Speaker 1: Hey Carl here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes,
Speaker 1: Spotify or wherever you get security this week. Also, you
Speaker 1: can get an ad free feed by becoming a five
Speaker 1: dollars a month patron. Go to Patreon dot Security this
Speaker 1: week dot com and sign up, and don't forget discord
Speaker 1: Discord dot security this week dot com. Lots of good
Speaker 1: stuff happening there. Yeah, I think that's it. So on
Speaker 1: with the podcast. Hey guys, what do you call a
Speaker 1: vegetarian with diarrhea? I don't know, a salad shooter? Oh
Speaker 1: my god. All right, Well, enough about that. Let's talk
Speaker 1: about the stories this week. I think we have seven.
Speaker 1: So let's start with RedHook. Android malware now uses wireless
Speaker 1: ADB for shell access.
Speaker 2: New and improved.
Speaker 3: I honestly love AB slices. It's a debugging bug, right, yeah,
Speaker 3: So ADB is Android debugging bridge. The debugging bridge is
Speaker 3: obviously if you're if you're writing code, you're writing an
Speaker 3: APK or whatever, some sort of program for an Android device.
Speaker 3: You generally don't put all your dev tools on there
Speaker 3: and you debugging tools and all that KOD stuff, right,
Speaker 3: because it's it's a phone, or it's a dishwasher, it's
Speaker 3: a refrigerator or whatever. Right, there's all sorts of things
Speaker 3: that run Android. So for you to connect into that
Speaker 3: device and see everything that's going on, deploy packages or
Speaker 3: what we call side loading package packages, that sort of stuff,
Speaker 3: you need this debugging bridge, which is typically turned off
Speaker 3: on most Android devices. However, we found several ways that
Speaker 3: you can turn them on remotely. We found several bugs
Speaker 3: and devices TVs namelessly where we can turn them on
Speaker 3: and connect in and do all sorts of nefarious things.
Speaker 3: So yeah, it's a It is a very very powerful
Speaker 3: access to the device to put you know, back doors
Speaker 3: and all sorts of stuff. Okay, so you may say, okay,
Speaker 3: who cares what happened? What happened here in this case?
Speaker 3: Although yes ADB is there and they say, oh my god,
Speaker 3: this is like an uh, you know, an autonomous wireless
Speaker 3: ADB abuse blah, they still have to trick the victim
Speaker 3: to do something. Right. This isn't like this one. I
Speaker 3: This one I'd call more hype than anything else. And
Speaker 3: I know we talked about having that concept on this show,
Speaker 3: like which ones of these are like, oh my god
Speaker 3: we should worry about and which ones we shouldn't. This
Speaker 3: one somebody's gonna call you up, or somebody's gonna get
Speaker 3: you to click on something and have you jump through
Speaker 3: a whole bunch of hoops, which people do to turn
Speaker 3: on developer options, which people do activate wireless debugging and
Speaker 3: then do all sorts of stuff that then huzza, they're in.
Speaker 2: So it's not just a stupid switch that someone left
Speaker 2: expos Yeah, no, exactly, Like more than twenty years ago
Speaker 2: we found AXD files and debugging left on.
Speaker 3: This isn't that we're twenty years ago. I love that
Speaker 3: more than twenty years ago.
Speaker 1: It require stupid people, not stupid switches.
Speaker 3: Yeah, we've we've seen debugging files turned on recently.
Speaker 2: That's true, but let's not talk about that.
Speaker 3: Yes, Wayne, let's not talk about that in certain places
Speaker 3: where we can get awesome credit card data anyway. So
Speaker 3: that being said, yeah, in this case, if somebody is
Speaker 3: walking you through, it'd be like somebody showing up at
Speaker 3: your house and being like, hey, i'd really love to
Speaker 3: give you a quote for a new roof, you might
Speaker 3: if we walk around and look at it, and you go, yeah, sure,
Speaker 3: and they were like, to do that, We're going to
Speaker 3: need to come in the house, I'm going to need
Speaker 3: to grab your key, We're going to need to make
Speaker 3: a copy of it. I'm going to go upstairs and
Speaker 3: plant some things in the attic just to monitor the roof.
Speaker 3: And then you know, we may come back on our
Speaker 3: own occasionally. And you're like, yeah, sure, okay, yeah that
Speaker 3: makes sense to give me a quote.
Speaker 1: Hmm.
Speaker 3: Right, So if somebody's jumping you through a whole bunch
Speaker 3: of hoops that don't seem to make any sense, yeah,
Speaker 3: you're probably doing the wrong stuff.
Speaker 1: So this reminds me of a Star Trek Next Generation episode.
Speaker 1: The guy that did Max Headroom just kind of shows
Speaker 1: up in a ship and and has some they noticed
Speaker 1: some temporal anomaly, and then he beams over the Enterprise
Speaker 1: and he says he's from the future. He's a historian.
Speaker 2: Oh I remember that.
Speaker 1: Oh yeah, yeah, he's a historian. He just he wants
Speaker 1: to witness this amazing thing that's going on right now,
Speaker 1: and they all want to know what happens in the future.
Speaker 1: He can't tell them right, right, right, and so he
Speaker 1: starts stealing technology and after you know, the thing happens,
Speaker 1: which was a coincidence, he says, well, it's time for
Speaker 1: me to go, and they say not so fast. Turns
Speaker 1: out he was from the past and he's a huckster
Speaker 1: and he stole the time travel ship and came two
Speaker 1: hundred years into the future.
Speaker 2: Started taking tech to get technology so he could invent them.
Speaker 1: Yeah, so he could invent them. That's right. He was
Speaker 1: an inventor. So that that's kind of what it reminds
Speaker 1: me of. You know, you just just be aware when
Speaker 1: people tell you.
Speaker 2: I'm surprised that Elon husins sewell over his life story.
Speaker 3: Wow wow.
Speaker 1: All right, so it's an interesting story. Be careful and
Speaker 1: that's about all we can say.
Speaker 3: Yeah. Absolutely, And you know, for those of you. The
Speaker 3: other thing I would say is for those of you
Speaker 3: who do develop on Android and have devices connected to
Speaker 3: your network and maybe do have the ADB port turned
Speaker 3: on on those devices, it may not be a bad
Speaker 3: idea to shut off if you're not developing on them,
Speaker 3: or keep them on an isolated network. Yeah. So it's
Speaker 3: it's not uncommon to be multi homed where I might
Speaker 3: have two network cards or you know, I'm talking on
Speaker 3: an isolated network, you know v LAN where you know
Speaker 3: I'm only talking those devices and they don't have access
Speaker 3: to the Internet. So if you do have to turn this on,
Speaker 3: just you know what you're doing. Just make sure it's
Speaker 3: it's isolated so other people can't connect to it and
Speaker 3: put the various things on there like we like to do,
Speaker 3: right Patrick.
Speaker 2: And advice for everyone. If someone asks you to jump
Speaker 2: through hoops, whether it's a person or AI, double check
Speaker 2: find out what they're doing, because the ai'll do that too.
Speaker 2: When I'm when I'm building systems, a lot of times
Speaker 2: it'll try to tell me to do something that's you know, crazy,
Speaker 2: and I'm like, you always should understand what you're being
Speaker 2: asked to do and why.
Speaker 1: Yep.
Speaker 3: AIS tend to look a lot like like hackers. Yeah,
Speaker 3: so yeah, absolutely, Speaking.
Speaker 1: Of AIS and guardrails, I was I got an email
Speaker 1: from Microsoft that I had to upgrade my Azure storage
Speaker 1: directory from verson GP something from version one to version two.
Speaker 1: And it's happening in October, right, and they'll be unavailable
Speaker 1: if I don't do it. Now. I don't know what
Speaker 1: to do, how to do that. So I opened Codex
Speaker 1: and I said, walk me through this. Now Codex doesn't
Speaker 1: have access to my accounts or anything, my passwords, my credentials,
Speaker 1: but I did log in and I got a PowerShell
Speaker 1: session and it basically gave me the commands step by
Speaker 1: step to go through and do this for each account.
Speaker 1: And it told me it said, look, I don't don't
Speaker 1: ever type in passwords and credentials into an AI, including me.
Speaker 1: So I thought that was really good that it's said that,
Speaker 1: you know, if you just are expected Codex.
Speaker 2: Okay, that's good the way.
Speaker 1: Yeah, yeah, so it was cool. This is a good experience.
Speaker 1: All right, we moved on.
Speaker 3: We've moved on.
Speaker 1: Yes, attacker uses suspected AI generated PowerShell script to map
Speaker 1: active directory.
Speaker 3: Oh no, no, I mean okay, so boy meets AI,
Speaker 3: AI writes no seriously, Like, so what happens is you
Speaker 3: vibe code up something to you know, grab all the
Speaker 3: information you can't out of active directories. So for those
Speaker 3: of you who aren't network administrators, you know active directory
Speaker 3: and a Windows network or usually corporate networks or Windows networks,
Speaker 3: it's now called yeah, it's now called oh that's that.
Speaker 1: That's the cloud version.
Speaker 3: Yeah, Yeah, that's the cloud version is entra. It doesn't matter.
Speaker 3: They're the same thing. Whether you're running it on your
Speaker 3: own it's active directory, but they're the same thing. It
Speaker 3: was stolen by Microsoft in the nineties from Novel anyways,
Speaker 3: actually legitimately, and this is the story I heard legitimately.
Speaker 3: The story I heard was the head engineer at Novel
Speaker 3: got hired away by Microsoft and that's where active directory
Speaker 3: came from. Was this engineer anyway? So very similar to
Speaker 3: the way that novelle used to work. And most people
Speaker 3: are probably thinking, what the hell is novel? Yeah? Did
Speaker 3: at history class data history talk about and no anyways?
Speaker 3: So I mean to talk about the bindery exactly. Let's
Speaker 3: go in to buyd dns from the seventies. So needless
Speaker 3: is say active directory is. Think of it as like
Speaker 3: a hierarchical database of objects that are have permissions and
Speaker 3: rights to certain things on your network. And those objects
Speaker 3: may be users, they might be desktops, they might be whatever. Right,
Speaker 3: most of the time people just think of the users, right,
Speaker 3: But computers are in there too. Actually, computers could be
Speaker 3: pretty powerful in there. If you can control a computer
Speaker 3: or a machine account. There's all sorts of fun stuff
Speaker 3: you can do. There was actually a really cool exploit
Speaker 3: where you could create as a normal user. If you
Speaker 3: could breach a network and grab normal user credentials, you
Speaker 3: could create up to five fake machines and then store
Speaker 3: them in active directory and then give them all sorts
Speaker 3: of special rights and yeah, anyways, that being said, games
Speaker 3: geeks play, Yeah, yeah, yeah. So in this particular case, yes,
Speaker 3: I'm attacker used vibe coding to go and cull information
Speaker 3: out of out of a active directory that they gained
Speaker 3: access to through remote desktop. So it doesn't it's not
Speaker 3: super clear as to whether remote desktop was installed and
Speaker 3: connected to the internet, whether it was they they get
Speaker 3: asked to us.
Speaker 1: But basically what it did is it looked for the
Speaker 1: domain controller and then mapped users, computers and domains, and
Speaker 1: then created a directory and exported a number of files
Speaker 1: and finally creating a report, an HTML report to measure
Speaker 1: the success of the enumeration attempt. So, you know, it
Speaker 1: was a I think it's a script that you would write.
Speaker 1: You know, that seems like something that you could do.
Speaker 2: Did they say what?
Speaker 1: What?
Speaker 2: What tipped them off that it was Ai've generated? I mean,
Speaker 2: the beautiful output console output, Yeah, with different colors maybe
Speaker 2: a tip off.
Speaker 3: Yeah, absolutely, a lot of times over engineered code, it
Speaker 3: says I Usually, like anytime you have an icon that's
Speaker 3: spit out, like hey, this is the users and this
Speaker 3: little user icon spits out on the terminal window, you're like, oh, yeah,
Speaker 3: that was a code because no programmers wouldn't do that,
Speaker 3: No developer whatever spend the time to find the right
Speaker 3: unicode for that icon.
Speaker 1: And the colors too, like that said, beautiful console output
Speaker 1: using cyan green red ye.
Speaker 3: Just no, not gonna do it.
Speaker 2: Is that because is that because developers don't have any taste?
Speaker 1: Is perfluis doesn't matter?
Speaker 3: Yes, exactly. It's because it's because we're efficient, is what
Speaker 3: it is. Patrick efficient. So is this novel? Like, oh
Speaker 3: my god, now you can't like no, we use tools
Speaker 3: like this all the time. Uh, you know, whether it's
Speaker 3: Pincastle or Bloodhound or whatever. There's all sorts of tools
Speaker 3: for enumerating active directory that are legitimate tools that you
Speaker 3: can buy a license to and use, and some of them,
Speaker 3: oddly enough, are free tools you can just download and use.
Speaker 3: So this is the most puzzling thing for me, is
Speaker 3: this this person decided to write their own when there's
Speaker 3: so many of them out there that exists that anti
Speaker 3: virus generally won't find because they're actually legitimate tools.
Speaker 1: But so here's your criminal career advice. If you're going
Speaker 1: to use AI to generate a script that you plan
Speaker 1: to use to make an attack, don't make it spit
Speaker 1: out colors and icons for Christ's.
Speaker 3: Sake, exactly. And maybe your first prompt should be is
Speaker 3: there already a tool that does this ruse? And that
Speaker 3: might be save you a couple tokens that you can
Speaker 3: use later on for important things.
Speaker 1: That's always the first question. Has this been done before?
Speaker 1: Where can I get it? Yep?
Speaker 3: Absolutely all right?
Speaker 1: So was the did they catch the guy or the
Speaker 1: girl or whatever?
Speaker 3: It's ongoing? It looks like ongoing.
Speaker 1: Okay. Next, SISA warns admins to patch actively exploited SharePoint
Speaker 1: flaws SharePoint who runs share Point? In two six?
Speaker 3: You know that was the most that was the most
Speaker 3: shocking part of this story, Carl, I know, because that
Speaker 3: was like I read that Wrongs probably runs it. Yeah, yeah,
Speaker 3: probably that's I think. Keep track of all those exploits.
Speaker 3: Uh yeah. The US Cybersecurity and Infrastructure Security Agency oh,
Speaker 3: I don't think you should have the word of security
Speaker 3: twice in the name, but whatever. SISA warns today that
Speaker 3: attackers are actively exploiting three vulnerabilities to hack Internet exposed
Speaker 3: on premise SharePoint servers. Let me unpack that again. Internet
Speaker 3: exposed on premise share point servers?
Speaker 1: What could go wrong?
Speaker 3: If you, my dear listener, have an Internet exposed on premise.
Speaker 2: Anything, then you you are only listening to this show
Speaker 2: while you sleep.
Speaker 1: That's right?
Speaker 3: I never yeah, like what, no, that's no. Like if
Speaker 3: you had okay, if you had to have SharePoint and
Speaker 3: you had to have people have access to it, you
Speaker 3: got to use something like a VPN, you got to
Speaker 3: hide a point something, because there's so many different ways
Speaker 3: to manipulate things like Sharepoints designed to be an open
Speaker 3: architecture of documents and sharing in that sort of time.
Speaker 1: It was designed before people even gave a rat's butt
Speaker 1: about security.
Speaker 3: Absolutely, and I can't tell it. I call SharePoint the
Speaker 3: cat of document libraries because it has nine lives. Every
Speaker 3: time I've heard about SharePoint, they're like, you know what
Speaker 3: they're getting rid of it? Yeah, sharep and nobody's gonna
Speaker 3: use it anymore. And then it's like, oh share points back,
Speaker 3: look at that. So it's fascinating though, that you would
Speaker 3: take a SharePoint server and then decide to manage it
Speaker 3: on your own, not put it up in the cloud
Speaker 3: where you have you know, people who are watching at
Speaker 3: twenty four to seven and know exactly what they're doing.
Speaker 2: I mean, Microsoft's made it really hard to host anything anymore.
Speaker 2: We gave up on I tried heroically, you did heroically
Speaker 2: to keep us hosting our own exchange, and it just
Speaker 2: made it impossible. I assume SharePoint is far, far beyond that.
Speaker 3: I fought Patrick tooth and nail, fought Patrick, and I
Speaker 3: was like, I will burn this server to the ground. Yeah,
Speaker 3: there's no need for us to maintain it. Well, it
Speaker 3: used to be back in the day, which was a Wednesday, Carl,
Speaker 3: thank you, Back in the day context managing your own
Speaker 3: if you were in the cloud and the cloud went down,
Speaker 3: you were so well right.
Speaker 2: But we made that switch over ten years ago. Oh absolutely,
Speaker 2: But it's not like we made the switch last Monday.
Speaker 2: No no, no, no, no. But like twenty years ago, fifteen
Speaker 2: years ago, if if Microsoft was down for a day,
Speaker 2: it wasn't unheard of. Yeah, right, for Office three sixty five.
Speaker 2: You go down and then you just didn't get email right,
Speaker 2: and we weren't willing to do that, and that's why
Speaker 2: we were hosting it, just to give you a little
Speaker 2: bit of props. Patrick Well, and we also had taught
Speaker 2: the Microsoft course on how to manage.
Speaker 3: We did do that. So actually do you remember the
Speaker 3: SharePoint course?
Speaker 1: I do.
Speaker 2: Yeah, we were the first to teach it as far
Speaker 2: as I know. And we had to talk to the course, right,
Speaker 2: I think it's long enough that we can talk about this, yes,
Speaker 2: to get that, and they were like, oh, I'm sorry, man,
Speaker 2: I'm sorry.
Speaker 1: Sahil Malick did a DVD SharePoint training for Franklin's Net.
Speaker 1: Oh I know a lot of people that made a
Speaker 1: lot of money writing share Yeah, aps, but that doesn't
Speaker 1: mean there was secure.
Speaker 3: Yeah that the the developer of the course was actually
Speaker 3: in our class and sat down and is watching it.
Speaker 3: And then when when labs and demos didn't work, we
Speaker 3: just looked over explains really really exactly and they were
Speaker 3: just like, we're so sorry, just keep moving but nothing anyway.
Speaker 1: The long and short of it is this, this was
Speaker 1: a you know, of vulnerability and it's patched isn't it.
Speaker 3: And yeah, absolutely so, SISA added three actively exploited, so
Speaker 3: they were actually seeing these exploited in the wild, you know,
Speaker 3: twenty twenty six three two two one, twenty twenty six
Speaker 3: four five six nine, and twenty twenty six five six
Speaker 3: one six four. This is April fourteenth, July first, and
Speaker 3: July fourteenth, so two of these are reasonably new. But
Speaker 3: you are absolutely gonna want to make sure that you
Speaker 3: go patch pit patch, patch, patch.
Speaker 1: Patchy patchy patch. All right, well, let's patch our way
Speaker 1: to a break and we'll be right back after these
Speaker 1: very important messages and we're back. It's security this week.
Speaker 1: I'm Carl, that's doing and Patrick and we got a
Speaker 1: few more stories for you here. Ernst and Young discloses
Speaker 1: data breach after support system hack. So hey, guess what
Speaker 1: another data breach? Do you think people are just like yawn?
Speaker 3: I think so. I mean, I've I've had family members
Speaker 3: come to me and be like what else could they take? Yeah, Like, honestly,
Speaker 3: there's not much that I haven't like, social security member, address,
Speaker 3: credit card number, pass where it's like there's really not much. Helse,
Speaker 3: so lock your credit account. We told you how to
Speaker 3: do that before. Yeah, and you know, be change your
Speaker 3: passwords in your password.
Speaker 2: Managers, change all your money for gold, exchange all your
Speaker 2: money for golden, ammo.
Speaker 3: Both one golden.
Speaker 2: Yeah, that doesn't kill were wolves.
Speaker 1: Oh yeah, but if it's silver, it'll kill.
Speaker 3: Yeah, it's silver, Emma, and then you're good, sell it,
Speaker 3: shoot it whatever. Yeah. This this is this is another
Speaker 3: sort of story we've seen time and time again over
Speaker 3: I'd say, over the last two years, this has been
Speaker 3: more and more prevalent. Third parties support ticketing system managed
Speaker 3: by somebody else, not Ernst and Young gets breached supply chain, right, listen,
Speaker 3: Ernst and Young is they're they're good at what they do.
Speaker 3: They actually have an auditing and cyber division, this particular
Speaker 3: one that says Ernst you and offers tax consulting and
Speaker 3: transaction advisory services to major organizations in one hundred and
Speaker 3: fifty countries, so not a small organization.
Speaker 2: You know.
Speaker 1: What they didn't mention in this article is how many
Speaker 1: records that you know, they are customers.
Speaker 3: They're they're good at what they do, so when they
Speaker 3: got breached, they know exactly what to say, which is nothing.
Speaker 1: Yeah, they're not like anything really.
Speaker 3: Yeah, because they will say they're not going to say
Speaker 3: what records were breached. They're not going to say what
Speaker 3: the attackers had access to. They're not going to say.
Speaker 3: They're not going to say anything unless it forensically is
Speaker 3: identified as true, and then they'll put a letter out.
Speaker 3: So the letter of the law is they need to
Speaker 3: notify their user the potential user base, that some of
Speaker 3: their data may potentially have been leaked, and then they
Speaker 3: don't have to exactly say what was leaked until the
Speaker 3: forensics audit is done, which may take forever. Right, So the.
Speaker 1: Article does say the company employs four hundred and six
Speaker 1: thousand people and reported a global revenue of fifty three
Speaker 1: point two billion dollars last year.
Speaker 3: The other thing that it's interesting, I like humble bragging,
Speaker 3: I know, right, yeah, you know, we're small whatever, just
Speaker 3: a little company, just fifty four billion, fifty three to
Speaker 3: two really, I.
Speaker 2: Mean that is small by AI standards.
Speaker 3: But yeah, yeah, I mean, so from the attackers had
Speaker 3: access to the platform from March twenty eighth to April twelfth,
Speaker 3: and then Ian Ernst and Young and whoever the third
Speaker 3: party is didn't notice it till later on twenty third.
Speaker 3: It was like, yeah, till the twenty third, So there
Speaker 3: was a fair bit of time where the attackers were
Speaker 3: in there for weeks pulling information and then finally they went,
Speaker 3: oh crap, somebody's been in here. And that points to
Speaker 3: another issue like what was where's the auditing in here?
Speaker 3: Why was it found weeks and weeks afterwards and not
Speaker 3: immediately during exfiltration of the data? Right? So I think
Speaker 3: a lot of that may come out as well.
Speaker 1: All right, so big mystery right now? Okay, Well, next story.
Speaker 1: SISA urges immediate action on actively exploited Fortinet flaws.
Speaker 3: Are old friends at Fortinet, Carl, what is this fortunet
Speaker 3: you talk about?
Speaker 1: I don't know. I've never heard of it before. They're
Speaker 1: only in every episode.
Speaker 3: Well, listeners, if you were a reoccurring character, this is
Speaker 3: the first episode you've listened to, But you too will
Speaker 3: get fordinite one percent of your episodes.
Speaker 1: More importantly, which forty X?
Speaker 3: It does it matter?
Speaker 1: Product? Does it?
Speaker 2: Which of the forty things?
Speaker 3: Yeah?
Speaker 1: I don't think it even it's the forty sandbox. It is,
Speaker 1: and you can get that in small, medium or large
Speaker 1: with extra fries. I like the forty sandbox, please with
Speaker 1: doesn't it sound like a like a you know, fast
Speaker 1: food they put forty in front of every product.
Speaker 3: Right, everything's like geez. So these X plays we've talked about,
Speaker 3: some of these have been around for a little while.
Speaker 3: I think the earliest one was dating to April fourteenth,
Speaker 3: So we're looking at CV twenty twenty six thirty three
Speaker 3: nine eight oh eight and twenty twenty six two fiveh
Speaker 3: eighty nine, So this is April fourteenth and June ninth.
Speaker 3: We have talked about both of these exploits on this show.
Speaker 3: We have talked about the patches and or ways to
Speaker 3: mitigate both these exploits on this show. At the time
Speaker 3: when we had announced these in April and June, there
Speaker 3: was not active exploitation in the field, right. The experts
Speaker 3: that be weren't saying, oh my gosh, this is you know,
Speaker 3: we're seeing massive amounts of people trying to exploit these.
Speaker 3: Now they are and this is so A. If you
Speaker 3: were listening to this and you did go patch, great,
Speaker 3: good for you, Good for you. B One of the
Speaker 3: things I did want to point out here as well
Speaker 3: is the difference between the CVE, which is a common
Speaker 3: vulnerability exploit, which is like, hey, you know, we know
Speaker 3: that you can exploit the system doesn't necessarily mean somebody
Speaker 3: in the Internet has done it. It may be a
Speaker 3: security researcher found the issue reported it responsibly, not like
Speaker 3: Midnight Eclips, which we'll talk about later, reported it for shadow. Yeah,
Speaker 3: I know, reported it responsibly. The security even the software
Speaker 3: vendor fixed it. And there's a patch that gets a
Speaker 3: CVE right. Software software companies get banks of cvees that
Speaker 3: they can assign themselves to security issues.
Speaker 2: Right.
Speaker 3: A known vulnerability exploited vulnerability SISA has the UH the
Speaker 3: Known Exploited Vulnerabilities database. When something gets added to that database,
Speaker 3: it's already going to be an exploit we know about.
Speaker 3: So it's not new from the exploit standpoint, it's new
Speaker 3: from the usage standpoint. We're starting to see attackers use.
Speaker 2: It, and I think there's a trigger with government agencies
Speaker 2: on like they're in trouble if they haven't fixed it
Speaker 2: by them.
Speaker 3: Correct, Yeah, and then they get some sort of ultimatum
Speaker 3: like fix it by Monday or.
Speaker 2: Or else we'll ask you on Tuesday.
Speaker 3: Ye all. Yeah. That so needless to say this, it
Speaker 3: is one of the reasons we brought this back up.
Speaker 3: It isn't to beat the dead horse that is Fortinet.
Speaker 3: It's the fact that now that it's being reported as
Speaker 3: a known expletive vulnerability, you really do want to go
Speaker 3: through and make sure that everything's buttoned out and tight.
Speaker 1: Right. And if you were one of those people who
Speaker 1: went to your CSO and said patch this and they did,
Speaker 1: you can say, ah, wave the finger right, okay?
Speaker 3: Uh.
Speaker 1: Cybersecurity News report seven zip vulnerability exposes millions of users
Speaker 1: to remote.
Speaker 2: It's been a minute since we've seen a compressor vulnerability.
Speaker 1: Remote code execution risk. What happened with old seven zip?
Speaker 3: Oh? Seven zip's neat. So for those of you that
Speaker 3: don't use to zip, you might use wind zip, you
Speaker 3: might use wind rar. You might have no idea what
Speaker 3: any of those are.
Speaker 1: Just use what's in Windows. You can compress and uncompression.
Speaker 3: Yeah, so compression dates all the way back to p
Speaker 3: k's hip Phil Cats a long time ago.
Speaker 1: Yeah, yep, even arc before that. Yes, you wrote that too.
Speaker 3: Where was Phil Cats from?
Speaker 1: I don't know. I don't even know if he's still
Speaker 1: alive or what he does.
Speaker 3: I'd venture to say New England area, smart guy, probably right, Probably.
Speaker 2: A little island that just got smaller and.
Speaker 3: Smaller exactly as he was compressing it.
Speaker 1: We should find him, We should find him and see
Speaker 1: if we could.
Speaker 3: Oh my god, it'd be great, great, that would be great.
Speaker 3: All right, We're on the hunt for the old folks,
Speaker 3: for the old folks, for the old folks, the people
Speaker 3: who make us feel younger.
Speaker 1: Old folks home probably guming his neat low.
Speaker 3: That's what we gotta do. We're gonna broadcast live from
Speaker 3: shape Acres. It's Phil Katz. So, yeah, So these are
Speaker 3: compression utilities, right, seven zip, win zip when whatever?
Speaker 1: Right? And seven seven zip is the feature set is
Speaker 1: that it can handle multiple formats. Yeah, seven formats in fact,
Speaker 1: or is it Heine's fifty seven formats?
Speaker 3: I don't, oh, Patrick, if they'd only changed the spelling of.
Speaker 2: The I know, if I had only been in the will.
Speaker 3: Yeah. So in this particular case, you know, there is
Speaker 3: a buffer overrun what they call the x Z compression,
Speaker 3: the algorithms where you can then get it to execute code.
Speaker 3: What it does is it executes code under the context
Speaker 3: of the user. So this isn't to provask. This isn't
Speaker 3: like I'm a normal user in Hazzan. Now I'm an administrator.
Speaker 3: This isn't an attack your computer firm, you know, across
Speaker 3: the internet. This is you get some weird ZIP file
Speaker 3: from some rando or from you know III cloud at
Speaker 3: you know gmail dot com, and you download it, you write,
Speaker 3: click on it, and you happen to open it with
Speaker 3: seven zip, and they may get a command to run
Speaker 3: as you.
Speaker 1: Yeah, you can trigger a heap based buffer overflow, a
Speaker 1: memory corruption issue that occurs in data was written to
Speaker 1: a buffer exceeds the allocated space.
Speaker 3: Yeah. So if you're not running it as administrator, if
Speaker 3: you're running with what we call lease privileges that will
Speaker 3: help mitigate some of this. You can go patch this.
Speaker 3: The vulnerability has been fixed in twenty six oh two
Speaker 3: of seven zip. Interestingly enough, that x X compression. We've
Speaker 3: seen issues with this this algorithm in the past, I
Speaker 3: think we I know, we had reported on the z
Speaker 3: backdoor a while ago, in twenty twenty four. We had
Speaker 3: talked about this.
Speaker 2: Yeah, long time.
Speaker 3: So for those of you who haven't been listening to
Speaker 3: this show since twenty twenty four, shoot, actually we've been here.
Speaker 2: Since five years man, twenty sixteen.
Speaker 3: Yeah's twenty twenty. It's been a while. Five twenty sixteenth yeah,
Speaker 3: twenty one. You're right, Yeah, you're twenty twenty twenty one.
Speaker 3: Around there, COVID sucked. We decided to start a podcast anyway. Anyhow,
Speaker 3: back in twenty twenty four, it was discovered that there
Speaker 3: was a developer there is an open source project. Yeah,
Speaker 3: it was discovered that there was a developer who had
Speaker 3: been working on the x Z compression algorithm for for
Speaker 3: all sorts of utilities, right, whether it's seven zip or
Speaker 3: built in compression and Linux and that sort of stuff.
Speaker 3: And for two years, this developer built up CLOUTEP would
Speaker 3: do good things, would add you know, add good features,
Speaker 3: would go through your thicks, actual bugs for two years.
Speaker 2: And his name was Dwayne Laflotte.
Speaker 3: That's the long con, baby son, it is the long con.
Speaker 3: And then silently added back doors right that hooked like
Speaker 3: rs public keys and that sort of how you get
Speaker 3: access to us to ah riverers and that sort of thing.
Speaker 3: And they're still seeing ramifications of that today because it
Speaker 3: it went wide fast because they didn't know to look
Speaker 3: for this guy. Right.
Speaker 1: So you know what occurs to me here is that
Speaker 1: this buffer overflow, heap based buffer overflow tells me that
Speaker 1: this was not written in a managed language like C
Speaker 1: sharp or Java. Yeah, this must be the SEA or
Speaker 1: C plus plus or some other bare metal you know,
Speaker 1: manual memory allocation kind of thing.
Speaker 3: Yeah, and I'll tell you he heap manipulation is, I mean,
Speaker 3: not as easy as stack like stack buffer overflows. Yeah,
Speaker 3: you overload a field and huzzah, now you're you're on
Speaker 3: the running execution stack. Heaps need to be groomed, so
Speaker 3: you actually have to like allocate space, dellogate space, allocate space,
Speaker 3: dellocate space, find angling pointers. Right, it's there. There has
Speaker 3: to be a fair bit to go into, you know,
Speaker 3: heapex plaint.
Speaker 1: And the objects and the heap get rearranged, just kind
Speaker 1: of like a hard DISTI fragment I used to do
Speaker 1: in the two thousands and then.
Speaker 3: Yeah, absolutely, Yeah, So not an easy class of overflow.
Speaker 3: If you're looking for easier class stacks, stack is easier
Speaker 3: class than a heap butt Yeah, needless to say, go
Speaker 3: patch seven zip if you have. If you know what
Speaker 3: seven zip is, go patch it or just stop using
Speaker 3: it for crying out loud, or just use what's built
Speaker 3: in the windows.
Speaker 1: All right. Our top story this week new Windows Legacy
Speaker 1: Hive zero day gives hackers admin privileges.
Speaker 2: Who could this be?
Speaker 1: This sounds very familiar to me.
Speaker 2: Who could this be?
Speaker 3: Yes, dear listeners, Nightmare Eclips, the same guy who brought
Speaker 3: you Blue Hammer, Red Sun, Undefended, Yellow Key, Green Plasma,
Speaker 3: Mini Plasma, Rogue Planet, and Great XML. These are all
Speaker 3: exploits that this person has released. Yeah, and.
Speaker 1: He basically went rogue after he warned Microsoft of some
Speaker 1: vulnerabilities and they're like.
Speaker 3: Eh, yeah, right, They're like whatever, whatever, and he's like, okay, okay, fine, cool, right.
Speaker 3: I mean some of it, some of these exploits are
Speaker 3: awesome if you go, if you go through some of.
Speaker 1: Them and Wayne flat sense of the word.
Speaker 3: Bypassing BitLocker key, I mean, there's nice stuff. There is
Speaker 3: a really great list of exploits here. And this one
Speaker 3: is no joke as well. So Live Legacy Hive is
Speaker 3: the newest one, and Microsoft is quote unquote looking into it.
Speaker 3: But what this guy has now taken to do and
Speaker 3: I say guy generically, could be a girl, could be
Speaker 3: a guy. I don't know, but I'm saying guy, what
Speaker 3: this guy has done is releases. He waits till patch. Tuesday,
Speaker 3: Microsoft puts out this massive patch and says, so, za,
Speaker 3: we fixed three hundred things, and then like hours later
Speaker 3: he releases an exploit that works on that patch. Ye,
Speaker 3: and he goes, oh, Microsoft patch today, look at that.
Speaker 3: It doesn't work. It doesn't fix anything, you know, blah
Speaker 3: blah blah.
Speaker 1: Right, that's why we this week had patch Wednesday as
Speaker 1: well as patch Tuesday.
Speaker 3: Soon we'll have patch Thursday in patch Friday.
Speaker 1: So I did, didn't we We had a patch on
Speaker 1: Tuesday and then one again on Wednesday.
Speaker 3: Yeah, yep. So what's interesting about this one is this
Speaker 3: is a this is a potential remote code execution, well
Speaker 3: not remote code execution, privileged escalation really, where I can
Speaker 3: get another account to execute a command. Typically you're going
Speaker 3: to do the administrative account, right or anybody who has
Speaker 3: administrative privileges.
Speaker 2: It.
Speaker 3: You know. Two nightmare eclipses credit. The POC that uh
Speaker 3: that was released was defanged a little bit. It required
Speaker 3: that you at least knew a username and password on
Speaker 3: the system, and it required that you at least knew
Speaker 3: a third name of a different account. Although I think
Speaker 3: Kevin Beaumont said, uh, if you have half a brain,
Speaker 3: you know how to rip those out exactly and then
Speaker 3: get it to work. He did the stripe Mary West,
Speaker 3: just take it and use it. Yeah, exactly. So I
Speaker 3: think you probably could take the POC, maybe put it
Speaker 3: in codex and ask it to fix it.
Speaker 2: And he's a modern day Robinhood. And then you get
Speaker 2: decide whether you're on the side of the Sheriff of
Speaker 2: Nottingham or not in this case.
Speaker 3: Yeah, I mean it's interesting.
Speaker 2: Also known as Sachin as Yellow pushes.
Speaker 1: He pushes Microsoft to fix things. He does, he does,
Speaker 1: you know, that's that's how it works. He's kind of
Speaker 1: a jerk about it.
Speaker 3: Yeah, and you know he's gone rogue from the I
Speaker 3: get it, like I get We've had plenty of times
Speaker 3: I can't talk about on the air, but we've had
Speaker 3: plenty of times where we've discovered zero day exploits that
Speaker 3: were very damaging to massive amounts of people in financial
Speaker 3: institutions and when we released them and they just don't
Speaker 3: want to hear it. Chew the software company, I'd say
Speaker 3: seventy percent of the time we get so or what
Speaker 3: are you doing looking at this? Like that's yeah, yeah,
Speaker 3: or what are you doing looking at this? Or or
Speaker 3: you're kind of fat so it's not a feature you know,
Speaker 3: that's not going to sell features sell, So have a
Speaker 3: nice day. And then, as you know, not nightmare eclipse people.
Speaker 3: What do we do about it? Right?
Speaker 2: Well, I mean the only way, the way that works
Speaker 2: for us is that we represent their customers. Yes, And
Speaker 2: so the customer comes and says, hey, you got notified
Speaker 2: that was a pen test for us. You need to
Speaker 2: fix this or we're not going to renew.
Speaker 3: Or we're not going to buy it anymore. And then
Speaker 3: that catches their eye, you'd think. And there are some
Speaker 3: companies we've caught numerous times on this and they still
Speaker 3: won't talk.
Speaker 1: To us directly changed their policies.
Speaker 3: Yeah. So it's frustrating. And so I'm not saying I
Speaker 3: condone just taking a you know, a zero day and
Speaker 3: throwing it out on the internet and saying, good look everybody.
Speaker 3: But you know, I understand the frustration. Let's put it
Speaker 3: that way.
Speaker 2: It has its effects, does well.
Speaker 1: The whole goal is to get the company to fix it, right,
Speaker 1: that's the goal.
Speaker 3: Absolutely.
Speaker 1: You don't want to harm anybody, Nope.
Speaker 3: No, if you wanted to harm somebody, you would take
Speaker 3: this and you would have released it on the dark
Speaker 3: webs somewhere. Yeah, made some money on it, right, and
Speaker 3: then they would do one mass damage. Yeah yeah, yeah,
Speaker 3: exactly right, monetize it.
Speaker 1: That's right. That's a that's a little grab bag of
Speaker 1: stories that happened last week. You guys cut anything else.
Speaker 2: That's a wrap.
Speaker 3: That's it. Yeah all right.
Speaker 1: I guess we'll see you next week on security this week,
Speaker 1: bye bye, thanks bye,