Speaker 1: And don't forget Discord. Discord.SecurityThisWeek.com. Lots of good stuff happening there. Yeah,
Speaker 1: I think that's it. So on with the podcast. Do
Speaker 1: you suffer from shyness? Do you sometimes wish you were
Speaker 1: more assertive? Ask your doctor about tequila.
Speaker 2: Or donut.
Speaker 3: Side effects may cause beer goggles.
Speaker 1: When my wife and I started dating, she said, I'm
Speaker 1: not allowed to drink tequila. All right. We've got a
Speaker 1: few stories for you today. This is Security This Week,
Speaker 1: by the way.
Speaker 4: I'm Carl.
Speaker 1: That's Dwayne and Patrick. This week, This is kind of
Speaker 1: good news, I think, but it confirms at least what
Speaker 1: we've been talking about all the time. Sys of Vulnerability Review. Old,
Speaker 1: simple flaws drive most breaches.
Speaker 2: Oldies but goodies.
Speaker 1: Oldies but goodies.
Speaker 2: Yeah.
Speaker 5: That's right.
Speaker 2: Wayne's still using printer defects from years ago.
Speaker 5: Well, I mean....
Speaker 3: Sequel injections been on the top of the list for
Speaker 3: how long?
Speaker 4: Yeah.
Speaker 5: Right.
Speaker 2: Since they started the list.
Speaker 4: Yeah.
Speaker 3: Since the list began.
Speaker 4: Yeah.
Speaker 3: It's like that FBI's, you know, top 10 people to get.
Speaker 3: It's still, it's the same, it's the same people.
Speaker 1: The thing here is that we talk about AI as
Speaker 1: being evil and models being evil, which is the.
Speaker 5: Title of this show.
Speaker 1: But, but, you know, in fact, most problems are caused
Speaker 1: by old, old issues.
Speaker 4: Yeah. Yeah.
Speaker 2: We'll have the longest time for people to, figure out
Speaker 2: how to exploit them for the exploits to mature and
Speaker 2: get more of that, uh, less variable.
Speaker 4: Yeah.
Speaker 3: But I'm going to, I'm going to take the negative
Speaker 3: side of that, Patrick. We've also had a lot more
Speaker 3: time to understand how they work so that people, developers
Speaker 3: should be actually fixing them.
Speaker 2: Oh no, I I'm on, I'm all on board. I'm
Speaker 2: just saying you give the hackers, you give the hacker
Speaker 2: community a decade and script kitties will even be proficient.
Speaker 4: Yeah.
Speaker 3: So it, you know, it goes through and it's an
Speaker 3: interesting breakdown. There's, um, if you guys, click if at
Speaker 3: some point if you click on the links to the
Speaker 3: show you'll see they break down some of the different
Speaker 3: types of attacks and and it's not saying the most
Speaker 3: dangerous ones are the ones that have been around forever
Speaker 3: it's just the most frequent ones um there are you
Speaker 3: know input validation errors right how many times have we
Speaker 3: told you on the show never trust the user right
Speaker 3: whether they're talking to you or whether they call you
Speaker 3: and say they want to switch their bank account or
Speaker 3: whether it's their typing data in the browser, right?
Speaker 2: Or whether you can imagine how they could exploit it.
Speaker 5: Yeah, absolutely.
Speaker 2: Because you can't imagine it doesn't mean it's not possible.
Speaker 3: Yeah, and actually, not to foreshadow a little bit, but
Speaker 3: one of our stories here, we will talk about trusting
Speaker 3: the user and their browser a little bit too much,
Speaker 3: which caused untold damages.
Speaker 2: Hilarity.
Speaker 3: Yeah, injection issues, here again.
Speaker 5: Right?
Speaker 3: We just talked about SQL injection. So for those of
Speaker 3: you who may or may not, I don't know, perform
Speaker 3: injection all the time.
Speaker 1: Enough said.
Speaker 3: Walk that fine line. An injection issue is where you're
Speaker 3: expecting the user to give you input of some sort, right?
Speaker 3: Whether it's oh, what language do I want the browser in?
Speaker 3: What day do I want my, you know, my tea
Speaker 3: time at this golf.
Speaker 5: Course, whatever it may be.
Speaker 2: Like your steak cooked.
Speaker 5: Yeah, exactly.
Speaker 3: You know, whatever you're expecting the user to give you
Speaker 3: or expecting to come from the user's browser, more importantly,
Speaker 3: because a lot of people will just assume, hey, I
Speaker 3: got five fields on this that the user can fill out.
Speaker 3: So that's what I'm expecting. But there's 15 other fields
Speaker 3: I take from that, that I'm just holding variables in
Speaker 3: the browser.
Speaker 2: But the text ones are the dangerous ones is the lead.
Speaker 3: Right, exactly. Developers always assume if a user can type
Speaker 3: in it, it's dangerous and I should keep an eye
Speaker 3: on it. But the problem is every field that gets
Speaker 3: submitted back on that form is something the user can edit.
Speaker 2: Inject.
Speaker 3: Ultimately, right, and inject into. So these are the types
Speaker 3: of issues, and they pop up. So input validation, memory
Speaker 3: safety issues, we talk about buffer overruns and that sort
Speaker 3: of stuff, injections, access control deficiencies. So we've talked about
Speaker 3: these are probably the core.
Speaker 5: Of most of the stories we've talked about. Yep.
Speaker 3: Is, you know, every time it comes back to, oh,
Speaker 3: and then, you know, the keys were in the page or, oh,
Speaker 3: then the user did, you know, or one equals one
Speaker 3: and got access to the whole site, right?
Speaker 1: And social engineering tops the list too. I mean, that's
Speaker 1: kind of the root of all, the radix malorium.
Speaker 5: The root of all evil.
Speaker 2: Wow.
Speaker 5: Radix malorium.
Speaker 1: Malorum.
Speaker 3: Did you just make that up?
Speaker 1: Radix malorum.
Speaker 5: Radix malorum.
Speaker 1: So, it's from the Latin, radix malorum est cupiditas.
Speaker 5: You know, avarice is the root of all evil.
Speaker 4: Damn, Carl.
Speaker 1: So, radix malorum.
Speaker 4: Yeah.
Speaker 5: I don't even know what to say about that, Carl.
Speaker 1: I went to school. What can I say? I'm sorry.
Speaker 3: I learned a few things. Patrick, our boy is so smart.
Speaker 3: Your mom and I are so proud, Carl.
Speaker 5: Yeah, okay.
Speaker 2: Okay. In fact, I'm... Parabellum.
Speaker 1: All right. So the next one is kind of, seems important.
Speaker 1: The proof of concept published for Linux kernel priv-esque flaw.
Speaker 1: And I was reading it and I was trying to
Speaker 1: figure out how the heck could, you know, how hard
Speaker 1: is it to, how easy is it for somebody to
Speaker 1: be exploited if they have a Linux box that's on
Speaker 1: the internet? Turns out they have to have a user account, right?
Speaker 2: Yeah.
Speaker 3: I mean, this is, this is a straight up privask
Speaker 3: and it's interesting. It's an interesting one. Um, uh, you know, uh,
Speaker 3: walking through the attack.
Speaker 5: Right?
Speaker 3: Um, it says the issue resides in the, I don't
Speaker 3: worry about the functions, but the IO poll get ownership function.
Speaker 5: Okay, great.
Speaker 3: So there's some sort of function that pulls ownership. It
Speaker 3: uses a signed comparison to check a specific slow path.
Speaker 3: Don't worry about slow path thresholds.
Speaker 1: Signed meaning both negative and positive.
Speaker 4: Yeah.
Speaker 3: That's what I want to focus on. Yeah, exactly. Um,
Speaker 3: so I, I had this conversation, uh, earlier with one
Speaker 3: of my children just yesterday, actually. Um, And we were
Speaker 3: talking about the memory structures of variables. And if you
Speaker 3: take an int, an integer, right, a number, and you
Speaker 3: make it a variable, there's a certain size that you
Speaker 3: can store in that structure. And the size of the
Speaker 3: variable might be, you know, 32767, right? If it's a
Speaker 3: signed integer, right? or it might be 65,000 if it's
Speaker 3: an unsigned integer because the last bit is generally used
Speaker 3: as to whether the number is negative or positive. So
Speaker 3: if you say it's unsigned, right, then you can have
Speaker 3: a much larger number, but you can't ever have a negative.
Speaker 3: If you say it's a signed variable, then you have,
Speaker 3: you know, positive 32767 and negative 32767, let's say, right?
Speaker 3: So you have the same kind of amount of, of
Speaker 3: variability in there, just whether it's negative or positive. So
Speaker 3: this is a classic problem, more with C and C
Speaker 3: + + than other programming languages, where you had to
Speaker 3: declare whether this was a signed or an unsigned integer.
Speaker 3: And then when you went to make a comparison, it
Speaker 3: would then say, oh, well, I'm comparing this to a
Speaker 3: particular number. So in this particular case, all right, now
Speaker 3: that we know what signed is, In comparison, the atomic
Speaker 3: read function, nobody cares, operates and returns a signed integer.
Speaker 3: So if you call IO pull cancel flag, doesn't matter,
Speaker 3: the value becomes negative during the signed path. Okay, so
Speaker 3: at some point, it's calling this IO cancel flag and
Speaker 3: the last bit is set. So it assumes the number
Speaker 3: is now negative. Well, in the world of comparisons, if
Speaker 3: you do a true false... Anything negative is false. Anything
Speaker 3: positive is true. So the number five is true. The
Speaker 3: number negative 3000 is false, right? So it's that weird
Speaker 3: place where you're using this variable in a way that
Speaker 3: it wasn't supposed to be used, right? In this particular case,
Speaker 3: somebody figured out how I, how you could go from
Speaker 3: a regular user and Carl was right here. You have
Speaker 3: to be a regular user, but you can go from
Speaker 3: a regular user to an administrative user on these versions
Speaker 3: of Linux.
Speaker 4: Wow.
Speaker 5: Yeah, that's bad.
Speaker 1: It's not good.
Speaker 3: It's very similar. This reminds me very much of a
Speaker 3: type confusion flaw. I haven't seen a lot of really
Speaker 3: good type confusion flaws lately. But a type confusion flaw
Speaker 3: is in languages that are not strongly typed.
Speaker 1: Like JavaScript, for example.
Speaker 3: Yeah, great point, Carl, like JavaScript. And for those of you,
Speaker 3: if you want to go a little bit into that, Carl,
Speaker 3: like for our non-developers on the call.
Speaker 1: Yeah, so JavaScript makes it easy for you just to
Speaker 1: pull variables out of thin air and say, you know,
Speaker 1: X equals one, Y equals hello in quotes. And it
Speaker 1: knows enough to, you know, treat the first one as
Speaker 1: a number and the second one as a string.
Speaker 3: Right.
Speaker 1: Then, you know, if you say Z equals 1.1, that's
Speaker 1: different than X equals one.
Speaker 5: Right.
Speaker 4: Right.
Speaker 1: So behind there, one is an integer. We don't know
Speaker 1: if it's signed or if it's unsigned. And then the
Speaker 1: other one, it's sort of a decimal or a numeric.
Speaker 5: Right.
Speaker 1: Yeah.
Speaker 4: Yeah.
Speaker 3: And, and then if you do some weird stuff like, uh,
Speaker 3: you know, X equals one and Y equals hello, and
Speaker 3: you do.
Speaker 5: X plus Y, what happens?
Speaker 4: Right.
Speaker 5: Right.
Speaker 3: So the computer goes, Oh, hello, must be, maybe it's
Speaker 3: the ASCII numbers and maybe I should do whatever. So there's,
Speaker 3: there's a place you get to where the developer, the
Speaker 3: developer may not know what the heck happens when that
Speaker 3: addition happens. So type confusion is an interesting style of attack. Well,
Speaker 3: I haven't, like I said, I haven't seen one in
Speaker 3: a while, but this, this feels very type confusion.
Speaker 1: Yeah.
Speaker 2: So I'm going to call a strike in on my
Speaker 2: own position here, possibly, but I read something or, or
Speaker 2: there was a story a years ago, I think it
Speaker 2: was before we started the podcast where they were talking
Speaker 2: to Linus Torvald, who's the guy who started Linux.
Speaker 4: Right.
Speaker 2: And they pointed out that there were some problems with
Speaker 2: the Linux kernel that were architectural and troubling. And he's like, no,
Speaker 2: we're never going to revisit that. And, and it, you know,
Speaker 2: fantastic developer, better developer than me. But when one guy
Speaker 2: writes or one guy supervises the writing of an entire
Speaker 2: operating system in his spare time, you got to wonder
Speaker 2: where the, where the, the, the technical debt sits. And
Speaker 2: I think a lot of it might be in the
Speaker 2: kernel of Linux based on these kinds of things. This
Speaker 2: seems like a, It seems like a mistake that shouldn't
Speaker 2: have been made in an operating system that's going to
Speaker 2: be used for the enterprise.
Speaker 5: Yeah, you would think so.
Speaker 1: If Linus Torvalds had AI, do you think that anybody
Speaker 1: could have come up with that? Could we have a
Speaker 1: Carl X or Pat X or Dwayne X?
Speaker 5: Heck yeah. I'm going to create my own.
Speaker 2: I do actually believe that's true, given that you start
Speaker 2: with Unix.
Speaker 1: Could we still do it?
Speaker 4: Yeah.
Speaker 1: I mean, could I make not a version of Linux,
Speaker 1: but a whole new Unix-based operating system?
Speaker 3: Yeah, you could make your own operating system absolutely right now.
Speaker 2: You can also make your own Bitcoin. It's called Doge.
Speaker 1: Okay, we moved on?
Speaker 5: We've moved on.
Speaker 3: All right.
Speaker 1: SonicWall patches two new actively exploited zero days in SMA
Speaker 1: 1000 VPNs.
Speaker 3: Oh, no.
Speaker 5: Zero days.
Speaker 1: But it patched them, so that's good.
Speaker 3: They did.
Speaker 4: Yeah.
Speaker 5: I know.
Speaker 4: Merry Christmas.
Speaker 2: Yeah.
Speaker 3: So, SonicWall, these are... I love that band.
Speaker 5: I know, right?
Speaker 4: The kids?
Speaker 1: Yeah, they were great.
Speaker 5: It's sonic wall okay.
Speaker 3: Wonder wall anyways sonic wall patches two new um vulnerabilities
Speaker 3: this is so sonic wall devices are generally targeted to
Speaker 3: small to medium businesses um you don't generally you're not
Speaker 3: going to see like apple running a whole bunch of
Speaker 3: sonic walls you know at one of the 10 yeah
Speaker 3: okay so this is a great point so this one
Speaker 3: was marked as a 10 and here at security this
Speaker 3: week we always like to figure out is this really
Speaker 3: a 10 or is this kind of a bs 10
Speaker 3: and it's it should be considered a seven.
Speaker 1: Well, we want the contagion score, which is how likely
Speaker 1: are you to get it?
Speaker 3: No, if you're running this version, you're already in trouble.
Speaker 2: Okay.
Speaker 3: Um, yeah, this is, this takes very little technical knowledge
Speaker 3: to run. There's already a POC out on the internet
Speaker 3: and it's not hard to find your patch. Yeah, it's patch.
Speaker 3: You can absolutely go patch it. But if let's say
Speaker 3: you're not like this is targeting small to medium business, right?
Speaker 3: Most small to medium businesses, you're running a, a barbershop,
Speaker 3: you're not running around, you know, keeping up on security
Speaker 3: news and patching your Sonic wall.
Speaker 5: Right.
Speaker 3: So there's tons of these devices out there. Uh, although
Speaker 3: I guess what would you do as a barbershop VPNing
Speaker 3: and back to the shop anyways? Um, so there's tons
Speaker 3: of these devices out there that are unpatched right now.
Speaker 3: The POC is out there. It is super easy to run. Um,
Speaker 3: it is a form of SSRF, which is a server
Speaker 3: side request forgery attack.
Speaker 2: Yeah.
Speaker 3: Um, So for those of you who haven't been familiar
Speaker 3: with SSRF attacks, an SSRF attack is where I can
Speaker 3: make a call out to a service, whether it's a
Speaker 3: web server or in this case a VPN service. Most
Speaker 3: of the SonicWall VPN services are a web server.
Speaker 4: Whatever.
Speaker 3: It doesn't matter really because you go to a website,
Speaker 3: you log in and it gives you access. But you
Speaker 3: go out to a website and you make a request
Speaker 3: and what happens is that server then makes a request
Speaker 3: to itself on your behalf. So it looks like it's
Speaker 3: coming from inside. And that's generally what an SSRF attack is,
Speaker 3: is me conning the device into doing my bidding for
Speaker 3: me on a backend channel so that it trusts it.
Speaker 5: Yeah.
Speaker 3: So this one does not look good. And this is
Speaker 3: pre-authenticated by the way. That's the other reason that this
Speaker 3: is kind of a scary attack right now is you
Speaker 3: don't need a username or password. Just find the sonic
Speaker 3: wall on the internet. run the proof of concept, you
Speaker 3: grab off a GitHub and boom, you have access.
Speaker 1: Hey guys, this seems like a good time and place
Speaker 1: to take a break. So we'll be right back after
Speaker 1: these very important messages. Don't you go away. So guys,
Speaker 1: I went to the Humane Society the other day and
Speaker 1: I got myself a Mirage Kitten. And the Mirage Kitten
Speaker 1: is a really interesting kitten because you can see it
Speaker 1: across the room, but as you get close, it just disappears.
Speaker 2: Wow.
Speaker 1: You can still hear it going.
Speaker 4: All right.
Speaker 1: The story is Iran-linked APT Mirage Kitten uses fake job
Speaker 1: tests to spread malware. Malware.
Speaker 2: These countries, North Korea and Iran are making the world,
Speaker 2: they're ruining everything.
Speaker 4: I know.
Speaker 1: They've given us Mirage Kittens.
Speaker 2: The Q-bomber all over again.
Speaker 1: So this is a LinkedIn coding test, right?
Speaker 5: Yeah, absolutely.
Speaker 3: You apply for a job and you apply for a
Speaker 3: job and they give you a co-test and they say, hey,
Speaker 3: we need you to use, it's actually funny, this exact path, actually,
Speaker 3: maybe they've been listening to Security This Week. This exact
Speaker 3: path is a path that we presented probably six months ago.
Speaker 5: Who's we?
Speaker 3: We, as in we the security cabal, presented to one
Speaker 3: of our customers as a viable path to break into
Speaker 3: their organization we say listen we'll just hire one of
Speaker 3: your developers who we see does side work and we'll
Speaker 3: force them to use libraries not force them just say
Speaker 3: hey we'd like you to use this library in this
Speaker 3: library in this library and they'll be infected we're horrified
Speaker 3: yeah and they were like wait what like that's so
Speaker 3: we'll absolutely could do that and and apparently um iran's
Speaker 3: like you know we like that that's a that's a
Speaker 3: great path let's do that so that's what they're doing
Speaker 3: post fake jobs force you to use libraries that you
Speaker 3: don't possibly have time enough to read through, and when
Speaker 3: you make a call to it, it infects your local computer,
Speaker 3: pulling information, info-stealing, blah, blah, blah.
Speaker 1: What's the why for Iran-linked Mirage Kitten or whatever? What
Speaker 1: is their goal? Do they just want to infect people randomly?
Speaker 1: You said something like information-stealing, but what is it going
Speaker 1: to get them if they get some out-of-school... coder wannabe
Speaker 1: access to their computer.
Speaker 2: Well, with Korea, it does it for the money. They
Speaker 2: do it so that they can steal the money to
Speaker 2: build missiles.
Speaker 1: Like ransomware?
Speaker 3: Yeah, like ransomware, but in this case also, think about
Speaker 3: the fact that you control the job posting. So if
Speaker 3: I say, oh, I need a candidate that's TSSCI, right?
Speaker 3: So top secret, secure compartmentalized information knowledge. They're certified to
Speaker 3: deal with u.s secret government you know stuff.
Speaker 2: Car job might be u.s secret government right.
Speaker 3: So when they say oh you know we're a division
Speaker 3: of the you know uh doj and we need blah
Speaker 3: blah whatever and this is a you know we need
Speaker 3: you to go through this test to see whether you're
Speaker 3: you know smart enough to develop whatever now when i
Speaker 3: get on your computer there's probably i mean yeah i
Speaker 3: mean if you're following all the regs with tssci and
Speaker 3: zipper and nipper and all that good stuff you shouldn't
Speaker 3: have anything secure on your network on your your computer
Speaker 3: but chances are they might garner access or information that'll
Speaker 3: help them. So I would guess that's a RANDS target,
Speaker 3: the Mirage Kitten, is let's see what type of sensitive
Speaker 3: things we can pull from people and then just gain
Speaker 3: and continue access, maintain access to those devices.
Speaker 1: Okay. Is there anything that we can do to protect
Speaker 1: ourselves except for don't answer stupid emails and click on
Speaker 1: links or anything?
Speaker 5: This is a tough one.
Speaker 3: This is one of the reasons we proposed this to
Speaker 3: attack our customer because it's like I could spin up
Speaker 3: a real company with a real name, with a real
Speaker 3: 800 number, with real people on LinkedIn, and it could
Speaker 3: literally look like a normal job posting.
Speaker 2: Okay, let's talk about this then. If you were somebody
Speaker 2: who really wanted to apply for this job, you checked
Speaker 2: out the company and they came back legit because they
Speaker 2: did all the things and they're a nation state. The
Speaker 2: way I would approach it if you decide you're going
Speaker 2: to have to do this is you set up a
Speaker 2: segregated VM. You download the things there. You run it
Speaker 2: with separate accounts on that VM. You get AI to
Speaker 2: look at all the libraries ahead of time to see
Speaker 2: if there's anything untoward in them because it can look
Speaker 2: through all the code even if you can't. And you
Speaker 2: do that test on a throwaway VM. That's the problem
Speaker 2: is it's a lot of work. it's not easy.
Speaker 4: Right.
Speaker 3: Well, you know, that's an interesting point though, Patrick, like
Speaker 3: in nowadays with AI, it could be, I spin up
Speaker 3: a VM, I have a trash VM, whatever, but I
Speaker 3: also could have cursor read through the library and be like, Hey,
Speaker 3: give me an, give me an initial understanding of what
Speaker 3: this thing does. If it, if they're giving us the
Speaker 3: code now, if they're giving us just a DLL that
Speaker 3: we call entry points on, I don't know, me personally,
Speaker 3: I'd reverse engineer the DLL and strip it apart. But
Speaker 3: normal humans might be, okay, I'm going to do this
Speaker 3: on a throwaway VM. You don't have the mythos.
Speaker 2: But still, even if you did it just in a
Speaker 2: segregated environment, I mean, hell, rent a VM on a
Speaker 2: hosting provider for a month and use it there and
Speaker 2: then throw it away. The problem is cost and time.
Speaker 2: And right now the job market is so obscene. There
Speaker 2: are companies that are listing jobs that don't exist because
Speaker 2: they're trying to hype up their company as a growing company.
Speaker 2: There's AI that's a friend of ours, Ted Newart, had
Speaker 2: a post where somebody he knew, I think it was
Speaker 2: somebody he reposted, was a hiring manager and they couldn't
Speaker 2: understand why HR just said no qualified applicants and he
Speaker 2: needed somebody for his team. So he took his resume,
Speaker 2: changed the names and the dates, submitted it, and within
Speaker 2: six minutes, the company's AI rejected him as a candidate
Speaker 2: for a job he was fully qualified for. Wow. Because
Speaker 2: it was looking for React.js with a certain capitalization and punctuation.
Speaker 2: It just said React. It said, oh, you don't have
Speaker 2: the right technologies and threw you away.
Speaker 4: Wow.
Speaker 2: So we're just in such an idiocracy in terms of
Speaker 2: the job space. I can see people being desperate to
Speaker 2: find something if they've left the job and doing this
Speaker 2: right away. But it's a trap.
Speaker 1: Be careful. All right, we moved on. Hackers push malicious
Speaker 1: virtualizer update in BGP hijacking attack. What's BGP?
Speaker 3: BGP, big, great. You know, I can't even come up
Speaker 3: with a real funny thing. Yeah, exactly.
Speaker 2: Football has been around forever.
Speaker 3: Yeah, exactly. So a border gateway protocol is how the
Speaker 3: whole internet works, right?
Speaker 1: You're making this up.
Speaker 3: Um, so let's assume, no, seriously, if like, yeah, it's
Speaker 3: that magic thing that nobody understands, but that's how all
Speaker 3: my bits get to your bits. Um, so imagine, um,
Speaker 3: you want to go to an IP address. So, okay,
Speaker 3: let's say, let's imagine you want to go to Google's
Speaker 3: DNS to talk to it. Um, Google's DNS is is 8.8.8.8.
Speaker 3: The reason I use that one is super simple. So
Speaker 3: my computer is going to try and reach out to 8.8.8
Speaker 3: on my local network. Obviously, it's not here. So it's
Speaker 3: going to go to the router and or gateway and say, hey,
Speaker 3: I need 8.8.8.8. My router and gateway is then going
Speaker 3: to upstream it to my ISP and say, hey, do
Speaker 3: you know where 8.8.8.8 is? And my ISP for me
Speaker 3: here is Fidium. It then is going to use BGP
Speaker 3: to say who is announcing that they own that range.
Speaker 4: Oh, okay.
Speaker 3: And that's going to come back to, oh, it's Google
Speaker 3: owns that range or it's, you know, whatever. It's usually
Speaker 3: a major provider.
Speaker 5: It's not like. you know, Pulsar security owns that range.
Speaker 1: So it's sort of like DNS for IP addresses.
Speaker 3: Exactly. That's a great analogy.
Speaker 1: It's like a phone book.
Speaker 4: Yep.
Speaker 3: Yeah, exactly. And it's interesting because DNS ultimately comes down
Speaker 3: to IP and then IP then comes down to BGP.
Speaker 3: So BGP, when I say it's how the internet works,
Speaker 3: it's literally how the internet works, not how a network works,
Speaker 3: but how the internet works.
Speaker 1: Yeah, that makes sense.
Speaker 3: So they don't go into, so if I can hijack,
Speaker 3: a particular broadcast, I can say, oh, I am 8.0.0.0 slash,
Speaker 3: you know, whatever. Then I own that IP and anybody
Speaker 3: who goes there is going to come to me.
Speaker 1: So this is dangerous because it's so fundamental. It's so
Speaker 1: low level.
Speaker 3: Yes.
Speaker 2: It's like controlling the phone company switching.
Speaker 3: Yeah, exactly.
Speaker 1: Well, let me put it another way. I mean, most
Speaker 1: brainwashing happens when somebody is told and eventually believes that
Speaker 1: some fundamental fact that all of your other facts are
Speaker 1: stacked upon, something at the lowest level was true and
Speaker 1: now it's false. The sky is green and the grass
Speaker 1: is blue, right?
Speaker 2: And Picard said, there are two lights.
Speaker 3: Yeah, three lights.
Speaker 2: Or three lights.
Speaker 1: There are three lights. Yeah, exactly. Some fundamental... belief is
Speaker 1: twisted and then your whole house of cards comes crumbling
Speaker 1: down and that's exactly what i see here because it's
Speaker 1: so low level that it affects everything.
Speaker 3: Upstream yeah exactly um so in this particular case uh
Speaker 3: so i don't get that thing wrong an urgent notice
Speaker 3: from the vendor of all utc around august 30th an
Speaker 3: attacker routed a block of hetzner hosted IP addresses in
Speaker 3: a BGP hijacking attack. What they in essence were doing
Speaker 3: was they were saying, we are this range. And then
Speaker 3: a certain number of people believed it and started coming
Speaker 3: to them for updates. They were attacking, um, this virtualizer software, um,
Speaker 3: which is a control panel for virtual private servers for, uh,
Speaker 3: VPCs on the internet. Um, by a company called soft delicious, soft, soft, cool.
Speaker 5: Yeah. Cause I don't know. So it looks like soft delicious,
Speaker 5: which sounds weird. It does.
Speaker 1: Soft, soft, a coolest, soft.
Speaker 5: Soft, a coolest.
Speaker 4: Yeah.
Speaker 5: Anyways.
Speaker 3: Um, so what would happen is now legitimate requests for
Speaker 3: updates for this panel would actually go to the attackers
Speaker 3: instead of actually going into the legitimate backend source. And
Speaker 3: it would be hard for you as a, just a
Speaker 3: normal human updating your software to see the problem. because
Speaker 3: you don't have control over it. You're just routing where
Speaker 3: the internet's telling you to route. What I will tell
Speaker 3: you though, is if a software update does like, okay,
Speaker 3: how do I protect myself? A software update designed properly
Speaker 3: from the software vendor would actually have probably signed the
Speaker 3: update with their own key. And when it makes it
Speaker 3: down to the software, it then checks the signature before
Speaker 3: it applies it. So my guess is, as we dig
Speaker 3: deeper here into this article, there wasn't, they didn't actually
Speaker 3: properly sign this, those updates.
Speaker 1: Human error.
Speaker 3: Yeah, so it's interesting. I mean, secure, we talk about
Speaker 3: all the, hey, you should do this and you should
Speaker 3: do that and blah, blah, blah. But somebody hacks your BGP.
Speaker 3: I mean, there isn't much you can.
Speaker 5: Do other than.
Speaker 3: Yeah, even lower. Hope the vendor does something right.
Speaker 1: Okay, extortion group, fulcrum sec. claims 86 gigabyte manchester airports
Speaker 1: group data theft too.
Speaker 3: Close to home is it no not that manchester actually
Speaker 3: i got this one from cliff um yeah i think
Speaker 3: one of one of probably two guests we've ever had
Speaker 3: on this show but um yes that's right yeah uh
Speaker 3: so cliff posted this in the discord actually uh this
Speaker 3: is probably a good point for me to bring up
Speaker 3: uh the discord now also has although we have we've
Speaker 3: been getting a ton of new users which is awesome
Speaker 3: I've also added a cyber AI channel because we've been
Speaker 3: talking a lot more about cyber and AI. I figure
Speaker 3: there's probably a good place for us to put some
Speaker 3: stuff down there.
Speaker 5: Okay.
Speaker 3: Yeah, so Cliff hit me up at 2 this morning
Speaker 3: and was like, hey, have you seen this? And I
Speaker 3: started reading through it. It is an interesting attack. These guys,
Speaker 3: the Fulcrum Sec group, they've been hitting some pretty big
Speaker 3: targets and they're, they've made a name for themselves as
Speaker 3: the no BS attackers. Like if they call you up
Speaker 3: and say, Hey, we have a hundred.
Speaker 5: Gig of your data. They have a hundred gig of
Speaker 5: your data.
Speaker 1: Believe them.
Speaker 4: Yeah.
Speaker 5: Believe them.
Speaker 3: So bleeping computer actually reached out to them when Manchester
Speaker 3: airport group disclosed this breach and was like, all right,
Speaker 3: show us some of it. And sure enough, they showed
Speaker 3: them some of the information they have. And what's interesting
Speaker 3: here is the spin. The Manchester airport group mag is like, Oh, listen,
Speaker 3: no credit card data was bleep bleep.
Speaker 5: So you're good.
Speaker 3: Like everything's great.
Speaker 5: Right.
Speaker 3: But if you take a look at the data that
Speaker 3: was actually.
Speaker 1: Leaked or wifi registrations, fast track bookings, license plates for
Speaker 1: your car, vehicle registrations, your zip code and in the
Speaker 1: UK that brings, there's like, it brings you down to
Speaker 1: like 12 different homes, your booking reservations. So they know
Speaker 1: when you're going to be out of the house and
Speaker 1: they know when you're going to be out of the country.
Speaker 1: So it's much more devastating than credit cards, like whatever
Speaker 1: credit cards you can just rotate.
Speaker 2: Right.
Speaker 5: Right.
Speaker 3: I can just call up and get a new one. But, uh,
Speaker 3: this stuff, you just can't go get a new license
Speaker 3: plate easily.
Speaker 5: Yeah. Right.
Speaker 3: Uh, or rotate your phone number easily. So, um, This
Speaker 3: is kind of a big deal. So, okay, you go, okay, well,
Speaker 3: the breach happened. They were notified. They don't look like
Speaker 3: they're going to pay the crew. So, my guess is
Speaker 3: 86 gig worth of data is going to get leaked.
Speaker 3: How did it happen?
Speaker 5: What type of?
Speaker 3: Amazing zero-day attack got them there?
Speaker 1: You know, by the way you're talking, I think it's
Speaker 1: going to be relatively simple. Like somebody got called up
Speaker 1: and asked for it or something.
Speaker 3: Hey, Carl, if you had a super... I'm just asking
Speaker 3: you as a professional developer. If you had a super secret...
Speaker 3: api key yeah where's the one place you probably wouldn't
Speaker 3: put said super secret api key in code in.
Speaker 2: Code the home page.
Speaker 1: Yeah i wouldn't hard code it into a github repo
Speaker 1: or something.
Speaker 3: Would you would you put it in javascript no because
Speaker 3: that's secure it's not secure of course not That's what
Speaker 3: they did. They took this super secret backend API credential
Speaker 3: and they put it in JavaScript and they said, I'm
Speaker 3: sure the client browser won't tell the user what it is.
Speaker 1: Oh my God.
Speaker 3: And that was it. That was the whole hack. They
Speaker 3: looked at it and went, wow, there's a key coming
Speaker 3: to my page, to my browser. I'm just going to
Speaker 3: call the API.
Speaker 2: Isn't that just looking?
Speaker 3: Yeah, exactly. Uh, so I'm not saying this crew is
Speaker 3: not talented. I'm sure they're talented in breaking into places
Speaker 3: and there's tons of breaches that have been attributed to them.
Speaker 3: But in this particular case, the, the Manchester airport group
Speaker 3: actually put a API key that had admin level credential access,
Speaker 3: you know, level access to everything, um, in JavaScript.
Speaker 5: Right.
Speaker 3: Um, Because they were like, well, this key has to
Speaker 3: be able to look up whether there's a spot available
Speaker 3: in the garage and what your license tag would be
Speaker 3: and what your reservations are so we can know whether,
Speaker 3: you know what I mean? So it's, they're like, well,
Speaker 3: let's just give this key access to everything. And they
Speaker 3: did that and then gave it to every user who
Speaker 3: ever browsed the website.
Speaker 2: I have to imagine that this decision was influenced by tequila.
Speaker 1: No i think we're in the wrong business i think
Speaker 1: i think i'm going to be the next next jeff
Speaker 1: foxworthy you know you might be a redneck if but
Speaker 1: my routine's going to be you might be an idiot
Speaker 1: coder if you're anybody can break into your system by
Speaker 1: view source right right.
Speaker 4: Exactly i think we once bought a a website that
Speaker 4: that should have known better that had pictures of people
Speaker 4: and the The label on the picture was the social
Speaker 4: security number.
Speaker 1: Oh, God.
Speaker 4: Yep.
Speaker 5: We're like, come on.
Speaker 1: What could happen?
Speaker 4: Oh, yes.
Speaker 2: Yeah.
Speaker 5: All right.
Speaker 1: And that brings us to our top story. OpenAI Astra
Speaker 1: brings autonomous zero-day exploitation to AI. So, if this is
Speaker 1: what I think it means, that means this Astra is using...
Speaker 1: It is an AI model that can just completely devastate
Speaker 1: the world.
Speaker 2: It's open AI saying, we have a mythos too. That's
Speaker 2: my take on it. We pass the cyber bench. And
Speaker 2: by the way, most people are starting to come around
Speaker 2: to the fact that these benchmarks are tests that the
Speaker 2: AI study too. So the question then becomes... Is OpenAI
Speaker 2: trying to just get regulated so that it's an advertising stunt?
Speaker 2: So they'll have their fable mythos moment, their glass wing moment?
Speaker 2: I don't know. It's inevitable that we're going to see
Speaker 2: models who get better and better at cyber.
Speaker 1: Yeah.
Speaker 2: But just the fact that it's passed a bench test,
Speaker 2: there's a motivation now for them to say they have
Speaker 2: their me too moment as far as mythos goes. What
Speaker 2: do you think? Yeah.
Speaker 1: So let me just explain what it is. So this
Speaker 1: Astra can, according to OpenAI, autonomously find zero days and
Speaker 1: build exploits. So that's the key. How is that?
Speaker 5: Right.
Speaker 2: We've been talking about it for six months.
Speaker 4: Right.
Speaker 3: You know, it's funny. Before the show started, I was like, oh,
Speaker 3: that's cute. I mean, we've had it for nine months now,
Speaker 3: but that's adorable. Like, I'm glad OpenAI caught up. I mean, and,
Speaker 3: you know, it's funny. I was like, we just, we
Speaker 3: don't submit our AIs and harnesses to you know, get
Speaker 3: awards and blue ribbons. In this case, this is the
Speaker 3: first to reach this cyber classification of critical designation, which, whatever. Like, listen,
Speaker 3: and we've talked about this, the harness matters just about
Speaker 3: as much as the model itself. And there are plenty
Speaker 3: of harnesses out there at this point that can go
Speaker 3: full attack. You point it at a target. It pulls
Speaker 3: down software. It creates zero days. It tests them in
Speaker 3: the virtualized environment. They create and then it'll go out
Speaker 3: and attack it. We've seen this. We've seen these entire frameworks.
Speaker 4: Sure.
Speaker 3: So the fact that OpenAI is announcing Astra is amazing.
Speaker 3: I agree with Patrick. This is all just marketing ploy.
Speaker 2: The model 5% of what it takes to use these
Speaker 2: AI systems. The harness is 95%.
Speaker 1: Yeah, I agree.
Speaker 5: Yeah, the harness matters.
Speaker 2: You can take a weak model and do incredible damage
Speaker 2: with the right harness.
Speaker 1: Yep.
Speaker 2: And you can take the best model and not be
Speaker 2: able to find anything.
Speaker 5: Yeah, right.
Speaker 2: If you don't have the right harness.
Speaker 1: And for those who've never heard that term, harness, the
Speaker 1: harness is like your cloud code app or your GitHub
Speaker 1: co-pilot CLI.
Speaker 2: It's the judgment.
Speaker 3: It's the pipeline. It's the everything.
Speaker 1: Yeah, so the LLM has no state.
Speaker 2: Right.
Speaker 1: So the harness is the thing that keeps track of
Speaker 1: the state and the memory and all of that and
Speaker 1: makes it a worthwhile experience.
Speaker 2: Everything that's moved us past prompt engineering.
Speaker 1: Right.
Speaker 4: Yeah.
Speaker 3: Yep.
Speaker 2: Okay.
Speaker 1: I think that's a show, guys. What do you think?
Speaker 3: I agree. I think that was, that's a lot of fun.
Speaker 3: And thanks, Cliff, for sending in this story.
Speaker 5: Always.
Speaker 3: By all means, keep sending in stories.
Speaker 5: We appreciate it.
Speaker 4: Yep.
Speaker 5: Thanks.
Speaker 1: And check out our Discord. And, well, gee whiz, that's
Speaker 1: what we talked about from last week, and we'll see
Speaker 1: you next week on Security This Week.
Speaker 4: Bye-bye.
Speaker 3: Bye. Bye, guys.