WEBVTT 1 00:00:00.320 --> 00:00:03.200 Hey, Carl here, we're on a mission to find new 2 00:00:03.240 --> 00:00:05.919 fans of the show. I mean, where else can you 3 00:00:05.960 --> 00:00:10.240 get real life comedy and horror in one podcast. You 4 00:00:10.279 --> 00:00:13.000 can do your part by leaving us a review on iTunes, 5 00:00:13.039 --> 00:00:16.719 Spotify or wherever you get Security this week. Also, you 6 00:00:16.719 --> 00:00:19.079 can get an ad free feed by becoming a five 7 00:00:19.120 --> 00:00:22.039 dollars a month patron. Go to Patreon dot Security this 8 00:00:22.079 --> 00:00:25.320 week dot com and sign up, and don't forget discord. 9 00:00:25.600 --> 00:00:28.519 Discord dot Security this week dot com. Lots of good 10 00:00:28.559 --> 00:00:32.280 stuff happening there. Yeah, I think that's it. So on 11 00:00:32.359 --> 00:00:33.200 with the podcast. 12 00:00:33.759 --> 00:00:36.799 You know, guys, this whole thing about equality of the sexes, 13 00:00:36.880 --> 00:00:38.079 it's just bunk. 14 00:00:39.640 --> 00:00:43.280 Said, you're hate mail to Carl Franklin, both of our 15 00:00:43.320 --> 00:00:44.159 female listeners. 16 00:00:44.359 --> 00:00:48.640 Here's an example. Miley Cyrus dance is naked and licks 17 00:00:48.640 --> 00:00:51.759 a hammer and everybody says, oh, it's art. You know 18 00:00:51.840 --> 00:00:54.640 when I do that, the manager calls the cops at 19 00:00:54.640 --> 00:01:06.120 home depot. Hey, welcome back to Security this week. I'm 20 00:01:06.159 --> 00:01:09.599 Carl Franklin's Patrick Hines and Dwaine Laflatte. You got some stories, 21 00:01:09.599 --> 00:01:13.079 Oh boy, do we have some stories. But I gotta 22 00:01:13.120 --> 00:01:17.040 say we have a good percentage of good stories. Sure, yeah, absolutely, 23 00:01:17.120 --> 00:01:20.640 let's start with one that's not so good. In Gadget reports, 24 00:01:20.680 --> 00:01:25.319 hacker used anthropics Claude chat bot to attack multiple government 25 00:01:25.400 --> 00:01:27.280 agencies in Mexico. 26 00:01:27.599 --> 00:01:33.519 What happened, Oh no, so we've heard this. So what 27 00:01:33.640 --> 00:01:37.719 happened is a lot of these lms, especially when you 28 00:01:37.719 --> 00:01:41.319 put tooling on them, give them agency. They can run things, right, 29 00:01:41.319 --> 00:01:43.280 they can run in map, they can go scan networks, 30 00:01:43.319 --> 00:01:45.480 they can do whatever. But a lot of them, a 31 00:01:45.480 --> 00:01:47.560 lot of the online ones you're chat Gypts and whatever, 32 00:01:47.599 --> 00:01:49.840 they're not going to allow you to break into a site. 33 00:01:49.879 --> 00:01:52.079 They're not going to allow you to you know, learn 34 00:01:52.079 --> 00:01:53.239 how to make a bomb whatever. 35 00:01:53.280 --> 00:01:54.200 They have guardrails. 36 00:01:54.359 --> 00:01:59.000 Yeah, what this particular attacker did is obviously learned the 37 00:01:59.040 --> 00:02:04.120 ways around the guardrails. And sometimes that's downloading the language 38 00:02:04.120 --> 00:02:06.920 model locally and using a local version like in l 39 00:02:07.120 --> 00:02:10.800 M Studio or something along those lines, or you know openclaw, 40 00:02:10.879 --> 00:02:14.879 which we'll talk about later. So there are ways for 41 00:02:14.919 --> 00:02:18.479 you to use artificial intelligence locally that actually has tools 42 00:02:18.479 --> 00:02:20.719 that can do things, that can go out and touch things. 43 00:02:20.759 --> 00:02:23.960 And in this case, they decided to automate as much 44 00:02:24.039 --> 00:02:27.000 of an attack chain as they could and we've seen 45 00:02:27.080 --> 00:02:30.919 this anthropic says they stopped an attack from China where 46 00:02:31.000 --> 00:02:36.520 China was actually using Anthropic to target organizations. This person 47 00:02:36.719 --> 00:02:39.240 just got much further. We've got one hundred and fifty 48 00:02:39.280 --> 00:02:42.439 three gig worth of sensitive data, tax records, and all 49 00:02:42.479 --> 00:02:43.680 sorts of stuff from Mexico. 50 00:02:43.879 --> 00:02:47.280 So, I mean, this is an example of everything can 51 00:02:47.319 --> 00:02:51.319 be used for both good and evil. Nuclear power, nuclear weapons, 52 00:02:52.479 --> 00:02:57.719 you know, biological research, cures for diseases, bio weapons. It's 53 00:02:57.759 --> 00:03:00.520 true of everything. So the more we lock this stuff 54 00:03:00.560 --> 00:03:03.800 down so that it can't hack, then what happens when 55 00:03:04.039 --> 00:03:06.439 we want to have it evaluate our code to see 56 00:03:06.439 --> 00:03:09.159 what vulnerabilities we can fix. Right, So there's this double 57 00:03:09.240 --> 00:03:11.560 edged sword we have to figure out, and we haven't 58 00:03:11.560 --> 00:03:14.840 figured it out yet. It's not we're not anywhere close there. Yeah, 59 00:03:14.879 --> 00:03:15.719 it's moving faster. 60 00:03:15.879 --> 00:03:18.879 Well, it's moving fast. I mean it's like, yeah, it's 61 00:03:18.919 --> 00:03:21.080 like gunpowder, right, gunpowder could be used for good or 62 00:03:21.080 --> 00:03:23.199 could be used for evil. But if you gave everybody 63 00:03:23.199 --> 00:03:26.080 on the planet gunpowder the moment it was invented, but 64 00:03:26.199 --> 00:03:29.439 we'd see a bunch of really crazy stuff until laws 65 00:03:29.479 --> 00:03:32.120 and regulations in society came came forward and said you 66 00:03:32.120 --> 00:03:34.560 can't do these things. And we're now starting to see 67 00:03:34.560 --> 00:03:36.560 that with AI. It's moving so fast and it's in 68 00:03:36.560 --> 00:03:39.240 the hands of everybody on the planet right anything they 69 00:03:39.240 --> 00:03:41.960 can imagine they want to do at this point, you know, 70 00:03:42.080 --> 00:03:47.520 like automatically targeting organizations and stealing data is now becoming 71 00:03:47.520 --> 00:03:50.000 a possibility. And we talked about this, I think last night. 72 00:03:50.080 --> 00:03:52.240 Yeah, look at a hammer. Look at a hammer. I 73 00:03:52.240 --> 00:03:53.479 mean it's got dual uses. 74 00:03:55.280 --> 00:04:00.000 We use wrenches, sorry, wrenches, wrenches. 75 00:04:00.159 --> 00:04:01.560 The fight all a wrench, that's right. 76 00:04:03.280 --> 00:04:05.360 So in this article they do I think they talk 77 00:04:05.680 --> 00:04:08.240 down by the bottom about the fact that Anthropic has 78 00:04:08.400 --> 00:04:12.840 changed their commitment to safety, and it's not the commitments 79 00:04:12.840 --> 00:04:14.960 to safety. The military is trying to get them to rollback. 80 00:04:15.080 --> 00:04:17.720 And I need to acknowledge a mistake I made in 81 00:04:17.759 --> 00:04:18.800 the last episode. 82 00:04:18.839 --> 00:04:20.800 I said that you don't make mistakes there I did. 83 00:04:20.839 --> 00:04:23.000 I said, Pete Hay says never saw a war, and 84 00:04:23.040 --> 00:04:26.240 he did actually deploy, and he did get two Bronze Stars, 85 00:04:26.240 --> 00:04:29.160 but neither one of them was for valor. They're more meritorious. 86 00:04:29.240 --> 00:04:32.399 So I still think he's not competent for the job. 87 00:04:32.560 --> 00:04:35.920 But he did see war zones and get a cib 88 00:04:36.079 --> 00:04:37.040 so I Will. 89 00:04:37.040 --> 00:04:39.000 Was his dad, the guy that handed out the stars. 90 00:04:39.959 --> 00:04:41.920 Well, I mean I got a bronze star for my 91 00:04:42.639 --> 00:04:46.839 firefight in the first Golf War. It wasn't a valorous one. 92 00:04:46.920 --> 00:04:49.279 It's not with valid I didn't charge a machine gun, nest. 93 00:04:49.800 --> 00:04:54.560 He got one for professionalism and commitment to excellence to 94 00:04:54.600 --> 00:04:58.639 help build a stable Iraq. No mention of any combat there. 95 00:04:58.759 --> 00:04:59.759 That sounds like a gold star. 96 00:05:00.000 --> 00:05:02.319 And then the next one was in Afghanistan. He was 97 00:05:02.319 --> 00:05:05.480 a counter surgeon instructor and he acted in a dangerous situation, 98 00:05:05.560 --> 00:05:07.600 which probably means he was just in range of something. 99 00:05:07.720 --> 00:05:08.079 Got it. 100 00:05:08.879 --> 00:05:12.000 But so I don't like to be wrong, so I 101 00:05:12.040 --> 00:05:13.680 want to make that correction. But I still think he's 102 00:05:13.680 --> 00:05:21.360 an idiot. So Patrick, bring it on, Man, bring it on. 103 00:05:22.279 --> 00:05:25.879 So the Anthropic changed their commitment, and the commitment was 104 00:05:26.040 --> 00:05:28.800 pretty out there in my opinion. It was like they 105 00:05:29.240 --> 00:05:31.759 wanted to make sure they didn't build an AI they 106 00:05:31.759 --> 00:05:35.680 couldn't prove was safe. Okay, again, like I just said, 107 00:05:35.680 --> 00:05:40.160 this dual use technologies. Everything has a sinister side. And 108 00:05:40.199 --> 00:05:42.240 they kind of came to the realization that it was 109 00:05:42.279 --> 00:05:44.800 moving so fast that if they kept to this pledge, 110 00:05:44.839 --> 00:05:48.279 they'd lose that did. And and right now, one of 111 00:05:48.279 --> 00:05:50.240 the things that we've seen, and I digressed a little 112 00:05:50.240 --> 00:05:54.800 bit is open AI went in and tried to scoop 113 00:05:55.000 --> 00:06:00.240 the military contract from Anthropic and it it fail, bailed 114 00:06:00.279 --> 00:06:04.120 disastrously because the backlash against them. I read that they 115 00:06:04.160 --> 00:06:07.079 had a two hundred and ninety five percent increase in cancelations. 116 00:06:07.199 --> 00:06:10.000 Oh yeah, like one point five million or something like that, 117 00:06:10.040 --> 00:06:11.519 cancelations in service. 118 00:06:11.279 --> 00:06:15.120 Which is probably worth more than the contract will be 119 00:06:15.240 --> 00:06:19.800 worth that they're after. So Anthropic lost a contract probably 120 00:06:19.800 --> 00:06:23.839 with the government, and is won many many more devoted fans. 121 00:06:24.720 --> 00:06:29.160 And Open Ai has now shown that they'll basically do 122 00:06:29.240 --> 00:06:32.480 anything for a buck. And so I think what's happening 123 00:06:32.519 --> 00:06:35.240 is we could very well see this as the decision 124 00:06:35.279 --> 00:06:38.319 point that decides which one ultimately wins. I'm not calling 125 00:06:38.360 --> 00:06:41.920 the race yet, but I think this was actually a 126 00:06:41.920 --> 00:06:44.399 good thing, for a good fight for Anthropic to pick. 127 00:06:44.519 --> 00:06:46.759 You know, I saw a story today and I'll add 128 00:06:46.800 --> 00:06:50.199 it to the show. Notes that Anthropic CEO says company 129 00:06:50.279 --> 00:06:53.720 no longer sure whether or not Claude is conscious. 130 00:06:54.160 --> 00:06:55.920 Oh wow, Yeah, that's that's bs. 131 00:06:55.959 --> 00:06:59.120 They can't say definitively whether it is conscious. 132 00:06:59.360 --> 00:07:02.319 I believe that that is total BS. I think that 133 00:07:02.319 --> 00:07:07.759 that is either he's being intentionally obtuse or he's an 134 00:07:07.759 --> 00:07:11.120 idiot in that regard, because if you understand how large 135 00:07:11.160 --> 00:07:15.040 language models work, they'll never they don't understand what they're saying, 136 00:07:15.040 --> 00:07:18.399 they don't understand what they're what they're hearing. They'll never 137 00:07:18.480 --> 00:07:20.639 be conscious. I'll put stake my life you. 138 00:07:21.240 --> 00:07:23.759 I know people that fall into that category too, though, I. 139 00:07:23.800 --> 00:07:26.279 Mean, and maybe they're not conscious. That's why I advocate 140 00:07:26.319 --> 00:07:31.759 killing them. 141 00:07:30.639 --> 00:07:34.759 Tom. If you think about and I know those of 142 00:07:34.839 --> 00:07:38.000 us in the software world, we know how these things, 143 00:07:38.079 --> 00:07:39.759 what these things are made of, and they're made of 144 00:07:39.800 --> 00:07:44.720 algorithms and software, but you know, at the if you 145 00:07:44.759 --> 00:07:47.759 break down what the brain does and how thoughts work 146 00:07:47.800 --> 00:07:50.759 and how words are put together, they are kind of 147 00:07:51.399 --> 00:07:54.279 something like when I when I think about what to say, 148 00:07:54.399 --> 00:07:58.000 sometimes my synapse is misfired and it comes out to statistical. 149 00:07:58.199 --> 00:08:01.879 I do not count the fact that there will someday 150 00:08:01.959 --> 00:08:04.959 be a computer that is conscious and that has consciousness. 151 00:08:05.079 --> 00:08:07.120 I don't disagree with that at all. I do not 152 00:08:07.199 --> 00:08:10.040 believe lllms will ever lead to that. I believe it 153 00:08:10.079 --> 00:08:13.120 will be another jump and it could be a much 154 00:08:13.160 --> 00:08:15.120 further jump. So yeah, we can debate it. 155 00:08:15.199 --> 00:08:16.720 This is just the language part of them. 156 00:08:16.800 --> 00:08:20.480 But also remember one thing, all these Silicon Valley CEOs, 157 00:08:21.319 --> 00:08:24.279 they are raising billions and tens of billions and even 158 00:08:24.399 --> 00:08:28.040 hundreds of billions on the back of this hype for AGI. 159 00:08:28.279 --> 00:08:30.800 So there's an old story that says, an old saying 160 00:08:30.839 --> 00:08:33.960 that says, you can never convince a man to believe 161 00:08:34.159 --> 00:08:37.039 that which his paycheck depends on him not believing. 162 00:08:37.759 --> 00:08:41.320 Right, All right, let's move on. Hacker new says clawjacked, 163 00:08:41.399 --> 00:08:46.120 flaw lets, malicious sites hijack local open claw AI agents 164 00:08:46.679 --> 00:08:50.080 via web socket. Man, here's what I know about web sockets. 165 00:08:50.559 --> 00:08:55.159 There's like sockets that you connect to with a yeah yeah, 166 00:08:55.519 --> 00:08:57.919 that you connect to at an IP address. But they're 167 00:08:57.960 --> 00:09:00.639 all over port eighty so they go right through firewalls. 168 00:09:01.559 --> 00:09:02.960 So what what is this all about? 169 00:09:03.320 --> 00:09:05.879 So this this is interesting. Poor open claw has been 170 00:09:06.000 --> 00:09:10.960 in the news constantly. 171 00:09:11.039 --> 00:09:12.200 Yeah, I mean, that's great. 172 00:09:12.240 --> 00:09:15.679 You misunderstood. 173 00:09:15.799 --> 00:09:18.840 Wow, wow, he was a good guy. Yeah. 174 00:09:19.519 --> 00:09:23.879 So what's happening is there's a local website. So when 175 00:09:23.879 --> 00:09:27.720 you install open claw, there's a local management website where 176 00:09:27.799 --> 00:09:30.919 obviously it's you can put a password on it. But 177 00:09:30.960 --> 00:09:32.840 that's how you log in and you do things, right, 178 00:09:32.960 --> 00:09:35.480 you you know, set up agents, trusted computers, all sorts 179 00:09:35.519 --> 00:09:38.200 of other stuff, right. You know, that's your interface to 180 00:09:38.440 --> 00:09:44.799 this locally running agentic AI. But it's only accessible on 181 00:09:44.840 --> 00:09:47.600 what's called local host right, right, So for those of 182 00:09:47.600 --> 00:09:51.360 you who aren't sort of networking, it didn't didn't grow 183 00:09:51.399 --> 00:09:54.960 up in the networking world. Local host is your computer, 184 00:09:55.440 --> 00:09:57.759 but it's a little bit more unique than that. The 185 00:09:57.799 --> 00:10:00.840 address that resolves to local hosts. So every computer on 186 00:10:00.879 --> 00:10:04.120 the Internet obviously has an IP address. In your home, 187 00:10:04.240 --> 00:10:07.559 your computer has an IP dress that's called non routable. Yeah, 188 00:10:07.600 --> 00:10:08.200 so you're not you. 189 00:10:08.200 --> 00:10:10.440 Can't access it from outside your local network. 190 00:10:10.600 --> 00:10:13.320 Yeah, I you know, my house might be one nine 191 00:10:13.360 --> 00:10:16.759 six eight, you know, zero dot two, Go on, right, 192 00:10:16.840 --> 00:10:19.399 I know, right, yeah, go ahead, find that IP address. 193 00:10:20.039 --> 00:10:22.200 But so is ninety nine percent of the rest of 194 00:10:22.240 --> 00:10:25.799 the planet. Right, Your home addresses are nonroutable. Their computers, 195 00:10:26.080 --> 00:10:27.679 you know, can talk to each other that way, but 196 00:10:27.759 --> 00:10:29.639 it's not like I'm connecting to you on that IP. 197 00:10:29.840 --> 00:10:32.240 All routers on the Internet drop those p exactly. 198 00:10:32.600 --> 00:10:32.799 Now. 199 00:10:32.840 --> 00:10:36.399 On top of that, you have another address associated with 200 00:10:36.399 --> 00:10:38.840 your computer called one two seven dot zero dot zero 201 00:10:38.840 --> 00:10:39.120 dot one. 202 00:10:39.120 --> 00:10:40.039 There's no place like home. 203 00:10:40.080 --> 00:10:43.960 There's no place like one two seven zero zero one. Yes, 204 00:10:44.200 --> 00:10:47.679 all right, it's a great nerd t shirt because that's 205 00:10:47.679 --> 00:10:48.200 how right. 206 00:10:48.320 --> 00:10:49.039 That's your home. 207 00:10:49.440 --> 00:10:53.000 Yeah, it's your computer. If if anything, any software in 208 00:10:53.039 --> 00:10:56.879 your computer has to talk to one two seven dot one, 209 00:10:57.000 --> 00:10:59.080 but one two seven do zero dot zero dot one, 210 00:11:00.039 --> 00:11:04.399 then it's talking to itself locally. Nobody sees that traffic. 211 00:11:04.759 --> 00:11:06.559 It doesn't go out over the Internet, it doesn't go 212 00:11:06.559 --> 00:11:07.799 out over your local network. 213 00:11:07.840 --> 00:11:08.759 It just talks local. 214 00:11:08.919 --> 00:11:12.159 So would that cause the average human to set up 215 00:11:12.200 --> 00:11:14.799 really weak passwords since nobody can access it. 216 00:11:15.639 --> 00:11:17.960 You should say that, Patrick, It's a great it's a 217 00:11:17.960 --> 00:11:21.240 great point, Patrick. So let's say you set up your 218 00:11:21.279 --> 00:11:24.519 open claw and you know it can only be accessed locally. 219 00:11:24.559 --> 00:11:26.759 You are the only person who can open a browser 220 00:11:26.879 --> 00:11:30.360 and view that configuration website. And let's say you set 221 00:11:30.360 --> 00:11:33.279 the password to it to be password because you're like whatever, 222 00:11:33.519 --> 00:11:35.480 or open claw, yeah, or open clause. It doesn't matter 223 00:11:35.519 --> 00:11:37.840 because nobody can access it unless they're hands on keys 224 00:11:37.879 --> 00:11:38.519 at your computer. 225 00:11:38.720 --> 00:11:39.399 Not so fast. 226 00:11:40.600 --> 00:11:45.519 Not so fast because communications happen over web sockets, right, 227 00:11:45.639 --> 00:11:51.720 like Carl had said, And because JavaScript can open web sockets. 228 00:11:52.399 --> 00:11:56.879 If you visit a malicious website, it will open a 229 00:11:57.000 --> 00:12:01.879 web socket two one zero zero dot one for the 230 00:12:01.919 --> 00:12:04.840 open claw web socket port, and it will brute force 231 00:12:04.879 --> 00:12:07.639 your password and if it finds it, it will add 232 00:12:07.679 --> 00:12:10.879 the hackers computers as a trusted device. Yeah, and this, 233 00:12:11.120 --> 00:12:12.759 and then it will dump all the keys and do 234 00:12:12.799 --> 00:12:13.600 all sorts of stuff. 235 00:12:13.639 --> 00:12:15.960 So so in this way, the web socket's acting like 236 00:12:16.000 --> 00:12:22.759 a shell exactly, exactly good good, I mean, play the music, 237 00:12:23.000 --> 00:12:24.200 because for the play of the. 238 00:12:24.200 --> 00:12:26.440 Music, guys, all right, go ahead, brand and play the music. 239 00:12:27.039 --> 00:12:33.759 It's hey, if you need a shell that's not a shell, 240 00:12:33.960 --> 00:12:34.840 use web sockets. 241 00:12:36.360 --> 00:12:38.480 Shell class have shells. 242 00:12:38.480 --> 00:12:42.120 Exactly that's where it should be. So it's an interesting attack. 243 00:12:42.159 --> 00:12:45.080 We've seen attacks of our web sockets before, but it's 244 00:12:45.080 --> 00:12:49.000 that weird. I'm safe because nobody can access it unless 245 00:12:49.000 --> 00:12:51.519 they're at my computer, but realize you're also on your 246 00:12:51.559 --> 00:12:54.639 computer doing things, and malicious code can then access it 247 00:12:54.679 --> 00:12:55.000 down way. 248 00:12:55.000 --> 00:12:57.120 So the pass where it's going to be like password 249 00:12:57.159 --> 00:12:59.679 with an act or something, nobody will know. 250 00:13:00.519 --> 00:13:06.120 Set your passwords to security this week. Nobody will gets 251 00:13:06.159 --> 00:13:11.159 that right, all right, So that was an interesting thing. 252 00:13:12.240 --> 00:13:14.759 I don't think there's anything that anybody can do about 253 00:13:14.799 --> 00:13:16.279 it except don't run open claw. 254 00:13:16.360 --> 00:13:18.480 Come on, I mean yeah, And if you're going to 255 00:13:18.559 --> 00:13:21.200 run a better password and isolate it from your network 256 00:13:21.240 --> 00:13:23.679 and don't run it on a computer you're actually sitting at. 257 00:13:23.960 --> 00:13:26.200 If you get to run anything, you need to understand 258 00:13:26.200 --> 00:13:29.679 the risks. Yeah's And the problem is most people. 259 00:13:29.399 --> 00:13:30.000 Don't, right. 260 00:13:30.320 --> 00:13:33.759 I think Amazon just announced that you can actually deploy 261 00:13:33.840 --> 00:13:37.000 open claw in their cloud, oh boy, which would actually 262 00:13:37.039 --> 00:13:39.120 make it super isolated and that sort of stuff. So 263 00:13:40.000 --> 00:13:42.799 although here's what I'm thinking, that actually might be a 264 00:13:42.840 --> 00:13:45.720 really great attack path to have a whole take off 265 00:13:46.120 --> 00:13:51.879 army of Claus sitting up in Amazon. Anyways, Okay, Danne 266 00:13:51.919 --> 00:13:56.159 dream on. So this one is a PSA. Most Wi 267 00:13:56.200 --> 00:14:00.600 Fi routers are vulnerable to an air snitch attack. Here's 268 00:14:00.639 --> 00:14:02.559 what to do. First of all, what's the air snitch? 269 00:14:03.120 --> 00:14:06.600 So air snitch is what they're dubbing the attack because 270 00:14:06.600 --> 00:14:10.080 it can be man in the middle. And we've talked 271 00:14:10.080 --> 00:14:12.679 about these tactics before. So mad in the middle is 272 00:14:12.720 --> 00:14:15.639 like Carl goes to his bank on the Internet and 273 00:14:15.679 --> 00:14:18.279 he's doing banking. Now, if I can get in between 274 00:14:18.360 --> 00:14:21.559 that traffic and in this case, let's assume there's no 275 00:14:21.759 --> 00:14:23.879 secure socket layers or anything like that. I can to 276 00:14:23.919 --> 00:14:25.320 see the traffic that's man in the middle, and I 277 00:14:25.360 --> 00:14:28.360 can manipulate it. I could send back to Carl that 278 00:14:28.399 --> 00:14:31.159 there's no money in his accounts. I could send to 279 00:14:31.240 --> 00:14:33.159 the bank that I want to transfer money whatever. Right, 280 00:14:33.200 --> 00:14:35.200 because I'm in the middle, I get to change that traffic. 281 00:14:35.960 --> 00:14:39.600 So this air snitch is actually man in the middle 282 00:14:39.679 --> 00:14:43.159 on Wi Fi. Now, there are some caveats because that 283 00:14:43.200 --> 00:14:46.200 sounds really bad where they're like, listen, there are no protections. 284 00:14:46.480 --> 00:14:50.600 You know you're in trouble. Blah blah blah. The way 285 00:14:50.679 --> 00:14:54.360 Wi Fi typically works is you have a password, right 286 00:14:54.759 --> 00:14:56.679 that goes along with the Wi Fi, and it has 287 00:14:56.720 --> 00:14:59.399 to be at least eight characters. We always recommend longer 288 00:14:59.399 --> 00:15:00.960 than a characters, but it has to be at least as 289 00:15:01.039 --> 00:15:02.960 long as possible. As long as eight might as well 290 00:15:03.039 --> 00:15:05.639 be three. But I will tell you, yeah, I know, right, 291 00:15:05.720 --> 00:15:09.960 I will tell you, like open networks. Go to Starbucks, 292 00:15:09.960 --> 00:15:12.600 it's an open network, right, Go to the airport. Go 293 00:15:12.639 --> 00:15:15.240 to the airport, is sit on a delta flight. If 294 00:15:15.240 --> 00:15:16.639 they're all may go. 295 00:15:16.600 --> 00:15:18.360 To Chili's and get Chili's Wi Fi. 296 00:15:18.600 --> 00:15:21.720 Right, there's still networks. So there's no password there, which means. 297 00:15:21.639 --> 00:15:23.080 So that means there's no encryption. 298 00:15:23.320 --> 00:15:25.799 Yeah, the barrier to entry is love. 299 00:15:25.600 --> 00:15:27.159 Because the password is used for encryption. 300 00:15:27.399 --> 00:15:32.720 Yeah, right, exactly. So what happens is, let's say it's 301 00:15:32.759 --> 00:15:35.720 not strong, Patrick, Carl and I we're on a you know, 302 00:15:35.720 --> 00:15:37.519 we're on a delta flight and we're using the Wi Fi. 303 00:15:38.399 --> 00:15:41.000 And let's say I, being the nefarious hacker, want to 304 00:15:41.000 --> 00:15:43.559 see who else is on the network, right, And I'm 305 00:15:43.559 --> 00:15:45.039 going to go and scan that network. And what I'm 306 00:15:45.039 --> 00:15:47.879 going to find is I see nobody except for me 307 00:15:48.600 --> 00:15:49.320 in the gateway. 308 00:15:49.720 --> 00:15:50.200 That's it. 309 00:15:51.000 --> 00:15:53.600 And the reason being is most public networks like that 310 00:15:53.679 --> 00:15:57.960 do what's called client isolation, where I can't talk directly 311 00:15:57.960 --> 00:16:00.440 to Patrick, I can't talk directly to Carl, and Carl 312 00:16:00.519 --> 00:16:03.159 can't talk to Patrick. Client isolation allows me only talk 313 00:16:03.200 --> 00:16:06.159 to gateway like v Lance exactly. V Lance is a 314 00:16:06.159 --> 00:16:11.639 great example of client isolation. What they found with air 315 00:16:11.759 --> 00:16:17.120 snitch is that level of isolation, if it's on, can 316 00:16:17.279 --> 00:16:22.600 be bypassed where I can manipulate the traffic to tell 317 00:16:22.840 --> 00:16:28.200 the router the access point I'm Carl's gateway send all 318 00:16:28.279 --> 00:16:31.159 of his traffic to me. So what happens is Carl, 319 00:16:31.480 --> 00:16:34.279 when he gets on that network, he gets isolated. How 320 00:16:34.279 --> 00:16:36.240 does he get isolated? It's actually a little bit more 321 00:16:36.240 --> 00:16:39.279 complicated than that. There's a session key between Carl and 322 00:16:39.320 --> 00:16:42.960 the access point. Then nobody can decrypt, right And there's 323 00:16:42.960 --> 00:16:45.559 a unique session key from Patrick to that access point, 324 00:16:45.559 --> 00:16:47.759 and there's unique session key from me to that access point, 325 00:16:47.840 --> 00:16:50.080 So I can't decrypt that. But if I tell the 326 00:16:50.120 --> 00:16:52.279 access point Carl has to go to me to get 327 00:16:52.279 --> 00:16:55.600 to the Internet. What happens is the access point routes 328 00:16:55.799 --> 00:17:00.519 gets the traffic from Carl, decrypts it, re encrypts it 329 00:17:00.559 --> 00:17:03.399 with my key, and sends it to me. Then if 330 00:17:03.399 --> 00:17:05.519 I can do whatever I want with it, and I 331 00:17:05.559 --> 00:17:07.519 can then send it to the Internet. So it's a 332 00:17:07.519 --> 00:17:10.079 pretty novel attack when you look at it that way, 333 00:17:10.119 --> 00:17:13.359 where they found out which layers of Wi Fi they 334 00:17:13.359 --> 00:17:17.559 can manipulate, whether it's ARP spoofing or whatever that bypasses. 335 00:17:17.559 --> 00:17:21.279 If Carl's using a VPN, he'll still be protected right absolutely. 336 00:17:21.319 --> 00:17:23.480 And that's a great point. Like if you're encrypting your 337 00:17:23.519 --> 00:17:26.599 traffic another so you have that encrypted traffic to your 338 00:17:26.640 --> 00:17:28.880 access point, but the access point can decrypt it. If 339 00:17:28.920 --> 00:17:32.119 I'm using a VPN, I already have an encrypted session 340 00:17:32.119 --> 00:17:34.720 to a remote server, right, So at that point you're 341 00:17:34.759 --> 00:17:35.799 not going to get mad in the middle. 342 00:17:35.920 --> 00:17:38.960 And here's the story. You should probably always use a 343 00:17:39.039 --> 00:17:42.160 VPN when you're using a Wi Fi endpoint that doesn't 344 00:17:42.200 --> 00:17:43.440 have a password. 345 00:17:43.039 --> 00:17:44.119 One hundred percent. 346 00:17:44.240 --> 00:17:45.960 Absolutely, Yeah, attacks like this. 347 00:17:46.240 --> 00:17:48.480 But here's the problem though. You have to connect to 348 00:17:48.559 --> 00:17:51.200 the end point before you can enable the VPN, right. 349 00:17:51.799 --> 00:17:53.880 So you do, yeah, and you're going to connect out 350 00:17:53.880 --> 00:17:55.839 to that. But what but if I connect to that 351 00:17:55.960 --> 00:17:59.000 endpoint access point. Let's say I'm on the Delta flight 352 00:17:59.039 --> 00:18:03.559 again and I go to VPN, my certificate is not 353 00:18:03.680 --> 00:18:06.200 going to allow me to connect to the remote host 354 00:18:06.240 --> 00:18:08.480 if it's man in the middle. So what's gonna happen 355 00:18:08.519 --> 00:18:10.839 is because they unable to connect, unable to connect, unable 356 00:18:10.839 --> 00:18:13.359 to connect. And if that's the case, shut your laptop 357 00:18:13.400 --> 00:18:14.440 down and wait until you land. 358 00:18:14.559 --> 00:18:17.400 You've detected. Yeah, it's a telltale sign that you've got 359 00:18:17.440 --> 00:18:18.039 somebody yep. 360 00:18:18.119 --> 00:18:20.480 Yeah, if you're a VPM won't connect, it's they could 361 00:18:20.480 --> 00:18:22.400 be blocking it. But either way, I would just shut 362 00:18:22.440 --> 00:18:22.680 it down. 363 00:18:22.720 --> 00:18:24.839 It's how I It's how I found out find out 364 00:18:24.839 --> 00:18:26.559 if Dwayne's checked into the hotel yet. 365 00:18:26.799 --> 00:18:30.960 Exactly if you can VPN in, you know, I'm not 366 00:18:31.000 --> 00:18:32.000 at the hotel. 367 00:18:32.839 --> 00:18:34.960 And if you get attacks now, man, I'm in the lobby. 368 00:18:34.960 --> 00:18:40.359 Don't believe that. Don't believe it's. 369 00:18:38.920 --> 00:18:41.799 What's weird is this is a very novel, unique attack 370 00:18:42.000 --> 00:18:47.440 for bypassing client isolation. I have been on plenty of 371 00:18:47.480 --> 00:18:49.799 networks I've been traveling over the last couple of weeks. 372 00:18:49.799 --> 00:18:51.480 I've been on plenty of networks over the last couple 373 00:18:51.480 --> 00:18:54.000 of weeks that did not even have client isolation. I 374 00:18:54.000 --> 00:18:56.640 could see all of the other clients on that on 375 00:18:56.680 --> 00:19:00.559 that Wi Fi. So, yeah, this is a WPA three attack. 376 00:19:00.799 --> 00:19:05.680 So WPA is WPA, WPA two, WPA three, WPA three 377 00:19:05.799 --> 00:19:08.599 is regarded as the best. It's still the best, Yeah 378 00:19:08.640 --> 00:19:11.119 it is. I don't think there's a WPA four defined yet. 379 00:19:11.480 --> 00:19:11.920 I don't know. 380 00:19:12.519 --> 00:19:15.200 No, there's there are, Like there are tons of RFCs 381 00:19:15.200 --> 00:19:18.000 for brand new you know whatever is. But your router 382 00:19:18.079 --> 00:19:20.279 at home is going to be supporting WA three, right, But. 383 00:19:20.599 --> 00:19:23.279 There's no WPA four to four to support yet that 384 00:19:23.279 --> 00:19:26.000 that is widely out there, is there? I don't think 385 00:19:26.079 --> 00:19:27.839 I don't think so, it's been a while since I 386 00:19:27.839 --> 00:19:28.640 can figured a router. 387 00:19:30.039 --> 00:19:31.680 All right, you guys ready to move on? 388 00:19:31.920 --> 00:19:32.880 Yeah, we're ready. 389 00:19:33.039 --> 00:19:38.039 Hacker News says Europole led operation takes down Tycoon two 390 00:19:38.200 --> 00:19:43.119 FA fishing as a service linked to sixty four thousand attacks. 391 00:19:43.359 --> 00:19:43.920 That's awesome. 392 00:19:44.079 --> 00:19:45.480 Yeah, that is good news. 393 00:19:45.519 --> 00:19:48.519 Golf Clapp, well done, well done. 394 00:19:48.359 --> 00:19:51.880 Well done. You So what's the story here? How did 395 00:19:51.880 --> 00:19:56.079 they find it? And I mean sixty four thousand attacks that, 396 00:19:56.599 --> 00:20:01.000 I mean, that's every attack could potentially harm you know, 397 00:20:01.119 --> 00:20:02.079 millions of people. 398 00:20:02.240 --> 00:20:04.240 Yeah, absolutely, So that's a lot. 399 00:20:04.039 --> 00:20:07.920 Of a lot of bad stuff. Wow. Yeah. 400 00:20:07.960 --> 00:20:10.839 And a lot of times the way that these are 401 00:20:10.960 --> 00:20:15.039