Speaker 1: Hey, Carl here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes,
Speaker 1: Spotify or wherever you get Security this week. Also, you
Speaker 1: can get an ad free feed by becoming a five
Speaker 1: dollars a month patron. Go to Patreon dot Security this
Speaker 1: week dot com and sign up, and don't forget discord.
Speaker 1: Discord dot Security this week dot com. Lots of good
Speaker 1: stuff happening there. Yeah, I think that's it. So on
Speaker 1: with the podcast.
Speaker 2: You know, guys, this whole thing about equality of the sexes,
Speaker 2: it's just bunk.
Speaker 3: Said, you're hate mail to Carl Franklin, both of our
Speaker 3: female listeners.
Speaker 2: Here's an example. Miley Cyrus dance is naked and licks
Speaker 2: a hammer and everybody says, oh, it's art. You know
Speaker 2: when I do that, the manager calls the cops at
Speaker 2: home depot. Hey, welcome back to Security this week. I'm
Speaker 2: Carl Franklin's Patrick Hines and Dwaine Laflatte. You got some stories,
Speaker 2: Oh boy, do we have some stories. But I gotta
Speaker 2: say we have a good percentage of good stories. Sure, yeah, absolutely,
Speaker 2: let's start with one that's not so good. In Gadget reports,
Speaker 2: hacker used anthropics Claude chat bot to attack multiple government
Speaker 2: agencies in Mexico.
Speaker 4: What happened, Oh no, so we've heard this. So what
Speaker 4: happened is a lot of these lms, especially when you
Speaker 4: put tooling on them, give them agency. They can run things, right,
Speaker 4: they can run in map, they can go scan networks,
Speaker 4: they can do whatever. But a lot of them, a
Speaker 4: lot of the online ones you're chat Gypts and whatever,
Speaker 4: they're not going to allow you to break into a site.
Speaker 4: They're not going to allow you to you know, learn
Speaker 4: how to make a bomb whatever.
Speaker 5: They have guardrails.
Speaker 4: Yeah, what this particular attacker did is obviously learned the
Speaker 4: ways around the guardrails. And sometimes that's downloading the language
Speaker 4: model locally and using a local version like in l
Speaker 4: M Studio or something along those lines, or you know openclaw,
Speaker 4: which we'll talk about later. So there are ways for
Speaker 4: you to use artificial intelligence locally that actually has tools
Speaker 4: that can do things, that can go out and touch things.
Speaker 4: And in this case, they decided to automate as much
Speaker 4: of an attack chain as they could and we've seen
Speaker 4: this anthropic says they stopped an attack from China where
Speaker 4: China was actually using Anthropic to target organizations. This person
Speaker 4: just got much further. We've got one hundred and fifty
Speaker 4: three gig worth of sensitive data, tax records, and all
Speaker 4: sorts of stuff from Mexico.
Speaker 3: So, I mean, this is an example of everything can
Speaker 3: be used for both good and evil. Nuclear power, nuclear weapons,
Speaker 3: you know, biological research, cures for diseases, bio weapons. It's
Speaker 3: true of everything. So the more we lock this stuff
Speaker 3: down so that it can't hack, then what happens when
Speaker 3: we want to have it evaluate our code to see
Speaker 3: what vulnerabilities we can fix. Right, So there's this double
Speaker 3: edged sword we have to figure out, and we haven't
Speaker 3: figured it out yet. It's not we're not anywhere close there. Yeah,
Speaker 3: it's moving faster.
Speaker 4: Well, it's moving fast. I mean it's like, yeah, it's
Speaker 4: like gunpowder, right, gunpowder could be used for good or
Speaker 4: could be used for evil. But if you gave everybody
Speaker 4: on the planet gunpowder the moment it was invented, but
Speaker 4: we'd see a bunch of really crazy stuff until laws
Speaker 4: and regulations in society came came forward and said you
Speaker 4: can't do these things. And we're now starting to see
Speaker 4: that with AI. It's moving so fast and it's in
Speaker 4: the hands of everybody on the planet right anything they
Speaker 4: can imagine they want to do at this point, you know,
Speaker 4: like automatically targeting organizations and stealing data is now becoming
Speaker 4: a possibility. And we talked about this, I think last night.
Speaker 2: Yeah, look at a hammer. Look at a hammer. I
Speaker 2: mean it's got dual uses.
Speaker 4: We use wrenches, sorry, wrenches, wrenches.
Speaker 5: The fight all a wrench, that's right.
Speaker 3: So in this article they do I think they talk
Speaker 3: down by the bottom about the fact that Anthropic has
Speaker 3: changed their commitment to safety, and it's not the commitments
Speaker 3: to safety. The military is trying to get them to rollback.
Speaker 3: And I need to acknowledge a mistake I made in
Speaker 3: the last episode.
Speaker 4: I said that you don't make mistakes there I did.
Speaker 3: I said, Pete Hay says never saw a war, and
Speaker 3: he did actually deploy, and he did get two Bronze Stars,
Speaker 3: but neither one of them was for valor. They're more meritorious.
Speaker 3: So I still think he's not competent for the job.
Speaker 3: But he did see war zones and get a cib
Speaker 3: so I Will.
Speaker 2: Was his dad, the guy that handed out the stars.
Speaker 3: Well, I mean I got a bronze star for my
Speaker 3: firefight in the first Golf War. It wasn't a valorous one.
Speaker 3: It's not with valid I didn't charge a machine gun, nest.
Speaker 3: He got one for professionalism and commitment to excellence to
Speaker 3: help build a stable Iraq. No mention of any combat there.
Speaker 5: That sounds like a gold star.
Speaker 3: And then the next one was in Afghanistan. He was
Speaker 3: a counter surgeon instructor and he acted in a dangerous situation,
Speaker 3: which probably means he was just in range of something.
Speaker 5: Got it.
Speaker 3: But so I don't like to be wrong, so I
Speaker 3: want to make that correction. But I still think he's
Speaker 3: an idiot. So Patrick, bring it on, Man, bring it on.
Speaker 3: So the Anthropic changed their commitment, and the commitment was
Speaker 3: pretty out there in my opinion. It was like they
Speaker 3: wanted to make sure they didn't build an AI they
Speaker 3: couldn't prove was safe. Okay, again, like I just said,
Speaker 3: this dual use technologies. Everything has a sinister side. And
Speaker 3: they kind of came to the realization that it was
Speaker 3: moving so fast that if they kept to this pledge,
Speaker 3: they'd lose that did. And and right now, one of
Speaker 3: the things that we've seen, and I digressed a little
Speaker 3: bit is open AI went in and tried to scoop
Speaker 3: the military contract from Anthropic and it it fail, bailed
Speaker 3: disastrously because the backlash against them. I read that they
Speaker 3: had a two hundred and ninety five percent increase in cancelations.
Speaker 4: Oh yeah, like one point five million or something like that,
Speaker 4: cancelations in service.
Speaker 3: Which is probably worth more than the contract will be
Speaker 3: worth that they're after. So Anthropic lost a contract probably
Speaker 3: with the government, and is won many many more devoted fans.
Speaker 3: And Open Ai has now shown that they'll basically do
Speaker 3: anything for a buck. And so I think what's happening
Speaker 3: is we could very well see this as the decision
Speaker 3: point that decides which one ultimately wins. I'm not calling
Speaker 3: the race yet, but I think this was actually a
Speaker 3: good thing, for a good fight for Anthropic to pick.
Speaker 2: You know, I saw a story today and I'll add
Speaker 2: it to the show. Notes that Anthropic CEO says company
Speaker 2: no longer sure whether or not Claude is conscious.
Speaker 3: Oh wow, Yeah, that's that's bs.
Speaker 2: They can't say definitively whether it is conscious.
Speaker 3: I believe that that is total BS. I think that
Speaker 3: that is either he's being intentionally obtuse or he's an
Speaker 3: idiot in that regard, because if you understand how large
Speaker 3: language models work, they'll never they don't understand what they're saying,
Speaker 3: they don't understand what they're what they're hearing. They'll never
Speaker 3: be conscious. I'll put stake my life you.
Speaker 2: I know people that fall into that category too, though, I.
Speaker 3: Mean, and maybe they're not conscious. That's why I advocate
Speaker 3: killing them.
Speaker 2: Tom. If you think about and I know those of
Speaker 2: us in the software world, we know how these things,
Speaker 2: what these things are made of, and they're made of
Speaker 2: algorithms and software, but you know, at the if you
Speaker 2: break down what the brain does and how thoughts work
Speaker 2: and how words are put together, they are kind of
Speaker 2: something like when I when I think about what to say,
Speaker 2: sometimes my synapse is misfired and it comes out to statistical.
Speaker 3: I do not count the fact that there will someday
Speaker 3: be a computer that is conscious and that has consciousness.
Speaker 3: I don't disagree with that at all. I do not
Speaker 3: believe lllms will ever lead to that. I believe it
Speaker 3: will be another jump and it could be a much
Speaker 3: further jump. So yeah, we can debate it.
Speaker 2: This is just the language part of them.
Speaker 3: But also remember one thing, all these Silicon Valley CEOs,
Speaker 3: they are raising billions and tens of billions and even
Speaker 3: hundreds of billions on the back of this hype for AGI.
Speaker 3: So there's an old story that says, an old saying
Speaker 3: that says, you can never convince a man to believe
Speaker 3: that which his paycheck depends on him not believing.
Speaker 2: Right, All right, let's move on. Hacker new says clawjacked,
Speaker 2: flaw lets, malicious sites hijack local open claw AI agents
Speaker 2: via web socket. Man, here's what I know about web sockets.
Speaker 2: There's like sockets that you connect to with a yeah yeah,
Speaker 2: that you connect to at an IP address. But they're
Speaker 2: all over port eighty so they go right through firewalls.
Speaker 2: So what what is this all about?
Speaker 4: So this this is interesting. Poor open claw has been
Speaker 4: in the news constantly.
Speaker 2: Yeah, I mean, that's great.
Speaker 3: You misunderstood.
Speaker 2: Wow, wow, he was a good guy. Yeah.
Speaker 4: So what's happening is there's a local website. So when
Speaker 4: you install open claw, there's a local management website where
Speaker 4: obviously it's you can put a password on it. But
Speaker 4: that's how you log in and you do things, right,
Speaker 4: you you know, set up agents, trusted computers, all sorts
Speaker 4: of other stuff, right. You know, that's your interface to
Speaker 4: this locally running agentic AI. But it's only accessible on
Speaker 4: what's called local host right, right, So for those of
Speaker 4: you who aren't sort of networking, it didn't didn't grow
Speaker 4: up in the networking world. Local host is your computer,
Speaker 4: but it's a little bit more unique than that. The
Speaker 4: address that resolves to local hosts. So every computer on
Speaker 4: the Internet obviously has an IP address. In your home,
Speaker 4: your computer has an IP dress that's called non routable. Yeah,
Speaker 4: so you're not you.
Speaker 2: Can't access it from outside your local network.
Speaker 4: Yeah, I you know, my house might be one nine
Speaker 4: six eight, you know, zero dot two, Go on, right,
Speaker 4: I know, right, yeah, go ahead, find that IP address.
Speaker 4: But so is ninety nine percent of the rest of
Speaker 4: the planet. Right, Your home addresses are nonroutable. Their computers,
Speaker 4: you know, can talk to each other that way, but
Speaker 4: it's not like I'm connecting to you on that IP.
Speaker 3: All routers on the Internet drop those p exactly.
Speaker 5: Now.
Speaker 4: On top of that, you have another address associated with
Speaker 4: your computer called one two seven dot zero dot zero
Speaker 4: dot one.
Speaker 2: There's no place like home.
Speaker 3: There's no place like one two seven zero zero one. Yes,
Speaker 3: all right, it's a great nerd t shirt because that's
Speaker 3: how right.
Speaker 2: That's your home.
Speaker 4: Yeah, it's your computer. If if anything, any software in
Speaker 4: your computer has to talk to one two seven dot one,
Speaker 4: but one two seven do zero dot zero dot one,
Speaker 4: then it's talking to itself locally. Nobody sees that traffic.
Speaker 4: It doesn't go out over the Internet, it doesn't go
Speaker 4: out over your local network.
Speaker 5: It just talks local.
Speaker 3: So would that cause the average human to set up
Speaker 3: really weak passwords since nobody can access it.
Speaker 4: You should say that, Patrick, It's a great it's a
Speaker 4: great point, Patrick. So let's say you set up your
Speaker 4: open claw and you know it can only be accessed locally.
Speaker 4: You are the only person who can open a browser
Speaker 4: and view that configuration website. And let's say you set
Speaker 4: the password to it to be password because you're like whatever,
Speaker 4: or open claw, yeah, or open clause. It doesn't matter
Speaker 4: because nobody can access it unless they're hands on keys
Speaker 4: at your computer.
Speaker 2: Not so fast.
Speaker 4: Not so fast because communications happen over web sockets, right,
Speaker 4: like Carl had said, And because JavaScript can open web sockets.
Speaker 4: If you visit a malicious website, it will open a
Speaker 4: web socket two one zero zero dot one for the
Speaker 4: open claw web socket port, and it will brute force
Speaker 4: your password and if it finds it, it will add
Speaker 4: the hackers computers as a trusted device. Yeah, and this,
Speaker 4: and then it will dump all the keys and do
Speaker 4: all sorts of stuff.
Speaker 3: So so in this way, the web socket's acting like
Speaker 3: a shell exactly, exactly good good, I mean, play the music,
Speaker 3: because for the play of the.
Speaker 2: Music, guys, all right, go ahead, brand and play the music.
Speaker 4: It's hey, if you need a shell that's not a shell,
Speaker 4: use web sockets.
Speaker 3: Shell class have shells.
Speaker 4: Exactly that's where it should be. So it's an interesting attack.
Speaker 4: We've seen attacks of our web sockets before, but it's
Speaker 4: that weird. I'm safe because nobody can access it unless
Speaker 4: they're at my computer, but realize you're also on your
Speaker 4: computer doing things, and malicious code can then access it
Speaker 4: down way.
Speaker 2: So the pass where it's going to be like password
Speaker 2: with an act or something, nobody will know.
Speaker 4: Set your passwords to security this week. Nobody will gets
Speaker 4: that right, all right, So that was an interesting thing.
Speaker 2: I don't think there's anything that anybody can do about
Speaker 2: it except don't run open claw.
Speaker 4: Come on, I mean yeah, And if you're going to
Speaker 4: run a better password and isolate it from your network
Speaker 4: and don't run it on a computer you're actually sitting at.
Speaker 3: If you get to run anything, you need to understand
Speaker 3: the risks. Yeah's And the problem is most people.
Speaker 5: Don't, right.
Speaker 4: I think Amazon just announced that you can actually deploy
Speaker 4: open claw in their cloud, oh boy, which would actually
Speaker 4: make it super isolated and that sort of stuff. So
Speaker 4: although here's what I'm thinking, that actually might be a
Speaker 4: really great attack path to have a whole take off
Speaker 4: army of Claus sitting up in Amazon. Anyways, Okay, Danne
Speaker 4: dream on. So this one is a PSA. Most Wi
Speaker 4: Fi routers are vulnerable to an air snitch attack. Here's
Speaker 4: what to do. First of all, what's the air snitch?
Speaker 4: So air snitch is what they're dubbing the attack because
Speaker 4: it can be man in the middle. And we've talked
Speaker 4: about these tactics before. So mad in the middle is
Speaker 4: like Carl goes to his bank on the Internet and
Speaker 4: he's doing banking. Now, if I can get in between
Speaker 4: that traffic and in this case, let's assume there's no
Speaker 4: secure socket layers or anything like that. I can to
Speaker 4: see the traffic that's man in the middle, and I
Speaker 4: can manipulate it. I could send back to Carl that
Speaker 4: there's no money in his accounts. I could send to
Speaker 4: the bank that I want to transfer money whatever. Right,
Speaker 4: because I'm in the middle, I get to change that traffic.
Speaker 4: So this air snitch is actually man in the middle
Speaker 4: on Wi Fi. Now, there are some caveats because that
Speaker 4: sounds really bad where they're like, listen, there are no protections.
Speaker 4: You know you're in trouble. Blah blah blah. The way
Speaker 4: Wi Fi typically works is you have a password, right
Speaker 4: that goes along with the Wi Fi, and it has
Speaker 4: to be at least eight characters. We always recommend longer
Speaker 4: than a characters, but it has to be at least as
Speaker 4: long as possible. As long as eight might as well
Speaker 4: be three. But I will tell you, yeah, I know, right,
Speaker 4: I will tell you, like open networks. Go to Starbucks,
Speaker 4: it's an open network, right, Go to the airport. Go
Speaker 4: to the airport, is sit on a delta flight. If
Speaker 4: they're all may go.
Speaker 2: To Chili's and get Chili's Wi Fi.
Speaker 4: Right, there's still networks. So there's no password there, which means.
Speaker 2: So that means there's no encryption.
Speaker 3: Yeah, the barrier to entry is love.
Speaker 2: Because the password is used for encryption.
Speaker 4: Yeah, right, exactly. So what happens is, let's say it's
Speaker 4: not strong, Patrick, Carl and I we're on a you know,
Speaker 4: we're on a delta flight and we're using the Wi Fi.
Speaker 4: And let's say I, being the nefarious hacker, want to
Speaker 4: see who else is on the network, right, And I'm
Speaker 4: going to go and scan that network. And what I'm
Speaker 4: going to find is I see nobody except for me
Speaker 4: in the gateway.
Speaker 5: That's it.
Speaker 4: And the reason being is most public networks like that
Speaker 4: do what's called client isolation, where I can't talk directly
Speaker 4: to Patrick, I can't talk directly to Carl, and Carl
Speaker 4: can't talk to Patrick. Client isolation allows me only talk
Speaker 4: to gateway like v Lance exactly. V Lance is a
Speaker 4: great example of client isolation. What they found with air
Speaker 4: snitch is that level of isolation, if it's on, can
Speaker 4: be bypassed where I can manipulate the traffic to tell
Speaker 4: the router the access point I'm Carl's gateway send all
Speaker 4: of his traffic to me. So what happens is Carl,
Speaker 4: when he gets on that network, he gets isolated. How
Speaker 4: does he get isolated? It's actually a little bit more
Speaker 4: complicated than that. There's a session key between Carl and
Speaker 4: the access point. Then nobody can decrypt, right And there's
Speaker 4: a unique session key from Patrick to that access point,
Speaker 4: and there's unique session key from me to that access point,
Speaker 4: So I can't decrypt that. But if I tell the
Speaker 4: access point Carl has to go to me to get
Speaker 4: to the Internet. What happens is the access point routes
Speaker 4: gets the traffic from Carl, decrypts it, re encrypts it
Speaker 4: with my key, and sends it to me. Then if
Speaker 4: I can do whatever I want with it, and I
Speaker 4: can then send it to the Internet. So it's a
Speaker 4: pretty novel attack when you look at it that way,
Speaker 4: where they found out which layers of Wi Fi they
Speaker 4: can manipulate, whether it's ARP spoofing or whatever that bypasses.
Speaker 3: If Carl's using a VPN, he'll still be protected right absolutely.
Speaker 4: And that's a great point. Like if you're encrypting your
Speaker 4: traffic another so you have that encrypted traffic to your
Speaker 4: access point, but the access point can decrypt it. If
Speaker 4: I'm using a VPN, I already have an encrypted session
Speaker 4: to a remote server, right, So at that point you're
Speaker 4: not going to get mad in the middle.
Speaker 2: And here's the story. You should probably always use a
Speaker 2: VPN when you're using a Wi Fi endpoint that doesn't
Speaker 2: have a password.
Speaker 5: One hundred percent.
Speaker 4: Absolutely, Yeah, attacks like this.
Speaker 2: But here's the problem though. You have to connect to
Speaker 2: the end point before you can enable the VPN, right.
Speaker 4: So you do, yeah, and you're going to connect out
Speaker 4: to that. But what but if I connect to that
Speaker 4: endpoint access point. Let's say I'm on the Delta flight
Speaker 4: again and I go to VPN, my certificate is not
Speaker 4: going to allow me to connect to the remote host
Speaker 4: if it's man in the middle. So what's gonna happen
Speaker 4: is because they unable to connect, unable to connect, unable
Speaker 4: to connect. And if that's the case, shut your laptop
Speaker 4: down and wait until you land.
Speaker 3: You've detected. Yeah, it's a telltale sign that you've got
Speaker 3: somebody yep.
Speaker 4: Yeah, if you're a VPM won't connect, it's they could
Speaker 4: be blocking it. But either way, I would just shut
Speaker 4: it down.
Speaker 3: It's how I It's how I found out find out
Speaker 3: if Dwayne's checked into the hotel yet.
Speaker 4: Exactly if you can VPN in, you know, I'm not
Speaker 4: at the hotel.
Speaker 2: And if you get attacks now, man, I'm in the lobby.
Speaker 2: Don't believe that. Don't believe it's.
Speaker 4: What's weird is this is a very novel, unique attack
Speaker 4: for bypassing client isolation. I have been on plenty of
Speaker 4: networks I've been traveling over the last couple of weeks.
Speaker 4: I've been on plenty of networks over the last couple
Speaker 4: of weeks that did not even have client isolation. I
Speaker 4: could see all of the other clients on that on
Speaker 4: that Wi Fi. So, yeah, this is a WPA three attack.
Speaker 3: So WPA is WPA, WPA two, WPA three, WPA three
Speaker 3: is regarded as the best. It's still the best, Yeah
Speaker 3: it is. I don't think there's a WPA four defined yet.
Speaker 2: I don't know.
Speaker 4: No, there's there are, Like there are tons of RFCs
Speaker 4: for brand new you know whatever is. But your router
Speaker 4: at home is going to be supporting WA three, right, But.
Speaker 3: There's no WPA four to four to support yet that
Speaker 3: that is widely out there, is there? I don't think
Speaker 3: I don't think so, it's been a while since I
Speaker 3: can figured a router.
Speaker 2: All right, you guys ready to move on?
Speaker 5: Yeah, we're ready.
Speaker 2: Hacker News says Europole led operation takes down Tycoon two
Speaker 2: FA fishing as a service linked to sixty four thousand attacks.
Speaker 3: That's awesome.
Speaker 2: Yeah, that is good news.
Speaker 4: Golf Clapp, well done, well done.
Speaker 2: Well done. You So what's the story here? How did
Speaker 2: they find it? And I mean sixty four thousand attacks that,
Speaker 2: I mean, that's every attack could potentially harm you know,
Speaker 2: millions of people.
Speaker 4: Yeah, absolutely, So that's a lot.
Speaker 2: Of a lot of bad stuff. Wow. Yeah.
Speaker 4: And a lot of times the way that these are
Speaker 4: detected is like you'll take something like Proofpoint where they're
Speaker 4: seeing a lot of emails, they're seeing a lot of communications,
Speaker 4: and they start to see a trend in people going
Speaker 4: to hacker dot com for authentication or having links in
Speaker 4: their emails.
Speaker 5: And that's first off.
Speaker 2: So a lot of this is for Joe's fishing as
Speaker 2: a service dot com, right, Yeah.
Speaker 4: So a lot of this is, you know, having the
Speaker 4: proper defenses and monitoring in place that's looking for these
Speaker 4: types of phishing attacks, looking for emails coming in with
Speaker 4: all of the same type of URL going to the
Speaker 4: same type of location, going to an untrusted site. Right,
Speaker 4: there's all sorts of these metrics that are used inside
Speaker 4: of phishing detection. And then what will happen is, you know,
Speaker 4: they'll start gathering some of them and they'll get users
Speaker 4: are probably clicking on them, but they'll they'll start picking
Speaker 4: them all up, and then they put together there's some
Speaker 4: sort of concerted effort to take them down, and a
Speaker 4: lot of times that's organizing with local law enforcement in
Speaker 4: different areas and that sort of stuff, or even ISPs
Speaker 4: to take down these sites.
Speaker 2: Yeah.
Speaker 4: So hey Patrick, Yeah, in the article that they do
Speaker 4: mention a very cool service which I will talk about.
Speaker 2: No, please don't, but you'll have to read the article
Speaker 2: if you want the read the article Career Criminal Advice.
Speaker 4: But I can tell you if you're looking for some
Speaker 4: high end access some really cool data. There's some companies
Speaker 4: mentioned in this article that I know personally.
Speaker 3: Yeah, wow, lose my number. Yeah.
Speaker 2: So Microsoft was kind of involved in this too, right, Yeah.
Speaker 5: Absolutely.
Speaker 2: I mean their logo is right at the top of
Speaker 2: this thing, right below europoll. So did they help out?
Speaker 3: Yeah? Yeah, I think they did.
Speaker 4: Yeah, yeah, I mean sixty two percent. According to this article,
Speaker 4: sixty two percent of these fishing attempts were actually blocked
Speaker 4: by Microsoft. Wow, it's funny. I talked to a lot
Speaker 4: of people about phishing, of course, and they're like, what
Speaker 4: should we do? And should I? You know, how do I?
Speaker 4: And obviously we talk about like user education and training
Speaker 4: and that sort of stuff like, yeah, get your users
Speaker 4: to detect what's going on, right, But I will tell
Speaker 4: you they're like, well do you trust like Microsoft's phishing
Speaker 4: detection and blah blah blah. And I'm like, who do
Speaker 4: you think other than Google sees more emails on the planet?
Speaker 2: Yeah?
Speaker 4: Right, is it? It's probably Microsoft?
Speaker 5: Right?
Speaker 2: Yeah, so they got all the corporate emails.
Speaker 3: Yeah, they have like five hundred million customers.
Speaker 4: Yeah, so I would, I would venture to say, and
Speaker 4: this is this. Somebody can call me out on these statistics,
Speaker 4: but between Google and Microsoft, you're probably looking at about
Speaker 4: eighty to ninety percent of all emails sent on the planet.
Speaker 4: I bet right, So, yeah, I would trust one of
Speaker 4: those two to discover it's a phishing attack over you
Speaker 4: know you?
Speaker 2: Yeah, right, exactly?
Speaker 4: No, even me, Honestly, I'll be honest with you No, I.
Speaker 3: Mean the alarm goes offt never mind, is just the commenter?
Speaker 4: No, I will tell you. Even me, like, our team
Speaker 4: has looked at phishing emails of course all the time,
Speaker 4: because we emulate them and use them and that sort
Speaker 4: of stuff, and there are some that are so good
Speaker 4: we're like, now I think this is real.
Speaker 3: Think the hardest I think the to be the hardest
Speaker 3: target is to be just so parent. Like I call
Speaker 3: you regularly to say did you send this to me?
Speaker 5: Yeah?
Speaker 3: And sometimes it's things I've asked you to send to me.
Speaker 4: I have had customers say, you know what, I passed
Speaker 4: the fishing I passed the fishing tests all the time,
Speaker 4: and I'm like.
Speaker 2: Wow, how do you do that?
Speaker 4: They're like every email that comes in my inbox, I say,
Speaker 4: this is fishing, this is fishing, this is fishing, And
Speaker 4: eventually they send them back going, no, that one's that
Speaker 4: one's good. Nope, that one's good, and see, I'm good.
Speaker 4: I never click on that. I'm like, I was like,
Speaker 4: but what if I send you an email that at
Speaker 4: the bottom says, if you think this is fishing, click here,
Speaker 4: Yeah that'll probably yeah, no problem. If you think this
Speaker 4: is click here come on, yes, credit card to verify
Speaker 4: you're a human. Copy and paste this command.
Speaker 2: All right, very good, we'll be right back after these
Speaker 2: very important messages, and we're back. It's Security this week.
Speaker 2: I'm Carl Franklin, that's Dwayne Laflott and Patrick Hines, and
Speaker 2: we're halfway through the show today. We got a big
Speaker 2: one coming up at the end. But let's go to
Speaker 2: this one. State affiliated hackers set up for critical OT
Speaker 2: attacks that operators may not detect. What is OT in this.
Speaker 3: Case, operational technology?
Speaker 4: Okay, yeah, so anything that runs a pump, power plants,
Speaker 4: dams exactly, go, a water treatment plate, damn power plants, Yeah,
Speaker 4: water treatment plants, nuclear plants, I mean, you name it.
Speaker 4: That's all industrial control systems ROCK, what they call operation control.
Speaker 2: So they're saying that the hackers are getting ready or
Speaker 2: set up for critical infrastructure attacks that operators might not detect.
Speaker 2: That's scary and fascinating at the same time.
Speaker 4: So this is it's complex operation. We always recommend patching
Speaker 4: your computers. We always recommend being on the latest version.
Speaker 4: We always recommend being on the cutting edge because you're
Speaker 4: less likely to be exploited if you have the latest patch. Right,
Speaker 4: but you are more likely to blue screen your computer
Speaker 4: and have to bring it back from death. Yes, And
Speaker 4: where's the probably the one of two places you don't
Speaker 4: want a computer to blue screen, Probably if it's running
Speaker 4: a power grid or it's running an iron lung for
Speaker 4: somebody in a hospital. Right, So those are the two
Speaker 4: places we see computers with default logins. Windows XP never
Speaker 4: been patched, right, because they're just we're gonna it's up
Speaker 4: and running, it's doing what it needs to do. Just
Speaker 4: don't touch it, Please, don't breathe near it, just leave
Speaker 4: it alone. Right, And that's what we're seeing here is
Speaker 4: this is automation of attacks of what they call edge systems,
Speaker 4: which are either older technology, default user names and passwords,
Speaker 4: et cetera. And once they get in, then they start
Speaker 4: to infect the industrial control systems.
Speaker 2: Yeah, so what can we do better?
Speaker 4: We can do better?
Speaker 2: Ye? Can we do better?
Speaker 5: Yeah?
Speaker 4: I mean, honestly, I will tell you there's a couple
Speaker 4: of different things, especially when I'm dealing with operational technology
Speaker 4: OT systems. One isolation that's key, Like if you can't
Speaker 4: change the standard. If Windows XP is unfortunately the only
Speaker 4: thing that can run these devices, the nuclear centrifugeon. Don't
Speaker 4: put it on the internet, right.
Speaker 2: Or at least have a strong VPN. Yeah, and rotate
Speaker 2: the keys like you know, simple stuff.
Speaker 4: Yeah, or or heads up, make it air gapped. I
Speaker 4: know it's inconvenient for an engineer to have to actually
Speaker 4: come into the building and do something, but it's probably
Speaker 4: more secure than having it accessible from home.
Speaker 3: So if it's not convenient, it's not secure.
Speaker 2: That's right.
Speaker 5: If it's convenient, switch.
Speaker 3: If it's not, it's not inconvenient, it's not secure.
Speaker 2: You know.
Speaker 4: Willy Wonka there, good day, sir.
Speaker 3: Roll it back reverse.
Speaker 2: God. I love that movie.
Speaker 5: It is so good.
Speaker 4: So you know that honestly. And if you're ever interested
Speaker 4: in really kind of deep diving into operational technology and
Speaker 4: that sort of stuff, there's a there's a great guy
Speaker 4: who runs a podcast called ot Defender. That's very great guy.
Speaker 4: Awesome pen testing company, but they very much focus on
Speaker 4: operational technology and industrial control.
Speaker 5: So there's a lot of cool stuff there.
Speaker 4: But in short, isolate computers that are controlling industrial control systems,
Speaker 4: have strong passwords and then patch whatever you can.
Speaker 2: Yeah, okay, so let's move on. CVE twenty twenty six,
Speaker 2: DASH two seven nine four. This is engine x.
Speaker 3: A newbie, but a goodie.
Speaker 2: Yeah, it is a a newbie. Yeah, so this is well,
Speaker 2: the story is a newbie engine XUI.
Speaker 3: It's all about back is uh yeah.
Speaker 2: It's a backup disclosure. So if you follow this as
Speaker 2: a hacker wire and if you follow it the links
Speaker 2: down at the bottom, the second one, the artificial intelligence
Speaker 2: analysis is actually pretty good at describing the problem. A
Speaker 2: critical unauthenticated sensitive data disclosure vulnerability and engine XUI a
Speaker 2: web user interface for the engine x web server. This
Speaker 2: flaw carries a CVSS score of nine point eight and
Speaker 2: I just wonder what the other point two percent was
Speaker 2: left off for. Right. An unauthenticated attacker can leverage this
Speaker 2: vulnerability to download a full system backup and immediately decryptic,
Speaker 2: gaining access to highly sensitive data. Probably the reason why
Speaker 2: this is so high this score is because everybody who's
Speaker 2: running Kubernetes or using containers uses engine x because it's
Speaker 2: a lightweight Linux web server that they can run in
Speaker 2: a container and that's the darling of.
Speaker 3: Nanny's and Docker, and as a web server it needs
Speaker 3: to be on the web.
Speaker 5: Right, Yeah, absolutely.
Speaker 3: I think the point too is that it's not delivered
Speaker 3: to your inbox automatically.
Speaker 4: Yeah, there's not a one one button click, I mean,
Speaker 4: and this, you know, this looks like improper permissions on
Speaker 4: certain directories as well. Right, So you're getting access to backups,
Speaker 4: and we look for this all the time when we're
Speaker 4: crawling websites, but in this particular case, there's a slash
Speaker 4: API slash backup directory and there's a place for you
Speaker 4: to then pull the keys for that backup. So so let's.
Speaker 3: Talk about this just for a second. If Dwayne's team
Speaker 3: is going after a server, they identify an IP address
Speaker 3: of interest, they scan it with en map or some
Speaker 3: other tool, it's almost always endmap, and they find that
Speaker 3: engine x ui displays a banner from you know, they
Speaker 3: get a banner and they know it's engine x ui.
Speaker 3: Maybe they don't know the version, maybe they do. And
Speaker 3: then what they do is they, oh, that's a web server.
Speaker 3: Let's go and fuzz and see what directories we can
Speaker 3: access by with unauthenticated And so that's what you're going
Speaker 3: to get back. You're gonna they're gonna try API, they're
Speaker 3: going to try you know, forms, they're gonna try images,
Speaker 3: they're gonna try all those directories points and this one
Speaker 3: would have come back open.
Speaker 2: Not good.
Speaker 4: Yeah, and then from there you just try and pull
Speaker 4: all the information you possibly can out of that directory.
Speaker 4: You try and get a files listing. There's all the
Speaker 4: common things you look for, backup files, API keys, environment variables,
Speaker 4: configuration files, you name it.
Speaker 5: You try and pull it.
Speaker 2: So yeah, not good. A patch is available, so go patch.
Speaker 3: Yeah I cannot this is I wonder if this is
Speaker 3: newly introduced.
Speaker 4: Well, yeah, it's good question because.
Speaker 3: This is something that should have been picked up if
Speaker 3: they did any pen testing at all.
Speaker 4: Use your upgrade to their new engine XS installation version
Speaker 4: two dot three. I'm trying to see if.
Speaker 5: They give it.
Speaker 4: They give prior to version two dot three dot three,
Speaker 4: so it sounds like, wow, it's probably been there a
Speaker 4: while because they didn't say, you know, between two three
Speaker 4: dot one and two three dots.
Speaker 5: They just said prior to.
Speaker 3: If I if I was told an AI found this,
Speaker 3: I wouldn't be impressed, wow, because it's like okay, yeah,
Speaker 3: I mean I one of our interns could find this.
Speaker 4: Yeah, no, I see what you're saying. Yeah, I might
Speaker 4: be impressed that it's been out so long and people
Speaker 4: haven't seen it. Yeah, yeah, right, but you're right, it's
Speaker 4: the level of complexity is low.
Speaker 2: Yeah, all right. We moved on Atomic Edge reports reverse
Speaker 2: engineering a phishing campaign with complex offfuscation. Now this is
Speaker 2: a long article, but it kind of smells like Cliff
Speaker 2: Stole story, like a cuckoo's egg about how this guy
Speaker 2: or this company reverse engineered this fishing campaign and figured
Speaker 2: it out.
Speaker 4: So and it's it's interesting because I love some of
Speaker 4: the tactics and techniques they use here for threat hunting,
Speaker 4: for tracking down this particular campaign. And now I'll tell
Speaker 4: you it takes time. It is funny, like I get it.
Speaker 4: I get it from a lot of customers where they're like,
Speaker 4: you know, ah, here's the email they sent me and
Speaker 4: that's how they got in. Go find them. And I'm like, okay,
Speaker 4: I mean could we Yes, it may represent week's worth
Speaker 4: of work and deoffuscation.
Speaker 2: It's gonna cost a lot of money.
Speaker 4: I peas and like, and what are we gonna do
Speaker 4: when we find them.
Speaker 3: And the logs have to be in place?
Speaker 4: Yeah, and we're gonna go ooh, you you shouldn't have
Speaker 4: done it because they're probably outside the country anyways, and
Speaker 4: we're not going to get them to get extra dided
Speaker 4: like just lock down the systems better. But it is
Speaker 4: cool to watch somebody go through this process and see
Speaker 4: just how hard it is, just how much obfuscation goes
Speaker 4: into changing the code arounds that people can't read it. So,
Speaker 4: you know, because a lot of people say, well, why
Speaker 4: can't anti virus find this, Why can't spam filters find this,
Speaker 4: why can't Microsoft find this? Read through this article and
Speaker 4: see how hard it is to de off use skate
Speaker 4: and understand what's going on in this code, and then
Speaker 4: say why you can't do that on masks and you'll
Speaker 4: know why.
Speaker 2: But it also just says volumes about these people that
Speaker 2: figured it out, just how smart they are.
Speaker 5: Oh yeah, you know, Yeah, it's cool stuff.
Speaker 2: And it's good that we have good guys working on
Speaker 2: our side.
Speaker 5: Agreed.
Speaker 2: Yeah, so that's a happy story. Now the not so
Speaker 2: happy story, Oh boy, here we go. AI chatbots use
Speaker 2: tactical nuclear weapons in ninety five percent of AI war
Speaker 2: games launched. Why they always went launch strategic strikes three times?
Speaker 2: Researcher put GPT five point two, Claude son At four,
Speaker 2: and Gemini three against each other, with at least one
Speaker 2: model using a tactical nuke in twenty out of twenty
Speaker 2: one matches.
Speaker 3: I'm surprised it wasn't twenty two out of twenty one matches.
Speaker 4: Right, Yeah, this is an interesting article.
Speaker 2: And then you listen to the news and they say that,
Speaker 2: you know, the current minuetra is saying they're using AI
Speaker 2: to help fight the war with Iran.
Speaker 3: Yeah, well, they're prioritizing targets, they're they're coordinating. There's definitely
Speaker 3: legitimate uses for as in the military realm, and then
Speaker 3: there's also gray areas, and then there's just really really
Speaker 3: bad ideas. This is a really really bad idea. Everyone
Speaker 3: with half a brain, and I'm not saying everybody does
Speaker 3: knows you don't allow ai' I mean there's just too
Speaker 3: many movies. Yeah, sure, wargames, which is where the title
Speaker 3: comes from, Terminator. I don't need to go any further.
Speaker 3: Those two are so.
Speaker 2: You know, somebody like Richard Campbell would say the current
Speaker 2: fear factor around AI is because of Hollywood, But I
Speaker 2: will tell you it's like, you know, that's the reason
Speaker 2: that we mistrust it. Yeah, then I read articles like this, Yeah.
Speaker 4: But I will tell you sometimes Hollywood actually drives change,
Speaker 4: and they get it. So take, for example, Wargames nineteen
Speaker 4: eighty three War Games. You're Ronald Rake and you're sitting
Speaker 4: at Camp David. You're you're sitting down with your wife
Speaker 4: and your box of popcorn, and you put Wargames on
Speaker 4: the big movie theater there. And this actually happened, and
Speaker 4: he watched it, and he was so freaked out that
Speaker 4: when he went back to DC, he talked to his
Speaker 4: entire cabinet and said, dear God, I saw this movie.
Speaker 4: And he explained the plot, and they went, Now, that
Speaker 4: can't happen, No way, Yeah, that actually might happen. And
Speaker 4: they went and they they actually came out with some
Speaker 4: of the computer interviews, fraud acts from nineteen eighty four
Speaker 4: and that sort of stuff. So like it can drive change,
Speaker 4: the more Hollywood kind of hypes something up and says,
Speaker 4: these might be the possibilities.
Speaker 3: Right, he wrote a strongly worded letter.
Speaker 4: Now, but imagine like we all approached pairing AI with
Speaker 4: robots with no restrictions as a bad thing. Why because
Speaker 4: in our society we've seen movies where people did it
Speaker 4: and it destroyed the humans. Right, So if none of
Speaker 4: those existed, we might go, yeah, well, what could go wrong?
Speaker 4: It's fine, it's just code and really dangerous machines. Let's
Speaker 4: put them together and see what happened.
Speaker 2: And the real fact is, I mean, let's not get
Speaker 2: you a political here, otherwise Patrick will keep us here
Speaker 2: for a half hour. But the reality is nuclear weapons.
Speaker 2: A nuclear weapon was used to stop World War two. Great,
Speaker 2: it can't be used again. It can't. I mean, the
Speaker 2: thread of it is useful. Yeah, once a nuke goes off,
Speaker 2: game over man. Right, Wait, that was from Aliens, now
Speaker 2: that you're mixing.
Speaker 6: All as I thought that was apocalypse now, all right, Well, okay,
Speaker 6: so I think it's fundamentally stupid to try to put
Speaker 6: AI in charge of nuclear There's no need.
Speaker 3: No, we talked about this before.
Speaker 2: There's dangerous.
Speaker 3: There's this fallacy that we need instantaneous decision making, right,
Speaker 3: and we need quick decision making, but not so quick
Speaker 3: that we can't have a human in the loop. And
Speaker 3: so I don't believe the US or any other major
Speaker 3: power that has nukes is going to let AI make
Speaker 3: the decision.
Speaker 5: Now.
Speaker 2: No, I don't think so either.
Speaker 3: I also don't think I'm going to have a you know,
Speaker 3: a doorbell camera that's going to decide whether it uses
Speaker 3: a machine gun or turns on the speaker to talk
Speaker 3: to the person at the door based on a you know,
Speaker 3: facial recognition. There's just fundamentally stupid applications and this is
Speaker 3: one of them. For the process. Now there's the gray
Speaker 3: areas are actually probably much more interesting to talk about
Speaker 3: because they're much more likely to happen, like having a
Speaker 3: fighter identify a target and kill it without any any intervention.
Speaker 3: But I think you're going to have fighters that are said,
Speaker 3: go to this area and kill anything you see that
Speaker 3: matches this description. And we're already doing that with switchblade
Speaker 3: drones and some of the other technologies out there. That's
Speaker 3: where more of a gray area. But but this whole
Speaker 3: like off the chain, AI, I think, I think this
Speaker 3: is this is illustrative of why this is a stupid idea.
Speaker 2: Right sure, all right, So should we worry?
Speaker 3: Patrick, I'm not that worried about it, because I think
Speaker 3: I think as stupid as we are, we're smarter than this.
Speaker 2: Well me worry.
Speaker 3: There's plenty of things to worry about it. This isn't
Speaker 3: This isn't one of them. Unless yeah, because honestly that
Speaker 3: we have if the people who are in charge of
Speaker 3: firing nukes are this stupid, they're going to fire nukes
Speaker 3: on their own anyways.
Speaker 2: Well, the fact is is that, you know, it illustrates
Speaker 2: that AI doesn't think, right, it didn't. It doesn't think
Speaker 2: through you know, it only thinks to.
Speaker 3: Well back to my point, it's not really conscious.
Speaker 2: Well of course, but it doesn't think through the whole process.
Speaker 2: What's the endgame after that?
Speaker 5: Right?
Speaker 2: You know that that's not They only were given the
Speaker 2: goal of defeating the enemy. Okay, but then you know
Speaker 2: their life is one prompt exactly exactly. Yeah.
Speaker 4: Well, and it is interesting you say that, Carl, because
Speaker 4: they will fight for whatever the goal is. But if
Speaker 4: the goal is like win, defeat the enemy and minimize
Speaker 4: human collateral, you know, for the rest of time, right
Speaker 4: then right, maybe maybe the outcome is different.
Speaker 2: Yeah, we got to do it more smart, smart, wicked.
Speaker 3: Smat Someday we may have an AI that is is
Speaker 3: more compassionate than us and smarter than us. But I
Speaker 3: think that's decades and decades away.
Speaker 2: Just got to have it programmed by the Dalai. Lama
Speaker 2: there you go, you know, Lama said my death, I
Speaker 2: rushed the consciousness so I got that comb for me
Speaker 2: and on that note, and his name was Carl in
Speaker 2: that movie. It's okay, that's it, Thank you very much. Hey,
Speaker 2: check out our Discord server RT. Twain.
Speaker 4: Heck yeah, discords where it's at.
Speaker 2: Discord is where it's at. We get a lot of
Speaker 2: ideas from there too.
Speaker 5: So Discord dot security this week dot com.
Speaker 2: Right, So that's all that happened last week, and we'll
Speaker 2: talk to you next week on security this week.
Speaker 7: Bye bye bye, buddy.
Speaker 1: Oh her