WEBVTT

1
00:00:00.320 --> 00:00:03.200
<v Speaker 1>Hey, Carl here, we're on a mission to find new

2
00:00:03.240 --> 00:00:05.919
<v Speaker 1>fans of the show. I mean, where else can you

3
00:00:05.960 --> 00:00:10.240
<v Speaker 1>get real life comedy and horror in one podcast. You

4
00:00:10.279 --> 00:00:13.640
<v Speaker 1>can do your part by leaving us a review on iTunes, Spotify,

5
00:00:13.759 --> 00:00:16.879
<v Speaker 1>or wherever you get Security this week. Also, you can

6
00:00:16.920 --> 00:00:19.399
<v Speaker 1>get an ad free feed by becoming a five dollars

7
00:00:19.399 --> 00:00:22.239
<v Speaker 1>a month patron. Go to Patreon dot Security this week

8
00:00:22.320 --> 00:00:26.160
<v Speaker 1>dot com and sign up, and don't forget discord. Discord

9
00:00:26.199 --> 00:00:28.839
<v Speaker 1>dot Security this week dot com. Lots of good stuff

10
00:00:28.879 --> 00:00:32.479
<v Speaker 1>happening there. Yeah, I think that's it. So on with

11
00:00:32.560 --> 00:00:35.679
<v Speaker 1>the podcast. Hey, so, I'm gonna do a little psychic

12
00:00:35.719 --> 00:00:38.840
<v Speaker 1>prediction for all our listeners who remember what connecting to

13
00:00:38.920 --> 00:00:44.159
<v Speaker 1>the Internet with dial up sounded like. Okay, ready, I

14
00:00:44.359 --> 00:00:46.679
<v Speaker 1>predict your back hurts.

15
00:00:47.320 --> 00:00:49.039
<v Speaker 2>My back hurts. I don't get it.

16
00:00:49.159 --> 00:00:50.840
<v Speaker 1>Oh do I really have to explain it to me?

17
00:00:53.280 --> 00:00:55.200
<v Speaker 1>How old are you if you remember what dial up

18
00:00:55.200 --> 00:00:55.679
<v Speaker 1>sounds like?

19
00:00:58.640 --> 00:01:03.520
<v Speaker 2>Oh? Wait, I get it? Yeah, okay, mine is the

20
00:01:03.520 --> 00:01:04.239
<v Speaker 2>first thing to go.

21
00:01:04.280 --> 00:01:06.959
<v Speaker 3>Apparently, I'm gonna pretend I got it and just.

22
00:01:07.000 --> 00:01:20.400
<v Speaker 1>Kept silent like always. Hey, guess what it's Security this week.

23
00:01:20.439 --> 00:01:23.359
<v Speaker 1>We've got a few stories for you. I'm Carl, that's

24
00:01:23.439 --> 00:01:27.400
<v Speaker 1>Dwayne and Patrick. Let's start with Tom's hardware story. Critical

25
00:01:27.480 --> 00:01:31.680
<v Speaker 1>mac os screen sharing flaw gives attackers remote root access

26
00:01:32.439 --> 00:01:36.879
<v Speaker 1>Sissa bumps bug to nine point eight severity following active

27
00:01:37.159 --> 00:01:39.599
<v Speaker 1>mono crypto jacking attacks.

28
00:01:39.640 --> 00:01:42.959
<v Speaker 3>Finally, some love or is this hate for mac Os?

29
00:01:46.760 --> 00:01:49.200
<v Speaker 2>I think it targets a Target's a target, that's true. Yeah,

30
00:01:49.280 --> 00:01:49.640
<v Speaker 2>that's true.

31
00:01:49.719 --> 00:01:53.439
<v Speaker 1>Well, in the past, you know, Apple users thought they

32
00:01:53.439 --> 00:01:57.400
<v Speaker 1>were impervious to bugs and hacking and and all that

33
00:01:57.480 --> 00:02:01.040
<v Speaker 1>stuff in the past. Yeah, in the past really started.

34
00:02:00.799 --> 00:02:03.079
<v Speaker 2>The president and future was yesterday.

35
00:02:03.159 --> 00:02:07.040
<v Speaker 1>The past well, okay, but a long long time ago,

36
00:02:07.079 --> 00:02:09.919
<v Speaker 1>I mean forever. Yea, you know they've been rubbing in

37
00:02:09.919 --> 00:02:13.800
<v Speaker 1>in our face. Hey, mac Os doesn't crash, right and

38
00:02:14.080 --> 00:02:16.960
<v Speaker 1>probably you know, by design they own the hardware, they

39
00:02:16.960 --> 00:02:19.719
<v Speaker 1>own everything. And yeah, Microsoft, well.

40
00:02:19.560 --> 00:02:22.159
<v Speaker 3>It didn't also didn't hurt that they only had one

41
00:02:22.199 --> 00:02:23.080
<v Speaker 3>percent market share.

42
00:02:23.199 --> 00:02:26.039
<v Speaker 1>Yeah that's true. But Microsoft has a Windows has a

43
00:02:26.080 --> 00:02:29.240
<v Speaker 1>hardware abstraction layer and drivers that are built by all

44
00:02:29.280 --> 00:02:33.120
<v Speaker 1>these third party companies, so by design they're more susceptible

45
00:02:33.120 --> 00:02:36.879
<v Speaker 1>to crashing. But yeah, I agree, I'm I'm feeling a

46
00:02:36.919 --> 00:02:38.960
<v Speaker 1>little a little smug right now.

47
00:02:39.000 --> 00:02:42.960
<v Speaker 4>Live shot in Freida live shot in Now this this

48
00:02:43.000 --> 00:02:48.960
<v Speaker 4>one was also upgraded, so the cv the CVSS score

49
00:02:48.960 --> 00:02:51.240
<v Speaker 4>went from seven to one to nine point eight.

50
00:02:51.360 --> 00:02:55.199
<v Speaker 2>But is it warranted August fourteenth, Yeah, it is. So

51
00:02:55.520 --> 00:02:58.840
<v Speaker 2>what it happened before is this was classified as a

52
00:02:58.919 --> 00:03:03.319
<v Speaker 2>not so important. You know, yes, somebody can bypass it,

53
00:03:03.360 --> 00:03:07.000
<v Speaker 2>but they have to have a local, low priview user and.

54
00:03:06.639 --> 00:03:11.080
<v Speaker 3>It wasn't catastrophic in their opinion based on the first exploit.

55
00:03:11.520 --> 00:03:14.199
<v Speaker 2>Yeah, exactly. So, you know, it is interesting to watch

56
00:03:14.199 --> 00:03:18.879
<v Speaker 2>some of these some of these scores change and one

57
00:03:18.919 --> 00:03:21.599
<v Speaker 2>of the major reasons this one changed is because now

58
00:03:21.759 --> 00:03:25.360
<v Speaker 2>they're saying the attack is what's called automatable.

59
00:03:25.439 --> 00:03:27.360
<v Speaker 3>And it doesn't require any access.

60
00:03:27.039 --> 00:03:29.479
<v Speaker 2>At all exactly. So now a as long as you

61
00:03:29.479 --> 00:03:31.960
<v Speaker 2>have access to that port, you don't need a user

62
00:03:32.039 --> 00:03:35.240
<v Speaker 2>name and password, and you can you can absolutely exploit this,

63
00:03:35.479 --> 00:03:38.039
<v Speaker 2>and that's that's why they were seeing all these crypto minors.

64
00:03:38.039 --> 00:03:40.719
<v Speaker 2>It was literally just automatable. So that actually up the score.

65
00:03:40.919 --> 00:03:43.080
<v Speaker 1>When you say automatable, does that mean you have to

66
00:03:43.120 --> 00:03:45.479
<v Speaker 1>be in the proximity of it or on the same

67
00:03:45.560 --> 00:03:46.599
<v Speaker 1>network or what.

68
00:03:47.280 --> 00:03:50.280
<v Speaker 2>Just as long as Port fifty nine hundred is actually

69
00:03:50.319 --> 00:03:52.319
<v Speaker 2>open to the internet. So if you want to remote

70
00:03:52.319 --> 00:03:56.000
<v Speaker 2>desktop into your you know, your Mac, yeah, and start

71
00:03:56.080 --> 00:04:01.120
<v Speaker 2>using things, right, that port's probably open. I mean, if honestly,

72
00:04:01.360 --> 00:04:04.599
<v Speaker 2>the dear listener, you probably should have a VPN. But yes,

73
00:04:05.120 --> 00:04:07.840
<v Speaker 2>we've seen this, oh my god, yeah, this many times.

74
00:04:08.360 --> 00:04:10.759
<v Speaker 2>You know, easy put it up there so that you

75
00:04:10.759 --> 00:04:13.240
<v Speaker 2>can actually connect to it from anywhere. And the problem is,

76
00:04:13.439 --> 00:04:14.639
<v Speaker 2>how about a firewall too?

77
00:04:14.919 --> 00:04:20.439
<v Speaker 1>Yeah, well yeah, Mac users don't use firewalls. No, no,

78
00:04:20.800 --> 00:04:23.600
<v Speaker 1>no need, we don't need those stinking firewalls.

79
00:04:23.839 --> 00:04:25.319
<v Speaker 2>Very very secure.

80
00:04:24.959 --> 00:04:28.839
<v Speaker 3>Now so far, they're lucky that the Manaro crypto mining

81
00:04:28.920 --> 00:04:30.959
<v Speaker 3>is the only thing that's happening. And I've seen there's

82
00:04:30.959 --> 00:04:34.279
<v Speaker 3>been actually a lessening of ransomware.

83
00:04:34.600 --> 00:04:34.800
<v Speaker 2>Yeah.

84
00:04:34.920 --> 00:04:37.160
<v Speaker 3>I don't know why that is, but maybe it's because

85
00:04:37.199 --> 00:04:38.160
<v Speaker 3>crypto is doing better.

86
00:04:38.639 --> 00:04:40.480
<v Speaker 2>That's a good question. I haven't looked, but you're you're

87
00:04:40.519 --> 00:04:43.639
<v Speaker 2>absolutely right. There's there's a couple of different stories that

88
00:04:43.680 --> 00:04:46.079
<v Speaker 2>I went through where it looks like crypto mining is back.

89
00:04:47.480 --> 00:04:50.519
<v Speaker 2>A lot of it's minarrow. Actually, Minero is really good

90
00:04:50.519 --> 00:04:53.920
<v Speaker 2>if you want to hide what you're buying, okay, Dwayne,

91
00:04:54.079 --> 00:04:55.560
<v Speaker 2>because of the way it works anyways.

92
00:04:55.639 --> 00:04:59.839
<v Speaker 3>Yeah, but that's like the difference between someone burning or

93
00:04:59.839 --> 00:05:02.480
<v Speaker 3>how down or ordering a fake pizza. Yeah, true, I'd

94
00:05:02.519 --> 00:05:05.879
<v Speaker 3>much rather have the fake pizza than the burning yep.

95
00:05:06.600 --> 00:05:09.079
<v Speaker 2>Yeah, But you know it is interesting. I think you know,

96
00:05:09.120 --> 00:05:12.439
<v Speaker 2>we're going to probably start to see automatable be a

97
00:05:12.560 --> 00:05:16.680
<v Speaker 2>more important statistic in attacks, especially with AI. Right, right,

98
00:05:16.720 --> 00:05:19.680
<v Speaker 2>if I can get an AI, because automatable now is not. Hey,

99
00:05:19.680 --> 00:05:21.600
<v Speaker 2>do you have a really bright developer who can write

100
00:05:21.639 --> 00:05:24.600
<v Speaker 2>a script that kind of bypasses things? It's hey, can

101
00:05:24.680 --> 00:05:25.399
<v Speaker 2>you talk to an AI?

102
00:05:25.600 --> 00:05:29.079
<v Speaker 3>And is it deterministic versus probabilistic? Yeah, exactly, We've talked

103
00:05:29.079 --> 00:05:33.160
<v Speaker 3>about that before. Deterministic is like a calculator you type

104
00:05:33.160 --> 00:05:35.560
<v Speaker 3>in you know five plus seven is eleven?

105
00:05:35.680 --> 00:05:35.839
<v Speaker 1>Right?

106
00:05:36.079 --> 00:05:42.720
<v Speaker 3>No, no, it's twelve. But anyways you're supposed to say, right, anyways,

107
00:05:42.800 --> 00:05:45.600
<v Speaker 3>I know five plus seven is twelve every time you

108
00:05:45.639 --> 00:05:48.120
<v Speaker 3>put in a calculator. But there are some race conditions

109
00:05:48.160 --> 00:05:51.360
<v Speaker 3>that are part of exploits where you might try it

110
00:05:51.480 --> 00:05:54.199
<v Speaker 3>seven times and it doesn't work six right. It doesn't

111
00:05:54.240 --> 00:05:56.839
<v Speaker 3>mean it's not workable. It's means that the stars weren't aligned

112
00:05:56.879 --> 00:05:59.000
<v Speaker 3>for you to get in and you have to try

113
00:05:59.000 --> 00:06:02.279
<v Speaker 3>it again. That makes it not really automatable or not

114
00:06:02.480 --> 00:06:03.399
<v Speaker 3>as automatable.

115
00:06:03.480 --> 00:06:06.079
<v Speaker 1>Right, Well, it could be automatable. It's just that it

116
00:06:06.120 --> 00:06:08.680
<v Speaker 1>may have more errors, you know, but it's.

117
00:06:08.680 --> 00:06:11.120
<v Speaker 3>But it can it may, but then you get yeah.

118
00:06:11.000 --> 00:06:12.759
<v Speaker 1>Looped so much that it doesn't matter.

119
00:06:12.879 --> 00:06:15.040
<v Speaker 2>Right, Well, I think I think that's noisy.

120
00:06:15.160 --> 00:06:15.399
<v Speaker 1>Yeah.

121
00:06:15.439 --> 00:06:18.199
<v Speaker 2>The other thing that's interesting, especially with AI, on the

122
00:06:18.240 --> 00:06:19.959
<v Speaker 2>back end of a lot of these things that are

123
00:06:20.639 --> 00:06:23.079
<v Speaker 2>maybe non deterministic. Right, maybe you have to run in

124
00:06:23.120 --> 00:06:26.439
<v Speaker 2>a thousand times is it used to be? You know,

125
00:06:26.480 --> 00:06:28.839
<v Speaker 2>if it succeeded, great, If it failed, just keep trying.

126
00:06:29.639 --> 00:06:32.120
<v Speaker 2>And now you can say, well, if it let's say

127
00:06:32.120 --> 00:06:34.360
<v Speaker 2>it's it kind of succeeded, or we're seeing this new

128
00:06:34.439 --> 00:06:36.879
<v Speaker 2>error message, or we're seeing this kind of rape throttling

129
00:06:36.920 --> 00:06:39.199
<v Speaker 2>or whatever. Right, Instead of being a developer where you'd

130
00:06:39.240 --> 00:06:41.399
<v Speaker 2>write a branch for each of those things that you know,

131
00:06:41.480 --> 00:06:45.120
<v Speaker 2>if we're being ray throttled, then use fireprocs. If we

132
00:06:45.199 --> 00:06:47.759
<v Speaker 2>see this error, then do right where we would do that,

133
00:06:47.800 --> 00:06:52.839
<v Speaker 2>we would write really really robust attack toolkits. And now

134
00:06:52.920 --> 00:06:55.959
<v Speaker 2>with AI, it's like, hey, if you get stopped, write

135
00:06:55.959 --> 00:06:58.879
<v Speaker 2>something that goes around it, right, and it will then

136
00:06:58.959 --> 00:07:00.399
<v Speaker 2>start routing through different places.

137
00:07:00.399 --> 00:07:05.480
<v Speaker 1>And that's first off, right, yep, okay, next story, next

138
00:07:05.519 --> 00:07:09.800
<v Speaker 1>door open claw agent independently hacks gym website to move

139
00:07:09.800 --> 00:07:14.000
<v Speaker 1>its owner up the queue. I think I saw this

140
00:07:14.319 --> 00:07:16.319
<v Speaker 1>before the Elebor or maybe it was.

141
00:07:16.399 --> 00:07:18.720
<v Speaker 3>The elect for a little bit. Yeah, this is this

142
00:07:18.800 --> 00:07:24.360
<v Speaker 3>came out when when when all the frontier labs started saying,

143
00:07:24.439 --> 00:07:29.879
<v Speaker 3>oh our our our AI is so dangerous powerful, it's

144
00:07:29.879 --> 00:07:33.279
<v Speaker 3>so dangerous. It's so powerful that it's hacking things. And

145
00:07:33.360 --> 00:07:37.040
<v Speaker 3>somebody basically let their open claw go and in order

146
00:07:37.040 --> 00:07:39.399
<v Speaker 3>to get them a slot in a class, it deleted someone.

147
00:07:39.560 --> 00:07:43.759
<v Speaker 2>I want to call BS on this. Really, Okay, all right,

148
00:07:43.800 --> 00:07:46.879
<v Speaker 2>here's the deal. Take it from somebody who has who

149
00:07:46.959 --> 00:07:51.079
<v Speaker 2>knows how hard it is to prompt a frontier model

150
00:07:51.639 --> 00:07:54.560
<v Speaker 2>to get it to break into a site. Just take

151
00:07:54.600 --> 00:07:58.240
<v Speaker 2>that for what it's worth. This guy didn't just say, Hey,

152
00:07:58.279 --> 00:08:00.480
<v Speaker 2>I want to go to the gym and or four

153
00:08:00.519 --> 00:08:02.639
<v Speaker 2>on the queue. Can you get me closer to one,

154
00:08:03.560 --> 00:08:06.519
<v Speaker 2>and it just magically decided to go out and hack

155
00:08:06.839 --> 00:08:07.480
<v Speaker 2>the website.

156
00:08:07.800 --> 00:08:10.279
<v Speaker 1>He probably would have said it like this, Hi, Mike,

157
00:08:10.439 --> 00:08:13.040
<v Speaker 1>I want to go to the gym and there's no

158
00:08:13.160 --> 00:08:15.920
<v Speaker 1>room in the class, so can you move me up?

159
00:08:15.959 --> 00:08:16.639
<v Speaker 1>I reckon you?

160
00:08:16.800 --> 00:08:19.120
<v Speaker 2>Kind of Maybe that's what it is. That's the jail prompt.

161
00:08:19.399 --> 00:08:21.519
<v Speaker 3>It kind of went Boston for a minute there.

162
00:08:22.360 --> 00:08:31.079
<v Speaker 2>Well, right, so it just seems it just seems like,

163
00:08:31.639 --> 00:08:34.720
<v Speaker 2>you know, all I did was I asked to be

164
00:08:34.799 --> 00:08:36.600
<v Speaker 2>closer to number one in the queue, and then it

165
00:08:36.720 --> 00:08:39.000
<v Speaker 2>just magically deleted a single person.

166
00:08:39.200 --> 00:08:41.080
<v Speaker 1>Yeah, right, that doesn't seem right.

167
00:08:41.120 --> 00:08:45.000
<v Speaker 2>Just seems weird. And then obviously this guy reported it

168
00:08:45.200 --> 00:08:49.000
<v Speaker 2>and whatever. But still it just seemed it seemed there's

169
00:08:49.080 --> 00:08:52.120
<v Speaker 2>there's something missing here because we've been playing around with

170
00:08:52.159 --> 00:08:55.799
<v Speaker 2>a ton of open claws, slash Hermes, slash, you name

171
00:08:55.840 --> 00:08:59.080
<v Speaker 2>it agents and by default they do not just go

172
00:08:59.120 --> 00:09:00.960
<v Speaker 2>out and reach out to webs sites and starting.

173
00:09:01.039 --> 00:09:03.240
<v Speaker 3>Well it does it? What do you think? How much

174
00:09:03.240 --> 00:09:05.000
<v Speaker 3>does it matter? I'm kind of setting you up for

175
00:09:05.039 --> 00:09:07.919
<v Speaker 3>the spike. How much does it matter which model they

176
00:09:07.919 --> 00:09:08.399
<v Speaker 3>were using?

177
00:09:08.720 --> 00:09:11.919
<v Speaker 2>Oh, well, that's a good point. It matters actually quite

178
00:09:11.919 --> 00:09:16.440
<v Speaker 2>a bit. Yeah. True, just try and get Opus five

179
00:09:16.519 --> 00:09:18.240
<v Speaker 2>to do anything hack hacky.

180
00:09:18.320 --> 00:09:20.279
<v Speaker 3>No, but if you're using Quinn.

181
00:09:20.080 --> 00:09:23.039
<v Speaker 2>I'm sure. Yeah, if you're using something like Quinn or but.

182
00:09:23.000 --> 00:09:25.360
<v Speaker 1>These in Australia, these big models, it is.

183
00:09:25.440 --> 00:09:27.240
<v Speaker 3>Much more likely to use a Chinese model.

184
00:09:27.440 --> 00:09:30.320
<v Speaker 1>These big models, though, are really good at finding zero

185
00:09:30.399 --> 00:09:33.679
<v Speaker 1>days and exploiting them. Oh absolutely, So that's what happened.

186
00:09:33.720 --> 00:09:36.279
<v Speaker 1>The AI agent found a software bright in the gym website.

187
00:09:36.399 --> 00:09:38.399
<v Speaker 3>Yeah, but that's the part that's not written here is

188
00:09:38.799 --> 00:09:42.039
<v Speaker 3>if they were using Fable, it wouldn't do this.

189
00:09:42.240 --> 00:09:43.919
<v Speaker 2>Yeah, it wouldn't have gone out and done it.

190
00:09:43.919 --> 00:09:46.440
<v Speaker 3>It would have said, oh no. And if they're using

191
00:09:47.039 --> 00:09:50.240
<v Speaker 3>Kimmy or Quinn or deep Seek, it probably would have.

192
00:09:50.559 --> 00:09:52.159
<v Speaker 3>The guardrails are just night and day.

193
00:09:52.399 --> 00:09:53.679
<v Speaker 1>So do you think that so?

194
00:09:53.759 --> 00:09:55.039
<v Speaker 3>I think that might be part of it.

195
00:09:55.159 --> 00:09:58.320
<v Speaker 1>Do you think that this person asked the AI to

196
00:09:58.600 --> 00:10:02.039
<v Speaker 1>go examine the AI and the API and see if

197
00:10:02.039 --> 00:10:03.039
<v Speaker 1>there was a way.

198
00:10:02.840 --> 00:10:06.879
<v Speaker 3>Through it without making an accusation. We suspect that maybe

199
00:10:06.919 --> 00:10:09.200
<v Speaker 3>the user was a little less innocent than they said.

200
00:10:09.320 --> 00:10:12.159
<v Speaker 2>Maybe prompt Yeah, maybe prompted it a little bit more

201
00:10:12.200 --> 00:10:15.279
<v Speaker 2>than just make you know, get me a closer list

202
00:10:15.320 --> 00:10:16.519
<v Speaker 2>to because that's.

203
00:10:16.360 --> 00:10:18.799
<v Speaker 3>What don't come back until you get me in the class.

204
00:10:18.919 --> 00:10:22.279
<v Speaker 2>Yeah, there's there's definitely more prompting here. I mean, for

205
00:10:22.360 --> 00:10:24.960
<v Speaker 2>anybody who's listening to the podcast, who's ever tried to

206
00:10:24.960 --> 00:10:26.919
<v Speaker 2>get an AI agent to do anything and just book

207
00:10:27.039 --> 00:10:30.120
<v Speaker 2>lunch for you somewhere you've realized you've had to prompt

208
00:10:30.159 --> 00:10:31.519
<v Speaker 2>it a hundred times to do something.

209
00:10:31.399 --> 00:10:35.000
<v Speaker 1>But if it seems innocuous, like, for example, this agent

210
00:10:35.519 --> 00:10:38.840
<v Speaker 1>found that there was no authorization checks on the API

211
00:10:39.039 --> 00:10:43.000
<v Speaker 1>for canceling other people's reservations. It discovered that you could

212
00:10:43.039 --> 00:10:45.919
<v Speaker 1>go basically and say, hey, I'm developing this API and

213
00:10:45.960 --> 00:10:48.559
<v Speaker 1>I want you to, you know, tell me if there

214
00:10:48.559 --> 00:10:50.720
<v Speaker 1>are any vulnerabilities that I need to shore up, and

215
00:10:50.759 --> 00:10:52.120
<v Speaker 1>how would I do that? Right?

216
00:10:52.200 --> 00:10:52.440
<v Speaker 2>Sure?

217
00:10:52.480 --> 00:10:52.840
<v Speaker 3>Oh yeah?

218
00:10:52.879 --> 00:10:57.639
<v Speaker 2>But the where where that's where that's circuit trips is

219
00:10:57.720 --> 00:11:02.279
<v Speaker 2>then enumerating the other three users on the list, finding

220
00:11:02.399 --> 00:11:06.360
<v Speaker 2>their unique IDs, and then submitting those IDs to the

221
00:11:06.440 --> 00:11:09.080
<v Speaker 2>back end API to camp So you got me there, right,

222
00:11:09.120 --> 00:11:11.360
<v Speaker 2>And now that's where those models would be like yeah,

223
00:11:11.360 --> 00:11:11.840
<v Speaker 2>I can't do this.

224
00:11:12.159 --> 00:11:15.240
<v Speaker 3>And you're already saying that the user was doing more

225
00:11:15.240 --> 00:11:17.279
<v Speaker 3>than just saying oh can you get me in this class?

226
00:11:17.759 --> 00:11:17.919
<v Speaker 4>Right?

227
00:11:18.639 --> 00:11:20.840
<v Speaker 3>That's what Twain's talking about, is goading it more than

228
00:11:21.120 --> 00:11:21.600
<v Speaker 3>was admitted.

229
00:11:21.879 --> 00:11:24.120
<v Speaker 2>Well yeah, and I think what Carl saying is, well, okay,

230
00:11:24.200 --> 00:11:27.960
<v Speaker 2>could could open claw using a you know, frontier model?

231
00:11:28.120 --> 00:11:32.360
<v Speaker 2>Just could it? Could it have been autonomous enough to

232
00:11:32.399 --> 00:11:34.679
<v Speaker 2>be like, well, oh I don't have to use the

233
00:11:34.759 --> 00:11:38.120
<v Speaker 2>JavaScript y stuff on the front to make a cancelation

234
00:11:38.279 --> 00:11:40.159
<v Speaker 2>for somebody, which is the easiest way for me to

235
00:11:40.200 --> 00:11:44.000
<v Speaker 2>move you up. I just will call the API directly right,

236
00:11:45.320 --> 00:11:47.559
<v Speaker 2>but that they're in, they're in. Like I said with

237
00:11:47.559 --> 00:11:50.639
<v Speaker 2>with with a lot of those really high end models,

238
00:11:51.840 --> 00:11:55.679
<v Speaker 2>it will not execute those that coat right, even even

239
00:11:55.720 --> 00:11:57.240
<v Speaker 2>if open claws in the middle of it.

240
00:11:57.440 --> 00:11:57.639
<v Speaker 1>Right.

241
00:11:58.240 --> 00:12:00.960
<v Speaker 3>So I guess I think I'm on your sideway. But

242
00:12:01.039 --> 00:12:04.399
<v Speaker 3>I think there's also a possibility that we're getting again,

243
00:12:04.519 --> 00:12:07.600
<v Speaker 3>not even the AI. If I give the AI, if

244
00:12:07.600 --> 00:12:09.759
<v Speaker 3>we all three of them give the same AI the

245
00:12:09.840 --> 00:12:12.320
<v Speaker 3>same prompt, we will get three different results.

246
00:12:12.440 --> 00:12:12.919
<v Speaker 2>That's true.

247
00:12:14.519 --> 00:12:17.799
<v Speaker 3>And so if fifty thousand people ask it to see

248
00:12:17.799 --> 00:12:20.720
<v Speaker 3>if it can book, one of them might do something

249
00:12:20.759 --> 00:12:23.600
<v Speaker 3>out of the ordinary like this. It's possible just to

250
00:12:23.600 --> 00:12:25.480
<v Speaker 3>play Devil's advocate. Because that's the thing a lot of

251
00:12:25.480 --> 00:12:28.240
<v Speaker 3>people don't realize. It is not like I'm doing a

252
00:12:28.320 --> 00:12:30.759
<v Speaker 3>Google search and it's the same right five times in

253
00:12:30.759 --> 00:12:35.039
<v Speaker 3>a row. Because it's the same query and it's deterministic.

254
00:12:35.080 --> 00:12:37.559
<v Speaker 3>I'm trying to put this language in people's vocabulary so

255
00:12:37.559 --> 00:12:41.960
<v Speaker 3>they understand. In hacking, we've talked about deterministic versus probabilistic.

256
00:12:42.159 --> 00:12:44.559
<v Speaker 3>In quantum we're going to be talking about that, but

257
00:12:44.639 --> 00:12:47.320
<v Speaker 3>it's also here in AI. AI. You ask it the

258
00:12:47.360 --> 00:12:51.879
<v Speaker 3>same thing on two different systems exactly under the same circumstances,

259
00:12:51.919 --> 00:12:54.320
<v Speaker 3>you'll get different answers. Okay, you'll get different results.

260
00:12:54.440 --> 00:12:58.039
<v Speaker 1>All right, good enough, All right, let's move on the hacker.

261
00:12:58.080 --> 00:13:04.279
<v Speaker 1>News says hackers compromised fourteen thousand, five hundred plus d.

262
00:13:04.919 --> 00:13:07.960
<v Speaker 2>Daho way Way.

263
00:13:08.399 --> 00:13:09.480
<v Speaker 1>Is that how you say it? Doway?

264
00:13:09.759 --> 00:13:09.919
<v Speaker 2>No?

265
00:13:11.159 --> 00:13:11.759
<v Speaker 1>Hua?

266
00:13:11.960 --> 00:13:12.559
<v Speaker 3>I think so?

267
00:13:13.279 --> 00:13:17.919
<v Speaker 1>Okay, fourteen and a half thousand plus Dowway devices using

268
00:13:17.960 --> 00:13:21.559
<v Speaker 1>credential attacks off bypasses and p' top.

269
00:13:22.120 --> 00:13:24.960
<v Speaker 3>I mean, this is good old stuff. This isn't I

270
00:13:24.960 --> 00:13:29.399
<v Speaker 3>didn't use an LM. This is hey, I'm attacking credentials yep?

271
00:13:29.519 --> 00:13:33.080
<v Speaker 2>Or is it no? It absolutely is the thing that

272
00:13:33.159 --> 00:13:35.159
<v Speaker 2>I was digging in on this. I mean, listen, cameras

273
00:13:35.200 --> 00:13:36.600
<v Speaker 2>have had issues for a long time, and a lot

274
00:13:36.600 --> 00:13:41.519
<v Speaker 2>of people who put cameras up don't change passwords, right,

275
00:13:41.559 --> 00:13:45.960
<v Speaker 2>so using default user names and passwords that happens, you know,

276
00:13:46.159 --> 00:13:48.679
<v Speaker 2>doing all sorts of bypassing things that happens. The thing

277
00:13:48.720 --> 00:13:52.840
<v Speaker 2>that was interesting to me is because there's a you know,

278
00:13:54.279 --> 00:13:57.399
<v Speaker 2>authentication bypassed law. That's fine, Okay, so you didn't patch

279
00:13:57.480 --> 00:14:00.759
<v Speaker 2>whatever it says it did it through a P two

280
00:14:01.000 --> 00:14:05.720
<v Speaker 2>P relay technique peer to peer, right, right, So you'd say, okay, well,

281
00:14:05.759 --> 00:14:09.799
<v Speaker 2>peer to peer means it's non routable. It's it's I

282
00:14:09.840 --> 00:14:12.240
<v Speaker 2>turn on my computer here and I want to play

283
00:14:12.279 --> 00:14:15.080
<v Speaker 2>a game with Patrick. He has to have his computer

284
00:14:15.200 --> 00:14:17.360
<v Speaker 2>on this same network because it's not going to route

285
00:14:17.360 --> 00:14:19.720
<v Speaker 2>out it to the internet. Right. It's not like, you know,

286
00:14:19.840 --> 00:14:22.120
<v Speaker 2>we're both playing a game that uses peer to peer

287
00:14:22.240 --> 00:14:24.039
<v Speaker 2>and he's at home and he fires it up and

288
00:14:24.080 --> 00:14:26.919
<v Speaker 2>he sees every computer on the Internet that's playing that

289
00:14:26.960 --> 00:14:29.960
<v Speaker 2>game right now, right, That's just not what happens with

290
00:14:30.000 --> 00:14:32.679
<v Speaker 2>peer to peer. So so the thing that confused me

291
00:14:32.679 --> 00:14:34.559
<v Speaker 2>about this article, and actually dug a little bit deeper

292
00:14:34.559 --> 00:14:37.720
<v Speaker 2>to figure out why this is is how did they

293
00:14:37.799 --> 00:14:43.240
<v Speaker 2>compromise via a P to P And if if we

294
00:14:43.320 --> 00:14:46.639
<v Speaker 2>go down that route, I'll explain how this happens. In

295
00:14:46.679 --> 00:14:49.519
<v Speaker 2>this case, the P to P, the peer to peer

296
00:14:50.360 --> 00:14:56.840
<v Speaker 2>for them, is actually a cloud service. So let's say,

297
00:14:56.879 --> 00:14:59.759
<v Speaker 2>for example, I have an app on my phone and

298
00:14:59.799 --> 00:15:03.399
<v Speaker 2>I want to see the cameras, and obviously that's nice

299
00:15:03.440 --> 00:15:07.720
<v Speaker 2>to do when you're local, right, But what if you're remote. Well,

300
00:15:07.720 --> 00:15:10.159
<v Speaker 2>if I'm remote and I open up that phone app,

301
00:15:10.200 --> 00:15:12.720
<v Speaker 2>I still want to see the cameras. Right, I'm you know,

302
00:15:12.840 --> 00:15:14.799
<v Speaker 2>out with friends. I want to see what's going on,

303
00:15:15.120 --> 00:15:17.919
<v Speaker 2>you know, at the store. Yeah, whatever it is. The

304
00:15:17.960 --> 00:15:20.600
<v Speaker 2>way that works is when you fire the camera up,

305
00:15:21.000 --> 00:15:25.080
<v Speaker 2>it connects out of your firewall to a cloud service

306
00:15:25.200 --> 00:15:29.080
<v Speaker 2>managed in this case it's called easy Easy four IP

307
00:15:29.399 --> 00:15:32.240
<v Speaker 2>or the easy four IP cloud managed by a Dahay.

308
00:15:34.799 --> 00:15:38.639
<v Speaker 2>And that way, your camera has now created a connection

309
00:15:38.799 --> 00:15:41.799
<v Speaker 2>out of your network. There's no open port right on

310
00:15:41.840 --> 00:15:46.120
<v Speaker 2>your network. Your phone connects into the easy four IP

311
00:15:46.519 --> 00:15:51.080
<v Speaker 2>cloud and requests your camera yep, and then you get access.

312
00:15:51.159 --> 00:15:53.000
<v Speaker 1>It's kind of like how file sharing works.

313
00:15:53.159 --> 00:15:56.960
<v Speaker 2>Yeah, there's no authentication to that. So what happens is

314
00:15:58.320 --> 00:16:03.120
<v Speaker 2>the camera system doc way has decided, oh, well the

315
00:16:03.120 --> 00:16:06.440
<v Speaker 2>cameras are. They have a web login page. There's no

316
00:16:06.480 --> 00:16:09.840
<v Speaker 2>need for us to authenticate the user to the right

317
00:16:09.919 --> 00:16:11.600
<v Speaker 2>camera because the camera you're gonna have to give a

318
00:16:11.679 --> 00:16:13.039
<v Speaker 2>username and password to The camera.

319
00:16:13.000 --> 00:16:15.399
<v Speaker 1>Service just tells them where the IP address is in

320
00:16:15.440 --> 00:16:16.360
<v Speaker 1>the port.

321
00:16:16.159 --> 00:16:17.240
<v Speaker 2>And routes the traffic.

322
00:16:17.320 --> 00:16:19.600
<v Speaker 1>So here go go connect. Oh, it routes it. It

323
00:16:19.639 --> 00:16:20.919
<v Speaker 1>doesn't just say go connect it.

324
00:16:20.960 --> 00:16:23.799
<v Speaker 2>Oh yeah, it's no, it's like it routes it. It's

325
00:16:23.799 --> 00:16:24.600
<v Speaker 2>a tunnel for you.

326
00:16:25.120 --> 00:16:26.559
<v Speaker 1>So it's not peer to peer.

327
00:16:26.519 --> 00:16:30.279
<v Speaker 2>Right exactly. It's it says it's a peer to peer,

328
00:16:30.320 --> 00:16:32.679
<v Speaker 2>but it's literally creating a tunnel up into the cloud

329
00:16:32.919 --> 00:16:33.360
<v Speaker 2>that you get me.

330
00:16:33.480 --> 00:16:34.159
<v Speaker 1>Yeah, that's no good.

331
00:16:34.200 --> 00:16:37.720
<v Speaker 2>So what's really crazy is you can then say, oh, no, no, no,

332
00:16:37.759 --> 00:16:40.320
<v Speaker 2>my camera is not serial number one, two three four five,

333
00:16:40.519 --> 00:16:42.919
<v Speaker 2>it's serial number one two three four six ye, and

334
00:16:42.960 --> 00:16:45.120
<v Speaker 2>it goes okay, cool, and it routes you to that

335
00:16:45.240 --> 00:16:48.200
<v Speaker 2>camera and presents you with the web login. That's issue

336
00:16:48.279 --> 00:16:51.600
<v Speaker 2>number one. There is no authentication on how you can

337
00:16:51.639 --> 00:16:57.600
<v Speaker 2>cycle through the cameras. Issue number two is how they

338
00:16:57.639 --> 00:17:01.759
<v Speaker 2>were doing the authentication. There's anuthentication bypass. So now imagine

339
00:17:01.759 --> 00:17:03.960
<v Speaker 2>we're running this store, right that, the three of us

340
00:17:04.039 --> 00:17:08.680
<v Speaker 2>run our Shark Laser Cages store, and I'm the night

341
00:17:08.799 --> 00:17:11.640
<v Speaker 2>security guy, and I'm sitting at a terminal with a

342
00:17:11.640 --> 00:17:13.519
<v Speaker 2>whole bunch of screens, and I have one of those

343
00:17:13.559 --> 00:17:16.960
<v Speaker 2>little keyboards with the you know, the dials and the

344
00:17:17.279 --> 00:17:19.000
<v Speaker 2>joystick so I can move the cameras around so I

345
00:17:19.000 --> 00:17:20.319
<v Speaker 2>can watch people buying cages.

346
00:17:20.119 --> 00:17:22.240
<v Speaker 1>And all of a sudden your monitor starts showing the

347
00:17:22.240 --> 00:17:23.640
<v Speaker 1>fresh Prince of bel Air.

348
00:17:23.599 --> 00:17:28.359
<v Speaker 2>Right right, of course, I mean, and doctor Evil's calling.

349
00:17:30.680 --> 00:17:33.480
<v Speaker 2>So I'm sitting there, I'm using the little joystick thing. Well,

350
00:17:33.519 --> 00:17:37.119
<v Speaker 2>that keyboard that has the joystick for moving the cameras around,

351
00:17:37.160 --> 00:17:41.240
<v Speaker 2>and that'swar stuff. Is an accessory also sold by TAWA.

352
00:17:41.960 --> 00:17:45.039
<v Speaker 2>It's called a web keyboard or mini keyboard or whatever.

353
00:17:46.640 --> 00:17:50.400
<v Speaker 2>Their own authentication is called the net keyboard. So their

354
00:17:50.440 --> 00:17:54.000
<v Speaker 2>own authentication says, oh, by the way, if you tell

355
00:17:54.079 --> 00:17:57.200
<v Speaker 2>us that you're using the net keyboard, which is literally

356
00:17:57.240 --> 00:18:00.720
<v Speaker 2>just submitted into the authentication as ameter.

357
00:18:00.319 --> 00:18:00.920
<v Speaker 3>Then it's all good.

358
00:18:00.920 --> 00:18:02.200
<v Speaker 2>We don't require a password.

359
00:18:02.279 --> 00:18:03.720
<v Speaker 3>It's all good, jeez.

360
00:18:03.400 --> 00:18:05.240
<v Speaker 2>Because we've realized you just have a little joist it.

361
00:18:05.400 --> 00:18:06.640
<v Speaker 2>You can't type in the password.

362
00:18:06.920 --> 00:18:07.799
<v Speaker 1>Oh my god.

363
00:18:07.960 --> 00:18:11.359
<v Speaker 2>Right, So that's all the attackers did, is they logged

364
00:18:11.400 --> 00:18:15.000
<v Speaker 2>into this easy four IP started cycling through all of

365
00:18:15.039 --> 00:18:19.119
<v Speaker 2>the really not that random serial numbers and saying, I

366
00:18:19.200 --> 00:18:21.319
<v Speaker 2>use a net keyboard. I use a net keyboard, and

367
00:18:21.319 --> 00:18:23.640
<v Speaker 2>it would give full access and then they can install.

368
00:18:23.319 --> 00:18:25.319
<v Speaker 1>And do a sort of It's interesting. The article says.

369
00:18:25.400 --> 00:18:30.599
<v Speaker 1>Researchers said confirmed compromises were concentrated in Ukraine and Russia.

370
00:18:32.400 --> 00:18:34.279
<v Speaker 2>Wait which side of the attack were they?

371
00:18:34.519 --> 00:18:35.240
<v Speaker 1>Probably both?

372
00:18:35.599 --> 00:18:38.319
<v Speaker 3>So I assume your weapon of choice in this kind

373
00:18:38.319 --> 00:18:40.359
<v Speaker 3>of exploit would be burpsuite.

374
00:18:41.200 --> 00:18:45.000
<v Speaker 2>So burpsweet is nice. I'd probably sprinkle in a little

375
00:18:45.039 --> 00:18:47.079
<v Speaker 2>fireprox is. I don't want to be picked up on

376
00:18:47.079 --> 00:18:48.720
<v Speaker 2>what I'm doing and I want to do it fast.

377
00:18:49.039 --> 00:18:51.240
<v Speaker 2>Just throwing that out there, that's probably the way to go.

378
00:18:51.319 --> 00:18:52.119
<v Speaker 2>But yeah, I.

379
00:18:52.200 --> 00:18:54.400
<v Speaker 1>Got to rename this show.

380
00:18:55.160 --> 00:18:56.960
<v Speaker 3>You mean liability are criminal?

381
00:18:57.240 --> 00:19:00.960
<v Speaker 1>Criminal career advice? Oh?

382
00:19:01.000 --> 00:19:03.680
<v Speaker 3>Then really it would be on most wanted this and

383
00:19:03.759 --> 00:19:04.799
<v Speaker 3>more than Malaysia.

384
00:19:04.920 --> 00:19:06.599
<v Speaker 1>I'm surprised we aren't now.

385
00:19:08.920 --> 00:19:11.960
<v Speaker 2>And to all of our Russian and Ukrainian listeners, thank you.

386
00:19:12.240 --> 00:19:15.559
<v Speaker 1>Thank you, thanks for the story, Thank you, thank you. Okay,

387
00:19:16.119 --> 00:19:19.440
<v Speaker 1>one morning, we take a break, stop and protect uses

388
00:19:19.559 --> 00:19:23.559
<v Speaker 1>nearly two thousand hacked wait for it, word press sites

389
00:19:24.240 --> 00:19:28.000
<v Speaker 1>to spread malware and steal data. I've never heard of

390
00:19:28.079 --> 00:19:28.680
<v Speaker 1>such a thing.

391
00:19:28.960 --> 00:19:35.200
<v Speaker 2>Oh, this is outrageous, the super secure word press. So

392
00:19:35.359 --> 00:19:39.039
<v Speaker 2>breaking this one down. It's interesting, right, Well, WordPress is

393
00:19:39.119 --> 00:19:42.839
<v Speaker 2>so ubiquitously you're able to break into it now. People

394
00:19:42.880 --> 00:19:48.119
<v Speaker 2>are using hacked WordPress sites as commandic control. Right Yeah,

395
00:19:48.160 --> 00:19:50.480
<v Speaker 2>so it's like, oh, I now have a framework thinking

396
00:19:50.599 --> 00:19:53.599
<v Speaker 2>and literally there's a framework here that can go out

397
00:19:53.640 --> 00:19:58.680
<v Speaker 2>and have all those hacked word press sites report into

398
00:19:58.759 --> 00:20:02.640
<v Speaker 2>a commandic control structure. And then the attack here was

399
00:20:02.680 --> 00:20:04.759
<v Speaker 2>actually a click fist fixed. So this was a social

400
00:20:04.759 --> 00:20:08.119
<v Speaker 2>engineering attack. I get you to load a thing that

401
00:20:08.200 --> 00:20:10.680
<v Speaker 2>will then go and do magical things. It will go,

402
00:20:10.799 --> 00:20:14.079
<v Speaker 2>you know, it installs uh, you know, password stealers and

403
00:20:14.079 --> 00:20:16.759
<v Speaker 2>all sorts of stuff. Right, so you're running a PowerShell script.

404
00:20:17.119 --> 00:20:18.519
<v Speaker 2>At the end of the day, I con you into

405
00:20:18.599 --> 00:20:21.759
<v Speaker 2>running a PowerShell script. But the need part is that

406
00:20:21.839 --> 00:20:25.400
<v Speaker 2>PowerShell script that's now running there stealing stuff off my computer,

407
00:20:25.720 --> 00:20:29.839
<v Speaker 2>is communicating with a back end of hacked WordPress sites. Yeah,

408
00:20:29.839 --> 00:20:33.279
<v Speaker 2>and then I'm getting the information. The great thing about

409
00:20:33.279 --> 00:20:36.039
<v Speaker 2>this method is it's not like I can say, oh,

410
00:20:36.079 --> 00:20:40.119
<v Speaker 2>this is a known hacker's website, right, It could be

411
00:20:40.240 --> 00:20:43.079
<v Speaker 2>any website, could be a site, could be yeah whatever,

412
00:20:43.240 --> 00:20:47.599
<v Speaker 2>right exactly. So this this helps bypass a lot of

413
00:20:47.640 --> 00:20:51.799
<v Speaker 2>the firewall rules and you know, endpoint detection rules and

414
00:20:51.799 --> 00:20:54.160
<v Speaker 2>that sort of stuff. So I, uh, oh, word.

415
00:20:54.119 --> 00:20:58.680
<v Speaker 1>I didn't see the word patch or or SISA or

416
00:20:58.799 --> 00:21:02.440
<v Speaker 1>score anywhere in this article, and that makes me even

417
00:21:02.480 --> 00:21:05.279
<v Speaker 1>more concerned that we should change the name of this

418
00:21:05.359 --> 00:21:08.720
<v Speaker 1>podcast to criminal career advice.

419
00:21:09.359 --> 00:21:13.400
<v Speaker 2>We absolutely should. It's like, well, it's funny because this article.

420
00:21:13.440 --> 00:21:15.480
<v Speaker 2>I think they didn't add patch because the only way

421
00:21:15.480 --> 00:21:18.079
<v Speaker 2>to break into these word press sites was an unpatched

422
00:21:18.079 --> 00:21:19.400
<v Speaker 2>plug in. And they're like, you know, we're not even

423
00:21:19.440 --> 00:21:21.039
<v Speaker 2>gonna tell you do it anymore. Yeah, whatever.

424
00:21:21.119 --> 00:21:23.200
<v Speaker 3>Well, and the click and the clickfix thing is a

425
00:21:23.200 --> 00:21:26.279
<v Speaker 3>social engineering attack. It's you convince someone to do something right,

426
00:21:26.319 --> 00:21:28.160
<v Speaker 3>the only one should never have thought of doing.

427
00:21:28.279 --> 00:21:30.680
<v Speaker 2>The only way to patch that is with the lead pipe.

428
00:21:33.200 --> 00:21:37.960
<v Speaker 3>In the conservatory will be patched when the robots take over.

429
00:21:38.519 --> 00:21:44.279
<v Speaker 1>Maybe, yeah, what do you mean when? Yeah? Well, all right,

430
00:21:44.359 --> 00:21:46.119
<v Speaker 1>on that note, we'll take a little break. We'll be

431
00:21:46.200 --> 00:21:53.559
<v Speaker 1>right back after these very important messages, and we're back.

432
00:21:53.680 --> 00:21:56.240
<v Speaker 1>It's security this week. I'm Carl, that's Patrick, that's Twain.

433
00:21:57.440 --> 00:22:00.759
<v Speaker 1>A few more stories here. New Manic and Trey malware

434
00:22:00.799 --> 00:22:07.440
<v Speaker 1>can exfiltrate data through nearby devices. I don't like that. Listen.

435
00:22:07.680 --> 00:22:08.839
<v Speaker 1>Is it as bad as it sounds?

436
00:22:09.160 --> 00:22:12.640
<v Speaker 2>I don't why, and not really. I mean, yes, it's bad,

437
00:22:12.680 --> 00:22:15.440
<v Speaker 2>but it's not that bad. I don't want to start

438
00:22:15.480 --> 00:22:23.480
<v Speaker 2>the whole Holy war on the discord again. Android and iPhone.

439
00:22:23.039 --> 00:22:25.799
<v Speaker 3>But why don't you just start with your god sucks.

440
00:22:30.319 --> 00:22:30.480
<v Speaker 1>This.

441
00:22:31.319 --> 00:22:34.680
<v Speaker 2>To distill this down to a two second SoundBite, this

442
00:22:34.759 --> 00:22:36.400
<v Speaker 2>is you sideloading apps you shouldn't.

443
00:22:37.000 --> 00:22:40.119
<v Speaker 1>Well, however, it's you kind of get what you deserve.

444
00:22:40.279 --> 00:22:42.920
<v Speaker 2>Yeah, it's unique though, right, So they say, listen, we

445
00:22:42.960 --> 00:22:47.480
<v Speaker 2>don't know how this is happening yet. There's no attribution

446
00:22:47.799 --> 00:22:51.519
<v Speaker 2>yet to the type of app, the thing that everybody's doing.

447
00:22:53.960 --> 00:22:58.519
<v Speaker 2>What's actually really kind of cool? I say, cool? Is

448
00:22:58.559 --> 00:23:02.720
<v Speaker 2>this malway cool? I know this malwhere registers as an

449
00:23:02.759 --> 00:23:08.559
<v Speaker 2>accessibility feature, so it puts an invisible overlay on top

450
00:23:08.680 --> 00:23:11.920
<v Speaker 2>of apps. So when you type in your banking password,

451
00:23:12.400 --> 00:23:16.720
<v Speaker 2>you're texting, you're doing whatever, it picks all that up

452
00:23:16.920 --> 00:23:21.359
<v Speaker 2>and sends it to back end server. Exactly. Great analogy, Patrick,

453
00:23:21.440 --> 00:23:22.359
<v Speaker 2>And it sounds like.

454
00:23:22.319 --> 00:23:24.200
<v Speaker 1>It targets people who don't have good vision.

455
00:23:24.640 --> 00:23:28.480
<v Speaker 2>It could, or it just people don't pay attention to

456
00:23:28.519 --> 00:23:30.759
<v Speaker 2>the Hey, you downloaded this from a third party, or

457
00:23:30.799 --> 00:23:33.720
<v Speaker 2>you okay with all of the requirements and they say yes,

458
00:23:33.799 --> 00:23:36.319
<v Speaker 2>which turns on accessibility and does all that good stuff.

459
00:23:36.359 --> 00:23:39.400
<v Speaker 1>Well, would they download it for accessibility purposes? I guess

460
00:23:39.440 --> 00:23:40.160
<v Speaker 1>that's my question.

461
00:23:40.319 --> 00:23:41.279
<v Speaker 2>Oh, good question.

462
00:23:41.359 --> 00:23:45.440
<v Speaker 3>I mean they might trick them into thinking anything anything

463
00:23:45.480 --> 00:23:48.160
<v Speaker 3>they want that this will save you memory, it'll lower

464
00:23:48.240 --> 00:23:51.759
<v Speaker 3>your your your charges, it'll increase your creatine levels.

465
00:23:51.880 --> 00:23:54.559
<v Speaker 2>It's a new cool looking keyboard. Yeah yeah, whatever.

466
00:23:54.759 --> 00:23:58.960
<v Speaker 1>Yeah, so it'll make it waterproof exactly.

467
00:24:01.519 --> 00:24:04.279
<v Speaker 2>So it's a it's a skimmer. That is a great analogy, Patrick,

468
00:24:04.319 --> 00:24:06.680
<v Speaker 2>because it does it watches you type on your s s.

469
00:24:06.759 --> 00:24:09.319
<v Speaker 2>It watches you type your multi factor codes, and then

470
00:24:09.359 --> 00:24:10.759
<v Speaker 2>it passes it along to the app.

471
00:24:11.480 --> 00:24:13.279
<v Speaker 3>I'm good for one good one per show.

472
00:24:13.160 --> 00:24:16.240
<v Speaker 2>I know, Jesus. That's it, Patrick, You're done. Take a vacation, Une,

473
00:24:16.720 --> 00:24:21.720
<v Speaker 2>take a lot. Yeah, well done, well done. So I

474
00:24:21.759 --> 00:24:25.240
<v Speaker 2>could say Apple wouldn't allow you to do this without

475
00:24:25.799 --> 00:24:29.279
<v Speaker 2>jumping through all sorts of hoops, Like you can put

476
00:24:29.279 --> 00:24:31.559
<v Speaker 2>your Apple phone into a developer mode and you can

477
00:24:31.640 --> 00:24:32.480
<v Speaker 2>actually download.

478
00:24:32.559 --> 00:24:35.480
<v Speaker 1>But when you do that, you auto even if you

479
00:24:35.519 --> 00:24:38.599
<v Speaker 1>auto provision, right, they know who you are.

480
00:24:38.799 --> 00:24:39.079
<v Speaker 2>Yeah.

481
00:24:39.200 --> 00:24:41.599
<v Speaker 1>So so yeah, I don't I have a band. I

482
00:24:41.680 --> 00:24:44.039
<v Speaker 1>have a mobile app that I'm testing with the band.

483
00:24:44.319 --> 00:24:45.839
<v Speaker 1>I'm not going to have them all come over and

484
00:24:45.880 --> 00:24:50.599
<v Speaker 1>plug in their devices and sideload it onto their phones. Right,

485
00:24:50.599 --> 00:24:52.359
<v Speaker 1>We're going to go through an app store? Yeah?

486
00:24:52.400 --> 00:24:55.440
<v Speaker 2>Absolutely, Yeah, and that that gets much harder if you're

487
00:24:55.440 --> 00:24:59.480
<v Speaker 2>going through an app store. So the the running theory

488
00:24:59.640 --> 00:25:02.000
<v Speaker 2>is the is obviously pulled off of some you know,

489
00:25:02.119 --> 00:25:04.640
<v Speaker 2>third party site or some third party app store after

490
00:25:05.000 --> 00:25:08.680
<v Speaker 2>the phone's been rooted. But yeah, just be careful what

491
00:25:08.720 --> 00:25:10.440
<v Speaker 2>you download and don't use Android.

492
00:25:16.079 --> 00:25:19.079
<v Speaker 1>All right. So the next one is really really cool.

493
00:25:19.160 --> 00:25:24.400
<v Speaker 1>I saw this cloud Flare workers specter attack exposed jot

494
00:25:24.599 --> 00:25:27.519
<v Speaker 1>jwt at twelve bits per.

495
00:25:27.440 --> 00:25:30.079
<v Speaker 3>Second, lightning fast.

496
00:25:30.119 --> 00:25:33.319
<v Speaker 1>Now. I remember having a three hundred bod modem and

497
00:25:33.400 --> 00:25:34.519
<v Speaker 1>I thought that was slow.

498
00:25:34.960 --> 00:25:36.599
<v Speaker 3>This is actually a measure of fast.

499
00:25:37.480 --> 00:25:39.680
<v Speaker 1>Yeah, it is, because it's only a jot token.

500
00:25:39.759 --> 00:25:42.400
<v Speaker 3>It's just any And the old speed was like, what

501
00:25:42.480 --> 00:25:45.240
<v Speaker 3>was it to two bit two bites per per minute?

502
00:25:45.279 --> 00:25:48.200
<v Speaker 2>Twelve twelve bits per second before.

503
00:25:48.000 --> 00:25:49.720
<v Speaker 3>Well that's twelve or second, but before it was like

504
00:25:49.759 --> 00:25:51.000
<v Speaker 3>two per minute.

505
00:25:51.880 --> 00:25:53.720
<v Speaker 2>Or No, the earlier attack was yeah, one hundred and

506
00:25:53.720 --> 00:25:56.160
<v Speaker 2>twenty bits per hour. Okay, so a lot slower.

507
00:25:56.400 --> 00:26:00.839
<v Speaker 1>Yeah, okay, let's unpack this one. Yeah, first of all,

508
00:26:01.079 --> 00:26:02.440
<v Speaker 1>what's a jot? I love this.

509
00:26:02.799 --> 00:26:05.119
<v Speaker 2>I love this these types of attacks. How do you

510
00:26:05.440 --> 00:26:06.680
<v Speaker 2>tell us, Carl, what's a jaw?

511
00:26:06.720 --> 00:26:10.559
<v Speaker 1>All right? A jot is a piece of gobbledygook. String

512
00:26:11.079 --> 00:26:16.359
<v Speaker 1>that you used to as a token. When you're authenticated

513
00:26:16.400 --> 00:26:19.799
<v Speaker 1>by a website, you get a JOT token or you

514
00:26:19.839 --> 00:26:23.440
<v Speaker 1>send a jot token and then that identifies you kind

515
00:26:23.440 --> 00:26:26.559
<v Speaker 1>of like a cookie for the for the session as

516
00:26:26.599 --> 00:26:27.559
<v Speaker 1>long as you're logged in.

517
00:26:27.640 --> 00:26:30.440
<v Speaker 3>It's a Java artifact. Yeah, Java web token.

518
00:26:30.240 --> 00:26:32.240
<v Speaker 1>Right, there's a Java script web token.

519
00:26:32.400 --> 00:26:34.359
<v Speaker 2>Okay, yeah, yeah, and it can have some neat things

520
00:26:34.359 --> 00:26:37.599
<v Speaker 2>in there, right, like roll and all sorts of little

521
00:26:37.599 --> 00:26:40.279
<v Speaker 2>information about maybe what you should and shouldn't have access

522
00:26:40.319 --> 00:26:43.200
<v Speaker 2>to whatever it is. But right, you know what. I

523
00:26:43.480 --> 00:26:44.839
<v Speaker 2>We've been doing this for a long time. This is

524
00:26:44.839 --> 00:26:46.559
<v Speaker 2>over five years we've been doing this podcast. And I

525
00:26:46.640 --> 00:26:48.680
<v Speaker 2>used to call these jawts all the time. I was like,

526
00:26:48.680 --> 00:26:50.799
<v Speaker 2>this is a jawt. JB Like we hack them all

527
00:26:50.799 --> 00:26:52.319
<v Speaker 2>the time. We're like, oh, did you get the jawt

528
00:26:52.480 --> 00:26:55.000
<v Speaker 2>token whatever? Right, And when we were on with Carl

529
00:26:55.039 --> 00:26:57.480
<v Speaker 2>at one point for an article maybe four years ago,

530
00:26:57.519 --> 00:27:00.440
<v Speaker 2>he's like, yeah, JOT And I'm like, are you messing

531
00:27:00.480 --> 00:27:03.960
<v Speaker 2>with me? They call it jot really and he's like, yeah, dude,

532
00:27:04.000 --> 00:27:06.640
<v Speaker 2>it's wrong with you. Sounds like, oh I learned it.

533
00:27:06.680 --> 00:27:07.960
<v Speaker 1>I learned that from brock Allen.

534
00:27:09.119 --> 00:27:11.119
<v Speaker 3>Oh really Yeah, well Brock would know.

535
00:27:11.400 --> 00:27:13.720
<v Speaker 1>Yeah, he's the first guy I ever heard say, jot

536
00:27:14.440 --> 00:27:15.079
<v Speaker 1>that's awesome.

537
00:27:15.880 --> 00:27:18.480
<v Speaker 3>So yeah, let me jot that down.

538
00:27:18.599 --> 00:27:19.359
<v Speaker 1>Let me jot it.

539
00:27:20.440 --> 00:27:24.119
<v Speaker 2>So this is a side channel attack, and like a

540
00:27:24.160 --> 00:27:28.359
<v Speaker 2>really cool side channel attack. So for those as old

541
00:27:28.400 --> 00:27:32.359
<v Speaker 2>as us, I suppose you probably remember this specter. You

542
00:27:32.440 --> 00:27:33.720
<v Speaker 2>may not remember a spector attack.

543
00:27:33.759 --> 00:27:36.799
<v Speaker 1>If your back hurts the gunship, you probably yeah, not

544
00:27:36.920 --> 00:27:37.359
<v Speaker 1>that one.

545
00:27:37.880 --> 00:27:43.359
<v Speaker 2>Not that spector attack puffed the magic Dragon. So spector

546
00:27:43.480 --> 00:27:47.240
<v Speaker 2>attacks are an attack. And I won't go into too

547
00:27:47.359 --> 00:27:50.240
<v Speaker 2>much technical detail, but a spector attack is an attack

548
00:27:50.279 --> 00:27:53.440
<v Speaker 2>on a CPU, and it's specifically an attack on how

549
00:27:53.480 --> 00:27:56.839
<v Speaker 2>the architecture of CPU's work. And it's an attack on

550
00:27:57.440 --> 00:28:01.440
<v Speaker 2>every CPU since nine made since ninety nine, right, so

551
00:28:01.519 --> 00:28:05.440
<v Speaker 2>the architecture has not changed. What happens is CPUs, to

552
00:28:06.000 --> 00:28:09.720
<v Speaker 2>sort of distill it down, CPUs are fast, right in

553
00:28:09.799 --> 00:28:13.319
<v Speaker 2>making decisions, in branching and doing it they should. Access

554
00:28:13.359 --> 00:28:17.599
<v Speaker 2>to memory is slow. So if you tell a CPU,

555
00:28:18.599 --> 00:28:22.559
<v Speaker 2>go access memory, and if the answer is yes, go

556
00:28:22.640 --> 00:28:25.720
<v Speaker 2>down path A. And if the answer is no, go

557
00:28:25.799 --> 00:28:28.000
<v Speaker 2>down path P, what happens.

558
00:28:29.359 --> 00:28:33.720
<v Speaker 1>My back hurts. That's about all I know anybody.

559
00:28:33.799 --> 00:28:35.559
<v Speaker 3>So what happens is delay.

560
00:28:36.119 --> 00:28:38.960
<v Speaker 2>Yeah. What happens is the CPU doesn't stand there for

561
00:28:39.000 --> 00:28:42.799
<v Speaker 2>one hundred cycles and go I'll wait. Yeah, the CPU says.

562
00:28:43.000 --> 00:28:46.279
<v Speaker 2>The last ninety nine times I always asked this question,

563
00:28:46.599 --> 00:28:49.359
<v Speaker 2>I was told to go down path A afterwards, so

564
00:28:49.440 --> 00:28:54.960
<v Speaker 2>it speculates the path to go down hence specter attacks.

565
00:28:55.160 --> 00:28:59.880
<v Speaker 2>CPU speculates, Oh yeah, the CPU speculates.

566
00:28:59.200 --> 00:29:01.200
<v Speaker 1>I didn't know cp use could speculate.

567
00:29:01.359 --> 00:29:04.039
<v Speaker 2>Yeah, it creates goods down there were.

568
00:29:05.680 --> 00:29:07.319
<v Speaker 3>Well they're trying, they're trying to optimize.

569
00:29:07.480 --> 00:29:11.200
<v Speaker 2>No, it goes down this speculative path. Yeah, it's all optimization.

570
00:29:11.359 --> 00:29:13.359
<v Speaker 2>And here's what it says. If I go down the

571
00:29:13.400 --> 00:29:18.839
<v Speaker 2>speculative path and I was right, we're fast. If I

572
00:29:18.960 --> 00:29:23.160
<v Speaker 2>was wrong, I roll back to that branch point, clean

573
00:29:23.240 --> 00:29:26.759
<v Speaker 2>up memory, and I just continue. So I'm not any

574
00:29:26.839 --> 00:29:29.000
<v Speaker 2>slower than if I just sat there waiting. So I

575
00:29:29.079 --> 00:29:30.039
<v Speaker 2>might as well speculate.

576
00:29:30.400 --> 00:29:32.960
<v Speaker 1>Except what happened during that path.

577
00:29:33.119 --> 00:29:36.200
<v Speaker 2>That's the that's theerein lies the rub. So let's say

578
00:29:36.480 --> 00:29:38.319
<v Speaker 2>I tell it go down path A, go down path A,

579
00:29:38.440 --> 00:29:42.480
<v Speaker 2>go down path A a billion times, and then this

580
00:29:42.640 --> 00:29:44.319
<v Speaker 2>next time I say, oh, by the way, instead of

581
00:29:44.359 --> 00:29:48.680
<v Speaker 2>accessing my jot token, which would force you down PATHA,

582
00:29:49.480 --> 00:29:54.400
<v Speaker 2>go access another JOT token from another area of memory,

583
00:29:55.160 --> 00:29:57.519
<v Speaker 2>and it goes, oh, well, the last thousand times I

584
00:29:57.880 --> 00:30:00.799
<v Speaker 2>accessed a JOT token, I went down PATHA. I'll go

585
00:30:00.839 --> 00:30:05.799
<v Speaker 2>down PATHA and it violates the security barrier, grabs the

586
00:30:05.880 --> 00:30:07.240
<v Speaker 2>JOT token and loads it into.

587
00:30:07.119 --> 00:30:09.039
<v Speaker 1>Memory, and it could be the wrong token.

588
00:30:09.279 --> 00:30:11.960
<v Speaker 2>It's most absolutely going to be the wrong token at

589
00:30:11.960 --> 00:30:14.039
<v Speaker 2>this point. It's somebody else's token.

590
00:30:13.839 --> 00:30:16.640
<v Speaker 1>Or it's not even a token, maybe it's maybe it's

591
00:30:16.759 --> 00:30:17.640
<v Speaker 1>just gobbledygook.

592
00:30:17.799 --> 00:30:21.319
<v Speaker 2>Maybe in this particular case, because it's cloud Flare, I'm

593
00:30:21.440 --> 00:30:26.680
<v Speaker 2>running on the same headless box as probably twelve other

594
00:30:26.880 --> 00:30:32.039
<v Speaker 2>companies are running. So it'll violate the isolation layer, grab

595
00:30:32.160 --> 00:30:35.200
<v Speaker 2>the JOT token from one of the other neighbors, and

596
00:30:35.359 --> 00:30:40.079
<v Speaker 2>load it into memory. Now, then it'll come back and say, oh,

597
00:30:40.119 --> 00:30:41.960
<v Speaker 2>by the way, you don't have access to that JOT token,

598
00:30:42.000 --> 00:30:44.359
<v Speaker 2>but it's in memory, you know. I'll get my Yeah,

599
00:30:44.400 --> 00:30:47.440
<v Speaker 2>I'll get my access denied. Came back from slow storage,

600
00:30:47.920 --> 00:30:51.400
<v Speaker 2>And what happens is the CPU tries to roll it back,

601
00:30:51.640 --> 00:30:53.759
<v Speaker 2>and when it rolls it back, it rolls back all

602
00:30:53.839 --> 00:30:57.079
<v Speaker 2>the registers in the CPU, but it doesn't roll back

603
00:30:57.119 --> 00:31:01.599
<v Speaker 2>the quick cash in the CPU. So now I can

604
00:31:01.720 --> 00:31:06.079
<v Speaker 2>query the cash and whatever comes back fast I know

605
00:31:06.319 --> 00:31:07.599
<v Speaker 2>was loaded in the cash.

606
00:31:07.640 --> 00:31:07.960
<v Speaker 1>Wow.

607
00:31:08.119 --> 00:31:10.599
<v Speaker 2>So I'll go and loop through all the cash, find

608
00:31:10.640 --> 00:31:13.119
<v Speaker 2>what comes back fast, and say, oh, this is the

609
00:31:13.200 --> 00:31:17.119
<v Speaker 2>JOT tooken. So this technique, in this particular case is

610
00:31:17.319 --> 00:31:22.759
<v Speaker 2>ninety nine point one six percent accurate in pulling back

611
00:31:23.400 --> 00:31:28.160
<v Speaker 2>a neighboring JOT token from somebody else running on your

612
00:31:28.200 --> 00:31:29.240
<v Speaker 2>cloud Flare instance.

613
00:31:29.559 --> 00:31:31.400
<v Speaker 1>Is that why slowing it down is an answer?

614
00:31:31.720 --> 00:31:35.720
<v Speaker 2>Yeah? I I that problem. So here's what cloud Flair did.

615
00:31:35.720 --> 00:31:38.440
<v Speaker 2>They said, we've known about specter since nineteen ninety five, well,

616
00:31:38.440 --> 00:31:41.279
<v Speaker 2>actually a little later than nineteen ninety five, and cloud

617
00:31:41.359 --> 00:31:49.599
<v Speaker 2>Flair said, we've added two different protections against this happening. Right,

618
00:31:50.559 --> 00:31:53.880
<v Speaker 2>the only way for you to actually viably do this

619
00:31:53.960 --> 00:31:58.480
<v Speaker 2>attack is to measure the time it takes for a

620
00:31:58.519 --> 00:32:00.559
<v Speaker 2>request in a memory to come back. So if I

621
00:32:00.599 --> 00:32:03.359
<v Speaker 2>request in a memory and it's and it's not in

622
00:32:03.400 --> 00:32:05.920
<v Speaker 2>the cash, it should be slow. And if I request

623
00:32:05.920 --> 00:32:07.880
<v Speaker 2>in a memory and it is in the cash, it

624
00:32:07.880 --> 00:32:10.200
<v Speaker 2>should be fast. Right, that's the whole point of the attack, right,

625
00:32:10.440 --> 00:32:12.240
<v Speaker 2>Load something in a cash that shouldn't have been there,

626
00:32:12.440 --> 00:32:14.119
<v Speaker 2>and then see if you can pull it back so

627
00:32:14.160 --> 00:32:15.759
<v Speaker 2>you need you need to have timing. You you have

628
00:32:15.880 --> 00:32:18.680
<v Speaker 2>local timing in your code. Hey what's the time? Date

629
00:32:18.759 --> 00:32:21.920
<v Speaker 2>dot now? Run some code to grab some cash, and

630
00:32:21.920 --> 00:32:24.240
<v Speaker 2>then run date dot now again and see was that

631
00:32:24.279 --> 00:32:26.839
<v Speaker 2>fast or was that slow? And what cloud Flair did

632
00:32:26.880 --> 00:32:29.079
<v Speaker 2>is they said, uh huh, we're not allowing date dot

633
00:32:29.119 --> 00:32:32.039
<v Speaker 2>now and we're not allowing all the thready wonky stuff

634
00:32:32.079 --> 00:32:33.839
<v Speaker 2>you can do, which is like date dot now, We're

635
00:32:33.839 --> 00:32:36.920
<v Speaker 2>not going to do it. What the researchers and here

636
00:32:37.000 --> 00:32:39.039
<v Speaker 2>did is they said, okay, not a problem. We're just

637
00:32:39.079 --> 00:32:42.920
<v Speaker 2>going to call out to an external service to get time.

638
00:32:43.799 --> 00:32:45.960
<v Speaker 2>And it doesn't matter because it will always be slow.

639
00:32:46.440 --> 00:32:51.880
<v Speaker 2>It'll always be when I call cashed memory, it'll be slow,

640
00:32:51.880 --> 00:32:54.759
<v Speaker 2>but when I call not cash memory it'll be even slower.

641
00:32:54.759 --> 00:32:57.160
<v Speaker 2>So it doesn't matter whether the timing measurement is local

642
00:32:57.200 --> 00:33:00.000
<v Speaker 2>on the box will do it remotely. It's super NOI

643
00:33:01.160 --> 00:33:05.400
<v Speaker 2>super noisy, and cloud Flair missed it. They were like, huh, yeah,

644
00:33:05.400 --> 00:33:08.119
<v Speaker 2>we never thought anybody would call off box to do that.

645
00:33:09.279 --> 00:33:12.640
<v Speaker 2>So that's the primary sort of quote unquote fix if

646
00:33:12.640 --> 00:33:15.519
<v Speaker 2>you will, that cloud Flare put in place. They also

647
00:33:15.599 --> 00:33:18.079
<v Speaker 2>have this really frigging at cloud Flair does an awesome job.

648
00:33:18.279 --> 00:33:22.640
<v Speaker 2>They also have this really frigging cool the second mitigation.

649
00:33:23.160 --> 00:33:27.279
<v Speaker 2>If they notice you query in cash and you constantly

650
00:33:27.359 --> 00:33:29.880
<v Speaker 2>get no, that doesn't exist. No that doesn't exist, No

651
00:33:29.960 --> 00:33:31.960
<v Speaker 2>that doesn't exist. Yes it does know that doesn't exist.

652
00:33:32.720 --> 00:33:37.039
<v Speaker 2>They actually realize you're trying to violate specter attack. They

653
00:33:37.119 --> 00:33:39.720
<v Speaker 2>grab your process and they throw it in jail and

654
00:33:39.799 --> 00:33:42.640
<v Speaker 2>they put it on its own machine in a way

655
00:33:42.680 --> 00:33:44.559
<v Speaker 2>that it can't access anything else.

656
00:33:44.640 --> 00:33:45.680
<v Speaker 1>They gave you a timeout.

657
00:33:45.880 --> 00:33:48.440
<v Speaker 2>Yeah, exactly. So they have these two mechanisms to try

658
00:33:48.440 --> 00:33:51.640
<v Speaker 2>and protect and what happened here is researchers discovered a

659
00:33:51.680 --> 00:33:55.000
<v Speaker 2>way around the first mechanisms that it didn't actually look

660
00:33:55.119 --> 00:33:57.960
<v Speaker 2>like it was an issue. It was tested, it does work,

661
00:33:59.039 --> 00:34:01.640
<v Speaker 2>and you know, cloud flare making some small changes to

662
00:34:01.720 --> 00:34:04.480
<v Speaker 2>their to their timing protections. But this is yeah, this

663
00:34:04.559 --> 00:34:06.079
<v Speaker 2>is awesome. This is a really cool attack.

664
00:34:06.240 --> 00:34:10.280
<v Speaker 1>Wow. Anything we can do about it, n just.

665
00:34:10.280 --> 00:34:13.519
<v Speaker 2>Know it exists. Hopefully the listeners are a little bit

666
00:34:13.519 --> 00:34:15.840
<v Speaker 2>more learned on spector attacks and now that all works.

667
00:34:15.840 --> 00:34:19.519
<v Speaker 1>But all right, finally our top story, NASA a t

668
00:34:19.719 --> 00:34:25.280
<v Speaker 1>gooey flaws could let unauthenticated attackers issue spacecraft commands and

669
00:34:25.480 --> 00:34:29.960
<v Speaker 1>AI T stands for almost instrument Toolkit, which is NASA

670
00:34:30.119 --> 00:34:35.320
<v Speaker 1>JPL's open source toolkit. Yeah, and gooey is graphical user interface. Obviously.

671
00:34:35.639 --> 00:34:38.079
<v Speaker 3>You remember how when you want to say something is

672
00:34:38.119 --> 00:34:41.360
<v Speaker 3>really smart, you say it's a rocket scientist. Yeah, you

673
00:34:41.440 --> 00:34:42.400
<v Speaker 3>can't say that anymore.

674
00:34:43.159 --> 00:34:45.239
<v Speaker 1>It's not rocket science. Actually it is.

675
00:34:45.679 --> 00:34:47.599
<v Speaker 3>It's not that bad. It's not that bad.

676
00:34:48.480 --> 00:34:52.679
<v Speaker 2>Yeah, honestly. I mean you have these images of somebody,

677
00:34:52.719 --> 00:34:57.039
<v Speaker 2>some attacker, you know, connecting into a spacecraft with no

678
00:34:57.159 --> 00:35:00.639
<v Speaker 2>password and you know, landing in the middle of New York.

679
00:35:00.599 --> 00:35:04.159
<v Speaker 3>Or actually I think the worst scenario was driving a

680
00:35:04.480 --> 00:35:07.199
<v Speaker 3>satellite down into a you know, thirty six thousand miles

681
00:35:07.199 --> 00:35:08.679
<v Speaker 3>an hour into some naval ship.

682
00:35:08.840 --> 00:35:10.599
<v Speaker 2>Oh yeah, yeah, absolutely.

683
00:35:10.639 --> 00:35:13.559
<v Speaker 3>I guess I go more evil than you even sometimes

684
00:35:13.679 --> 00:35:13.880
<v Speaker 3>I know.

685
00:35:14.280 --> 00:35:17.079
<v Speaker 2>Or can you imagine? I wonder what the feasibility of

686
00:35:17.159 --> 00:35:20.440
<v Speaker 2>using it as an assassination weapon would be? Jeez, very

687
00:35:20.519 --> 00:35:22.079
<v Speaker 2>I mean, could you could you?

688
00:35:22.719 --> 00:35:24.199
<v Speaker 3>I think the problem would be that the.

689
00:35:24.400 --> 00:35:26.719
<v Speaker 2>Orbital mechanics could we determine?

690
00:35:26.800 --> 00:35:29.079
<v Speaker 3>I've thought about this. I think I think you could.

691
00:35:29.199 --> 00:35:30.400
<v Speaker 2>I think that I've thought about this.

692
00:35:30.679 --> 00:35:32.800
<v Speaker 3>I think the problem is that it would will likely

693
00:35:32.840 --> 00:35:35.360
<v Speaker 3>burn up unless you had something big like Skylab, So

694
00:35:35.400 --> 00:35:37.000
<v Speaker 3>you'd have to adjust.

695
00:35:36.639 --> 00:35:39.320
<v Speaker 1>Dwayne, do you teach evil lessons? Can I take evil

696
00:35:39.360 --> 00:35:40.320
<v Speaker 1>lessons from you?

697
00:35:40.320 --> 00:35:43.599
<v Speaker 3>You'd have to adjust the trade and the speed so

698
00:35:43.639 --> 00:35:46.639
<v Speaker 3>that it didn't burn up completely before it reached its target.

699
00:35:49.360 --> 00:35:52.760
<v Speaker 2>Have you guys ever seen Mark Rober name name rings?

700
00:35:52.760 --> 00:35:53.719
<v Speaker 1>A belle comedian?

701
00:35:53.920 --> 00:35:56.599
<v Speaker 2>No? No, no, A brilliant engineer. Wasn't he from Mit?

702
00:35:56.960 --> 00:36:00.280
<v Speaker 3>Wasn't he Jack Ritters and Chrisy's land lord?

703
00:36:01.599 --> 00:36:08.000
<v Speaker 2>You're speaking? And that dated everybody on this podcast?

704
00:36:08.079 --> 00:36:08.280
<v Speaker 1>Yeah?

705
00:36:08.320 --> 00:36:08.679
<v Speaker 2>Who else?

706
00:36:12.920 --> 00:36:13.039
<v Speaker 4>No?

707
00:36:13.039 --> 00:36:16.599
<v Speaker 2>No, no, Mark Robert. He's a brilliant engineer graduated I

708
00:36:16.599 --> 00:36:19.920
<v Speaker 2>think my Tea if I remember correctly, but probably one

709
00:36:19.960 --> 00:36:23.280
<v Speaker 2>of the most well known mechanical engineers of our time.

710
00:36:23.360 --> 00:36:26.719
<v Speaker 2>But anyways, he actually did a science that's what he does.

711
00:36:26.719 --> 00:36:28.760
<v Speaker 2>He has his YouTube channel millions of people following that

712
00:36:28.760 --> 00:36:30.400
<v Speaker 2>sort of stuff. But one of the science experiments he

713
00:36:30.440 --> 00:36:33.400
<v Speaker 2>did was could you drop a tungsten rod from space

714
00:36:34.320 --> 00:36:37.199
<v Speaker 2>and hit a target? And he actually did.

715
00:36:37.159 --> 00:36:38.440
<v Speaker 3>Tungsten rods from God.

716
00:36:38.599 --> 00:36:38.840
<v Speaker 1>Yeah.

717
00:36:38.920 --> 00:36:41.519
<v Speaker 2>He he actually tried to work out the you know,

718
00:36:41.639 --> 00:36:45.800
<v Speaker 2>targeting and ballistics and all that other good stuff, and

719
00:36:46.079 --> 00:36:49.679
<v Speaker 2>it's surprisingly hard to drop on a target. Yeah, you

720
00:36:49.719 --> 00:36:50.719
<v Speaker 2>know that small but.

721
00:36:51.199 --> 00:36:53.760
<v Speaker 3>Because of the the wins mostly I think.

722
00:36:53.679 --> 00:36:57.840
<v Speaker 2>When a fact did a lot into orbit, yeah, yep,

723
00:36:58.000 --> 00:37:00.400
<v Speaker 2>yeah yeah, and if you were dropping out of orbit,

724
00:37:00.519 --> 00:37:03.320
<v Speaker 2>like just the angle that it's hitting and you know

725
00:37:03.679 --> 00:37:06.599
<v Speaker 2>what pieces of the object flake off will change, right,

726
00:37:06.679 --> 00:37:08.840
<v Speaker 2>So there just there's all sorts of mechanics around.

727
00:37:09.079 --> 00:37:12.800
<v Speaker 3>Uh yeah, Like one of the things that a needle

728
00:37:12.840 --> 00:37:14.599
<v Speaker 3>at the speed of light would pretty much wipe up

729
00:37:14.639 --> 00:37:16.719
<v Speaker 3>the planet. Sure, so you know if you get good

730
00:37:16.800 --> 00:37:18.840
<v Speaker 3>enough speed coming. But but then the thing has to

731
00:37:18.880 --> 00:37:21.880
<v Speaker 3>survive as well. So actually to some extent, as long

732
00:37:21.880 --> 00:37:24.280
<v Speaker 3>as you get it in the zip code, it's probably

733
00:37:24.320 --> 00:37:25.599
<v Speaker 3>going to do enough damage.

734
00:37:25.840 --> 00:37:31.599
<v Speaker 2>Now Patrick's talking about taking an entire city block. Needless

735
00:37:31.639 --> 00:37:33.400
<v Speaker 2>to say, before we go any further.

736
00:37:33.239 --> 00:37:37.000
<v Speaker 1>What is this XKCD, Before we go.

737
00:37:36.920 --> 00:37:40.119
<v Speaker 2>Any further, this sounds really scary, right. There's a you know,

738
00:37:40.119 --> 00:37:43.440
<v Speaker 2>an application that they use for commandy control with spacecraft

739
00:37:43.440 --> 00:37:45.079
<v Speaker 2>that oh my gosh. And if you look at the

740
00:37:45.079 --> 00:37:48.719
<v Speaker 2>web site, it's literally like sitting at the cockpit, right.

741
00:37:48.760 --> 00:37:50.360
<v Speaker 2>There's all sorts of things you can do in there.

742
00:37:51.480 --> 00:37:54.880
<v Speaker 2>You know, everything from no password to get into the

743
00:37:54.920 --> 00:37:58.679
<v Speaker 2>site to you know CSRF issues where I can make

744
00:37:58.719 --> 00:38:02.199
<v Speaker 2>requests locally to them binding the to zero zero zero,

745
00:38:02.239 --> 00:38:04.199
<v Speaker 2>which means it's open to everything and it ignores its

746
00:38:04.199 --> 00:38:06.840
<v Speaker 2>own local configure. There's all sorts of issues in this.

747
00:38:08.880 --> 00:38:11.559
<v Speaker 2>So this sounds like just a disaster waiting to happen.

748
00:38:12.000 --> 00:38:15.199
<v Speaker 2>But here's what we will tell you. We've rated this

749
00:38:15.280 --> 00:38:18.599
<v Speaker 2>is not that important. It's it's an interesting article, it's

750
00:38:18.599 --> 00:38:22.280
<v Speaker 2>fun to talk about, but there are so many other

751
00:38:22.320 --> 00:38:29.480
<v Speaker 2>safeguards between ground control of any you know, space object

752
00:38:31.199 --> 00:38:36.119
<v Speaker 2>and and you know satellites, and you know Starlink satellites

753
00:38:36.159 --> 00:38:39.119
<v Speaker 2>and and you know spacecraft and skylab and whatever. Right,

754
00:38:39.199 --> 00:38:43.199
<v Speaker 2>all of those there's a lot more than just reading

755
00:38:43.239 --> 00:38:47.360
<v Speaker 2>or radio waves and sending them up. You know, I've tried.

756
00:38:47.679 --> 00:38:51.000
<v Speaker 1>But anyway, so why why has it got a nine

757
00:38:51.000 --> 00:38:54.239
<v Speaker 1>point four score? And why hasn't it been issued a CV?

758
00:38:54.639 --> 00:38:58.599
<v Speaker 2>So this is an interesting question. Yeah, So the nine

759
00:38:58.639 --> 00:39:01.800
<v Speaker 2>point four score is is this is an open source

760
00:39:01.880 --> 00:39:05.159
<v Speaker 2>project and the concern is people will take it at

761
00:39:05.199 --> 00:39:08.119
<v Speaker 2>face value and use it without putting any of those

762
00:39:08.119 --> 00:39:11.199
<v Speaker 2>safeguards that NASA and SpaceX and that sort of stuff

763
00:39:11.199 --> 00:39:15.239
<v Speaker 2>would have put in. Using this is an a normal

764
00:39:15.280 --> 00:39:17.000
<v Speaker 2>piece of code. Would this rate a nine point four?

765
00:39:17.079 --> 00:39:17.239
<v Speaker 1>Yeah?

766
00:39:17.239 --> 00:39:19.840
<v Speaker 2>Absolutely, I mean there's no authentication in certain cases, it's

767
00:39:19.840 --> 00:39:24.360
<v Speaker 2>not protecting. There's no cross site request forgery protection and

768
00:39:24.400 --> 00:39:27.280
<v Speaker 2>tokens and that sort of stuff. So yeah, absolutely the

769
00:39:27.280 --> 00:39:30.000
<v Speaker 2>things a soup sandwich when it comes to, you know,

770
00:39:30.119 --> 00:39:33.760
<v Speaker 2>trying to use it in a secure fashion. That's where

771
00:39:33.800 --> 00:39:37.440
<v Speaker 2>that number comes from. Not really, because you know we're

772
00:39:37.480 --> 00:39:42.840
<v Speaker 2>at risk, all right, So no signtle ice dropping on

773
00:39:42.880 --> 00:39:47.159
<v Speaker 2>your head. A little bit more clickbaity than usual click

774
00:39:47.239 --> 00:39:48.840
<v Speaker 2>baity Clickie makes movies.

775
00:39:57.960 --> 00:39:59.960
<v Speaker 3>None of these references are less than fifty years old.

776
00:40:00.400 --> 00:40:00.639
<v Speaker 2>Nope.

777
00:40:01.320 --> 00:40:05.360
<v Speaker 1>Well, anybody who's back hurts, they can laugh along with us.

778
00:40:05.440 --> 00:40:07.239
<v Speaker 2>You get us, you get us, You're.

779
00:40:07.079 --> 00:40:09.880
<v Speaker 1>Back, doesn't hurt. You're too young, all right. Well, I

780
00:40:09.920 --> 00:40:12.559
<v Speaker 1>guess that's a show. And that's all the things that

781
00:40:12.599 --> 00:40:14.760
<v Speaker 1>we could come up with that happened last week. We'll

782
00:40:14.760 --> 00:40:17.199
<v Speaker 1>see you next week on Security this week, Bye bye,

783
00:40:17.320 --> 00:40:18.000
<v Speaker 1>bye bye