WEBVTT

1
00:00:00.320 --> 00:00:03.200
<v Speaker 1>Hey Carl here, we're on a mission to find new

2
00:00:03.240 --> 00:00:05.919
<v Speaker 1>fans of the show. I mean, where else can you

3
00:00:05.960 --> 00:00:10.240
<v Speaker 1>get real life comedy and horror in one podcast. You

4
00:00:10.279 --> 00:00:13.000
<v Speaker 1>can do your part by leaving us a review on iTunes,

5
00:00:13.039 --> 00:00:16.719
<v Speaker 1>Spotify or wherever you get Security this week. Also, you

6
00:00:16.719 --> 00:00:19.079
<v Speaker 1>can get an ad free feed by becoming a five

7
00:00:19.120 --> 00:00:22.039
<v Speaker 1>dollars a month patron. Go to Patreon dot Security this

8
00:00:22.079 --> 00:00:25.320
<v Speaker 1>week dot com and sign up, and don't forget Discord.

9
00:00:25.600 --> 00:00:28.519
<v Speaker 1>Discord dot Security this week dot com. Lots of good

10
00:00:28.559 --> 00:00:32.320
<v Speaker 1>stuff happening there. Yeah, I think that's it. So on

11
00:00:32.359 --> 00:00:35.799
<v Speaker 1>with the podcast. Hey, do you ever wake up kiss

12
00:00:35.880 --> 00:00:39.200
<v Speaker 1>the person sleeping beside you and feel so glad that

13
00:00:39.240 --> 00:00:42.640
<v Speaker 1>you're alive? I just did that and apparently I can

14
00:00:42.719 --> 00:00:55.799
<v Speaker 1>never fly Delta again. So hey, it's Security this week.

15
00:00:55.840 --> 00:00:59.200
<v Speaker 1>I'm Carl Franklin, Dwaine Laflatt, and Patrick Hines. Hey guys, Hey,

16
00:00:59.280 --> 00:01:03.479
<v Speaker 1>how you doing. We have a smattering of stories this week,

17
00:01:04.079 --> 00:01:08.680
<v Speaker 1>starting with our friends in Iran that try to say

18
00:01:08.719 --> 00:01:15.680
<v Speaker 1>that firmly planted in cheek, Iranian affiliated cyber actors exploit PLCs.

19
00:01:15.760 --> 00:01:22.120
<v Speaker 1>Those are programmable logic controllers across US critical infrastructure. So

20
00:01:22.959 --> 00:01:25.400
<v Speaker 1>we did a story on Iran hacking last week, didn't

21
00:01:25.400 --> 00:01:26.560
<v Speaker 1>we Yeah.

22
00:01:26.680 --> 00:01:29.920
<v Speaker 2>I think it's going to be probably more prevalent until it's.

23
00:01:29.799 --> 00:01:31.040
<v Speaker 3>Almost like there's a war going on.

24
00:01:31.159 --> 00:01:35.799
<v Speaker 1>Yeah, yeah, I know, right, what's going on with that? Yeah?

25
00:01:35.840 --> 00:01:38.400
<v Speaker 2>And this isn't surprising. The surprising thing is that there's

26
00:01:38.519 --> 00:01:42.200
<v Speaker 2>operational technology that's accessible on the Internet, which is just

27
00:01:42.680 --> 00:01:48.120
<v Speaker 2>horrifying but not surprising. Yeah, but not surprising. So according

28
00:01:48.159 --> 00:01:50.519
<v Speaker 2>to this, and this is an interesting article. If you

29
00:01:50.560 --> 00:01:55.680
<v Speaker 2>do manage anything that whether it's POC's or OT whatever,

30
00:01:57.000 --> 00:02:01.280
<v Speaker 2>a lot of Rockwell Automation and Alan Bradley systems are

31
00:02:01.359 --> 00:02:03.200
<v Speaker 2>the targets. These are SCATUS systems.

32
00:02:04.200 --> 00:02:08.080
<v Speaker 1>So it's probably so some CTO sitting in his you know,

33
00:02:09.319 --> 00:02:14.120
<v Speaker 1>suite at the Waldorf Astoria can monitor things and then

34
00:02:14.240 --> 00:02:17.360
<v Speaker 1>call people and chew them out when when stuff goes wrong.

35
00:02:17.919 --> 00:02:20.280
<v Speaker 2>Why why is the pressure in the tanks low.

36
00:02:20.800 --> 00:02:24.199
<v Speaker 1>Or why is it high?

37
00:02:24.280 --> 00:02:28.479
<v Speaker 2>Yeah? So what's interesting about this article. You know, first off,

38
00:02:28.520 --> 00:02:32.560
<v Speaker 2>if you're managing you know, Rockwell Automation PLCs or really

39
00:02:32.639 --> 00:02:35.560
<v Speaker 2>kind of any operational technology, you should obviously make sure

40
00:02:35.599 --> 00:02:38.800
<v Speaker 2>that it's your You're viewing logs, and this is something

41
00:02:38.800 --> 00:02:40.400
<v Speaker 2>where we can't say go patch.

42
00:02:40.800 --> 00:02:42.639
<v Speaker 1>Because it's just don't be stupid.

43
00:02:42.840 --> 00:02:45.599
<v Speaker 2>Yeah, a lot of this, A lot of these operational

44
00:02:45.639 --> 00:02:50.680
<v Speaker 2>technology you know PLCs, you can't go patch. Actually you

45
00:02:50.759 --> 00:02:52.520
<v Speaker 2>might be able to, but you shouldn't, right, A lot

46
00:02:52.520 --> 00:02:54.120
<v Speaker 2>of times you don't want touch it because it's working.

47
00:02:54.319 --> 00:02:57.080
<v Speaker 1>It's more of an architectural decision of how you expose

48
00:02:57.159 --> 00:03:00.560
<v Speaker 1>them to the Internet such that an Iranian hacker or

49
00:03:00.599 --> 00:03:03.960
<v Speaker 1>any hacker could discover them and infiltrate. Yeah.

50
00:03:04.000 --> 00:03:07.639
<v Speaker 2>Absolutely, And you know we've seen it before when testing

51
00:03:08.080 --> 00:03:10.719
<v Speaker 2>OT and talking to companies about it. It's like, well, yeah,

52
00:03:10.719 --> 00:03:13.120
<v Speaker 2>we had it air gapped, but you know, then it

53
00:03:13.159 --> 00:03:15.800
<v Speaker 2>made sense for us to add a wireless routers because

54
00:03:15.800 --> 00:03:17.199
<v Speaker 2>we didn't want to get out of our desk and

55
00:03:17.439 --> 00:03:20.560
<v Speaker 2>walk over and look at the gauge. So we see

56
00:03:20.560 --> 00:03:22.439
<v Speaker 2>this all the time where it's like it was architected

57
00:03:22.520 --> 00:03:27.080
<v Speaker 2>appropriately in the beginning and then just over time drift gaps, drift. Yeah, whatever,

58
00:03:28.039 --> 00:03:31.360
<v Speaker 2>developers putting boxes on both nets. We've seen all sorts

59
00:03:31.400 --> 00:03:32.039
<v Speaker 2>of weird stuff.

60
00:03:32.080 --> 00:03:33.400
<v Speaker 1>By the way, do you get rid of your TP

61
00:03:33.560 --> 00:03:34.800
<v Speaker 1>link routers this week?

62
00:03:36.560 --> 00:03:37.759
<v Speaker 2>I'm gathering them all here.

63
00:03:39.159 --> 00:03:40.960
<v Speaker 1>Yeah. You probably don't have any, do you, guys?

64
00:03:41.000 --> 00:03:43.479
<v Speaker 2>I do not, No, no, I do not.

65
00:03:43.879 --> 00:03:48.000
<v Speaker 3>So here's a question. They infiltrated them, did they cause

66
00:03:48.039 --> 00:03:51.280
<v Speaker 3>any serious damage or did we find them so quickly

67
00:03:51.319 --> 00:03:54.439
<v Speaker 3>they couldn't or were they trying to embed so they

68
00:03:54.479 --> 00:03:56.240
<v Speaker 3>could down the road do we.

69
00:03:56.199 --> 00:03:59.319
<v Speaker 2>Think question, Yeah, it's more in bed so that they

70
00:03:59.360 --> 00:04:01.120
<v Speaker 2>can do things on the road. So a lot of times,

71
00:04:01.240 --> 00:04:03.879
<v Speaker 2>especially if it's going to be uh, you know, tactically

72
00:04:03.879 --> 00:04:06.719
<v Speaker 2>war driven, it's you know, they'll be given the command

73
00:04:06.719 --> 00:04:09.800
<v Speaker 2>at some point to drop half the eastern Seaboards electricity

74
00:04:10.000 --> 00:04:11.240
<v Speaker 2>right or something along those lines.

75
00:04:11.280 --> 00:04:13.360
<v Speaker 3>So that failed because we found it, I.

76
00:04:13.319 --> 00:04:15.960
<v Speaker 2>Would assume so, because I haven't heard of any any

77
00:04:16.000 --> 00:04:19.439
<v Speaker 2>cities getting you know, completely flooded or the like.

78
00:04:19.439 --> 00:04:22.040
<v Speaker 1>Flickering, it doesn't really doesn't really say.

79
00:04:22.000 --> 00:04:24.639
<v Speaker 2>Nah, it doesn't go into that's not surprising. I don't

80
00:04:24.680 --> 00:04:27.319
<v Speaker 2>think they'll you know what I mean, maybe successfully they

81
00:04:27.319 --> 00:04:29.600
<v Speaker 2>got into one or two systems and shut something down.

82
00:04:29.600 --> 00:04:31.560
<v Speaker 2>And I'm sure the you know, SIS is not gonna

83
00:04:31.560 --> 00:04:34.079
<v Speaker 2>be like, well, gosh, darn it, they shut off the

84
00:04:34.519 --> 00:04:37.920
<v Speaker 2>you know, the water treatment plant in Ohio, Like.

85
00:04:37.959 --> 00:04:40.639
<v Speaker 1>Yeah, I would I would think those kind of attacks

86
00:04:40.639 --> 00:04:44.839
<v Speaker 1>would be listed high in this article if they actually happen. Yeah, absolutely,

87
00:04:44.879 --> 00:04:45.839
<v Speaker 1>see anything.

88
00:04:46.279 --> 00:04:49.040
<v Speaker 2>But you know, they they do make some really sort

89
00:04:49.079 --> 00:04:52.720
<v Speaker 2>of key advice here, right, remove any pocs from direct

90
00:04:52.759 --> 00:04:56.800
<v Speaker 2>Internet explosure. That makes sense. Have a firewall and it's honestly,

91
00:04:56.800 --> 00:04:58.680
<v Speaker 2>it's super easy at this point to have a firewall.

92
00:04:58.720 --> 00:05:01.519
<v Speaker 2>Put a VPN on that firewall, and then you know,

93
00:05:01.680 --> 00:05:04.480
<v Speaker 2>connect that way. It at least removes a little bit

94
00:05:04.519 --> 00:05:04.959
<v Speaker 2>of the risk.

95
00:05:05.199 --> 00:05:07.319
<v Speaker 1>Use all fording at devices.

96
00:05:07.000 --> 00:05:11.120
<v Speaker 2>Yeah, use all fording at devices, and then anybody can

97
00:05:11.199 --> 00:05:17.839
<v Speaker 2>use the VPN, including you. But they mean, yeah, but

98
00:05:17.959 --> 00:05:21.399
<v Speaker 2>they do have warranted right. So if you take a

99
00:05:21.399 --> 00:05:24.199
<v Speaker 2>look at this article though, towards the bottom, they have

100
00:05:24.240 --> 00:05:26.680
<v Speaker 2>these things called IOCs, which for those of you who

101
00:05:26.680 --> 00:05:30.519
<v Speaker 2>aren't threat hunters, and IOC is an indicator of compromise.

102
00:05:31.079 --> 00:05:33.800
<v Speaker 2>So on a network we always assume breach, but there

103
00:05:33.800 --> 00:05:37.160
<v Speaker 2>are threat hunters, you know, people who work at companies

104
00:05:37.160 --> 00:05:41.240
<v Speaker 2>who were constantly looking for threats on the network. They'll

105
00:05:41.360 --> 00:05:44.480
<v Speaker 2>use these indicators to compromise. These or they gave it

106
00:05:44.560 --> 00:05:48.800
<v Speaker 2>in XML and JSON format, but they can use these

107
00:05:48.839 --> 00:05:51.279
<v Speaker 2>to actually verify against the systems to see if something

108
00:05:51.839 --> 00:05:55.040
<v Speaker 2>is awry. So if you do manage those systems, realize

109
00:05:55.079 --> 00:05:58.240
<v Speaker 2>they do have indicators of compromise, What that also proves

110
00:05:58.319 --> 00:06:00.920
<v Speaker 2>is they've done the forensics and re search on live

111
00:06:01.319 --> 00:06:05.040
<v Speaker 2>OT systems to realize kind of what the issues are.

112
00:06:05.399 --> 00:06:08.319
<v Speaker 3>Yeah, so I think that's a win. Yeah, I mean, yeah,

113
00:06:08.480 --> 00:06:10.120
<v Speaker 3>it would be better if we didn't have news like

114
00:06:10.160 --> 00:06:13.120
<v Speaker 3>this because they couldn't get in right, But we know that.

115
00:06:13.839 --> 00:06:16.160
<v Speaker 3>It's almost like they're the Ranians are helping us pen

116
00:06:16.240 --> 00:06:19.639
<v Speaker 3>test our infrastructure. There you go, I appreciate that. Yeah,

117
00:06:19.680 --> 00:06:21.360
<v Speaker 3>you'll consider that a good will gesture.

118
00:06:21.720 --> 00:06:25.439
<v Speaker 1>Exactly exactly aren't they nice? I don't know if i'd

119
00:06:25.439 --> 00:06:29.319
<v Speaker 1>go that far. All right, Cyberscoop says Microsoft drops its

120
00:06:29.360 --> 00:06:32.800
<v Speaker 1>second largest monthly batch of defects on records. So this

121
00:06:32.959 --> 00:06:37.319
<v Speaker 1>was for patch Tuesday one hundred and sixty five. Vulnerability

122
00:06:37.399 --> 00:06:40.600
<v Speaker 1>is affecting its various products and underlying systems, including one

123
00:06:40.759 --> 00:06:45.079
<v Speaker 1>actively exploited vulnerability in Microsoft Office SharePoint.

124
00:06:45.480 --> 00:06:47.800
<v Speaker 2>Wow, I'm going to make this prediction right now. Okay,

125
00:06:48.079 --> 00:06:51.079
<v Speaker 2>this will not friends don't let friends use SharePoint. Yeah,

126
00:06:51.279 --> 00:06:56.040
<v Speaker 2>well there is that this will This will not be

127
00:06:56.160 --> 00:06:57.680
<v Speaker 2>the second largest for long.

128
00:06:58.199 --> 00:06:58.480
<v Speaker 1>Yeah.

129
00:06:58.519 --> 00:07:00.040
<v Speaker 2>I think this is going to get knocked down on

130
00:06:59.959 --> 00:07:02.000
<v Speaker 2>the list. I think we're going to start to see yeah,

131
00:07:02.160 --> 00:07:04.759
<v Speaker 2>upwards ten times this many patches coming out in a

132
00:07:04.839 --> 00:07:05.720
<v Speaker 2>very short period of time.

133
00:07:05.800 --> 00:07:08.879
<v Speaker 1>Do you think that they're embracing AI to help them

134
00:07:09.040 --> 00:07:10.040
<v Speaker 1>find these things now?

135
00:07:10.360 --> 00:07:13.160
<v Speaker 3>Yes, But also I had a slide and a presentation

136
00:07:13.240 --> 00:07:15.800
<v Speaker 3>I did recently about zero days surviving zero days in

137
00:07:15.839 --> 00:07:23.439
<v Speaker 3>the future of AI, And we had like in twenty fifteen,

138
00:07:23.480 --> 00:07:26.959
<v Speaker 3>twenty years ago, we had like a couple of thousand vulnerabilities,

139
00:07:27.560 --> 00:07:29.319
<v Speaker 3>and then it went up to like six thousand a

140
00:07:29.319 --> 00:07:32.720
<v Speaker 3>few years later, and then ten thousand, and last year

141
00:07:32.759 --> 00:07:38.759
<v Speaker 3>there were forty eight thousand vulnerabilities disclosed in the wild,

142
00:07:38.800 --> 00:07:40.800
<v Speaker 3>and it's expected to be one hundred thousand this year.

143
00:07:40.879 --> 00:07:42.920
<v Speaker 3>Oh yeah, wow, So it's going to be and it

144
00:07:43.439 --> 00:07:45.560
<v Speaker 3>might blow way past that to a quarter of a

145
00:07:45.600 --> 00:07:50.240
<v Speaker 3>million if if things like mythos actually do the job

146
00:07:50.240 --> 00:07:52.079
<v Speaker 3>they're supposed to do when they are limited release and

147
00:07:52.120 --> 00:07:55.160
<v Speaker 3>actually find a lot of things. Now, whether they quietly

148
00:07:55.399 --> 00:07:58.360
<v Speaker 3>patch those things, well they publicly patch those things, who knows.

149
00:07:58.680 --> 00:08:02.360
<v Speaker 2>Yeah, And you know, Microsoft was saying they saw three

150
00:08:02.639 --> 00:08:06.480
<v Speaker 2>times the amount of submissions for bugs for their bug

151
00:08:06.480 --> 00:08:09.199
<v Speaker 2>Bundy programs and that sort of stuff. So I think

152
00:08:09.199 --> 00:08:11.319
<v Speaker 2>there are a lot of people out there stitching together

153
00:08:11.639 --> 00:08:17.000
<v Speaker 2>artificial intelligent sort of bug bounty programs where you know,

154
00:08:17.079 --> 00:08:20.759
<v Speaker 2>even even groups like hacker one are now offering you know,

155
00:08:20.800 --> 00:08:23.000
<v Speaker 2>an AI to do the pen testing as opposed to

156
00:08:23.560 --> 00:08:25.079
<v Speaker 2>you know, the meat set.

157
00:08:25.120 --> 00:08:26.879
<v Speaker 3>I don't think everybody's familiar with hacker one. Do you

158
00:08:26.879 --> 00:08:28.240
<v Speaker 3>want to just explain who they are again?

159
00:08:28.319 --> 00:08:31.959
<v Speaker 2>Yeah, absolutely So. If you let's say you're a big company,

160
00:08:31.959 --> 00:08:34.320
<v Speaker 2>you've created an application, whatever it is, you could hire

161
00:08:34.360 --> 00:08:37.480
<v Speaker 2>these guys and it's a little bit different than a

162
00:08:37.480 --> 00:08:40.399
<v Speaker 2>pen test. So like for a pen test, if you know,

163
00:08:40.440 --> 00:08:41.919
<v Speaker 2>if we get hired by Bank of America and they

164
00:08:41.919 --> 00:08:43.200
<v Speaker 2>want us to look at a thing or look at

165
00:08:43.240 --> 00:08:46.000
<v Speaker 2>all the networks we go through, we work with them,

166
00:08:46.159 --> 00:08:49.240
<v Speaker 2>We you know, give them advice on what they should do,

167
00:08:49.519 --> 00:08:51.879
<v Speaker 2>We deliver the report, we make sure they are remediate,

168
00:08:51.919 --> 00:08:54.720
<v Speaker 2>blah blah whatever. That's a pen test, right and or

169
00:08:54.799 --> 00:08:57.720
<v Speaker 2>red team, depending on the depth you go. Hacker one

170
00:08:57.799 --> 00:09:00.720
<v Speaker 2>is more like, hey, I have this application we created,

171
00:09:01.159 --> 00:09:03.600
<v Speaker 2>not really interested in working with anybody. Just figure out

172
00:09:03.600 --> 00:09:06.360
<v Speaker 2>what's wrong with it. And Hacker one posts it up

173
00:09:06.399 --> 00:09:08.840
<v Speaker 2>and puts a bug bounty on it, says, hey, anybody

174
00:09:08.840 --> 00:09:11.000
<v Speaker 2>finds a bug, it's one hundred dollars. And anybody finds

175
00:09:11.000 --> 00:09:14.320
<v Speaker 2>a you know, critical bug, it's two hundred dollars and whatever.

176
00:09:14.480 --> 00:09:17.000
<v Speaker 3>Right, we've actually tried them out and they're easy to

177
00:09:17.080 --> 00:09:19.480
<v Speaker 3>work with. They were it was a good company to

178
00:09:19.480 --> 00:09:22.679
<v Speaker 3>work with. It was an interesting experience. But it's been

179
00:09:22.720 --> 00:09:24.840
<v Speaker 3>a number a year since we engage with them.

180
00:09:25.200 --> 00:09:28.519
<v Speaker 2>But it's also it's in a lot of cases it's

181
00:09:28.639 --> 00:09:32.000
<v Speaker 2>very much chaos. It's not it's not like, hey, I

182
00:09:32.039 --> 00:09:35.200
<v Speaker 2>have this one partner I'm working with who right, will

183
00:09:35.240 --> 00:09:37.480
<v Speaker 2>work with me from beginning to end, make sure it

184
00:09:37.480 --> 00:09:40.159
<v Speaker 2>gets remediator, will retest and blah blah blah blah blah.

185
00:09:40.159 --> 00:09:42.200
<v Speaker 2>It's like, here's a bug, pay us, here's a bug,

186
00:09:42.320 --> 00:09:44.360
<v Speaker 2>pay us. Does it go public? I mean, aren't they

187
00:09:44.399 --> 00:09:46.399
<v Speaker 2>opening themselves up to packing in general?

188
00:09:46.440 --> 00:09:46.559
<v Speaker 1>Now?

189
00:09:46.639 --> 00:09:50.080
<v Speaker 3>They have a stable of people that they work with

190
00:09:50.120 --> 00:09:50.799
<v Speaker 3>that they've vetted.

191
00:09:50.960 --> 00:09:53.080
<v Speaker 1>Okay, So it's not like you just go out on

192
00:09:53.120 --> 00:09:54.559
<v Speaker 1>the internet and said, hey, hack me.

193
00:09:54.799 --> 00:09:57.399
<v Speaker 2>You can do that, and sometimes they do. Sometimes they're

194
00:09:57.480 --> 00:10:00.799
<v Speaker 2>open programs where they're like, hey, anybody ca enjoin this program.

195
00:10:00.799 --> 00:10:02.639
<v Speaker 2>So you go when you sign up on hacker ones,

196
00:10:02.840 --> 00:10:05.639
<v Speaker 2>you know platform, but you have control and when a

197
00:10:05.679 --> 00:10:08.279
<v Speaker 2>new program pops up, yeah, it sends you a message saying, hey,

198
00:10:08.320 --> 00:10:09.639
<v Speaker 2>there's a new program, go hack this ip.

199
00:10:10.000 --> 00:10:12.039
<v Speaker 3>Right. It's kind of like in john Wick when everybody

200
00:10:12.080 --> 00:10:14.159
<v Speaker 3>gets a phone call that there's a new Yeah exactly.

201
00:10:14.240 --> 00:10:17.559
<v Speaker 3>It's like that, yeah, there's a new hit contract out

202
00:10:17.600 --> 00:10:20.240
<v Speaker 3>on on Carl yep. But at this point and everybody

203
00:10:20.279 --> 00:10:21.120
<v Speaker 3>starts looking at them.

204
00:10:21.200 --> 00:10:25.279
<v Speaker 1>Story to my life, guys, story of my life.

205
00:10:26.720 --> 00:10:28.840
<v Speaker 2>So, you know, with artificial intelligence, I think a lot

206
00:10:28.840 --> 00:10:32.279
<v Speaker 2>of these the really really high end bug bounty guys

207
00:10:32.399 --> 00:10:35.600
<v Speaker 2>like who are doing this as a job, they've always

208
00:10:35.600 --> 00:10:38.240
<v Speaker 2>had automation, they've always had scripts, they've always you know,

209
00:10:38.399 --> 00:10:41.200
<v Speaker 2>looked for kind of the low hanging fruit as quickly

210
00:10:41.240 --> 00:10:44.159
<v Speaker 2>as possible so they could send it, and even automatic submissions.

211
00:10:44.679 --> 00:10:46.960
<v Speaker 2>So they're getting you know, a program opens and within

212
00:10:47.000 --> 00:10:49.720
<v Speaker 2>a couple of seconds, they're getting thousands of dollars. I

213
00:10:49.720 --> 00:10:53.279
<v Speaker 2>think you wire artificial intelligence into that and they you know,

214
00:10:53.360 --> 00:10:55.200
<v Speaker 2>that's I think that's why hacker One's like, you know what,

215
00:10:55.240 --> 00:10:57.440
<v Speaker 2>why don't we do that as opposed to just handing

216
00:10:57.440 --> 00:10:58.120
<v Speaker 2>out all the money?

217
00:10:58.200 --> 00:11:01.480
<v Speaker 1>Right, All right, we're moving on, and so last week

218
00:11:01.679 --> 00:11:04.879
<v Speaker 1>our top story was about anthropic mythos and how they're

219
00:11:05.279 --> 00:11:08.080
<v Speaker 1>it's so powerful that they can't release it to the public.

220
00:11:08.200 --> 00:11:11.039
<v Speaker 1>It's only a few big companies that are getting access

221
00:11:11.039 --> 00:11:14.600
<v Speaker 1>to it, and governments or whatever. So now this story

222
00:11:14.720 --> 00:11:19.600
<v Speaker 1>just came across our desk yesterday. Open Ai releases a

223
00:11:19.639 --> 00:11:23.879
<v Speaker 1>cyber model to a limited group in a race with mythos.

224
00:11:23.960 --> 00:11:27.559
<v Speaker 1>It's like, oh, yeah, we can do that too. Yeah,

225
00:11:28.440 --> 00:11:30.240
<v Speaker 1>so has anybody seen it?

226
00:11:30.360 --> 00:11:32.080
<v Speaker 3>Or this is actually the first I've heard of this,

227
00:11:32.360 --> 00:11:34.399
<v Speaker 3>and I usually keep pretty good track of this stuff.

228
00:11:34.960 --> 00:11:37.279
<v Speaker 2>Yeah, I mean a lot of it's limited release. I

229
00:11:37.320 --> 00:11:40.559
<v Speaker 2>know they they only reached out to Opening Eye has

230
00:11:40.600 --> 00:11:44.480
<v Speaker 2>a it's not called friends and family like, it's like

231
00:11:44.600 --> 00:11:47.799
<v Speaker 2>a small trusted cyber grail here. It is enemies and grudges.

232
00:11:47.840 --> 00:11:52.120
<v Speaker 2>Is that what it's called. But open aiyes, trusted access

233
00:11:52.279 --> 00:11:55.919
<v Speaker 2>cyber program where you can work with them and get

234
00:11:55.919 --> 00:11:58.240
<v Speaker 2>beta releases and early releases and that sort of stuff.

235
00:11:58.639 --> 00:12:01.080
<v Speaker 1>But the whole idea is for these companies to use

236
00:12:01.120 --> 00:12:03.639
<v Speaker 1>it to find bugs and their issues in their software.

237
00:12:03.799 --> 00:12:06.360
<v Speaker 3>Right, and yeah, this reminds me of a story when

238
00:12:06.360 --> 00:12:08.639
<v Speaker 3>my kids were young. So, my niece was about a

239
00:12:08.679 --> 00:12:11.960
<v Speaker 3>couple of years older than my oldest daughter Jen, and

240
00:12:12.360 --> 00:12:14.720
<v Speaker 3>she had joined the Brownies and she came to my mother,

241
00:12:15.200 --> 00:12:18.879
<v Speaker 3>who was called Nana, and said, Nana, Nana, I'm a brownie.

242
00:12:19.399 --> 00:12:21.679
<v Speaker 3>And my youngest, my daughter, didn't understand what that was,

243
00:12:21.720 --> 00:12:25.360
<v Speaker 3>but she said, Nana, nanaa, I'm a cookie. I think

244
00:12:25.399 --> 00:12:27.399
<v Speaker 3>this is open a I becoming a cookie.

245
00:12:27.559 --> 00:12:31.559
<v Speaker 1>Yeah, well, who knows. We haven't obviously seen it, but

246
00:12:31.759 --> 00:12:33.759
<v Speaker 1>you know, it makes sense that they're trying to keep

247
00:12:33.840 --> 00:12:36.559
<v Speaker 1>up with the anthropics. Oh, the anthropics.

248
00:12:37.440 --> 00:12:40.559
<v Speaker 2>Yeah, absolutely, and it's not a surprise these you know,

249
00:12:40.679 --> 00:12:45.759
<v Speaker 2>a lot of discovery of exploits. Although there's some art

250
00:12:45.799 --> 00:12:48.919
<v Speaker 2>to it, there's a lot of scutwork and statistical analysis

251
00:12:48.960 --> 00:12:53.320
<v Speaker 2>too that's easily offloaded to artificial intelligence models. Right, So

252
00:12:53.360 --> 00:12:55.840
<v Speaker 2>it'll be interesting when they make these go wide, right

253
00:12:56.159 --> 00:12:59.399
<v Speaker 2>mythos and five four cybers not open to the public,

254
00:12:59.679 --> 00:13:01.759
<v Speaker 2>But the moment they open it up to the public,

255
00:13:01.759 --> 00:13:04.440
<v Speaker 2>you better bet all the old pieces of software that

256
00:13:04.480 --> 00:13:07.559
<v Speaker 2>didn't get into the data are going to be hammered on.

257
00:13:07.919 --> 00:13:11.360
<v Speaker 1>Five four cyber is the GPT that we're talking about here.

258
00:13:11.240 --> 00:13:15.320
<v Speaker 3>It's it's it's GPT five point four dash cyber. Right.

259
00:13:15.840 --> 00:13:20.639
<v Speaker 3>I'm reserving judgment because I think it could very well

260
00:13:20.679 --> 00:13:22.159
<v Speaker 3>be a well, we have to have something in the

261
00:13:22.200 --> 00:13:25.960
<v Speaker 3>space cabble something together. The timing is a little bit suspicious.

262
00:13:26.200 --> 00:13:28.879
<v Speaker 2>I think you'll only know that. And if Elon pops

263
00:13:28.879 --> 00:13:30.360
<v Speaker 2>one out next week and it's like.

264
00:13:30.480 --> 00:13:32.639
<v Speaker 1>Ah, there you go, Grock.

265
00:13:32.679 --> 00:13:36.159
<v Speaker 2>INDI it's called grock Penetrator. That's it, and that's.

266
00:13:38.159 --> 00:13:39.799
<v Speaker 1>I thought he was the grock Penetrator.

267
00:13:40.240 --> 00:13:44.799
<v Speaker 2>I would like to use the Grock penetrator. Please, Elon,

268
00:13:44.840 --> 00:13:46.879
<v Speaker 2>if you're listening to this, give me access to the

269
00:13:46.879 --> 00:13:47.679
<v Speaker 2>grock Penetrator.

270
00:13:47.720 --> 00:13:49.720
<v Speaker 1>All right, We'll do one more story before we take

271
00:13:49.759 --> 00:13:52.840
<v Speaker 1>a break. This is a good one. Fake Ledger Live

272
00:13:53.000 --> 00:13:56.879
<v Speaker 1>app on Apple Store linked to nine point five million

273
00:13:56.960 --> 00:14:01.519
<v Speaker 1>dollar crypto theft Apple the fake Ledger Live app on

274
00:14:01.559 --> 00:14:04.360
<v Speaker 1>its app store allowing scameras to steal nine and a

275
00:14:04.360 --> 00:14:07.399
<v Speaker 1>half million dollars from more than fifty users. Did you

276
00:14:07.440 --> 00:14:12.159
<v Speaker 1>install this app? Wasn't it just last week we talked

277
00:14:12.159 --> 00:14:15.159
<v Speaker 1>about an app that was in the app store that

278
00:14:15.399 --> 00:14:20.600
<v Speaker 1>got through the checks and balances and started messing people's up.

279
00:14:20.639 --> 00:14:22.360
<v Speaker 3>I mean, there's lots of ways to do that. We've

280
00:14:22.360 --> 00:14:26.559
<v Speaker 3>talked about it before, where you basically have a you know,

281
00:14:26.600 --> 00:14:29.879
<v Speaker 3>a legit application, and then you do a patch that

282
00:14:30.679 --> 00:14:33.240
<v Speaker 3>puts in the bad stuff. All right, so key, just

283
00:14:33.279 --> 00:14:36.840
<v Speaker 3>because it's in the you know, it's if you find

284
00:14:36.840 --> 00:14:38.840
<v Speaker 3>gum on the street, it doesn't mean it's free candy.

285
00:14:39.080 --> 00:14:42.639
<v Speaker 2>So yeah, so this was a wallet, a crypto wallet, yeah,

286
00:14:42.799 --> 00:14:47.600
<v Speaker 2>and it was purported to be like one of the

287
00:14:47.720 --> 00:14:52.480
<v Speaker 2>more well known wallets, although developed by somebody else. And

288
00:14:52.559 --> 00:14:57.440
<v Speaker 2>they stole nine point five million dollars from fifty people.

289
00:14:57.639 --> 00:14:59.840
<v Speaker 1>That's yeah. Those people have to have.

290
00:15:00.000 --> 00:15:01.759
<v Speaker 2>One hundred and ninety thousand dollars each.

291
00:15:02.000 --> 00:15:02.519
<v Speaker 1>That's a lot.

292
00:15:02.639 --> 00:15:05.559
<v Speaker 2>That's impressive in and of itself. So you're telling me

293
00:15:05.559 --> 00:15:08.559
<v Speaker 2>there's fifty people with two hundred grand in their crypto

294
00:15:08.600 --> 00:15:11.080
<v Speaker 2>wallets who jumped on top of this as quickly as

295
00:15:11.120 --> 00:15:14.320
<v Speaker 2>possible to throw money. It's just it's a weird story, man,

296
00:15:14.320 --> 00:15:16.240
<v Speaker 2>it's a weird story. It is a weird story. You

297
00:15:16.279 --> 00:15:21.159
<v Speaker 2>know's busy. I know he's giving me access to the penetrator,

298
00:15:22.600 --> 00:15:26.320
<v Speaker 2>you know. So it's I we always talk about and

299
00:15:26.360 --> 00:15:29.080
<v Speaker 2>I gave this advice to my kids and really anybody

300
00:15:29.080 --> 00:15:30.639
<v Speaker 2>who will listen to me talk. But when you go

301
00:15:30.679 --> 00:15:33.279
<v Speaker 2>to download an app on your phone, whether it's from

302
00:15:33.320 --> 00:15:35.519
<v Speaker 2>the Apple Store right, which you'd like to trust is

303
00:15:35.559 --> 00:15:37.320
<v Speaker 2>going to be safe for your you and your phone,

304
00:15:37.399 --> 00:15:39.799
<v Speaker 2>or whether it's you're on Android and it's the play store,

305
00:15:39.799 --> 00:15:43.879
<v Speaker 2>it doesn't matter. Do a little bit of research, right,

306
00:15:44.080 --> 00:15:45.919
<v Speaker 2>Like Patrick said, don't just pick up that gum and

307
00:15:45.960 --> 00:15:50.000
<v Speaker 2>eat it, Like, maybe see who the developer is actually.

308
00:15:50.000 --> 00:15:53.600
<v Speaker 3>I said that, Yeah, And it's what's interesting about.

309
00:15:53.399 --> 00:15:58.399
<v Speaker 1>It is care free Orday.

310
00:15:58.840 --> 00:16:05.600
<v Speaker 2>Bazookazoozuka, you should duck. Yes what I'm saying, Bazooka guns

311
00:16:05.639 --> 00:16:06.919
<v Speaker 2>good for about to choose.

312
00:16:07.120 --> 00:16:07.399
<v Speaker 1>That's it.

313
00:16:07.919 --> 00:16:10.120
<v Speaker 2>You don't want to you don't want out where you're

314
00:16:10.159 --> 00:16:13.279
<v Speaker 2>welcome with that chip of tooth. So you know, in

315
00:16:13.360 --> 00:16:15.399
<v Speaker 2>this particular case, I mean, they did a decent job,

316
00:16:15.639 --> 00:16:18.600
<v Speaker 2>right they There were a lot of reviews quote unquote

317
00:16:18.799 --> 00:16:20.799
<v Speaker 2>on using the app, and people were saying it was

318
00:16:20.840 --> 00:16:23.000
<v Speaker 2>great and blah blah blah whatever. Right, so you can't

319
00:16:23.039 --> 00:16:25.120
<v Speaker 2>really go off reviews. Hey, heads up, I mean if

320
00:16:25.159 --> 00:16:28.720
<v Speaker 2>you're listening to this podcast, you probably know this. A

321
00:16:28.799 --> 00:16:33.559
<v Speaker 2>lot of reviews are robots, like there's on Amazon on whatever.

322
00:16:33.840 --> 00:16:37.240
<v Speaker 2>It's like, you know, fifty eight bajillion five stars, like okay,

323
00:16:37.600 --> 00:16:38.879
<v Speaker 2>not really gonna.

324
00:16:38.679 --> 00:16:42.039
<v Speaker 1>Happen on dot neet rocks. We used to get multiple

325
00:16:42.159 --> 00:16:45.440
<v Speaker 1>emails saying, hey, I really love your podcasts and I'd

326
00:16:45.559 --> 00:16:48.399
<v Speaker 1>like to come on as a as a you know,

327
00:16:48.519 --> 00:16:51.519
<v Speaker 1>a guest and blah blah blah, and then you know,

328
00:16:51.639 --> 00:16:54.399
<v Speaker 1>and we totally ignore those things because we find the guests.

329
00:16:54.440 --> 00:16:58.080
<v Speaker 1>We don't need people soliciting us, right, And so now

330
00:16:58.240 --> 00:17:00.279
<v Speaker 1>what they do is they get an AI to go

331
00:17:00.399 --> 00:17:02.720
<v Speaker 1>and search through the RSS feed and they and it

332
00:17:02.840 --> 00:17:05.960
<v Speaker 1>comes up with a paragraph that's believable. It's like I

333
00:17:06.119 --> 00:17:08.400
<v Speaker 1>was listening to your episode on blah blah blah and

334
00:17:08.519 --> 00:17:11.279
<v Speaker 1>this and that episode ninety five when you guys really

335
00:17:11.400 --> 00:17:14.559
<v Speaker 1>had some good insights and especially and then they'll just

336
00:17:14.599 --> 00:17:18.039
<v Speaker 1>come up with some bs, right, you know about how

337
00:17:18.119 --> 00:17:21.759
<v Speaker 1>the juxtaposition between this these forces and yeah, yeah it

338
00:17:21.839 --> 00:17:24.480
<v Speaker 1>was really interesting, and I think you ought to have

339
00:17:24.759 --> 00:17:26.440
<v Speaker 1>this guy on your podcast, right.

340
00:17:26.519 --> 00:17:31.319
<v Speaker 2>It's just it's just shameless, Yeah, shameless, shameless without shame.

341
00:17:31.759 --> 00:17:35.920
<v Speaker 2>Get your own show, you know, stop bugging me. Yeah a,

342
00:17:36.160 --> 00:17:37.200
<v Speaker 2>I get your own show.

343
00:17:37.480 --> 00:17:40.480
<v Speaker 1>Yeah. Hey, I probably has its own show.

344
00:17:40.640 --> 00:17:48.000
<v Speaker 3>You know. I did never apologize for doing that, Carlo, All.

345
00:17:48.039 --> 00:17:50.000
<v Speaker 1>Right, so is there anything more to say about this

346
00:17:50.240 --> 00:17:52.200
<v Speaker 1>than it happened? And be careful and.

347
00:17:52.480 --> 00:17:54.519
<v Speaker 2>Just yeah, we always tell people to be careful about

348
00:17:54.559 --> 00:17:59.400
<v Speaker 2>what they download, like, don't trust reviews, really kind of

349
00:17:59.440 --> 00:18:02.160
<v Speaker 2>do the research. Take a look at the development site

350
00:18:02.200 --> 00:18:04.160
<v Speaker 2>and if you don't know, don't use it.

351
00:18:04.319 --> 00:18:04.559
<v Speaker 1>That's it.

352
00:18:04.640 --> 00:18:07.359
<v Speaker 2>At least don't transfer one hundred and ninety thousand dollars

353
00:18:07.440 --> 00:18:07.960
<v Speaker 2>in crypto.

354
00:18:08.160 --> 00:18:10.960
<v Speaker 3>Yeah, it's it's if you think it's butter but it's not,

355
00:18:11.359 --> 00:18:17.559
<v Speaker 3>don't eat it, right, Yeah, Unfortunately it is caveat. I'm there, buyer, Beware,

356
00:18:17.599 --> 00:18:22.039
<v Speaker 3>you have to figure out, like what's gout reputation. Look

357
00:18:22.119 --> 00:18:25.440
<v Speaker 3>at articles in you know, by actual journalists.

358
00:18:25.480 --> 00:18:28.039
<v Speaker 1>Look at top ten lists, brand names like you want to.

359
00:18:28.440 --> 00:18:30.640
<v Speaker 3>I don't think I would use a wallet.

360
00:18:30.799 --> 00:18:34.480
<v Speaker 1>You want to get the official app from the official vender. Yeah,

361
00:18:34.519 --> 00:18:37.039
<v Speaker 1>and sometimes it's hard to discern which one is that

362
00:18:37.319 --> 00:18:40.119
<v Speaker 1>that's true? Yeah, yeah, Usually they'll have a logo that

363
00:18:40.279 --> 00:18:43.000
<v Speaker 1>they say, or if you go to their trusted website

364
00:18:43.039 --> 00:18:46.400
<v Speaker 1>and there's a QR code, even better. All right, let's

365
00:18:46.440 --> 00:18:47.960
<v Speaker 1>take a break. This is a good time for that,

366
00:18:48.240 --> 00:18:51.839
<v Speaker 1>and we'll be right back after these very important messages

367
00:18:56.079 --> 00:18:58.440
<v Speaker 1>and we're back. It's security this week. I'm Carl, that's

368
00:18:58.480 --> 00:19:01.359
<v Speaker 1>Dwayne and Patrick, and we got a few more stories

369
00:19:01.440 --> 00:19:02.880
<v Speaker 1>for you before we wrap it up and call it

370
00:19:02.960 --> 00:19:06.880
<v Speaker 1>a week. The next one researchers hijack AI coding agents

371
00:19:07.079 --> 00:19:11.160
<v Speaker 1>and steal credentials. No way, this did not happen. What

372
00:19:11.720 --> 00:19:15.200
<v Speaker 1>this could not happen in twenty twenty six? Really, who

373
00:19:15.279 --> 00:19:18.400
<v Speaker 1>would allow it to happen? Oh my god? Yeah, all right,

374
00:19:18.440 --> 00:19:19.000
<v Speaker 1>what happened?

375
00:19:19.359 --> 00:19:21.079
<v Speaker 3>Just another version of the old stuff.

376
00:19:21.920 --> 00:19:24.839
<v Speaker 2>Yeah, whatever, I don't even know what to say about

377
00:19:24.839 --> 00:19:25.599
<v Speaker 2>these things, anyah.

378
00:19:25.599 --> 00:19:25.720
<v Speaker 1>I know.

379
00:19:26.240 --> 00:19:28.960
<v Speaker 3>Well, it's be honest, it's the same thing with just

380
00:19:29.079 --> 00:19:32.920
<v Speaker 3>a different factor. So basically they're using pull request titles

381
00:19:33.440 --> 00:19:37.000
<v Speaker 3>to sneak instructions in. And what I think, what I

382
00:19:37.039 --> 00:19:39.920
<v Speaker 3>think the AI should do is say instruction should only

383
00:19:40.039 --> 00:19:44.680
<v Speaker 3>be able to be given in these approved channels period.

384
00:19:45.319 --> 00:19:48.720
<v Speaker 3>But what's happened is they basically sneak in and oh,

385
00:19:48.799 --> 00:19:51.960
<v Speaker 3>by the way, also send a copy over here or whatever,

386
00:19:52.359 --> 00:19:53.920
<v Speaker 3>or give me the key or publish the key to

387
00:19:54.000 --> 00:19:59.319
<v Speaker 3>this location, right, and they're just sneaking in the the instructions.

388
00:19:59.599 --> 00:20:01.480
<v Speaker 1>Yeah, but here's what I don't know.

389
00:20:01.599 --> 00:20:05.000
<v Speaker 2>It just seems sloppy, like that you can prompt inject

390
00:20:05.799 --> 00:20:10.000
<v Speaker 2>in some sort of pull request pipeline, like you shouldn't

391
00:20:10.039 --> 00:20:13.960
<v Speaker 2>be giving instructions in some ways to the build manager.

392
00:20:13.960 --> 00:20:16.440
<v Speaker 2>I mean, I understand that that sometimes needs to be

393
00:20:16.519 --> 00:20:17.920
<v Speaker 2>done and that sort of stuff, but they just should

394
00:20:17.920 --> 00:20:19.799
<v Speaker 2>be betrails around.

395
00:20:19.559 --> 00:20:21.200
<v Speaker 1>It, and that should the PR.

396
00:20:21.279 --> 00:20:24.880
<v Speaker 3>Disabled by default for you to give a prompt or

397
00:20:24.960 --> 00:20:27.200
<v Speaker 3>refine a prompt, or add to a prompt in any

398
00:20:27.319 --> 00:20:31.319
<v Speaker 3>channel other than an official, safe approved channel.

399
00:20:31.400 --> 00:20:33.880
<v Speaker 1>And how about this, how about you know, GitHub or

400
00:20:33.920 --> 00:20:36.839
<v Speaker 1>whatever the repo was, how about you just filter out

401
00:20:36.880 --> 00:20:39.839
<v Speaker 1>all the stuff that's not text? Well, yeah, you know, hey,

402
00:20:40.000 --> 00:20:40.680
<v Speaker 1>there's an idea.

403
00:20:40.880 --> 00:20:42.920
<v Speaker 2>Yeah, yeah, I mean the only thing I can see

404
00:20:43.000 --> 00:20:45.880
<v Speaker 2>is sometimes and here again, I don't understand why you

405
00:20:45.960 --> 00:20:49.720
<v Speaker 2>would be reading through all of the texts and processing

406
00:20:49.799 --> 00:20:53.839
<v Speaker 2>it within LLM, you know, but either way, yeah, there

407
00:20:53.960 --> 00:20:55.319
<v Speaker 2>need to be more guardrails around it.

408
00:20:55.599 --> 00:20:56.319
<v Speaker 1>Yep, definitely.

409
00:20:56.480 --> 00:20:58.400
<v Speaker 2>But this is this is really I think it was

410
00:20:58.640 --> 00:21:02.559
<v Speaker 2>two or three weeks ago we had reported on compromising

411
00:21:02.680 --> 00:21:09.200
<v Speaker 2>GitHub repos using poll requests and using the build pipelines,

412
00:21:09.200 --> 00:21:12.319
<v Speaker 2>and that's where stuff this is a very similar thing

413
00:21:13.000 --> 00:21:14.079
<v Speaker 2>we're seeing happen as well.

414
00:21:14.720 --> 00:21:19.000
<v Speaker 1>Tighten it up, guys, All right, this isn't really a

415
00:21:19.079 --> 00:21:21.559
<v Speaker 1>security story, but maybe it is. I'm not sure. But

416
00:21:21.759 --> 00:21:23.960
<v Speaker 1>it was just something that got us talking. We were

417
00:21:23.960 --> 00:21:26.240
<v Speaker 1>going through all the stories then we got to this

418
00:21:26.359 --> 00:21:29.279
<v Speaker 1>one and it sparked a conversation and we were like,

419
00:21:29.319 --> 00:21:31.400
<v Speaker 1>do we really want to include this? And I'm like, well,

420
00:21:31.720 --> 00:21:34.160
<v Speaker 1>we're talking about it, Yeah, we're not talking about the

421
00:21:34.240 --> 00:21:34.680
<v Speaker 1>other ones.

422
00:21:34.880 --> 00:21:35.160
<v Speaker 3>Why not?

423
00:21:35.880 --> 00:21:41.599
<v Speaker 1>French government says au Revoir to Windows, will use Linux instead.

424
00:21:42.200 --> 00:21:45.880
<v Speaker 1>The French government has officially committed to replacing Microsoft Windows

425
00:21:46.440 --> 00:21:51.759
<v Speaker 1>with Linux across all government desktops, stepping up its efforts

426
00:21:51.839 --> 00:21:57.319
<v Speaker 1>to gain digital sovereignty. And so one of the big

427
00:21:57.440 --> 00:22:01.319
<v Speaker 1>takeaways here is the French National Police Force that replaced

428
00:22:01.319 --> 00:22:04.839
<v Speaker 1>Windows with a customized version of Ubuntu Linux saves two

429
00:22:05.039 --> 00:22:10.839
<v Speaker 1>million euros a year. And that was just the police force, right,

430
00:22:11.160 --> 00:22:15.799
<v Speaker 1>So they're they're they're replacing it across two point five

431
00:22:16.000 --> 00:22:19.880
<v Speaker 1>million civil servants desktops. They're going to say about.

432
00:22:19.640 --> 00:22:22.599
<v Speaker 3>You a lot of money, Yeah they are, but there's

433
00:22:22.640 --> 00:22:26.559
<v Speaker 3>gonna be I think it helps them with sovereignty for sure. Sure,

434
00:22:27.599 --> 00:22:32.319
<v Speaker 3>most users are familiar with Windows, and and something Dwayne

435
00:22:32.400 --> 00:22:35.880
<v Speaker 3>brought up when we had this discussion earlier is when

436
00:22:35.920 --> 00:22:40.079
<v Speaker 3>something goes wrong with Windows and you Google or AI

437
00:22:40.279 --> 00:22:43.480
<v Speaker 3>search to find a solution, if it says, oh, we

438
00:22:43.759 --> 00:22:47.839
<v Speaker 3>run these archaic commands, most people are kind of trained

439
00:22:47.880 --> 00:22:51.680
<v Speaker 3>to not do that. And we call that clickfix, where

440
00:22:51.960 --> 00:22:54.279
<v Speaker 3>you know somebody gives you commands that are actually back

441
00:22:54.279 --> 00:22:55.519
<v Speaker 3>for you. If if someone asked you to run a

442
00:22:55.559 --> 00:22:58.400
<v Speaker 3>PowerShell I'm quoting Dwayne again, if someone asked you to

443
00:22:58.759 --> 00:23:05.440
<v Speaker 3>run a powershelling, sounds really smart. Uh, brother is a

444
00:23:05.480 --> 00:23:06.359
<v Speaker 3>little smarter es.

445
00:23:07.240 --> 00:23:07.799
<v Speaker 1>So if you.

446
00:23:09.519 --> 00:23:11.720
<v Speaker 3>Most people are trained now to say, you know, that's

447
00:23:11.759 --> 00:23:13.519
<v Speaker 3>a little sketchy. I don't think I'll do that. You know,

448
00:23:13.599 --> 00:23:16.039
<v Speaker 3>it should be something where I can like open something

449
00:23:16.200 --> 00:23:19.200
<v Speaker 3>and click on something right, and they'll they'll be shells

450
00:23:19.519 --> 00:23:22.200
<v Speaker 3>and ways for people to run Linux. But I think

451
00:23:22.240 --> 00:23:24.640
<v Speaker 3>your average user is going to be lost, and I

452
00:23:24.720 --> 00:23:27.960
<v Speaker 3>think there's gonna there's gonna be either that money is

453
00:23:28.000 --> 00:23:31.680
<v Speaker 3>going to be spent in protecting protective systems to help

454
00:23:31.720 --> 00:23:34.119
<v Speaker 3>the users, or it's going to be lost in in

455
00:23:34.319 --> 00:23:37.640
<v Speaker 3>people making mistakes and getting fished. I don't know. I

456
00:23:38.119 --> 00:23:40.759
<v Speaker 3>don't have any I've heard a lot of anecdotes of

457
00:23:40.799 --> 00:23:43.400
<v Speaker 3>this over the years. Every couple of years, some organization,

458
00:23:43.599 --> 00:23:45.960
<v Speaker 3>some civil organization is saying, well, we're going to stop

459
00:23:46.000 --> 00:23:49.160
<v Speaker 3>doing some government and I haven't heard about it. I

460
00:23:49.240 --> 00:23:52.200
<v Speaker 3>think one of them backtracked and decided not to do it.

461
00:23:52.240 --> 00:23:54.599
<v Speaker 3>I think Meta been Munich or one of the others.

462
00:23:54.759 --> 00:23:57.000
<v Speaker 3>So if they if it's been successful. Great if it's

463
00:23:57.039 --> 00:23:58.279
<v Speaker 3>not well apparently has.

464
00:23:58.400 --> 00:24:01.240
<v Speaker 1>The police force has been using it and they haven't

465
00:24:01.279 --> 00:24:03.759
<v Speaker 1>had any problems. And you know, these are French police

466
00:24:03.839 --> 00:24:05.440
<v Speaker 1>officers we're talking about.

467
00:24:05.559 --> 00:24:06.640
<v Speaker 3>How long have they been using it.

468
00:24:06.720 --> 00:24:09.559
<v Speaker 1>We don't know, but it saves them, Okay, two million

469
00:24:09.640 --> 00:24:11.319
<v Speaker 1>years a year, so at least a year.

470
00:24:11.519 --> 00:24:17.440
<v Speaker 3>Okay, all right, I know, I worry about the unintended consequences.

471
00:24:17.799 --> 00:24:18.079
<v Speaker 1>Sure.

472
00:24:18.279 --> 00:24:21.119
<v Speaker 3>I hope they're doing training. I hope they're helping people understand.

473
00:24:21.359 --> 00:24:24.160
<v Speaker 3>I agree the differences here. It takes a lot for

474
00:24:24.240 --> 00:24:26.480
<v Speaker 3>people to understand that everything's a file.

475
00:24:26.640 --> 00:24:27.920
<v Speaker 1>In the right I know.

476
00:24:28.799 --> 00:24:31.319
<v Speaker 3>And maybe they'll distracted away so that they don't have

477
00:24:31.559 --> 00:24:32.599
<v Speaker 3>that experience.

478
00:24:32.920 --> 00:24:35.880
<v Speaker 1>Mac users, for the longest time didn't have the word

479
00:24:36.039 --> 00:24:39.519
<v Speaker 1>file in their vocabulary. You know, they didn't understand what

480
00:24:39.640 --> 00:24:41.440
<v Speaker 1>files were because they never had to deal with them.

481
00:24:41.559 --> 00:24:44.960
<v Speaker 1>They were just like documents and sheets.

482
00:24:45.079 --> 00:24:48.920
<v Speaker 2>And guys are adorable. Yeah, you only have one big

483
00:24:49.000 --> 00:24:54.480
<v Speaker 2>button on your mouth. You're the guy click like now,

484
00:24:54.559 --> 00:24:55.599
<v Speaker 2>come on, man st.

485
00:25:01.200 --> 00:25:01.319
<v Speaker 1>As.

486
00:25:01.359 --> 00:25:01.920
<v Speaker 2>You can tell the.

487
00:25:04.000 --> 00:25:07.200
<v Speaker 3>Big Mac user, Dwayne. Dwayne's a big mac us.

488
00:25:07.279 --> 00:25:10.519
<v Speaker 2>Yeah, you can tell I'm a big Mac user. The

489
00:25:10.599 --> 00:25:11.079
<v Speaker 2>hamber me.

490
00:25:11.279 --> 00:25:13.440
<v Speaker 1>I think Ubuntu is probably the cream of the crop

491
00:25:13.480 --> 00:25:15.960
<v Speaker 1>when it comes to desktop Linux, and I haven't used

492
00:25:16.000 --> 00:25:17.480
<v Speaker 1>it in a long time, but last time I looked

493
00:25:17.519 --> 00:25:19.240
<v Speaker 1>at it was really really cool.

494
00:25:19.559 --> 00:25:19.799
<v Speaker 2>It is.

495
00:25:20.160 --> 00:25:22.680
<v Speaker 3>Yeah, it is very good. I'm using it. I'm using

496
00:25:22.680 --> 00:25:24.720
<v Speaker 3>it for several systems. I use Windows in a lot

497
00:25:24.759 --> 00:25:27.319
<v Speaker 3>of systems too. But uh it, you know, it's pretty good.

498
00:25:27.319 --> 00:25:30.599
<v Speaker 3>But it's not as easy as Windows. And maybe that's

499
00:25:30.720 --> 00:25:32.519
<v Speaker 3>just a bias because I've used Windows so much.

500
00:25:32.839 --> 00:25:33.960
<v Speaker 2>Yeah, I mean I was going to.

501
00:25:33.960 --> 00:25:36.279
<v Speaker 1>Say, well, maybe it's not as convenient, but does that

502
00:25:36.400 --> 00:25:37.319
<v Speaker 1>mean it's more secure?

503
00:25:38.920 --> 00:25:39.319
<v Speaker 3>Probably not.

504
00:25:42.920 --> 00:25:44.480
<v Speaker 1>I just nade Patrick eat his words.

505
00:25:46.599 --> 00:25:49.920
<v Speaker 3>No, because I can make something, so I can make

506
00:25:50.200 --> 00:25:56.559
<v Speaker 3>a a security system so inconvenient that it's not used. Right. Sure,

507
00:25:56.839 --> 00:25:58.960
<v Speaker 3>So it gets down to that point where it's like

508
00:25:59.079 --> 00:26:01.759
<v Speaker 3>frustration sets in and people just do something that they

509
00:26:01.799 --> 00:26:02.319
<v Speaker 3>shouldn't do.

510
00:26:02.480 --> 00:26:05.000
<v Speaker 1>Does a BU do automatic updates? I mean that's the

511
00:26:05.039 --> 00:26:06.880
<v Speaker 1>biggest security issue that I can think of.

512
00:26:07.079 --> 00:26:10.200
<v Speaker 3>It does it, but you know it'll let you know, Hey,

513
00:26:10.400 --> 00:26:13.039
<v Speaker 3>you know you need to you need to do these updates.

514
00:26:12.680 --> 00:26:15.359
<v Speaker 1>And you know, so it doesn't have like Windows Update

515
00:26:15.400 --> 00:26:17.079
<v Speaker 1>where it just applies them and.

516
00:26:17.240 --> 00:26:20.119
<v Speaker 3>Not that I've seen. It may be something I can

517
00:26:20.200 --> 00:26:21.799
<v Speaker 3>set up with a crown job or something like that.

518
00:26:21.960 --> 00:26:23.799
<v Speaker 3>But I didn't see it out of the box.

519
00:26:23.920 --> 00:26:25.880
<v Speaker 2>You're talking about auto updates and a Buntu.

520
00:26:26.160 --> 00:26:28.680
<v Speaker 3>Yeah, yeah, it'll prompt you, but I don't know that

521
00:26:28.799 --> 00:26:30.079
<v Speaker 3>it'll do it without being prompted.

522
00:26:30.200 --> 00:26:32.839
<v Speaker 1>Yeah, but you don't have to drop to a bash file.

523
00:26:32.960 --> 00:26:34.559
<v Speaker 1>You don't have to drop to a Bash window and

524
00:26:34.640 --> 00:26:36.000
<v Speaker 1>do a pseudo or I mean you could.

525
00:26:36.319 --> 00:26:38.599
<v Speaker 2>You could sudo update and blah blah blah and you

526
00:26:38.680 --> 00:26:40.480
<v Speaker 2>know whatever if you wanted to. But they have an

527
00:26:40.480 --> 00:26:42.839
<v Speaker 2>app center. Yeah, there's an app center you can use

528
00:26:42.880 --> 00:26:44.720
<v Speaker 2>to and you can just update all hey. Yeah, but

529
00:26:44.839 --> 00:26:46.559
<v Speaker 2>no they had they they now have an auto update

530
00:26:46.640 --> 00:26:49.680
<v Speaker 2>or they're a real boy. Yeah, it's I can't imagine

531
00:26:49.680 --> 00:26:51.640
<v Speaker 2>they wouldn't you go right?

532
00:26:51.720 --> 00:26:52.079
<v Speaker 1>All right?

533
00:26:52.519 --> 00:26:53.200
<v Speaker 3>I wish them luck.

534
00:26:53.559 --> 00:26:54.039
<v Speaker 1>I wish them.

535
00:26:54.880 --> 00:26:57.400
<v Speaker 2>I hope this Linux thing takes off. Yeah, yeah, I

536
00:26:57.480 --> 00:26:58.079
<v Speaker 2>think it's fine.

537
00:26:58.200 --> 00:26:59.119
<v Speaker 1>I've heard it's pretty good.

538
00:26:59.119 --> 00:27:01.960
<v Speaker 3>Good luck boys, and I have fun storm in the castle.

539
00:27:03.200 --> 00:27:04.680
<v Speaker 2>Yeah, there's there's definitely an update.

540
00:27:04.759 --> 00:27:06.759
<v Speaker 1>Hey. Well, and they're gonna you know, they're gonna have

541
00:27:06.839 --> 00:27:09.160
<v Speaker 1>a lot of extra money to buy armor for a

542
00:27:09.240 --> 00:27:13.640
<v Speaker 1>storm in the castle. So all right, So here's the

543
00:27:14.000 --> 00:27:17.680
<v Speaker 1>top story. This week, a ten dollars domain could have

544
00:27:17.799 --> 00:27:22.880
<v Speaker 1>handed hackers twenty five thousand end points, including in OT

545
00:27:23.160 --> 00:27:27.839
<v Speaker 1>and government networks. So this I don't know could have

546
00:27:28.279 --> 00:27:29.039
<v Speaker 1>I thought it did.

547
00:27:30.880 --> 00:27:36.759
<v Speaker 2>What happened to me, that's a that's a good point. Yes, this, Yes,

548
00:27:37.400 --> 00:27:39.359
<v Speaker 2>So what happened was there was a piece of software

549
00:27:40.599 --> 00:27:44.279
<v Speaker 2>that was uh says it was used to help with

550
00:27:44.400 --> 00:27:47.880
<v Speaker 2>search engine optimization, and it was signed. I think it

551
00:27:48.000 --> 00:27:51.039
<v Speaker 2>was signed by a company called dragon Boss. The dragon

552
00:27:51.480 --> 00:27:54.200
<v Speaker 2>this is a company that's super reputable stuff.

553
00:27:54.839 --> 00:27:57.200
<v Speaker 1>They went out of his favorite Saturday Morning cartoon by the.

554
00:27:57.200 --> 00:27:59.119
<v Speaker 3>Way, dragon boss Z.

555
00:28:00.720 --> 00:28:04.799
<v Speaker 2>Yeah. Anyway, so you know lots of companies, Fortune five hundred's,

556
00:28:05.799 --> 00:28:08.799
<v Speaker 2>there's utility companies that sort of stuff. They were using it, right.

557
00:28:09.000 --> 00:28:11.119
<v Speaker 2>I don't know why as a utility company you need

558
00:28:11.200 --> 00:28:15.599
<v Speaker 2>a search engine optimization tool, right. It was also one

559
00:28:15.640 --> 00:28:19.039
<v Speaker 2>of those sketchy pieces of software, like those adware pieces

560
00:28:19.079 --> 00:28:20.799
<v Speaker 2>of software, where like, yeah, we'll give it to you

561
00:28:20.880 --> 00:28:23.200
<v Speaker 2>for free, but we're going to throw ads up. So

562
00:28:23.279 --> 00:28:25.799
<v Speaker 2>it was mildly obnoxious and bypassed a lot of pop

563
00:28:25.880 --> 00:28:27.960
<v Speaker 2>up rules and all sorts of other things. Well, needless

564
00:28:28.079 --> 00:28:30.400
<v Speaker 2>to say, it's switched over to more nefarious things. Later

565
00:28:30.480 --> 00:28:33.759
<v Speaker 2>on where they were pushing down a PowerShell script that

566
00:28:33.799 --> 00:28:36.960
<v Speaker 2>would shut down the firewall, would call back to command

567
00:28:36.960 --> 00:28:39.920
<v Speaker 2>and control structure, that sort of stuff. So yeah, absolutely right, Carl,

568
00:28:40.039 --> 00:28:45.839
<v Speaker 2>Like these systems were compromised. But security researchers, once they

569
00:28:45.920 --> 00:28:48.440
<v Speaker 2>started digging in, found out of of all of the

570
00:28:48.559 --> 00:28:51.319
<v Speaker 2>domains that it would call back to, because it would

571
00:28:51.359 --> 00:28:53.799
<v Speaker 2>call back to its its command and control it's C

572
00:28:53.920 --> 00:28:56.720
<v Speaker 2>two structure, of all the domains it would call back

573
00:28:56.759 --> 00:29:01.000
<v Speaker 2>to you, there was one that was not registered. So

574
00:29:01.200 --> 00:29:05.200
<v Speaker 2>the hackers whoever put the malicious code in, let's say,

575
00:29:05.559 --> 00:29:07.640
<v Speaker 2>they put twenty domains in there just in case one

576
00:29:07.680 --> 00:29:10.920
<v Speaker 2>got burnt, but they didn't actually register all twenty domains.

577
00:29:10.960 --> 00:29:13.000
<v Speaker 2>So when the researchers went and looked, one of the

578
00:29:13.079 --> 00:29:16.480
<v Speaker 2>domains that wasn't registered was only ten dollars. Wow, And

579
00:29:16.519 --> 00:29:18.839
<v Speaker 2>they're like, you know what, let's register it. So they did,

580
00:29:19.160 --> 00:29:22.240
<v Speaker 2>and then they started listening. Right when they started listening,

581
00:29:22.359 --> 00:29:25.480
<v Speaker 2>and they found twenty five thousand people reaching back saying

582
00:29:25.480 --> 00:29:26.079
<v Speaker 2>what do you want me to do?

583
00:29:26.200 --> 00:29:26.440
<v Speaker 1>Boss?

584
00:29:27.240 --> 00:29:29.240
<v Speaker 2>And they were like, hmmm, that's not good.

585
00:29:29.200 --> 00:29:32.000
<v Speaker 1>By people, you mean instances of the application.

586
00:29:32.240 --> 00:29:34.559
<v Speaker 3>Now, this also teaches a lesson like let's say you

587
00:29:34.680 --> 00:29:38.720
<v Speaker 3>had a company and you conducted business and then you

588
00:29:38.839 --> 00:29:41.359
<v Speaker 3>decided to change the company name and you let the domain,

589
00:29:41.440 --> 00:29:45.559
<v Speaker 3>the old domain go, right, Yeah, if you still have

590
00:29:45.880 --> 00:29:50.480
<v Speaker 3>accounts that maybe went dormant on that, if I bought

591
00:29:50.559 --> 00:29:54.359
<v Speaker 3>that domain, I can try to do a password reset

592
00:29:55.000 --> 00:29:57.559
<v Speaker 3>and I might be able to wake up that credential.

593
00:29:57.640 --> 00:30:00.720
<v Speaker 3>Now it might be lapsed, It might not cost anything,

594
00:30:01.079 --> 00:30:04.279
<v Speaker 3>but now I can represent who you were. And even

595
00:30:04.319 --> 00:30:06.400
<v Speaker 3>if it doesn't injure you, it could injure the people

596
00:30:06.400 --> 00:30:08.400
<v Speaker 3>who've done business with you, who didn't know that you

597
00:30:08.599 --> 00:30:11.960
<v Speaker 3>changed your name, who didn't know that you you did

598
00:30:12.039 --> 00:30:12.839
<v Speaker 3>these things, and so.

599
00:30:13.039 --> 00:30:14.960
<v Speaker 1>Well, I'm thinking more like you have software out in

600
00:30:15.000 --> 00:30:18.359
<v Speaker 1>the wild that's making calls to these things, like that's actually.

601
00:30:18.200 --> 00:30:20.440
<v Speaker 3>What this story is about. But there's also these other

602
00:30:21.200 --> 00:30:24.079
<v Speaker 3>it's it's always you always have to look at when

603
00:30:24.079 --> 00:30:27.119
<v Speaker 3>you let a domain go, what's what are you also

604
00:30:27.240 --> 00:30:29.720
<v Speaker 3>letting go? What is also attached to that? What could

605
00:30:29.839 --> 00:30:34.720
<v Speaker 3>a nefarious actor like Dwayne if they had that domain,

606
00:30:35.359 --> 00:30:38.000
<v Speaker 3>what chaos could they cause? What could they do? Right?

607
00:30:38.480 --> 00:30:40.400
<v Speaker 3>And that has to be part of the metric of

608
00:30:40.799 --> 00:30:43.039
<v Speaker 3>whether you keep the domain or not, or you have

609
00:30:43.160 --> 00:30:45.640
<v Speaker 3>to close down those problems in order to get rid

610
00:30:45.680 --> 00:30:46.599
<v Speaker 3>of the domain response.

611
00:30:46.799 --> 00:30:48.200
<v Speaker 1>It's only ten dollars a year.

612
00:30:48.720 --> 00:30:50.839
<v Speaker 3>Just yeah, but if you got a lot of domains,

613
00:30:51.039 --> 00:30:52.240
<v Speaker 3>you know a lot of people no.

614
00:30:52.319 --> 00:30:54.519
<v Speaker 1>No, no, I know that, but you know, if they

615
00:30:54.640 --> 00:30:57.240
<v Speaker 1>you know, you're sitting around in a boardroom talking about

616
00:30:57.279 --> 00:30:59.319
<v Speaker 1>should we keep those domain it's kind of you know,

617
00:30:59.440 --> 00:31:01.319
<v Speaker 1>it's being you in the world and blah blah blah.

618
00:31:01.359 --> 00:31:04.119
<v Speaker 1>It's ten bucks les you should keep it.

619
00:31:04.359 --> 00:31:06.400
<v Speaker 3>But it also could just be that somebody didn't know

620
00:31:06.519 --> 00:31:10.720
<v Speaker 3>what domain company it was registered with and they didn't

621
00:31:10.759 --> 00:31:14.079
<v Speaker 3>get the emails anymore. Because so you got to keep

622
00:31:14.440 --> 00:31:17.839
<v Speaker 3>inventory and audit is a big thing that nobody thinks

623
00:31:17.839 --> 00:31:21.799
<v Speaker 3>about as part of security. It's important for encryption, it's

624
00:31:21.839 --> 00:31:24.640
<v Speaker 3>important for s bomb, it's important for everything, right, and

625
00:31:25.079 --> 00:31:26.920
<v Speaker 3>it's something that it takes a lot of time and

626
00:31:27.039 --> 00:31:28.599
<v Speaker 3>energy and it's boring, right.

627
00:31:28.759 --> 00:31:30.640
<v Speaker 2>Yeah. I think in the age of AI will start

628
00:31:30.680 --> 00:31:32.839
<v Speaker 2>to see more and more agents will do this in

629
00:31:32.920 --> 00:31:36.400
<v Speaker 2>an automated way. So yeah, fingers crossed.

630
00:31:36.960 --> 00:31:41.039
<v Speaker 3>Yeah, was it dangerous, repetitive and boring? Yeah, those are

631
00:31:41.039 --> 00:31:43.440
<v Speaker 3>the things that we'll see AI and robotics.

632
00:31:43.720 --> 00:31:45.240
<v Speaker 1>Those are my nicknames in high school.

633
00:31:47.240 --> 00:31:50.640
<v Speaker 2>Dangerous repetitive and boring, exactly nice.

634
00:31:51.200 --> 00:31:54.720
<v Speaker 1>Good for you. All right. Well is that it, guys

635
00:31:55.640 --> 00:31:58.039
<v Speaker 1>for this week. That's a show. So that's all that

636
00:31:58.119 --> 00:32:00.279
<v Speaker 1>happened last week, and we'll talk about what happened spends

637
00:32:00.359 --> 00:32:03.160
<v Speaker 1>next week on security this week, Bye bye weeks.

638
00:32:03.559 --> 00:32:04.400
<v Speaker 3>Thanks God.