WEBVTT 1 00:00:00.340 --> 00:00:30.980 And don't forget Discord. Discord.SecurityThisWeek.com. Lots of good stuff happening there. Yeah, 2 00:00:31.000 --> 00:00:33.799 I think that's it. So on with the podcast. Do 3 00:00:33.840 --> 00:00:37.880 you suffer from shyness? Do you sometimes wish you were 4 00:00:37.920 --> 00:00:42.369 more assertive? Ask your doctor about tequila. 5 00:00:47.530 --> 00:00:47.869 Or donut. 6 00:00:49.659 --> 00:00:51.859 Side effects may cause beer goggles. 7 00:00:52.179 --> 00:00:54.350 When my wife and I started dating, she said, I'm 8 00:00:54.409 --> 00:01:07.519 not allowed to drink tequila. All right. We've got a 9 00:01:07.560 --> 00:01:10.540 few stories for you today. This is Security This Week, 10 00:01:10.579 --> 00:01:10.920 by the way. 11 00:01:10.959 --> 00:01:11.420 I'm Carl. 12 00:01:11.439 --> 00:01:15.329 That's Dwayne and Patrick. This week, This is kind of 13 00:01:15.750 --> 00:01:19.030 good news, I think, but it confirms at least what 14 00:01:19.049 --> 00:01:23.329 we've been talking about all the time. Sys of Vulnerability Review. Old, 15 00:01:23.750 --> 00:01:26.569 simple flaws drive most breaches. 16 00:01:27.079 --> 00:01:27.890 Oldies but goodies. 17 00:01:28.280 --> 00:01:29.159 Oldies but goodies. 18 00:01:29.439 --> 00:01:30.000 Yeah. 19 00:01:30.099 --> 00:01:30.579 That's right. 20 00:01:30.739 --> 00:01:34.159 Wayne's still using printer defects from years ago. 21 00:01:34.180 --> 00:01:35.099 Well, I mean.... 22 00:01:37.609 --> 00:01:40.799 Sequel injections been on the top of the list for 23 00:01:40.859 --> 00:01:41.439 how long? 24 00:01:41.579 --> 00:01:41.739 Yeah. 25 00:01:41.780 --> 00:01:41.980 Right. 26 00:01:42.000 --> 00:01:43.180 Since they started the list. 27 00:01:43.219 --> 00:01:43.439 Yeah. 28 00:01:43.459 --> 00:01:44.420 Since the list began. 29 00:01:44.680 --> 00:01:44.859 Yeah. 30 00:01:45.439 --> 00:01:48.599 It's like that FBI's, you know, top 10 people to get. 31 00:01:48.719 --> 00:01:50.760 It's still, it's the same, it's the same people. 32 00:01:50.939 --> 00:01:52.719 The thing here is that we talk about AI as 33 00:01:52.780 --> 00:01:55.290 being evil and models being evil, which is the. 34 00:01:55.750 --> 00:01:56.890 Title of this show. 35 00:01:56.950 --> 00:02:01.670 But, but, you know, in fact, most problems are caused 36 00:02:01.750 --> 00:02:03.969 by old, old issues. 37 00:02:04.010 --> 00:02:04.750 Yeah. Yeah. 38 00:02:04.930 --> 00:02:07.629 We'll have the longest time for people to, figure out 39 00:02:07.670 --> 00:02:10.689 how to exploit them for the exploits to mature and 40 00:02:10.729 --> 00:02:12.840 get more of that, uh, less variable. 41 00:02:13.469 --> 00:02:13.740 Yeah. 42 00:02:13.780 --> 00:02:15.080 But I'm going to, I'm going to take the negative 43 00:02:15.099 --> 00:02:17.060 side of that, Patrick. We've also had a lot more 44 00:02:17.099 --> 00:02:19.960 time to understand how they work so that people, developers 45 00:02:20.039 --> 00:02:21.860 should be actually fixing them. 46 00:02:22.020 --> 00:02:24.180 Oh no, I I'm on, I'm all on board. I'm 47 00:02:24.199 --> 00:02:26.699 just saying you give the hackers, you give the hacker 48 00:02:26.740 --> 00:02:29.400 community a decade and script kitties will even be proficient. 49 00:02:30.969 --> 00:02:31.250 Yeah. 50 00:02:31.259 --> 00:02:33.189 So it, you know, it goes through and it's an 51 00:02:33.270 --> 00:02:36.199 interesting breakdown. There's, um, if you guys, click if at 52 00:02:36.219 --> 00:02:37.719 some point if you click on the links to the 53 00:02:37.780 --> 00:02:40.680 show you'll see they break down some of the different 54 00:02:40.699 --> 00:02:43.520 types of attacks and and it's not saying the most 55 00:02:43.759 --> 00:02:45.870 dangerous ones are the ones that have been around forever 56 00:02:45.879 --> 00:02:49.009 it's just the most frequent ones um there are you 57 00:02:49.030 --> 00:02:52.330 know input validation errors right how many times have we 58 00:02:52.349 --> 00:02:55.509 told you on the show never trust the user right 59 00:02:55.569 --> 00:02:57.949 whether they're talking to you or whether they call you 60 00:02:58.009 --> 00:03:00.449 and say they want to switch their bank account or 61 00:03:00.509 --> 00:03:03.069 whether it's their typing data in the browser, right? 62 00:03:03.250 --> 00:03:06.909 Or whether you can imagine how they could exploit it. 63 00:03:07.069 --> 00:03:08.240 Yeah, absolutely. 64 00:03:08.259 --> 00:03:11.240 Because you can't imagine it doesn't mean it's not possible. 65 00:03:11.400 --> 00:03:14.400 Yeah, and actually, not to foreshadow a little bit, but 66 00:03:15.319 --> 00:03:18.060 one of our stories here, we will talk about trusting 67 00:03:18.099 --> 00:03:19.990 the user and their browser a little bit too much, 68 00:03:20.090 --> 00:03:23.150 which caused untold damages. 69 00:03:23.270 --> 00:03:24.169 Hilarity. 70 00:03:24.569 --> 00:03:27.110 Yeah, injection issues, here again. 71 00:03:27.620 --> 00:03:27.879 Right? 72 00:03:28.000 --> 00:03:31.740 We just talked about SQL injection. So for those of 73 00:03:31.780 --> 00:03:35.520 you who may or may not, I don't know, perform 74 00:03:35.560 --> 00:03:36.469 injection all the time. 75 00:03:38.889 --> 00:03:39.349 Enough said. 76 00:03:39.409 --> 00:03:45.469 Walk that fine line. An injection issue is where you're 77 00:03:45.509 --> 00:03:50.169 expecting the user to give you input of some sort, right? 78 00:03:50.229 --> 00:03:53.229 Whether it's oh, what language do I want the browser in? 79 00:03:53.449 --> 00:03:55.469 What day do I want my, you know, my tea 80 00:03:55.509 --> 00:03:56.449 time at this golf. 81 00:03:56.270 --> 00:03:57.189 Course, whatever it may be. 82 00:03:57.210 --> 00:03:58.270 Like your steak cooked. 83 00:03:58.610 --> 00:03:59.389 Yeah, exactly. 84 00:03:59.669 --> 00:04:01.550 You know, whatever you're expecting the user to give you 85 00:04:02.310 --> 00:04:05.069 or expecting to come from the user's browser, more importantly, 86 00:04:05.849 --> 00:04:08.129 because a lot of people will just assume, hey, I 87 00:04:08.169 --> 00:04:11.550 got five fields on this that the user can fill out. 88 00:04:11.849 --> 00:04:14.270 So that's what I'm expecting. But there's 15 other fields 89 00:04:14.310 --> 00:04:16.329 I take from that, that I'm just holding variables in 90 00:04:16.350 --> 00:04:16.670 the browser. 91 00:04:16.689 --> 00:04:19.500 But the text ones are the dangerous ones is the lead. 92 00:04:20.259 --> 00:04:24.680 Right, exactly. Developers always assume if a user can type 93 00:04:24.740 --> 00:04:26.699 in it, it's dangerous and I should keep an eye 94 00:04:26.800 --> 00:04:29.639 on it. But the problem is every field that gets 95 00:04:29.699 --> 00:04:32.839 submitted back on that form is something the user can edit. 96 00:04:32.879 --> 00:04:33.339 Inject. 97 00:04:33.399 --> 00:04:38.500 Ultimately, right, and inject into. So these are the types 98 00:04:38.560 --> 00:04:43.220 of issues, and they pop up. So input validation, memory 99 00:04:43.279 --> 00:04:46.399 safety issues, we talk about buffer overruns and that sort 100 00:04:46.420 --> 00:04:51.370 of stuff, injections, access control deficiencies. So we've talked about 101 00:04:51.850 --> 00:04:53.870 these are probably the core. 102 00:04:53.529 --> 00:04:55.730 Of most of the stories we've talked about. Yep. 103 00:04:56.029 --> 00:04:58.170 Is, you know, every time it comes back to, oh, 104 00:04:58.230 --> 00:05:01.360 and then, you know, the keys were in the page or, oh, 105 00:05:02.189 --> 00:05:04.240 then the user did, you know, or one equals one 106 00:05:04.259 --> 00:05:05.899 and got access to the whole site, right? 107 00:05:05.939 --> 00:05:08.439 And social engineering tops the list too. I mean, that's 108 00:05:08.560 --> 00:05:11.079 kind of the root of all, the radix malorium. 109 00:05:11.939 --> 00:05:13.040 The root of all evil. 110 00:05:13.579 --> 00:05:14.220 Wow. 111 00:05:14.300 --> 00:05:15.620 Radix malorium. 112 00:05:16.139 --> 00:05:16.740 Malorum. 113 00:05:16.779 --> 00:05:17.699 Did you just make that up? 114 00:05:18.189 --> 00:05:19.089 Radix malorum. 115 00:05:19.129 --> 00:05:20.129 Radix malorum. 116 00:05:21.129 --> 00:05:24.660 So, it's from the Latin, radix malorum est cupiditas. 117 00:05:25.160 --> 00:05:26.860 You know, avarice is the root of all evil. 118 00:05:27.319 --> 00:05:27.720 Damn, Carl. 119 00:05:27.740 --> 00:05:28.620 So, radix malorum. 120 00:05:28.959 --> 00:05:29.120 Yeah. 121 00:05:29.439 --> 00:05:30.939 I don't even know what to say about that, Carl. 122 00:05:30.959 --> 00:05:32.860 I went to school. What can I say? I'm sorry. 123 00:05:34.360 --> 00:05:37.970 I learned a few things. Patrick, our boy is so smart. 124 00:05:41.810 --> 00:05:43.129 Your mom and I are so proud, Carl. 125 00:05:43.189 --> 00:05:43.730 Yeah, okay. 126 00:05:46.209 --> 00:05:48.470 Okay. In fact, I'm... Parabellum. 127 00:05:48.850 --> 00:05:53.870 All right. So the next one is kind of, seems important. 128 00:05:54.529 --> 00:05:59.569 The proof of concept published for Linux kernel priv-esque flaw. 129 00:06:00.350 --> 00:06:02.029 And I was reading it and I was trying to 130 00:06:02.069 --> 00:06:05.029 figure out how the heck could, you know, how hard 131 00:06:05.089 --> 00:06:07.430 is it to, how easy is it for somebody to 132 00:06:07.470 --> 00:06:09.329 be exploited if they have a Linux box that's on 133 00:06:09.350 --> 00:06:13.110 the internet? Turns out they have to have a user account, right? 134 00:06:13.750 --> 00:06:14.189 Yeah. 135 00:06:14.329 --> 00:06:16.189 I mean, this is, this is a straight up privask 136 00:06:16.269 --> 00:06:20.279 and it's interesting. It's an interesting one. Um, uh, you know, uh, 137 00:06:20.360 --> 00:06:21.569 walking through the attack. 138 00:06:22.040 --> 00:06:22.300 Right? 139 00:06:22.759 --> 00:06:25.579 Um, it says the issue resides in the, I don't 140 00:06:25.600 --> 00:06:28.480 worry about the functions, but the IO poll get ownership function. 141 00:06:28.680 --> 00:06:29.180 Okay, great. 142 00:06:29.199 --> 00:06:32.279 So there's some sort of function that pulls ownership. It 143 00:06:32.399 --> 00:06:36.879 uses a signed comparison to check a specific slow path. 144 00:06:36.920 --> 00:06:38.300 Don't worry about slow path thresholds. 145 00:06:38.519 --> 00:06:41.490 Signed meaning both negative and positive. 146 00:06:41.550 --> 00:06:42.019 Yeah. 147 00:06:42.110 --> 00:06:44.389 That's what I want to focus on. Yeah, exactly. Um, 148 00:06:44.930 --> 00:06:48.069 so I, I had this conversation, uh, earlier with one 149 00:06:48.089 --> 00:06:52.720 of my children just yesterday, actually. Um, And we were 150 00:06:52.759 --> 00:06:58.360 talking about the memory structures of variables. And if you 151 00:06:58.399 --> 00:07:04.160 take an int, an integer, right, a number, and you 152 00:07:04.279 --> 00:07:07.079 make it a variable, there's a certain size that you 153 00:07:07.110 --> 00:07:12.209 can store in that structure. And the size of the 154 00:07:12.230 --> 00:07:14.769 variable might be, you know, 32767, right? If it's a 155 00:07:14.810 --> 00:07:20.519 signed integer, right? or it might be 65,000 if it's 156 00:07:20.540 --> 00:07:24.370 an unsigned integer because the last bit is generally used 157 00:07:24.449 --> 00:07:27.569 as to whether the number is negative or positive. So 158 00:07:27.589 --> 00:07:30.829 if you say it's unsigned, right, then you can have 159 00:07:30.870 --> 00:07:34.009 a much larger number, but you can't ever have a negative. 160 00:07:34.209 --> 00:07:38.860 If you say it's a signed variable, then you have, 161 00:07:39.100 --> 00:07:43.600 you know, positive 32767 and negative 32767, let's say, right? 162 00:07:43.620 --> 00:07:48.939 So you have the same kind of amount of, of 163 00:07:49.279 --> 00:07:53.009 variability in there, just whether it's negative or positive. So 164 00:07:53.050 --> 00:07:57.699 this is a classic problem, more with C and C 165 00:07:57.699 --> 00:08:01.310 + + than other programming languages, where you had to 166 00:08:01.389 --> 00:08:05.550 declare whether this was a signed or an unsigned integer. 167 00:08:06.470 --> 00:08:09.350 And then when you went to make a comparison, it 168 00:08:10.670 --> 00:08:13.110 would then say, oh, well, I'm comparing this to a 169 00:08:13.129 --> 00:08:15.399 particular number. So in this particular case, all right, now 170 00:08:15.439 --> 00:08:20.029 that we know what signed is, In comparison, the atomic 171 00:08:20.129 --> 00:08:24.689 read function, nobody cares, operates and returns a signed integer. 172 00:08:25.029 --> 00:08:28.740 So if you call IO pull cancel flag, doesn't matter, 173 00:08:29.250 --> 00:08:34.519 the value becomes negative during the signed path. Okay, so 174 00:08:34.659 --> 00:08:39.059 at some point, it's calling this IO cancel flag and 175 00:08:39.100 --> 00:08:41.639 the last bit is set. So it assumes the number 176 00:08:41.700 --> 00:08:45.980 is now negative. Well, in the world of comparisons, if 177 00:08:46.019 --> 00:08:50.950 you do a true false... Anything negative is false. Anything 178 00:08:51.110 --> 00:08:56.389 positive is true. So the number five is true. The 179 00:08:56.450 --> 00:09:00.929 number negative 3000 is false, right? So it's that weird 180 00:09:01.049 --> 00:09:03.940 place where you're using this variable in a way that 181 00:09:04.080 --> 00:09:07.519 it wasn't supposed to be used, right? In this particular case, 182 00:09:07.539 --> 00:09:09.539 somebody figured out how I, how you could go from 183 00:09:09.559 --> 00:09:12.120 a regular user and Carl was right here. You have 184 00:09:12.139 --> 00:09:13.519 to be a regular user, but you can go from 185 00:09:13.570 --> 00:09:17.490 a regular user to an administrative user on these versions 186 00:09:17.549 --> 00:09:17.809 of Linux. 187 00:09:17.870 --> 00:09:18.110 Wow. 188 00:09:18.409 --> 00:09:19.049 Yeah, that's bad. 189 00:09:19.370 --> 00:09:19.909 It's not good. 190 00:09:20.809 --> 00:09:23.509 It's very similar. This reminds me very much of a 191 00:09:23.909 --> 00:09:27.679 type confusion flaw. I haven't seen a lot of really 192 00:09:27.720 --> 00:09:31.279 good type confusion flaws lately. But a type confusion flaw 193 00:09:31.580 --> 00:09:34.830 is in languages that are not strongly typed. 194 00:09:36.139 --> 00:09:37.549 Like JavaScript, for example. 195 00:09:37.850 --> 00:09:41.309 Yeah, great point, Carl, like JavaScript. And for those of you, 196 00:09:41.649 --> 00:09:43.649 if you want to go a little bit into that, Carl, 197 00:09:43.690 --> 00:09:46.370 like for our non-developers on the call. 198 00:09:46.429 --> 00:09:48.889 Yeah, so JavaScript makes it easy for you just to 199 00:09:48.929 --> 00:09:51.250 pull variables out of thin air and say, you know, 200 00:09:51.429 --> 00:09:54.929 X equals one, Y equals hello in quotes. And it 201 00:09:54.970 --> 00:09:57.470 knows enough to, you know, treat the first one as 202 00:09:57.509 --> 00:09:59.009 a number and the second one as a string. 203 00:09:59.029 --> 00:09:59.970 Right. 204 00:10:01.000 --> 00:10:05.700 Then, you know, if you say Z equals 1.1, that's 205 00:10:05.740 --> 00:10:07.059 different than X equals one. 206 00:10:07.240 --> 00:10:07.519 Right. 207 00:10:07.539 --> 00:10:07.759 Right. 208 00:10:07.879 --> 00:10:11.179 So behind there, one is an integer. We don't know 209 00:10:11.220 --> 00:10:13.789 if it's signed or if it's unsigned. And then the 210 00:10:13.850 --> 00:10:16.590 other one, it's sort of a decimal or a numeric. 211 00:10:16.809 --> 00:10:17.009 Right. 212 00:10:17.389 --> 00:10:17.529 Yeah. 213 00:10:18.289 --> 00:10:18.450 Yeah. 214 00:10:18.570 --> 00:10:21.269 And, and then if you do some weird stuff like, uh, 215 00:10:21.309 --> 00:10:25.429 you know, X equals one and Y equals hello, and 216 00:10:25.450 --> 00:10:25.909 you do. 217 00:10:26.110 --> 00:10:28.409 X plus Y, what happens? 218 00:10:28.850 --> 00:10:29.049 Right. 219 00:10:29.210 --> 00:10:29.429 Right. 220 00:10:30.149 --> 00:10:32.970 So the computer goes, Oh, hello, must be, maybe it's 221 00:10:33.009 --> 00:10:36.129 the ASCII numbers and maybe I should do whatever. So there's, 222 00:10:36.149 --> 00:10:39.049 there's a place you get to where the developer, the 223 00:10:39.090 --> 00:10:41.529 developer may not know what the heck happens when that 224 00:10:41.590 --> 00:10:45.570 addition happens. So type confusion is an interesting style of attack. Well, 225 00:10:45.830 --> 00:10:46.970 I haven't, like I said, I haven't seen one in 226 00:10:47.009 --> 00:10:49.149 a while, but this, this feels very type confusion. 227 00:10:49.379 --> 00:10:49.659 Yeah. 228 00:10:49.720 --> 00:10:51.639 So I'm going to call a strike in on my 229 00:10:51.700 --> 00:10:54.940 own position here, possibly, but I read something or, or 230 00:10:55.320 --> 00:10:57.080 there was a story a years ago, I think it 231 00:10:57.100 --> 00:10:59.600 was before we started the podcast where they were talking 232 00:10:59.620 --> 00:11:02.240 to Linus Torvald, who's the guy who started Linux. 233 00:11:02.570 --> 00:11:02.710 Right. 234 00:11:02.879 --> 00:11:05.690 And they pointed out that there were some problems with 235 00:11:05.750 --> 00:11:12.169 the Linux kernel that were architectural and troubling. And he's like, no, 236 00:11:12.210 --> 00:11:14.870 we're never going to revisit that. And, and it, you know, 237 00:11:15.629 --> 00:11:19.409 fantastic developer, better developer than me. But when one guy 238 00:11:19.470 --> 00:11:22.379 writes or one guy supervises the writing of an entire 239 00:11:22.460 --> 00:11:25.940 operating system in his spare time, you got to wonder 240 00:11:25.980 --> 00:11:29.220 where the, where the, the, the technical debt sits. And 241 00:11:29.240 --> 00:11:30.740 I think a lot of it might be in the 242 00:11:31.340 --> 00:11:33.879 kernel of Linux based on these kinds of things. This 243 00:11:33.919 --> 00:11:37.259 seems like a, It seems like a mistake that shouldn't 244 00:11:37.279 --> 00:11:39.159 have been made in an operating system that's going to 245 00:11:39.179 --> 00:11:40.039 be used for the enterprise. 246 00:11:40.259 --> 00:11:41.000 Yeah, you would think so. 247 00:11:41.019 --> 00:11:45.149 If Linus Torvalds had AI, do you think that anybody 248 00:11:45.190 --> 00:11:46.809 could have come up with that? Could we have a 249 00:11:47.090 --> 00:11:50.080 Carl X or Pat X or Dwayne X? 250 00:11:50.240 --> 00:11:53.120 Heck yeah. I'm going to create my own. 251 00:11:53.139 --> 00:11:55.419 I do actually believe that's true, given that you start 252 00:11:55.440 --> 00:11:56.019 with Unix. 253 00:11:56.279 --> 00:11:57.149 Could we still do it? 254 00:11:57.320 --> 00:11:57.460 Yeah. 255 00:11:57.480 --> 00:12:00.129 I mean, could I make not a version of Linux, 256 00:12:00.190 --> 00:12:02.190 but a whole new Unix-based operating system? 257 00:12:02.230 --> 00:12:05.090 Yeah, you could make your own operating system absolutely right now. 258 00:12:05.169 --> 00:12:07.470 You can also make your own Bitcoin. It's called Doge. 259 00:12:11.919 --> 00:12:12.740 Okay, we moved on? 260 00:12:12.940 --> 00:12:13.409 We've moved on. 261 00:12:13.440 --> 00:12:13.700 All right. 262 00:12:14.470 --> 00:12:20.870 SonicWall patches two new actively exploited zero days in SMA 263 00:12:20.870 --> 00:12:21.769 1000 VPNs. 264 00:12:22.250 --> 00:12:22.850 Oh, no. 265 00:12:23.590 --> 00:12:24.169 Zero days. 266 00:12:24.649 --> 00:12:26.159 But it patched them, so that's good. 267 00:12:26.820 --> 00:12:27.259 They did. 268 00:12:27.700 --> 00:12:27.899 Yeah. 269 00:12:28.659 --> 00:12:28.919 I know. 270 00:12:28.940 --> 00:12:29.799 Merry Christmas. 271 00:12:30.159 --> 00:12:30.399 Yeah. 272 00:12:30.539 --> 00:12:34.179 So, SonicWall, these are... I love that band. 273 00:12:34.379 --> 00:12:34.820 I know, right? 274 00:12:34.840 --> 00:12:35.220 The kids? 275 00:12:35.539 --> 00:12:36.240 Yeah, they were great. 276 00:12:36.809 --> 00:12:38.809 It's sonic wall okay. 277 00:12:38.570 --> 00:12:42.529 Wonder wall anyways sonic wall patches two new um vulnerabilities 278 00:12:42.570 --> 00:12:45.580 this is so sonic wall devices are generally targeted to 279 00:12:45.600 --> 00:12:48.580 small to medium businesses um you don't generally you're not 280 00:12:48.600 --> 00:12:50.440 going to see like apple running a whole bunch of 281 00:12:50.460 --> 00:12:53.659 sonic walls you know at one of the 10 yeah 282 00:12:54.480 --> 00:12:56.580 okay so this is a great point so this one 283 00:12:56.600 --> 00:12:59.120 was marked as a 10 and here at security this 284 00:12:59.139 --> 00:13:01.559 week we always like to figure out is this really 285 00:13:01.580 --> 00:13:03.899 a 10 or is this kind of a bs 10 286 00:13:03.899 --> 00:13:05.759 and it's it should be considered a seven. 287 00:13:05.799 --> 00:13:08.570 Well, we want the contagion score, which is how likely 288 00:13:08.889 --> 00:13:09.809 are you to get it? 289 00:13:10.289 --> 00:13:12.250 No, if you're running this version, you're already in trouble. 290 00:13:12.429 --> 00:13:12.909 Okay. 291 00:13:12.950 --> 00:13:18.129 Um, yeah, this is, this takes very little technical knowledge 292 00:13:18.149 --> 00:13:21.200 to run. There's already a POC out on the internet 293 00:13:21.759 --> 00:13:25.600 and it's not hard to find your patch. Yeah, it's patch. 294 00:13:25.620 --> 00:13:27.740 You can absolutely go patch it. But if let's say 295 00:13:27.759 --> 00:13:30.419 you're not like this is targeting small to medium business, right? 296 00:13:30.759 --> 00:13:34.980 Most small to medium businesses, you're running a, a barbershop, 297 00:13:35.639 --> 00:13:38.480 you're not running around, you know, keeping up on security 298 00:13:38.539 --> 00:13:40.740 news and patching your Sonic wall. 299 00:13:40.899 --> 00:13:41.139 Right. 300 00:13:41.320 --> 00:13:45.419 So there's tons of these devices out there. Uh, although 301 00:13:45.440 --> 00:13:47.779 I guess what would you do as a barbershop VPNing 302 00:13:47.850 --> 00:13:51.570 and back to the shop anyways? Um, so there's tons 303 00:13:51.610 --> 00:13:54.169 of these devices out there that are unpatched right now. 304 00:13:54.529 --> 00:13:57.629 The POC is out there. It is super easy to run. Um, 305 00:13:57.809 --> 00:14:00.700 it is a form of SSRF, which is a server 306 00:14:00.720 --> 00:14:02.159 side request forgery attack. 307 00:14:02.320 --> 00:14:02.519 Yeah. 308 00:14:03.019 --> 00:14:07.240 Um, So for those of you who haven't been familiar 309 00:14:07.259 --> 00:14:10.570 with SSRF attacks, an SSRF attack is where I can 310 00:14:10.590 --> 00:14:12.970 make a call out to a service, whether it's a 311 00:14:12.990 --> 00:14:16.029 web server or in this case a VPN service. Most 312 00:14:16.070 --> 00:14:18.110 of the SonicWall VPN services are a web server. 313 00:14:19.490 --> 00:14:19.789 Whatever. 314 00:14:20.129 --> 00:14:22.629 It doesn't matter really because you go to a website, 315 00:14:22.649 --> 00:14:26.289 you log in and it gives you access. But you 316 00:14:26.309 --> 00:14:28.210 go out to a website and you make a request 317 00:14:28.269 --> 00:14:31.370 and what happens is that server then makes a request 318 00:14:31.409 --> 00:14:34.460 to itself on your behalf. So it looks like it's 319 00:14:34.519 --> 00:14:38.259 coming from inside. And that's generally what an SSRF attack is, 320 00:14:38.799 --> 00:14:42.769 is me conning the device into doing my bidding for 321 00:14:42.809 --> 00:14:45.639 me on a backend channel so that it trusts it. 322 00:14:46.429 --> 00:14:46.990 Yeah. 323 00:14:47.090 --> 00:14:48.769 So this one does not look good. And this is 324 00:14:48.809 --> 00:14:51.860 pre-authenticated by the way. That's the other reason that this 325 00:14:52.000 --> 00:14:55.399 is kind of a scary attack right now is you 326 00:14:55.460 --> 00:14:58.240 don't need a username or password. Just find the sonic 327 00:14:58.259 --> 00:15:00.840 wall on the internet. run the proof of concept, you 328 00:15:00.940 --> 00:15:03.480 grab off a GitHub and boom, you have access. 329 00:15:03.870 --> 00:15:06.529 Hey guys, this seems like a good time and place 330 00:15:06.590 --> 00:15:08.309 to take a break. So we'll be right back after 331 00:15:08.350 --> 00:15:15.070 these very important messages. Don't you go away. So guys, 332 00:15:15.230 --> 00:15:17.470 I went to the Humane Society the other day and 333 00:15:17.570 --> 00:15:21.929 I got myself a Mirage Kitten. And the Mirage Kitten 334 00:15:22.000 --> 00:15:24.059 is a really interesting kitten because you can see it 335 00:15:24.200 --> 00:15:26.820 across the room, but as you get close, it just disappears. 336 00:15:26.840 --> 00:15:28.259 Wow. 337 00:15:29.350 --> 00:15:30.289 You can still hear it going. 338 00:15:30.509 --> 00:15:33.190 All right. 339 00:15:33.769 --> 00:15:39.909 The story is Iran-linked APT Mirage Kitten uses fake job 340 00:15:39.950 --> 00:15:44.750 tests to spread malware. Malware. 341 00:15:46.129 --> 00:15:48.629 These countries, North Korea and Iran are making the world, 342 00:15:49.169 --> 00:15:50.110 they're ruining everything. 343 00:15:50.490 --> 00:15:50.769 I know. 344 00:15:50.789 --> 00:15:52.549 They've given us Mirage Kittens. 345 00:15:52.570 --> 00:15:53.629 The Q-bomber all over again. 346 00:15:55.370 --> 00:15:57.740 So this is a LinkedIn coding test, right? 347 00:15:58.320 --> 00:15:59.080 Yeah, absolutely. 348 00:15:59.100 --> 00:16:03.299 You apply for a job and you apply for a 349 00:16:03.340 --> 00:16:05.759 job and they give you a co-test and they say, hey, 350 00:16:05.830 --> 00:16:10.549 we need you to use, it's actually funny, this exact path, actually, 351 00:16:10.590 --> 00:16:13.529 maybe they've been listening to Security This Week. This exact 352 00:16:13.610 --> 00:16:18.529 path is a path that we presented probably six months ago. 353 00:16:18.990 --> 00:16:19.600 Who's we? 354 00:16:20.509 --> 00:16:25.740 We, as in we the security cabal, presented to one 355 00:16:25.759 --> 00:16:29.169 of our customers as a viable path to break into 356 00:16:29.190 --> 00:16:31.690 their organization we say listen we'll just hire one of 357 00:16:31.730 --> 00:16:35.659 your developers who we see does side work and we'll 358 00:16:35.700 --> 00:16:38.019 force them to use libraries not force them just say 359 00:16:38.059 --> 00:16:39.899 hey we'd like you to use this library in this 360 00:16:39.919 --> 00:16:42.899 library in this library and they'll be infected we're horrified 361 00:16:43.440 --> 00:16:47.399 yeah and they were like wait what like that's so 362 00:16:47.419 --> 00:16:51.570 we'll absolutely could do that and and apparently um iran's 363 00:16:51.629 --> 00:16:53.750 like you know we like that that's a that's a 364 00:16:53.769 --> 00:16:55.490 great path let's do that so that's what they're doing 365 00:16:56.029 --> 00:17:00.669 post fake jobs force you to use libraries that you 366 00:17:00.710 --> 00:17:03.620 don't possibly have time enough to read through, and when 367 00:17:03.659 --> 00:17:05.960 you make a call to it, it infects your local computer, 368 00:17:05.980 --> 00:17:10.140 pulling information, info-stealing, blah, blah, blah. 369 00:17:10.759 --> 00:17:16.140 What's the why for Iran-linked Mirage Kitten or whatever? What 370 00:17:16.180 --> 00:17:19.299 is their goal? Do they just want to infect people randomly? 371 00:17:19.539 --> 00:17:23.509 You said something like information-stealing, but what is it going 372 00:17:23.529 --> 00:17:28.869 to get them if they get some out-of-school... coder wannabe 373 00:17:29.529 --> 00:17:30.630 access to their computer. 374 00:17:30.650 --> 00:17:33.049 Well, with Korea, it does it for the money. They 375 00:17:33.089 --> 00:17:36.410 do it so that they can steal the money to 376 00:17:37.009 --> 00:17:37.609 build missiles. 377 00:17:38.210 --> 00:17:38.950 Like ransomware? 378 00:17:39.190 --> 00:17:43.190 Yeah, like ransomware, but in this case also, think about 379 00:17:43.309 --> 00:17:47.009 the fact that you control the job posting. So if 380 00:17:47.130 --> 00:17:50.910 I say, oh, I need a candidate that's TSSCI, right? 381 00:17:50.930 --> 00:17:56.230 So top secret, secure compartmentalized information knowledge. They're certified to 382 00:17:56.269 --> 00:17:59.230 deal with u.s secret government you know stuff. 383 00:17:59.250 --> 00:18:02.130 Car job might be u.s secret government right. 384 00:18:02.450 --> 00:18:04.450 So when they say oh you know we're a division 385 00:18:04.470 --> 00:18:06.980 of the you know uh doj and we need blah 386 00:18:07.000 --> 00:18:09.200 blah whatever and this is a you know we need 387 00:18:09.220 --> 00:18:10.859 you to go through this test to see whether you're 388 00:18:11.019 --> 00:18:14.059 you know smart enough to develop whatever now when i 389 00:18:14.079 --> 00:18:16.900 get on your computer there's probably i mean yeah i 390 00:18:16.920 --> 00:18:19.569 mean if you're following all the regs with tssci and 391 00:18:19.630 --> 00:18:21.450 zipper and nipper and all that good stuff you shouldn't 392 00:18:21.509 --> 00:18:23.990 have anything secure on your network on your your computer 393 00:18:24.049 --> 00:18:28.339 but chances are they might garner access or information that'll 394 00:18:28.359 --> 00:18:31.900 help them. So I would guess that's a RANDS target, 395 00:18:32.599 --> 00:18:35.420 the Mirage Kitten, is let's see what type of sensitive 396 00:18:35.579 --> 00:18:38.799 things we can pull from people and then just gain 397 00:18:38.880 --> 00:18:41.619 and continue access, maintain access to those devices. 398 00:18:41.960 --> 00:18:45.700 Okay. Is there anything that we can do to protect 399 00:18:45.759 --> 00:18:49.559 ourselves except for don't answer stupid emails and click on 400 00:18:49.619 --> 00:18:50.160 links or anything? 401 00:18:51.380 --> 00:18:52.259