WEBVTT 1 00:00:00.320 --> 00:00:03.200 Hey Carl here, we're on a mission to find new 2 00:00:03.240 --> 00:00:05.919 fans of the show. I mean, where else can you 3 00:00:05.960 --> 00:00:10.240 get real life comedy and horror in one podcast. You 4 00:00:10.279 --> 00:00:13.000 can do your part by leaving us a review on iTunes, 5 00:00:13.039 --> 00:00:16.719 Spotify or wherever you get security this week. Also, you 6 00:00:16.719 --> 00:00:19.079 can get an ad free feed by becoming a five 7 00:00:19.120 --> 00:00:22.039 dollars a month patron. Go to Patreon dot Security this 8 00:00:22.079 --> 00:00:25.320 week dot com and sign up, and don't forget discord 9 00:00:25.600 --> 00:00:28.519 Discord dot security this week dot com. Lots of good 10 00:00:28.559 --> 00:00:32.320 stuff happening there. Yeah, I think that's it. So on 11 00:00:32.359 --> 00:00:34.560 with the podcast. Hey guys, what do you call a 12 00:00:34.640 --> 00:00:39.000 vegetarian with diarrhea? I don't know, a salad shooter? Oh 13 00:00:39.039 --> 00:00:51.000 my god. All right, Well, enough about that. Let's talk 14 00:00:51.039 --> 00:00:53.719 about the stories this week. I think we have seven. 15 00:00:54.560 --> 00:00:59.359 So let's start with RedHook. Android malware now uses wireless 16 00:00:59.399 --> 00:01:01.960 ADB for shell access. 17 00:01:01.759 --> 00:01:02.560 New and improved. 18 00:01:04.519 --> 00:01:11.120 I honestly love AB slices. It's a debugging bug, right, yeah, 19 00:01:11.280 --> 00:01:16.079 So ADB is Android debugging bridge. The debugging bridge is 20 00:01:16.120 --> 00:01:19.359 obviously if you're if you're writing code, you're writing an 21 00:01:19.400 --> 00:01:22.159 APK or whatever, some sort of program for an Android device. 22 00:01:23.519 --> 00:01:25.439 You generally don't put all your dev tools on there 23 00:01:25.480 --> 00:01:27.200 and you debugging tools and all that KOD stuff, right, 24 00:01:27.239 --> 00:01:30.599 because it's it's a phone, or it's a dishwasher, it's 25 00:01:30.640 --> 00:01:34.040 a refrigerator or whatever. Right, there's all sorts of things 26 00:01:34.040 --> 00:01:37.480 that run Android. So for you to connect into that 27 00:01:37.519 --> 00:01:40.760 device and see everything that's going on, deploy packages or 28 00:01:40.799 --> 00:01:43.760 what we call side loading package packages, that sort of stuff, 29 00:01:44.040 --> 00:01:47.120 you need this debugging bridge, which is typically turned off 30 00:01:48.480 --> 00:01:53.519 on most Android devices. However, we found several ways that 31 00:01:53.560 --> 00:01:57.280 you can turn them on remotely. We found several bugs 32 00:01:57.280 --> 00:02:00.519 and devices TVs namelessly where we can turn them on 33 00:02:00.599 --> 00:02:02.719 and connect in and do all sorts of nefarious things. 34 00:02:04.239 --> 00:02:07.159 So yeah, it's a It is a very very powerful 35 00:02:08.080 --> 00:02:10.439 access to the device to put you know, back doors 36 00:02:10.439 --> 00:02:12.479 and all sorts of stuff. Okay, so you may say, okay, 37 00:02:13.280 --> 00:02:16.080 who cares what happened? What happened here in this case? 38 00:02:16.840 --> 00:02:19.400 Although yes ADB is there and they say, oh my god, 39 00:02:19.439 --> 00:02:22.159 this is like an uh, you know, an autonomous wireless 40 00:02:22.199 --> 00:02:25.520 ADB abuse blah, they still have to trick the victim 41 00:02:25.599 --> 00:02:29.080 to do something. Right. This isn't like this one. I 42 00:02:29.319 --> 00:02:31.240 This one I'd call more hype than anything else. And 43 00:02:31.280 --> 00:02:33.960 I know we talked about having that concept on this show, 44 00:02:34.120 --> 00:02:36.479 like which ones of these are like, oh my god 45 00:02:36.479 --> 00:02:39.120 we should worry about and which ones we shouldn't. This 46 00:02:39.159 --> 00:02:41.479 one somebody's gonna call you up, or somebody's gonna get 47 00:02:41.479 --> 00:02:44.479 you to click on something and have you jump through 48 00:02:44.479 --> 00:02:47.960 a whole bunch of hoops, which people do to turn 49 00:02:48.000 --> 00:02:54.199 on developer options, which people do activate wireless debugging and 50 00:02:54.319 --> 00:02:57.319 then do all sorts of stuff that then huzza, they're in. 51 00:02:57.439 --> 00:02:59.639 So it's not just a stupid switch that someone left 52 00:02:59.680 --> 00:03:03.439 expos Yeah, no, exactly, Like more than twenty years ago 53 00:03:03.479 --> 00:03:06.479 we found AXD files and debugging left on. 54 00:03:07.199 --> 00:03:10.520 This isn't that we're twenty years ago. I love that 55 00:03:10.599 --> 00:03:11.560 more than twenty years ago. 56 00:03:11.599 --> 00:03:13.919 It require stupid people, not stupid switches. 57 00:03:14.199 --> 00:03:19.199 Yeah, we've we've seen debugging files turned on recently. 58 00:03:19.400 --> 00:03:21.400 That's true, but let's not talk about that. 59 00:03:22.439 --> 00:03:25.280 Yes, Wayne, let's not talk about that in certain places 60 00:03:25.319 --> 00:03:28.360 where we can get awesome credit card data anyway. So 61 00:03:28.879 --> 00:03:33.120 that being said, yeah, in this case, if somebody is 62 00:03:33.879 --> 00:03:37.360 walking you through, it'd be like somebody showing up at 63 00:03:37.360 --> 00:03:39.120 your house and being like, hey, i'd really love to 64 00:03:39.120 --> 00:03:40.560 give you a quote for a new roof, you might 65 00:03:40.560 --> 00:03:42.199 if we walk around and look at it, and you go, yeah, sure, 66 00:03:42.199 --> 00:03:43.439 and they were like, to do that, We're going to 67 00:03:43.479 --> 00:03:45.240 need to come in the house, I'm going to need 68 00:03:45.280 --> 00:03:46.960 to grab your key, We're going to need to make 69 00:03:47.000 --> 00:03:50.039 a copy of it. I'm going to go upstairs and 70 00:03:50.080 --> 00:03:53.039 plant some things in the attic just to monitor the roof. 71 00:03:53.039 --> 00:03:55.800 And then you know, we may come back on our 72 00:03:55.840 --> 00:03:58.400 own occasionally. And you're like, yeah, sure, okay, yeah that 73 00:03:58.479 --> 00:04:00.000 makes sense to give me a quote. 74 00:04:00.039 --> 00:04:00.280 Hmm. 75 00:04:00.599 --> 00:04:02.800 Right, So if somebody's jumping you through a whole bunch 76 00:04:02.800 --> 00:04:06.120 of hoops that don't seem to make any sense, yeah, 77 00:04:06.159 --> 00:04:07.560 you're probably doing the wrong stuff. 78 00:04:07.599 --> 00:04:10.520 So this reminds me of a Star Trek Next Generation episode. 79 00:04:10.919 --> 00:04:14.520 The guy that did Max Headroom just kind of shows 80 00:04:14.599 --> 00:04:17.800 up in a ship and and has some they noticed 81 00:04:17.839 --> 00:04:20.720 some temporal anomaly, and then he beams over the Enterprise 82 00:04:20.759 --> 00:04:23.560 and he says he's from the future. He's a historian. 83 00:04:23.800 --> 00:04:24.560 Oh I remember that. 84 00:04:24.720 --> 00:04:27.759 Oh yeah, yeah, he's a historian. He just he wants 85 00:04:27.800 --> 00:04:30.240 to witness this amazing thing that's going on right now, 86 00:04:30.279 --> 00:04:32.240 and they all want to know what happens in the future. 87 00:04:32.279 --> 00:04:35.160 He can't tell them right, right, right, and so he 88 00:04:35.360 --> 00:04:40.959 starts stealing technology and after you know, the thing happens, 89 00:04:41.000 --> 00:04:43.720 which was a coincidence, he says, well, it's time for 90 00:04:43.759 --> 00:04:46.759 me to go, and they say not so fast. Turns 91 00:04:46.759 --> 00:04:49.720 out he was from the past and he's a huckster 92 00:04:50.319 --> 00:04:53.800 and he stole the time travel ship and came two 93 00:04:53.839 --> 00:04:55.639 hundred years into the future. 94 00:04:55.680 --> 00:04:58.680 Started taking tech to get technology so he could invent them. 95 00:04:59.040 --> 00:05:00.839 Yeah, so he could invent them. That's right. He was 96 00:05:00.839 --> 00:05:04.560 an inventor. So that that's kind of what it reminds 97 00:05:04.600 --> 00:05:07.120 me of. You know, you just just be aware when 98 00:05:07.160 --> 00:05:07.959 people tell you. 99 00:05:08.120 --> 00:05:11.279 I'm surprised that Elon husins sewell over his life story. 100 00:05:12.680 --> 00:05:16.399 Wow wow. 101 00:05:17.000 --> 00:05:19.959 All right, so it's an interesting story. Be careful and 102 00:05:20.040 --> 00:05:21.120 that's about all we can say. 103 00:05:21.199 --> 00:05:23.800 Yeah. Absolutely, And you know, for those of you. The 104 00:05:23.839 --> 00:05:25.240 other thing I would say is for those of you 105 00:05:25.279 --> 00:05:27.839 who do develop on Android and have devices connected to 106 00:05:27.839 --> 00:05:32.079 your network and maybe do have the ADB port turned 107 00:05:32.079 --> 00:05:34.040 on on those devices, it may not be a bad 108 00:05:34.040 --> 00:05:36.160 idea to shut off if you're not developing on them, 109 00:05:36.759 --> 00:05:40.959 or keep them on an isolated network. Yeah. So it's 110 00:05:41.120 --> 00:05:45.279 it's not uncommon to be multi homed where I might 111 00:05:45.319 --> 00:05:47.920 have two network cards or you know, I'm talking on 112 00:05:47.959 --> 00:05:53.800 an isolated network, you know v LAN where you know 113 00:05:53.839 --> 00:05:55.959 I'm only talking those devices and they don't have access 114 00:05:56.000 --> 00:05:58.519 to the Internet. So if you do have to turn this on, 115 00:05:58.839 --> 00:06:00.800 just you know what you're doing. Just make sure it's 116 00:06:00.839 --> 00:06:03.079 it's isolated so other people can't connect to it and 117 00:06:03.120 --> 00:06:06.040 put the various things on there like we like to do, 118 00:06:06.160 --> 00:06:07.079 right Patrick. 119 00:06:06.759 --> 00:06:09.839 And advice for everyone. If someone asks you to jump 120 00:06:09.879 --> 00:06:13.839 through hoops, whether it's a person or AI, double check 121 00:06:14.600 --> 00:06:16.800 find out what they're doing, because the ai'll do that too. 122 00:06:16.800 --> 00:06:18.800 When I'm when I'm building systems, a lot of times 123 00:06:18.839 --> 00:06:21.759 it'll try to tell me to do something that's you know, crazy, 124 00:06:21.800 --> 00:06:24.360 and I'm like, you always should understand what you're being 125 00:06:24.360 --> 00:06:25.160 asked to do and why. 126 00:06:25.680 --> 00:06:25.920 Yep. 127 00:06:26.959 --> 00:06:30.959 AIS tend to look a lot like like hackers. Yeah, 128 00:06:31.000 --> 00:06:32.879 so yeah, absolutely, Speaking. 129 00:06:32.639 --> 00:06:35.879 Of AIS and guardrails, I was I got an email 130 00:06:35.959 --> 00:06:40.000 from Microsoft that I had to upgrade my Azure storage 131 00:06:40.000 --> 00:06:44.560 directory from verson GP something from version one to version two. 132 00:06:45.319 --> 00:06:49.439 And it's happening in October, right, and they'll be unavailable 133 00:06:49.480 --> 00:06:51.519 if I don't do it. Now. I don't know what 134 00:06:51.639 --> 00:06:54.079 to do, how to do that. So I opened Codex 135 00:06:54.839 --> 00:06:58.480 and I said, walk me through this. Now Codex doesn't 136 00:06:58.480 --> 00:07:02.199 have access to my accounts or anything, my passwords, my credentials, 137 00:07:02.680 --> 00:07:04.639 but I did log in and I got a PowerShell 138 00:07:04.720 --> 00:07:08.160 session and it basically gave me the commands step by 139 00:07:08.199 --> 00:07:12.199 step to go through and do this for each account. 140 00:07:13.199 --> 00:07:16.879 And it told me it said, look, I don't don't 141 00:07:17.000 --> 00:07:21.240 ever type in passwords and credentials into an AI, including me. 142 00:07:21.959 --> 00:07:24.040 So I thought that was really good that it's said that, 143 00:07:24.240 --> 00:07:28.600 you know, if you just are expected Codex. 144 00:07:28.959 --> 00:07:31.399 Okay, that's good the way. 145 00:07:32.240 --> 00:07:34.759 Yeah, yeah, so it was cool. This is a good experience. 146 00:07:35.600 --> 00:07:36.519 All right, we moved on. 147 00:07:36.800 --> 00:07:37.480 We've moved on. 148 00:07:37.800 --> 00:07:43.079 Yes, attacker uses suspected AI generated PowerShell script to map 149 00:07:43.160 --> 00:07:44.360 active directory. 150 00:07:44.759 --> 00:07:52.079 Oh no, no, I mean okay, so boy meets AI, 151 00:07:52.639 --> 00:07:56.000 AI writes no seriously, Like, so what happens is you 152 00:07:56.160 --> 00:07:59.600 vibe code up something to you know, grab all the 153 00:07:59.600 --> 00:08:01.720 information you can't out of active directories. So for those 154 00:08:01.800 --> 00:08:05.680 of you who aren't network administrators, you know active directory 155 00:08:05.680 --> 00:08:09.680 and a Windows network or usually corporate networks or Windows networks, 156 00:08:09.759 --> 00:08:13.439 it's now called yeah, it's now called oh that's that. 157 00:08:13.439 --> 00:08:14.360 That's the cloud version. 158 00:08:14.439 --> 00:08:17.959 Yeah, Yeah, that's the cloud version is entra. It doesn't matter. 159 00:08:18.040 --> 00:08:20.319 They're the same thing. Whether you're running it on your 160 00:08:20.319 --> 00:08:23.759 own it's active directory, but they're the same thing. It 161 00:08:23.839 --> 00:08:27.680 was stolen by Microsoft in the nineties from Novel anyways, 162 00:08:30.360 --> 00:08:34.320 actually legitimately, and this is the story I heard legitimately. 163 00:08:34.440 --> 00:08:37.759 The story I heard was the head engineer at Novel 164 00:08:38.159 --> 00:08:41.480 got hired away by Microsoft and that's where active directory 165 00:08:41.600 --> 00:08:45.960 came from. Was this engineer anyway? So very similar to 166 00:08:45.960 --> 00:08:47.720 the way that novelle used to work. And most people 167 00:08:47.720 --> 00:08:52.919 are probably thinking, what the hell is novel? Yeah? Did 168 00:08:53.559 --> 00:08:59.759 at history class data history talk about and no anyways? 169 00:09:00.320 --> 00:09:05.000 So I mean to talk about the bindery exactly. Let's 170 00:09:05.000 --> 00:09:08.960 go in to buyd dns from the seventies. So needless 171 00:09:09.000 --> 00:09:11.440 is say active directory is. Think of it as like 172 00:09:11.679 --> 00:09:18.879 a hierarchical database of objects that are have permissions and 173 00:09:19.039 --> 00:09:21.679 rights to certain things on your network. And those objects 174 00:09:21.720 --> 00:09:24.360 may be users, they might be desktops, they might be whatever. Right, 175 00:09:26.559 --> 00:09:28.559 most of the time people just think of the users, right, 176 00:09:28.639 --> 00:09:31.200 But computers are in there too. Actually, computers could be 177 00:09:31.200 --> 00:09:33.440 pretty powerful in there. If you can control a computer 178 00:09:33.600 --> 00:09:36.240 or a machine account. There's all sorts of fun stuff 179 00:09:36.279 --> 00:09:38.600 you can do. There was actually a really cool exploit 180 00:09:38.639 --> 00:09:41.279 where you could create as a normal user. If you 181 00:09:41.279 --> 00:09:44.320 could breach a network and grab normal user credentials, you 182 00:09:44.360 --> 00:09:48.080 could create up to five fake machines and then store 183 00:09:48.120 --> 00:09:50.320 them in active directory and then give them all sorts 184 00:09:50.320 --> 00:09:55.120 of special rights and yeah, anyways, that being said, games 185 00:09:55.279 --> 00:09:59.759 geeks play, Yeah, yeah, yeah. So in this particular case, yes, 186 00:10:00.080 --> 00:10:05.919 I'm attacker used vibe coding to go and cull information 187 00:10:06.080 --> 00:10:10.000 out of out of a active directory that they gained 188 00:10:10.200 --> 00:10:14.440 access to through remote desktop. So it doesn't it's not 189 00:10:14.720 --> 00:10:18.039 super clear as to whether remote desktop was installed and 190 00:10:18.120 --> 00:10:22.879 connected to the internet, whether it was they they get 191 00:10:22.879 --> 00:10:23.440 asked to us. 192 00:10:23.600 --> 00:10:25.440 But basically what it did is it looked for the 193 00:10:25.480 --> 00:10:29.679 domain controller and then mapped users, computers and domains, and 194 00:10:29.679 --> 00:10:33.440 then created a directory and exported a number of files 195 00:10:33.440 --> 00:10:37.440 and finally creating a report, an HTML report to measure 196 00:10:37.440 --> 00:10:40.759 the success of the enumeration attempt. So, you know, it 197 00:10:40.799 --> 00:10:44.399 was a I think it's a script that you would write. 198 00:10:44.639 --> 00:10:46.919 You know, that seems like something that you could do. 199 00:10:47.080 --> 00:10:48.399 Did they say what? 200 00:10:48.039 --> 00:10:48.080 What? 201 00:10:48.399 --> 00:10:51.039 What tipped them off that it was Ai've generated? I mean, 202 00:10:51.080 --> 00:10:55.120 the beautiful output console output, Yeah, with different colors maybe 203 00:10:55.159 --> 00:10:56.000 a tip off. 204 00:10:56.399 --> 00:10:59.279 Yeah, absolutely, a lot of times over engineered code, it 205 00:10:59.320 --> 00:11:03.720 says I Usually, like anytime you have an icon that's 206 00:11:03.759 --> 00:11:05.639 spit out, like hey, this is the users and this 207 00:11:05.759 --> 00:11:08.720 little user icon spits out on the terminal window, you're like, oh, yeah, 208 00:11:08.759 --> 00:11:11.080 that was a code because no programmers wouldn't do that, 209 00:11:11.200 --> 00:11:13.559 No developer whatever spend the time to find the right 210 00:11:13.679 --> 00:11:15.240 unicode for that icon. 211 00:11:15.600 --> 00:11:18.799 And the colors too, like that said, beautiful console output 212 00:11:18.879 --> 00:11:20.320 using cyan green red ye. 213 00:11:20.679 --> 00:11:22.720 Just no, not gonna do it. 214 00:11:22.799 --> 00:11:25.279 Is that because is that because developers don't have any taste? 215 00:11:25.759 --> 00:11:29.320 Is perfluis doesn't matter? 216 00:11:29.399 --> 00:11:32.840 Yes, exactly. It's because it's because we're efficient, is what 217 00:11:32.879 --> 00:11:37.159 it is. Patrick efficient. So is this novel? Like, oh 218 00:11:37.200 --> 00:11:41.200 my god, now you can't like no, we use tools 219 00:11:41.200 --> 00:11:43.639 like this all the time. Uh, you know, whether it's 220 00:11:43.639 --> 00:11:46.919 Pincastle or Bloodhound or whatever. There's all sorts of tools 221 00:11:47.200 --> 00:11:51.080 for enumerating active directory that are legitimate tools that you 222 00:11:51.120 --> 00:11:54.679 can buy a license to and use, and some of them, 223 00:11:54.759 --> 00:11:58.240 oddly enough, are free tools you can just download and use. 224 00:11:58.639 --> 00:12:00.639 So this is the most puzzling thing for me, is 225 00:12:00.679 --> 00:12:06.120 this this person decided to write their own when there's 226 00:12:06.120 --> 00:12:08.519 so many of them out there that exists that anti 227 00:12:08.600 --> 00:12:11.840 virus generally won't find because they're actually legitimate tools. 228 00:12:11.879 --> 00:12:18.200 But so here's your criminal career advice. If you're going 229 00:12:18.240 --> 00:12:20.879 to use AI to generate a script that you plan 230 00:12:20.960 --> 00:12:23.759 to use to make an attack, don't make it spit 231 00:12:23.840 --> 00:12:26.360 out colors and icons for Christ's. 232 00:12:26.000 --> 00:12:29.679 Sake, exactly. And maybe your first prompt should be is 233 00:12:29.720 --> 00:12:33.759 there already a tool that does this ruse? And that 234 00:12:33.879 --> 00:12:36.480 might be save you a couple tokens that you can 235 00:12:36.559 --> 00:12:37.840 use later on for important things. 236 00:12:37.879 --> 00:12:41.000 That's always the first question. Has this been done before? 237 00:12:41.039 --> 00:12:42.120 Where can I get it? Yep? 238 00:12:42.240 --> 00:12:43.440 Absolutely all right? 239 00:12:44.039 --> 00:12:46.440 So was the did they catch the guy or the 240 00:12:46.559 --> 00:12:47.279 girl or whatever? 241 00:12:47.639 --> 00:12:50.519 It's ongoing? It looks like ongoing. 242 00:12:50.600 --> 00:12:56.200 Okay. Next, SISA warns admins to patch actively exploited SharePoint 243 00:12:56.240 --> 00:13:01.120 flaws SharePoint who runs share Point? In two six? 244 00:13:01.320 --> 00:13:03.840 You know that was the most that was the most 245 00:13:03.840 --> 00:13:06.320 shocking part of this story, Carl, I know, because that 246 00:13:06.440 --> 00:13:11.639 was like I read that Wrongs probably runs it. Yeah, yeah, 247 00:13:11.679 --> 00:13:14.840 probably that's I think. Keep track of all those exploits. 248 00:13:15.080 --> 00:13:21.240 Uh yeah. The US Cybersecurity and Infrastructure Security Agency oh, 249 00:13:21.279 --> 00:13:22.679 I don't think you should have the word of security 250 00:13:22.720 --> 00:13:25.759 twice in the name, but whatever. SISA warns today that 251 00:13:25.879 --> 00:13:31.000 attackers are actively exploiting three vulnerabilities to hack Internet exposed 252 00:13:31.440 --> 00:13:37.879 on premise SharePoint servers. Let me unpack that again. Internet 253 00:13:37.960 --> 00:13:43.320 exposed on premise share point servers? 254 00:13:43.399 --> 00:13:44.240 What could go wrong? 255 00:13:44.360 --> 00:13:51.480 If you, my dear listener, have an Internet exposed on premise. 256 00:13:52.720 --> 00:13:55.320 Anything, then you you are only listening to this show 257 00:13:55.399 --> 00:13:56.120 while you sleep. 258 00:13:56.399 --> 00:13:56.919 That's right? 259 00:13:57.360 --> 00:14:03.840 I never yeah, like what, no, that's no. Like if 260 00:14:03.879 --> 00:14:07.000 you had okay, if you had to have SharePoint and 261 00:14:07.039 --> 00:14:09.200 you had to have people have access to it, you 262 00:14:09.279 --> 00:14:10.840 got to use something like a VPN, you got to 263 00:14:10.879 --> 00:14:13.559 hide a point something, because there's so many different ways 264 00:14:13.559 --> 00:14:16.120 to manipulate things like Sharepoints designed to be an open 265 00:14:16.200 --> 00:14:19.080 architecture of documents and sharing in that sort of time. 266 00:14:19.240 --> 00:14:22.039 It was designed before people even gave a rat's butt 267 00:14:22.120 --> 00:14:22.960 about security. 268 00:14:23.120 --> 00:14:27.559 Absolutely, and I can't tell it. I call SharePoint the 269 00:14:27.679 --> 00:14:31.759 cat of document libraries because it has nine lives. Every 270 00:14:31.799 --> 00:14:33.759 time I've heard about SharePoint, they're like, you know what 271 00:14:33.759 --> 00:14:35.960 they're getting rid of it? Yeah, sharep and nobody's gonna 272 00:14:36.000 --> 00:14:38.399 use it anymore. And then it's like, oh share points back, 273 00:14:38.440 --> 00:14:42.639 look at that. So it's fascinating though, that you would 274 00:14:42.639 --> 00:14:45.919 take a SharePoint server and then decide to manage it 275 00:14:46.000 --> 00:14:48.600 on your own, not put it up in the cloud 276 00:14:48.639 --> 00:14:51.000 where you have you know, people who are watching at 277 00:14:51.039 --> 00:14:53.480 twenty four to seven and know exactly what they're doing. 278 00:14:53.600 --> 00:14:56.440 I mean, Microsoft's made it really hard to host anything anymore. 279 00:14:56.960 --> 00:15:01.039 We gave up on I tried heroically, you did heroically 280 00:15:01.159 --> 00:15:03.480 to keep us hosting our own exchange, and it just 281 00:15:03.519 --> 00:15:07.159 made it impossible. I assume SharePoint is far, far beyond that. 282 00:15:07.279 --> 00:15:12.200 I fought Patrick tooth and nail, fought Patrick, and I 283 00:15:12.279 --> 00:15:14.440 was like, I will burn this server to the ground. Yeah, 284 00:15:14.519 --> 00:15:16.480 there's no need for us to maintain it. Well, it 285 00:15:16.559 --> 00:15:19.039 used to be back in the day, which was a Wednesday, Carl, 286 00:15:19.159 --> 00:15:22.360 thank you, Back in the day context managing your own 287 00:15:22.440 --> 00:15:24.399 if you were in the cloud and the cloud went down, 288 00:15:24.440 --> 00:15:26.000 you were so well right. 289 00:15:25.879 --> 00:15:28.720 But we made that switch over ten years ago. Oh absolutely, 290 00:15:28.759 --> 00:15:30.639 But it's not like we made the switch last Monday. 291 00:15:30.799 --> 00:15:34.279 No no, no, no, no. But like twenty years ago, fifteen 292 00:15:34.360 --> 00:15:36.840 years ago, if if Microsoft was down for a day, 293 00:15:36.879 --> 00:15:39.799 it wasn't unheard of. Yeah, right, for Office three sixty five. 294 00:15:39.840 --> 00:15:43.440 You go down and then you just didn't get email right, 295 00:15:43.480 --> 00:15:45.519 and we weren't willing to do that, and that's why 296 00:15:45.559 --> 00:15:47.399 we were hosting it, just to give you a little 297 00:15:47.399 --> 00:15:50.440 bit of props. Patrick Well, and we also had taught 298 00:15:50.480 --> 00:15:53.000 the Microsoft course on how to manage. 299 00:15:52.879 --> 00:15:55.320 We did do that. So actually do you remember the 300 00:15:55.320 --> 00:15:56.120 SharePoint course? 301 00:15:56.279 --> 00:15:56.480 I do. 302 00:15:56.720 --> 00:15:58.720 Yeah, we were the first to teach it as far 303 00:15:58.759 --> 00:16:01.320 as I know. And we had to talk to the course, right, 304 00:16:01.360 --> 00:16:03.679 I think it's long enough that we can talk about this, yes, 305 00:16:03.759 --> 00:16:05.679 to get that, and they were like, oh, I'm sorry, man, 306 00:16:05.879 --> 00:16:07.200 I'm sorry. 307 00:16:07.919 --> 00:16:12.639 Sahil Malick did a DVD SharePoint training for Franklin's Net. 308 00:16:12.720 --> 00:16:15.440 Oh I know a lot of people that made a 309 00:16:15.440 --> 00:16:19.080 lot of money writing share Yeah, aps, but that doesn't 310 00:16:19.120 --> 00:16:19.879 mean there was secure. 311 00:16:20.000 --> 00:16:23.320 Yeah that the the developer of the course was actually 312 00:16:23.320 --> 00:16:27.559 in our class and sat down and is watching it. 313 00:16:27.639 --> 00:16:30.679 And then when when labs and demos didn't work, we 314 00:16:30.840 --> 00:16:37.919 just looked over explains really really exactly and they were 315 00:16:37.960 --> 00:16:42.080 just like, we're so sorry, just keep moving but nothing anyway. 316 00:16:42.279 --> 00:16:44.480 The long and short of it is this, this was 317 00:16:44.519 --> 00:16:47.799 a you know, of vulnerability and it's patched isn't it. 318 00:16:48.000 --> 00:16:51.879 And yeah, absolutely so, SISA added three actively exploited, so 319 00:16:51.879 --> 00:16:54.679 they were actually seeing these exploited in the wild, you know, 320 00:16:54.720 --> 00:16:57.320 twenty twenty six three two two one, twenty twenty six 321 00:16:57.399 --> 00:17:00.639 four five six nine, and twenty twenty six five six 322 00:17:00.759 --> 00:17:04.279 one six four. This is April fourteenth, July first, and 323 00:17:04.400 --> 00:17:08.359 July fourteenth, so two of these are reasonably new. But 324 00:17:08.559 --> 00:17:10.759 you are absolutely gonna want to make sure that you 325 00:17:10.880 --> 00:17:13.119 go patch pit patch, patch, patch. 326 00:17:13.079 --> 00:17:16.279 Patchy patchy patch. All right, well, let's patch our way 327 00:17:16.319 --> 00:17:18.640 to a break and we'll be right back after these 328 00:17:18.759 --> 00:17:25.200 very important messages and we're back. It's security this week. 329 00:17:25.240 --> 00:17:28.480 I'm Carl, that's doing and Patrick and we got a 330 00:17:28.480 --> 00:17:31.119 few more stories for you here. Ernst and Young discloses 331 00:17:31.240 --> 00:17:36.839 data breach after support system hack. So hey, guess what 332 00:17:36.920 --> 00:17:39.480 another data breach? Do you think people are just like yawn? 333 00:17:40.640 --> 00:17:43.599 I think so. I mean, I've I've had family members 334 00:17:43.640 --> 00:17:46.519 come to me and be like what else could they take? Yeah, Like, honestly, 335 00:17:46.559 --> 00:17:51.519 there's not much that I haven't like, social security member, address, 336 00:17:52.079 --> 00:17:55.519 credit card number, pass where it's like there's really not much. Helse, 337 00:17:55.640 --> 00:17:57.799 so lock your credit account. We told you how to 338 00:17:57.839 --> 00:18:01.119 do that before. Yeah, and you know, be change your 339 00:18:01.240 --> 00:18:03.079 passwords in your password. 340 00:18:02.680 --> 00:18:06.400 Managers, change all your money for gold, exchange all your 341 00:18:06.400 --> 00:18:07.640 money for golden, ammo. 342 00:18:09.839 --> 00:18:12.799 Both one golden. 343 00:18:13.799 --> 00:18:16.119 Yeah, that doesn't kill were wolves. 344 00:18:16.400 --> 00:18:18.400 Oh yeah, but if it's silver, it'll kill. 345 00:18:18.480 --> 00:18:21.960 Yeah, it's silver, Emma, and then you're good, sell it, 346 00:18:22.000 --> 00:18:26.240 shoot it whatever. Yeah. This this is this is another 347 00:18:26.359 --> 00:18:29.359 sort of story we've seen time and time again over 348 00:18:29.400 --> 00:18:32.000 I'd say, over the last two years, this has been 349 00:18:32.000 --> 00:18:37.440 more and more prevalent. Third parties support ticketing system managed 350 00:18:37.480 --> 00:18:43.160 by somebody else, not Ernst and Young gets breached supply chain, right, listen, 351 00:18:43.279 --> 00:18:45.720 Ernst and Young is they're they're good at what they do. 352 00:18:45.799 --> 00:18:50.440 They actually have an auditing and cyber division, this particular 353 00:18:50.440 --> 00:18:56.759 one that says Ernst you and offers tax consulting and 354 00:18:57.039 --> 00:19:00.640 transaction advisory services to major organizations in one hundred and 355 00:19:00.640 --> 00:19:02.680 fifty countries, so not a small organization. 356 00:19:02.799 --> 00:19:02.960 You know. 357 00:19:03.000 --> 00:19:07.279 What they didn't mention in this article is how many 358 00:19:07.319 --> 00:19:09.960 records that you know, they are customers. 359 00:19:10.039 --> 00:19:13.319 They're they're good at what they do, so when they 360 00:19:13.359 --> 00:19:16.799 got breached, they know exactly what to say, which is nothing. 361 00:19:17.160 --> 00:19:19.000 Yeah, they're not like anything really. 362 00:19:18.839 --> 00:19:21.000 Yeah, because they will say they're not going to say 363 00:19:21.200 --> 00:19:23.440 what records were breached. They're not going to say what 364 00:19:23.599 --> 00:19:25.680 the attackers had access to. They're not going to say. 365 00:19:25.880 --> 00:19:29.440 They're not going to say anything unless it forensically is 366 00:19:29.640 --> 00:19:33.119 identified as true, and then they'll put a letter out. 367 00:19:33.160 --> 00:19:35.119 So the letter of the law is they need to 368 00:19:35.160 --> 00:19:39.079 notify their user the potential user base, that some of 369 00:19:39.119 --> 00:19:43.160 their data may potentially have been leaked, and then they 370 00:19:43.200 --> 00:19:45.720 don't have to exactly say what was leaked until the 371 00:19:45.720 --> 00:19:50.160 forensics audit is done, which may take forever. Right, So the. 372 00:19:50.160 --> 00:19:52.799 Article does say the company employs four hundred and six 373 00:19:52.960 --> 00:19:56.200 thousand people and reported a global revenue of fifty three 374 00:19:56.279 --> 00:19:58.839 point two billion dollars last year. 375 00:19:59.319 --> 00:20:02.160 The other thing that it's interesting, I like humble bragging, 376 00:20:02.440 --> 00:20:06.720 I know, right, yeah, you know, we're small whatever, just 377 00:20:06.720 --> 00:20:10.039 a little company, just fifty four billion, fifty three to 378 00:20:10.039 --> 00:20:12.279 two really, I. 379 00:20:12.200 --> 00:20:14.279 Mean that is small by AI standards. 380 00:20:14.319 --> 00:20:18.599 But yeah, yeah, I mean, so from the attackers had 381 00:20:18.680 --> 00:20:21.839 access to the platform from March twenty eighth to April twelfth, 382 00:20:22.319 --> 00:20:27.839 and then Ian Ernst and Young and whoever the third 383 00:20:27.880 --> 00:20:31.680 party is didn't notice it till later on twenty third. 384 00:20:31.720 --> 00:20:34.200 It was like, yeah, till the twenty third, So there 385 00:20:34.279 --> 00:20:36.519 was a fair bit of time where the attackers were 386 00:20:36.559 --> 00:20:40.160 in there for weeks pulling information and then finally they went, 387 00:20:40.279 --> 00:20:43.039 oh crap, somebody's been in here. And that points to 388 00:20:43.079 --> 00:20:45.880 another issue like what was where's the auditing in here? 389 00:20:45.960 --> 00:20:48.480 Why was it found weeks and weeks afterwards and not 390 00:20:48.599 --> 00:20:52.000 immediately during exfiltration of the data? Right? So I think 391 00:20:52.160 --> 00:20:53.640 a lot of that may come out as well. 392 00:20:53.680 --> 00:20:58.039 All right, so big mystery right now? Okay, Well, next story. 393 00:20:58.119 --> 00:21:03.519 SISA urges immediate action on actively exploited Fortinet flaws. 394 00:21:03.480 --> 00:21:07.799 Are old friends at Fortinet, Carl, what is this fortunet 395 00:21:07.880 --> 00:21:08.559 you talk about? 396 00:21:08.640 --> 00:21:11.119 I don't know. I've never heard of it before. They're 397 00:21:11.160 --> 00:21:12.759 only in every episode. 398 00:21:13.400 --> 00:21:15.960 Well, listeners, if you were a reoccurring character, this is 399 00:21:16.000 --> 00:21:19.160 the first episode you've listened to, But you too will 400 00:21:19.160 --> 00:21:21.000 get fordinite one percent of your episodes. 401 00:21:21.079 --> 00:21:24.440