Speaker 1: Hey, Carl. Here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes,
Speaker 1: Spotify or wherever you get Security this week. Also, you
Speaker 1: can get an ad free feed by becoming a five
Speaker 1: dollars a month patron. Go to Patreon dot Security this
Speaker 1: week dot com and sign up, and don't forget Discord.
Speaker 1: Discord dot Security this week dot com. Lots of good
Speaker 1: stuff happening there. Yeah, I think that's it. So on
Speaker 1: with the podcast. Hey guys, I thought i'd tell you
Speaker 1: I just bought a sweet car online.
Speaker 2: Ooh nice? Well, yeah, what is it?
Speaker 1: It was previously owned by Neil Diamond Sweet Car Online.
Speaker 1: Do I have to spell it out?
Speaker 2: Come on you deadly it all right?
Speaker 1: It's Security this Week, Carl. That's Dwayne and Patrick and
Speaker 1: we got a few stories here. Some of them are
Speaker 1: pretty scary and some of them are of the time.
Speaker 1: Let's talk about Fortinet, our old friend. They are warning
Speaker 1: of critical RCEE. That's remote control and execution flaws in
Speaker 1: forty sandbox and forty authenticator and you know they're they're
Speaker 1: going the way of McDonald's where everything starts with Mick.
Speaker 3: Right, they've been there. Coke please, and yeah, i'd like
Speaker 3: a mcfirewall. I think you hat it is apporting.
Speaker 2: Yeah, all right.
Speaker 1: So what happened here?
Speaker 2: This is a classic? This is a classic. Well, we
Speaker 2: didn't check the inputs type of thing on our you know,
Speaker 2: forty authenticator are bad. Somebody can execute code what I
Speaker 2: don't understand, and so nothing really groundbreaking here other than
Speaker 2: obviously people are trying to tear apart these firewalls, so
Speaker 2: always make sure you go and patch. The first CVE
Speaker 2: here the twenty twenty six four four two seven seven
Speaker 2: that's forty authentic Hator identity so it's their identity management solution.
Speaker 2: Was actually patched in UH six five seven and six
Speaker 2: six nine and eight oh three, so there are patches
Speaker 2: out for these, but it's it's a pretty basic like
Speaker 2: there's an endpoint that you can hit that unfortunately will
Speaker 2: execute code. So this one, this one distills down to
Speaker 2: a if you're running this, go patch. Is one of
Speaker 2: the reasons we put this on the this week's show
Speaker 2: because there's a lot of Fordinet out there.
Speaker 1: I just want to point out that this article refers
Speaker 1: to at least four different products, all that start with forty.
Speaker 1: I know, And I wonder if you work there, if
Speaker 1: they make you say the whole product name in meetings
Speaker 1: and in emails and everything, and do the people get tired?
Speaker 2: Probably relentlessly like prefixing everything with Carl and I sit down,
Speaker 2: I'm like, yeah, I took a look at Sandbox today,
Speaker 2: And he's like, sorry, what did you just say?
Speaker 1: I'm sorry, you looked at what.
Speaker 2: Fo to Sandbox four to Sandbox bad?
Speaker 1: All right, I'm going to forty lunch now at the
Speaker 1: forty cafeteria.
Speaker 4: So put forty dollars in the tip.
Speaker 1: Jar sweed jar A forty. Met up with you forty later.
Speaker 1: All right, So go patch, Go patch, go patch. No
Speaker 1: problem there right next you remember we talked about Canvas.
Speaker 2: Yes we did, and they were hacked. Yes. I heard
Speaker 2: a lot about Canvas.
Speaker 1: Yeah, and Canvas was hacked. And it turns out that
Speaker 1: they reached an agreement with the hacking group behind the breach,
Speaker 1: and that they this is I don't get it. They
Speaker 1: say all stolen data was returned.
Speaker 2: Yeah, returned unread. Yeah. And you know what's great is
Speaker 2: the bad guys. According to this sent a shred log
Speaker 2: showing they deleted everything, like yeah, you know what we
Speaker 2: removed it on, don't we Really?
Speaker 1: All they had to do is back it up onto
Speaker 1: something else and then what shred something else and say,
Speaker 1: see we shredded it.
Speaker 2: Yeah, it's all gone. It's all gone.
Speaker 4: Are you saying there's no honor among.
Speaker 2: The Yeah, yes, yes, that's what I'm saying. Yeah, yeah,
Speaker 2: I know, right, there's very little honor among US security
Speaker 2: people and never mind thieves. So instructure and oddly we
Speaker 2: were joking about this before I read it all last
Speaker 2: week because nobody knows the parent company of Canvas, but
Speaker 2: as infrastructure, it's actually in structure. Yeah, so in structure.
Speaker 2: UH reached out to the Shiny Hunters and miraculously came
Speaker 2: to this agreement where the data was deleted and none
Speaker 2: of it will be shared. And it's awesome. You know
Speaker 2: what I missed in this article that I scoured for
Speaker 2: and then I scoured the internet for is the data? No, No,
Speaker 2: that's there. I can find that. How much do you
Speaker 2: think they paid for that?
Speaker 1: Wow?
Speaker 2: Like they didn't. There is there is no mention of
Speaker 2: it anywhere, and all there is is a note from
Speaker 2: the FBI today saying we don't agree with paying for ransomware,
Speaker 2: but just a generic note, not in reference to this,
Speaker 2: of course, but in reference to this. So, yeah, my
Speaker 2: guess is if you're using Canvas, your fees may go up.
Speaker 1: You know, Shiny Hunters was my favorite band in the nineties,
Speaker 1: and I particularly liked their first album, which was called
Speaker 1: Stolen Hard Drives.
Speaker 2: Nice. Yeah, yeah, yeah, I could see that. I could
Speaker 2: see that.
Speaker 1: Yeah, Shiny Hunters.
Speaker 4: So, Patrick, how much do you think they paid? I
Speaker 4: would think it was a six six figures.
Speaker 1: It's got to be six or seven figures.
Speaker 2: So with the damages they caused, and so, okay, when
Speaker 2: we talked about this last week, we said, listen, initially,
Speaker 2: this is not a big deal. This was a data breach.
Speaker 2: They actually signed up as a free teacher. There's a
Speaker 2: free teacher accounts, so they signed up as a free teacher.
Speaker 2: They quirt an API. They were able to get more
Speaker 2: information than they should, you know, blah blah blah. Right,
Speaker 2: and it should have stopped there. But what the forensics
Speaker 2: is now releasing is there was a fair bit of Okay,
Speaker 2: now that we have some information on who the students
Speaker 2: are who the teachers are in a little bit of
Speaker 2: a mess. Let's start crafting our own parts inside canvas
Speaker 2: because you can do that, right, You can create your
Speaker 2: own little HTML snippets and that sort of stuff. And
Speaker 2: they started doing that and injecting cross site scripting once
Speaker 2: that happened. Now they were getting access to real accounts, right,
Speaker 2: and starting to get access to administrative accounts, so.
Speaker 4: They could do like a module that teaches teachers how
Speaker 4: to detect using AI to write a paper or things
Speaker 4: like that.
Speaker 2: Sure, absolutely right, speculation, yep, just speculation. Yeah, So cross
Speaker 2: site scripting to cross site scripting was absolutely used in
Speaker 2: starting to steal accounts once they got access to the
Speaker 2: data they had through the APIs. And then on top
Speaker 2: of that, it also allowed them to inject that warning
Speaker 2: screen we saw last week, Hey shiny hunters have compromised
Speaker 2: blah blah blah whatever. Right, And all that was was, yeah,
Speaker 2: they didn't take down the back end servers. They were
Speaker 2: just messing around with the hteam out, but it freaked
Speaker 2: everybody out, causing damages and chaos that way.
Speaker 4: So it's worth saying something. This is a little bit
Speaker 4: of of a segue, but it's a little bit of
Speaker 4: a PSA. So one of the plagues of the Internet
Speaker 4: is you go to a website and it asks it
Speaker 4: to send you notifications, and you should always say no,
Speaker 4: but you say yes by accident or you sneeze and
Speaker 4: click the wrong thing. That site now can send you
Speaker 4: pop toast and notifications, and a lot of times what
Speaker 4: happens is you give the wrong website that permission and
Speaker 4: it starts telling you that you're infected. Yeah, and then
Speaker 4: that leads you to the panic that causes the actual breach. Yeah,
Speaker 4: because those notifications are harmless if you don't click on.
Speaker 1: Them, right, Yeah, those notifications, if you've approved them, they
Speaker 1: could put whatever JavaScript or anything they want in there
Speaker 1: because you've approved it.
Speaker 4: So you basically get told you're about to die if
Speaker 4: you don't send me fifty thousand dollars. But you're really not.
Speaker 4: You're not gotten until you take the bait. And so
Speaker 4: I think this is akin to that kind of psychological effect.
Speaker 4: So one of the one of the key things to
Speaker 4: avoid is panic and taking a rash decision. If they're
Speaker 4: gonna make a rash decision, unplug the system, Yes, like,
Speaker 4: just unplug it. That'll buy you time.
Speaker 2: Well, It sounds like instructor tried that right, and they
Speaker 2: shut everything down during finals, which messed a lot of
Speaker 2: people up.
Speaker 4: I get it, but I'm just saying for the users
Speaker 4: when in doubt, stop and analyze. Don't don't kneed jerk reaction.
Speaker 2: But here's the here's the other thing I would ask.
Speaker 2: If you're Canvas and you're an educational tool and you
Speaker 2: allow your users a tool I know, right, you allow
Speaker 2: your users to create content and that content can have
Speaker 2: JavaScript in it, Why, oh why would you ever not
Speaker 2: have that pen tested?
Speaker 1: Right? Like?
Speaker 2: That should have been number one. Hey, my users might
Speaker 2: be malicious, especially seeing we're handing out free accounts because
Speaker 2: they need to say the ransoms. Well thanks for that, Patrick,
Speaker 2: I didn't think about it that way. That makes the
Speaker 2: same number.
Speaker 1: Two, Patrick Hines.
Speaker 2: Sorry, Yeah, I just closed my mind when I see that,
Speaker 2: because it's like, did you have no eye whatsoever towards
Speaker 2: the fact that this could be used maliciously, especially in
Speaker 2: the fact that you're handing out free accounts?
Speaker 1: Yeah?
Speaker 2: And I will tell you if if this was pen tested,
Speaker 2: I don't know that I would go back to that
Speaker 2: pen testing team. I can tell you, like, do we
Speaker 2: find everything in a pen test. No, but there's like
Speaker 2: cross sit scripting is usually.
Speaker 1: By the way, I think the Shiny Hunters second album
Speaker 1: was even better. That's called data.
Speaker 2: What data?
Speaker 1: All right, let's move on.
Speaker 2: Kong tu was it? Bye bye bye? There was not us.
Speaker 1: Kong tou ko t u k e. Hackers now use
Speaker 1: Microsoft teams for corporate breaches.
Speaker 4: Is that like a hat a knit hat for King Kong?
Speaker 3: It is?
Speaker 2: It's a konto, It's a French hat.
Speaker 1: Is the I'd hate to see the ball of yarn
Speaker 1: that started as take Yeah, so the interesting what is
Speaker 1: kong tuk anyway?
Speaker 2: So kong Tuk is a malicious team what they call
Speaker 2: it an initial access broker IV. Initial access brokers aren't
Speaker 2: people who have malware, aren't people who take bitcoin that
Speaker 2: sort of stuff. They break into sites and they stay
Speaker 2: as quiet as possible, and then they sell access to
Speaker 2: those sites. So they say, hey, I have access to
Speaker 2: you know, uh canvas. Yeah, well yeah exactly, I have
Speaker 2: accesses to canvas in multiple schools, uh you know who
Speaker 2: wants it on the dark web and then at that
Speaker 2: point there's a bidding frenzy and people then get access
Speaker 2: go infect the place. That sort of stuff.
Speaker 1: You know.
Speaker 2: What's interesting I find is a lot of the people
Speaker 2: who do the ransomware and damages and that sort of stuff,
Speaker 2: they get caught. They there are several articles of some
Speaker 2: arrests that happened this week. You don't see it a
Speaker 2: lot with the initial access brokers, no right where it's like, oh,
Speaker 2: I don't know, we found an exploit, but we didn't
Speaker 2: do anything with it, although they didn't turn it into
Speaker 2: the company either.
Speaker 4: In human trafficking. All the people who actually do the
Speaker 4: initial kidnapping and things like that very rarely come to justice.
Speaker 4: It's the ones at the end. Yeah, you know, but
Speaker 4: they're every bit is bad.
Speaker 2: Stark advice.
Speaker 4: I know, got dark there, didn't.
Speaker 1: I get nervous when I see PowerShell commands like this
Speaker 1: PowerShell ex Dash Execution policy bypass.
Speaker 2: Nice what Windows style hidden? Don't show the window? What right? Yep?
Speaker 2: Dash command IWR yep. So it's downloading from a from
Speaker 2: a ZIP. It looks like from drop box. So Dropbox
Speaker 2: isn't going to be picked up on your outbound rules
Speaker 2: because everybody uses that out to a file, it expands
Speaker 2: it and then it runs win zip. It runs a winps, Python,
Speaker 2: Slash games, dot Pie heads up. Those aren't games. Yeah,
Speaker 2: I'm going to throw that out there right now.
Speaker 4: They're fun for somebody.
Speaker 2: Yeah, it's a it's a modal rat So what does.
Speaker 1: This mean for people who use Microsoft Teams all the time?
Speaker 2: So this will cause yeah, no, oh my god, sorry
Speaker 2: so mean.
Speaker 1: And that's why Patrick and I are not regional directors.
Speaker 2: Yeah, exactly, they're like, way to toe the line. All
Speaker 2: this means is this, This is a social engineering attack.
Speaker 2: This isn't you know, teams being exploited. This, it's just
Speaker 2: a delivery mechanism. It's it's the same thing as if
Speaker 2: they had sent you an email with this command and
Speaker 2: asked you to run it. Right, They're just they're now
Speaker 2: initial access brokers are targeting every surface they can, whether
Speaker 2: it's email, whether it's SMS. Is a lot harder, right,
Speaker 2: They're not going to text you these commands because you
Speaker 2: can't run them. But messaging apps Telegram, WhatsApp, if you're
Speaker 2: running them on your desktop and get commands like this,
Speaker 2: This happens all the time. Just teams is in the
Speaker 2: mix now, So I'd say, don't run things you don't
Speaker 2: know what they are. Don't don't like Patrick lakes to say,
Speaker 2: don't pick up gum and chew it off the floor.
Speaker 2: But here, trendy freaky, these aren't free games, I promise you.
Speaker 1: Yeah, all right, one more and then we'll take a break.
Speaker 1: Praise on AI p r A I s O n
Speaker 1: AI off bypass targeted within hours of disclosure. So Dwayne,
Speaker 1: you like this one?
Speaker 2: I do like this one?
Speaker 4: How many hours so this?
Speaker 2: Yeah? I know? Right? So well, first let's talk about
Speaker 2: the exploit. So the vulnerability here and think think of
Speaker 2: praise on AI as like an open Claws spin off
Speaker 2: type thing whatever. Right, there's tons of these things around.
Speaker 1: Something you give agency to. You give it all your
Speaker 1: passwords and stuff.
Speaker 2: And all your passwords and your AI keys so they
Speaker 2: can charge you millions of months.
Speaker 1: Yeah, nicko's and ax on your behalf and you hope
Speaker 1: that it doesn't screw up your life.
Speaker 2: Yeah it does and it does. So in here blah
Speaker 2: blah blah, they deploy a flask server, which is a
Speaker 2: web server for running Python. Uh you know code and
Speaker 2: you know lo and behold. There's no authentication turned on
Speaker 2: by default whatever, right, I mean, yeah, it sucks. Somebody
Speaker 2: should have tested it. Somebody should have found it whatever.
Speaker 2: If you're if you have this accessible on the internet,
Speaker 2: you know, bad for you. Anyways, you probably should have
Speaker 2: not had that.
Speaker 1: But they said that it ships with a legacy flask
Speaker 1: API server with off disabled by default, right, so shame
Speaker 1: on them for doing that.
Speaker 2: Yeah. True, shame on everybody. Shame on everybody. Everybody gets shame.
Speaker 2: So yeah, okay, this is a classic story like boy
Speaker 2: meets API server, API server doesn't ask what his name is.
Speaker 3: And.
Speaker 2: Yeah, exactly. But the more interesting part was the moment
Speaker 2: that this was announced publicly. Uh, this was targeted within
Speaker 2: four hours public disclosure, so publicly they came out and said, hey,
Speaker 2: we got this thing. It's really weird. People can access
Speaker 2: the API agent's file. We're taking care of it. And
Speaker 2: then four hours later servers were seeing from the internet
Speaker 2: scans coming in to look for those files. Four hours
Speaker 2: four hours.
Speaker 4: I mean, that's a little longer than the Gilligan's tour, but.
Speaker 2: About his devastating as a Gilligan's tour. Now, professor, you
Speaker 2: can fix everything but the boat. Okay, as is Justice
Speaker 2: side tour here? Yeah, why really, you couldn't fix the boat.
Speaker 2: You couldn't even build a raft out of all that
Speaker 2: wood and bamboo they had. He built a radio out
Speaker 2: of coconuts. I know it doesn't make any sense.
Speaker 1: Yeah, well, I I just wonder how they got all
Speaker 1: those batteries to last for so many years. You know,
Speaker 1: did you know that the whole premise of Gilligan's Island
Speaker 1: was for each of them one to represent the seven
Speaker 1: Deadly Sins?
Speaker 2: No? Really, no I did not.
Speaker 1: Oh yeah, yep, that was it.
Speaker 2: I mean I could see I could see Thurston Howell
Speaker 2: as Greed. Yeah, I could see. Uh absolutely, Gilligan was
Speaker 2: sloth Vanity. Uh wait who Gilligan was?
Speaker 1: Gilligan was slough because he was lazy and he didn't
Speaker 1: do anything.
Speaker 2: I thought Gillian Gilligan was idiocy, but sloth makes.
Speaker 1: I don't think idiocy is one of the dead, but
Speaker 1: it should fortunately should be.
Speaker 2: But uh wait, Ginger was probably Vanity lust Oh lust.
Speaker 4: Yeah, Vanity would be Missus Howell.
Speaker 1: The Skipper was Gluttony.
Speaker 2: Yeah.
Speaker 4: Or what's what's her name?
Speaker 2: The other love Marianne Daddy mah oh mary Anne?
Speaker 1: Oh geez, I don't I don't.
Speaker 2: Remember, okay, ken one of you without looking on the
Speaker 2: internet name.
Speaker 4: I think Missus Howell was van Gilligan.
Speaker 1: You know, when you said boy meets Ai and all
Speaker 1: that stuff, I was immediately reminded of watching MTV with
Speaker 1: when bands in the eighties towards the end of the
Speaker 1: eighties just started getting a bigger edge to them and
Speaker 1: getting out of the glam band thing, and this one
Speaker 1: heavy metal guy.
Speaker 2: Goes yeah, you know, it's a typical love story.
Speaker 1: Boy loves girl, girl doesn't love boy, boy kills girl.
Speaker 2: That's uh, that's typical dark dark dark. All right, here's
Speaker 2: our official list. You're ready. Yeah, Pride, okay, greed, lust, envy, gluttony, wrath, sloth.
Speaker 4: Oh, I wonder if that's it.
Speaker 1: Marianne was envy, Yeah she wasn't.
Speaker 2: Oh yeah she envy ginger? Yeah yeah, who was Pride?
Speaker 1: And Pride must have been the professor.
Speaker 2: Professor because he was so smart, but not really.
Speaker 4: Because he refused to fix the boat.
Speaker 2: He's like, I'm not fixing that boat that's beneath me.
Speaker 4: Does this still qualify as an episode?
Speaker 1: I don't think it's a security podcast anymore. We're going
Speaker 1: to change it to uh three hours, right, all right,
Speaker 1: So what's the takeaway for this thing? H be careful
Speaker 1: because after.
Speaker 2: You can going to be exploded. Yeah. I think there's
Speaker 2: a couple takeaways. We've been talking about how AIS entered
Speaker 2: the arena of exploitation, and we're starting to see we're
Speaker 2: definitely starting to see attackers watching public announcements. Before they
Speaker 2: couldn't do much about it, right, they'd needed to go
Speaker 2: do research and figure out what's going on before they
Speaker 2: could come up with an exploit. Now, with a public
Speaker 2: announcement and just a little bit of detail, AI is
Speaker 2: getting very, very good at discovering what the problem is
Speaker 2: and then creating a proof of comoy.
Speaker 1: I was going to say, it's the AIS that are
Speaker 1: discovering these things people aren't glued to their Yeah.
Speaker 4: Absolutely, Well, we're still we're still in the era where
Speaker 4: AI because Mythos hasn't been generally released and who knows
Speaker 4: whether it's actually living up to its standard is AI
Speaker 4: is really great at finding vulnerabilities in things that has
Speaker 4: the source code for like Linux kernels and documented stupidity.
Speaker 2: Sure like this ye yeah, yep.
Speaker 4: So if it knows what to look for, it will
Speaker 4: find the vulnerability. Yes, we're still in that phase. We're
Speaker 4: not in the phase yet where it's you know, inventing
Speaker 4: new hacks from whole cloth.
Speaker 1: And I think I'll put on my future looking hat here.
Speaker 1: And I've said it before, and you know, I've been
Speaker 1: pretty good about predicting the future in my career.
Speaker 4: Your two.
Speaker 1: Is that we're going to find that the AI works
Speaker 1: for the good guys as fast as it does for
Speaker 1: the bad guys at some point.
Speaker 2: Sure.
Speaker 1: And what I mean by that is we have to
Speaker 1: have more automated patching that kind of stuff, better alerts.
Speaker 1: Right now, we have to have our you know, our
Speaker 1: documentation and in order in our list of resources what
Speaker 1: do we call it.
Speaker 4: The good guys have more money, and there are more
Speaker 4: good guys more money than if we got into a
Speaker 4: situation where we could patch things using a pool of
Speaker 4: tokens and money so that we could patch things faster.
Speaker 4: The problem is, if it's one company against all the
Speaker 4: hackers that might come after him, then it's it's not
Speaker 4: a fair fight. If it's all the defenders against all
Speaker 4: the attackers, then it's very much a fair fight.
Speaker 1: There could be services in the future that will have
Speaker 1: your s bombs and all that stuff should be looking
Speaker 1: out for you, and holy crap, where you know.
Speaker 4: I think it's going to be a rocky five years.
Speaker 1: This is vulnerable and that just got announced and we're
Speaker 1: patching it now.
Speaker 4: I have hope for five years from now. I don't
Speaker 4: have hope for the next five.
Speaker 1: I think it'll be sooner than that. It's got to be.
Speaker 4: I hope, So, I hope.
Speaker 1: So it's got it.
Speaker 4: I thought I thought getting ransom weird for a decade
Speaker 4: would cause people to back up their stuff in ways
Speaker 4: that was immutable.
Speaker 1: Well, I thought we were going to have peak oil
Speaker 1: and the world is going to end before we found
Speaker 1: fracking too.
Speaker 2: I mean, yeah, so what do you think this podcast
Speaker 2: looks like in a year.
Speaker 1: I think we're just going to talk about Gilligan's Island.
Speaker 4: I mean, I hope.
Speaker 2: I mean it's a slower moving topic.
Speaker 4: Yeah, I mean we've been declaring the death of the
Speaker 4: need for cyber people for a long time. You and
Speaker 4: I said, well, you know, this gravy train of sequel
Speaker 4: injection can't last that long. You know.
Speaker 2: It's funny. I remember when companies got firewalls and I
Speaker 2: was like, well, it's all over and don't need to
Speaker 2: be in security. Now everybody's got a firewall.
Speaker 4: It just keeps getting bigger and bigger. And bigger because
Speaker 4: the vulnerabilities keep getting weirder and weirder. Right, Oh, and
Speaker 4: you have to have a sick, twisted mind like you
Speaker 4: and somewhat to me in order to even think that way.
Speaker 1: But I'm so glad my mind is not sick and
Speaker 1: twisted like you. Guys.
Speaker 4: We're working on it.
Speaker 2: All right.
Speaker 1: With that, let's take a little break and we'll get
Speaker 1: back to I promise more security content right.
Speaker 2: After these very important messages.
Speaker 1: And we're back at security this week. That's Dwayne and
Speaker 1: Patrick and I'm Carl And this is this one's going
Speaker 1: to take a little bit of time to explain Windows
Speaker 1: zero days expose BitLocker bypasses and CTF MOND privilege escalation.
Speaker 2: This one's awesome.
Speaker 1: Wow, that that's a big one.
Speaker 2: Yeah, I mean I really actually like this one.
Speaker 4: So before you get into this, you were talking about
Speaker 4: how weird BitLocker is in the way it actually defends.
Speaker 2: Yeah, so a lot of people I don't think I
Speaker 2: understand how BitLocker works. Okay, so if you do bit
Speaker 2: let's say we do BitLocker. Those that do you think
Speaker 2: they know how it works?
Speaker 1: Probably first well, BitLocker is to encrypt data in Windows
Speaker 1: on the hard drive, right.
Speaker 4: Yeah, And it's encryption at rest.
Speaker 1: Encryption at rest, Yeah.
Speaker 2: Exactly, I was going to say. And more specifically, it's
Speaker 2: encryption at rest. So what does that mean?
Speaker 1: Yah?
Speaker 2: Data in motion. Obviously, data you're using needs to be
Speaker 2: decrypted or you can't use it. Data at rest are
Speaker 2: the bits that are sitting on I call it a
Speaker 2: hard drive, not a hard drive anymore, right, solid state whatever,
Speaker 2: but it in store for lack of yeah, for lack
Speaker 2: of a better TERMAL call it hard drive. So you
Speaker 2: have a hard drive in your in your computer, your
Speaker 2: laptop or whatever. If you turn on BitLocker, you know
Speaker 2: ya for you if you lose your laptop, somebody can't
Speaker 2: pull the data off that drive. Well they can now,
Speaker 2: but they used to not be able to that data
Speaker 2: off the drive and we've seen so how does it work? Actually,
Speaker 2: So that's a good question, you say yourself. Okay, so
Speaker 2: the whole drive is encrypted at rest. If it's encrypted
Speaker 2: at rest, how do I boot my computer?
Speaker 1: Because if it doesn't have to be your whole drive,
Speaker 1: by the way, it could just be one folder.
Speaker 2: Sure, absolutely, But let's say we're using but it's typically
Speaker 2: the whole drive. Let's say, we're using full volume encryption. Okay,
Speaker 2: we're encrypting everything.
Speaker 4: Which is the thing most people do.
Speaker 2: Yes, you say yourself, okay, so if I'm using full
Speaker 2: volume encryption, then how does the computer boot? Right? Just
Speaker 2: ask that simple question. Well, there's some Windows files kicking
Speaker 2: around somewhere.
Speaker 4: I thought they were in the TPM.
Speaker 1: That aren't encrypted, and they need some isn't encrypted at
Speaker 1: boot time, So that's what you're saying.
Speaker 2: No, they're all encrypted. That's the part that's weird. Most
Speaker 2: people don't get the whole thing is encrypted. So you say, okay, well,
Speaker 2: how does it even boot Windows? Then how do I
Speaker 2: get into Windows? The way it works is my whole
Speaker 2: hard drive is encrypted, So when I boot my computer up,
Speaker 2: your computer goes through this whole BIOS check, the CPU check,
Speaker 2: the memory check, the whatever. And the computers that support
Speaker 2: locker have a chip on the motherboard which is a
Speaker 2: tp M chip. It's a trusted compute module that holds keys.
Speaker 2: That's what it does. That's its job, right, and it
Speaker 2: verifies that nothing has changed in the security of the
Speaker 2: boot order. So what that means is, you know, is
Speaker 2: the drive serial number the same? Is it have? Am
Speaker 2: I booting in UEFI. There's all sorts of things it
Speaker 2: checks and if everything checks out, it goes Okay. I
Speaker 2: will give you a key, but that key does not
Speaker 2: decrypt the hard drive. That key is a master key
Speaker 2: that decrypts the key that's used for the hard drive.
Speaker 2: This is an important distinction. So there are two keys,
Speaker 2: two symmetric keys that are used for encryption. One of
Speaker 2: them is.
Speaker 1: The symmetric used. Symmetric means one way and asymmetric use
Speaker 1: means both ways. Is that how it works?
Speaker 2: So let me let me break that apart even more.
Speaker 2: Metric means the key is used. The same key is
Speaker 2: used to decrypts as it is to encrypt. It's like
Speaker 2: we have a password and if I give you the password,
Speaker 2: you're gonna give me access to a room or whatever
Speaker 2: it is. But is that one password.
Speaker 4: It's like using a key to lock a door, same
Speaker 4: key unlocks the door exactly.
Speaker 1: That's symmetric, yes.
Speaker 4: Whereas asymmetric means one key locks and a different key
Speaker 4: unlocks exactly.
Speaker 2: Okay, right, Yeah, that's a that's a good way of
Speaker 2: thinking about it.
Speaker 1: That's a really Hey, if you learn nothing today except
Speaker 1: for the seven Deadly sins.
Speaker 2: You'll remember the Gilligan stuff.
Speaker 1: This is something to remember because yeah, that that was
Speaker 1: a piece of data that went in when here and
Speaker 1: out the other when I was working with the keys.
Speaker 2: Yeah, and it's and so okay, so we got two
Speaker 2: symmetric keys. We have a master symmetric key that is
Speaker 2: used to unlock the the the volume level key. Yeah,
Speaker 2: and the volume level key is used to unlock all
Speaker 2: of the files on the drive. Those are two keys.
Speaker 2: Those keys are also encrypted by asymmetric encryption. And that's
Speaker 2: so you can't just open the chip up and look
Speaker 2: at it and try and get the master key, the
Speaker 2: volume master key. You can't because it's encrypted with asymmetric encryption.
Speaker 2: And the only way that key comes out is if
Speaker 2: everything in the boot process looks clean. So, so far
Speaker 2: are we good? Right? I boom my computer like normal.
Speaker 2: The bias goes through, says nothing's changed, it's the same drive,
Speaker 2: it's the whatever, and it pulls that volume level master
Speaker 2: key out. That key then decrypts the full disc key,
Speaker 2: which is then used to decrypt the drive.
Speaker 4: So this is why if you update the firm where
Speaker 4: sometimes you get screwed.
Speaker 2: On, yeah, or change the drive out or anything like that,
Speaker 2: or put the drive in a new laptop. You can't
Speaker 2: read it anymore because the keys don't match. I have
Speaker 2: a question, what's the question? Yeah, So my question is
Speaker 2: do the asymmetric keys get created on the fly every
Speaker 2: time or are they also stored? They are also stored.
Speaker 2: They are, yeah, and they're they're not released unless that
Speaker 2: boot order camera is called the PC something or other.
Speaker 1: It's not like TLS like ah cps, where the keys
Speaker 1: are created.
Speaker 2: You know. Yeah, it's that's a good distinction. Yeah, it's not.
Speaker 2: It's not instantaneously created at the time. Because the interesting
Speaker 2: thing about asymmetric encryption, I guess if you find asymmetric
Speaker 2: encryption interesting is you're it's not used to encrypt large
Speaker 2: amounts of data. So a lot of us see SSL
Speaker 2: and we go, oh, that's a symmetric encryption. It's got
Speaker 2: public and private keys and blah blah blah. Really, all
Speaker 2: that's doing is encrypting a session key in your browser.
Speaker 2: That's that's a symmetric key that we're going to share.
Speaker 2: So and I go to talk to Carl, and I
Speaker 2: want our conversation to be secure. I have a public key,
Speaker 2: he has a private key. I send I encrypt a
Speaker 2: password a symmetric key like Kong two right with his
Speaker 2: public key, and I send it to him, and now
Speaker 2: he can decrypt it, and then.
Speaker 4: We use that key we switch over to the metric key.
Speaker 2: Yeah, exactly. Okay.
Speaker 4: The problem with all asymmetric protocols are very limited in
Speaker 4: how much data they can encrypt, whereas symmetric can encrypt terabytes.
Speaker 2: Yeah. Yeah, and there's all sorts of stream ciphers and
Speaker 2: all sorts of things you can do with that.
Speaker 4: This is your important concepts for quantum.
Speaker 2: So yeah, no, no, moving on.
Speaker 1: So let's go back to Gilligan's Island.
Speaker 2: Let's say we're now, let's say, in a normal situation,
Speaker 2: we haven't even gotten to the exploit yet. Let's say
Speaker 2: in a normal situation, we boot our laptop, we log in,
Speaker 2: so that means we've passed the nothing has changed. Check
Speaker 2: the TPM supplied the master key. Yeah, the master key decrypted,
Speaker 2: the full disc encryption key. The full disc encryption key
Speaker 2: decrypted the disc. Now here's an important distinction. What happens
Speaker 2: if I power my laptop off? How does all those
Speaker 2: files get encrypted? Again?
Speaker 1: Wait a minute, encrypted the whole disc at boot? Yeah, now,
Speaker 1: you say, well, just like that, not on demand. How's
Speaker 1: that even possible? How is that possible?
Speaker 2: So there's another right, So what about Mary lou So
Speaker 2: there's another distinction here. The files on disc actually never
Speaker 2: get decrypted sitting on disc. The moment Windows boots, it
Speaker 2: decrypts them all in RAM, not the whole drive, everything
Speaker 2: it needs. When it goes down, everything on it starts.
Speaker 2: So now we have on demand decryption that only is
Speaker 2: loaded in memory. And what that means is, if I
Speaker 2: power the laptop off, you're fine. The files are still encrypted, right, Yeah,
Speaker 2: the files are still and the memory disappears, right right,
Speaker 2: because that's how random access memory works. So okay, So, however,
Speaker 2: I see a vulnerability here.
Speaker 1: That key is somewhere in RAM.
Speaker 2: So, yes, the key is somewhere in RAM, and it's
Speaker 2: it's highly protected. There are ways to strip the keys
Speaker 2: out and all sorts of stuff. Yeah, there are listeners
Speaker 2: on the TPMs and all sorts of weird stuff. Okay,
Speaker 2: Now let's come to the exploit. And this is the
Speaker 2: the the guy who discovered this exploit this said, this
Speaker 2: is one of the most insane discoveries I've ever found.
Speaker 2: End quote. He starts digging through Windows coat and I
Speaker 2: say he maybe it's maybe it's a HEMI it's a
Speaker 2: she actually is probably an AI, but neither here nor
Speaker 2: there's an it. Yeah, so this SEXPLO it's called yellow key.
Speaker 2: So when I boot Windows, that whole process we talked
Speaker 2: about works. If I plug a US. Let's say I
Speaker 2: want to restore Windows. We're running into an issue. I
Speaker 2: had a driver failure or whatever it is. You go
Speaker 2: into the Windows are which is a it's a Windows
Speaker 2: recovery environment. So I plug into USB, a Windows USB,
Speaker 2: and it boots to that Windows USB. But I can
Speaker 2: still see the drive. I can't access anything unless I
Speaker 2: supply the BitLocker recovery key. So if I go to
Speaker 2: my sea drive and say, oh, show me all of
Speaker 2: Carl's files because I've booted to this USB stick, it
Speaker 2: will say, well, give me the one hundred and twenty
Speaker 2: eight bit key that unlocks a drive.
Speaker 1: And I'll do that, and I know where those are.
Speaker 1: Those are online and you if you log into Windows
Speaker 1: with yeah, log into the website, you see your profile. Yep,
Speaker 1: they're right there.
Speaker 4: Yeah.
Speaker 2: If you on your laptop have logged into your laptop
Speaker 2: with an online micros account. You're not using a local account.
Speaker 2: You can log into your profile. You can find those
Speaker 2: recovery keys. But let's say we don't have that recovery key.
Speaker 2: Anything I try and do to the boot drive, anything
Speaker 2: I try and do to the to the user's drive,
Speaker 2: the files that anything I get access denied I get.
Speaker 2: You can't do anything with these because I don't have
Speaker 2: that recovery key. I can't bypass, I can't ask Windows.
Speaker 2: Are the USB stick to decrypt the file so that
Speaker 2: I can read it?
Speaker 1: Not possible.
Speaker 2: Okay, so we're in the same place, but I can
Speaker 2: see some I can see the files, right. It's because
Speaker 2: the you know what the names are because because we
Speaker 2: were able to boot into Windows R the volume master
Speaker 2: key loaded, which is fine because we haven't manipulated anything yet,
Speaker 2: and we can still see the file structure, right. We
Speaker 2: just can't do things with it. Okay. There is a
Speaker 2: transactional file system. It's called FSTX. For those of you
Speaker 2: who may have remembered Microsoft. Do you guys remember Microsoft
Speaker 2: at one point said, you know what file systems are
Speaker 2: dead wins. We're going to make the entire win fest.
Speaker 2: We're going to make the entire file system.
Speaker 4: A database a database, Yeah, because what could go wrong?
Speaker 2: And what did databases have?
Speaker 1: Do you remember Rory Blach on dot net rocks trying
Speaker 1: to explain win fs. Yes, you do it, says Now,
Speaker 1: now imagine you have your porn collection and imagine you
Speaker 1: want to store it by keyword. So you might have
Speaker 1: one keyword that's like threesomes, another keyword it's like and
Speaker 1: you have another category. You know, computer must be burned
Speaker 1: to the ground after viewing.
Speaker 2: Right, So okay, get away with words that. What did
Speaker 2: databases have? They have all sorts of things. They have
Speaker 2: transactions right where I can say, I want to make
Speaker 2: sure that if I'm you know, let's say, for example,
Speaker 2: I want to enter an entry into the database table, well, transactionally,
Speaker 2: I want to make sure that it doesn't violate neing
Speaker 2: referential integrity. I want to make sure that I commit it.
Speaker 2: Blah bah blah. Let's say there's an issue with me
Speaker 2: committing that transaction. Well, obviously I want to be able
Speaker 2: to roll it back, right, I want to go back
Speaker 2: to originally what was in that table. So Microsoft had
Speaker 2: implemented all of these things in the file systems. Okay,
Speaker 2: stop there, transactions, rollbacks, all sorts of stuff.
Speaker 1: Stop there. WinFS was supposed to be one of the
Speaker 1: pillars of Vista that included all sorts of other things.
Speaker 1: Uh huh, And they couldn't. They basically said, we couldn't
Speaker 1: implement WinFS because we couldn't figure out how to traverse
Speaker 1: networks efficiently. Yes, and so they they dropped it. Yeah,
Speaker 1: and everybody thought, hey, it's that we don't have that.
Speaker 2: Do you know how they dropped it? They just deleted it,
Speaker 2: didn't tell anybody that it was there. They deleted the
Speaker 2: UI and said, pretend you don't remember it's here. That's
Speaker 2: what they did. So at the kernel level, all of
Speaker 2: the transactions still exist, all of the rollbacks still exists,
Speaker 2: as the.
Speaker 1: MVP is going to be revoked.
Speaker 4: No, no, backward compatibility is a bane in our existence.
Speaker 2: What's actually, Carl, what's hilarious is my MVP for Microsoft
Speaker 2: Security Developer was revoked a long time ago, which whatever.
Speaker 2: But anyways, so okay, because I don't do enough in
Speaker 2: the community talking about development and security, Yeah, that's why
Speaker 2: it's all good.
Speaker 1: Yeah.
Speaker 2: So what this exploit does is it invokes that kernel
Speaker 2: level roll batches and puts it as a transaction in
Speaker 2: the queue for for NTFS Transactional File System and says, oh,
Speaker 2: by the way, here are the bits I want you
Speaker 2: to roll back. I want you to take command dot
Speaker 2: ex and I want you to roll it back onto
Speaker 2: the se T HC dot ex. Now you may say,
Speaker 2: what what is the s E T A C H
Speaker 2: dody x. That's the sticky keys. Anybody know what sticky
Speaker 2: keys is?
Speaker 1: Oh?
Speaker 2: Yeah, and how you get to sticky keys?
Speaker 1: Yeah, there's a keystroke or something like that. If you
Speaker 1: hit you get this pop up that says, hey, do
Speaker 1: you want to turn sticky keys?
Speaker 2: If you know, if you ta, if you hit shift
Speaker 2: your left shift five times quickly, it will pop this
Speaker 2: up and say you want to do you want to
Speaker 2: enable sticky keys? And it's an accessibility You're going to
Speaker 2: do it right now?
Speaker 1: Ready? Yeah, there it is sticky keys.
Speaker 2: So it's an accessibility thing. What's great about that is
Speaker 2: that works before you log into the computer. So I
Speaker 2: can be at the login screen and I can hit
Speaker 2: I can hit shift five times and it will open
Speaker 2: up that that program, that sticky keys program. So now
Speaker 2: what I can say is, hey, computer, I want you
Speaker 2: to put in the transactional layer to restore on top
Speaker 2: of the sticky keys program the command dot ex program
Speaker 2: for me. So you can now I just shut the
Speaker 2: computer down. I didn't I didn't touch the encrypted files.
Speaker 2: When I boot the computer back up, it goes through
Speaker 2: the whole process of decrypting and whatnot, and it goes, oh,
Speaker 2: by the way, there's this transaction here that I need
Speaker 2: to run to restore command dot ex on top of
Speaker 2: S E T HC dot exe. And then at the
Speaker 2: command prompt, I hit the shift five times and sure enough,
Speaker 2: a command prompt opens with system level access and everything's degred.
Speaker 2: Oh my god.
Speaker 4: All right, so you can get this command to run
Speaker 4: on a system that you don't have credentials to.
Speaker 2: Yeah, what's also kind of cool? As you say, okay, well, Dwayne,
Speaker 2: this sounds like BS. How did you get a transaction?
Speaker 2: And the transactions are actually logged in a dollar log
Speaker 2: file log file sitting at the route? How did you
Speaker 2: get a transaction in an encrypted log file? Right? The
Speaker 2: decryption and encryption of data only denies you only requires
Speaker 2: that recovery key on BitLocker if you try and do
Speaker 2: normal reads and writes. So if I tried to open
Speaker 2: that file and say nope, go away. But if I
Speaker 2: call the API and the Windows kernels, who would do
Speaker 2: that to create a transaction? This is the Windows kernel
Speaker 2: API goes, Oh, well, let me grab the keys for you, okay,
Speaker 2: so I can encrypt it into the log file.
Speaker 1: I have an obvious question here that I'm sure is
Speaker 1: on everybody's mind.
Speaker 2: Uh huh.
Speaker 1: Does NTFS which is the file system the user uses?
Speaker 1: Does it use win FS the stuff that's there? No? Okay,
Speaker 1: why is it there?
Speaker 4: Back with compatibility?
Speaker 1: Is the a p I even enabled?
Speaker 4: Back with compatibility?
Speaker 1: Question?
Speaker 4: Some some product that Microsoft built that needs it and
Speaker 4: they didn't want to right.
Speaker 2: Or I'm an overwork development of Microsoft. And my manager,
Speaker 2: Candy me said, did you rip out fast yet? And
Speaker 2: I said, uh, yeah, delete the UI it's gone find
Speaker 2: it good luck.
Speaker 1: Geez.
Speaker 2: Yeah, this is uh, this is a crazy bug and
Speaker 2: it is super easy to exploit.
Speaker 1: So and is there a fix?
Speaker 2: No? No, this is Oh my god, this is we
Speaker 2: need with our listeners.
Speaker 1: Please don't be evil.
Speaker 4: Don't let Dwayne near your computer.
Speaker 2: No, don't around with speed drive.
Speaker 4: So I gotta tell the story, Dwayne. We had a customer,
Speaker 4: super paranoid customer, great customer. No names, no, no in
Speaker 4: name of industry, and they were super proud of how
Speaker 4: they did things, and they didn't allow people to even
Speaker 4: access the Internet from their desktops. They had to go
Speaker 4: to Kiosk machines in the middle of the courtyard and
Speaker 4: Dwayne walked in and they're like, you know, we're really
Speaker 4: proud of these. You know, you're welcome to try to,
Speaker 4: you know, get administrative prompt or you know, do something
Speaker 4: on these, but they're so locked down. And the guy
Speaker 4: turned around and Dwayne had an admin prompt.
Speaker 1: Yeah, you told me this, yeah, And then he was
Speaker 1: freaking embarrassed, right, and he goes, oh my god, hang on,
Speaker 1: and he like ran off and came back.
Speaker 2: He says, okay, now you can't do it.
Speaker 4: It just happened over and over again, but he's like
Speaker 4: four times.
Speaker 2: And what was funny is the last time, he's like, listen,
Speaker 2: this network we have here, these computers in the middle
Speaker 2: of the room. They don't have access to anything but
Speaker 2: the Internet. And I was able to not only bypass
Speaker 2: the things they had, but then fire up wire sharks.
Speaker 2: Oh god, and I could see all the credit card
Speaker 2: transactions coming off of their their outside network. And he's like, wait,
Speaker 2: how do you see those? They're on a different IP range.
Speaker 2: I don't even route that, and I'm like, dude, it's
Speaker 2: on the same copper. I'll tell you for a million
Speaker 2: dollars exactly. Yeah. Yeah, it was. That was a fun
Speaker 2: That was a fun benta.
Speaker 1: All right. So now let's let's get to the story
Speaker 1: which is in two stories, which is you remember last
Speaker 1: week and we talked about Linux and how it was
Speaker 1: pretty much hosed. Every Linux system is at risk. That
Speaker 1: was what two thirty two is all about. Yeah, well,
Speaker 1: apparently there's more to come, and.
Speaker 2: Let's it's just a dumpster fire.
Speaker 1: Yeah, let's start with the dirty frag zero day that
Speaker 1: gives root on all major distributions.
Speaker 2: Oh, it's so good, so good. This is a great
Speaker 2: week for privesk. Honestly, this is the historical week for
Speaker 2: privesk Windows and Linux.
Speaker 4: And a bad week for everyone else.
Speaker 2: Yeah, this is so good, so yeah dirty. We talked
Speaker 2: about copy fail last week, which copy fail was oh
Speaker 2: my god, you have access to all these things and
Speaker 2: there are patches for the kernel out there for that.
Speaker 2: And then based off of the XFRM esp page caching,
Speaker 2: which was part of the vulnerability, another researcher came out
Speaker 2: with another one and they were like, you know what,
Speaker 2: this is dirty frag. Dirty frag also exploits cash right
Speaker 2: vulnerability and gives you privileged escalation right on the box.
Speaker 2: And you know, here again we're back at the same place,
Speaker 2: not patched. You know, we have an issue.
Speaker 1: So why did they call it dirty frag? Does that
Speaker 1: have anything with defragmenting?
Speaker 2: It has to do with fragmentation, So it has to
Speaker 2: do with, you know how, because they're manipulating the cash
Speaker 2: right vulnerability. So cash is notoriously you need to fragment
Speaker 2: and then defragment it to squeeze all the memory down
Speaker 2: and then refragment it right as you're reading and writing
Speaker 2: and that sort of stuff. And typically we find, especially
Speaker 2: if you're doing even if you're doing like heap grooming,
Speaker 2: same type of thing, you're manipulating the fragmentation of the
Speaker 2: heap to get it to run code or free something
Speaker 2: it shouldn't have, or that sort of stuff like a
Speaker 2: US effort.
Speaker 1: So I can understand from when you say heap grooming
Speaker 1: what that is. And because you know grooming, you get
Speaker 1: comb your hair, you organized things. I get it. But
Speaker 1: you know, they they talk about things like dirty pipe,
Speaker 1: and I'm a little I don't really understand what that is.
Speaker 1: You know, I have an imagination.
Speaker 2: That's a special folder dirty pipe. We could probably find
Speaker 2: some examples of dirty pipe, but they.
Speaker 1: Say in the dirty frag belongs to the same class
Speaker 1: as dirty pipe and copy fill innextrollabilities. It exploits the
Speaker 1: fragment field of a different kernel data structure.
Speaker 2: Right right, So it's and it's a lot of these
Speaker 2: exploits come from I create a structure, I delete the structure,
Speaker 2: and then I create a smaller structure, and I delete
Speaker 2: that structure, and I do these in a particular pattern
Speaker 2: that allow me to then manipulate that structure to either
Speaker 2: access stuff I shouldn't, or have a use after free
Speaker 2: where it's actually putting data in there and it and
Speaker 2: the computer believes that that memory is freed, but I
Speaker 2: still have a pointer to it, so then I can
Speaker 2: do all sorts of stuff in there. So and that's
Speaker 2: all of your like you're dirty, even going all the
Speaker 2: way back to dirty cow, all of them are the
Speaker 2: same style of attackers. Now you get dirty cow, dirty pipe,
Speaker 2: dirty frog, all of them come back to get.
Speaker 1: A dirty frog, dirty chicken, dirty pig.
Speaker 2: The dirty farm. That's going to be the exploitation framework
Speaker 2: is the dirty farm, and it's just going to be all.
Speaker 1: I just you know, I can't deduce what they possibly
Speaker 1: could be from those names, so.
Speaker 2: I know, right, So a lot of these are around,
Speaker 2: and some of these, a lot of them end up
Speaker 2: being around efficiencies, right, like all of you know, when
Speaker 2: you delete a file on your hard drive, doesn't actually
Speaker 2: delete it, right, It doesn't overrite it was.
Speaker 1: You know that.
Speaker 2: Yeah, it doesn't remove the magnetic bits on there, right.
Speaker 2: All it does is tell the file system pretend it's
Speaker 2: not there. That's it. That's all that deleting a file does. Now,
Speaker 2: as we have frantic listeners going and drilling drives, so
Speaker 2: what we do, yeah, exactly, Yeah, we have them melted
Speaker 2: down into a slag.
Speaker 4: We have a company that does the shredding.
Speaker 2: Oh yeah, yep, data distruction. I don't know if you've
Speaker 2: seen those. Those are awesome. They're like paper shredders, but
Speaker 2: for like hard drives. I mean you shrow them in
Speaker 2: there and they crush anything.
Speaker 1: So there was the episode of Mondays where Richard Campbell,
Speaker 1: who was Richard the Toy Boy, found this device that
Speaker 1: was a hard drive cleaner, Zappa or whatever. You put
Speaker 1: it in this device. It had no power. You put
Speaker 1: it in the device, you wait for one minute, and
Speaker 1: then you take it out and it's completely gone. It
Speaker 1: was a magnet.
Speaker 2: Yeah, yeah, a big, a big magnet.
Speaker 1: Man. He told the story of Goliath. You want to
Speaker 1: hear a story, I'll tell you a story about a
Speaker 1: big magnet. This is nothing. Yeah, okay, So but you're
Speaker 1: talking about things that shred.
Speaker 2: Right right? Yeah?
Speaker 4: Anyways, yeah I digress.
Speaker 2: Yeah, like uh yeah, like just choose the drives apart
Speaker 2: in small, fine metal bits.
Speaker 1: All right. So there is a patch for this, and
Speaker 1: it's kind of a patch. It's a command that you
Speaker 1: need to to run, and it's right there in the article.
Speaker 1: It's an s h print def install ESP four whatever.
Speaker 1: So it's going to remove the vulnerable ESP four, ESP
Speaker 1: six and r x pc r x RPC kernel modules.
Speaker 1: But it's important that it'll break ip SECVPNS and that stuff.
Speaker 1: So read the article and I think there are patches
Speaker 1: available maybe yet are there?
Speaker 2: So configurations the the a lot of the Linux kernels
Speaker 2: are getting patches over some of these, whether it's going
Speaker 2: to be copy fail or you know, dirty frag or whatever,
Speaker 2: or the next one we talk about.
Speaker 1: Yeah, and so what is the next one we're going
Speaker 1: to talk about? This is this is our yeah?
Speaker 2: Yeah, the next one is literally shoot, you know what.
Speaker 2: Let me look at the days here. On the eighth,
Speaker 2: Dirty Frag came out and we were like, oh dear god,
Speaker 2: we just had an exploit in copy fail in all
Speaker 2: major Linux brands. And then on the fourteenth, Fragnesia came out.
Speaker 2: And this is a spin off of a dirty Frag.
Speaker 2: This is the same leveraging a lot of the same components,
Speaker 2: the x FRS esp cash right.
Speaker 1: You know, I would imagine that it could be a
Speaker 1: spin off of dirty Cow, because then you'd have milk
Speaker 1: of frag.
Speaker 2: Milk of frag.
Speaker 4: It's a child of wow, wow, how is that?
Speaker 2: That's pretty good? Huh.
Speaker 1: I'll be here for five more minutes, kids.
Speaker 2: So, needless to say, this is another way to exploit it.
Speaker 2: So a lot of people, especially if there's not a
Speaker 2: patch released, we'll go out and start putting indicators a
Speaker 2: compromise monitoring on their systems. They have sims that they're
Speaker 2: monitoring what's going on, and they may be so specific
Speaker 2: that they're going to catch one of these button on
Speaker 2: the other. So just real there are multiple ways to
Speaker 2: exploit this cash read and write. In the article, it
Speaker 2: even says just as Fragnesia, dirty frag has a publicly
Speaker 2: available POC exploit. So both of these right now are
Speaker 2: just out on the internet, so you have to be
Speaker 2: careful if any one of them at this point could
Speaker 2: exploit a Linux system. So you need to go out
Speaker 2: and take a look at these articles. Like Carl had said,
Speaker 2: there is a configuration change you can make that will
Speaker 2: make these safer. You just need to make sure it's
Speaker 2: not going to cause issues with your install.
Speaker 1: And the Linux distros are trying to catch up, and
Speaker 1: probably by the time you hear this, there's probably going
Speaker 1: to be a distro patch.
Speaker 2: One would hope one would hoop. Until then, I'm going
Speaker 2: to compromise every Linux box.
Speaker 1: Watch out. Duane's on the case.
Speaker 2: Wow for science.
Speaker 1: I think that's it.
Speaker 2: Right, I think that's that's this week.
Speaker 1: Yeah, all right, that's what happened last week, and so
Speaker 1: we'll talk about what happens next week on Security this week.
Speaker 1: Bye bye, Mike, ooh
Speaker 4: Ooh ta