WEBVTT

1
00:00:00.320 --> 00:00:03.200
<v Speaker 1>Hey, Carl. Here, we're on a mission to find new

2
00:00:03.240 --> 00:00:05.919
<v Speaker 1>fans of the show. I mean, where else can you

3
00:00:05.960 --> 00:00:10.240
<v Speaker 1>get real life comedy and horror in one podcast. You

4
00:00:10.279 --> 00:00:13.000
<v Speaker 1>can do your part by leaving us a review on iTunes,

5
00:00:13.039 --> 00:00:16.719
<v Speaker 1>Spotify or wherever you get Security this week. Also, you

6
00:00:16.719 --> 00:00:19.079
<v Speaker 1>can get an ad free feed by becoming a five

7
00:00:19.120 --> 00:00:22.039
<v Speaker 1>dollars a month patron. Go to Patreon dot Security this

8
00:00:22.079 --> 00:00:25.359
<v Speaker 1>week dot com and sign up, and don't forget Discord.

9
00:00:25.600 --> 00:00:28.519
<v Speaker 1>Discord dot Security this week dot com. Lots of good

10
00:00:28.559 --> 00:00:32.320
<v Speaker 1>stuff happening there. Yeah, I think that's it. So on

11
00:00:32.359 --> 00:00:35.320
<v Speaker 1>with the podcast. Hey guys, I thought i'd tell you

12
00:00:35.359 --> 00:00:37.479
<v Speaker 1>I just bought a sweet car online.

13
00:00:37.560 --> 00:00:39.399
<v Speaker 2>Ooh nice? Well, yeah, what is it?

14
00:00:39.399 --> 00:00:43.960
<v Speaker 1>It was previously owned by Neil Diamond Sweet Car Online.

15
00:00:44.159 --> 00:00:45.280
<v Speaker 1>Do I have to spell it out?

16
00:00:45.320 --> 00:00:55.280
<v Speaker 2>Come on you deadly it all right?

17
00:00:55.320 --> 00:00:58.439
<v Speaker 1>It's Security this Week, Carl. That's Dwayne and Patrick and

18
00:00:58.600 --> 00:01:00.679
<v Speaker 1>we got a few stories here. Some of them are

19
00:01:00.759 --> 00:01:02.960
<v Speaker 1>pretty scary and some of them are of the time.

20
00:01:03.840 --> 00:01:07.599
<v Speaker 1>Let's talk about Fortinet, our old friend. They are warning

21
00:01:07.640 --> 00:01:13.239
<v Speaker 1>of critical RCEE. That's remote control and execution flaws in

22
00:01:13.400 --> 00:01:17.519
<v Speaker 1>forty sandbox and forty authenticator and you know they're they're

23
00:01:17.560 --> 00:01:20.200
<v Speaker 1>going the way of McDonald's where everything starts with Mick.

24
00:01:20.920 --> 00:01:26.680
<v Speaker 3>Right, they've been there. Coke please, and yeah, i'd like

25
00:01:26.680 --> 00:01:31.599
<v Speaker 3>a mcfirewall. I think you hat it is apporting.

26
00:01:31.840 --> 00:01:34.000
<v Speaker 2>Yeah, all right.

27
00:01:33.920 --> 00:01:34.799
<v Speaker 1>So what happened here?

28
00:01:36.640 --> 00:01:40.439
<v Speaker 2>This is a classic? This is a classic. Well, we

29
00:01:40.480 --> 00:01:43.599
<v Speaker 2>didn't check the inputs type of thing on our you know,

30
00:01:43.680 --> 00:01:48.519
<v Speaker 2>forty authenticator are bad. Somebody can execute code what I

31
00:01:48.599 --> 00:01:52.920
<v Speaker 2>don't understand, and so nothing really groundbreaking here other than

32
00:01:53.000 --> 00:01:55.560
<v Speaker 2>obviously people are trying to tear apart these firewalls, so

33
00:01:55.799 --> 00:01:58.519
<v Speaker 2>always make sure you go and patch. The first CVE

34
00:01:58.799 --> 00:02:01.359
<v Speaker 2>here the twenty twenty six four four two seven seven

35
00:02:02.760 --> 00:02:07.920
<v Speaker 2>that's forty authentic Hator identity so it's their identity management solution.

36
00:02:09.080 --> 00:02:11.879
<v Speaker 2>Was actually patched in UH six five seven and six

37
00:02:11.919 --> 00:02:15.400
<v Speaker 2>six nine and eight oh three, so there are patches

38
00:02:15.439 --> 00:02:18.439
<v Speaker 2>out for these, but it's it's a pretty basic like

39
00:02:18.520 --> 00:02:21.560
<v Speaker 2>there's an endpoint that you can hit that unfortunately will

40
00:02:21.599 --> 00:02:25.680
<v Speaker 2>execute code. So this one, this one distills down to

41
00:02:25.759 --> 00:02:27.639
<v Speaker 2>a if you're running this, go patch. Is one of

42
00:02:27.680 --> 00:02:30.599
<v Speaker 2>the reasons we put this on the this week's show

43
00:02:30.639 --> 00:02:32.520
<v Speaker 2>because there's a lot of Fordinet out there.

44
00:02:32.599 --> 00:02:35.719
<v Speaker 1>I just want to point out that this article refers

45
00:02:35.759 --> 00:02:40.159
<v Speaker 1>to at least four different products, all that start with forty.

46
00:02:40.280 --> 00:02:42.759
<v Speaker 1>I know, And I wonder if you work there, if

47
00:02:42.879 --> 00:02:46.039
<v Speaker 1>they make you say the whole product name in meetings

48
00:02:46.120 --> 00:02:48.879
<v Speaker 1>and in emails and everything, and do the people get tired?

49
00:02:49.080 --> 00:02:53.319
<v Speaker 2>Probably relentlessly like prefixing everything with Carl and I sit down,

50
00:02:53.400 --> 00:02:55.159
<v Speaker 2>I'm like, yeah, I took a look at Sandbox today,

51
00:02:55.159 --> 00:02:56.879
<v Speaker 2>And he's like, sorry, what did you just say?

52
00:02:56.919 --> 00:02:58.560
<v Speaker 1>I'm sorry, you looked at what.

53
00:02:58.639 --> 00:03:00.680
<v Speaker 2>Fo to Sandbox four to Sandbox bad?

54
00:03:00.680 --> 00:03:02.360
<v Speaker 1>All right, I'm going to forty lunch now at the

55
00:03:02.400 --> 00:03:03.360
<v Speaker 1>forty cafeteria.

56
00:03:03.439 --> 00:03:05.080
<v Speaker 4>So put forty dollars in the tip.

57
00:03:05.159 --> 00:03:08.360
<v Speaker 1>Jar sweed jar A forty. Met up with you forty later.

58
00:03:11.680 --> 00:03:15.120
<v Speaker 1>All right, So go patch, Go patch, go patch. No

59
00:03:15.199 --> 00:03:19.199
<v Speaker 1>problem there right next you remember we talked about Canvas.

60
00:03:19.520 --> 00:03:21.560
<v Speaker 2>Yes we did, and they were hacked. Yes. I heard

61
00:03:21.560 --> 00:03:22.599
<v Speaker 2>a lot about Canvas.

62
00:03:23.120 --> 00:03:26.800
<v Speaker 1>Yeah, and Canvas was hacked. And it turns out that

63
00:03:26.840 --> 00:03:29.919
<v Speaker 1>they reached an agreement with the hacking group behind the breach,

64
00:03:30.400 --> 00:03:33.159
<v Speaker 1>and that they this is I don't get it. They

65
00:03:33.199 --> 00:03:36.599
<v Speaker 1>say all stolen data was returned.

66
00:03:36.360 --> 00:03:39.639
<v Speaker 2>Yeah, returned unread. Yeah. And you know what's great is

67
00:03:39.680 --> 00:03:43.800
<v Speaker 2>the bad guys. According to this sent a shred log

68
00:03:44.199 --> 00:03:46.879
<v Speaker 2>showing they deleted everything, like yeah, you know what we

69
00:03:46.960 --> 00:03:48.360
<v Speaker 2>removed it on, don't we Really?

70
00:03:49.360 --> 00:03:51.400
<v Speaker 1>All they had to do is back it up onto

71
00:03:51.719 --> 00:03:55.240
<v Speaker 1>something else and then what shred something else and say,

72
00:03:55.280 --> 00:03:56.240
<v Speaker 1>see we shredded it.

73
00:03:56.319 --> 00:03:58.000
<v Speaker 2>Yeah, it's all gone. It's all gone.

74
00:03:58.159 --> 00:03:59.759
<v Speaker 4>Are you saying there's no honor among.

75
00:03:59.680 --> 00:04:04.560
<v Speaker 2>The Yeah, yes, yes, that's what I'm saying. Yeah, yeah,

76
00:04:04.599 --> 00:04:07.840
<v Speaker 2>I know, right, there's very little honor among US security

77
00:04:07.879 --> 00:04:11.879
<v Speaker 2>people and never mind thieves. So instructure and oddly we

78
00:04:11.919 --> 00:04:14.080
<v Speaker 2>were joking about this before I read it all last

79
00:04:14.120 --> 00:04:16.480
<v Speaker 2>week because nobody knows the parent company of Canvas, but

80
00:04:16.600 --> 00:04:20.519
<v Speaker 2>as infrastructure, it's actually in structure. Yeah, so in structure.

81
00:04:20.680 --> 00:04:25.720
<v Speaker 2>UH reached out to the Shiny Hunters and miraculously came

82
00:04:25.759 --> 00:04:28.560
<v Speaker 2>to this agreement where the data was deleted and none

83
00:04:28.560 --> 00:04:30.879
<v Speaker 2>of it will be shared. And it's awesome. You know

84
00:04:30.920 --> 00:04:33.600
<v Speaker 2>what I missed in this article that I scoured for

85
00:04:33.680 --> 00:04:39.120
<v Speaker 2>and then I scoured the internet for is the data? No, No,

86
00:04:39.240 --> 00:04:42.560
<v Speaker 2>that's there. I can find that. How much do you

87
00:04:42.600 --> 00:04:43.399
<v Speaker 2>think they paid for that?

88
00:04:44.519 --> 00:04:44.879
<v Speaker 1>Wow?

89
00:04:45.240 --> 00:04:48.079
<v Speaker 2>Like they didn't. There is there is no mention of

90
00:04:48.120 --> 00:04:51.160
<v Speaker 2>it anywhere, and all there is is a note from

91
00:04:51.199 --> 00:04:55.639
<v Speaker 2>the FBI today saying we don't agree with paying for ransomware,

92
00:04:55.800 --> 00:04:58.439
<v Speaker 2>but just a generic note, not in reference to this,

93
00:04:58.600 --> 00:05:04.240
<v Speaker 2>of course, but in reference to this. So, yeah, my

94
00:05:04.399 --> 00:05:07.079
<v Speaker 2>guess is if you're using Canvas, your fees may go up.

95
00:05:07.160 --> 00:05:10.040
<v Speaker 1>You know, Shiny Hunters was my favorite band in the nineties,

96
00:05:10.480 --> 00:05:13.160
<v Speaker 1>and I particularly liked their first album, which was called

97
00:05:13.279 --> 00:05:14.519
<v Speaker 1>Stolen Hard Drives.

98
00:05:15.240 --> 00:05:17.959
<v Speaker 2>Nice. Yeah, yeah, yeah, I could see that. I could

99
00:05:17.959 --> 00:05:18.279
<v Speaker 2>see that.

100
00:05:18.399 --> 00:05:19.600
<v Speaker 1>Yeah, Shiny Hunters.

101
00:05:20.439 --> 00:05:23.720
<v Speaker 4>So, Patrick, how much do you think they paid? I

102
00:05:23.720 --> 00:05:25.560
<v Speaker 4>would think it was a six six figures.

103
00:05:25.639 --> 00:05:28.199
<v Speaker 1>It's got to be six or seven figures.

104
00:05:27.920 --> 00:05:31.279
<v Speaker 2>So with the damages they caused, and so, okay, when

105
00:05:31.279 --> 00:05:35.040
<v Speaker 2>we talked about this last week, we said, listen, initially,

106
00:05:35.040 --> 00:05:37.040
<v Speaker 2>this is not a big deal. This was a data breach.

107
00:05:37.519 --> 00:05:40.319
<v Speaker 2>They actually signed up as a free teacher. There's a

108
00:05:40.360 --> 00:05:42.879
<v Speaker 2>free teacher accounts, so they signed up as a free teacher.

109
00:05:42.920 --> 00:05:44.519
<v Speaker 2>They quirt an API. They were able to get more

110
00:05:44.519 --> 00:05:47.519
<v Speaker 2>information than they should, you know, blah blah blah. Right,

111
00:05:48.680 --> 00:05:52.680
<v Speaker 2>and it should have stopped there. But what the forensics

112
00:05:52.759 --> 00:05:55.959
<v Speaker 2>is now releasing is there was a fair bit of Okay,

113
00:05:56.000 --> 00:05:58.319
<v Speaker 2>now that we have some information on who the students

114
00:05:58.319 --> 00:05:59.680
<v Speaker 2>are who the teachers are in a little bit of

115
00:05:59.720 --> 00:06:08.120
<v Speaker 2>a mess. Let's start crafting our own parts inside canvas

116
00:06:09.399 --> 00:06:11.519
<v Speaker 2>because you can do that, right, You can create your

117
00:06:11.560 --> 00:06:14.160
<v Speaker 2>own little HTML snippets and that sort of stuff. And

118
00:06:14.199 --> 00:06:19.439
<v Speaker 2>they started doing that and injecting cross site scripting once

119
00:06:19.600 --> 00:06:23.360
<v Speaker 2>that happened. Now they were getting access to real accounts, right,

120
00:06:23.399 --> 00:06:25.680
<v Speaker 2>and starting to get access to administrative accounts, so.

121
00:06:25.639 --> 00:06:28.439
<v Speaker 4>They could do like a module that teaches teachers how

122
00:06:28.480 --> 00:06:32.160
<v Speaker 4>to detect using AI to write a paper or things

123
00:06:32.199 --> 00:06:32.480
<v Speaker 4>like that.

124
00:06:32.600 --> 00:06:38.759
<v Speaker 2>Sure, absolutely right, speculation, yep, just speculation. Yeah, So cross

125
00:06:38.759 --> 00:06:41.920
<v Speaker 2>site scripting to cross site scripting was absolutely used in

126
00:06:42.000 --> 00:06:44.439
<v Speaker 2>starting to steal accounts once they got access to the

127
00:06:44.560 --> 00:06:48.399
<v Speaker 2>data they had through the APIs. And then on top

128
00:06:48.439 --> 00:06:53.600
<v Speaker 2>of that, it also allowed them to inject that warning

129
00:06:53.639 --> 00:06:57.399
<v Speaker 2>screen we saw last week, Hey shiny hunters have compromised

130
00:06:57.399 --> 00:07:00.240
<v Speaker 2>blah blah blah whatever. Right, And all that was was, yeah,

131
00:07:00.240 --> 00:07:02.160
<v Speaker 2>they didn't take down the back end servers. They were

132
00:07:02.199 --> 00:07:04.480
<v Speaker 2>just messing around with the hteam out, but it freaked

133
00:07:04.480 --> 00:07:09.120
<v Speaker 2>everybody out, causing damages and chaos that way.

134
00:07:09.360 --> 00:07:11.519
<v Speaker 4>So it's worth saying something. This is a little bit

135
00:07:11.519 --> 00:07:13.199
<v Speaker 4>of of a segue, but it's a little bit of

136
00:07:13.399 --> 00:07:17.199
<v Speaker 4>a PSA. So one of the plagues of the Internet

137
00:07:17.399 --> 00:07:19.680
<v Speaker 4>is you go to a website and it asks it

138
00:07:19.720 --> 00:07:22.240
<v Speaker 4>to send you notifications, and you should always say no,

139
00:07:23.000 --> 00:07:25.560
<v Speaker 4>but you say yes by accident or you sneeze and

140
00:07:25.560 --> 00:07:28.920
<v Speaker 4>click the wrong thing. That site now can send you

141
00:07:29.040 --> 00:07:33.120
<v Speaker 4>pop toast and notifications, and a lot of times what

142
00:07:33.199 --> 00:07:37.959
<v Speaker 4>happens is you give the wrong website that permission and

143
00:07:38.000 --> 00:07:40.959
<v Speaker 4>it starts telling you that you're infected. Yeah, and then

144
00:07:41.079 --> 00:07:45.199
<v Speaker 4>that leads you to the panic that causes the actual breach. Yeah,

145
00:07:45.240 --> 00:07:47.839
<v Speaker 4>because those notifications are harmless if you don't click on.

146
00:07:47.800 --> 00:07:51.000
<v Speaker 1>Them, right, Yeah, those notifications, if you've approved them, they

147
00:07:51.000 --> 00:07:53.639
<v Speaker 1>could put whatever JavaScript or anything they want in there

148
00:07:53.680 --> 00:07:54.879
<v Speaker 1>because you've approved it.

149
00:07:54.959 --> 00:07:58.720
<v Speaker 4>So you basically get told you're about to die if

150
00:07:58.720 --> 00:08:01.680
<v Speaker 4>you don't send me fifty thousand dollars. But you're really not.

151
00:08:01.839 --> 00:08:05.399
<v Speaker 4>You're not gotten until you take the bait. And so

152
00:08:05.519 --> 00:08:08.399
<v Speaker 4>I think this is akin to that kind of psychological effect.

153
00:08:08.480 --> 00:08:10.319
<v Speaker 4>So one of the one of the key things to

154
00:08:10.399 --> 00:08:15.920
<v Speaker 4>avoid is panic and taking a rash decision. If they're

155
00:08:15.920 --> 00:08:19.079
<v Speaker 4>gonna make a rash decision, unplug the system, Yes, like,

156
00:08:19.199 --> 00:08:21.240
<v Speaker 4>just unplug it. That'll buy you time.

157
00:08:21.279 --> 00:08:23.639
<v Speaker 2>Well, It sounds like instructor tried that right, and they

158
00:08:23.639 --> 00:08:26.160
<v Speaker 2>shut everything down during finals, which messed a lot of

159
00:08:26.160 --> 00:08:26.639
<v Speaker 2>people up.

160
00:08:26.680 --> 00:08:28.879
<v Speaker 4>I get it, but I'm just saying for the users

161
00:08:29.079 --> 00:08:33.799
<v Speaker 4>when in doubt, stop and analyze. Don't don't kneed jerk reaction.

162
00:08:33.919 --> 00:08:35.919
<v Speaker 2>But here's the here's the other thing I would ask.

163
00:08:36.320 --> 00:08:38.840
<v Speaker 2>If you're Canvas and you're an educational tool and you

164
00:08:39.000 --> 00:08:42.799
<v Speaker 2>allow your users a tool I know, right, you allow

165
00:08:42.799 --> 00:08:46.960
<v Speaker 2>your users to create content and that content can have

166
00:08:47.279 --> 00:08:51.679
<v Speaker 2>JavaScript in it, Why, oh why would you ever not

167
00:08:51.840 --> 00:08:52.759
<v Speaker 2>have that pen tested?

168
00:08:53.240 --> 00:08:53.679
<v Speaker 1>Right? Like?

169
00:08:53.759 --> 00:08:56.600
<v Speaker 2>That should have been number one. Hey, my users might

170
00:08:56.639 --> 00:08:59.600
<v Speaker 2>be malicious, especially seeing we're handing out free accounts because

171
00:08:59.600 --> 00:09:06.399
<v Speaker 2>they need to say the ransoms. Well thanks for that, Patrick,

172
00:09:06.399 --> 00:09:08.240
<v Speaker 2>I didn't think about it that way. That makes the

173
00:09:08.519 --> 00:09:09.320
<v Speaker 2>same number.

174
00:09:09.080 --> 00:09:10.519
<v Speaker 1>Two, Patrick Hines.

175
00:09:13.320 --> 00:09:15.200
<v Speaker 2>Sorry, Yeah, I just closed my mind when I see that,

176
00:09:15.200 --> 00:09:19.440
<v Speaker 2>because it's like, did you have no eye whatsoever towards

177
00:09:19.519 --> 00:09:22.480
<v Speaker 2>the fact that this could be used maliciously, especially in

178
00:09:22.519 --> 00:09:24.039
<v Speaker 2>the fact that you're handing out free accounts?

179
00:09:24.279 --> 00:09:25.080
<v Speaker 1>Yeah?

180
00:09:25.080 --> 00:09:28.919
<v Speaker 2>And I will tell you if if this was pen tested,

181
00:09:29.759 --> 00:09:31.519
<v Speaker 2>I don't know that I would go back to that

182
00:09:31.799 --> 00:09:34.440
<v Speaker 2>pen testing team. I can tell you, like, do we

183
00:09:34.519 --> 00:09:37.919
<v Speaker 2>find everything in a pen test. No, but there's like

184
00:09:38.039 --> 00:09:39.679
<v Speaker 2>cross sit scripting is usually.

185
00:09:42.720 --> 00:09:46.000
<v Speaker 1>By the way, I think the Shiny Hunters second album

186
00:09:46.039 --> 00:09:47.399
<v Speaker 1>was even better. That's called data.

187
00:09:47.480 --> 00:09:50.799
<v Speaker 2>What data?

188
00:09:51.559 --> 00:09:52.519
<v Speaker 1>All right, let's move on.

189
00:09:52.679 --> 00:09:56.480
<v Speaker 2>Kong tu was it? Bye bye bye? There was not us.

190
00:09:58.519 --> 00:10:03.000
<v Speaker 1>Kong tou ko t u k e. Hackers now use

191
00:10:03.159 --> 00:10:05.480
<v Speaker 1>Microsoft teams for corporate breaches.

192
00:10:05.720 --> 00:10:08.279
<v Speaker 4>Is that like a hat a knit hat for King Kong?

193
00:10:08.600 --> 00:10:08.879
<v Speaker 3>It is?

194
00:10:09.240 --> 00:10:11.600
<v Speaker 2>It's a konto, It's a French hat.

195
00:10:12.200 --> 00:10:14.600
<v Speaker 1>Is the I'd hate to see the ball of yarn

196
00:10:14.679 --> 00:10:20.720
<v Speaker 1>that started as take Yeah, so the interesting what is

197
00:10:20.799 --> 00:10:21.799
<v Speaker 1>kong tuk anyway?

198
00:10:22.000 --> 00:10:26.879
<v Speaker 2>So kong Tuk is a malicious team what they call

199
00:10:26.919 --> 00:10:30.639
<v Speaker 2>it an initial access broker IV. Initial access brokers aren't

200
00:10:30.639 --> 00:10:33.600
<v Speaker 2>people who have malware, aren't people who take bitcoin that

201
00:10:33.639 --> 00:10:36.799
<v Speaker 2>sort of stuff. They break into sites and they stay

202
00:10:36.840 --> 00:10:40.919
<v Speaker 2>as quiet as possible, and then they sell access to

203
00:10:41.080 --> 00:10:43.919
<v Speaker 2>those sites. So they say, hey, I have access to

204
00:10:44.759 --> 00:10:47.559
<v Speaker 2>you know, uh canvas. Yeah, well yeah exactly, I have

205
00:10:47.600 --> 00:10:50.879
<v Speaker 2>accesses to canvas in multiple schools, uh you know who

206
00:10:50.960 --> 00:10:52.799
<v Speaker 2>wants it on the dark web and then at that

207
00:10:52.840 --> 00:10:55.919
<v Speaker 2>point there's a bidding frenzy and people then get access

208
00:10:56.440 --> 00:10:58.360
<v Speaker 2>go infect the place. That sort of stuff.

209
00:10:58.399 --> 00:10:58.559
<v Speaker 1>You know.

210
00:10:58.600 --> 00:11:00.440
<v Speaker 2>What's interesting I find is a lot of the people

211
00:11:00.480 --> 00:11:05.120
<v Speaker 2>who do the ransomware and damages and that sort of stuff,

212
00:11:05.159 --> 00:11:09.120
<v Speaker 2>they get caught. They there are several articles of some

213
00:11:09.279 --> 00:11:11.679
<v Speaker 2>arrests that happened this week. You don't see it a

214
00:11:11.720 --> 00:11:14.320
<v Speaker 2>lot with the initial access brokers, no right where it's like, oh,

215
00:11:14.320 --> 00:11:16.039
<v Speaker 2>I don't know, we found an exploit, but we didn't

216
00:11:16.080 --> 00:11:18.679
<v Speaker 2>do anything with it, although they didn't turn it into

217
00:11:18.720 --> 00:11:19.480
<v Speaker 2>the company either.

218
00:11:19.679 --> 00:11:23.279
<v Speaker 4>In human trafficking. All the people who actually do the

219
00:11:23.279 --> 00:11:26.240
<v Speaker 4>initial kidnapping and things like that very rarely come to justice.

220
00:11:26.240 --> 00:11:28.200
<v Speaker 4>It's the ones at the end. Yeah, you know, but

221
00:11:28.240 --> 00:11:30.000
<v Speaker 4>they're every bit is bad.

222
00:11:30.200 --> 00:11:30.919
<v Speaker 2>Stark advice.

223
00:11:31.000 --> 00:11:32.559
<v Speaker 4>I know, got dark there, didn't.

224
00:11:32.559 --> 00:11:35.440
<v Speaker 1>I get nervous when I see PowerShell commands like this

225
00:11:35.559 --> 00:11:40.279
<v Speaker 1>PowerShell ex Dash Execution policy bypass.

226
00:11:40.000 --> 00:11:45.879
<v Speaker 2>Nice what Windows style hidden? Don't show the window? What right? Yep?

227
00:11:46.000 --> 00:11:50.039
<v Speaker 2>Dash command IWR yep. So it's downloading from a from

228
00:11:50.120 --> 00:11:53.399
<v Speaker 2>a ZIP. It looks like from drop box. So Dropbox

229
00:11:53.480 --> 00:11:55.440
<v Speaker 2>isn't going to be picked up on your outbound rules

230
00:11:55.960 --> 00:11:59.120
<v Speaker 2>because everybody uses that out to a file, it expands

231
00:11:59.200 --> 00:12:05.840
<v Speaker 2>it and then it runs win zip. It runs a winps, Python,

232
00:12:06.080 --> 00:12:11.039
<v Speaker 2>Slash games, dot Pie heads up. Those aren't games. Yeah,

233
00:12:11.320 --> 00:12:12.679
<v Speaker 2>I'm going to throw that out there right now.

234
00:12:12.720 --> 00:12:13.759
<v Speaker 4>They're fun for somebody.

235
00:12:13.879 --> 00:12:16.559
<v Speaker 2>Yeah, it's a it's a modal rat So what does.

236
00:12:16.440 --> 00:12:18.879
<v Speaker 1>This mean for people who use Microsoft Teams all the time?

237
00:12:19.320 --> 00:12:26.000
<v Speaker 2>So this will cause yeah, no, oh my god, sorry

238
00:12:27.240 --> 00:12:27.840
<v Speaker 2>so mean.

239
00:12:27.960 --> 00:12:30.559
<v Speaker 1>And that's why Patrick and I are not regional directors.

240
00:12:31.600 --> 00:12:35.919
<v Speaker 2>Yeah, exactly, they're like, way to toe the line. All

241
00:12:35.960 --> 00:12:38.240
<v Speaker 2>this means is this, This is a social engineering attack.

242
00:12:38.320 --> 00:12:41.320
<v Speaker 2>This isn't you know, teams being exploited. This, it's just

243
00:12:41.320 --> 00:12:43.519
<v Speaker 2>a delivery mechanism. It's it's the same thing as if

244
00:12:43.559 --> 00:12:45.320
<v Speaker 2>they had sent you an email with this command and

245
00:12:45.360 --> 00:12:48.279
<v Speaker 2>asked you to run it. Right, They're just they're now

246
00:12:48.720 --> 00:12:52.679
<v Speaker 2>initial access brokers are targeting every surface they can, whether

247
00:12:52.720 --> 00:12:55.360
<v Speaker 2>it's email, whether it's SMS. Is a lot harder, right,

248
00:12:55.440 --> 00:12:57.120
<v Speaker 2>They're not going to text you these commands because you

249
00:12:57.159 --> 00:13:01.039
<v Speaker 2>can't run them. But messaging apps Telegram, WhatsApp, if you're

250
00:13:01.080 --> 00:13:03.039
<v Speaker 2>running them on your desktop and get commands like this,

251
00:13:03.039 --> 00:13:05.000
<v Speaker 2>This happens all the time. Just teams is in the

252
00:13:05.000 --> 00:13:08.240
<v Speaker 2>mix now, So I'd say, don't run things you don't

253
00:13:08.279 --> 00:13:11.960
<v Speaker 2>know what they are. Don't don't like Patrick lakes to say,

254
00:13:12.000 --> 00:13:14.120
<v Speaker 2>don't pick up gum and chew it off the floor.

255
00:13:14.320 --> 00:13:18.919
<v Speaker 2>But here, trendy freaky, these aren't free games, I promise you.

256
00:13:19.039 --> 00:13:22.080
<v Speaker 1>Yeah, all right, one more and then we'll take a break.

257
00:13:22.720 --> 00:13:25.600
<v Speaker 1>Praise on AI p r A I s O n

258
00:13:25.720 --> 00:13:33.000
<v Speaker 1>AI off bypass targeted within hours of disclosure. So Dwayne,

259
00:13:33.080 --> 00:13:33.840
<v Speaker 1>you like this one?

260
00:13:33.919 --> 00:13:34.879
<v Speaker 2>I do like this one?

261
00:13:34.879 --> 00:13:36.039
<v Speaker 4>How many hours so this?

262
00:13:36.399 --> 00:13:39.360
<v Speaker 2>Yeah? I know? Right? So well, first let's talk about

263
00:13:39.360 --> 00:13:42.879
<v Speaker 2>the exploit. So the vulnerability here and think think of

264
00:13:42.919 --> 00:13:46.039
<v Speaker 2>praise on AI as like an open Claws spin off

265
00:13:46.200 --> 00:13:49.159
<v Speaker 2>type thing whatever. Right, there's tons of these things around.

266
00:13:49.000 --> 00:13:51.039
<v Speaker 1>Something you give agency to. You give it all your

267
00:13:51.080 --> 00:13:52.279
<v Speaker 1>passwords and stuff.

268
00:13:52.039 --> 00:13:54.840
<v Speaker 2>And all your passwords and your AI keys so they

269
00:13:54.840 --> 00:13:55.919
<v Speaker 2>can charge you millions of months.

270
00:13:56.000 --> 00:13:58.279
<v Speaker 1>Yeah, nicko's and ax on your behalf and you hope

271
00:13:58.279 --> 00:13:59.559
<v Speaker 1>that it doesn't screw up your life.

272
00:13:59.679 --> 00:14:04.960
<v Speaker 2>Yeah it does and it does. So in here blah

273
00:14:04.960 --> 00:14:07.919
<v Speaker 2>blah blah, they deploy a flask server, which is a

274
00:14:07.919 --> 00:14:11.559
<v Speaker 2>web server for running Python. Uh you know code and

275
00:14:12.080 --> 00:14:14.759
<v Speaker 2>you know lo and behold. There's no authentication turned on

276
00:14:14.799 --> 00:14:18.480
<v Speaker 2>by default whatever, right, I mean, yeah, it sucks. Somebody

277
00:14:18.480 --> 00:14:20.440
<v Speaker 2>should have tested it. Somebody should have found it whatever.

278
00:14:21.080 --> 00:14:23.080
<v Speaker 2>If you're if you have this accessible on the internet,

279
00:14:23.240 --> 00:14:25.600
<v Speaker 2>you know, bad for you. Anyways, you probably should have

280
00:14:25.639 --> 00:14:26.080
<v Speaker 2>not had that.

281
00:14:26.120 --> 00:14:29.320
<v Speaker 1>But they said that it ships with a legacy flask

282
00:14:29.399 --> 00:14:33.559
<v Speaker 1>API server with off disabled by default, right, so shame

283
00:14:33.600 --> 00:14:34.679
<v Speaker 1>on them for doing that.

284
00:14:34.759 --> 00:14:38.559
<v Speaker 2>Yeah. True, shame on everybody. Shame on everybody. Everybody gets shame.

285
00:14:39.919 --> 00:14:43.120
<v Speaker 2>So yeah, okay, this is a classic story like boy

286
00:14:43.159 --> 00:14:46.039
<v Speaker 2>meets API server, API server doesn't ask what his name is.

287
00:14:46.000 --> 00:14:46.159
<v Speaker 3>And.

288
00:14:48.200 --> 00:14:52.600
<v Speaker 2>Yeah, exactly. But the more interesting part was the moment

289
00:14:52.720 --> 00:14:58.440
<v Speaker 2>that this was announced publicly. Uh, this was targeted within

290
00:14:58.679 --> 00:15:03.080
<v Speaker 2>four hours public disclosure, so publicly they came out and said, hey,

291
00:15:03.080 --> 00:15:06.159
<v Speaker 2>we got this thing. It's really weird. People can access

292
00:15:06.200 --> 00:15:09.240
<v Speaker 2>the API agent's file. We're taking care of it. And

293
00:15:09.320 --> 00:15:12.399
<v Speaker 2>then four hours later servers were seeing from the internet

294
00:15:12.960 --> 00:15:16.799
<v Speaker 2>scans coming in to look for those files. Four hours

295
00:15:16.840 --> 00:15:18.000
<v Speaker 2>four hours.

296
00:15:17.639 --> 00:15:20.399
<v Speaker 4>I mean, that's a little longer than the Gilligan's tour, but.

297
00:15:22.360 --> 00:15:27.759
<v Speaker 2>About his devastating as a Gilligan's tour. Now, professor, you

298
00:15:27.759 --> 00:15:32.039
<v Speaker 2>can fix everything but the boat. Okay, as is Justice

299
00:15:32.080 --> 00:15:35.440
<v Speaker 2>side tour here? Yeah, why really, you couldn't fix the boat.

300
00:15:35.440 --> 00:15:37.399
<v Speaker 2>You couldn't even build a raft out of all that

301
00:15:37.480 --> 00:15:40.200
<v Speaker 2>wood and bamboo they had. He built a radio out

302
00:15:40.200 --> 00:15:42.759
<v Speaker 2>of coconuts. I know it doesn't make any sense.

303
00:15:43.080 --> 00:15:46.200
<v Speaker 1>Yeah, well, I I just wonder how they got all

304
00:15:46.240 --> 00:15:48.600
<v Speaker 1>those batteries to last for so many years. You know,

305
00:15:50.200 --> 00:15:53.840
<v Speaker 1>did you know that the whole premise of Gilligan's Island

306
00:15:53.960 --> 00:15:56.960
<v Speaker 1>was for each of them one to represent the seven

307
00:15:57.000 --> 00:15:57.679
<v Speaker 1>Deadly Sins?

308
00:15:58.039 --> 00:16:00.200
<v Speaker 2>No? Really, no I did not.

309
00:16:00.440 --> 00:16:01.840
<v Speaker 1>Oh yeah, yep, that was it.

310
00:16:02.000 --> 00:16:03.960
<v Speaker 2>I mean I could see I could see Thurston Howell

311
00:16:03.960 --> 00:16:07.799
<v Speaker 2>as Greed. Yeah, I could see. Uh absolutely, Gilligan was

312
00:16:07.879 --> 00:16:11.000
<v Speaker 2>sloth Vanity. Uh wait who Gilligan was?

313
00:16:11.759 --> 00:16:13.960
<v Speaker 1>Gilligan was slough because he was lazy and he didn't

314
00:16:13.960 --> 00:16:14.360
<v Speaker 1>do anything.

315
00:16:14.639 --> 00:16:17.559
<v Speaker 2>I thought Gillian Gilligan was idiocy, but sloth makes.

316
00:16:17.320 --> 00:16:19.759
<v Speaker 1>I don't think idiocy is one of the dead, but

317
00:16:19.799 --> 00:16:21.320
<v Speaker 1>it should fortunately should be.

318
00:16:21.399 --> 00:16:26.799
<v Speaker 2>But uh wait, Ginger was probably Vanity lust Oh lust.

319
00:16:26.840 --> 00:16:28.440
<v Speaker 4>Yeah, Vanity would be Missus Howell.

320
00:16:29.080 --> 00:16:31.919
<v Speaker 1>The Skipper was Gluttony.

321
00:16:32.000 --> 00:16:32.159
<v Speaker 2>Yeah.

322
00:16:32.440 --> 00:16:33.639
<v Speaker 4>Or what's what's her name?

323
00:16:33.679 --> 00:16:37.000
<v Speaker 2>The other love Marianne Daddy mah oh mary Anne?

324
00:16:37.320 --> 00:16:38.720
<v Speaker 1>Oh geez, I don't I don't.

325
00:16:38.600 --> 00:16:41.399
<v Speaker 2>Remember, okay, ken one of you without looking on the

326
00:16:41.399 --> 00:16:41.960
<v Speaker 2>internet name.

327
00:16:42.000 --> 00:16:45.000
<v Speaker 4>I think Missus Howell was van Gilligan.

328
00:16:49.639 --> 00:16:52.399
<v Speaker 1>You know, when you said boy meets Ai and all

329
00:16:52.399 --> 00:16:55.480
<v Speaker 1>that stuff, I was immediately reminded of watching MTV with

330
00:16:55.679 --> 00:16:57.519
<v Speaker 1>when bands in the eighties towards the end of the

331
00:16:57.519 --> 00:16:59.960
<v Speaker 1>eighties just started getting a bigger edge to them and

332
00:17:00.039 --> 00:17:02.840
<v Speaker 1>getting out of the glam band thing, and this one

333
00:17:02.879 --> 00:17:03.879
<v Speaker 1>heavy metal guy.

334
00:17:03.840 --> 00:17:06.680
<v Speaker 2>Goes yeah, you know, it's a typical love story.

335
00:17:06.960 --> 00:17:10.519
<v Speaker 1>Boy loves girl, girl doesn't love boy, boy kills girl.

336
00:17:13.319 --> 00:17:17.279
<v Speaker 2>That's uh, that's typical dark dark dark. All right, here's

337
00:17:17.319 --> 00:17:25.160
<v Speaker 2>our official list. You're ready. Yeah, Pride, okay, greed, lust, envy, gluttony, wrath, sloth.

338
00:17:25.240 --> 00:17:26.240
<v Speaker 4>Oh, I wonder if that's it.

339
00:17:26.279 --> 00:17:28.240
<v Speaker 1>Marianne was envy, Yeah she wasn't.

340
00:17:28.319 --> 00:17:31.839
<v Speaker 2>Oh yeah she envy ginger? Yeah yeah, who was Pride?

341
00:17:31.839 --> 00:17:34.119
<v Speaker 1>And Pride must have been the professor.

342
00:17:34.319 --> 00:17:37.039
<v Speaker 2>Professor because he was so smart, but not really.

343
00:17:36.920 --> 00:17:38.400
<v Speaker 4>Because he refused to fix the boat.

344
00:17:42.759 --> 00:17:44.920
<v Speaker 2>He's like, I'm not fixing that boat that's beneath me.

345
00:17:45.119 --> 00:17:46.799
<v Speaker 4>Does this still qualify as an episode?

346
00:17:46.839 --> 00:17:49.599
<v Speaker 1>I don't think it's a security podcast anymore. We're going

347
00:17:49.680 --> 00:17:54.680
<v Speaker 1>to change it to uh three hours, right, all right,

348
00:17:54.759 --> 00:17:58.799
<v Speaker 1>So what's the takeaway for this thing? H be careful

349
00:17:58.839 --> 00:17:59.839
<v Speaker 1>because after.

350
00:18:00.119 --> 00:18:03.039
<v Speaker 2>You can going to be exploded. Yeah. I think there's

351
00:18:03.039 --> 00:18:05.240
<v Speaker 2>a couple takeaways. We've been talking about how AIS entered

352
00:18:05.240 --> 00:18:09.640
<v Speaker 2>the arena of exploitation, and we're starting to see we're

353
00:18:09.680 --> 00:18:14.160
<v Speaker 2>definitely starting to see attackers watching public announcements. Before they

354
00:18:14.160 --> 00:18:16.000
<v Speaker 2>couldn't do much about it, right, they'd needed to go

355
00:18:16.119 --> 00:18:17.880
<v Speaker 2>do research and figure out what's going on before they

356
00:18:17.880 --> 00:18:21.759
<v Speaker 2>could come up with an exploit. Now, with a public

357
00:18:21.799 --> 00:18:24.279
<v Speaker 2>announcement and just a little bit of detail, AI is

358
00:18:24.319 --> 00:18:27.440
<v Speaker 2>getting very, very good at discovering what the problem is

359
00:18:27.759 --> 00:18:29.160
<v Speaker 2>and then creating a proof of comoy.

360
00:18:29.200 --> 00:18:30.720
<v Speaker 1>I was going to say, it's the AIS that are

361
00:18:30.720 --> 00:18:33.079
<v Speaker 1>discovering these things people aren't glued to their Yeah.

362
00:18:33.119 --> 00:18:36.319
<v Speaker 4>Absolutely, Well, we're still we're still in the era where

363
00:18:36.400 --> 00:18:39.799
<v Speaker 4>AI because Mythos hasn't been generally released and who knows

364
00:18:39.839 --> 00:18:42.839
<v Speaker 4>whether it's actually living up to its standard is AI

365
00:18:43.039 --> 00:18:46.279
<v Speaker 4>is really great at finding vulnerabilities in things that has

366
00:18:46.279 --> 00:18:51.759
<v Speaker 4>the source code for like Linux kernels and documented stupidity.

367
00:18:51.720 --> 00:18:53.640
<v Speaker 2>Sure like this ye yeah, yep.

368
00:18:53.759 --> 00:18:57.440
<v Speaker 4>So if it knows what to look for, it will

369
00:18:57.480 --> 00:18:59.759
<v Speaker 4>find the vulnerability. Yes, we're still in that phase. We're

370
00:18:59.759 --> 00:19:02.920
<v Speaker 4>not in the phase yet where it's you know, inventing

371
00:19:03.039 --> 00:19:05.039
<v Speaker 4>new hacks from whole cloth.

372
00:19:05.319 --> 00:19:08.480
<v Speaker 1>And I think I'll put on my future looking hat here.

373
00:19:08.519 --> 00:19:10.319
<v Speaker 1>And I've said it before, and you know, I've been

374
00:19:10.319 --> 00:19:12.240
<v Speaker 1>pretty good about predicting the future in my career.

375
00:19:12.279 --> 00:19:12.839
<v Speaker 4>Your two.

376
00:19:15.079 --> 00:19:19.319
<v Speaker 1>Is that we're going to find that the AI works

377
00:19:19.359 --> 00:19:21.240
<v Speaker 1>for the good guys as fast as it does for

378
00:19:21.279 --> 00:19:22.680
<v Speaker 1>the bad guys at some point.

379
00:19:22.880 --> 00:19:23.119
<v Speaker 2>Sure.

380
00:19:23.160 --> 00:19:25.440
<v Speaker 1>And what I mean by that is we have to

381
00:19:25.559 --> 00:19:30.680
<v Speaker 1>have more automated patching that kind of stuff, better alerts.

382
00:19:31.960 --> 00:19:36.519
<v Speaker 1>Right now, we have to have our you know, our

383
00:19:36.559 --> 00:19:40.200
<v Speaker 1>documentation and in order in our list of resources what

384
00:19:40.200 --> 00:19:40.720
<v Speaker 1>do we call it.

385
00:19:40.759 --> 00:19:44.359
<v Speaker 4>The good guys have more money, and there are more

386
00:19:44.400 --> 00:19:46.599
<v Speaker 4>good guys more money than if we got into a

387
00:19:46.720 --> 00:19:51.960
<v Speaker 4>situation where we could patch things using a pool of

388
00:19:52.079 --> 00:19:56.079
<v Speaker 4>tokens and money so that we could patch things faster.

389
00:19:56.200 --> 00:19:59.240
<v Speaker 4>The problem is, if it's one company against all the

390
00:19:59.240 --> 00:20:01.839
<v Speaker 4>hackers that might come after him, then it's it's not

391
00:20:01.880 --> 00:20:04.680
<v Speaker 4>a fair fight. If it's all the defenders against all

392
00:20:04.720 --> 00:20:06.400
<v Speaker 4>the attackers, then it's very much a fair fight.

393
00:20:06.480 --> 00:20:08.519
<v Speaker 1>There could be services in the future that will have

394
00:20:08.599 --> 00:20:10.920
<v Speaker 1>your s bombs and all that stuff should be looking

395
00:20:10.960 --> 00:20:14.240
<v Speaker 1>out for you, and holy crap, where you know.

396
00:20:14.279 --> 00:20:16.200
<v Speaker 4>I think it's going to be a rocky five years.

397
00:20:16.240 --> 00:20:19.480
<v Speaker 1>This is vulnerable and that just got announced and we're

398
00:20:19.559 --> 00:20:20.279
<v Speaker 1>patching it now.

399
00:20:20.599 --> 00:20:22.960
<v Speaker 4>I have hope for five years from now. I don't

400
00:20:22.960 --> 00:20:24.160
<v Speaker 4>have hope for the next five.

401
00:20:24.000 --> 00:20:25.920
<v Speaker 1>I think it'll be sooner than that. It's got to be.

402
00:20:26.039 --> 00:20:27.279
<v Speaker 4>I hope, So, I hope.

403
00:20:27.319 --> 00:20:28.640
<v Speaker 1>So it's got it.

404
00:20:28.680 --> 00:20:31.119
<v Speaker 4>I thought I thought getting ransom weird for a decade

405
00:20:31.160 --> 00:20:34.200
<v Speaker 4>would cause people to back up their stuff in ways

406
00:20:34.200 --> 00:20:34.960
<v Speaker 4>that was immutable.

407
00:20:35.000 --> 00:20:36.640
<v Speaker 1>Well, I thought we were going to have peak oil

408
00:20:36.799 --> 00:20:38.680
<v Speaker 1>and the world is going to end before we found

409
00:20:38.720 --> 00:20:39.400
<v Speaker 1>fracking too.

410
00:20:39.519 --> 00:20:41.640
<v Speaker 2>I mean, yeah, so what do you think this podcast

411
00:20:41.680 --> 00:20:43.039
<v Speaker 2>looks like in a year.

412
00:20:43.079 --> 00:20:45.039
<v Speaker 1>I think we're just going to talk about Gilligan's Island.

413
00:20:45.480 --> 00:20:46.279
<v Speaker 4>I mean, I hope.

414
00:20:46.319 --> 00:20:48.079
<v Speaker 2>I mean it's a slower moving topic.

415
00:20:48.640 --> 00:20:52.759
<v Speaker 4>Yeah, I mean we've been declaring the death of the

416
00:20:52.799 --> 00:20:55.799
<v Speaker 4>need for cyber people for a long time. You and

417
00:20:55.839 --> 00:20:58.200
<v Speaker 4>I said, well, you know, this gravy train of sequel

418
00:20:58.240 --> 00:21:00.279
<v Speaker 4>injection can't last that long. You know.

419
00:21:00.319 --> 00:21:03.440
<v Speaker 2>It's funny. I remember when companies got firewalls and I

420
00:21:03.480 --> 00:21:05.680
<v Speaker 2>was like, well, it's all over and don't need to

421
00:21:05.720 --> 00:21:08.200
<v Speaker 2>be in security. Now everybody's got a firewall.

422
00:21:08.680 --> 00:21:11.400
<v Speaker 4>It just keeps getting bigger and bigger. And bigger because

423
00:21:11.559 --> 00:21:15.039
<v Speaker 4>the vulnerabilities keep getting weirder and weirder. Right, Oh, and

424
00:21:15.079 --> 00:21:16.920
<v Speaker 4>you have to have a sick, twisted mind like you

425
00:21:17.079 --> 00:21:20.039
<v Speaker 4>and somewhat to me in order to even think that way.

426
00:21:20.039 --> 00:21:21.920
<v Speaker 1>But I'm so glad my mind is not sick and

427
00:21:21.920 --> 00:21:22.920
<v Speaker 1>twisted like you. Guys.

428
00:21:22.960 --> 00:21:24.960
<v Speaker 4>We're working on it.

429
00:21:27.160 --> 00:21:27.480
<v Speaker 2>All right.

430
00:21:27.519 --> 00:21:29.079
<v Speaker 1>With that, let's take a little break and we'll get

431
00:21:29.119 --> 00:21:31.880
<v Speaker 1>back to I promise more security content right.

432
00:21:31.799 --> 00:21:34.319
<v Speaker 2>After these very important messages.

433
00:21:38.279 --> 00:21:41.240
<v Speaker 1>And we're back at security this week. That's Dwayne and

434
00:21:41.279 --> 00:21:44.559
<v Speaker 1>Patrick and I'm Carl And this is this one's going

435
00:21:44.599 --> 00:21:49.240
<v Speaker 1>to take a little bit of time to explain Windows

436
00:21:49.400 --> 00:21:55.960
<v Speaker 1>zero days expose BitLocker bypasses and CTF MOND privilege escalation.

437
00:21:56.400 --> 00:21:57.480
<v Speaker 2>This one's awesome.

438
00:21:57.799 --> 00:22:00.559
<v Speaker 1>Wow, that that's a big one.

439
00:22:01.079 --> 00:22:03.559
<v Speaker 2>Yeah, I mean I really actually like this one.

440
00:22:04.319 --> 00:22:06.720
<v Speaker 4>So before you get into this, you were talking about

441
00:22:07.160 --> 00:22:10.599
<v Speaker 4>how weird BitLocker is in the way it actually defends.

442
00:22:10.799 --> 00:22:12.079
<v Speaker 2>Yeah, so a lot of people I don't think I

443
00:22:12.119 --> 00:22:14.720
<v Speaker 2>understand how BitLocker works. Okay, so if you do bit

444
00:22:14.839 --> 00:22:16.839
<v Speaker 2>let's say we do BitLocker. Those that do you think

445
00:22:16.880 --> 00:22:17.640
<v Speaker 2>they know how it works?

446
00:22:17.640 --> 00:22:22.319
<v Speaker 1>Probably first well, BitLocker is to encrypt data in Windows

447
00:22:22.359 --> 00:22:23.720
<v Speaker 1>on the hard drive, right.

448
00:22:23.680 --> 00:22:25.279
<v Speaker 4>Yeah, And it's encryption at rest.

449
00:22:25.480 --> 00:22:26.599
<v Speaker 1>Encryption at rest, Yeah.

450
00:22:26.480 --> 00:22:28.799
<v Speaker 2>Exactly, I was going to say. And more specifically, it's

451
00:22:28.880 --> 00:22:30.599
<v Speaker 2>encryption at rest. So what does that mean?

452
00:22:30.640 --> 00:22:30.839
<v Speaker 1>Yah?

453
00:22:31.119 --> 00:22:35.000
<v Speaker 2>Data in motion. Obviously, data you're using needs to be

454
00:22:35.079 --> 00:22:38.279
<v Speaker 2>decrypted or you can't use it. Data at rest are

455
00:22:38.319 --> 00:22:40.119
<v Speaker 2>the bits that are sitting on I call it a

456
00:22:40.160 --> 00:22:42.440
<v Speaker 2>hard drive, not a hard drive anymore, right, solid state whatever,

457
00:22:42.559 --> 00:22:45.240
<v Speaker 2>but it in store for lack of yeah, for lack

458
00:22:45.279 --> 00:22:46.920
<v Speaker 2>of a better TERMAL call it hard drive. So you

459
00:22:46.920 --> 00:22:48.519
<v Speaker 2>have a hard drive in your in your computer, your

460
00:22:48.559 --> 00:22:51.759
<v Speaker 2>laptop or whatever. If you turn on BitLocker, you know

461
00:22:51.839 --> 00:22:54.160
<v Speaker 2>ya for you if you lose your laptop, somebody can't

462
00:22:54.160 --> 00:22:57.319
<v Speaker 2>pull the data off that drive. Well they can now,

463
00:22:57.480 --> 00:23:00.440
<v Speaker 2>but they used to not be able to that data

464
00:23:00.440 --> 00:23:02.759
<v Speaker 2>off the drive and we've seen so how does it work? Actually,

465
00:23:02.799 --> 00:23:05.240
<v Speaker 2>So that's a good question, you say yourself. Okay, so

466
00:23:05.279 --> 00:23:07.759
<v Speaker 2>the whole drive is encrypted at rest. If it's encrypted

467
00:23:07.799 --> 00:23:09.000
<v Speaker 2>at rest, how do I boot my computer?

468
00:23:09.279 --> 00:23:10.920
<v Speaker 1>Because if it doesn't have to be your whole drive,

469
00:23:10.920 --> 00:23:12.319
<v Speaker 1>by the way, it could just be one folder.

470
00:23:12.400 --> 00:23:14.839
<v Speaker 2>Sure, absolutely, But let's say we're using but it's typically

471
00:23:14.839 --> 00:23:18.000
<v Speaker 2>the whole drive. Let's say, we're using full volume encryption. Okay,

472
00:23:18.079 --> 00:23:19.519
<v Speaker 2>we're encrypting everything.

473
00:23:19.240 --> 00:23:20.799
<v Speaker 4>Which is the thing most people do.

474
00:23:20.920 --> 00:23:23.680
<v Speaker 2>Yes, you say yourself, okay, so if I'm using full

475
00:23:23.759 --> 00:23:28.240
<v Speaker 2>volume encryption, then how does the computer boot? Right? Just

476
00:23:28.279 --> 00:23:31.079
<v Speaker 2>ask that simple question. Well, there's some Windows files kicking

477
00:23:31.079 --> 00:23:32.000
<v Speaker 2>around somewhere.

478
00:23:32.119 --> 00:23:33.960
<v Speaker 4>I thought they were in the TPM.

479
00:23:33.559 --> 00:23:36.680
<v Speaker 1>That aren't encrypted, and they need some isn't encrypted at

480
00:23:36.680 --> 00:23:38.359
<v Speaker 1>boot time, So that's what you're saying.

481
00:23:38.599 --> 00:23:41.519
<v Speaker 2>No, they're all encrypted. That's the part that's weird. Most

482
00:23:41.519 --> 00:23:44.480
<v Speaker 2>people don't get the whole thing is encrypted. So you say, okay, well,

483
00:23:45.079 --> 00:23:47.160
<v Speaker 2>how does it even boot Windows? Then how do I

484
00:23:47.160 --> 00:23:49.319
<v Speaker 2>get into Windows? The way it works is my whole

485
00:23:49.319 --> 00:23:52.839
<v Speaker 2>hard drive is encrypted, So when I boot my computer up,

486
00:23:52.920 --> 00:23:55.880
<v Speaker 2>your computer goes through this whole BIOS check, the CPU check,

487
00:23:55.920 --> 00:23:59.480
<v Speaker 2>the memory check, the whatever. And the computers that support

488
00:24:00.079 --> 00:24:02.400
<v Speaker 2>locker have a chip on the motherboard which is a

489
00:24:02.400 --> 00:24:08.119
<v Speaker 2>tp M chip. It's a trusted compute module that holds keys.

490
00:24:08.480 --> 00:24:11.440
<v Speaker 2>That's what it does. That's its job, right, and it

491
00:24:11.640 --> 00:24:16.000
<v Speaker 2>verifies that nothing has changed in the security of the

492
00:24:16.039 --> 00:24:19.599
<v Speaker 2>boot order. So what that means is, you know, is

493
00:24:19.640 --> 00:24:22.680
<v Speaker 2>the drive serial number the same? Is it have? Am

494
00:24:22.720 --> 00:24:25.599
<v Speaker 2>I booting in UEFI. There's all sorts of things it

495
00:24:25.680 --> 00:24:30.759
<v Speaker 2>checks and if everything checks out, it goes Okay. I

496
00:24:30.839 --> 00:24:34.000
<v Speaker 2>will give you a key, but that key does not

497
00:24:34.160 --> 00:24:37.920
<v Speaker 2>decrypt the hard drive. That key is a master key

498
00:24:38.680 --> 00:24:42.400
<v Speaker 2>that decrypts the key that's used for the hard drive.

499
00:24:42.480 --> 00:24:46.319
<v Speaker 2>This is an important distinction. So there are two keys,

500
00:24:47.079 --> 00:24:51.599
<v Speaker 2>two symmetric keys that are used for encryption. One of

501
00:24:51.640 --> 00:24:52.000
<v Speaker 2>them is.

502
00:24:51.960 --> 00:24:55.240
<v Speaker 1>The symmetric used. Symmetric means one way and asymmetric use

503
00:24:55.400 --> 00:24:57.160
<v Speaker 1>means both ways. Is that how it works?

504
00:24:57.480 --> 00:24:59.720
<v Speaker 2>So let me let me break that apart even more.

505
00:25:00.119 --> 00:25:02.799
<v Speaker 2>Metric means the key is used. The same key is

506
00:25:02.880 --> 00:25:05.319
<v Speaker 2>used to decrypts as it is to encrypt. It's like

507
00:25:05.400 --> 00:25:07.599
<v Speaker 2>we have a password and if I give you the password,

508
00:25:07.599 --> 00:25:09.359
<v Speaker 2>you're gonna give me access to a room or whatever

509
00:25:09.400 --> 00:25:10.960
<v Speaker 2>it is. But is that one password.

510
00:25:11.000 --> 00:25:13.440
<v Speaker 4>It's like using a key to lock a door, same

511
00:25:13.519 --> 00:25:15.160
<v Speaker 4>key unlocks the door exactly.

512
00:25:15.200 --> 00:25:16.400
<v Speaker 1>That's symmetric, yes.

513
00:25:16.880 --> 00:25:20.240
<v Speaker 4>Whereas asymmetric means one key locks and a different key

514
00:25:20.359 --> 00:25:21.359
<v Speaker 4>unlocks exactly.

515
00:25:21.359 --> 00:25:23.559
<v Speaker 2>Okay, right, Yeah, that's a that's a good way of

516
00:25:23.559 --> 00:25:24.000
<v Speaker 2>thinking about it.

517
00:25:24.000 --> 00:25:26.799
<v Speaker 1>That's a really Hey, if you learn nothing today except

518
00:25:26.799 --> 00:25:30.319
<v Speaker 1>for the seven Deadly sins.

519
00:25:30.279 --> 00:25:31.680
<v Speaker 2>You'll remember the Gilligan stuff.

520
00:25:31.759 --> 00:25:36.759
<v Speaker 1>This is something to remember because yeah, that that was

521
00:25:36.759 --> 00:25:38.319
<v Speaker 1>a piece of data that went in when here and

522
00:25:38.319 --> 00:25:40.759
<v Speaker 1>out the other when I was working with the keys.

523
00:25:40.920 --> 00:25:43.400
<v Speaker 2>Yeah, and it's and so okay, so we got two

524
00:25:43.640 --> 00:25:48.119
<v Speaker 2>symmetric keys. We have a master symmetric key that is

525
00:25:48.240 --> 00:25:54.680
<v Speaker 2>used to unlock the the the volume level key. Yeah,

526
00:25:54.680 --> 00:25:57.240
<v Speaker 2>and the volume level key is used to unlock all

527
00:25:57.279 --> 00:25:59.319
<v Speaker 2>of the files on the drive. Those are two keys.

528
00:26:00.160 --> 00:26:05.880
<v Speaker 2>Those keys are also encrypted by asymmetric encryption. And that's

529
00:26:06.079 --> 00:26:08.440
<v Speaker 2>so you can't just open the chip up and look

530
00:26:08.440 --> 00:26:10.000
<v Speaker 2>at it and try and get the master key, the

531
00:26:10.039 --> 00:26:13.160
<v Speaker 2>volume master key. You can't because it's encrypted with asymmetric encryption.

532
00:26:13.440 --> 00:26:16.319
<v Speaker 2>And the only way that key comes out is if

533
00:26:16.359 --> 00:26:20.160
<v Speaker 2>everything in the boot process looks clean. So, so far

534
00:26:20.200 --> 00:26:22.960
<v Speaker 2>are we good? Right? I boom my computer like normal.

535
00:26:23.200 --> 00:26:25.799
<v Speaker 2>The bias goes through, says nothing's changed, it's the same drive,

536
00:26:25.839 --> 00:26:29.480
<v Speaker 2>it's the whatever, and it pulls that volume level master

537
00:26:29.599 --> 00:26:33.839
<v Speaker 2>key out. That key then decrypts the full disc key,

538
00:26:33.920 --> 00:26:35.519
<v Speaker 2>which is then used to decrypt the drive.

539
00:26:35.960 --> 00:26:37.920
<v Speaker 4>So this is why if you update the firm where

540
00:26:38.000 --> 00:26:40.000
<v Speaker 4>sometimes you get screwed.

541
00:26:39.599 --> 00:26:42.200
<v Speaker 2>On, yeah, or change the drive out or anything like that,

542
00:26:42.319 --> 00:26:44.000
<v Speaker 2>or put the drive in a new laptop. You can't

543
00:26:44.000 --> 00:26:46.119
<v Speaker 2>read it anymore because the keys don't match. I have

544
00:26:46.160 --> 00:26:48.960
<v Speaker 2>a question, what's the question? Yeah, So my question is

545
00:26:49.720 --> 00:26:53.480
<v Speaker 2>do the asymmetric keys get created on the fly every

546
00:26:53.519 --> 00:26:56.720
<v Speaker 2>time or are they also stored? They are also stored.

547
00:26:56.720 --> 00:27:00.599
<v Speaker 2>They are, yeah, and they're they're not released unless that

548
00:27:00.720 --> 00:27:04.240
<v Speaker 2>boot order camera is called the PC something or other.

549
00:27:04.680 --> 00:27:08.240
<v Speaker 1>It's not like TLS like ah cps, where the keys

550
00:27:08.240 --> 00:27:09.279
<v Speaker 1>are created.

551
00:27:09.480 --> 00:27:12.559
<v Speaker 2>You know. Yeah, it's that's a good distinction. Yeah, it's not.

552
00:27:12.799 --> 00:27:16.000
<v Speaker 2>It's not instantaneously created at the time. Because the interesting

553
00:27:16.000 --> 00:27:19.240
<v Speaker 2>thing about asymmetric encryption, I guess if you find asymmetric

554
00:27:19.359 --> 00:27:23.960
<v Speaker 2>encryption interesting is you're it's not used to encrypt large

555
00:27:23.960 --> 00:27:26.519
<v Speaker 2>amounts of data. So a lot of us see SSL

556
00:27:26.519 --> 00:27:28.680
<v Speaker 2>and we go, oh, that's a symmetric encryption. It's got

557
00:27:28.680 --> 00:27:31.279
<v Speaker 2>public and private keys and blah blah blah. Really, all

558
00:27:31.279 --> 00:27:34.240
<v Speaker 2>that's doing is encrypting a session key in your browser.

559
00:27:34.279 --> 00:27:36.359
<v Speaker 2>That's that's a symmetric key that we're going to share.

560
00:27:36.680 --> 00:27:38.799
<v Speaker 2>So and I go to talk to Carl, and I

561
00:27:38.839 --> 00:27:43.119
<v Speaker 2>want our conversation to be secure. I have a public key,

562
00:27:43.160 --> 00:27:45.839
<v Speaker 2>he has a private key. I send I encrypt a

563
00:27:45.880 --> 00:27:49.759
<v Speaker 2>password a symmetric key like Kong two right with his

564
00:27:50.079 --> 00:27:52.519
<v Speaker 2>public key, and I send it to him, and now

565
00:27:52.519 --> 00:27:54.000
<v Speaker 2>he can decrypt it, and then.

566
00:27:53.839 --> 00:27:55.960
<v Speaker 4>We use that key we switch over to the metric key.

567
00:27:56.000 --> 00:27:56.880
<v Speaker 2>Yeah, exactly. Okay.

568
00:27:57.279 --> 00:28:00.720
<v Speaker 4>The problem with all asymmetric protocols are very limited in

569
00:28:00.799 --> 00:28:04.440
<v Speaker 4>how much data they can encrypt, whereas symmetric can encrypt terabytes.

570
00:28:04.559 --> 00:28:06.559
<v Speaker 2>Yeah. Yeah, and there's all sorts of stream ciphers and

571
00:28:06.599 --> 00:28:07.680
<v Speaker 2>all sorts of things you can do with that.

572
00:28:07.759 --> 00:28:09.519
<v Speaker 4>This is your important concepts for quantum.

573
00:28:09.599 --> 00:28:13.319
<v Speaker 2>So yeah, no, no, moving on.

574
00:28:13.920 --> 00:28:15.799
<v Speaker 1>So let's go back to Gilligan's Island.

575
00:28:16.079 --> 00:28:18.200
<v Speaker 2>Let's say we're now, let's say, in a normal situation,

576
00:28:18.240 --> 00:28:19.799
<v Speaker 2>we haven't even gotten to the exploit yet. Let's say

577
00:28:19.799 --> 00:28:21.720
<v Speaker 2>in a normal situation, we boot our laptop, we log in,

578
00:28:22.359 --> 00:28:25.240
<v Speaker 2>so that means we've passed the nothing has changed. Check

579
00:28:26.000 --> 00:28:31.440
<v Speaker 2>the TPM supplied the master key. Yeah, the master key decrypted,

580
00:28:31.480 --> 00:28:35.759
<v Speaker 2>the full disc encryption key. The full disc encryption key

581
00:28:36.079 --> 00:28:40.400
<v Speaker 2>decrypted the disc. Now here's an important distinction. What happens

582
00:28:40.440 --> 00:28:42.279
<v Speaker 2>if I power my laptop off? How does all those

583
00:28:42.279 --> 00:28:43.839
<v Speaker 2>files get encrypted? Again?

584
00:28:43.880 --> 00:28:48.400
<v Speaker 1>Wait a minute, encrypted the whole disc at boot? Yeah, now,

585
00:28:48.440 --> 00:28:51.039
<v Speaker 1>you say, well, just like that, not on demand. How's

586
00:28:51.079 --> 00:28:53.279
<v Speaker 1>that even possible? How is that possible?

587
00:28:53.359 --> 00:28:58.559
<v Speaker 2>So there's another right, So what about Mary lou So

588
00:28:58.680 --> 00:29:03.079
<v Speaker 2>there's another distinction here. The files on disc actually never

589
00:29:03.240 --> 00:29:08.039
<v Speaker 2>get decrypted sitting on disc. The moment Windows boots, it

590
00:29:08.119 --> 00:29:11.799
<v Speaker 2>decrypts them all in RAM, not the whole drive, everything

591
00:29:11.799 --> 00:29:14.559
<v Speaker 2>it needs. When it goes down, everything on it starts.

592
00:29:14.920 --> 00:29:18.319
<v Speaker 2>So now we have on demand decryption that only is

593
00:29:18.359 --> 00:29:20.400
<v Speaker 2>loaded in memory. And what that means is, if I

594
00:29:20.400 --> 00:29:23.720
<v Speaker 2>power the laptop off, you're fine. The files are still encrypted, right, Yeah,

595
00:29:23.720 --> 00:29:26.160
<v Speaker 2>the files are still and the memory disappears, right right,

596
00:29:26.400 --> 00:29:30.599
<v Speaker 2>because that's how random access memory works. So okay, So, however,

597
00:29:30.680 --> 00:29:32.000
<v Speaker 2>I see a vulnerability here.

598
00:29:32.480 --> 00:29:34.599
<v Speaker 1>That key is somewhere in RAM.

599
00:29:35.079 --> 00:29:36.960
<v Speaker 2>So, yes, the key is somewhere in RAM, and it's

600
00:29:37.000 --> 00:29:39.640
<v Speaker 2>it's highly protected. There are ways to strip the keys

601
00:29:39.680 --> 00:29:41.680
<v Speaker 2>out and all sorts of stuff. Yeah, there are listeners

602
00:29:41.680 --> 00:29:44.640
<v Speaker 2>on the TPMs and all sorts of weird stuff. Okay,

603
00:29:44.799 --> 00:29:47.880
<v Speaker 2>Now let's come to the exploit. And this is the

604
00:29:47.880 --> 00:29:51.599
<v Speaker 2>the the guy who discovered this exploit this said, this

605
00:29:51.720 --> 00:29:54.480
<v Speaker 2>is one of the most insane discoveries I've ever found.

606
00:29:54.640 --> 00:29:58.440
<v Speaker 2>End quote. He starts digging through Windows coat and I

607
00:29:58.480 --> 00:30:00.319
<v Speaker 2>say he maybe it's maybe it's a HEMI it's a

608
00:30:00.359 --> 00:30:03.160
<v Speaker 2>she actually is probably an AI, but neither here nor

609
00:30:03.200 --> 00:30:06.079
<v Speaker 2>there's an it. Yeah, so this SEXPLO it's called yellow key.

610
00:30:07.039 --> 00:30:10.480
<v Speaker 2>So when I boot Windows, that whole process we talked

611
00:30:10.480 --> 00:30:12.880
<v Speaker 2>about works. If I plug a US. Let's say I

612
00:30:12.920 --> 00:30:14.920
<v Speaker 2>want to restore Windows. We're running into an issue. I

613
00:30:14.960 --> 00:30:16.839
<v Speaker 2>had a driver failure or whatever it is. You go

614
00:30:16.880 --> 00:30:21.160
<v Speaker 2>into the Windows are which is a it's a Windows

615
00:30:21.200 --> 00:30:24.000
<v Speaker 2>recovery environment. So I plug into USB, a Windows USB,

616
00:30:24.160 --> 00:30:25.960
<v Speaker 2>and it boots to that Windows USB. But I can

617
00:30:26.000 --> 00:30:29.599
<v Speaker 2>still see the drive. I can't access anything unless I

618
00:30:29.640 --> 00:30:32.720
<v Speaker 2>supply the BitLocker recovery key. So if I go to

619
00:30:32.799 --> 00:30:34.359
<v Speaker 2>my sea drive and say, oh, show me all of

620
00:30:34.400 --> 00:30:38.079
<v Speaker 2>Carl's files because I've booted to this USB stick, it

621
00:30:38.079 --> 00:30:40.279
<v Speaker 2>will say, well, give me the one hundred and twenty

622
00:30:40.279 --> 00:30:42.519
<v Speaker 2>eight bit key that unlocks a drive.

623
00:30:42.519 --> 00:30:44.599
<v Speaker 1>And I'll do that, and I know where those are.

624
00:30:44.680 --> 00:30:48.200
<v Speaker 1>Those are online and you if you log into Windows

625
00:30:48.400 --> 00:30:53.920
<v Speaker 1>with yeah, log into the website, you see your profile. Yep,

626
00:30:54.000 --> 00:30:54.599
<v Speaker 1>they're right there.

627
00:30:54.680 --> 00:30:54.839
<v Speaker 4>Yeah.

628
00:30:54.880 --> 00:30:58.200
<v Speaker 2>If you on your laptop have logged into your laptop

629
00:30:58.279 --> 00:31:01.920
<v Speaker 2>with an online micros account. You're not using a local account.

630
00:31:02.279 --> 00:31:03.880
<v Speaker 2>You can log into your profile. You can find those

631
00:31:03.920 --> 00:31:06.720
<v Speaker 2>recovery keys. But let's say we don't have that recovery key.

632
00:31:07.039 --> 00:31:09.640
<v Speaker 2>Anything I try and do to the boot drive, anything

633
00:31:09.680 --> 00:31:13.000
<v Speaker 2>I try and do to the to the user's drive,

634
00:31:13.599 --> 00:31:17.240
<v Speaker 2>the files that anything I get access denied I get.

635
00:31:17.559 --> 00:31:19.640
<v Speaker 2>You can't do anything with these because I don't have

636
00:31:19.680 --> 00:31:24.720
<v Speaker 2>that recovery key. I can't bypass, I can't ask Windows.

637
00:31:24.799 --> 00:31:28.960
<v Speaker 2>Are the USB stick to decrypt the file so that

638
00:31:29.079 --> 00:31:29.720
<v Speaker 2>I can read it?

639
00:31:29.759 --> 00:31:30.319
<v Speaker 1>Not possible.

640
00:31:30.359 --> 00:31:32.720
<v Speaker 2>Okay, so we're in the same place, but I can

641
00:31:32.759 --> 00:31:34.839
<v Speaker 2>see some I can see the files, right. It's because

642
00:31:34.880 --> 00:31:37.160
<v Speaker 2>the you know what the names are because because we

643
00:31:37.160 --> 00:31:41.480
<v Speaker 2>were able to boot into Windows R the volume master

644
00:31:41.640 --> 00:31:44.440
<v Speaker 2>key loaded, which is fine because we haven't manipulated anything yet,

645
00:31:45.240 --> 00:31:47.480
<v Speaker 2>and we can still see the file structure, right. We

646
00:31:47.559 --> 00:31:51.359
<v Speaker 2>just can't do things with it. Okay. There is a

647
00:31:51.680 --> 00:31:56.519
<v Speaker 2>transactional file system. It's called FSTX. For those of you

648
00:31:56.559 --> 00:31:59.079
<v Speaker 2>who may have remembered Microsoft. Do you guys remember Microsoft

649
00:31:59.079 --> 00:32:00.759
<v Speaker 2>at one point said, you know what file systems are

650
00:32:00.759 --> 00:32:03.960
<v Speaker 2>dead wins. We're going to make the entire win fest.

651
00:32:04.119 --> 00:32:06.200
<v Speaker 2>We're going to make the entire file system.

652
00:32:05.920 --> 00:32:08.680
<v Speaker 4>A database a database, Yeah, because what could go wrong?

653
00:32:10.200 --> 00:32:11.400
<v Speaker 2>And what did databases have?

654
00:32:11.480 --> 00:32:14.279
<v Speaker 1>Do you remember Rory Blach on dot net rocks trying

655
00:32:14.319 --> 00:32:18.519
<v Speaker 1>to explain win fs. Yes, you do it, says Now,

656
00:32:18.920 --> 00:32:23.200
<v Speaker 1>now imagine you have your porn collection and imagine you

657
00:32:23.240 --> 00:32:25.960
<v Speaker 1>want to store it by keyword. So you might have

658
00:32:26.000 --> 00:32:32.200
<v Speaker 1>one keyword that's like threesomes, another keyword it's like and

659
00:32:32.319 --> 00:32:35.759
<v Speaker 1>you have another category. You know, computer must be burned

660
00:32:35.759 --> 00:32:37.359
<v Speaker 1>to the ground after viewing.

661
00:32:38.160 --> 00:32:41.480
<v Speaker 2>Right, So okay, get away with words that. What did

662
00:32:41.559 --> 00:32:43.400
<v Speaker 2>databases have? They have all sorts of things. They have

663
00:32:43.440 --> 00:32:46.799
<v Speaker 2>transactions right where I can say, I want to make

664
00:32:46.839 --> 00:32:49.240
<v Speaker 2>sure that if I'm you know, let's say, for example,

665
00:32:49.279 --> 00:32:53.119
<v Speaker 2>I want to enter an entry into the database table, well, transactionally,

666
00:32:53.119 --> 00:32:54.720
<v Speaker 2>I want to make sure that it doesn't violate neing

667
00:32:54.839 --> 00:32:57.039
<v Speaker 2>referential integrity. I want to make sure that I commit it.

668
00:32:57.079 --> 00:32:59.279
<v Speaker 2>Blah bah blah. Let's say there's an issue with me

669
00:32:59.319 --> 00:33:01.480
<v Speaker 2>committing that transaction. Well, obviously I want to be able

670
00:33:01.480 --> 00:33:03.200
<v Speaker 2>to roll it back, right, I want to go back

671
00:33:03.200 --> 00:33:07.000
<v Speaker 2>to originally what was in that table. So Microsoft had

672
00:33:07.079 --> 00:33:09.880
<v Speaker 2>implemented all of these things in the file systems. Okay,

673
00:33:09.960 --> 00:33:12.920
<v Speaker 2>stop there, transactions, rollbacks, all sorts of stuff.

674
00:33:12.920 --> 00:33:15.279
<v Speaker 1>Stop there. WinFS was supposed to be one of the

675
00:33:15.319 --> 00:33:20.279
<v Speaker 1>pillars of Vista that included all sorts of other things.

676
00:33:20.400 --> 00:33:23.640
<v Speaker 1>Uh huh, And they couldn't. They basically said, we couldn't

677
00:33:23.640 --> 00:33:26.440
<v Speaker 1>implement WinFS because we couldn't figure out how to traverse

678
00:33:26.559 --> 00:33:30.920
<v Speaker 1>networks efficiently. Yes, and so they they dropped it. Yeah,

679
00:33:30.960 --> 00:33:35.240
<v Speaker 1>and everybody thought, hey, it's that we don't have that.

680
00:33:35.319 --> 00:33:37.319
<v Speaker 2>Do you know how they dropped it? They just deleted it,

681
00:33:37.319 --> 00:33:39.720
<v Speaker 2>didn't tell anybody that it was there. They deleted the

682
00:33:39.839 --> 00:33:43.559
<v Speaker 2>UI and said, pretend you don't remember it's here. That's

683
00:33:43.599 --> 00:33:48.039
<v Speaker 2>what they did. So at the kernel level, all of

684
00:33:48.039 --> 00:33:51.279
<v Speaker 2>the transactions still exist, all of the rollbacks still exists,

685
00:33:51.279 --> 00:33:51.759
<v Speaker 2>as the.

686
00:33:51.839 --> 00:33:53.200
<v Speaker 1>MVP is going to be revoked.

687
00:33:53.440 --> 00:33:56.720
<v Speaker 4>No, no, backward compatibility is a bane in our existence.

688
00:33:56.920 --> 00:34:00.480
<v Speaker 2>What's actually, Carl, what's hilarious is my MVP for Microsoft

689
00:34:00.559 --> 00:34:03.839
<v Speaker 2>Security Developer was revoked a long time ago, which whatever.

690
00:34:04.000 --> 00:34:06.160
<v Speaker 2>But anyways, so okay, because I don't do enough in

691
00:34:06.200 --> 00:34:09.639
<v Speaker 2>the community talking about development and security, Yeah, that's why

692
00:34:09.760 --> 00:34:10.320
<v Speaker 2>it's all good.

693
00:34:10.360 --> 00:34:10.519
<v Speaker 1>Yeah.

694
00:34:12.239 --> 00:34:16.679
<v Speaker 2>So what this exploit does is it invokes that kernel

695
00:34:16.760 --> 00:34:20.840
<v Speaker 2>level roll batches and puts it as a transaction in

696
00:34:20.920 --> 00:34:25.800
<v Speaker 2>the queue for for NTFS Transactional File System and says, oh,

697
00:34:25.840 --> 00:34:28.679
<v Speaker 2>by the way, here are the bits I want you

698
00:34:28.760 --> 00:34:32.199
<v Speaker 2>to roll back. I want you to take command dot

699
00:34:32.199 --> 00:34:36.039
<v Speaker 2>ex and I want you to roll it back onto

700
00:34:36.159 --> 00:34:39.320
<v Speaker 2>the se T HC dot ex. Now you may say,

701
00:34:39.320 --> 00:34:41.159
<v Speaker 2>what what is the s E T A C H

702
00:34:41.199 --> 00:34:44.199
<v Speaker 2>dody x. That's the sticky keys. Anybody know what sticky

703
00:34:44.280 --> 00:34:44.679
<v Speaker 2>keys is?

704
00:34:44.800 --> 00:34:45.000
<v Speaker 1>Oh?

705
00:34:45.079 --> 00:34:46.679
<v Speaker 2>Yeah, and how you get to sticky keys?

706
00:34:46.760 --> 00:34:49.199
<v Speaker 1>Yeah, there's a keystroke or something like that. If you

707
00:34:49.280 --> 00:34:51.400
<v Speaker 1>hit you get this pop up that says, hey, do

708
00:34:51.440 --> 00:34:52.440
<v Speaker 1>you want to turn sticky keys?

709
00:34:53.000 --> 00:34:55.880
<v Speaker 2>If you know, if you ta, if you hit shift

710
00:34:56.039 --> 00:34:59.480
<v Speaker 2>your left shift five times quickly, it will pop this

711
00:34:59.559 --> 00:35:00.760
<v Speaker 2>up and say you want to do you want to

712
00:35:00.880 --> 00:35:03.000
<v Speaker 2>enable sticky keys? And it's an accessibility You're going to

713
00:35:03.039 --> 00:35:03.480
<v Speaker 2>do it right now?

714
00:35:03.519 --> 00:35:06.119
<v Speaker 1>Ready? Yeah, there it is sticky keys.

715
00:35:06.239 --> 00:35:09.679
<v Speaker 2>So it's an accessibility thing. What's great about that is

716
00:35:09.719 --> 00:35:12.400
<v Speaker 2>that works before you log into the computer. So I

717
00:35:12.400 --> 00:35:14.320
<v Speaker 2>can be at the login screen and I can hit

718
00:35:14.400 --> 00:35:16.239
<v Speaker 2>I can hit shift five times and it will open

719
00:35:16.360 --> 00:35:19.679
<v Speaker 2>up that that program, that sticky keys program. So now

720
00:35:19.679 --> 00:35:21.760
<v Speaker 2>what I can say is, hey, computer, I want you

721
00:35:21.800 --> 00:35:25.320
<v Speaker 2>to put in the transactional layer to restore on top

722
00:35:25.360 --> 00:35:27.960
<v Speaker 2>of the sticky keys program the command dot ex program

723
00:35:28.000 --> 00:35:30.000
<v Speaker 2>for me. So you can now I just shut the

724
00:35:30.000 --> 00:35:33.039
<v Speaker 2>computer down. I didn't I didn't touch the encrypted files.

725
00:35:33.480 --> 00:35:35.400
<v Speaker 2>When I boot the computer back up, it goes through

726
00:35:35.440 --> 00:35:38.199
<v Speaker 2>the whole process of decrypting and whatnot, and it goes, oh,

727
00:35:38.199 --> 00:35:41.239
<v Speaker 2>by the way, there's this transaction here that I need

728
00:35:41.280 --> 00:35:44.199
<v Speaker 2>to run to restore command dot ex on top of

729
00:35:44.480 --> 00:35:46.920
<v Speaker 2>S E T HC dot exe. And then at the

730
00:35:46.920 --> 00:35:49.880
<v Speaker 2>command prompt, I hit the shift five times and sure enough,

731
00:35:49.880 --> 00:35:52.920
<v Speaker 2>a command prompt opens with system level access and everything's degred.

732
00:35:52.960 --> 00:35:53.480
<v Speaker 2>Oh my god.

733
00:35:53.719 --> 00:35:56.280
<v Speaker 4>All right, so you can get this command to run

734
00:35:57.039 --> 00:35:59.039
<v Speaker 4>on a system that you don't have credentials to.

735
00:35:59.400 --> 00:36:03.159
<v Speaker 2>Yeah, what's also kind of cool? As you say, okay, well, Dwayne,

736
00:36:03.199 --> 00:36:06.320
<v Speaker 2>this sounds like BS. How did you get a transaction?

737
00:36:07.480 --> 00:36:10.679
<v Speaker 2>And the transactions are actually logged in a dollar log

738
00:36:11.199 --> 00:36:14.239
<v Speaker 2>file log file sitting at the route? How did you

739
00:36:14.280 --> 00:36:18.440
<v Speaker 2>get a transaction in an encrypted log file? Right? The

740
00:36:18.920 --> 00:36:24.679
<v Speaker 2>decryption and encryption of data only denies you only requires

741
00:36:24.679 --> 00:36:27.280
<v Speaker 2>that recovery key on BitLocker if you try and do

742
00:36:27.360 --> 00:36:29.320
<v Speaker 2>normal reads and writes. So if I tried to open

743
00:36:29.320 --> 00:36:31.559
<v Speaker 2>that file and say nope, go away. But if I

744
00:36:31.679 --> 00:36:34.679
<v Speaker 2>call the API and the Windows kernels, who would do

745
00:36:34.760 --> 00:36:38.960
<v Speaker 2>that to create a transaction? This is the Windows kernel

746
00:36:38.960 --> 00:36:42.679
<v Speaker 2>API goes, Oh, well, let me grab the keys for you, okay,

747
00:36:42.480 --> 00:36:44.920
<v Speaker 2>so I can encrypt it into the log file.

748
00:36:45.239 --> 00:36:47.519
<v Speaker 1>I have an obvious question here that I'm sure is

749
00:36:47.559 --> 00:36:48.760
<v Speaker 1>on everybody's mind.

750
00:36:48.880 --> 00:36:49.280
<v Speaker 2>Uh huh.

751
00:36:50.039 --> 00:36:53.079
<v Speaker 1>Does NTFS which is the file system the user uses?

752
00:36:53.199 --> 00:36:57.039
<v Speaker 1>Does it use win FS the stuff that's there? No? Okay,

753
00:36:58.079 --> 00:36:59.079
<v Speaker 1>why is it there?

754
00:37:00.079 --> 00:37:01.480
<v Speaker 4>Back with compatibility?

755
00:37:01.679 --> 00:37:03.559
<v Speaker 1>Is the a p I even enabled?

756
00:37:04.400 --> 00:37:05.360
<v Speaker 4>Back with compatibility?

757
00:37:06.400 --> 00:37:06.679
<v Speaker 1>Question?

758
00:37:08.199 --> 00:37:12.000
<v Speaker 4>Some some product that Microsoft built that needs it and

759
00:37:12.039 --> 00:37:13.400
<v Speaker 4>they didn't want to right.

760
00:37:13.679 --> 00:37:16.079
<v Speaker 2>Or I'm an overwork development of Microsoft. And my manager,

761
00:37:16.119 --> 00:37:18.000
<v Speaker 2>Candy me said, did you rip out fast yet? And

762
00:37:18.000 --> 00:37:22.639
<v Speaker 2>I said, uh, yeah, delete the UI it's gone find

763
00:37:22.639 --> 00:37:23.960
<v Speaker 2>it good luck.

764
00:37:25.199 --> 00:37:25.599
<v Speaker 1>Geez.

765
00:37:26.000 --> 00:37:28.599
<v Speaker 2>Yeah, this is uh, this is a crazy bug and

766
00:37:28.639 --> 00:37:30.639
<v Speaker 2>it is super easy to exploit.

767
00:37:31.159 --> 00:37:32.599
<v Speaker 1>So and is there a fix?

768
00:37:32.880 --> 00:37:37.679
<v Speaker 2>No? No, this is Oh my god, this is we

769
00:37:37.760 --> 00:37:39.440
<v Speaker 2>need with our listeners.

770
00:37:39.480 --> 00:37:42.320
<v Speaker 1>Please don't be evil.

771
00:37:42.760 --> 00:37:44.199
<v Speaker 4>Don't let Dwayne near your computer.

772
00:37:44.559 --> 00:37:46.920
<v Speaker 2>No, don't around with speed drive.

773
00:37:47.239 --> 00:37:49.960
<v Speaker 4>So I gotta tell the story, Dwayne. We had a customer,

774
00:37:50.559 --> 00:37:54.199
<v Speaker 4>super paranoid customer, great customer. No names, no, no in

775
00:37:54.280 --> 00:37:56.960
<v Speaker 4>name of industry, and they were super proud of how

776
00:37:57.480 --> 00:38:00.280
<v Speaker 4>they did things, and they didn't allow people to even

777
00:38:00.719 --> 00:38:02.440
<v Speaker 4>access the Internet from their desktops. They had to go

778
00:38:02.480 --> 00:38:05.920
<v Speaker 4>to Kiosk machines in the middle of the courtyard and

779
00:38:06.039 --> 00:38:08.039
<v Speaker 4>Dwayne walked in and they're like, you know, we're really

780
00:38:08.119 --> 00:38:10.559
<v Speaker 4>proud of these. You know, you're welcome to try to,

781
00:38:10.880 --> 00:38:13.239
<v Speaker 4>you know, get administrative prompt or you know, do something

782
00:38:13.320 --> 00:38:15.400
<v Speaker 4>on these, but they're so locked down. And the guy

783
00:38:15.440 --> 00:38:17.519
<v Speaker 4>turned around and Dwayne had an admin prompt.

784
00:38:17.920 --> 00:38:20.159
<v Speaker 1>Yeah, you told me this, yeah, And then he was

785
00:38:20.199 --> 00:38:22.840
<v Speaker 1>freaking embarrassed, right, and he goes, oh my god, hang on,

786
00:38:22.880 --> 00:38:24.360
<v Speaker 1>and he like ran off and came back.

787
00:38:24.400 --> 00:38:26.159
<v Speaker 2>He says, okay, now you can't do it.

788
00:38:26.159 --> 00:38:28.719
<v Speaker 4>It just happened over and over again, but he's like

789
00:38:28.840 --> 00:38:29.679
<v Speaker 4>four times.

790
00:38:30.159 --> 00:38:33.159
<v Speaker 2>And what was funny is the last time, he's like, listen,

791
00:38:33.199 --> 00:38:35.320
<v Speaker 2>this network we have here, these computers in the middle

792
00:38:35.360 --> 00:38:36.800
<v Speaker 2>of the room. They don't have access to anything but

793
00:38:36.840 --> 00:38:42.039
<v Speaker 2>the Internet. And I was able to not only bypass

794
00:38:42.159 --> 00:38:44.360
<v Speaker 2>the things they had, but then fire up wire sharks.

795
00:38:44.400 --> 00:38:46.800
<v Speaker 2>Oh god, and I could see all the credit card

796
00:38:46.880 --> 00:38:50.760
<v Speaker 2>transactions coming off of their their outside network. And he's like, wait,

797
00:38:50.800 --> 00:38:52.880
<v Speaker 2>how do you see those? They're on a different IP range.

798
00:38:52.920 --> 00:38:54.519
<v Speaker 2>I don't even route that, and I'm like, dude, it's

799
00:38:54.519 --> 00:38:57.079
<v Speaker 2>on the same copper. I'll tell you for a million

800
00:38:57.199 --> 00:39:01.440
<v Speaker 2>dollars exactly. Yeah. Yeah, it was. That was a fun

801
00:39:01.480 --> 00:39:02.519
<v Speaker 2>That was a fun benta.

802
00:39:02.599 --> 00:39:06.119
<v Speaker 1>All right. So now let's let's get to the story

803
00:39:06.199 --> 00:39:08.960
<v Speaker 1>which is in two stories, which is you remember last

804
00:39:08.960 --> 00:39:11.719
<v Speaker 1>week and we talked about Linux and how it was

805
00:39:11.760 --> 00:39:14.719
<v Speaker 1>pretty much hosed. Every Linux system is at risk. That

806
00:39:14.840 --> 00:39:17.519
<v Speaker 1>was what two thirty two is all about. Yeah, well,

807
00:39:17.559 --> 00:39:19.880
<v Speaker 1>apparently there's more to come, and.

808
00:39:20.079 --> 00:39:21.719
<v Speaker 2>Let's it's just a dumpster fire.

809
00:39:21.840 --> 00:39:25.159
<v Speaker 1>Yeah, let's start with the dirty frag zero day that

810
00:39:25.320 --> 00:39:27.880
<v Speaker 1>gives root on all major distributions.

811
00:39:28.039 --> 00:39:30.800
<v Speaker 2>Oh, it's so good, so good. This is a great

812
00:39:30.840 --> 00:39:34.000
<v Speaker 2>week for privesk. Honestly, this is the historical week for

813
00:39:34.119 --> 00:39:35.760
<v Speaker 2>privesk Windows and Linux.

814
00:39:35.480 --> 00:39:37.119
<v Speaker 4>And a bad week for everyone else.

815
00:39:37.320 --> 00:39:41.000
<v Speaker 2>Yeah, this is so good, so yeah dirty. We talked

816
00:39:41.000 --> 00:39:44.559
<v Speaker 2>about copy fail last week, which copy fail was oh

817
00:39:44.639 --> 00:39:46.360
<v Speaker 2>my god, you have access to all these things and

818
00:39:46.679 --> 00:39:48.440
<v Speaker 2>there are patches for the kernel out there for that.

819
00:39:49.320 --> 00:39:53.800
<v Speaker 2>And then based off of the XFRM esp page caching,

820
00:39:54.400 --> 00:39:58.599
<v Speaker 2>which was part of the vulnerability, another researcher came out

821
00:39:58.599 --> 00:40:00.360
<v Speaker 2>with another one and they were like, you know what,

822
00:40:00.400 --> 00:40:05.280
<v Speaker 2>this is dirty frag. Dirty frag also exploits cash right

823
00:40:05.400 --> 00:40:11.280
<v Speaker 2>vulnerability and gives you privileged escalation right on the box.

824
00:40:11.360 --> 00:40:14.280
<v Speaker 2>And you know, here again we're back at the same place,

825
00:40:14.400 --> 00:40:17.920
<v Speaker 2>not patched. You know, we have an issue.

826
00:40:18.079 --> 00:40:20.400
<v Speaker 1>So why did they call it dirty frag? Does that

827
00:40:20.400 --> 00:40:21.960
<v Speaker 1>have anything with defragmenting?

828
00:40:22.360 --> 00:40:25.159
<v Speaker 2>It has to do with fragmentation, So it has to

829
00:40:25.199 --> 00:40:28.920
<v Speaker 2>do with, you know how, because they're manipulating the cash

830
00:40:29.000 --> 00:40:33.880
<v Speaker 2>right vulnerability. So cash is notoriously you need to fragment

831
00:40:33.920 --> 00:40:35.880
<v Speaker 2>and then defragment it to squeeze all the memory down

832
00:40:35.920 --> 00:40:38.119
<v Speaker 2>and then refragment it right as you're reading and writing

833
00:40:38.119 --> 00:40:40.559
<v Speaker 2>and that sort of stuff. And typically we find, especially

834
00:40:40.599 --> 00:40:44.280
<v Speaker 2>if you're doing even if you're doing like heap grooming,

835
00:40:44.719 --> 00:40:48.480
<v Speaker 2>same type of thing, you're manipulating the fragmentation of the

836
00:40:48.519 --> 00:40:50.960
<v Speaker 2>heap to get it to run code or free something

837
00:40:51.039 --> 00:40:52.960
<v Speaker 2>it shouldn't have, or that sort of stuff like a

838
00:40:53.039 --> 00:40:53.440
<v Speaker 2>US effort.

839
00:40:53.639 --> 00:40:56.000
<v Speaker 1>So I can understand from when you say heap grooming

840
00:40:56.039 --> 00:40:58.679
<v Speaker 1>what that is. And because you know grooming, you get

841
00:40:58.679 --> 00:41:01.239
<v Speaker 1>comb your hair, you organized things. I get it. But

842
00:41:01.400 --> 00:41:04.360
<v Speaker 1>you know, they they talk about things like dirty pipe,

843
00:41:04.639 --> 00:41:08.320
<v Speaker 1>and I'm a little I don't really understand what that is.

844
00:41:08.400 --> 00:41:10.800
<v Speaker 1>You know, I have an imagination.

845
00:41:13.239 --> 00:41:22.400
<v Speaker 2>That's a special folder dirty pipe. We could probably find

846
00:41:22.440 --> 00:41:24.639
<v Speaker 2>some examples of dirty pipe, but they.

847
00:41:24.519 --> 00:41:27.519
<v Speaker 1>Say in the dirty frag belongs to the same class

848
00:41:27.559 --> 00:41:30.440
<v Speaker 1>as dirty pipe and copy fill innextrollabilities. It exploits the

849
00:41:30.480 --> 00:41:33.480
<v Speaker 1>fragment field of a different kernel data structure.

850
00:41:33.400 --> 00:41:36.480
<v Speaker 2>Right right, So it's and it's a lot of these

851
00:41:36.480 --> 00:41:39.679
<v Speaker 2>exploits come from I create a structure, I delete the structure,

852
00:41:39.679 --> 00:41:41.400
<v Speaker 2>and then I create a smaller structure, and I delete

853
00:41:41.400 --> 00:41:44.199
<v Speaker 2>that structure, and I do these in a particular pattern

854
00:41:44.719 --> 00:41:47.400
<v Speaker 2>that allow me to then manipulate that structure to either

855
00:41:47.519 --> 00:41:50.800
<v Speaker 2>access stuff I shouldn't, or have a use after free

856
00:41:50.800 --> 00:41:53.159
<v Speaker 2>where it's actually putting data in there and it and

857
00:41:53.239 --> 00:41:55.480
<v Speaker 2>the computer believes that that memory is freed, but I

858
00:41:55.519 --> 00:41:57.400
<v Speaker 2>still have a pointer to it, so then I can

859
00:41:57.440 --> 00:42:00.119
<v Speaker 2>do all sorts of stuff in there. So and that's

860
00:42:00.159 --> 00:42:01.920
<v Speaker 2>all of your like you're dirty, even going all the

861
00:42:01.960 --> 00:42:04.719
<v Speaker 2>way back to dirty cow, all of them are the

862
00:42:04.760 --> 00:42:08.880
<v Speaker 2>same style of attackers. Now you get dirty cow, dirty pipe,

863
00:42:09.039 --> 00:42:12.280
<v Speaker 2>dirty frog, all of them come back to get.

864
00:42:12.159 --> 00:42:15.239
<v Speaker 1>A dirty frog, dirty chicken, dirty pig.

865
00:42:16.440 --> 00:42:19.239
<v Speaker 2>The dirty farm. That's going to be the exploitation framework

866
00:42:19.280 --> 00:42:20.880
<v Speaker 2>is the dirty farm, and it's just going to be all.

867
00:42:21.119 --> 00:42:25.000
<v Speaker 1>I just you know, I can't deduce what they possibly

868
00:42:25.039 --> 00:42:26.840
<v Speaker 1>could be from those names, so.

869
00:42:27.199 --> 00:42:31.000
<v Speaker 2>I know, right, So a lot of these are around,

870
00:42:31.039 --> 00:42:32.920
<v Speaker 2>and some of these, a lot of them end up

871
00:42:32.920 --> 00:42:37.280
<v Speaker 2>being around efficiencies, right, like all of you know, when

872
00:42:37.280 --> 00:42:39.199
<v Speaker 2>you delete a file on your hard drive, doesn't actually

873
00:42:39.199 --> 00:42:41.559
<v Speaker 2>delete it, right, It doesn't overrite it was.

874
00:42:41.519 --> 00:42:41.920
<v Speaker 1>You know that.

875
00:42:42.079 --> 00:42:46.800
<v Speaker 2>Yeah, it doesn't remove the magnetic bits on there, right.

876
00:42:46.840 --> 00:42:49.880
<v Speaker 2>All it does is tell the file system pretend it's

877
00:42:49.920 --> 00:42:54.480
<v Speaker 2>not there. That's it. That's all that deleting a file does. Now,

878
00:42:54.519 --> 00:42:58.599
<v Speaker 2>as we have frantic listeners going and drilling drives, so

879
00:42:59.039 --> 00:43:02.360
<v Speaker 2>what we do, yeah, exactly, Yeah, we have them melted

880
00:43:02.400 --> 00:43:03.559
<v Speaker 2>down into a slag.

881
00:43:04.760 --> 00:43:07.039
<v Speaker 4>We have a company that does the shredding.

882
00:43:07.119 --> 00:43:09.039
<v Speaker 2>Oh yeah, yep, data distruction. I don't know if you've

883
00:43:09.079 --> 00:43:11.559
<v Speaker 2>seen those. Those are awesome. They're like paper shredders, but

884
00:43:11.639 --> 00:43:14.039
<v Speaker 2>for like hard drives. I mean you shrow them in

885
00:43:14.119 --> 00:43:15.679
<v Speaker 2>there and they crush anything.

886
00:43:16.000 --> 00:43:20.760
<v Speaker 1>So there was the episode of Mondays where Richard Campbell,

887
00:43:20.880 --> 00:43:25.360
<v Speaker 1>who was Richard the Toy Boy, found this device that

888
00:43:25.519 --> 00:43:30.079
<v Speaker 1>was a hard drive cleaner, Zappa or whatever. You put

889
00:43:30.119 --> 00:43:33.679
<v Speaker 1>it in this device. It had no power. You put

890
00:43:33.679 --> 00:43:37.400
<v Speaker 1>it in the device, you wait for one minute, and

891
00:43:37.440 --> 00:43:39.480
<v Speaker 1>then you take it out and it's completely gone. It

892
00:43:39.519 --> 00:43:40.239
<v Speaker 1>was a magnet.

893
00:43:40.519 --> 00:43:42.599
<v Speaker 2>Yeah, yeah, a big, a big magnet.

894
00:43:42.880 --> 00:43:45.000
<v Speaker 1>Man. He told the story of Goliath. You want to

895
00:43:45.000 --> 00:43:46.800
<v Speaker 1>hear a story, I'll tell you a story about a

896
00:43:46.800 --> 00:43:53.519
<v Speaker 1>big magnet. This is nothing. Yeah, okay, So but you're

897
00:43:53.559 --> 00:43:55.119
<v Speaker 1>talking about things that shred.

898
00:43:55.440 --> 00:43:56.880
<v Speaker 2>Right right? Yeah?

899
00:43:56.920 --> 00:43:58.360
<v Speaker 4>Anyways, yeah I digress.

900
00:43:58.480 --> 00:44:01.679
<v Speaker 2>Yeah, like uh yeah, like just choose the drives apart

901
00:44:01.719 --> 00:44:03.679
<v Speaker 2>in small, fine metal bits.

902
00:44:04.000 --> 00:44:06.599
<v Speaker 1>All right. So there is a patch for this, and

903
00:44:06.760 --> 00:44:08.880
<v Speaker 1>it's kind of a patch. It's a command that you

904
00:44:09.000 --> 00:44:12.760
<v Speaker 1>need to to run, and it's right there in the article.

905
00:44:12.800 --> 00:44:16.880
<v Speaker 1>It's an s h print def install ESP four whatever.

906
00:44:16.960 --> 00:44:19.880
<v Speaker 1>So it's going to remove the vulnerable ESP four, ESP

907
00:44:20.039 --> 00:44:23.559
<v Speaker 1>six and r x pc r x RPC kernel modules.

908
00:44:24.079 --> 00:44:27.960
<v Speaker 1>But it's important that it'll break ip SECVPNS and that stuff.

909
00:44:28.000 --> 00:44:32.599
<v Speaker 1>So read the article and I think there are patches

910
00:44:32.760 --> 00:44:34.800
<v Speaker 1>available maybe yet are there?

911
00:44:35.360 --> 00:44:38.760
<v Speaker 2>So configurations the the a lot of the Linux kernels

912
00:44:38.760 --> 00:44:40.800
<v Speaker 2>are getting patches over some of these, whether it's going

913
00:44:40.880 --> 00:44:45.840
<v Speaker 2>to be copy fail or you know, dirty frag or whatever,

914
00:44:46.599 --> 00:44:47.960
<v Speaker 2>or the next one we talk about.

915
00:44:49.119 --> 00:44:51.440
<v Speaker 1>Yeah, and so what is the next one we're going

916
00:44:51.519 --> 00:44:54.239
<v Speaker 1>to talk about? This is this is our yeah?

917
00:44:54.320 --> 00:44:57.360
<v Speaker 2>Yeah, the next one is literally shoot, you know what.

918
00:44:57.440 --> 00:45:01.760
<v Speaker 2>Let me look at the days here. On the eighth,

919
00:45:02.239 --> 00:45:05.000
<v Speaker 2>Dirty Frag came out and we were like, oh dear god,

920
00:45:05.039 --> 00:45:07.719
<v Speaker 2>we just had an exploit in copy fail in all

921
00:45:07.760 --> 00:45:14.239
<v Speaker 2>major Linux brands. And then on the fourteenth, Fragnesia came out.

922
00:45:14.880 --> 00:45:18.920
<v Speaker 2>And this is a spin off of a dirty Frag.

923
00:45:19.000 --> 00:45:22.960
<v Speaker 2>This is the same leveraging a lot of the same components,

924
00:45:23.000 --> 00:45:25.079
<v Speaker 2>the x FRS esp cash right.

925
00:45:25.480 --> 00:45:27.239
<v Speaker 1>You know, I would imagine that it could be a

926
00:45:27.239 --> 00:45:29.519
<v Speaker 1>spin off of dirty Cow, because then you'd have milk

927
00:45:29.559 --> 00:45:30.840
<v Speaker 1>of frag.

928
00:45:31.360 --> 00:45:32.280
<v Speaker 2>Milk of frag.

929
00:45:32.440 --> 00:45:35.480
<v Speaker 4>It's a child of wow, wow, how is that?

930
00:45:35.480 --> 00:45:37.039
<v Speaker 2>That's pretty good? Huh.

931
00:45:38.000 --> 00:45:39.519
<v Speaker 1>I'll be here for five more minutes, kids.

932
00:45:41.079 --> 00:45:43.800
<v Speaker 2>So, needless to say, this is another way to exploit it.

933
00:45:43.519 --> 00:45:45.760
<v Speaker 2>So a lot of people, especially if there's not a

934
00:45:45.800 --> 00:45:50.280
<v Speaker 2>patch released, we'll go out and start putting indicators a

935
00:45:50.280 --> 00:45:53.119
<v Speaker 2>compromise monitoring on their systems. They have sims that they're

936
00:45:53.119 --> 00:45:55.840
<v Speaker 2>monitoring what's going on, and they may be so specific

937
00:45:55.920 --> 00:45:57.480
<v Speaker 2>that they're going to catch one of these button on

938
00:45:57.559 --> 00:46:01.519
<v Speaker 2>the other. So just real there are multiple ways to

939
00:46:01.840 --> 00:46:06.440
<v Speaker 2>exploit this cash read and write. In the article, it

940
00:46:06.440 --> 00:46:09.639
<v Speaker 2>even says just as Fragnesia, dirty frag has a publicly

941
00:46:09.760 --> 00:46:12.880
<v Speaker 2>available POC exploit. So both of these right now are

942
00:46:12.920 --> 00:46:14.960
<v Speaker 2>just out on the internet, so you have to be

943
00:46:15.000 --> 00:46:17.880
<v Speaker 2>careful if any one of them at this point could

944
00:46:17.920 --> 00:46:19.679
<v Speaker 2>exploit a Linux system. So you need to go out

945
00:46:19.719 --> 00:46:22.480
<v Speaker 2>and take a look at these articles. Like Carl had said,

946
00:46:22.519 --> 00:46:26.360
<v Speaker 2>there is a configuration change you can make that will

947
00:46:26.360 --> 00:46:28.760
<v Speaker 2>make these safer. You just need to make sure it's

948
00:46:28.760 --> 00:46:30.239
<v Speaker 2>not going to cause issues with your install.

949
00:46:30.320 --> 00:46:32.199
<v Speaker 1>And the Linux distros are trying to catch up, and

950
00:46:32.199 --> 00:46:34.440
<v Speaker 1>probably by the time you hear this, there's probably going

951
00:46:34.519 --> 00:46:35.800
<v Speaker 1>to be a distro patch.

952
00:46:36.400 --> 00:46:39.960
<v Speaker 2>One would hope one would hoop. Until then, I'm going

953
00:46:39.960 --> 00:46:41.440
<v Speaker 2>to compromise every Linux box.

954
00:46:42.800 --> 00:46:44.760
<v Speaker 1>Watch out. Duane's on the case.

955
00:46:46.159 --> 00:46:47.159
<v Speaker 2>Wow for science.

956
00:46:47.480 --> 00:46:48.320
<v Speaker 1>I think that's it.

957
00:46:48.320 --> 00:46:51.000
<v Speaker 2>Right, I think that's that's this week.

958
00:46:51.079 --> 00:46:53.760
<v Speaker 1>Yeah, all right, that's what happened last week, and so

959
00:46:53.840 --> 00:46:57.360
<v Speaker 1>we'll talk about what happens next week on Security this week.

960
00:46:57.559 --> 00:47:03.079
<v Speaker 1>Bye bye, Mike, ooh

961
00:47:10.400 --> 00:47:11.519
<v Speaker 4>Ooh ta