WEBVTT 1 00:00:00.320 --> 00:00:03.200 Hey, Carl, here, we're on a mission to find new 2 00:00:03.240 --> 00:00:05.919 fans of the show. I mean, where else can you 3 00:00:05.960 --> 00:00:10.240 get real life comedy and horror in one podcast. You 4 00:00:10.279 --> 00:00:13.640 can do your part by leaving us a review on iTunes, Spotify, 5 00:00:13.759 --> 00:00:16.879 or wherever you get Security this week. Also, you can 6 00:00:16.920 --> 00:00:19.399 get an ad free feed by becoming a five dollars 7 00:00:19.399 --> 00:00:22.239 a month patron. Go to Patreon dot Security this week 8 00:00:22.320 --> 00:00:26.160 dot com and sign up, and don't forget discord Discord 9 00:00:26.199 --> 00:00:28.839 dot Security this week dot com. Lots of good stuff 10 00:00:28.879 --> 00:00:32.439 happening there. Yeah, I think that's it. So on with 11 00:00:32.560 --> 00:00:33.719 the podcast. 12 00:00:33.840 --> 00:00:36.159 So, my wife asked me this morning why I was 13 00:00:36.200 --> 00:00:39.439 speaking so softly around the house. I told her I 14 00:00:39.479 --> 00:00:43.679 was afraid Mark Zuckerberg was listening to me. She laughed, 15 00:00:44.240 --> 00:00:57.399 I laughed, Alexa laughed, Siri laughed. All right, let's get 16 00:00:57.439 --> 00:01:01.600 stated here. We got a story from the record, Russia 17 00:01:01.799 --> 00:01:07.760 laked malware operation collapses after security failures and developers arrest. 18 00:01:08.079 --> 00:01:09.120 Poetic justice. 19 00:01:09.599 --> 00:01:10.480 Poetic justice. 20 00:01:10.560 --> 00:01:14.040 I love it. I love how it says after security failures, 21 00:01:14.359 --> 00:01:16.959 this guy's a malware developer. It wasn't security failures on 22 00:01:17.000 --> 00:01:21.040 what he was exploiting. It was on his own side. Yeah, 23 00:01:21.480 --> 00:01:28.239 so this developer built a piece of malware called clay rat, 24 00:01:29.159 --> 00:01:32.239 and clay rat would in effect systems and whatever, right 25 00:01:32.359 --> 00:01:35.319 Android devices, But in a. 26 00:01:35.359 --> 00:01:38.239 RAT, you should explain, a RAT is a remote access trojan. 27 00:01:38.319 --> 00:01:42.400 Yeah, absolutely, Oh okay, so pretend. So that's if you 28 00:01:42.439 --> 00:01:46.000 want to watch somebody's phone and watch them play you know, 29 00:01:46.480 --> 00:01:49.680 candy crush on the potty like a RAT. Yeah, exactly, 30 00:01:49.760 --> 00:01:51.799 on their phone and you can see what they're doing. 31 00:01:52.239 --> 00:01:54.840 Keep that in mind kids when you're you know, using 32 00:01:54.879 --> 00:01:57.799 your phone. But anyways, so this guy develops a RAT. 33 00:01:57.879 --> 00:02:00.079 He has it all obviously communicate back to what we 34 00:02:00.120 --> 00:02:02.920 call SEE two, which is a commanded control structures. You know, 35 00:02:02.959 --> 00:02:07.239 he can rake in the doze and then come to 36 00:02:07.239 --> 00:02:11.319 find out his site has like hundreds of security vulnerabilities, 37 00:02:11.319 --> 00:02:14.360 plain text passwords that everybody can read, all sorts of stuff. 38 00:02:14.479 --> 00:02:19.039 So was not hard for the authorities to take a 39 00:02:19.039 --> 00:02:20.919 peek at the site and take it down and then 40 00:02:21.039 --> 00:02:22.360 obviously attributed to him. 41 00:02:22.680 --> 00:02:26.919 He was not listening to our career, criminal career, right, 42 00:02:27.439 --> 00:02:29.479 come on, now on, it's. 43 00:02:33.840 --> 00:02:35.280 I mean, if you're gonna if you're going to create 44 00:02:35.280 --> 00:02:37.400 a command and control structure first stuff which you really 45 00:02:37.400 --> 00:02:40.039 need to do is route it through AWS, right, because 46 00:02:40.039 --> 00:02:42.479 nobody's going to block that. And at that point, I mean, 47 00:02:42.879 --> 00:02:45.319 corporations don't even notice that type of traffic. And if 48 00:02:45.360 --> 00:02:47.000 you really want to rinse it, then you put it 49 00:02:47.000 --> 00:02:48.599 through azure. At the same time you no. 50 00:02:48.639 --> 00:02:52.159 I didn't mean go ahead and give the guys oh 51 00:02:52.280 --> 00:02:57.000 sorry and everybody else for that matter criminal career? 52 00:02:57.800 --> 00:03:02.479 Was that not worried? Put that jumped right in. It's 53 00:03:02.520 --> 00:03:04.080 one of those days people. 54 00:03:04.560 --> 00:03:06.800 Right, So that's just a fun story to start off 55 00:03:06.840 --> 00:03:07.120 the week. 56 00:03:07.319 --> 00:03:07.599 Yeah. 57 00:03:07.599 --> 00:03:11.280 Absolutely, Let's talk about q NAP q NAP Patches for 58 00:03:11.759 --> 00:03:16.080 Vulnerabilities exploited it, pone to own to own, pone to own. 59 00:03:16.199 --> 00:03:20.840 We've talked about this. It's a great yeah sort of conference, 60 00:03:20.919 --> 00:03:23.159 right where ackers get together and they try to they 61 00:03:23.159 --> 00:03:24.560 try to hack in and they. 62 00:03:24.840 --> 00:03:26.919 It's like the it's like the super Bowl of nerds. 63 00:03:27.280 --> 00:03:29.639 Yeah, you get yeah, and they put up a reward 64 00:03:29.719 --> 00:03:33.759 and you know, motivate people to help them find vulnerabilities. 65 00:03:33.080 --> 00:03:37.400 And they're the competitions are awesome. It's like sometimes it's 66 00:03:37.400 --> 00:03:40.599 against printers. Sometimes they they roll in a tesla and 67 00:03:40.599 --> 00:03:43.759 say go ahead. Yeah. Absolutely, There's there's a lot of 68 00:03:43.759 --> 00:03:46.360 really cool stuff that they do, but in this particular case, 69 00:03:46.400 --> 00:03:47.360 they were targeting. 70 00:03:47.039 --> 00:03:49.439 The q NAP any human contestants or. 71 00:03:51.520 --> 00:03:53.280 Less and less, less and less. 72 00:03:53.360 --> 00:03:56.719 So so this being like a router show, Yeah, this 73 00:03:56.960 --> 00:04:01.080 is a good first router story. So que app has 74 00:04:01.319 --> 00:04:08.439 a sd WAN, routers and there were four security defects. 75 00:04:08.680 --> 00:04:13.120 Yeah yeah, and they also have NAS devices network attached storage, 76 00:04:14.000 --> 00:04:16.439 so it's the box you plug on a bunch of disk. Yeah, 77 00:04:16.480 --> 00:04:20.040 they do that. They have routers as well. Yeah. So 78 00:04:20.160 --> 00:04:24.279 for for very interesting flaws, there are patches that have 79 00:04:24.439 --> 00:04:27.639 already been created last Friday were released. So if you 80 00:04:27.680 --> 00:04:30.759 do have the q NAP, whether it's the q net switches, 81 00:04:31.600 --> 00:04:35.120 whether it's the q NAP NAS device, you just go 82 00:04:35.199 --> 00:04:37.560 out and patch these. But one of them is actually 83 00:04:38.000 --> 00:04:39.839 arbitrary code execution, which. 84 00:04:39.680 --> 00:04:41.439 Is who wrote this article, Twain. 85 00:04:43.000 --> 00:04:52.519 It wasn't me, I I O nut our Guyer, Yeah, 86 00:04:52.639 --> 00:04:53.040 thank you. 87 00:04:53.879 --> 00:04:55.000 It's good pirate names. 88 00:04:55.879 --> 00:04:57.480 Yeah, it's pirate name. 89 00:04:59.240 --> 00:04:59.560 Guyer. 90 00:05:02.199 --> 00:05:03.959 All right, shall we move on? 91 00:05:05.879 --> 00:05:07.480 I talk all day, we can move on. 92 00:05:07.600 --> 00:05:10.439 Well, it's good that it was found in a own a. 93 00:05:10.480 --> 00:05:15.000 Pone yes or pone own, you know, whichever one is fine. 94 00:05:15.680 --> 00:05:19.199 What's interesting? So digging into the digging into the four 95 00:05:19.319 --> 00:05:22.319 different exploits though, because they're a bunch of CVEs in here. 96 00:05:23.600 --> 00:05:28.439 One of them requires the attacker to gain physical access 97 00:05:28.639 --> 00:05:31.399 of the device. So if the attacker gains physical access, 98 00:05:31.399 --> 00:05:34.920 they can exploit improper restrictions and communication channels intended for 99 00:05:34.959 --> 00:05:38.839 certain endpoints. Okay, so okay, that's one of them. The 100 00:05:38.879 --> 00:05:43.279 next one if the attacker gains access to the local network, right, 101 00:05:43.319 --> 00:05:45.639 so they broke into a different device, Now they can 102 00:05:45.680 --> 00:05:52.120 exploit weak authentication uh, through certain protocols. The third one 103 00:05:52.199 --> 00:05:56.800 is if the attacker gains an administrative account okay, uh, 104 00:05:56.959 --> 00:06:00.600 then they can actually exploit SQL injection, getting execution and 105 00:06:00.759 --> 00:06:05.079 arbitrary code execution. And then the fourth one is if 106 00:06:05.120 --> 00:06:09.079 they if the attacker gains another administrative account, there's another 107 00:06:09.360 --> 00:06:13.879 improper neutralization of escaping meta sequences that allows control of 108 00:06:13.920 --> 00:06:17.560 the device. So we say there's four. I think the team, 109 00:06:17.600 --> 00:06:19.360 if I remember correctly in the article, got paid out 110 00:06:19.399 --> 00:06:22.040 one hundred grand for finding these four. But if you 111 00:06:22.079 --> 00:06:25.759 look at them really deeply, like they're pretty critical, severity 112 00:06:25.800 --> 00:06:28.000 is huge. But two of them, the dude needs to 113 00:06:28.000 --> 00:06:29.720 be on the network with you, and the other two 114 00:06:29.800 --> 00:06:33.480 the dude needs an admen account so do debt or 115 00:06:33.560 --> 00:06:35.519 do debt? Right? I use dude in a sort of 116 00:06:35.600 --> 00:06:41.959 neutral Well, okay, dude, dude. 117 00:06:42.199 --> 00:06:44.040 Which is astic bias. 118 00:06:44.600 --> 00:06:49.560 No, no, no, I'm I'm I'm an equal dude, opportunity guy. Okay, 119 00:06:49.839 --> 00:06:51.439 I still don't know what the hell you're talking about. 120 00:06:51.519 --> 00:06:57.319 That's all right, nobody ever does, really, Carl. That's the 121 00:06:57.439 --> 00:06:58.399 charm of this show. 122 00:06:58.480 --> 00:07:01.560 That is it is you can you can pretend to 123 00:07:01.680 --> 00:07:05.480 know what Dwayne's talking about and laugh and everybody will 124 00:07:05.480 --> 00:07:09.879 think you're super smart. All right, let's move on Aqua's 125 00:07:10.079 --> 00:07:16.600 Triviy vulnerability scanner hit by supply chain attack. So the 126 00:07:17.120 --> 00:07:20.560 so the Triviy vulnerability scanner, what is that? Just what 127 00:07:20.680 --> 00:07:21.279 it sounds like? 128 00:07:21.560 --> 00:07:23.839 First off? Can we can we also address this is 129 00:07:23.879 --> 00:07:28.319 also written by I owe nut our guyer? Ok are 130 00:07:28.680 --> 00:07:31.360 our guy? This guy's on fire this week people. 131 00:07:32.319 --> 00:07:34.680 Yeah, he's he's everywhere you want to know. 132 00:07:36.040 --> 00:07:40.319 He is absolutely well done, our guyer. This is this 133 00:07:40.439 --> 00:07:43.160 is an open source security vulnerability scanner, which is ironic 134 00:07:45.040 --> 00:07:49.519 that will has worth every penny right exactly has vulnerability 135 00:07:49.560 --> 00:07:53.600 has like extensions for vs code and we'll look for 136 00:07:53.680 --> 00:07:56.399 things like you know, top code issues and that sort 137 00:07:56.399 --> 00:07:56.839 of stuff. 138 00:07:57.199 --> 00:07:59.399 So it's this is not a tool we used typically. 139 00:07:59.480 --> 00:08:02.759 No, no, but I mean, you know, having a tool 140 00:08:02.879 --> 00:08:05.279 that does Stata code analysis and that sort of stuff 141 00:08:05.360 --> 00:08:09.279 not a bad idea. The problem came, and this is 142 00:08:09.319 --> 00:08:13.720 where the supply chain risk comes in. They had an 143 00:08:13.759 --> 00:08:23.040 automated sort of CDCI pipeline, right, Continuous development Continuous integration 144 00:08:23.279 --> 00:08:29.360 pipe ce IC. Yeah, CICD pipeline. Sorry, a lot of 145 00:08:29.360 --> 00:08:33.279 those were automated through GitHub actions. Okay, So imagine that 146 00:08:33.320 --> 00:08:34.639 you have a bunch of keys to a bunch of 147 00:08:34.799 --> 00:08:38.159 sort of secret places, and then you allow somebody in 148 00:08:38.200 --> 00:08:41.000 an open source repo who maybe they've made changes before 149 00:08:41.039 --> 00:08:43.200 that have actually been great, and you allow them on 150 00:08:43.200 --> 00:08:45.720 the repo and et cetera. But they still don't have 151 00:08:45.720 --> 00:08:47.759 access to the keys. But what they do is they 152 00:08:47.799 --> 00:08:50.320 make a build and push it as a PRS as 153 00:08:50.320 --> 00:08:54.879 a pull request, and the automated actions GitHub actions then 154 00:08:54.960 --> 00:08:59.000 start building that code and testing the code and making 155 00:08:59.039 --> 00:09:01.600 sure it actually runs and making sure right because there's 156 00:09:01.600 --> 00:09:03.639 this entire you know, hey, we're not going to allow 157 00:09:03.639 --> 00:09:07.480 it into the mean, the main branch unless the code 158 00:09:07.480 --> 00:09:11.399 builds in runs. Well, during that process, when the code 159 00:09:11.440 --> 00:09:14.639 goes to run, you have no idea what this person 160 00:09:14.720 --> 00:09:16.279 just added in the code. And what they do is 161 00:09:16.279 --> 00:09:20.879 they dump the worker process for GitHub oh, which has 162 00:09:20.960 --> 00:09:24.120 the memory to coded keys, and then they steal those 163 00:09:24.159 --> 00:09:27.039 keys and now they have access to do whatever they want, 164 00:09:27.080 --> 00:09:29.799 approve things, push malicious stuff up into the code repo, 165 00:09:29.879 --> 00:09:30.720 and that's what which. 166 00:09:30.480 --> 00:09:32.039 Is what they say they did here. So is this 167 00:09:32.080 --> 00:09:33.840 a technique you often use? Dwyane? 168 00:09:35.039 --> 00:09:37.240 Oddly enough? No, defind often. 169 00:09:37.360 --> 00:09:37.559 Yeah. 170 00:09:37.600 --> 00:09:41.519 I was gonna say, how about publicly for our customers? 171 00:09:41.600 --> 00:09:41.639 No? 172 00:09:42.200 --> 00:09:45.720 Yeah, yeah, I mean a lot of times it's easier 173 00:09:45.720 --> 00:09:49.879 for us to go through and look at your pipelines 174 00:09:49.919 --> 00:09:51.440 and how you have been configured than it is for 175 00:09:51.519 --> 00:09:53.159 us to just kind of hammer away at them. But 176 00:09:53.720 --> 00:09:56.159 this is an interesting one, right. Nobody really thinks, okay, 177 00:09:56.240 --> 00:10:00.240 the code that you're actually running in that pipeline may 178 00:10:00.240 --> 00:10:01.600 actually be vulnerable, and. 179 00:10:01.559 --> 00:10:03.279 No one expects the Spanish inquisition. 180 00:10:03.559 --> 00:10:05.519 Nobody sea Takamata. 181 00:10:06.240 --> 00:10:08.240 So you can't talk about it. 182 00:10:08.320 --> 00:10:11.559 You can't talk about it, and all of the people 183 00:10:11.639 --> 00:10:16.360 under forty have no idea what we're talking about. 184 00:10:16.639 --> 00:10:16.960 One. 185 00:10:17.399 --> 00:10:21.399 Yeah, a lot of show So HubSpot if it's not 186 00:10:21.480 --> 00:10:23.720 really it's not related to this, But this HubSpot is 187 00:10:23.759 --> 00:10:26.759 mentioned here. I heard not HubSpot, get get up, get Up. 188 00:10:26.840 --> 00:10:29.360 I heard as now you have to opt out for 189 00:10:29.480 --> 00:10:31.679 your code to not be used in training AI. 190 00:10:31.919 --> 00:10:35.200 That is right, and I just learned that yesterday before 191 00:10:35.240 --> 00:10:38.399 this recording, and I same day went to get up 192 00:10:38.440 --> 00:10:41.320 settings to copilot and right down at the bottom there's 193 00:10:41.360 --> 00:10:46.120 a you know, allow co pilot to use your code 194 00:10:46.279 --> 00:10:50.159 to train its models, and it's allowed by default. Now 195 00:10:51.000 --> 00:10:52.120 you have to opt out. 196 00:10:52.200 --> 00:10:55.799 Honestly, I'm happy with them using all the code in 197 00:10:55.879 --> 00:10:58.440 my repost as a training model. 198 00:10:59.399 --> 00:11:01.600 I have custom and they're not counting on it. 199 00:11:02.000 --> 00:11:04.440 I'm counting on it. Honestly. I'm really hoping some of 200 00:11:04.480 --> 00:11:07.200 the code that's in my private repos makes it into 201 00:11:07.279 --> 00:11:09.000 some massive pieces of software. 202 00:11:09.039 --> 00:11:13.240 So yeah, well that's true for you, But. 203 00:11:13.240 --> 00:11:16.720 No, so is it just for public repos or is 204 00:11:16.759 --> 00:11:20.320 it private repos as well? Wow, that's crazy. 205 00:11:20.200 --> 00:11:23.480 At up until now all private repos they said they 206 00:11:23.480 --> 00:11:25.679 would not use the right. 207 00:11:25.840 --> 00:11:27.720 Right, all right, So is there a oh they gave 208 00:11:27.799 --> 00:11:31.200 us a year, Is there a give us ad start. 209 00:11:31.360 --> 00:11:31.960 Patch for this? 210 00:11:32.200 --> 00:11:33.960 I don't even know what we're talking about anymore? 211 00:11:34.080 --> 00:11:34.879 Trivy trivy? 212 00:11:35.000 --> 00:11:40.159 Oh, no patch, they don't use the bad version? Yeah, 213 00:11:40.200 --> 00:11:43.200 it's it's literally like, don't approve people for your repo, 214 00:11:43.720 --> 00:11:48.320 especially if you have a CICD pipeline that exposes keys. Right, 215 00:11:48.320 --> 00:11:51.720 if you're doing automated builds of software, know the randos 216 00:11:51.720 --> 00:11:53.120 who are submitting stuff. 217 00:11:53.279 --> 00:11:57.559 So version version zero point sixty nine point four is 218 00:11:58.240 --> 00:12:00.240 the Mount Militia's version. Don't use that. 219 00:12:00.360 --> 00:12:03.399 Okay, yeah, exactly. So that's a good point. Patrick. The 220 00:12:03.519 --> 00:12:06.840 fix quote unquote for get Hub issue is just be 221 00:12:06.919 --> 00:12:09.320 careful in who you give access to that pipeline. But 222 00:12:09.360 --> 00:12:11.720 you're right, there was some malicious code built and you 223 00:12:11.799 --> 00:12:14.000 really should update update to the latest. 224 00:12:14.120 --> 00:12:16.000 Okay, all right, so let's talk about Oracle. 225 00:12:16.000 --> 00:12:17.519 Now, let's talk about Oracle. 226 00:12:17.600 --> 00:12:22.919 Oracle patches critical CVE twenty six twenty one, nine ninety 227 00:12:22.919 --> 00:12:27.440 two enabling unauthenticated RCE in Identity Manager. 228 00:12:27.240 --> 00:12:31.879 Remote code execution. Oh no, that's the one. So like 229 00:12:31.919 --> 00:12:34.840 you got two. I mean you have major categories is 230 00:12:34.840 --> 00:12:39.679 remote code execution and this privileged escalation PRIVEESK you have 231 00:12:39.759 --> 00:12:44.639 to have access. Remote code execution gives you access. Yeah, 232 00:12:44.639 --> 00:12:48.240 so they kind of go hand in hand. Yeah, I mean, 233 00:12:48.600 --> 00:12:51.159 is this is unauthenticated that's a bad one. 234 00:12:51.240 --> 00:12:53.159 Yeah, this is a bad one. Honestly. So if you 235 00:12:53.200 --> 00:12:55.879 are running the Identity Manager or the web Services Manager, 236 00:12:55.919 --> 00:12:59.720 I mean web Services Manager by its nature is connected 237 00:12:59.759 --> 00:13:02.679 at the so's identity. So you really do want to 238 00:13:02.679 --> 00:13:04.159 go out and patch our patches for this. But you 239 00:13:04.200 --> 00:13:05.480 want to go out and patch. 240 00:13:05.960 --> 00:13:08.519 It's like if your bathroom door doesn't lock, that's one thing, 241 00:13:08.559 --> 00:13:10.840 if your front door doesn't lock, that's quite another. 242 00:13:10.720 --> 00:13:14.759 Right, exactly, So if you are running Oracle Identity Manager 243 00:13:14.840 --> 00:13:18.600 version twelve dot two dot one dot four and fourteen 244 00:13:18.600 --> 00:13:21.480 one dot two dot one, or web Services Manager twelve 245 00:13:21.480 --> 00:13:23.919 dot two dot one dot four or fourteen one dot 246 00:13:23.919 --> 00:13:26.320 two dot one, right, a lot of numbers, just go patch. 247 00:13:26.799 --> 00:13:29.879 Okay, Okay, fake, it's time to take a break. M 248 00:13:30.519 --> 00:13:33.320 So we'll be right back after these very important messages. 249 00:13:37.440 --> 00:13:39.919 All right, and we're back. It's Security this Week. I'm 250 00:13:39.960 --> 00:13:43.960 Carl Franklin, that's doing the Flott and Patrick Hines. Next 251 00:13:44.000 --> 00:13:47.519 story from Security Week. Not Security this Week, that's Security Week. 252 00:13:47.919 --> 00:13:51.039 They had a good idea there with that title critical 253 00:13:51.159 --> 00:13:59.039 Langflow vulnerability exploited hours after public disclosure Langflow, what's that? 254 00:13:59.720 --> 00:14:02.720 Okay, So what's interesting about this story is not langflow 255 00:14:02.879 --> 00:14:06.840 at all. Like lang flows. Their framework for AI and 256 00:14:07.120 --> 00:14:10.200 what they call RAG retrieval, augmented generation whatever. It's how 257 00:14:10.240 --> 00:14:12.879 you store physical documents and then pull them in AI. 258 00:14:13.080 --> 00:14:16.639 Blah blah blah. Super interesting. I'm sure what's really interesting 259 00:14:16.639 --> 00:14:20.960 about this article is the fact that the moment that 260 00:14:21.039 --> 00:14:25.919 this attack, this security risk was there was an advisory 261 00:14:26.000 --> 00:14:30.399 that came out about it. Within twenty hours, attackers made 262 00:14:30.440 --> 00:14:32.480 a POC based on the advisory. 263 00:14:32.559 --> 00:14:34.720 So this is based on what we were talking about before, 264 00:14:35.480 --> 00:14:39.960 is the zero day clock is ticking down. It's taking 265 00:14:40.080 --> 00:14:43.919 less and less time from when something is revealed to hey, 266 00:14:43.919 --> 00:14:47.399 there's a problem here, we'll probably patch it this week, 267 00:14:47.559 --> 00:14:51.039 or we patched it today, and then twenty hours later 268 00:14:51.080 --> 00:14:54.519 you've got people actually using an exploit. Well, that's got 269 00:14:54.559 --> 00:14:58.279 to be AI, or it just happens to be that 270 00:14:58.399 --> 00:15:01.679 much more qualified hackers are are working quicker. I think 271 00:15:01.679 --> 00:15:03.440 it's more likely the former than the latter. 272 00:15:03.799 --> 00:15:05.639 It also, yeah, yeah, I think so too. And it 273 00:15:05.639 --> 00:15:08.279 could be a combination, right, It could be somebody who 274 00:15:08.320 --> 00:15:12.360 gets a notification and then goes to an AI and says, hey, 275 00:15:12.480 --> 00:15:13.080 exploit this. 276 00:15:13.360 --> 00:15:16.159 Yeah, And you're absolutely right. If I can take a 277 00:15:16.200 --> 00:15:19.879 look at an advisory and start off with that AI piece, right, like, Hey, 278 00:15:20.039 --> 00:15:21.759 here's an advisory. What do you think what might be 279 00:15:21.799 --> 00:15:24.639 the issue? Here's the open source quarter, here's whatever, right, 280 00:15:25.200 --> 00:15:27.759 and AI goes, oh, this is exploitable. Oh Grey, can 281 00:15:27.799 --> 00:15:31.000 you give me a script that tests my systems? Right, 282 00:15:31.080 --> 00:15:33.759 which most the AIS will do because they're trying to 283 00:15:33.799 --> 00:15:37.399 help you, and then you weaponize it right without an AI. 284 00:15:37.559 --> 00:15:39.720 So I think you're starting to see the pairing of 285 00:15:40.480 --> 00:15:42.879 and this is us speculating. Of course we're not sure, 286 00:15:42.960 --> 00:15:45.639 but you're starting to see the pairing of initial reconnaissance 287 00:15:46.440 --> 00:15:51.120 and code evaluation based on an advisory being done by 288 00:15:51.159 --> 00:15:52.799 potentially AI. Right. 289 00:15:52.879 --> 00:15:57.080 So I don't think this makes everyone a super hacker. 290 00:15:57.159 --> 00:16:00.720 I think what this does is it makes every malicious 291 00:16:00.840 --> 00:16:04.080 actor one level high or more dangerous. 292 00:16:04.200 --> 00:16:04.879 So that's bad. 293 00:16:05.399 --> 00:16:08.759 But the script kitties who don't understand networking and don't 294 00:16:08.799 --> 00:16:13.000 really understand the language that they're looking at, they're not 295 00:16:13.080 --> 00:16:15.320 capable of doing this because there are steps that are 296 00:16:15.320 --> 00:16:16.039 still manual. 297 00:16:16.519 --> 00:16:21.080 Yep, So I got a question. So this was patched. 298 00:16:21.799 --> 00:16:24.799 Version one point eight point one was released on March 299 00:16:24.840 --> 00:16:30.399 seventeenth with patches. Was it then that they after that 300 00:16:30.799 --> 00:16:34.440 patch was available, that they did the advisory no, or 301 00:16:34.480 --> 00:16:36.759 did they do the advisory before it was patched. 302 00:16:36.919 --> 00:16:40.159 Generally, the advisory comes out before a patch, like, hey, guys, 303 00:16:40.399 --> 00:16:45.360 just you know, we're seeing XYZ as an attack surface. 304 00:16:45.879 --> 00:16:47.440 We expect to have a patch out in the next 305 00:16:47.799 --> 00:16:50.679 couple of days, but you know, shar up your firewalls 306 00:16:50.720 --> 00:16:52.120 or whatever it is. Right, They like to give an 307 00:16:52.120 --> 00:16:55.000 advisory beforehand, before they even have a patch, to give 308 00:16:55.039 --> 00:16:57.240 advice to people who are using this pipeline. 309 00:16:57.279 --> 00:16:59.279 Do you think that's a good idea in general? 310 00:16:59.360 --> 00:17:00.320 It might have to stock. 311 00:17:01.679 --> 00:17:04.000 That is a good question. In the past, I would 312 00:17:04.000 --> 00:17:07.039 have said, yeah, absolutely, right, absolutely, you should let people 313 00:17:07.039 --> 00:17:09.640 know if there's a risk, Like, hey, guys, this, you 314 00:17:09.640 --> 00:17:11.400 know the street out in front of my house, there 315 00:17:11.599 --> 00:17:13.880 may be a sinkhole. We've had so much rain. You 316 00:17:13.880 --> 00:17:15.759 should you should know about it. If you're going over it, 317 00:17:15.880 --> 00:17:18.440 just you know the risk, right, and maybe drive around it. 318 00:17:18.880 --> 00:17:21.359 But now it's you know, I say, hey, there might 319 00:17:21.400 --> 00:17:23.880 be a sinkhole there, and somebody goes over and says, oh, wow, 320 00:17:23.880 --> 00:17:27.000 I know I can exploit this sinkhole. Yeah, drop Patrick's 321 00:17:27.000 --> 00:17:29.200 car into it. Well, and looking at that zero day 322 00:17:29.200 --> 00:17:31.640 clock right twenty eighteen, it took two and a half 323 00:17:31.720 --> 00:17:35.079 years to create an exploit, right, a zero day exploit, 324 00:17:35.119 --> 00:17:35.519 and now. 325 00:17:35.440 --> 00:17:37.839 Well for us to see an exploit didn't necessarily take that. 326 00:17:37.920 --> 00:17:40.640 It's that's when that's the average time it took for 327 00:17:40.720 --> 00:17:42.680 an exploit to surface in the wild. 328 00:17:42.920 --> 00:17:43.119 Right. 329 00:17:43.160 --> 00:17:50.720 So SISA, the cyber agency that basically helps watchdog this 330 00:17:50.799 --> 00:17:55.000 kind of stuff, they have a known exploitable vulnerability no 331 00:17:55.039 --> 00:17:58.519 one exploited vulnerably k ev list. And it used to 332 00:17:58.519 --> 00:18:00.920 be that, you know, once a quarter they'd throw something 333 00:18:00.960 --> 00:18:03.200 on the key. It's like every day there's something new 334 00:18:03.200 --> 00:18:06.519 on the k ev less. So it's coming faster and faster. 335 00:18:06.640 --> 00:18:09.920 So think of it this way. Elite hackers like people 336 00:18:10.000 --> 00:18:13.359 like Dwayne I think there's a thousand of them around 337 00:18:13.400 --> 00:18:17.240 the world, people with that level of capability. Maybe maybe 338 00:18:17.279 --> 00:18:22.279 this two thousand, But now the million people are rung 339 00:18:22.440 --> 00:18:26.200 below that can do what he was doing two years 340 00:18:26.240 --> 00:18:30.319 ago because of AI. And so that's a big that's 341 00:18:30.319 --> 00:18:33.359 a that's three zdos a magnitude increase, and so you're 342 00:18:33.400 --> 00:18:35.480 going to see a lot more activity. It doesn't mean 343 00:18:35.759 --> 00:18:38.720 one hundred million or a billion people can do it, 344 00:18:39.359 --> 00:18:42.319 but a million is a big number to do. To 345 00:18:42.400 --> 00:18:44.440 have this kind of power. So it's like. 346 00:18:44.599 --> 00:18:46.559 Dwa any feeling obsolete, not at all. 347 00:18:46.880 --> 00:18:49.039 Oh if we could only talk about the deeper things 348 00:18:49.039 --> 00:18:49.680 well to do. 349 00:18:49.720 --> 00:18:55.119 Honestly, honestly, I only say this. Oh, yeah, Dwayne's moved 350 00:18:55.160 --> 00:18:58.599 up a level too, so good because now he can 351 00:18:58.680 --> 00:19:00.880 use it. So we're starting to get to the point 352 00:19:00.880 --> 00:19:03.079 where a lot of these like you know, top level 353 00:19:03.119 --> 00:19:05.720 hackers are starting to get scary, like nation states used 354 00:19:05.720 --> 00:19:05.920 to be. 355 00:19:06.680 --> 00:19:07.440 Yeah, I don't know. 356 00:19:07.519 --> 00:19:09.839 I don't want to talk about nation states because that's 357 00:19:09.960 --> 00:19:10.359 just like. 358 00:19:10.920 --> 00:19:14.559 You know, massive opinion right there, it is, Yeah, it is. 359 00:19:14.599 --> 00:19:17.279 Well, we're already we already know. Yeah, we already know that. 360 00:19:17.319 --> 00:19:20.640 It's like the you know, espionage on the population and 361 00:19:20.720 --> 00:19:23.519 all the things that Anthropic warned us about. 362 00:19:23.799 --> 00:19:27.920 Right, Okay, we moved on TP link and the TP 363 00:19:28.160 --> 00:19:31.960 does not stand for toilet paper, although doesn't discuss that in. 364 00:19:31.880 --> 00:19:38.720 The past, because that's cool. 365 00:19:39.839 --> 00:19:42.680 TP Link is trying to convince us that they're not 366 00:19:42.839 --> 00:19:45.319 a Chinese company anymore and they're based in the US. 367 00:19:45.519 --> 00:19:47.119 Wait, we don't know why yet. We're going to talk 368 00:19:47.160 --> 00:19:49.279 about that in a little bit a little foreshadowing. 369 00:19:49.480 --> 00:19:50.519 I wonder why they do that. 370 00:19:50.640 --> 00:19:53.240 So let's start. Let's start with the headline tp link 371 00:19:53.279 --> 00:19:57.400 warns users to patch critical router off bypass flaw. That's 372 00:19:57.720 --> 00:19:58.839 that's the story. 373 00:19:59.000 --> 00:19:59.720 It is the story. 374 00:19:59.799 --> 00:20:01.759 So the big story is they call it a flaw 375 00:20:02.319 --> 00:20:05.680 with this up. I'm pretty sure most of those are 376 00:20:05.680 --> 00:20:07.880 shipped with an off bypass, but I could be wrong. 377 00:20:07.960 --> 00:20:09.279 Yeah, but you're not supposed to know about them. 378 00:20:11.359 --> 00:20:14.720 So this is Listen, we've seen this before where especially 379 00:20:14.799 --> 00:20:18.920 actually we've seen this before with tp link, where there 380 00:20:19.119 --> 00:20:23.960 is a way to send an unauthenticated request. Maybe it's 381 00:20:23.960 --> 00:20:27.279 for configuration, maybe it's for DHGP, maybe it's for whatever. Right, 382 00:20:27.319 --> 00:20:29.240 there's a whole bunch of different requests that can happen 383 00:20:29.279 --> 00:20:33.759 to a router, and then it gives us the ability 384 00:20:33.799 --> 00:20:37.400 to run code. So in this particular case, yeah, if 385 00:20:37.400 --> 00:20:38.920 you do, if you're running one of these and you 386 00:20:38.960 --> 00:20:41.359 really do, you really should go patch, right if you 387 00:20:41.440 --> 00:20:44.839 have Uh, these are the Archer series. If you're running 388 00:20:44.839 --> 00:20:49.759 an Archer NX two hundred six hundred router, go patch. 389 00:20:50.440 --> 00:20:52.759 You're going to pull the patch down from tp link. 390 00:20:52.880 --> 00:20:56.160 Although in somewhere in Asia and hopefully it's stops. 391 00:20:56.440 --> 00:20:59.400 We'll find out very shortly. The next story might make 392 00:20:59.480 --> 00:21:00.680 this whole thing moot. 393 00:21:00.759 --> 00:21:01.519 Maybe it is crap. 394 00:21:02.200 --> 00:21:05.640 Maybe it is crap. Well, maybe patching is not. 395 00:21:05.720 --> 00:21:08.400 Then maybe it's not. 396 00:21:10.759 --> 00:21:14.039 Does heath kit give you a router kit? Can you 397 00:21:14.079 --> 00:21:15.960 do that? Can you like make your own router from 398 00:21:15.960 --> 00:21:16.880 a electronic No? 399 00:21:17.119 --> 00:21:20.319 Right, I mean we might want them to do that 400 00:21:20.400 --> 00:21:22.920 after this next story. So could you actually, that's an 401 00:21:22.960 --> 00:21:26.960