Speaker 1: Hey, Carl. Here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes,
Speaker 1: Spotify or wherever you get Security this Week. Also, you
Speaker 1: can get an ad free feed by becoming a five
Speaker 1: dollars a month patron. Go to Patreon dot Security this
Speaker 1: week dot com and sign up, and don't forget Discord.
Speaker 1: Discord dot Security this week dot com. Lots of good
Speaker 1: stuff happening there. Yeah, I think that's it. So on
Speaker 1: with the podcast. Hey, did you guys know that I
Speaker 1: took a workshop with Melbrooks?
Speaker 2: No?
Speaker 1: Yeah, comedy workshop. How do you think we got all
Speaker 1: those Monday's episodes? No? Basically I was sitting down with
Speaker 1: Melbrooks and he told me the secret to comedy. Yeah,
Speaker 1: Dwayne asked me, what's the secret to comic? Go ahead?
Speaker 3: Yeah, absolutely, what's the what's the secret timing? I don't
Speaker 3: get it?
Speaker 2: He that is Carl.
Speaker 1: Okay, we got a lot of stuff to get through
Speaker 1: today on Security This Week, I'm Carl Franklin, It's Dwayne
Speaker 1: Leflotte and Patrick Hines. Let's start with identity crisis, novel
Speaker 1: vulnerabilities leading to Kerberos downgrade, DOS, denial of service, and
Speaker 1: full domain takeover. This one's awesome.
Speaker 2: So this is the new new thing that's happening. We're
Speaker 2: going to talk a lot about the identity as a place,
Speaker 2: that place that gets attacked, and because that's the place
Speaker 2: that matters the most, we implemented two factor authentication because
Speaker 2: passwords weren't strong enough. Regular authentication was falling down. So
Speaker 2: now this is the logical place where the hackers have
Speaker 2: to attack, because otherwise what are they going to do,
Speaker 2: like just consider things secure?
Speaker 1: Yeah, once they have your identity, it's game over.
Speaker 2: Yeah, because now they can they can log in, right.
Speaker 1: This one's so good though. So good.
Speaker 2: Directory is something that we've kind of moved away whatnot,
Speaker 2: kind of dramatically moved away from, and many clients moved
Speaker 2: away from active directory is great, but it makes things convenient,
Speaker 2: so which is really a problem.
Speaker 3: Yeah, I hear what you're saying, but from a corporate standpoint,
Speaker 3: one hundred percent of the companies out there aren't moving
Speaker 3: away from active directory. They're just not doing it. It's
Speaker 3: too much of a pain in the ass. Normal users
Speaker 3: aren't gonna understand how to Well, I get to log
Speaker 3: into my local box with a user and passer that's
Speaker 3: not used anywhere else and has access to nothing, and
Speaker 3: then every resource I need to access, I'm gonna use
Speaker 3: some sort of password management. Like nobody's gonna do it, right,
Speaker 3: She's not gonna happen, right, And there are all sorts
Speaker 3: of other ways you can do. You can implement things
Speaker 3: like zero trust.
Speaker 1: Yeah, I was gonna say, Dane, what is the answer
Speaker 1: to shoring up active directory in the cloud for these companies.
Speaker 3: Should have been built better? Maybe I don't know. I mean,
Speaker 3: the problem is it's it's very active directory. Is a
Speaker 3: Patrick trite is convenient, right, but it's it's also been
Speaker 3: around longer than I don't know, twenty five thirty years,
Speaker 3: well before just before it was stolen from Novelle and
Speaker 3: Microsoft Ticket so so anyways, it's been around a long time.
Speaker 3: So the problem with that is you keep just adding
Speaker 3: on to it and adding on to it and adding
Speaker 3: on to it and adding on to it, and there's
Speaker 3: so much technical debt in there. But unfortunately, you know,
Speaker 3: thirty years of companies are now built on top of it,
Speaker 3: so you can't just rip it out.
Speaker 2: I mean it's it's literally single sign on, which we've
Speaker 2: decided is a bad thing. Single sign on is not
Speaker 2: a good thing. We need zero trust. Do you see
Speaker 2: active directory participating in zero trust? Now? It's the athenma
Speaker 2: to it, isn't it?
Speaker 1: With all these AI tools, couldn't Microsoft just whip up
Speaker 1: its genie AI guys and say, hey, we want you
Speaker 1: to rebuild active directory from the bottom up, using the
Speaker 1: same interface to the customer, but make it more secure
Speaker 1: and take out all the baroque bs that we don't
Speaker 1: need anymore.
Speaker 3: Sure, yeah, I think you could. I think you could.
Speaker 3: I think it takes time. I don't know. I don't
Speaker 3: know that anybody would trust, you know, vibe code up
Speaker 3: active directory yet.
Speaker 1: Well no, I don't mean vibe coding, I mean assisted coding.
Speaker 3: I could see that. I could see that. But this so,
Speaker 3: this particular case, the way that this was exploited, Right,
Speaker 3: we talked about denial of service and all sorts of
Speaker 3: other things. The way this is exploited is you have
Speaker 3: service principal names in active directory, and those SPNs you know,
Speaker 3: give you access to resources and all sorts of weird stuff, right,
Speaker 3: and they're supposed to be unique, right, it'd be weird
Speaker 3: if my account resolved to my account and Patrick's account
Speaker 3: at the same time. And what a researcher found is
Speaker 3: there's I'd have to look back at the article to
Speaker 3: see the number of it's like three hundred and eighty
Speaker 3: two unprincipal Unicode characters. They're just they're just they look
Speaker 3: like spaces. And of those, there's like one hundred and
Speaker 3: twenty six of them that active directory visa vl tapp
Speaker 3: doesn't actually recognize but are uniquely different characters.
Speaker 1: But some of them they do.
Speaker 3: So I can take Patrick's account and I can add
Speaker 3: one of these characters at the end, and an active
Speaker 3: director will go, yeah, this is a unique object. But
Speaker 3: then when it goes to verify, right, oh, does Dwayne
Speaker 3: have access to this account? It goes, well, I got
Speaker 3: two users here, er uh, and then denial of service
Speaker 3: happens because I was able to make my you know,
Speaker 3: for lack of a better term, my unique identifier in
Speaker 3: active directory look exactly like Patrick's for the filtering it
Speaker 3: uses for certain functions. Wow, so this is it's a
Speaker 3: it is a novel attack. There's three different attacks, and
Speaker 3: here one of them is a denial of service. One
Speaker 3: of them is a pre vesque, uh, where you can
Speaker 3: just yeah, you can jump straight to DA. And that's
Speaker 3: what we're usually looking for, is right, can you get
Speaker 3: to DA and how quickly can you get there? So this,
Speaker 3: this is an interesting find, honestly, this this I really
Speaker 3: love these clever kind of finds.
Speaker 1: There.
Speaker 3: There was a while back actually print Nightmare was one
Speaker 3: of the ones that was just a really kind of
Speaker 3: interesting cleverifying right. There was another one in the past
Speaker 3: where any any domain user could go and add five
Speaker 3: computers for some random reason to active directory and there
Speaker 3: was all sorts of ways to manipulate that that so
Speaker 3: there's a lot of cool exploits that can go give
Speaker 3: you privileged escalation or denial a service or something along
Speaker 3: those lines. And this, this actually is really kind of unique.
Speaker 3: It's not being seen in the wild right now. This
Speaker 3: this researcher obviously, you know, announced it to Microsoft. Microsoft
Speaker 3: has patched it, so if you're running the latest patches
Speaker 3: on Microsoft, you are good here. But yeah, no, it's kudos.
Speaker 3: That's a that's a good find.
Speaker 2: And this is a little bit of a precursor some
Speaker 2: other things we're going to talk about Oh.
Speaker 1: Yeah, yeah. So if identity is the biggest target, Hacker
Speaker 1: News says device cod fishing is the fastest growing threat
Speaker 1: of twenty twenty six. And here are six reasons why.
Speaker 1: Device code phishing, device code and so is that like
Speaker 1: when you know you're using two FA and somebody sends
Speaker 1: a text to you with a code that you have
Speaker 1: to enter that kind of phishing?
Speaker 3: Uh yeah, absolutely, yeah, it's uh and it's it's uh,
Speaker 3: you know you what, We've all done this, right, yeah,
Speaker 3: And we talked about this, i think last week because
Speaker 3: there was another device fishing sort of token based attack
Speaker 3: we were talking about. You go to Netflix on your
Speaker 3: TV and it says, hey, do you want to log
Speaker 3: in with your username and really long password because hopefully
Speaker 3: you're using a password manager m M. You go, nah,
Speaker 3: I don't want to do that, and it goes okay, cool.
Speaker 3: Then just log in on your laptop or on your
Speaker 3: phone and type this code in right to Netflix. You go, okay, cool, Right,
Speaker 3: and you go to you go to Netflix and you
Speaker 3: go to the slash ad device or whatever it is,
Speaker 3: and you type in the code right, And what you've
Speaker 3: just done is you have authorized the TV to gain
Speaker 3: access to your account, right, right, So you've passed the
Speaker 3: authentication stage. You've already authenticated. I used my username and
Speaker 3: password on my phone, I used my multi factor authentication I.
Speaker 2: Used and you goun to bridge it to this other device, I.
Speaker 3: Used my my you know, secure keys, whatever. And once
Speaker 3: I got access to whatever that device is, whatever that
Speaker 3: service is, I then gave another device access by just
Speaker 3: typing in six little, six little digits.
Speaker 1: Yeah, I mean, I get it.
Speaker 2: This isn't quite as bad, but it's it's kind of
Speaker 2: like the later evolution of you go over to your
Speaker 2: router and you hit a button and there's a four
Speaker 2: digit number that you can enter and join your Wi Fi.
Speaker 1: Right.
Speaker 2: Well, hackers love that because it dramatically weakens the security
Speaker 2: of having to provide the Wi Fi password. Yeah, and
Speaker 2: in this case, like in the Wi Fi situation, WPS
Speaker 2: like we may brute force that, right, there's only so
Speaker 2: many codes in this particular case, you don't even need
Speaker 2: to brute force it. All you need to do is
Speaker 2: con somebody into taking those you know, six little DIDs
Speaker 2: and typing it into the account. And what's super interesting
Speaker 2: is when these attacks are executed against you know, mirror
Speaker 2: mortals right, who aren't like digging into Well, I wasn't.
Speaker 3: Actually logging in. Why would I ever type this code in?
Speaker 1: Whatever it is?
Speaker 3: But at the social engineering level, when you click on
Speaker 3: the link in an email that comes in or a
Speaker 3: tax that comes in, or whatever, the website you go
Speaker 3: to is legitimately Microsoft or legitimately Google or legitimately Netflix
Speaker 3: or whatever it is. So your password manager is not
Speaker 3: going to flag it. It's not going to say, oh,
Speaker 3: I shouldn't type in the username password here because you
Speaker 3: are at Microsoft.
Speaker 2: But if I go, if I send a message to
Speaker 2: somebody who's not on guard, who's not savvy to what's
Speaker 2: going on, and I say, oh, you know, your Netflix
Speaker 2: is coming up for a review and we'd like to
Speaker 2: give you a deeper discount. Sure, can you validate that
Speaker 2: you're still using this account? Here? Go log in and
Speaker 2: use these six characters to validate it.
Speaker 3: And then you redirect them and then you give them
Speaker 3: the link that brings them straight to like Netflix dot com,
Speaker 3: slash you know, TV or whatever link I think is that,
Speaker 3: or TV or whatever, and they go, okay, cool, click
Speaker 3: on it, and then they do the log in thing
Speaker 3: and then they just type in the code and click okay, right,
Speaker 3: and it will say we've added a device to your account.
Speaker 3: But most people aren't even reading that deeply. So and
Speaker 3: a lot of times what will happen is on the
Speaker 3: back end, the attackers have automated systems waiting for access,
Speaker 3: and the moment you give them access, they run. It starts,
Speaker 3: It starts adding different devices, it starts pulling down in
Speaker 3: from it. I mean, faster than you can deny access
Speaker 3: to that account.
Speaker 2: Well, and most people don't know how to deny it.
Speaker 1: Apparently. This is number one is it defeats every form
Speaker 1: of MFA, including passkeys. But number two in this article
Speaker 1: is that the fast ecosystem has fully industrialized it. In
Speaker 1: other words, it's it's standard practice.
Speaker 3: Now oh yeah, yeah yeah, and for you convenient. The
Speaker 3: fast ecosystem, by the way, is the fishing as service,
Speaker 3: So you know there are a lot of frameworks. Heck,
Speaker 3: there's a lot of services out there. I used to
Speaker 3: talk about this, especially on lectures I'd give where I'd
Speaker 3: say hacking is now commercialized.
Speaker 2: Shouldn't it be pass per fishing fishing?
Speaker 3: Well, I mean, if you're gonna go with it as
Speaker 3: PHAs So here from ban Bam so hacking is definitely commercialized.
Speaker 3: It's definitely you can pay to get ransomware created, you
Speaker 3: can pay to have it deployed, you can pay to
Speaker 3: have a troubleshoot, you can pay to have somebody answer
Speaker 3: the phone when Grandma calls to send bitcoin, et cetera.
Speaker 1: And reading this article, which we linked here in Hacker News,
Speaker 1: I find it most disturbing. And I'm just guessing I'm
Speaker 1: inferring from what I see on this page that if
Speaker 1: you get fished like this, not only will it turn
Speaker 1: all of your guitars from right handed to left handed,
Speaker 1: but it will put a soft rectangular red eye patch
Speaker 1: floating eye patch on your head with a little white
Speaker 1: arrow on it.
Speaker 3: It's definitely definitely. That's yeah, that's fair.
Speaker 2: So I will ask that we change our order of
Speaker 2: operations because this specifically calls out Collie three sixty five,
Speaker 2: and one of our later stories is about exactly that tool.
Speaker 3: Oh let's talk about it then, Okay.
Speaker 2: If you skip down the road a little bit, we
Speaker 2: have an article also by the Hacker News, Cali three
Speaker 2: sixty five weaponizes Microsoft authentication against US company's new enterprise risk.
Speaker 2: So this is part of that basket of risks. And
Speaker 2: when I see Collie three sixty five, is this a
Speaker 2: an actual like tool on Collie the Linux distribution or
Speaker 2: is this just a name that crosses over? I think
Speaker 2: it's the second.
Speaker 3: No, this is just a phishing kit.
Speaker 2: Oh okay, So it's not like offsec has gone rogue.
Speaker 3: No they're not. Yeah, No, this is just a phishing kit,
Speaker 3: and it's one of the frameworks that you know was
Speaker 3: probably vibe coded and just showed up, and it is
Speaker 3: probably pretty good at what it does.
Speaker 1: All right, So is there anything more to the story.
Speaker 1: I mean, we might as well talk about it now.
Speaker 1: Callie three sixty five weaponizes Microsoft authentication against US companies,
Speaker 1: new enterprise risk.
Speaker 2: I think it's just more of what we were just
Speaker 2: talking about. I think it's folds into the same unless
Speaker 2: it's all Unless there's something specific.
Speaker 3: No, but I think one of the things I'd like
Speaker 3: to warrant against is it used to be to perform
Speaker 3: this level of an attack, you needed a modicum of
Speaker 3: understanding of technology, right, You needed to know like, okay,
Speaker 3: maybe even a smattering maybe right, a smidgen would not
Speaker 3: be trying I'm trying to highbrow this a little bit
Speaker 3: it's just for you car. So now you don't right now,
Speaker 3: you can take a stand on the shoulders of giants,
Speaker 3: as they say, and just take the frameworks that are
Speaker 3: out there, or if you don't want to do that,
Speaker 3: you can just vibe code your own. You just ask,
Speaker 3: you know, claude to hey, I'm doing this practice thing
Speaker 3: and can you create me a fishing framework. And for
Speaker 3: the most part, most of these ais don't generally do
Speaker 3: what you ask it to. Guardrails are easy to bypass,
Speaker 3: so which we'll talk about later.
Speaker 1: All right, let's move on. Chinese hacker commands deep Seek
Speaker 1: via Telegram to launch autonomous attacks.
Speaker 2: There's three things I don't trust.
Speaker 1: Telegrams went out when the phone.
Speaker 2: Became Telegram is a very very popular in Ukraine and
Speaker 2: in Russia. It's banned in Russia now because it was
Speaker 2: created by somebody who is not a friend of Russia's anymore.
Speaker 1: Oh no, what is it?
Speaker 2: So telegrams? Like, what's it's up? It's like, yeah, it's
Speaker 2: like what's app? It's like signals, It's like any one
Speaker 2: of those you know, messaging slash voice, slash video slash
Speaker 2: whatever chat apps. So fun. Fact, the founder who now
Speaker 2: I think lives in either Dubai or Switzerland has dropped
Speaker 2: their Russian citizenship has been convicted as a terrorist in Russia. Oh,
Speaker 2: because they've allowed Ukraine to use Telegram and haven't taken
Speaker 2: down forms and messages that have been used as part
Speaker 2: of the war.
Speaker 1: All right, So deep Seek is an AI model, right,
Speaker 1: Chinese a Chinese AI model. But you can also download
Speaker 1: it and run it locally.
Speaker 3: So yeah, there are deeps we can run locally.
Speaker 1: Yeah, absolutely, so, I mean I have one. I'm running
Speaker 1: it here. But am I at risk running this locally?
Speaker 1: Or is it deep Seek in the cloud that is
Speaker 1: susceptible to this attack?
Speaker 2: No?
Speaker 3: This is think of this in a different way. This
Speaker 3: is a Chinese attacker leveraging Telegram as a command and
Speaker 3: control to control a deep Seek instance to go out
Speaker 3: and do attacking. Okay, so it will go out, and
Speaker 3: it will go out and do all of the reconnaissance
Speaker 3: on hundreds of companies and it can it'll come back
Speaker 3: and say, hey, I found these companies that we can exploit.
Speaker 3: And we've seen this type of a report probably and
Speaker 3: I think it was September last year where China was
Speaker 3: using an anthropic model to break into organizations, and they
Speaker 3: had created this harness where they could say, hey, here's
Speaker 3: the you know, go out and grab the top one
Speaker 3: hundred US companies and and and start profiling them and
Speaker 3: see what their exploits are. So Palo Alto's Unit forty
Speaker 3: two said, hey, we're actually detecting this this attacker who's
Speaker 3: leveraging telegram to communicate with a deep seek. And then
Speaker 3: that deep Seek is actually using Hermes to do things.
Speaker 3: For those of you who haven't played around with AI
Speaker 3: local agents, Hermes. Hermes is actually by a French organization
Speaker 3: if I remember correctly, but Hermes.
Speaker 1: Is pronounced in French.
Speaker 3: I'm not even gonna try.
Speaker 2: They'll revote.
Speaker 3: I can't do it. I can't do it. Ohmy Hermes,
Speaker 3: it's yeah. Anyways, So, needless to say, you all heard
Speaker 3: of open Claw, right, which was one of the first
Speaker 3: agents that really kind of got a lot of hype around.
Speaker 3: It would leverage llms and it could do stuff right hands, Yeah, exactly,
Speaker 3: that's a.
Speaker 1: Great question harness.
Speaker 3: Yeah, so, and Hermes is one of them.
Speaker 2: Let me take that one real quick. So, so you
Speaker 2: have the model, which is the l M at the
Speaker 2: heart of this thing, and there's been a lot of
Speaker 2: hype about oh, GPT, this GPT, that claude this, claude
Speaker 2: that the model is the prediction engine that says, based
Speaker 2: on this, this is the next word, right, and then
Speaker 2: that's the next word, and that's next word.
Speaker 1: Yeah, and it's stateless and done.
Speaker 2: We've been using harnesses since we moved off of chat
Speaker 2: and into agentic AI, and the harness is the thing
Speaker 2: that controls the loops and the pointing and the tool
Speaker 2: use in all the memory and all that, all the things,
Speaker 2: all the things like memory that make it useful outside
Speaker 2: of answering questions about Wagner and composing odes to grilled
Speaker 2: cheese sandwiches.
Speaker 1: Don't have any idea what you're talking about. He's just
Speaker 1: making stuff, Wagner, you.
Speaker 2: Know what sandwiches? That okay? Anyway, So the thing is,
Speaker 2: in the last round we've gotten diminishing returns on the model,
Speaker 2: and so that the hyperscalers and the open weight companies
Speaker 2: have been competing on the harness and it's indistinguishable to
Speaker 2: most people because they don't see the difference, but the
Speaker 2: model can get.
Speaker 1: That's where the innovation is going on, is exactly.
Speaker 2: And they're finding that just change the same model with
Speaker 2: a different harness can make a twenty different point swing
Speaker 2: on some of these these standards that they're measuring against.
Speaker 2: And of course all these ais are testing against their
Speaker 2: training for the test. They're trying to make them better
Speaker 2: at the test. But if you find that the AI
Speaker 2: that you're using agentically uses tools well, answers questions correctly,
Speaker 2: doesn't hallucinate so much, you know, can can correct itself,
Speaker 2: then it's the harness that's really making the big difference,
Speaker 2: and that's where the competition is. Now. One other thing
Speaker 2: I want to say here is Deep Seek and all
Speaker 2: these open weight models and open weight models. When you
Speaker 2: can download and run on your own stuff. You can't
Speaker 2: download mythos and run it on your own stuff. You've
Speaker 2: got to run it against the horse.
Speaker 3: You have enough money, Okay, let's not.
Speaker 1: So.
Speaker 2: The latest version of Kimmy Kimmy three by Moonshot, another
Speaker 2: Chinese company, it would take a million dollars in GPUs
Speaker 2: to run it, So the average person's not downloading that.
Speaker 1: They context is kim a model or a harness?
Speaker 2: Kimmy is is exactly like Deep Seek. It's another it's
Speaker 2: a model plus harness. It's another AI company, but they're
Speaker 2: the latest one that came out. They're the they're the
Speaker 2: most powerful Chinese model that released, is releasing his open Weight.
Speaker 2: But understand, what I'm trying to help you understand is
Speaker 2: this hacker either has enormous resources, or is hacking into
Speaker 2: and stealing from someone who has enormous resources to run
Speaker 2: deep Seek, or they're using the actual official deep Seek
Speaker 2: right to hack, or finally, they have millions of dollars
Speaker 2: in they're hosting their own modern verse. It's another thing
Speaker 2: is they could be using a much older version of
Speaker 2: Deep Sea Sure, and it's not as enabled. It's not
Speaker 2: as capable as it seems. It's just they happen to
Speaker 2: be using it.
Speaker 1: Okay.
Speaker 3: Interestingly enough, we have found some of the less capable
Speaker 3: models are more willing to do bad things. I'll leave
Speaker 3: it at that, because they're down and out on everybody's
Speaker 3: talking about Methos and you're like, come here, Haiku, put
Speaker 3: your armor on. Haiku. You're like, let's do some fun things.
Speaker 2: You're just as smart.
Speaker 3: To that house down. Hiku's like, yeah, it runs over
Speaker 3: you know, but it only.
Speaker 1: Does it if you specify the prompt in Haiku.
Speaker 2: Right, Yeah, well you know, it's who has a very
Speaker 2: complex relationship with its father.
Speaker 1: All right, shall we do some good news before we break?
Speaker 3: Let's do some good news?
Speaker 2: All right?
Speaker 3: We have there is none so.
Speaker 1: Quick. Three recent Chrome releases fix one forty two flaws,
Speaker 1: more than prior to twenty three updates combined. And this
Speaker 1: is a direct result, as we were talking about in
Speaker 1: the last few episodes, of these companies using mythos you.
Speaker 2: Know, and other advanced models to find the vulnerabilities.
Speaker 1: Yeah, Gemini have another advanced models that only they have
Speaker 1: access to to do bug fixes. Microsoft last week was in.
Speaker 2: The news as intimidating as this is. This is not
Speaker 2: the train wreck that I thought.
Speaker 1: It would be. No, it's good news because.
Speaker 2: We did have anthropic go and say, hey, we're going
Speaker 2: to take this advanced model and use it to find
Speaker 2: these bugs. And I think it's a definite net good
Speaker 2: that they're using them to find the bugs exactly. But understand,
Speaker 2: there's still a race on that people are using models
Speaker 2: to find bugs that haven't yet been found, because in
Speaker 2: a month, there's going to be another thousand bugs that
Speaker 2: haven't been found yet.
Speaker 3: In a month.
Speaker 2: You're so cute, Well, next Tuesday, next Tuesday.
Speaker 1: You see the people. You say, people are using this
Speaker 1: to find bugs and expect them, but AI models are
Speaker 1: using truths, are using them to sin and exploit as
Speaker 1: they are out coming up.
Speaker 2: I would rather be hacked by a model that's trying
Speaker 2: to pass a benchmark than by Chinese hackers. Okay, there's
Speaker 2: a difference in intent and the purpose of it. I
Speaker 2: would rather have someone.
Speaker 1: At least the models understand English.
Speaker 2: I would rather have someone cryptomnd my system if they
Speaker 2: broke into it, than ransomware. Sure, so there's levels of hell.
Speaker 1: Especially if Dwayne can get access to how they did
Speaker 1: it and make it a story on Security this week,
Speaker 1: and then we'd all be friends.
Speaker 2: Absolutely, exactly, exactly, that's what honeypots are for.
Speaker 3: Making friends, making friends on the Internet.
Speaker 2: Welcome to the eight hour episode of.
Speaker 1: Yeah and with those unicorns and rainbows. Let's take a
Speaker 1: quick break and we'll be right back after these very
Speaker 1: important messages, and we're back. It's Security this Week. I'm
Speaker 1: Carl Franklin. That's Patrick Hines and Dwaye Laflotte and moving
Speaker 1: on here, we have what five, six, six more?
Speaker 2: Yeah, but the last three are kind of the same story.
Speaker 1: Yeah, Okay, good enough. Hey, we've been talking about Hotel
Speaker 1: Wi Fi and how much it sucks and how much
Speaker 1: you shouldn't trust it. Huh. So here's another.
Speaker 2: Happy Unless you're one of our targets, then please trust Yeah,
Speaker 2: then then always trust the open Wi Fi.
Speaker 1: Here's another story in that vein hijacked Hotel Wi Fi
Speaker 1: pushes fake updates to deliver surveillance malware. So apparently what
Speaker 1: you're in your room, you're about to relax, you know,
Speaker 1: with the latest episode of whatever you're watching, and you
Speaker 1: turn it on and all of a sudden, some thing
Speaker 1: pops up and says, hey, you need to update Windows
Speaker 1: or whatever you're using. Click here, and you click, and
Speaker 1: now you've got surveillance malware.
Speaker 3: Oh yeah, which is nice. You see you got that
Speaker 3: going for you. So yeah, So this campaign is called
Speaker 3: captive Crunch, and.
Speaker 2: Captive Crunch I love it isn't it isn't the rat
Speaker 2: called cornflake. It is.
Speaker 3: It's called cornflake. I don't know, We're not making this up.
Speaker 3: It's in the story. But anyways, so this has been
Speaker 3: attributed to Storm two nine four five, which is a
Speaker 3: Russian APT I don't think we've defined apt in a little.
Speaker 2: While I can advance persistent threat.
Speaker 3: Yes, so an advanced persistent threat a hacking group, like
Speaker 3: Carl had said, and APT is a little bit more
Speaker 3: savvy swarthy. I don't know one of the s words.
Speaker 2: It's more like a global security entity. It's a company
Speaker 2: or a group of individuals that either work for other
Speaker 2: countries or highly financially Russia, China, maybe the United States,
Speaker 2: the sponsored kind of thing, or they working for billion
Speaker 2: dollar enterprises.
Speaker 3: Yeah, yeah, they have, They've reached sources. So an APT
Speaker 3: is not like, you know.
Speaker 2: Two guys in a basement.
Speaker 3: It's exactly, it's an organization that has access.
Speaker 1: Is that your retirement plan?
Speaker 3: It is?
Speaker 1: Yeah, find an ATP billionaire you need.
Speaker 3: Yeah, that's a good look getting there, or an island anyways.
Speaker 3: So uh yeah, needless to say. This is uh, this
Speaker 3: harkens to be a clickfix command. So manipulate DNS on
Speaker 3: the servers. Uh, you know, pops up on your browsers
Speaker 3: says oh my god, you gotta update your browser whatever
Speaker 3: it is. Run this command. When it does that, you
Speaker 3: infect yourself, which is nice. But then now it's cuts
Speaker 3: out the middleman, open webcam, open mic records, keystrokes, steals
Speaker 3: Chrome cookies.
Speaker 1: All another reason why you should just tether your phone
Speaker 1: or get a MA Fi device when you go, yes,
Speaker 1: travel anywhere, yep.
Speaker 2: Yeah, or have a VPN that's automatic through a device, right,
Speaker 2: a tails device or something.
Speaker 3: I would rather Yeah, I would rather tether my phone.
Speaker 3: I Actually, well it used to be you'd say, if
Speaker 3: they've compromised the telephone network, then you know we're in trouble.
Speaker 3: Although that's happened three times over the last year, but
Speaker 3: at least it's rarer. Yes, let's put it that way,
Speaker 3: that that they're going to compromise an entire teleco network.
Speaker 1: Right, Yeah, but if you do both, if you have
Speaker 1: a VPN through your phone or am I fight device, yep,
Speaker 1: that's the best of all worlds.
Speaker 3: Absolutely.
Speaker 1: I find sometimes a hotel Wi Fi doesn't like VPNs
Speaker 1: there for some things.
Speaker 2: Oh it's because that you won't take their updates.
Speaker 3: Yeah, unless you click and allow it and it likes
Speaker 3: you a lot then yeah.
Speaker 1: And you wonder why you get those free chocolates delivered
Speaker 1: to your room.
Speaker 3: Yeah, I mean, how's the how is the cleaning staff
Speaker 3: going to know when you're not in your roof? They
Speaker 3: can't see you through your computer's camera.
Speaker 1: That's true, right, if you think about it. Yeah, so
Speaker 1: don't think about it unencumbered by the thought, you know,
Speaker 1: and s whatch you should be. All right, let's move on.
Speaker 1: Google password manager attacks could let malware hijack passkey protected accounts.
Speaker 1: Wasn't this one of those things fixed in the fourteen
Speaker 1: and fourteen forty two flaws?
Speaker 2: Yeah?
Speaker 3: It was. This is another If you're patching, you're you're
Speaker 3: probably okay. It's just you know, we won't go into
Speaker 3: a ton of detail here, but it's just it's an interesting,
Speaker 3: you know, article on Hey listen, as they're going through
Speaker 3: and finding these issues. Internally, we're seeing you know, Google
Speaker 3: actually detecting a lot of these issues using Gemini right right, right,
Speaker 3: So you know, we're seeing Microsoft and Google and all
Speaker 3: sorts of organizations out there using AI and discovering some
Speaker 3: of these bugs that have been sitting inside of you know,
Speaker 3: the browser for thirteen years and going ooh, yeah, here's
Speaker 3: a script that actually would do X. Let's fix this.
Speaker 3: You know what's funny is, you know, we we talk
Speaker 3: a lot about AI offense versus AI defense, right, and
Speaker 3: we say, listen, AI defense has to get every single
Speaker 3: attack right, right. But AI offense only has to get
Speaker 3: one attack right, and when it gets access, you're in trouble.
Speaker 3: And then if you look at the you know, the
Speaker 3: the ratio there, it's almost impossible for an AI defender
Speaker 3: to successfully defend against AI attacking right because an AI
Speaker 3: attack can give out billions of attacks, where the AA
Speaker 3: defender would then have to reason out whether they're attacks
Speaker 3: or legitimate traffic. I think what we're seeing is large
Speaker 3: companies realize that, right, Google realizes that. Microsoft realizes that.
Speaker 3: So what they're doing is they're saying, we're going to
Speaker 3: do AI defense in terms of AI offense. We're going
Speaker 3: to use AI offensively against our stuff and that's good
Speaker 3: and try hopefully discover things before the attackers do, which
Speaker 3: is a great way to do it.
Speaker 1: That's sort of sort of AI pen testing exactly.
Speaker 3: Yep.
Speaker 1: Absolutely, you guys are out of business now.
Speaker 2: We've been saying that for a lot long time.
Speaker 3: Yeah, let me tell you about my AI Uh yeah,
Speaker 3: it's impressive.
Speaker 1: Right, all right, all right, we moved on.
Speaker 3: We've moved on.
Speaker 1: Okay, Kiev linked NPM worm poisons hundreds of packages, plants,
Speaker 1: claud code and vs code hooks, and Kiev linked is
Speaker 1: k E y v dash linked l I n k
Speaker 1: e d Yikeuse that doesn't sound good.
Speaker 3: No, it's fine, It's okay, it's it's it's it is.
Speaker 3: It is awesome. I mean an n PM. N PM
Speaker 3: is a package manager right.
Speaker 1: Right for JavaScript? What's up for JavaScript? Yeah?
Speaker 3: For JavaScript? Right pie Pie is a package manager for
Speaker 3: Python right in a library where you can download Python libraries.
Speaker 3: So it's not uncommon to see these repositories, you know,
Speaker 3: get compromised from here to you know, occasionally. We we've
Speaker 3: even seen it where AI recommends libraries that don't exist,
Speaker 3: so attackers will go, oh, we see the top ones
Speaker 3: that are getting recommended. Let's just go create a malicious
Speaker 3: ones that you'll automatically pull them in. And we'll actually
Speaker 3: see that in some of our latter three stories as well. So, yeah,
Speaker 3: there was a malicious, malicious, credential stealing NPM worm that
Speaker 3: first appeared in k E y v y version six
Speaker 3: dot keep version six dot zero dot zero, and that's
Speaker 3: you know, obviously been been patched since. But yeah, yeah,
Speaker 3: patching was the first problem. Wait, aren't you supposed to
Speaker 3: patch always always.
Speaker 2: Not when it's poisoned poison patch.
Speaker 1: Well, yeah, but we still recommend people patch. Yeah, I
Speaker 1: know all the time.
Speaker 3: Yeah, absolutely. I mean honestly, it's like it's like the
Speaker 3: people who complain about wearing a seatbelt, Like there's this
Speaker 3: story about somebody who died because they're wearing their seatbelt.
Speaker 3: It's like, yeah, but you don't see the stories that people.
Speaker 2: Doctor says, I should eat lettuce, but this doesn't sound
Speaker 2: like a good time eat let us.
Speaker 1: Oh my god, speaking of that, my trombone player couldn't
Speaker 1: make it too rehearsal because he's had the taco bell
Speaker 1: let us disease for the last three weeks. So we
Speaker 1: have a gig next weekend.
Speaker 2: I think you have a gig next weekend.
Speaker 1: Yeah, exactly, maybe tromboneless.
Speaker 2: Yeah, poor guy, that's brutal. Yeah, that's horrible. At thousands
Speaker 2: of thousands of people now have that.
Speaker 3: So wow.
Speaker 2: So just because it's recommended doesn't mean you to consider
Speaker 2: the source.
Speaker 1: Think about the odds.
Speaker 3: Right, you're using this now. So he said that you
Speaker 3: can use it as an excuse not to eat.
Speaker 2: I was just force sight. I just I just prepared
Speaker 2: for it well in advance.
Speaker 3: Patrick's theatric Remember that guy at time, feed the let us.
Speaker 1: To a ruminant, kill and eat the ruminant, Fine, a
Speaker 1: little filter. Who cares if the ruminant gets diarrhea, Just
Speaker 1: kill it and eat it, all right? Uh? Meta AI
Speaker 1: model hacked a company during misconfigured cyber test. And this
Speaker 1: is another one of those models going row, which is advertising.
Speaker 1: This is the Yeah, but the topic of this story
Speaker 1: is kind of like the whole theme of this program
Speaker 1: Yeah today. Yeah.
Speaker 2: Well, there's three stories that basically walk the same line.
Speaker 2: Meta Medai.
Speaker 1: What.
Speaker 2: Here's the thing when the when the company say our
Speaker 2: model was so bad it broke out of its containment.
Speaker 2: What they're trying to communicate is it's so powerful. It's
Speaker 2: so powerful, it's dangerous. It's so bad they have to
Speaker 2: put a warning on it. You know, it's an Altoid's commercial.
Speaker 1: Well okay, but that doesn't mean that it didn't break
Speaker 1: out of its containment.
Speaker 2: Well, I mean misconfigured. They that's admitted here at least,
Speaker 2: but a lot of them.
Speaker 3: Oh yeah.
Speaker 2: When you look at the messaging of the AI companies,
Speaker 2: Open Ai, Meta and Anthropic, it's all like, oh, it's
Speaker 2: just so powerful, we didn't even know it.
Speaker 3: These last three stories, Yeah, talk about uh, you know,
Speaker 3: meta breaking out and attacking companies, talk about anthropics, open
Speaker 3: AI actually targeting in humans and going through and harassing.
Speaker 3: We'll talk about this, but harassing I get ho open
Speaker 3: that's open AI and anthropic. Yeah, exactly. So we're seeing
Speaker 3: a lot of sort of Oh my god's AI is
Speaker 3: breaking loose. If you dig into sent into these stories,
Speaker 3: you'll find mention of a company called Irregular. It's actually uh,
Speaker 3: let me read through real quick right here. So, according
Speaker 3: to the report, the model reached the public Internet because
Speaker 3: of an error in configuration of a sandbox testing environment
Speaker 3: operated with independent cybersecurity evaluation company Irregular. So Irregular is
Speaker 3: a Israeli cyber security company. Their soul claim to fame
Speaker 3: is that they test what are called frontier models. Right,
Speaker 3: so all the models you if you're not running a
Speaker 3: model on open weight model, you're running a frontier model, right,
Speaker 3: And if you.
Speaker 2: Pay extra, they'll do it badly.
Speaker 1: So if I'd like to pay for the extra bad
Speaker 1: service and I'll leave it open to the Internet.
Speaker 2: I would like a story to emerge so that live
Speaker 2: had a skit where it's like there was a delivery
Speaker 2: company that you could order something to be delivered and
Speaker 2: they would say that they delivered it late and lost it,
Speaker 2: and they would take all the blame. But they're at
Speaker 2: the center of all this, aren't they. They're they're involved
Speaker 2: in all of these events, yougular.
Speaker 3: Yeah, so it's there. They test frontier models and their
Speaker 3: cyber security capabilities and offense, and they're the ones who
Speaker 3: are giving it, uh, you know, giving the models the objectives. Oh,
Speaker 3: go test you know, do the cyber security gym, Go
Speaker 3: test this, go test this. Here's you know, et cetera.
Speaker 3: Thousands of different tests we want you to run through
Speaker 3: and multiple two of the stories we have here. Actually
Speaker 3: it might maybe all three of the next stories were
Speaker 3: all about misconfigurations and it's this company irregular that.
Speaker 2: Like I said, costs extra.
Speaker 3: Yeah, I don't know if yet. It's a great point.
Speaker 2: Well, when it first happened, it was a big bump
Speaker 2: in open AI because it was like, oh, wow, their
Speaker 2: models are so powerful. I honestly wouldn't doubt that this
Speaker 2: isn't the whole play, This isn't an actual manipulations.
Speaker 3: That's pretty nefarious.
Speaker 2: It's well, if you watch a lot of the if
Speaker 2: you read a lot of the newsletters, you read a
Speaker 2: lot of articles. If you watch a lot of the interviews,
Speaker 2: you very often hear the refrain of I actually know
Speaker 2: a lot of these founders of these AI companies. And
Speaker 2: this isn't me saying. This is people who know them,
Speaker 2: who tell you in private exactly the opposite. Well, what
Speaker 2: they're telling the audience, and the reason is because they
Speaker 2: need to tell a story that brings billions and hundreds
Speaker 2: of billions of dollars of investment in yep. And the
Speaker 2: truth is more nuanced and different than what they're saying.
Speaker 2: Think about it this way. When chat GPT came out,
Speaker 2: they were talking about in the next eighteen months, we're
Speaker 2: going to have general AI General AI. We don't and
Speaker 2: it's not even eighteen months away, although they keep promising it.
Speaker 2: It's not because they're stupid, it's because they're manipulative.
Speaker 1: Well, think about it. I mean, you might you might think, oh,
Speaker 1: Patrick's got a ten flil hat on and we're just
Speaker 1: you know, thinking of conspiracy theories. But the whole world
Speaker 1: economy right now is based on the hype around AI.
Speaker 2: The Magnificent seven.
Speaker 1: Oh, it's absolutely true. If you took AI companies out
Speaker 1: of the stock market, we'd be in another depression.
Speaker 2: Well it's been a recession then, yeah, not well even
Speaker 2: even worse. The stock market's down if you take them out.
Speaker 2: So yeah, I don't think I'm being I'm not I'm
Speaker 2: being cynical. I don't think I'm.
Speaker 1: Being totally hyperbolic.
Speaker 2: But this is how they're trying to keep the hype
Speaker 2: engine because the the eight, the IPOs of Open AI
Speaker 2: and Anthropic are coming and they want them to be magnificent,
Speaker 2: and some of the news has not been great for them,
Speaker 2: and this is probably the bright even though it's bad news,
Speaker 2: it's the bright spot.
Speaker 1: So Irregular is used in all three of these stories
Speaker 1: and cited in all three of these stories as a
Speaker 1: partner for environmental testing and all that stuff. So are
Speaker 1: we blaming Irregular?
Speaker 2: So the competence is up up for question.
Speaker 3: Yeah, exactly if you're if you've taken a frontier model
Speaker 3: and you've paid to have them test it in an offline,
Speaker 3: sandboxed way and.
Speaker 2: It keeps breaking out, maybe you should disconnect the wires.
Speaker 3: And it and it breaks out, and you realize, like
Speaker 3: for this first one, muse spark one dot one breached
Speaker 3: a real company and changed its internal systems during the test, right,
Speaker 3: So there there's there's damages potentially here. So from an
Speaker 3: opening from a meta standpoint, I'd be like, are you serious, Like, dude,
Speaker 3: I gave you access to this model to test it,
Speaker 3: and then you let the model out just by not
Speaker 3: configuring it properly. Like there was no sandbox escape, There
Speaker 3: was no magic that happened. It just they left the
Speaker 3: door open.
Speaker 2: Which means a hacker could get in and get the.
Speaker 3: Model potentially right depending on how this actually works, or
Speaker 3: or manipulate the model. The model was on the internet.
Speaker 3: We've seen tons of times where a model will go
Speaker 3: out and read a site and then start taking in
Speaker 3: prompts from that site. Right, So could it have happened?
Speaker 1: Yes? Is it regular your next new customer to teach
Speaker 1: them how to secure their stuff.
Speaker 2: I think this bug is a feature you think so
Speaker 2: you think it was so Patrick thinks it's a it's
Speaker 2: all staged. I don't think the first were left open
Speaker 2: on purpose. I don't think the first one was. But
Speaker 2: I think it's it's it's spreading right to other customers. Now,
Speaker 2: if you've put a timeline on and you show me
Speaker 2: that it all happened within a two week period before
Speaker 2: it became public. Then yeah, I'd take back Mike. I thought,
Speaker 2: I'm happy to listen to evidence, sure, and change my opinion,
Speaker 2: But it just seems so convenient that they just keep
Speaker 2: all having this thing. And again, the way a lot
Speaker 2: of people interpret this is, oh, my god, that's powerful.
Speaker 2: I should use that model, right, of course, I'll use
Speaker 2: guidelines and I'll wait until it's secured, or I can't
Speaker 2: wait for that model.
Speaker 1: If you're on the other side, oh, this thing is
Speaker 1: too powerful for mere mortals to use. We should ban it.
Speaker 2: Right, Yeah, they're trying to walk that thin line, right
Speaker 2: because they're trying to keep it from getting banned.
Speaker 1: Yeah, I don't know.
Speaker 2: I'm cynical.
Speaker 1: I guess.
Speaker 2: I guess. Well, maybe I'm wrong. I'd love to be
Speaker 2: proven wrong, but it seems a little bit too. I
Speaker 2: would be infuriated if I ran a company and I
Speaker 2: had a secret NDA software that you let get on
Speaker 2: the Internet, because that means the Internet could get into it.
Speaker 1: Right, Yeah, all right, So there's one more in this
Speaker 1: final trilogy, which is anthropic, says Claude mistook the Open
Speaker 1: Internet for a CTF and breached three organizations and of course,
Speaker 1: our friend Irregular is in this story as well.
Speaker 3: Yeah. Absolutely, So this is this same configuration issue. Is
Speaker 3: they were doing testing, they left the door open. There
Speaker 3: was one incident with Claude Opus four to seven. There
Speaker 3: was another one with Mythos five that involved it actually
Speaker 3: creating different pie pipe packages and fifteen different companies actually
Speaker 3: in an hour pulled down those pie pipe packages and
Speaker 3: got infected. One of them was a cybersecurity company who
Speaker 3: flagged it as a Okay, so you know, it's interesting
Speaker 3: to see that Irregular was really kind of had some
Speaker 3: pretty big contracts. Good for them, but in this particular case,
Speaker 3: leaving the leaving the door open didn't help anything.
Speaker 2: I find it to be highly irregular. Yeah, so needless
Speaker 2: to say.
Speaker 1: At the beginning of the show. Yeah, and it's usually
Speaker 1: levied me.
Speaker 3: Yeah, so there's a there was. Those were the incidents
Speaker 3: that involved Irregular. Now, one of the ones we didn't
Speaker 3: talk about real quick before we leave is open AI
Speaker 3: Anthropic agents targeted real people this week as well. We
Speaker 3: won't go into a lot of that story, but what's
Speaker 3: interesting in that story is it was purposefully given access
Speaker 3: to the Internet and all of the guardware rails were removed,
Speaker 3: and they pointed it at a test GitHub and said, yeah,
Speaker 3: figure out what you can do. And it mistook a
Speaker 3: real GitHub repo as the target, and it started creating
Speaker 3: GitHub users and adding patches to the software. And when
Speaker 3: the person who owned that repo said no, no, no, no,
Speaker 3: this is malware, it tried to intimidate them. It not
Speaker 3: only started sending him emails and like intimidating them, but
Speaker 3: it created a bunch of other GitHub users saying no,
Speaker 3: this is cool, looks good, like on, know what you're
Speaker 3: talking about.
Speaker 1: If I were investigating this story, the first thing I
Speaker 1: would ask is I want to know if the person
Speaker 1: who issued these prompts was an ESL person English as
Speaker 1: a second language, huh, and just kind of maybe swapped
Speaker 1: around some Tensessa labs or whatever, and boom, you've got
Speaker 1: a vulnerability.
Speaker 2: Left out the word not out of Don't it could?
Speaker 1: Yeah?
Speaker 3: Yeah, who knows? Yeah it is interesting. But this is
Speaker 3: why you absolutely need to be careful what you're doing
Speaker 3: with targeting of an LLLM, because we've all seen this,
Speaker 3: We've all talked to you know, whether it's CHET, GPT
Speaker 3: or whatever. And I could ask the same question as
Speaker 3: Carl the same question as Patrick, and we may not
Speaker 3: get the same answer because it's a statistical model. It's
Speaker 3: coming back with what at the time it thinks is
Speaker 3: the most appropriate answer, and it may use.
Speaker 1: Some history and it's nondeterministic.
Speaker 3: Yes, right. It may say, well, I've been talking to Carl,
Speaker 3: and I know Carl's a musician, and this is how
Speaker 3: he would want this framed versus me. You know, I'm
Speaker 3: an amateur radio operator and a martial artist. I might
Speaker 3: want it in a different way. And Patrick has his
Speaker 3: military background and he might want it to so statistically
Speaker 3: it might give us different answers. When you're looking at
Speaker 3: a tool that's going to cut through, you know, whether
Speaker 3: it's social engineering, manipulating hardware, breaking into companies and that
Speaker 3: sort of stuff, you don't want statistical analysis there. You
Speaker 3: don't want. Oh, I think this is probably a better target.
Speaker 3: So yeah, I'd be intrigued to see what the what
Speaker 3: the prompts are here? How do they guarantee when you
Speaker 3: point that LLM missile it actually hits the right target.
Speaker 1: Before we wrap up, this seems like a good time
Speaker 1: to plug next weeks or this week's code it with
Speaker 1: AI video that I do with Rocky Latka, and he
Speaker 1: talks about he uses claud code most of the time,
Speaker 1: and claud code keeps memories of things that it gleans
Speaker 1: during a session in your users folder on Windows or
Speaker 1: in a different folder and a Linux system, but it
Speaker 1: keeps it on your machine and all of the memories
Speaker 1: of things that it learned about. You know, you should
Speaker 1: always do this, you should never do that that you
Speaker 1: tell it to remember, but then if you go to
Speaker 1: another machine, all those memories are gone. So he basically
Speaker 1: created a damon that runs on your machine that constantly
Speaker 1: updates and refreshes from a GitHub repo these memories based
Speaker 1: on your projects. And how cool is that?
Speaker 2: And that's very cool.
Speaker 3: Wait a second, did Rocky work with open ai and
Speaker 3: all I think there was one of these stories actually
Speaker 3: that open ai store. We're just talking about it targeting humans.
Speaker 3: They used a GitHub repo, all the different agents to coordinate.
Speaker 1: But this is a private GitHub repo. Obviously it's not
Speaker 1: that stupid.
Speaker 3: No, no, no, I no, I'm just saying, like, using
Speaker 3: the tactic of a GitHub as a memory storage location
Speaker 3: was actually used by this too, which is very interesting.
Speaker 1: It's a great solution to that. Sure because otherwise you
Speaker 1: have to like configure some cloud endpoints and blah blah
Speaker 1: blah and write some code and YadA YadA. You know,
Speaker 1: you could use storage accounts, I suppose, but.
Speaker 2: Yeah, living off the land, so.
Speaker 1: But but it's a cool tool that he wrote. And
Speaker 1: it also has this sort of over compacting on never mind,
Speaker 1: you just watched the show. It's good. It's coming out
Speaker 1: this Wednesday at two pm Eastern time, and you can
Speaker 1: find it on my various social media links.
Speaker 2: Cool. All right, thanks oboy.
Speaker 1: All right, well, that's all the news from last week
Speaker 1: and we'll see you next week on Security this week.
Speaker 1: Bye bye,