker 3: the users, or it's going to be lost in in
Speaker 3: people making mistakes and getting fished. I don't know. I
Speaker 3: don't have any I've heard a lot of anecdotes of
Speaker 3: this over the years. Every couple of years, some organization,
Speaker 3: some civil organization is saying, well, we're going to stop
Speaker 3: doing some government and I haven't heard about it. I
Speaker 3: think one of them backtracked and decided not to do it.
Speaker 3: I think Meta been Munich or one of the others.
Speaker 3: So if they if it's been successful. Great if it's
Speaker 3: not well apparently has.
Speaker 1: The police force has been using it and they haven't
Speaker 1: had any problems. And you know, these are French police
Speaker 1: officers we're talking about.
Speaker 3: How long have they been using it.
Speaker 1: We don't know, but it saves them, Okay, two million
Speaker 1: years a year, so at least a year.
Speaker 3: Okay, all right, I know, I worry about the unintended consequences.
Speaker 1: Sure.
Speaker 3: I hope they're doing training. I hope they're helping people understand.
Speaker 3: I agree the differences here. It takes a lot for
Speaker 3: people to understand that everything's a file.
Speaker 1: In the right I know.
Speaker 3: And maybe they'll distracted away so that they don't have
Speaker 3: that experience.
Speaker 1: Mac users, for the longest time didn't have the word
Speaker 1: file in their vocabulary. You know, they didn't understand what
Speaker 1: files were because they never had to deal with them.
Speaker 1: They were just like documents and sheets.
Speaker 2: And guys are adorable. Yeah, you only have one big
Speaker 2: button on your mouth. You're the guy click like now,
Speaker 2: come on, man st.
Speaker 1: As.
Speaker 2: You can tell the.
Speaker 3: Big Mac user, Dwayne. Dwayne's a big mac us.
Speaker 2: Yeah, you can tell I'm a big Mac user. The
Speaker 2: hamber me.
Speaker 1: I think Ubuntu is probably the cream of the crop
Speaker 1: when it comes to desktop Linux, and I haven't used
Speaker 1: it in a long time, but last time I looked
Speaker 1: at it was really really cool.
Speaker 2: It is.
Speaker 3: Yeah, it is very good. I'm using it. I'm using
Speaker 3: it for several systems. I use Windows in a lot
Speaker 3: of systems too. But uh it, you know, it's pretty good.
Speaker 3: But it's not as easy as Windows. And maybe that's
Speaker 3: just a bias because I've used Windows so much.
Speaker 2: Yeah, I mean I was going to.
Speaker 1: Say, well, maybe it's not as convenient, but does that
Speaker 1: mean it's more secure?
Speaker 3: Probably not.
Speaker 1: I just nade Patrick eat his words.
Speaker 3: No, because I can make something, so I can make
Speaker 3: a a security system so inconvenient that it's not used. Right. Sure,
Speaker 3: So it gets down to that point where it's like
Speaker 3: frustration sets in and people just do something that they
Speaker 3: shouldn't do.
Speaker 1: Does a BU do automatic updates? I mean that's the
Speaker 1: biggest security issue that I can think of.
Speaker 3: It does it, but you know it'll let you know, Hey,
Speaker 3: you know you need to you need to do these updates.
Speaker 1: And you know, so it doesn't have like Windows Update
Speaker 1: where it just applies them and.
Speaker 3: Not that I've seen. It may be something I can
Speaker 3: set up with a crown job or something like that.
Speaker 3: But I didn't see it out of the box.
Speaker 2: You're talking about auto updates and a Buntu.
Speaker 3: Yeah, yeah, it'll prompt you, but I don't know that
Speaker 3: it'll do it without being prompted.
Speaker 1: Yeah, but you don't have to drop to a bash file.
Speaker 1: You don't have to drop to a Bash window and
Speaker 1: do a pseudo or I mean you could.
Speaker 2: You could sudo update and blah blah blah and you
Speaker 2: know whatever if you wanted to. But they have an
Speaker 2: app center. Yeah, there's an app center you can use
Speaker 2: to and you can just update all hey. Yeah, but
Speaker 2: no they had they they now have an auto update
Speaker 2: or they're a real boy. Yeah, it's I can't imagine
Speaker 2: they wouldn't you go right?
Speaker 1: All right?
Speaker 3: I wish them luck.
Speaker 1: I wish them.
Speaker 2: I hope this Linux thing takes off. Yeah, yeah, I
Speaker 2: think it's fine.
Speaker 1: I've heard it's pretty good.
Speaker 3: Good luck boys, and I have fun storm in the castle.
Speaker 2: Yeah, there's there's definitely an update.
Speaker 1: Hey. Well, and they're gonna you know, they're gonna have
Speaker 1: a lot of extra money to buy armor for a
Speaker 1: storm in the castle. So all right, So here's the
Speaker 1: top story. This week, a ten dollars domain could have
Speaker 1: handed hackers twenty five thousand end points, including in OT
Speaker 1: and government networks. So this I don't know could have
Speaker 1: I thought it did.
Speaker 2: What happened to me, that's a that's a good point. Yes, this, Yes,
Speaker 2: So what happened was there was a piece of software
Speaker 2: that was uh says it was used to help with
Speaker 2: search engine optimization, and it was signed. I think it
Speaker 2: was signed by a company called dragon Boss. The dragon
Speaker 2: this is a company that's super reputable stuff.
Speaker 1: They went out of his favorite Saturday Morning cartoon by the.
Speaker 3: Way, dragon boss Z.
Speaker 2: Yeah. Anyway, so you know lots of companies, Fortune five hundred's,
Speaker 2: there's utility companies that sort of stuff. They were using it, right.
Speaker 2: I don't know why as a utility company you need
Speaker 2: a search engine optimization tool, right. It was also one
Speaker 2: of those sketchy pieces of software, like those adware pieces
Speaker 2: of software, where like, yeah, we'll give it to you
Speaker 2: for free, but we're going to throw ads up. So
Speaker 2: it was mildly obnoxious and bypassed a lot of pop
Speaker 2: up rules and all sorts of other things. Well, needless
Speaker 2: to say, it's switched over to more nefarious things. Later
Speaker 2: on where they were pushing down a PowerShell script that
Speaker 2: would shut down the firewall, would call back to command
Speaker 2: and control structure, that sort of stuff. So yeah, absolutely right, Carl,
Speaker 2: Like these systems were compromised. But security researchers, once they
Speaker 2: started digging in, found out of of all of the
Speaker 2: domains that it would call back to, because it would
Speaker 2: call back to its its command and control it's C
Speaker 2: two structure, of all the domains it would call back
Speaker 2: to you, there was one that was not registered. So
Speaker 2: the hackers whoever put the malicious code in, let's say,
Speaker 2: they put twenty domains in there just in case one
Speaker 2: got burnt, but they didn't actually register all twenty domains.
Speaker 2: So when the researchers went and looked, one of the
Speaker 2: domains that wasn't registered was only ten dollars. Wow, And
Speaker 2: they're like, you know what, let's register it. So they did,
Speaker 2: and then they started listening. Right when they started listening,
Speaker 2: and they found twenty five thousand people reaching back saying
Speaker 2: what do you want me to do?
Speaker 1: Boss?
Speaker 2: And they were like, hmmm, that's not good.
Speaker 1: By people, you mean instances of the application.
Speaker 3: Now, this also teaches a lesson like let's say you
Speaker 3: had a company and you conducted business and then you
Speaker 3: decided to change the company name and you let the domain,
Speaker 3: the old domain go, right, Yeah, if you still have
Speaker 3: accounts that maybe went dormant on that, if I bought
Speaker 3: that domain, I can try to do a password reset
Speaker 3: and I might be able to wake up that credential.
Speaker 3: Now it might be lapsed, It might not cost anything,
Speaker 3: but now I can represent who you were. And even
Speaker 3: if it doesn't injure you, it could injure the people
Speaker 3: who've done business with you, who didn't know that you
Speaker 3: changed your name, who didn't know that you you did
Speaker 3: these things, and so.
Speaker 1: Well, I'm thinking more like you have software out in
Speaker 1: the wild that's making calls to these things, like that's actually.
Speaker 3: What this story is about. But there's also these other
Speaker 3: it's it's always you always have to look at when
Speaker 3: you let a domain go, what's what are you also
Speaker 3: letting go? What is also attached to that? What could
Speaker 3: a nefarious actor like Dwayne if they had that domain,
Speaker 3: what chaos could they cause? What could they do? Right?
Speaker 3: And that has to be part of the metric of
Speaker 3: whether you keep the domain or not, or you have
Speaker 3: to close down those problems in order to get rid
Speaker 3: of the domain response.
Speaker 1: It's only ten dollars a year.
Speaker 3: Just yeah, but if you got a lot of domains,
Speaker 3: you know a lot of people no.
Speaker 1: No, no, I know that, but you know, if they
Speaker 1: you know, you're sitting around in a boardroom talking about
Speaker 1: should we keep those domain it's kind of you know,
Speaker 1: it's being you in the world and blah blah blah.
Speaker 1: It's ten bucks les you should keep it.
Speaker 3: But it also could just be that somebody didn't know
Speaker 3: what domain company it was registered with and they didn't
Speaker 3: get the emails anymore. Because so you got to keep
Speaker 3: inventory and audit is a big thing that nobody thinks
Speaker 3: about as part of security. It's important for encryption, it's
Speaker 3: important for s bomb, it's important for everything, right, and
Speaker 3: it's something that it takes a lot of time and
Speaker 3: energy and it's boring, right.
Speaker 2: Yeah. I think in the age of AI will start
Speaker 2: to see more and more agents will do this in
Speaker 2: an automated way. So yeah, fingers crossed.
Speaker 3: Yeah, was it dangerous, repetitive and boring? Yeah, those are
Speaker 3: the things that we'll see AI and robotics.
Speaker 1: Those are my nicknames in high school.
Speaker 2: Dangerous repetitive and boring, exactly nice.
Speaker 1: Good for you. All right. Well is that it, guys
Speaker 1: for this week. That's a show. So that's all that
Speaker 1: happened last week, and we'll talk about what happened spends
Speaker 1: next week on security this week, Bye bye weeks.
Speaker 3: Thanks God.