Speaker 1: Hey, Carl, here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes, Spotify,
Speaker 1: or wherever you get Security this week. Also, you can
Speaker 1: get an ad free feed by becoming a five dollars
Speaker 1: a month patron. Go to Patreon dot Security this week
Speaker 1: dot com and sign up, and don't forget discord Discord
Speaker 1: dot Security this week dot com. Lots of good stuff
Speaker 1: happening there. Yeah, I think that's it. So on with
Speaker 1: the podcast.
Speaker 2: So, my wife asked me this morning why I was
Speaker 2: speaking so softly around the house. I told her I
Speaker 2: was afraid Mark Zuckerberg was listening to me. She laughed,
Speaker 2: I laughed, Alexa laughed, Siri laughed. All right, let's get
Speaker 2: stated here. We got a story from the record, Russia
Speaker 2: laked malware operation collapses after security failures and developers arrest.
Speaker 3: Poetic justice.
Speaker 2: Poetic justice.
Speaker 4: I love it. I love how it says after security failures,
Speaker 4: this guy's a malware developer. It wasn't security failures on
Speaker 4: what he was exploiting. It was on his own side. Yeah,
Speaker 4: so this developer built a piece of malware called clay rat,
Speaker 4: and clay rat would in effect systems and whatever, right
Speaker 4: Android devices, But in a.
Speaker 3: RAT, you should explain, a RAT is a remote access trojan.
Speaker 4: Yeah, absolutely, Oh okay, so pretend. So that's if you
Speaker 4: want to watch somebody's phone and watch them play you know,
Speaker 4: candy crush on the potty like a RAT. Yeah, exactly,
Speaker 4: on their phone and you can see what they're doing.
Speaker 4: Keep that in mind kids when you're you know, using
Speaker 4: your phone. But anyways, so this guy develops a RAT.
Speaker 4: He has it all obviously communicate back to what we
Speaker 4: call SEE two, which is a commanded control structures. You know,
Speaker 4: he can rake in the doze and then come to
Speaker 4: find out his site has like hundreds of security vulnerabilities,
Speaker 4: plain text passwords that everybody can read, all sorts of stuff.
Speaker 4: So was not hard for the authorities to take a
Speaker 4: peek at the site and take it down and then
Speaker 4: obviously attributed to him.
Speaker 2: He was not listening to our career, criminal career, right,
Speaker 2: come on, now on, it's.
Speaker 4: I mean, if you're gonna if you're going to create
Speaker 4: a command and control structure first stuff which you really
Speaker 4: need to do is route it through AWS, right, because
Speaker 4: nobody's going to block that. And at that point, I mean,
Speaker 4: corporations don't even notice that type of traffic. And if
Speaker 4: you really want to rinse it, then you put it
Speaker 4: through azure. At the same time you no.
Speaker 2: I didn't mean go ahead and give the guys oh
Speaker 2: sorry and everybody else for that matter criminal career?
Speaker 4: Was that not worried? Put that jumped right in. It's
Speaker 4: one of those days people.
Speaker 2: Right, So that's just a fun story to start off
Speaker 2: the week.
Speaker 4: Yeah.
Speaker 2: Absolutely, Let's talk about q NAP q NAP Patches for
Speaker 2: Vulnerabilities exploited it, pone to own to own, pone to own.
Speaker 2: We've talked about this. It's a great yeah sort of conference,
Speaker 2: right where ackers get together and they try to they
Speaker 2: try to hack in and they.
Speaker 4: It's like the it's like the super Bowl of nerds.
Speaker 3: Yeah, you get yeah, and they put up a reward
Speaker 3: and you know, motivate people to help them find vulnerabilities.
Speaker 4: And they're the competitions are awesome. It's like sometimes it's
Speaker 4: against printers. Sometimes they they roll in a tesla and
Speaker 4: say go ahead. Yeah. Absolutely, There's there's a lot of
Speaker 4: really cool stuff that they do, but in this particular case,
Speaker 4: they were targeting.
Speaker 3: The q NAP any human contestants or.
Speaker 4: Less and less, less and less.
Speaker 2: So so this being like a router show, Yeah, this
Speaker 2: is a good first router story. So que app has
Speaker 2: a sd WAN, routers and there were four security defects.
Speaker 4: Yeah yeah, and they also have NAS devices network attached storage,
Speaker 4: so it's the box you plug on a bunch of disk. Yeah,
Speaker 4: they do that. They have routers as well. Yeah. So
Speaker 4: for for very interesting flaws, there are patches that have
Speaker 4: already been created last Friday were released. So if you
Speaker 4: do have the q NAP, whether it's the q net switches,
Speaker 4: whether it's the q NAP NAS device, you just go
Speaker 4: out and patch these. But one of them is actually
Speaker 4: arbitrary code execution, which.
Speaker 3: Is who wrote this article, Twain.
Speaker 4: It wasn't me, I I O nut our Guyer, Yeah,
Speaker 4: thank you.
Speaker 3: It's good pirate names.
Speaker 2: Yeah, it's pirate name.
Speaker 4: Guyer.
Speaker 2: All right, shall we move on?
Speaker 4: I talk all day, we can move on.
Speaker 3: Well, it's good that it was found in a own a.
Speaker 4: Pone yes or pone own, you know, whichever one is fine.
Speaker 4: What's interesting? So digging into the digging into the four
Speaker 4: different exploits though, because they're a bunch of CVEs in here.
Speaker 4: One of them requires the attacker to gain physical access
Speaker 4: of the device. So if the attacker gains physical access,
Speaker 4: they can exploit improper restrictions and communication channels intended for
Speaker 4: certain endpoints. Okay, so okay, that's one of them. The
Speaker 4: next one if the attacker gains access to the local network, right,
Speaker 4: so they broke into a different device, Now they can
Speaker 4: exploit weak authentication uh, through certain protocols. The third one
Speaker 4: is if the attacker gains an administrative account okay, uh,
Speaker 4: then they can actually exploit SQL injection, getting execution and
Speaker 4: arbitrary code execution. And then the fourth one is if
Speaker 4: they if the attacker gains another administrative account, there's another
Speaker 4: improper neutralization of escaping meta sequences that allows control of
Speaker 4: the device. So we say there's four. I think the team,
Speaker 4: if I remember correctly in the article, got paid out
Speaker 4: one hundred grand for finding these four. But if you
Speaker 4: look at them really deeply, like they're pretty critical, severity
Speaker 4: is huge. But two of them, the dude needs to
Speaker 4: be on the network with you, and the other two
Speaker 4: the dude needs an admen account so do debt or
Speaker 4: do debt? Right? I use dude in a sort of
Speaker 4: neutral Well, okay, dude, dude.
Speaker 3: Which is astic bias.
Speaker 4: No, no, no, I'm I'm I'm an equal dude, opportunity guy. Okay,
Speaker 4: I still don't know what the hell you're talking about.
Speaker 4: That's all right, nobody ever does, really, Carl. That's the
Speaker 4: charm of this show.
Speaker 2: That is it is you can you can pretend to
Speaker 2: know what Dwayne's talking about and laugh and everybody will
Speaker 2: think you're super smart. All right, let's move on Aqua's
Speaker 2: Triviy vulnerability scanner hit by supply chain attack. So the
Speaker 2: so the Triviy vulnerability scanner, what is that? Just what
Speaker 2: it sounds like?
Speaker 4: First off? Can we can we also address this is
Speaker 4: also written by I owe nut our guyer? Ok are
Speaker 4: our guy? This guy's on fire this week people.
Speaker 3: Yeah, he's he's everywhere you want to know.
Speaker 4: He is absolutely well done, our guyer. This is this
Speaker 4: is an open source security vulnerability scanner, which is ironic
Speaker 4: that will has worth every penny right exactly has vulnerability
Speaker 4: has like extensions for vs code and we'll look for
Speaker 4: things like you know, top code issues and that sort
Speaker 4: of stuff.
Speaker 3: So it's this is not a tool we used typically.
Speaker 4: No, no, but I mean, you know, having a tool
Speaker 4: that does Stata code analysis and that sort of stuff
Speaker 4: not a bad idea. The problem came, and this is
Speaker 4: where the supply chain risk comes in. They had an
Speaker 4: automated sort of CDCI pipeline, right, Continuous development Continuous integration
Speaker 4: pipe ce IC. Yeah, CICD pipeline. Sorry, a lot of
Speaker 4: those were automated through GitHub actions. Okay, So imagine that
Speaker 4: you have a bunch of keys to a bunch of
Speaker 4: sort of secret places, and then you allow somebody in
Speaker 4: an open source repo who maybe they've made changes before
Speaker 4: that have actually been great, and you allow them on
Speaker 4: the repo and et cetera. But they still don't have
Speaker 4: access to the keys. But what they do is they
Speaker 4: make a build and push it as a PRS as
Speaker 4: a pull request, and the automated actions GitHub actions then
Speaker 4: start building that code and testing the code and making
Speaker 4: sure it actually runs and making sure right because there's
Speaker 4: this entire you know, hey, we're not going to allow
Speaker 4: it into the mean, the main branch unless the code
Speaker 4: builds in runs. Well, during that process, when the code
Speaker 4: goes to run, you have no idea what this person
Speaker 4: just added in the code. And what they do is
Speaker 4: they dump the worker process for GitHub oh, which has
Speaker 4: the memory to coded keys, and then they steal those
Speaker 4: keys and now they have access to do whatever they want,
Speaker 4: approve things, push malicious stuff up into the code repo,
Speaker 4: and that's what which.
Speaker 2: Is what they say they did here. So is this
Speaker 2: a technique you often use? Dwyane?
Speaker 3: Oddly enough? No, defind often.
Speaker 2: Yeah.
Speaker 4: I was gonna say, how about publicly for our customers?
Speaker 3: No?
Speaker 4: Yeah, yeah, I mean a lot of times it's easier
Speaker 4: for us to go through and look at your pipelines
Speaker 4: and how you have been configured than it is for
Speaker 4: us to just kind of hammer away at them. But
Speaker 4: this is an interesting one, right. Nobody really thinks, okay,
Speaker 4: the code that you're actually running in that pipeline may
Speaker 4: actually be vulnerable, and.
Speaker 3: No one expects the Spanish inquisition.
Speaker 4: Nobody sea Takamata.
Speaker 2: So you can't talk about it.
Speaker 3: You can't talk about it, and all of the people
Speaker 3: under forty have no idea what we're talking about.
Speaker 2: One.
Speaker 3: Yeah, a lot of show So HubSpot if it's not
Speaker 3: really it's not related to this, But this HubSpot is
Speaker 3: mentioned here. I heard not HubSpot, get get up, get Up.
Speaker 3: I heard as now you have to opt out for
Speaker 3: your code to not be used in training AI.
Speaker 2: That is right, and I just learned that yesterday before
Speaker 2: this recording, and I same day went to get up
Speaker 2: settings to copilot and right down at the bottom there's
Speaker 2: a you know, allow co pilot to use your code
Speaker 2: to train its models, and it's allowed by default. Now
Speaker 2: you have to opt out.
Speaker 4: Honestly, I'm happy with them using all the code in
Speaker 4: my repost as a training model.
Speaker 3: I have custom and they're not counting on it.
Speaker 4: I'm counting on it. Honestly. I'm really hoping some of
Speaker 4: the code that's in my private repos makes it into
Speaker 4: some massive pieces of software.
Speaker 2: So yeah, well that's true for you, But.
Speaker 4: No, so is it just for public repos or is
Speaker 4: it private repos as well? Wow, that's crazy.
Speaker 2: At up until now all private repos they said they
Speaker 2: would not use the right.
Speaker 3: Right, all right, So is there a oh they gave
Speaker 3: us a year, Is there a give us ad start.
Speaker 2: Patch for this?
Speaker 4: I don't even know what we're talking about anymore?
Speaker 2: Trivy trivy?
Speaker 5: Oh, no patch, they don't use the bad version? Yeah,
Speaker 5: it's it's literally like, don't approve people for your repo,
Speaker 5: especially if you have a CICD pipeline that exposes keys. Right,
Speaker 5: if you're doing automated builds of software, know the randos
Speaker 5: who are submitting stuff.
Speaker 3: So version version zero point sixty nine point four is
Speaker 3: the Mount Militia's version. Don't use that.
Speaker 4: Okay, yeah, exactly. So that's a good point. Patrick. The
Speaker 4: fix quote unquote for get Hub issue is just be
Speaker 4: careful in who you give access to that pipeline. But
Speaker 4: you're right, there was some malicious code built and you
Speaker 4: really should update update to the latest.
Speaker 2: Okay, all right, so let's talk about Oracle.
Speaker 4: Now, let's talk about Oracle.
Speaker 2: Oracle patches critical CVE twenty six twenty one, nine ninety
Speaker 2: two enabling unauthenticated RCE in Identity Manager.
Speaker 3: Remote code execution. Oh no, that's the one. So like
Speaker 3: you got two. I mean you have major categories is
Speaker 3: remote code execution and this privileged escalation PRIVEESK you have
Speaker 3: to have access. Remote code execution gives you access. Yeah,
Speaker 3: so they kind of go hand in hand. Yeah, I mean,
Speaker 3: is this is unauthenticated that's a bad one.
Speaker 4: Yeah, this is a bad one. Honestly. So if you
Speaker 4: are running the Identity Manager or the web Services Manager,
Speaker 4: I mean web Services Manager by its nature is connected
Speaker 4: at the so's identity. So you really do want to
Speaker 4: go out and patch our patches for this. But you
Speaker 4: want to go out and patch.
Speaker 3: It's like if your bathroom door doesn't lock, that's one thing,
Speaker 3: if your front door doesn't lock, that's quite another.
Speaker 4: Right, exactly, So if you are running Oracle Identity Manager
Speaker 4: version twelve dot two dot one dot four and fourteen
Speaker 4: one dot two dot one, or web Services Manager twelve
Speaker 4: dot two dot one dot four or fourteen one dot
Speaker 4: two dot one, right, a lot of numbers, just go patch.
Speaker 2: Okay, Okay, fake, it's time to take a break. M
Speaker 2: So we'll be right back after these very important messages.
Speaker 2: All right, and we're back. It's Security this Week. I'm
Speaker 2: Carl Franklin, that's doing the Flott and Patrick Hines. Next
Speaker 2: story from Security Week. Not Security this Week, that's Security Week.
Speaker 2: They had a good idea there with that title critical
Speaker 2: Langflow vulnerability exploited hours after public disclosure Langflow, what's that?
Speaker 4: Okay, So what's interesting about this story is not langflow
Speaker 4: at all. Like lang flows. Their framework for AI and
Speaker 4: what they call RAG retrieval, augmented generation whatever. It's how
Speaker 4: you store physical documents and then pull them in AI.
Speaker 4: Blah blah blah. Super interesting. I'm sure what's really interesting
Speaker 4: about this article is the fact that the moment that
Speaker 4: this attack, this security risk was there was an advisory
Speaker 4: that came out about it. Within twenty hours, attackers made
Speaker 4: a POC based on the advisory.
Speaker 3: So this is based on what we were talking about before,
Speaker 3: is the zero day clock is ticking down. It's taking
Speaker 3: less and less time from when something is revealed to hey,
Speaker 3: there's a problem here, we'll probably patch it this week,
Speaker 3: or we patched it today, and then twenty hours later
Speaker 3: you've got people actually using an exploit. Well, that's got
Speaker 3: to be AI, or it just happens to be that
Speaker 3: much more qualified hackers are are working quicker. I think
Speaker 3: it's more likely the former than the latter.
Speaker 2: It also, yeah, yeah, I think so too. And it
Speaker 2: could be a combination, right, It could be somebody who
Speaker 2: gets a notification and then goes to an AI and says, hey,
Speaker 2: exploit this.
Speaker 4: Yeah, And you're absolutely right. If I can take a
Speaker 4: look at an advisory and start off with that AI piece, right, like, Hey,
Speaker 4: here's an advisory. What do you think what might be
Speaker 4: the issue? Here's the open source quarter, here's whatever, right,
Speaker 4: and AI goes, oh, this is exploitable. Oh Grey, can
Speaker 4: you give me a script that tests my systems? Right,
Speaker 4: which most the AIS will do because they're trying to
Speaker 4: help you, and then you weaponize it right without an AI.
Speaker 4: So I think you're starting to see the pairing of
Speaker 4: and this is us speculating. Of course we're not sure,
Speaker 4: but you're starting to see the pairing of initial reconnaissance
Speaker 4: and code evaluation based on an advisory being done by
Speaker 4: potentially AI. Right.
Speaker 3: So I don't think this makes everyone a super hacker.
Speaker 3: I think what this does is it makes every malicious
Speaker 3: actor one level high or more dangerous.
Speaker 2: So that's bad.
Speaker 3: But the script kitties who don't understand networking and don't
Speaker 3: really understand the language that they're looking at, they're not
Speaker 3: capable of doing this because there are steps that are
Speaker 3: still manual.
Speaker 2: Yep, So I got a question. So this was patched.
Speaker 2: Version one point eight point one was released on March
Speaker 2: seventeenth with patches. Was it then that they after that
Speaker 2: patch was available, that they did the advisory no, or
Speaker 2: did they do the advisory before it was patched.
Speaker 4: Generally, the advisory comes out before a patch, like, hey, guys,
Speaker 4: just you know, we're seeing XYZ as an attack surface.
Speaker 4: We expect to have a patch out in the next
Speaker 4: couple of days, but you know, shar up your firewalls
Speaker 4: or whatever it is. Right, They like to give an
Speaker 4: advisory beforehand, before they even have a patch, to give
Speaker 4: advice to people who are using this pipeline.
Speaker 2: Do you think that's a good idea in general?
Speaker 3: It might have to stock.
Speaker 4: That is a good question. In the past, I would
Speaker 4: have said, yeah, absolutely, right, absolutely, you should let people
Speaker 4: know if there's a risk, Like, hey, guys, this, you
Speaker 4: know the street out in front of my house, there
Speaker 4: may be a sinkhole. We've had so much rain. You
Speaker 4: should you should know about it. If you're going over it,
Speaker 4: just you know the risk, right, and maybe drive around it.
Speaker 4: But now it's you know, I say, hey, there might
Speaker 4: be a sinkhole there, and somebody goes over and says, oh, wow,
Speaker 4: I know I can exploit this sinkhole. Yeah, drop Patrick's
Speaker 4: car into it. Well, and looking at that zero day
Speaker 4: clock right twenty eighteen, it took two and a half
Speaker 4: years to create an exploit, right, a zero day exploit,
Speaker 4: and now.
Speaker 3: Well for us to see an exploit didn't necessarily take that.
Speaker 3: It's that's when that's the average time it took for
Speaker 3: an exploit to surface in the wild.
Speaker 4: Right.
Speaker 3: So SISA, the cyber agency that basically helps watchdog this
Speaker 3: kind of stuff, they have a known exploitable vulnerability no
Speaker 3: one exploited vulnerably k ev list. And it used to
Speaker 3: be that, you know, once a quarter they'd throw something
Speaker 3: on the key. It's like every day there's something new
Speaker 3: on the k ev less. So it's coming faster and faster.
Speaker 3: So think of it this way. Elite hackers like people
Speaker 3: like Dwayne I think there's a thousand of them around
Speaker 3: the world, people with that level of capability. Maybe maybe
Speaker 3: this two thousand, But now the million people are rung
Speaker 3: below that can do what he was doing two years
Speaker 3: ago because of AI. And so that's a big that's
Speaker 3: a that's three zdos a magnitude increase, and so you're
Speaker 3: going to see a lot more activity. It doesn't mean
Speaker 3: one hundred million or a billion people can do it,
Speaker 3: but a million is a big number to do. To
Speaker 3: have this kind of power. So it's like.
Speaker 2: Dwa any feeling obsolete, not at all.
Speaker 4: Oh if we could only talk about the deeper things
Speaker 4: well to do.
Speaker 3: Honestly, honestly, I only say this. Oh, yeah, Dwayne's moved
Speaker 3: up a level too, so good because now he can
Speaker 3: use it. So we're starting to get to the point
Speaker 3: where a lot of these like you know, top level
Speaker 3: hackers are starting to get scary, like nation states used
Speaker 3: to be.
Speaker 4: Yeah, I don't know.
Speaker 3: I don't want to talk about nation states because that's
Speaker 3: just like.
Speaker 4: You know, massive opinion right there, it is, Yeah, it is.
Speaker 3: Well, we're already we already know. Yeah, we already know that.
Speaker 3: It's like the you know, espionage on the population and
Speaker 3: all the things that Anthropic warned us about.
Speaker 2: Right, Okay, we moved on TP link and the TP
Speaker 2: does not stand for toilet paper, although doesn't discuss that in.
Speaker 4: The past, because that's cool.
Speaker 3: TP Link is trying to convince us that they're not
Speaker 3: a Chinese company anymore and they're based in the US.
Speaker 4: Wait, we don't know why yet. We're going to talk
Speaker 4: about that in a little bit a little foreshadowing.
Speaker 3: I wonder why they do that.
Speaker 2: So let's start. Let's start with the headline tp link
Speaker 2: warns users to patch critical router off bypass flaw. That's
Speaker 2: that's the story.
Speaker 3: It is the story.
Speaker 4: So the big story is they call it a flaw
Speaker 4: with this up. I'm pretty sure most of those are
Speaker 4: shipped with an off bypass, but I could be wrong.
Speaker 3: Yeah, but you're not supposed to know about them.
Speaker 4: So this is Listen, we've seen this before where especially
Speaker 4: actually we've seen this before with tp link, where there
Speaker 4: is a way to send an unauthenticated request. Maybe it's
Speaker 4: for configuration, maybe it's for DHGP, maybe it's for whatever. Right,
Speaker 4: there's a whole bunch of different requests that can happen
Speaker 4: to a router, and then it gives us the ability
Speaker 4: to run code. So in this particular case, yeah, if
Speaker 4: you do, if you're running one of these and you
Speaker 4: really do, you really should go patch, right if you
Speaker 4: have Uh, these are the Archer series. If you're running
Speaker 4: an Archer NX two hundred six hundred router, go patch.
Speaker 4: You're going to pull the patch down from tp link.
Speaker 4: Although in somewhere in Asia and hopefully it's stops.
Speaker 2: We'll find out very shortly. The next story might make
Speaker 2: this whole thing moot.
Speaker 4: Maybe it is crap.
Speaker 2: Maybe it is crap. Well, maybe patching is not.
Speaker 4: Then maybe it's not.
Speaker 2: Does heath kit give you a router kit? Can you
Speaker 2: do that? Can you like make your own router from
Speaker 2: a electronic No?
Speaker 4: Right, I mean we might want them to do that
Speaker 4: after this next story. So could you actually, that's an
Speaker 4: interesting thought, could you? Yes, you could easily get a tiny,
Speaker 4: cheap little box like one of those little Dell Knucks
Speaker 4: or whatever, right, and then put a PF sense on
Speaker 4: it as a firewall, and then plug in a couple
Speaker 4: you know, wireless network cards and put it in an ape.
Speaker 4: So could you build your own? Yeah? You could.
Speaker 3: Actually to be enterprise quality, you'd have to know, you'd
Speaker 3: have to add vulnerabilities.
Speaker 4: Yeah, it's enough vulnerability secure.
Speaker 2: All right. So let's get to the next story, our
Speaker 2: clickbait story. The FCC bands foreign routers, meaning those not
Speaker 2: made in the United States, putting enterprise network risk in focus.
Speaker 3: Dwayne, can you help us out? Can you give us
Speaker 3: the list of a US made routers?
Speaker 2: Sure?
Speaker 4: Ken, Okay, you're done. Yeah, that's it. I'm done.
Speaker 3: That's it.
Speaker 4: This isn't funny, but it's so bad, you know it
Speaker 4: points out an interesting supply chain risk. Right, all of
Speaker 4: the routers used in enterprise and in homes are made
Speaker 4: in somewhere else, made somewhere else, right, Yeah, And it's
Speaker 4: not just all like, oh we're against you know, China
Speaker 4: making routers who they might put exploits in. Like, this
Speaker 4: is all foreign routers. So whether it's made in France,
Speaker 4: whether it's made it doesn't matter. Right. And what's really
Speaker 4: crazy is it also says whether major components, a major
Speaker 4: component of the router put together in a foreign country
Speaker 4: as well. So even if the router is designed here
Speaker 4: but made somewhere else, it's still on the band list.
Speaker 4: And if the router is designed here and forty percent
Speaker 4: of it is still built here, it's still on the
Speaker 4: band list because it's a major component.
Speaker 2: I thought Cisco was a Silicon Valley company.
Speaker 4: Cisco is a Silicon Valley company.
Speaker 3: Yeah.
Speaker 4: Absolutely. They haven't made routers in a long time. They
Speaker 4: they're all offshore. Yeah, they don't have massive, you know,
Speaker 4: farms of places building routers in the United States.
Speaker 2: So are we starting a new company?
Speaker 4: I know, right, Hey, maybe we do that. We have
Speaker 4: sense thing, Maybe we start building routers. Yeah, And it's
Speaker 4: tough too, because you know, Cisco may produce some of
Speaker 4: the router here, but not all of it, right, and
Speaker 4: that that then can also make it susceptible too. Well,
Speaker 4: it wasn't made here. Even if it was, even if
Speaker 4: it's a US friendly country, it doesn't matter.
Speaker 2: He gets got to come back.
Speaker 3: I mean later in the article they say that the
Speaker 3: US produces ten percent of US but maybe they're bending
Speaker 3: the rules to allow some rut of these routers to
Speaker 3: be considered American made, or.
Speaker 2: Maybe it's maybe it's ten percent of the router itself
Speaker 2: is American and the ninety percent of that same router
Speaker 2: as foreign. That's what they're talking.
Speaker 3: Yeah, right, Yeah, I think there's still some vagaries here.
Speaker 3: Hopefully they're they're not going to have. I mean, they
Speaker 3: could pick a winner and say only Cisco qualifies and
Speaker 3: we're giving them an exemption, or only you know, pick
Speaker 3: a vendor.
Speaker 4: Yeah, I want It depends. So here's the other thing.
Speaker 4: I work a lot with DoD and DD contractors and
Speaker 4: that sort of stuff, And when I talk to those guys,
Speaker 4: they will buy a piece of hardware, a router, a
Speaker 4: switch or whatever, and then they will look at all
Speaker 4: the components on that device, and then they will pull
Speaker 4: the components off that have any type of code on
Speaker 4: them and replace them with chips that they sourced and
Speaker 4: that they put from where and whatever on. So could you,
Speaker 4: you know, make one? Yeah, you could, you could? You
Speaker 4: could do that. I just asked. I just asked, chetch Ebt.
Speaker 4: Apparently there's a company called iron Link out of Virginia,
Speaker 4: So everybody should go rush and buy some iron Link.
Speaker 4: They do make, unless it's a hallucination ruggedized wireless wireless routers.
Speaker 4: I got a picture right here. There's a company called
Speaker 4: Netgate never heard of them, out of Texas apparently. And uh,
Speaker 4: protectile that sounds like a disease you'd take a pill for.
Speaker 4: But protect tile apparently.
Speaker 2: Oh wait, hold on, protectile dysfunction wa tile vomiting?
Speaker 4: You know what? I didn't even think about what? Oh,
Speaker 4: never mind. I got all excited. It was like firewall,
Speaker 4: and I was like, yeah, I love fire wallace and
Speaker 4: then in the bottom it says is not US made
Speaker 4: and is often confused as such. Oh I got really
Speaker 4: excited about firewall, like the yeah, well we got to
Speaker 4: do something about this.
Speaker 3: Yeah, I'm sure there'll be more information coming and they'll
Speaker 3: be tracking or exceptions or something along those lines. But
Speaker 3: it's it's pretty silly.
Speaker 2: So if they're banned, does that mean you can't buy
Speaker 2: you won't be able to buy them new? Like is
Speaker 2: the best buy router area completely shelf empty?
Speaker 3: Now?
Speaker 4: Yeah, what will happen is they'll stop getting shipments. They
Speaker 4: won't make it through customs. So what we'll see what happens.
Speaker 4: But yeah, a lot a lot of the routers that
Speaker 4: are being now there are something companies that order parts
Speaker 4: overseas that aren't routers. Right, broadcom chips come you know,
Speaker 4: from overseas. A lot of CPUs are from Taiwan, right,
Speaker 4: PCBs from Asia, but they're not it's not a router
Speaker 4: when it comes in and maybe it's assembled here. So
Speaker 4: we may see some companies trying to bypass regulations that way.
Speaker 2: I have no idea. We'll see what we're gonna have
Speaker 2: to We're gonna have to start at this our channel
Speaker 2: about this because this is going to require some brain
Speaker 2: power to figure out.
Speaker 3: I think the big result is we're going to see
Speaker 3: increase in prices.
Speaker 4: Yeah, yeah, or or a decrease, a decrease honestly, seriously,
Speaker 4: in supply until there is a you know, till Cisco
Speaker 4: decides listen. I mean, here's the other problem. Where do
Speaker 4: you get chips? Right, Like, there's there's not a massive
Speaker 4: amount of CPU slash Wi Fi chip makers in the
Speaker 4: United States. Qual COM's not here, Broadcom's not here, right, So.
Speaker 3: I like freedom lay good chips.
Speaker 4: And on that note, good listener.
Speaker 2: We'll see over in discord. It's that's all the news
Speaker 2: that happened last week, and we'll see you next week
Speaker 2: on security this week, bye bye bye weeks