Speaker 1: Hey, Carl here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes, Spotify,
Speaker 1: or wherever you get Security this week. Also, you can
Speaker 1: get an ad free feed by becoming a five dollars
Speaker 1: a month patron. Go to Patreon dot Security this week
Speaker 1: dot com and sign up, and don't forget discord. Discord
Speaker 1: dot Security this week dot com. Lots of good stuff
Speaker 1: happening there. Yeah, I think that's it. So on with
Speaker 1: the podcast. Hey, so, I'm gonna do a little psychic
Speaker 1: prediction for all our listeners who remember what connecting to
Speaker 1: the Internet with dial up sounded like. Okay, ready, I
Speaker 1: predict your back hurts.
Speaker 2: My back hurts. I don't get it.
Speaker 1: Oh do I really have to explain it to me?
Speaker 1: How old are you if you remember what dial up
Speaker 1: sounds like?
Speaker 2: Oh? Wait, I get it? Yeah, okay, mine is the
Speaker 2: first thing to go.
Speaker 3: Apparently, I'm gonna pretend I got it and just.
Speaker 1: Kept silent like always. Hey, guess what it's Security this week.
Speaker 1: We've got a few stories for you. I'm Carl, that's
Speaker 1: Dwayne and Patrick. Let's start with Tom's hardware story. Critical
Speaker 1: mac os screen sharing flaw gives attackers remote root access
Speaker 1: Sissa bumps bug to nine point eight severity following active
Speaker 1: mono crypto jacking attacks.
Speaker 3: Finally, some love or is this hate for mac Os?
Speaker 2: I think it targets a Target's a target, that's true. Yeah,
Speaker 2: that's true.
Speaker 1: Well, in the past, you know, Apple users thought they
Speaker 1: were impervious to bugs and hacking and and all that
Speaker 1: stuff in the past. Yeah, in the past really started.
Speaker 2: The president and future was yesterday.
Speaker 1: The past well, okay, but a long long time ago,
Speaker 1: I mean forever. Yea, you know they've been rubbing in
Speaker 1: in our face. Hey, mac Os doesn't crash, right and
Speaker 1: probably you know, by design they own the hardware, they
Speaker 1: own everything. And yeah, Microsoft, well.
Speaker 3: It didn't also didn't hurt that they only had one
Speaker 3: percent market share.
Speaker 1: Yeah that's true. But Microsoft has a Windows has a
Speaker 1: hardware abstraction layer and drivers that are built by all
Speaker 1: these third party companies, so by design they're more susceptible
Speaker 1: to crashing. But yeah, I agree, I'm I'm feeling a
Speaker 1: little a little smug right now.
Speaker 4: Live shot in Freida live shot in Now this this
Speaker 4: one was also upgraded, so the cv the CVSS score
Speaker 4: went from seven to one to nine point eight.
Speaker 2: But is it warranted August fourteenth, Yeah, it is. So
Speaker 2: what it happened before is this was classified as a
Speaker 2: not so important. You know, yes, somebody can bypass it,
Speaker 2: but they have to have a local, low priview user and.
Speaker 3: It wasn't catastrophic in their opinion based on the first exploit.
Speaker 2: Yeah, exactly. So, you know, it is interesting to watch
Speaker 2: some of these some of these scores change and one
Speaker 2: of the major reasons this one changed is because now
Speaker 2: they're saying the attack is what's called automatable.
Speaker 3: And it doesn't require any access.
Speaker 2: At all exactly. So now a as long as you
Speaker 2: have access to that port, you don't need a user
Speaker 2: name and password, and you can you can absolutely exploit this,
Speaker 2: and that's that's why they were seeing all these crypto minors.
Speaker 2: It was literally just automatable. So that actually up the score.
Speaker 1: When you say automatable, does that mean you have to
Speaker 1: be in the proximity of it or on the same
Speaker 1: network or what.
Speaker 2: Just as long as Port fifty nine hundred is actually
Speaker 2: open to the internet. So if you want to remote
Speaker 2: desktop into your you know, your Mac, yeah, and start
Speaker 2: using things, right, that port's probably open. I mean, if honestly,
Speaker 2: the dear listener, you probably should have a VPN. But yes,
Speaker 2: we've seen this, oh my god, yeah, this many times.
Speaker 2: You know, easy put it up there so that you
Speaker 2: can actually connect to it from anywhere. And the problem is,
Speaker 2: how about a firewall too?
Speaker 1: Yeah, well yeah, Mac users don't use firewalls. No, no,
Speaker 1: no need, we don't need those stinking firewalls.
Speaker 2: Very very secure.
Speaker 3: Now so far, they're lucky that the Manaro crypto mining
Speaker 3: is the only thing that's happening. And I've seen there's
Speaker 3: been actually a lessening of ransomware.
Speaker 2: Yeah.
Speaker 3: I don't know why that is, but maybe it's because
Speaker 3: crypto is doing better.
Speaker 2: That's a good question. I haven't looked, but you're you're
Speaker 2: absolutely right. There's there's a couple of different stories that
Speaker 2: I went through where it looks like crypto mining is back.
Speaker 2: A lot of it's minarrow. Actually, Minero is really good
Speaker 2: if you want to hide what you're buying, okay, Dwayne,
Speaker 2: because of the way it works anyways.
Speaker 3: Yeah, but that's like the difference between someone burning or
Speaker 3: how down or ordering a fake pizza. Yeah, true, I'd
Speaker 3: much rather have the fake pizza than the burning yep.
Speaker 2: Yeah, But you know it is interesting. I think you know,
Speaker 2: we're going to probably start to see automatable be a
Speaker 2: more important statistic in attacks, especially with AI. Right, right,
Speaker 2: if I can get an AI, because automatable now is not. Hey,
Speaker 2: do you have a really bright developer who can write
Speaker 2: a script that kind of bypasses things? It's hey, can
Speaker 2: you talk to an AI?
Speaker 3: And is it deterministic versus probabilistic? Yeah, exactly, We've talked
Speaker 3: about that before. Deterministic is like a calculator you type
Speaker 3: in you know five plus seven is eleven?
Speaker 1: Right?
Speaker 3: No, no, it's twelve. But anyways you're supposed to say, right, anyways,
Speaker 3: I know five plus seven is twelve every time you
Speaker 3: put in a calculator. But there are some race conditions
Speaker 3: that are part of exploits where you might try it
Speaker 3: seven times and it doesn't work six right. It doesn't
Speaker 3: mean it's not workable. It's means that the stars weren't aligned
Speaker 3: for you to get in and you have to try
Speaker 3: it again. That makes it not really automatable or not
Speaker 3: as automatable.
Speaker 1: Right, Well, it could be automatable. It's just that it
Speaker 1: may have more errors, you know, but it's.
Speaker 3: But it can it may, but then you get yeah.
Speaker 1: Looped so much that it doesn't matter.
Speaker 2: Right, Well, I think I think that's noisy.
Speaker 1: Yeah.
Speaker 2: The other thing that's interesting, especially with AI, on the
Speaker 2: back end of a lot of these things that are
Speaker 2: maybe non deterministic. Right, maybe you have to run in
Speaker 2: a thousand times is it used to be? You know,
Speaker 2: if it succeeded, great, If it failed, just keep trying.
Speaker 2: And now you can say, well, if it let's say
Speaker 2: it's it kind of succeeded, or we're seeing this new
Speaker 2: error message, or we're seeing this kind of rape throttling
Speaker 2: or whatever. Right, Instead of being a developer where you'd
Speaker 2: write a branch for each of those things that you know,
Speaker 2: if we're being ray throttled, then use fireprocs. If we
Speaker 2: see this error, then do right where we would do that,
Speaker 2: we would write really really robust attack toolkits. And now
Speaker 2: with AI, it's like, hey, if you get stopped, write
Speaker 2: something that goes around it, right, and it will then
Speaker 2: start routing through different places.
Speaker 1: And that's first off, right, yep, okay, next story, next
Speaker 1: door open claw agent independently hacks gym website to move
Speaker 1: its owner up the queue. I think I saw this
Speaker 1: before the Elebor or maybe it was.
Speaker 3: The elect for a little bit. Yeah, this is this
Speaker 3: came out when when when all the frontier labs started saying,
Speaker 3: oh our our our AI is so dangerous powerful, it's
Speaker 3: so dangerous. It's so powerful that it's hacking things. And
Speaker 3: somebody basically let their open claw go and in order
Speaker 3: to get them a slot in a class, it deleted someone.
Speaker 2: I want to call BS on this. Really, Okay, all right,
Speaker 2: here's the deal. Take it from somebody who has who
Speaker 2: knows how hard it is to prompt a frontier model
Speaker 2: to get it to break into a site. Just take
Speaker 2: that for what it's worth. This guy didn't just say, Hey,
Speaker 2: I want to go to the gym and or four
Speaker 2: on the queue. Can you get me closer to one,
Speaker 2: and it just magically decided to go out and hack
Speaker 2: the website.
Speaker 1: He probably would have said it like this, Hi, Mike,
Speaker 1: I want to go to the gym and there's no
Speaker 1: room in the class, so can you move me up?
Speaker 1: I reckon you?
Speaker 2: Kind of Maybe that's what it is. That's the jail prompt.
Speaker 3: It kind of went Boston for a minute there.
Speaker 2: Well, right, so it just seems it just seems like,
Speaker 2: you know, all I did was I asked to be
Speaker 2: closer to number one in the queue, and then it
Speaker 2: just magically deleted a single person.
Speaker 1: Yeah, right, that doesn't seem right.
Speaker 2: Just seems weird. And then obviously this guy reported it
Speaker 2: and whatever. But still it just seemed it seemed there's
Speaker 2: there's something missing here because we've been playing around with
Speaker 2: a ton of open claws, slash Hermes, slash, you name
Speaker 2: it agents and by default they do not just go
Speaker 2: out and reach out to webs sites and starting.
Speaker 3: Well it does it? What do you think? How much
Speaker 3: does it matter? I'm kind of setting you up for
Speaker 3: the spike. How much does it matter which model they
Speaker 3: were using?
Speaker 2: Oh, well, that's a good point. It matters actually quite
Speaker 2: a bit. Yeah. True, just try and get Opus five
Speaker 2: to do anything hack hacky.
Speaker 3: No, but if you're using Quinn.
Speaker 2: I'm sure. Yeah, if you're using something like Quinn or but.
Speaker 1: These in Australia, these big models, it is.
Speaker 3: Much more likely to use a Chinese model.
Speaker 1: These big models, though, are really good at finding zero
Speaker 1: days and exploiting them. Oh absolutely, So that's what happened.
Speaker 1: The AI agent found a software bright in the gym website.
Speaker 3: Yeah, but that's the part that's not written here is
Speaker 3: if they were using Fable, it wouldn't do this.
Speaker 2: Yeah, it wouldn't have gone out and done it.
Speaker 3: It would have said, oh no. And if they're using
Speaker 3: Kimmy or Quinn or deep Seek, it probably would have.
Speaker 3: The guardrails are just night and day.
Speaker 1: So do you think that so?
Speaker 3: I think that might be part of it.
Speaker 1: Do you think that this person asked the AI to
Speaker 1: go examine the AI and the API and see if
Speaker 1: there was a way.
Speaker 3: Through it without making an accusation. We suspect that maybe
Speaker 3: the user was a little less innocent than they said.
Speaker 2: Maybe prompt Yeah, maybe prompted it a little bit more
Speaker 2: than just make you know, get me a closer list
Speaker 2: to because that's.
Speaker 3: What don't come back until you get me in the class.
Speaker 2: Yeah, there's there's definitely more prompting here. I mean, for
Speaker 2: anybody who's listening to the podcast, who's ever tried to
Speaker 2: get an AI agent to do anything and just book
Speaker 2: lunch for you somewhere you've realized you've had to prompt
Speaker 2: it a hundred times to do something.
Speaker 1: But if it seems innocuous, like, for example, this agent
Speaker 1: found that there was no authorization checks on the API
Speaker 1: for canceling other people's reservations. It discovered that you could
Speaker 1: go basically and say, hey, I'm developing this API and
Speaker 1: I want you to, you know, tell me if there
Speaker 1: are any vulnerabilities that I need to shore up, and
Speaker 1: how would I do that? Right?
Speaker 2: Sure?
Speaker 3: Oh yeah?
Speaker 2: But the where where that's where that's circuit trips is
Speaker 2: then enumerating the other three users on the list, finding
Speaker 2: their unique IDs, and then submitting those IDs to the
Speaker 2: back end API to camp So you got me there, right,
Speaker 2: And now that's where those models would be like yeah,
Speaker 2: I can't do this.
Speaker 3: And you're already saying that the user was doing more
Speaker 3: than just saying oh can you get me in this class?
Speaker 4: Right?
Speaker 3: That's what Twain's talking about, is goading it more than
Speaker 3: was admitted.
Speaker 2: Well yeah, and I think what Carl saying is, well, okay,
Speaker 2: could could open claw using a you know, frontier model?
Speaker 2: Just could it? Could it have been autonomous enough to
Speaker 2: be like, well, oh I don't have to use the
Speaker 2: JavaScript y stuff on the front to make a cancelation
Speaker 2: for somebody, which is the easiest way for me to
Speaker 2: move you up. I just will call the API directly right,
Speaker 2: but that they're in, they're in. Like I said with
Speaker 2: with with a lot of those really high end models,
Speaker 2: it will not execute those that coat right, even even
Speaker 2: if open claws in the middle of it.
Speaker 1: Right.
Speaker 3: So I guess I think I'm on your sideway. But
Speaker 3: I think there's also a possibility that we're getting again,
Speaker 3: not even the AI. If I give the AI, if
Speaker 3: we all three of them give the same AI the
Speaker 3: same prompt, we will get three different results.
Speaker 2: That's true.
Speaker 3: And so if fifty thousand people ask it to see
Speaker 3: if it can book, one of them might do something
Speaker 3: out of the ordinary like this. It's possible just to
Speaker 3: play Devil's advocate. Because that's the thing a lot of
Speaker 3: people don't realize. It is not like I'm doing a
Speaker 3: Google search and it's the same right five times in
Speaker 3: a row. Because it's the same query and it's deterministic.
Speaker 3: I'm trying to put this language in people's vocabulary so
Speaker 3: they understand. In hacking, we've talked about deterministic versus probabilistic.
Speaker 3: In quantum we're going to be talking about that, but
Speaker 3: it's also here in AI. AI. You ask it the
Speaker 3: same thing on two different systems exactly under the same circumstances,
Speaker 3: you'll get different answers. Okay, you'll get different results.
Speaker 1: All right, good enough, All right, let's move on the hacker.
Speaker 1: News says hackers compromised fourteen thousand, five hundred plus d.
Speaker 2: Daho way Way.
Speaker 1: Is that how you say it? Doway?
Speaker 2: No?
Speaker 1: Hua?
Speaker 3: I think so?
Speaker 1: Okay, fourteen and a half thousand plus Dowway devices using
Speaker 1: credential attacks off bypasses and p' top.
Speaker 3: I mean, this is good old stuff. This isn't I
Speaker 3: didn't use an LM. This is hey, I'm attacking credentials yep?
Speaker 2: Or is it no? It absolutely is the thing that
Speaker 2: I was digging in on this. I mean, listen, cameras
Speaker 2: have had issues for a long time, and a lot
Speaker 2: of people who put cameras up don't change passwords, right,
Speaker 2: so using default user names and passwords that happens, you know,
Speaker 2: doing all sorts of bypassing things that happens. The thing
Speaker 2: that was interesting to me is because there's a you know,
Speaker 2: authentication bypassed law. That's fine, Okay, so you didn't patch
Speaker 2: whatever it says it did it through a P two
Speaker 2: P relay technique peer to peer, right, right, So you'd say, okay, well,
Speaker 2: peer to peer means it's non routable. It's it's I
Speaker 2: turn on my computer here and I want to play
Speaker 2: a game with Patrick. He has to have his computer
Speaker 2: on this same network because it's not going to route
Speaker 2: out it to the internet. Right. It's not like, you know,
Speaker 2: we're both playing a game that uses peer to peer
Speaker 2: and he's at home and he fires it up and
Speaker 2: he sees every computer on the Internet that's playing that
Speaker 2: game right now, right, That's just not what happens with
Speaker 2: peer to peer. So so the thing that confused me
Speaker 2: about this article, and actually dug a little bit deeper
Speaker 2: to figure out why this is is how did they
Speaker 2: compromise via a P to P And if if we
Speaker 2: go down that route, I'll explain how this happens. In
Speaker 2: this case, the P to P, the peer to peer
Speaker 2: for them, is actually a cloud service. So let's say,
Speaker 2: for example, I have an app on my phone and
Speaker 2: I want to see the cameras, and obviously that's nice
Speaker 2: to do when you're local, right, But what if you're remote. Well,
Speaker 2: if I'm remote and I open up that phone app,
Speaker 2: I still want to see the cameras. Right, I'm you know,
Speaker 2: out with friends. I want to see what's going on,
Speaker 2: you know, at the store. Yeah, whatever it is. The
Speaker 2: way that works is when you fire the camera up,
Speaker 2: it connects out of your firewall to a cloud service
Speaker 2: managed in this case it's called easy Easy four IP
Speaker 2: or the easy four IP cloud managed by a Dahay.
Speaker 2: And that way, your camera has now created a connection
Speaker 2: out of your network. There's no open port right on
Speaker 2: your network. Your phone connects into the easy four IP
Speaker 2: cloud and requests your camera yep, and then you get access.
Speaker 1: It's kind of like how file sharing works.
Speaker 2: Yeah, there's no authentication to that. So what happens is
Speaker 2: the camera system doc way has decided, oh, well the
Speaker 2: cameras are. They have a web login page. There's no
Speaker 2: need for us to authenticate the user to the right
Speaker 2: camera because the camera you're gonna have to give a
Speaker 2: username and password to The camera.
Speaker 1: Service just tells them where the IP address is in
Speaker 1: the port.
Speaker 2: And routes the traffic.
Speaker 1: So here go go connect. Oh, it routes it. It
Speaker 1: doesn't just say go connect it.
Speaker 2: Oh yeah, it's no, it's like it routes it. It's
Speaker 2: a tunnel for you.
Speaker 1: So it's not peer to peer.
Speaker 2: Right exactly. It's it says it's a peer to peer,
Speaker 2: but it's literally creating a tunnel up into the cloud
Speaker 2: that you get me.
Speaker 1: Yeah, that's no good.
Speaker 2: So what's really crazy is you can then say, oh, no, no, no,
Speaker 2: my camera is not serial number one, two three four five,
Speaker 2: it's serial number one two three four six ye, and
Speaker 2: it goes okay, cool, and it routes you to that
Speaker 2: camera and presents you with the web login. That's issue
Speaker 2: number one. There is no authentication on how you can
Speaker 2: cycle through the cameras. Issue number two is how they
Speaker 2: were doing the authentication. There's anuthentication bypass. So now imagine
Speaker 2: we're running this store, right that, the three of us
Speaker 2: run our Shark Laser Cages store, and I'm the night
Speaker 2: security guy, and I'm sitting at a terminal with a
Speaker 2: whole bunch of screens, and I have one of those
Speaker 2: little keyboards with the you know, the dials and the
Speaker 2: joystick so I can move the cameras around so I
Speaker 2: can watch people buying cages.
Speaker 1: And all of a sudden your monitor starts showing the
Speaker 1: fresh Prince of bel Air.
Speaker 2: Right right, of course, I mean, and doctor Evil's calling.
Speaker 2: So I'm sitting there, I'm using the little joystick thing. Well,
Speaker 2: that keyboard that has the joystick for moving the cameras around,
Speaker 2: and that'swar stuff. Is an accessory also sold by TAWA.
Speaker 2: It's called a web keyboard or mini keyboard or whatever.
Speaker 2: Their own authentication is called the net keyboard. So their
Speaker 2: own authentication says, oh, by the way, if you tell
Speaker 2: us that you're using the net keyboard, which is literally
Speaker 2: just submitted into the authentication as ameter.
Speaker 3: Then it's all good.
Speaker 2: We don't require a password.
Speaker 3: It's all good, jeez.
Speaker 2: Because we've realized you just have a little joist it.
Speaker 2: You can't type in the password.
Speaker 1: Oh my god.
Speaker 2: Right, So that's all the attackers did, is they logged
Speaker 2: into this easy four IP started cycling through all of
Speaker 2: the really not that random serial numbers and saying, I
Speaker 2: use a net keyboard. I use a net keyboard, and
Speaker 2: it would give full access and then they can install.
Speaker 1: And do a sort of It's interesting. The article says.
Speaker 1: Researchers said confirmed compromises were concentrated in Ukraine and Russia.
Speaker 2: Wait which side of the attack were they?
Speaker 1: Probably both?
Speaker 3: So I assume your weapon of choice in this kind
Speaker 3: of exploit would be burpsuite.
Speaker 2: So burpsweet is nice. I'd probably sprinkle in a little
Speaker 2: fireprox is. I don't want to be picked up on
Speaker 2: what I'm doing and I want to do it fast.
Speaker 2: Just throwing that out there, that's probably the way to go.
Speaker 2: But yeah, I.
Speaker 1: Got to rename this show.
Speaker 3: You mean liability are criminal?
Speaker 1: Criminal career advice? Oh?
Speaker 3: Then really it would be on most wanted this and
Speaker 3: more than Malaysia.
Speaker 1: I'm surprised we aren't now.
Speaker 2: And to all of our Russian and Ukrainian listeners, thank you.
Speaker 1: Thank you, thanks for the story, Thank you, thank you. Okay,
Speaker 1: one morning, we take a break, stop and protect uses
Speaker 1: nearly two thousand hacked wait for it, word press sites
Speaker 1: to spread malware and steal data. I've never heard of
Speaker 1: such a thing.
Speaker 2: Oh, this is outrageous, the super secure word press. So
Speaker 2: breaking this one down. It's interesting, right, Well, WordPress is
Speaker 2: so ubiquitously you're able to break into it now. People
Speaker 2: are using hacked WordPress sites as commandic control. Right Yeah,
Speaker 2: so it's like, oh, I now have a framework thinking
Speaker 2: and literally there's a framework here that can go out
Speaker 2: and have all those hacked word press sites report into
Speaker 2: a commandic control structure. And then the attack here was
Speaker 2: actually a click fist fixed. So this was a social
Speaker 2: engineering attack. I get you to load a thing that
Speaker 2: will then go and do magical things. It will go,
Speaker 2: you know, it installs uh, you know, password stealers and
Speaker 2: all sorts of stuff. Right, so you're running a PowerShell script.
Speaker 2: At the end of the day, I con you into
Speaker 2: running a PowerShell script. But the need part is that
Speaker 2: PowerShell script that's now running there stealing stuff off my computer,
Speaker 2: is communicating with a back end of hacked WordPress sites. Yeah,
Speaker 2: and then I'm getting the information. The great thing about
Speaker 2: this method is it's not like I can say, oh,
Speaker 2: this is a known hacker's website, right, It could be
Speaker 2: any website, could be a site, could be yeah whatever,
Speaker 2: right exactly. So this this helps bypass a lot of
Speaker 2: the firewall rules and you know, endpoint detection rules and
Speaker 2: that sort of stuff. So I, uh, oh, word.
Speaker 1: I didn't see the word patch or or SISA or
Speaker 1: score anywhere in this article, and that makes me even
Speaker 1: more concerned that we should change the name of this
Speaker 1: podcast to criminal career advice.
Speaker 2: We absolutely should. It's like, well, it's funny because this article.
Speaker 2: I think they didn't add patch because the only way
Speaker 2: to break into these word press sites was an unpatched
Speaker 2: plug in. And they're like, you know, we're not even
Speaker 2: gonna tell you do it anymore. Yeah, whatever.
Speaker 3: Well, and the click and the clickfix thing is a
Speaker 3: social engineering attack. It's you convince someone to do something right,
Speaker 3: the only one should never have thought of doing.
Speaker 2: The only way to patch that is with the lead pipe.
Speaker 3: In the conservatory will be patched when the robots take over.
Speaker 1: Maybe, yeah, what do you mean when? Yeah? Well, all right,
Speaker 1: on that note, we'll take a little break. We'll be
Speaker 1: right back after these very important messages, and we're back.
Speaker 1: It's security this week. I'm Carl, that's Patrick, that's Twain.
Speaker 1: A few more stories here. New Manic and Trey malware
Speaker 1: can exfiltrate data through nearby devices. I don't like that. Listen.
Speaker 1: Is it as bad as it sounds?
Speaker 2: I don't why, and not really. I mean, yes, it's bad,
Speaker 2: but it's not that bad. I don't want to start
Speaker 2: the whole Holy war on the discord again. Android and iPhone.
Speaker 3: But why don't you just start with your god sucks.
Speaker 1: This.
Speaker 2: To distill this down to a two second SoundBite, this
Speaker 2: is you sideloading apps you shouldn't.
Speaker 1: Well, however, it's you kind of get what you deserve.
Speaker 2: Yeah, it's unique though, right, So they say, listen, we
Speaker 2: don't know how this is happening yet. There's no attribution
Speaker 2: yet to the type of app, the thing that everybody's doing.
Speaker 2: What's actually really kind of cool? I say, cool? Is
Speaker 2: this malway cool? I know this malwhere registers as an
Speaker 2: accessibility feature, so it puts an invisible overlay on top
Speaker 2: of apps. So when you type in your banking password,
Speaker 2: you're texting, you're doing whatever, it picks all that up
Speaker 2: and sends it to back end server. Exactly. Great analogy, Patrick,
Speaker 2: And it sounds like.
Speaker 1: It targets people who don't have good vision.
Speaker 2: It could, or it just people don't pay attention to
Speaker 2: the Hey, you downloaded this from a third party, or
Speaker 2: you okay with all of the requirements and they say yes,
Speaker 2: which turns on accessibility and does all that good stuff.
Speaker 1: Well, would they download it for accessibility purposes? I guess
Speaker 1: that's my question.
Speaker 2: Oh, good question.
Speaker 3: I mean they might trick them into thinking anything anything
Speaker 3: they want that this will save you memory, it'll lower
Speaker 3: your your your charges, it'll increase your creatine levels.
Speaker 2: It's a new cool looking keyboard. Yeah yeah, whatever.
Speaker 1: Yeah, so it'll make it waterproof exactly.
Speaker 2: So it's a it's a skimmer. That is a great analogy, Patrick,
Speaker 2: because it does it watches you type on your s s.
Speaker 2: It watches you type your multi factor codes, and then
Speaker 2: it passes it along to the app.
Speaker 3: I'm good for one good one per show.
Speaker 2: I know, Jesus. That's it, Patrick, You're done. Take a vacation, Une,
Speaker 2: take a lot. Yeah, well done, well done. So I
Speaker 2: could say Apple wouldn't allow you to do this without
Speaker 2: jumping through all sorts of hoops, Like you can put
Speaker 2: your Apple phone into a developer mode and you can
Speaker 2: actually download.
Speaker 1: But when you do that, you auto even if you
Speaker 1: auto provision, right, they know who you are.
Speaker 2: Yeah.
Speaker 1: So so yeah, I don't I have a band. I
Speaker 1: have a mobile app that I'm testing with the band.
Speaker 1: I'm not going to have them all come over and
Speaker 1: plug in their devices and sideload it onto their phones. Right,
Speaker 1: We're going to go through an app store? Yeah?
Speaker 2: Absolutely, Yeah, and that that gets much harder if you're
Speaker 2: going through an app store. So the the running theory
Speaker 2: is the is obviously pulled off of some you know,
Speaker 2: third party site or some third party app store after
Speaker 2: the phone's been rooted. But yeah, just be careful what
Speaker 2: you download and don't use Android.
Speaker 1: All right. So the next one is really really cool.
Speaker 1: I saw this cloud Flare workers specter attack exposed jot
Speaker 1: jwt at twelve bits per.
Speaker 3: Second, lightning fast.
Speaker 1: Now. I remember having a three hundred bod modem and
Speaker 1: I thought that was slow.
Speaker 3: This is actually a measure of fast.
Speaker 1: Yeah, it is, because it's only a jot token.
Speaker 3: It's just any And the old speed was like, what
Speaker 3: was it to two bit two bites per per minute?
Speaker 2: Twelve twelve bits per second before.
Speaker 3: Well that's twelve or second, but before it was like
Speaker 3: two per minute.
Speaker 2: Or No, the earlier attack was yeah, one hundred and
Speaker 2: twenty bits per hour. Okay, so a lot slower.
Speaker 1: Yeah, okay, let's unpack this one. Yeah, first of all,
Speaker 1: what's a jot? I love this.
Speaker 2: I love this these types of attacks. How do you
Speaker 2: tell us, Carl, what's a jaw?
Speaker 1: All right? A jot is a piece of gobbledygook. String
Speaker 1: that you used to as a token. When you're authenticated
Speaker 1: by a website, you get a JOT token or you
Speaker 1: send a jot token and then that identifies you kind
Speaker 1: of like a cookie for the for the session as
Speaker 1: long as you're logged in.
Speaker 3: It's a Java artifact. Yeah, Java web token.
Speaker 1: Right, there's a Java script web token.
Speaker 2: Okay, yeah, yeah, and it can have some neat things
Speaker 2: in there, right, like roll and all sorts of little
Speaker 2: information about maybe what you should and shouldn't have access
Speaker 2: to whatever it is. But right, you know what. I
Speaker 2: We've been doing this for a long time. This is
Speaker 2: over five years we've been doing this podcast. And I
Speaker 2: used to call these jawts all the time. I was like,
Speaker 2: this is a jawt. JB Like we hack them all
Speaker 2: the time. We're like, oh, did you get the jawt
Speaker 2: token whatever? Right, And when we were on with Carl
Speaker 2: at one point for an article maybe four years ago,
Speaker 2: he's like, yeah, JOT And I'm like, are you messing
Speaker 2: with me? They call it jot really and he's like, yeah, dude,
Speaker 2: it's wrong with you. Sounds like, oh I learned it.
Speaker 1: I learned that from brock Allen.
Speaker 3: Oh really Yeah, well Brock would know.
Speaker 1: Yeah, he's the first guy I ever heard say, jot
Speaker 1: that's awesome.
Speaker 3: So yeah, let me jot that down.
Speaker 1: Let me jot it.
Speaker 2: So this is a side channel attack, and like a
Speaker 2: really cool side channel attack. So for those as old
Speaker 2: as us, I suppose you probably remember this specter. You
Speaker 2: may not remember a spector attack.
Speaker 1: If your back hurts the gunship, you probably yeah, not
Speaker 1: that one.
Speaker 2: Not that spector attack puffed the magic Dragon. So spector
Speaker 2: attacks are an attack. And I won't go into too
Speaker 2: much technical detail, but a spector attack is an attack
Speaker 2: on a CPU, and it's specifically an attack on how
Speaker 2: the architecture of CPU's work. And it's an attack on
Speaker 2: every CPU since nine made since ninety nine, right, so
Speaker 2: the architecture has not changed. What happens is CPUs, to
Speaker 2: sort of distill it down, CPUs are fast, right in
Speaker 2: making decisions, in branching and doing it they should. Access
Speaker 2: to memory is slow. So if you tell a CPU,
Speaker 2: go access memory, and if the answer is yes, go
Speaker 2: down path A. And if the answer is no, go
Speaker 2: down path P, what happens.
Speaker 1: My back hurts. That's about all I know anybody.
Speaker 3: So what happens is delay.
Speaker 2: Yeah. What happens is the CPU doesn't stand there for
Speaker 2: one hundred cycles and go I'll wait. Yeah, the CPU says.
Speaker 2: The last ninety nine times I always asked this question,
Speaker 2: I was told to go down path A afterwards, so
Speaker 2: it speculates the path to go down hence specter attacks.
Speaker 2: CPU speculates, Oh yeah, the CPU speculates.
Speaker 1: I didn't know cp use could speculate.
Speaker 2: Yeah, it creates goods down there were.
Speaker 3: Well they're trying, they're trying to optimize.
Speaker 2: No, it goes down this speculative path. Yeah, it's all optimization.
Speaker 2: And here's what it says. If I go down the
Speaker 2: speculative path and I was right, we're fast. If I
Speaker 2: was wrong, I roll back to that branch point, clean
Speaker 2: up memory, and I just continue. So I'm not any
Speaker 2: slower than if I just sat there waiting. So I
Speaker 2: might as well speculate.
Speaker 1: Except what happened during that path.
Speaker 2: That's the that's theerein lies the rub. So let's say
Speaker 2: I tell it go down path A, go down path A,
Speaker 2: go down path A a billion times, and then this
Speaker 2: next time I say, oh, by the way, instead of
Speaker 2: accessing my jot token, which would force you down PATHA,
Speaker 2: go access another JOT token from another area of memory,
Speaker 2: and it goes, oh, well, the last thousand times I
Speaker 2: accessed a JOT token, I went down PATHA. I'll go
Speaker 2: down PATHA and it violates the security barrier, grabs the
Speaker 2: JOT token and loads it into.
Speaker 1: Memory, and it could be the wrong token.
Speaker 2: It's most absolutely going to be the wrong token at
Speaker 2: this point. It's somebody else's token.
Speaker 1: Or it's not even a token, maybe it's maybe it's
Speaker 1: just gobbledygook.
Speaker 2: Maybe in this particular case, because it's cloud Flare, I'm
Speaker 2: running on the same headless box as probably twelve other
Speaker 2: companies are running. So it'll violate the isolation layer, grab
Speaker 2: the JOT token from one of the other neighbors, and
Speaker 2: load it into memory. Now, then it'll come back and say, oh,
Speaker 2: by the way, you don't have access to that JOT token,
Speaker 2: but it's in memory, you know. I'll get my Yeah,
Speaker 2: I'll get my access denied. Came back from slow storage,
Speaker 2: And what happens is the CPU tries to roll it back,
Speaker 2: and when it rolls it back, it rolls back all
Speaker 2: the registers in the CPU, but it doesn't roll back
Speaker 2: the quick cash in the CPU. So now I can
Speaker 2: query the cash and whatever comes back fast I know
Speaker 2: was loaded in the cash.
Speaker 1: Wow.
Speaker 2: So I'll go and loop through all the cash, find
Speaker 2: what comes back fast, and say, oh, this is the
Speaker 2: JOT tooken. So this technique, in this particular case is
Speaker 2: ninety nine point one six percent accurate in pulling back
Speaker 2: a neighboring JOT token from somebody else running on your
Speaker 2: cloud Flare instance.
Speaker 1: Is that why slowing it down is an answer?
Speaker 2: Yeah? I I that problem. So here's what cloud Flair did.
Speaker 2: They said, we've known about specter since nineteen ninety five, well,
Speaker 2: actually a little later than nineteen ninety five, and cloud
Speaker 2: Flair said, we've added two different protections against this happening. Right,
Speaker 2: the only way for you to actually viably do this
Speaker 2: attack is to measure the time it takes for a
Speaker 2: request in a memory to come back. So if I
Speaker 2: request in a memory and it's and it's not in
Speaker 2: the cash, it should be slow. And if I request
Speaker 2: in a memory and it is in the cash, it
Speaker 2: should be fast. Right, that's the whole point of the attack, right,
Speaker 2: Load something in a cash that shouldn't have been there,
Speaker 2: and then see if you can pull it back so
Speaker 2: you need you need to have timing. You you have
Speaker 2: local timing in your code. Hey what's the time? Date
Speaker 2: dot now? Run some code to grab some cash, and
Speaker 2: then run date dot now again and see was that
Speaker 2: fast or was that slow? And what cloud Flair did
Speaker 2: is they said, uh huh, we're not allowing date dot
Speaker 2: now and we're not allowing all the thready wonky stuff
Speaker 2: you can do, which is like date dot now, We're
Speaker 2: not going to do it. What the researchers and here
Speaker 2: did is they said, okay, not a problem. We're just
Speaker 2: going to call out to an external service to get time.
Speaker 2: And it doesn't matter because it will always be slow.
Speaker 2: It'll always be when I call cashed memory, it'll be slow,
Speaker 2: but when I call not cash memory it'll be even slower.
Speaker 2: So it doesn't matter whether the timing measurement is local
Speaker 2: on the box will do it remotely. It's super NOI
Speaker 2: super noisy, and cloud Flair missed it. They were like, huh, yeah,
Speaker 2: we never thought anybody would call off box to do that.
Speaker 2: So that's the primary sort of quote unquote fix if
Speaker 2: you will, that cloud Flare put in place. They also
Speaker 2: have this really frigging at cloud Flair does an awesome job.
Speaker 2: They also have this really frigging cool the second mitigation.
Speaker 2: If they notice you query in cash and you constantly
Speaker 2: get no, that doesn't exist. No that doesn't exist, No
Speaker 2: that doesn't exist. Yes it does know that doesn't exist.
Speaker 2: They actually realize you're trying to violate specter attack. They
Speaker 2: grab your process and they throw it in jail and
Speaker 2: they put it on its own machine in a way
Speaker 2: that it can't access anything else.
Speaker 1: They gave you a timeout.
Speaker 2: Yeah, exactly. So they have these two mechanisms to try
Speaker 2: and protect and what happened here is researchers discovered a
Speaker 2: way around the first mechanisms that it didn't actually look
Speaker 2: like it was an issue. It was tested, it does work,
Speaker 2: and you know, cloud flare making some small changes to
Speaker 2: their to their timing protections. But this is yeah, this
Speaker 2: is awesome. This is a really cool attack.
Speaker 1: Wow. Anything we can do about it, n just.
Speaker 2: Know it exists. Hopefully the listeners are a little bit
Speaker 2: more learned on spector attacks and now that all works.
Speaker 1: But all right, finally our top story, NASA a t
Speaker 1: gooey flaws could let unauthenticated attackers issue spacecraft commands and
Speaker 1: AI T stands for almost instrument Toolkit, which is NASA
Speaker 1: JPL's open source toolkit. Yeah, and gooey is graphical user interface. Obviously.
Speaker 3: You remember how when you want to say something is
Speaker 3: really smart, you say it's a rocket scientist. Yeah, you
Speaker 3: can't say that anymore.
Speaker 1: It's not rocket science. Actually it is.
Speaker 3: It's not that bad. It's not that bad.
Speaker 2: Yeah, honestly. I mean you have these images of somebody,
Speaker 2: some attacker, you know, connecting into a spacecraft with no
Speaker 2: password and you know, landing in the middle of New York.
Speaker 3: Or actually I think the worst scenario was driving a
Speaker 3: satellite down into a you know, thirty six thousand miles
Speaker 3: an hour into some naval ship.
Speaker 2: Oh yeah, yeah, absolutely.
Speaker 3: I guess I go more evil than you even sometimes
Speaker 3: I know.
Speaker 2: Or can you imagine? I wonder what the feasibility of
Speaker 2: using it as an assassination weapon would be? Jeez, very
Speaker 2: I mean, could you could you?
Speaker 3: I think the problem would be that the.
Speaker 2: Orbital mechanics could we determine?
Speaker 3: I've thought about this. I think I think you could.
Speaker 2: I think that I've thought about this.
Speaker 3: I think the problem is that it would will likely
Speaker 3: burn up unless you had something big like Skylab, So
Speaker 3: you'd have to adjust.
Speaker 1: Dwayne, do you teach evil lessons? Can I take evil
Speaker 1: lessons from you?
Speaker 3: You'd have to adjust the trade and the speed so
Speaker 3: that it didn't burn up completely before it reached its target.
Speaker 2: Have you guys ever seen Mark Rober name name rings?
Speaker 1: A belle comedian?
Speaker 2: No? No, no, A brilliant engineer. Wasn't he from Mit?
Speaker 3: Wasn't he Jack Ritters and Chrisy's land lord?
Speaker 2: You're speaking? And that dated everybody on this podcast?
Speaker 1: Yeah?
Speaker 2: Who else?
Speaker 4: No?
Speaker 2: No, no, Mark Robert. He's a brilliant engineer graduated I
Speaker 2: think my Tea if I remember correctly, but probably one
Speaker 2: of the most well known mechanical engineers of our time.
Speaker 2: But anyways, he actually did a science that's what he does.
Speaker 2: He has his YouTube channel millions of people following that
Speaker 2: sort of stuff. But one of the science experiments he
Speaker 2: did was could you drop a tungsten rod from space
Speaker 2: and hit a target? And he actually did.
Speaker 3: Tungsten rods from God.
Speaker 1: Yeah.
Speaker 2: He he actually tried to work out the you know,
Speaker 2: targeting and ballistics and all that other good stuff, and
Speaker 2: it's surprisingly hard to drop on a target. Yeah, you
Speaker 2: know that small but.
Speaker 3: Because of the the wins mostly I think.
Speaker 2: When a fact did a lot into orbit, yeah, yep,
Speaker 2: yeah yeah, and if you were dropping out of orbit,
Speaker 2: like just the angle that it's hitting and you know
Speaker 2: what pieces of the object flake off will change, right,
Speaker 2: So there just there's all sorts of mechanics around.
Speaker 3: Uh yeah, Like one of the things that a needle
Speaker 3: at the speed of light would pretty much wipe up
Speaker 3: the planet. Sure, so you know if you get good
Speaker 3: enough speed coming. But but then the thing has to
Speaker 3: survive as well. So actually to some extent, as long
Speaker 3: as you get it in the zip code, it's probably
Speaker 3: going to do enough damage.
Speaker 2: Now Patrick's talking about taking an entire city block. Needless
Speaker 2: to say, before we go any further.
Speaker 1: What is this XKCD, Before we go.
Speaker 2: Any further, this sounds really scary, right. There's a you know,
Speaker 2: an application that they use for commandy control with spacecraft
Speaker 2: that oh my gosh. And if you look at the
Speaker 2: web site, it's literally like sitting at the cockpit, right.
Speaker 2: There's all sorts of things you can do in there.
Speaker 2: You know, everything from no password to get into the
Speaker 2: site to you know CSRF issues where I can make
Speaker 2: requests locally to them binding the to zero zero zero,
Speaker 2: which means it's open to everything and it ignores its
Speaker 2: own local configure. There's all sorts of issues in this.
Speaker 2: So this sounds like just a disaster waiting to happen.
Speaker 2: But here's what we will tell you. We've rated this
Speaker 2: is not that important. It's it's an interesting article, it's
Speaker 2: fun to talk about, but there are so many other
Speaker 2: safeguards between ground control of any you know, space object
Speaker 2: and and you know satellites, and you know Starlink satellites
Speaker 2: and and you know spacecraft and skylab and whatever. Right,
Speaker 2: all of those there's a lot more than just reading
Speaker 2: or radio waves and sending them up. You know, I've tried.
Speaker 1: But anyway, so why why has it got a nine
Speaker 1: point four score? And why hasn't it been issued a CV?
Speaker 2: So this is an interesting question. Yeah, So the nine
Speaker 2: point four score is is this is an open source
Speaker 2: project and the concern is people will take it at
Speaker 2: face value and use it without putting any of those
Speaker 2: safeguards that NASA and SpaceX and that sort of stuff
Speaker 2: would have put in. Using this is an a normal
Speaker 2: piece of code. Would this rate a nine point four?
Speaker 1: Yeah?
Speaker 2: Absolutely, I mean there's no authentication in certain cases, it's
Speaker 2: not protecting. There's no cross site request forgery protection and
Speaker 2: tokens and that sort of stuff. So yeah, absolutely the
Speaker 2: things a soup sandwich when it comes to, you know,
Speaker 2: trying to use it in a secure fashion. That's where
Speaker 2: that number comes from. Not really, because you know we're
Speaker 2: at risk, all right, So no signtle ice dropping on
Speaker 2: your head. A little bit more clickbaity than usual click
Speaker 2: baity Clickie makes movies.
Speaker 3: None of these references are less than fifty years old.
Speaker 2: Nope.
Speaker 1: Well, anybody who's back hurts, they can laugh along with us.
Speaker 2: You get us, you get us, You're.
Speaker 1: Back, doesn't hurt. You're too young, all right. Well, I
Speaker 1: guess that's a show. And that's all the things that
Speaker 1: we could come up with that happened last week. We'll
Speaker 1: see you next week on Security this week, Bye bye,
Speaker 1: bye bye