WEBVTT 1 00:00:00.320 --> 00:00:03.200 Hey, Carl here, we're on a mission to find new 2 00:00:03.240 --> 00:00:05.919 fans of the show. I mean, where else can you 3 00:00:05.960 --> 00:00:10.240 get real life comedy and horror in one podcast. You 4 00:00:10.279 --> 00:00:13.640 can do your part by leaving us a review on iTunes, Spotify, 5 00:00:13.759 --> 00:00:16.879 or wherever you get Security this Week. Also, you can 6 00:00:16.920 --> 00:00:19.399 get an ad free feed by becoming a five dollars 7 00:00:19.399 --> 00:00:22.239 a month patron. Go to Patreon dot Security this Week 8 00:00:22.320 --> 00:00:26.160 dot com and sign up, and don't forget discord Discord 9 00:00:26.199 --> 00:00:28.839 dot Security this Week dot com. Lots of good stuff 10 00:00:28.879 --> 00:00:32.439 happening there. Yeah, I think that's it. So on with 11 00:00:32.560 --> 00:00:36.479 the podcast. So this man wakes up in the hospital. 12 00:00:37.119 --> 00:00:40.479 The phone rings. Doctor tells the man, I have really 13 00:00:40.479 --> 00:00:43.799 bad news. You're very sick after your collapse yesterday. We 14 00:00:43.920 --> 00:00:49.880 ordered several tests. You have avian flu ebola, your HIV positive, 15 00:00:50.000 --> 00:00:53.640 and you have hepatitis. Wow. The guy says, what are 16 00:00:53.640 --> 00:00:56.640 you gonna do? Doc replies, well, for starters, we're putting 17 00:00:56.679 --> 00:01:00.880 you on a strict diet of only pizza. He says, 18 00:01:00.880 --> 00:01:03.280 Will that really help me? Doc says no, but it's 19 00:01:03.320 --> 00:01:19.480 the only thing I can fit under the door. Nothing 20 00:01:19.560 --> 00:01:23.799 but serious, serious security talk here at Security this Week. 21 00:01:24.120 --> 00:01:26.640 I'm Carl Franklin. That's Patrick Hines and Dwaine Laflatte. 22 00:01:26.920 --> 00:01:28.120 Are we changing format? 23 00:01:29.680 --> 00:01:33.480 I was gonna say that doesn't sound like all right, 24 00:01:33.519 --> 00:01:36.480 we have six stories today. Let's start with this one. 25 00:01:36.760 --> 00:01:41.200 US Cyber Agency SISSA. But you know SISSA, so we 26 00:01:41.239 --> 00:01:44.000 had we had, we did have a Yeah, they do 27 00:01:44.079 --> 00:01:48.359 the scores, right, US Cyber Agency SISSA exposed reams of 28 00:01:48.400 --> 00:01:50.920 passwords and cloud keys to the open Web. 29 00:01:51.159 --> 00:01:52.959 Yeah, they're supposed to be better than this is what 30 00:01:52.959 --> 00:01:53.680 you're trying to say. 31 00:01:53.719 --> 00:01:57.599 I think, yeah, yeah, I mean this is SISSA. They 32 00:01:57.599 --> 00:01:58.840 give us the scores. 33 00:01:58.680 --> 00:02:03.239 Cyber Cybersecurity, Infrastructure and Security Agency. There's a lot of 34 00:02:03.239 --> 00:02:05.280 security in that name for someone who released a bunch 35 00:02:05.319 --> 00:02:05.920 of passwords. 36 00:02:06.120 --> 00:02:08.120 This never happened with Jen was running that show. 37 00:02:08.199 --> 00:02:11.080 I know, right, Jen's got to come back West Point 38 00:02:11.120 --> 00:02:13.319 Grad's right player of the guitar. 39 00:02:14.919 --> 00:02:15.400 Yeah, I know. 40 00:02:15.840 --> 00:02:17.120 I think she's happy where she is. 41 00:02:17.280 --> 00:02:18.759 I think it's pretty geeky that we know that. 42 00:02:19.560 --> 00:02:20.960 I didn't know you knew Jen. 43 00:02:21.560 --> 00:02:22.240 She went to West FO. 44 00:02:22.439 --> 00:02:23.800 You're on a first name basis with it. 45 00:02:23.919 --> 00:02:25.680 We only wish we knew Jen. We knew not. 46 00:02:26.759 --> 00:02:31.400 I'm very I'm very Kevin Bacon from Jen I know 47 00:02:31.439 --> 00:02:33.400 a lot of people who know her. She knows a 48 00:02:33.439 --> 00:02:34.360 lot of people that know me. 49 00:02:34.319 --> 00:02:35.199 But I do not know her. 50 00:02:35.400 --> 00:02:37.240 Okay, so wait, wait when Jenny Easterly? 51 00:02:37.319 --> 00:02:39.360 Yeah, when were you at West Point? 52 00:02:39.439 --> 00:02:40.439 I graduated eighty eight. 53 00:02:40.680 --> 00:02:43.360 When did she graduate? You know, I think she was within. 54 00:02:43.240 --> 00:02:46.599 A few years. I think we were there. You would 55 00:02:46.599 --> 00:02:47.400 have to look it up to know. 56 00:02:47.639 --> 00:02:53.159 Anyway, let's talk about this story. So the US Cybersecurity 57 00:02:53.199 --> 00:02:56.159 Agency says I may have escaped a sizable security breach 58 00:02:56.719 --> 00:03:00.400 thanks to a good faith security researcher who identified publy 59 00:03:00.479 --> 00:03:04.360 exposed credentials that allowed access to government cloud and internal 60 00:03:04.400 --> 00:03:08.159 agency system So were they compromised or were they not? 61 00:03:09.280 --> 00:03:12.159 I mean, it's just as much a compromise as if 62 00:03:12.199 --> 00:03:15.280 you take all of your passwords that you may have 63 00:03:15.439 --> 00:03:17.240 and put them out on your public website. 64 00:03:17.240 --> 00:03:19.599 All right, So nobody actually used them as far as 65 00:03:19.639 --> 00:03:20.240 we know now. 66 00:03:20.319 --> 00:03:24.240 So according to this, they're pretty sure that this cybersecurity 67 00:03:24.280 --> 00:03:28.159 researcher late On I believe is his name. Okay, I'm 68 00:03:28.159 --> 00:03:33.000 sure I'm butchering that found this before anybody else and 69 00:03:33.080 --> 00:03:36.240 reported it relatively quickly, And it was first reported by 70 00:03:36.240 --> 00:03:38.520 Brian Krabbs. We all know Brian Crabbs does a great job. 71 00:03:39.680 --> 00:03:42.240 So moral of the story. The way this kind of 72 00:03:42.280 --> 00:03:46.159 looks is there's a contractor doing work for SISSA. I'm 73 00:03:46.159 --> 00:03:49.080 not entirely sure why he had a spreadsheet or sheheet 74 00:03:49.479 --> 00:03:53.199 a spreadsheet of user names and passwords for valid government 75 00:03:53.280 --> 00:03:58.159 insights and then went to make a GitHub commit and 76 00:03:58.280 --> 00:03:59.919 committed it up to a public repo. 77 00:04:00.199 --> 00:04:03.439 Got to be careful where you save those spreadsheets. 78 00:04:02.879 --> 00:04:04.520 And then somebody saw it and save. 79 00:04:04.400 --> 00:04:06.599 Them outside of the reposts. 80 00:04:07.039 --> 00:04:11.439 Right exactly. Hey, listen, if you're vibe coding, mister contractor, 81 00:04:12.360 --> 00:04:14.879 maybe ask the AI not to put secret stuff in 82 00:04:14.960 --> 00:04:16.639 the in the directory that's coming public. 83 00:04:17.120 --> 00:04:19.360 I'm pretty sure that's that's a good conclusion. 84 00:04:19.759 --> 00:04:20.759 It was probably right. 85 00:04:20.800 --> 00:04:22.360 There might have been a little vibe coding at all. 86 00:04:22.439 --> 00:04:25.199 We're not confirming it here, but it's entirely possible. 87 00:04:25.240 --> 00:04:27.360 You can neither confirm nor deny, but it does. 88 00:04:27.560 --> 00:04:31.000 It does point out like you have a cybersecurity Infrastructure 89 00:04:31.040 --> 00:04:37.439 agency department that's totally focused on you know, cyber and 90 00:04:37.439 --> 00:04:40.199 and the right things to do, and they put our 91 00:04:40.240 --> 00:04:43.439 recommendations around tabletop, you know, exercises you should do with 92 00:04:43.480 --> 00:04:47.480 your organization, and you know, all sorts of really great 93 00:04:47.600 --> 00:04:50.279 information about how to protect yourself as an organization. And 94 00:04:50.319 --> 00:04:53.759 then you know, even they who are more cyber conscious 95 00:04:53.839 --> 00:04:56.360 than most could have something like this happened. 96 00:04:56.399 --> 00:04:58.160 So you never know. 97 00:04:58.240 --> 00:04:59.920 So it'll be interesting if there's any followup for the 98 00:05:00.040 --> 00:05:03.319 those were wondering. Jen At graduated two years after mem 99 00:05:03.800 --> 00:05:06.199 nolascin ninety so wait, she would have been a plebe 100 00:05:06.279 --> 00:05:07.480 when I was a junior. 101 00:05:07.519 --> 00:05:09.439 When you were a junior, I would have been very mean, 102 00:05:09.680 --> 00:05:12.600 so you could have you could have done mean things. 103 00:05:13.000 --> 00:05:15.759 I was usually harassing my classmates because I was the 104 00:05:15.800 --> 00:05:17.839 first sergeant, so I was more likely to be harassing 105 00:05:17.839 --> 00:05:18.560 them than God. 106 00:05:18.600 --> 00:05:20.680 I could have bumped into her in the hallway or 107 00:05:22.000 --> 00:05:24.160 stolen her gaze over a cup of coffee. 108 00:05:24.279 --> 00:05:26.480 Yeh, I just know that on LinkedIn. I think we 109 00:05:26.519 --> 00:05:27.680 have a lot of people in common. 110 00:05:27.959 --> 00:05:34.319 Interesting. Okay, anyway, let's move on. Cyber Unicorn Sierra Sierra 111 00:05:34.639 --> 00:05:38.959 cy E r A acquires five month old startup Genie 112 00:05:39.040 --> 00:05:44.240 Security and fifty million dollar deal. So it's an Israeli 113 00:05:44.319 --> 00:05:49.319 startup with just five employees, joints cybersecurity company with acquisition Spree. 114 00:05:49.399 --> 00:05:51.079 First off, they got a couple of things going for 115 00:05:51.160 --> 00:05:55.079 him there is rarely, which means you know security, right, 116 00:05:55.199 --> 00:05:56.720 I mean all your firewall. 117 00:05:56.319 --> 00:05:59.439 Companies positive bias. Is that what you're saying, Yeah, exactly, 118 00:05:59.519 --> 00:06:03.240 That's what I'm yeah. So this the reason this story 119 00:06:03.240 --> 00:06:06.160 is here is because this market's a little crazy. People 120 00:06:06.240 --> 00:06:09.439 don't know where cyber is going, whether it's going away, 121 00:06:09.519 --> 00:06:13.879 which has been predicted for thirty years by people including 122 00:06:13.959 --> 00:06:18.319 Dwayne and I at one point, and there's a lot 123 00:06:18.319 --> 00:06:20.360 of fear. There's a lot of people who are trying 124 00:06:20.360 --> 00:06:22.920 to figure out where it's going. I think it's going 125 00:06:23.000 --> 00:06:26.040 to be more of the same. We've noticed that there 126 00:06:26.079 --> 00:06:29.519 are more patches in every more vulnerabilities in every patch. 127 00:06:29.920 --> 00:06:32.680 Things are accelerating, but it's been on that trajectory for 128 00:06:32.720 --> 00:06:35.600 a while. This will be a big evolution in what 129 00:06:35.720 --> 00:06:39.519 cyber means and what protection looks like. But I don't 130 00:06:39.519 --> 00:06:41.879 think the industry itself goes away. I don't think the 131 00:06:41.879 --> 00:06:45.399 industry automates to the head of a pin on AI 132 00:06:45.560 --> 00:06:47.839 or anything like that. But it it's definitely changing. So 133 00:06:48.000 --> 00:06:50.560 this is a sign of these times that a five 134 00:06:50.639 --> 00:06:55.720 month old, five persons startup can sell for fifty million dollars. 135 00:06:57.120 --> 00:06:58.879 Some of that's going to just be hyped, that's going 136 00:06:58.920 --> 00:07:00.360 to wash away, and some of it going to be 137 00:07:00.480 --> 00:07:03.399 they just have a really good idea or they're doing 138 00:07:03.480 --> 00:07:04.879 things in a very interesting way. 139 00:07:05.040 --> 00:07:08.560 So fifty million dollars five months start up, ten million 140 00:07:08.600 --> 00:07:12.360 dollars a month they earned invaluation. That's on an idea, 141 00:07:12.480 --> 00:07:15.879 not bad on an idea. So that's yeah, that's insane. 142 00:07:16.199 --> 00:07:19.279 So this isn't really a news like that we normally cover, 143 00:07:19.399 --> 00:07:21.360 but but it's it is. You're going to see a 144 00:07:21.399 --> 00:07:24.600 lot more stories like this. There's a lot more you know, 145 00:07:24.680 --> 00:07:29.480 the market punishing incumbents like like CrowdStrike and Carbon Black 146 00:07:29.879 --> 00:07:32.720 because of an announcement of an AI that might come 147 00:07:32.759 --> 00:07:37.040 out that might change things. Everybody's waiting for where the 148 00:07:37.079 --> 00:07:38.439 chips are going to fall. I don't think we're going 149 00:07:38.480 --> 00:07:39.079 to know this year. 150 00:07:39.279 --> 00:07:42.040 Yeah, although, okay, there's gonna be a lot of awesome 151 00:07:42.040 --> 00:07:43.800 things this year. I know, I know some of the 152 00:07:43.920 --> 00:07:45.319 some of the things that we're working on are awesome. 153 00:07:45.360 --> 00:07:46.639 Okay, and that should scare us all. 154 00:07:46.639 --> 00:07:47.839 It's gonna be a lot of awesome things. 155 00:07:48.120 --> 00:07:50.040 Yeah, things that we can't talk about. 156 00:07:50.279 --> 00:07:53.000 Things we can't talk about, but things that are awesome. 157 00:07:53.160 --> 00:07:54.519 Wow, it's getting through. 158 00:07:56.199 --> 00:07:59.120 Oh, my god. All right, next story, Webworm deploys Echo 159 00:07:59.199 --> 00:08:05.399 creep and graph worm backdoors using Discord and Microsoft graph API. 160 00:08:05.800 --> 00:08:08.639 You know, if I just read that out of context 161 00:08:08.759 --> 00:08:13.439 to my mom, she would think I'd lost my mind. 162 00:08:13.639 --> 00:08:16.600 Oh wait, yeah, read this sentence, Carl. 163 00:08:16.360 --> 00:08:19.839 Hey mom. Webworm deploys Echo creep and graph worm backdoors 164 00:08:19.920 --> 00:08:23.800 using Discord and MS graph APIs plan. 165 00:08:23.680 --> 00:08:25.680 Is don't judge in one one because you're having a stroke. 166 00:08:27.639 --> 00:08:29.920 She just parachute in from over here. 167 00:08:29.759 --> 00:08:32.679 And yeah, it doesn't get any better. The third paragraph 168 00:08:32.799 --> 00:08:36.440 in a tax mounted by the group have leveraged remote 169 00:08:36.480 --> 00:08:38.759 access trojans. All right, we all know what rats are, right. 170 00:08:39.679 --> 00:08:43.799 Piece of malware allows somebody to access your system, like 171 00:08:44.120 --> 00:08:48.720 ghost Rat nine to two rat aka the Hydrack and 172 00:08:48.960 --> 00:08:51.440 mick Rat with cheese. The threat actor is said to 173 00:08:51.480 --> 00:08:55.440 overlap with China's Nexus cluster, tracked as Phishmonger or Aquatic 174 00:08:55.519 --> 00:08:59.480 Panda six Little Monkeys in the Space Pirates Six Little 175 00:08:59.519 --> 00:09:03.639 Monkeys is best known for deploying ghost Rat. Like, what 176 00:09:03.720 --> 00:09:04.120 the hell? 177 00:09:04.200 --> 00:09:05.240 What do you think of that? Mom? 178 00:09:05.720 --> 00:09:10.320 Exactly? It's it's like some sort of japanimation thing, like 179 00:09:10.360 --> 00:09:12.159 we're I don't know what we're talking about. Anymore. 180 00:09:12.240 --> 00:09:15.200 It's the most surreal sentence I've ever read on the internet. 181 00:09:15.519 --> 00:09:18.679 Yeah, a paragraph rather six little monkeys working with the 182 00:09:18.720 --> 00:09:21.200 phishmongers in the space prits. I mean, I thought I'd 183 00:09:21.240 --> 00:09:22.720 never see it in my life, but there you go. 184 00:09:22.759 --> 00:09:25.200 All right, So in English, what happened here? 185 00:09:27.000 --> 00:09:28.440 So the space. 186 00:09:31.559 --> 00:09:35.759 To follow me here. So all this is is this 187 00:09:35.799 --> 00:09:38.919 is a quick warning that we've talked about commanding control 188 00:09:38.960 --> 00:09:40.600 in the past, right, So, if you have a piece 189 00:09:40.639 --> 00:09:43.440 of malicious software sitting on your network, it's probably reaching 190 00:09:43.440 --> 00:09:49.120 out somewhere. Commanding control is much harder to detect on 191 00:09:49.159 --> 00:09:53.240 your network if it's using valid channels. So, for example, 192 00:09:53.279 --> 00:09:56.320 if I'm reaching out over DNS, or I'm reaching out 193 00:09:56.320 --> 00:10:00.159 over web traffic or like, you probably won't pick that 194 00:10:00.240 --> 00:10:05.240 up right now. Corporate networks generally inspect web traffic, right 195 00:10:05.279 --> 00:10:07.639 so they can see what's inside web traffic, So you 196 00:10:07.679 --> 00:10:10.399 don't want to use web traffic. Corporate networks a lot 197 00:10:10.399 --> 00:10:13.879 of times will use secure DNS, so kind of hard 198 00:10:13.879 --> 00:10:15.600 for you to breach that as well and use it 199 00:10:15.600 --> 00:10:19.039 as a command control structure. But then again, corporate networks 200 00:10:19.039 --> 00:10:24.120 will also use things like Microsoft Office, and they sometimes 201 00:10:24.200 --> 00:10:28.559 will use chat programs like Discord, so it's harder to 202 00:10:28.600 --> 00:10:31.759 inspect that traffic. So what this is saying is there's 203 00:10:31.759 --> 00:10:33.519 a lot of threat actors out there that are now 204 00:10:33.759 --> 00:10:38.399 piggybacking on Discord as a command and control which is 205 00:10:38.399 --> 00:10:39.960 funny because we've been doing it for a year or quarter, 206 00:10:40.720 --> 00:10:45.159 but piggybacking Discord for command and control because it's harder 207 00:10:45.200 --> 00:10:48.799 to detect the traffic that's inside there, and also using 208 00:10:48.840 --> 00:10:54.759 the Microsoft Graph API. If the Microsoft Graph API sounds 209 00:10:55.840 --> 00:10:58.960 like it might be familiar, if you guys have been 210 00:10:59.000 --> 00:11:00.759 listening to this show for a while, which we should. 211 00:11:00.840 --> 00:11:03.320 We should tell everybody what it is. I mean, it's 212 00:11:03.360 --> 00:11:07.679 basically the one API to rule them all for your accounts, right, 213 00:11:07.759 --> 00:11:11.240 what could go wrong? It's it's basically gives you access 214 00:11:11.279 --> 00:11:15.519 to all of your documents, your Excel, spreadsheets, your Mike 215 00:11:15.679 --> 00:11:19.159 you know what is it? Three sixty Yeah, all that 216 00:11:19.279 --> 00:11:22.879 stuff in one place. It's just one huge API for 217 00:11:23.080 --> 00:11:25.799 you and your account to go get everything that you 218 00:11:25.879 --> 00:11:27.480 can do on Microsoft's websites. 219 00:11:27.720 --> 00:11:29.960 And there used to be, uh, there was a tactic 220 00:11:30.320 --> 00:11:33.879 called token tactics. So if you guys look up token 221 00:11:33.919 --> 00:11:38.600 tactics where you could actually request a user's graph API 222 00:11:38.759 --> 00:11:42.559 through a sneaky social engineering way and then gain access 223 00:11:42.600 --> 00:11:46.240 to their accounts, and then have the ability to renew 224 00:11:46.279 --> 00:11:49.600 your token every ninety days that you contain, you'd still 225 00:11:49.679 --> 00:11:52.279 maintain access to their to their accounts, their you know, 226 00:11:52.320 --> 00:11:56.679 Microsoft Office Suite without them ever seeing you log in, 227 00:11:57.080 --> 00:11:59.320 even if you change your password. So there's a lot 228 00:11:59.320 --> 00:12:01.080 of really kind of cool things you could do with 229 00:12:01.120 --> 00:12:03.080 the graph API. A while ago, some of that's been 230 00:12:03.120 --> 00:12:05.159 shut down, but now it's being used for commanding control. 231 00:12:05.320 --> 00:12:07.360 So hang on second, my interns at the door, what, 232 00:12:08.200 --> 00:12:12.000 oh no, thanks, elliit Later he just brought me a micrat. 233 00:12:11.559 --> 00:12:19.360 With cheese, sit down with the Space pirates in this 234 00:12:20.799 --> 00:12:27.039 six little monkeys, Yeah exactly, mcrat. 235 00:12:26.679 --> 00:12:30.200 All right, So you know, this is just a tale 236 00:12:30.240 --> 00:12:33.799 of woe. There's nothing really that anybody can do about it. 237 00:12:33.879 --> 00:12:34.600 Stuff happens. 238 00:12:34.759 --> 00:12:36.759 Yeah, and I think a lot of it is like, 239 00:12:36.879 --> 00:12:41.879 no matter how good you are at monitoring outbound traffic, 240 00:12:42.960 --> 00:12:45.480 there's still gonna be ways that people can get past that. 241 00:12:45.600 --> 00:12:48.279 So defense and depth, like Patrick is always talking about, 242 00:12:48.480 --> 00:12:53.720 is key here, right, Don't just trust one outbound filtering 243 00:12:53.840 --> 00:12:55.879 rule to make sure that oh we're not getting hit 244 00:12:55.919 --> 00:12:59.200 with this this type of traffic, you know, you obviously 245 00:12:59.279 --> 00:13:02.679 need point detection on laptops and desktops. You need to 246 00:13:02.679 --> 00:13:07.279 make sure that if Discord is not a corporate communications 247 00:13:07.279 --> 00:13:12.279 platform for you, heads up block it, right, That's probably 248 00:13:12.279 --> 00:13:12.919 the safest thing. 249 00:13:12.919 --> 00:13:15.879 So I'm going to say something very Dwayne esque that 250 00:13:16.080 --> 00:13:19.240 I should probably have edited out, but I probably won't 251 00:13:19.440 --> 00:13:19.840 if I. 252 00:13:20.320 --> 00:13:22.639 So the sick way, do I have to get the lawyers? Now? 253 00:13:22.679 --> 00:13:23.799 Should I play the music? 254 00:13:23.840 --> 00:13:24.240 Patrick? 255 00:13:25.720 --> 00:13:33.840 It's the signal protocol is published and you can write 256 00:13:33.919 --> 00:13:38.080 your own rapper and use the signal protocol. Would that 257 00:13:38.159 --> 00:13:40.440 be distinguishable? So if you get an organization that uses 258 00:13:40.519 --> 00:13:44.360 signal and you had a agent or piece of code 259 00:13:44.360 --> 00:13:47.919 that was using would that be discernible? So by the 260 00:13:48.080 --> 00:13:49.159 by the perimeter. 261 00:13:49.360 --> 00:13:56.039 Here will tell you the signal protocol is the way 262 00:13:56.039 --> 00:13:59.480 that you can wrap the messages, but not necessarily the 263 00:13:59.519 --> 00:14:01.799 ports on back end server and that sort of stuff. 264 00:14:01.840 --> 00:14:06.240 So could I could I mimic the way signal actually 265 00:14:06.279 --> 00:14:10.879 talks through the network, Probably you wouldn't be able to 266 00:14:10.879 --> 00:14:13.679 intercept it. You're absolutely right, I mean, that's probably a 267 00:14:13.799 --> 00:14:20.480 very secure way for you to transmit data. Honestly, even 268 00:14:20.559 --> 00:14:23.600 using maybe something like the signal CLI on a rat 269 00:14:23.759 --> 00:14:26.039 of some sort where you can just send messages through 270 00:14:26.039 --> 00:14:29.000 a normal signal protocol and the signal. 271 00:14:28.679 --> 00:14:31.159 Servers to idea. 272 00:14:31.279 --> 00:14:34.679 Twayne, I like that, all right, signal. 273 00:14:34.759 --> 00:14:36.879 Now you got to put the theme song in there somewhere. 274 00:14:39.080 --> 00:14:41.440 All right, Well, take a break, okay, and we'll be 275 00:14:41.600 --> 00:14:44.960 right back after these very very very very important messages. 276 00:14:48.679 --> 00:14:50.639 And we're back. It's Security of this week. I'm Carl. 277 00:14:50.679 --> 00:14:53.240 Let's Dwayne and Patrick, and we got a couple more 278 00:14:54.120 --> 00:14:58.360 interesting stories here. Cisco warns of new critical s D 279 00:14:58.720 --> 00:15:03.120 one flaw exploited in zero day attacks. And this is 280 00:15:03.159 --> 00:15:06.000 a ten, isn't it? It's a ten. 281 00:15:06.720 --> 00:15:07.679 They stuck the landing. 282 00:15:07.960 --> 00:15:12.320 I know, right, well done? Uh yeah, I think this 283 00:15:12.360 --> 00:15:15.000 is a ten because A not hard to exploit. B 284 00:15:15.159 --> 00:15:17.799 you gain administrative access and get to manipulate the sd 285 00:15:17.879 --> 00:15:18.840 WAN fabric and. 286 00:15:18.799 --> 00:15:20.120 CE definitely on the internet. 287 00:15:20.200 --> 00:15:20.919 People put it on. 288 00:15:20.879 --> 00:15:23.600 The internet, right, so super accessible. 289 00:15:23.679 --> 00:15:26.559 Well it's not really much good without the Internet. 290 00:15:26.720 --> 00:15:29.559 Yeah, I got this awesome network that can't talk to anything. 291 00:15:30.320 --> 00:15:32.879 The thing is a network at that point. Yeah, the 292 00:15:33.039 --> 00:15:36.399 thing that I work, Yeah exactly, it's definitely a not work. 293 00:15:37.600 --> 00:15:41.399 The thing I find fascinating about and we've seen several 294 00:15:41.440 --> 00:15:45.039 styles of attacks like this is why oh, why oh, 295 00:15:45.080 --> 00:15:49.360 why would you put management access because you have to 296 00:15:49.399 --> 00:15:53.080 hit the management interface? Why would you put management access 297 00:15:53.279 --> 00:15:55.440 out on the internet? And if you did for a 298 00:15:55.480 --> 00:15:59.159 particular reason, why wouldn't you point it at a trusted 299 00:15:59.200 --> 00:16:02.440 IP address, like oh, only my house IPEE can hit 300 00:16:02.480 --> 00:16:05.720 this management interface on the internet so that I can 301 00:16:05.720 --> 00:16:08.440 come and you know whatever. But it just it doesn't 302 00:16:08.440 --> 00:16:10.480 make any sense to me when we see firewalls being 303 00:16:10.480 --> 00:16:13.240 exploited remotely and you go, well, how's that possible? Firewalls 304 00:16:13.320 --> 00:16:15.840 drop traffic? Oh unless you tell it. Yeah, listen to 305 00:16:16.000 --> 00:16:19.320 management traffic on the internet, which still blows my mind. 306 00:16:19.440 --> 00:16:21.759 Now I'm reading this and I don't see that there's 307 00:16:21.799 --> 00:16:24.440 a patch available. But I do see that in this 308 00:16:24.519 --> 00:16:28.600 is May twentieth when recording this, that SISA has added 309 00:16:28.759 --> 00:16:33.000 this flaw to the Known Exploited Vulnerabilities Catalog, ordering federal 310 00:16:33.039 --> 00:16:37.759 agents to patch affected devices by May seventeenth. Right, okay, 311 00:16:38.360 --> 00:16:41.399 but I don't see any patch. 312 00:16:41.320 --> 00:16:44.480 Any any listed patch now, So in this case, the 313 00:16:44.519 --> 00:16:50.519 patch immediately is really a remediation step, so they're unplug it. Yeah, yeah, honestly, 314 00:16:50.879 --> 00:16:53.840 you know you're not far off evacurate there, unplug it. 315 00:16:53.840 --> 00:16:57.240 It's the the remediation step is don't put the management 316 00:16:57.360 --> 00:16:58.480 interface on the internet. 317 00:16:58.600 --> 00:17:00.519 Friends. Don't let friends manage from the internet. 318 00:17:00.600 --> 00:17:01.200 Yeah, that's right. 319 00:17:02.039 --> 00:17:05.119 And if you have to for some reason, then restrict 320 00:17:05.119 --> 00:17:05.759 it to a non. 321 00:17:05.640 --> 00:17:07.039 IP and use a VPN. 322 00:17:07.240 --> 00:17:09.519 Yeah. Yeah, so that there's a bunch of different ways 323 00:17:09.519 --> 00:17:11.359 that you can secure this so that people can't get 324 00:17:11.400 --> 00:17:13.759 access to it. But yeah, this is being actively exploited. 325 00:17:13.759 --> 00:17:16.200 That's one of the other reasons this is so high. 326 00:17:16.759 --> 00:17:18.720 So if you are running I don't even think we 327 00:17:18.799 --> 00:17:21.680 mentioned the CV this is CVE twenty twenty six two 328 00:17:21.720 --> 00:17:25.319 one eight two. Yeah, if you are running a Cisco 329 00:17:25.519 --> 00:17:30.119 Catalyst sd WAN controller, there is an authentication bypass and 330 00:17:30.119 --> 00:17:31.680 you need to go out and make sure your management 331 00:17:31.759 --> 00:17:34.279 interface is not accessible on the internet. 332 00:17:34.640 --> 00:17:36.759 Just do it when you get to work. Man. Yeah, right, 333 00:17:36.759 --> 00:17:37.319 come on, you know. 334 00:17:37.279 --> 00:17:39.680 I didn't even tell you. Carl. On the Discord group, 335 00:17:39.720 --> 00:17:43.440 we had a savvy listener hit us up about our 336 00:17:43.880 --> 00:17:45.279 last recording. 337 00:17:45.480 --> 00:17:48.359 Okay, and the and the text. 338 00:17:48.079 --> 00:17:52.400 Goes something like this, Oh, lords of the iPhone, who 339 00:17:53.799 --> 00:17:57.640 who was it during this recording of security this week? 340 00:17:57.880 --> 00:18:01.720 Who had an Android device being out at about twenty 341 00:18:01.799 --> 00:18:02.519 four minutes in. 342 00:18:02.759 --> 00:18:04.359 Oh was that? And it was? 343 00:18:04.440 --> 00:18:06.240 It was actually on my desk. I do I have 344 00:18:06.279 --> 00:18:09.039 a sam and even named the device I do, I 345 00:18:09.039 --> 00:18:11.920 have a Samsung Android device sitting on my desk. 346 00:18:11.680 --> 00:18:14.039 Here started making happy noises, Yeah. 347 00:18:14.000 --> 00:18:17.400 Making happy noises because we do a lot of testing, right, 348 00:18:17.440 --> 00:18:19.200 tearing apart devices and that sort of stuff, and that 349 00:18:19.279 --> 00:18:21.400 one was just happened to be charging on my desk 350 00:18:21.759 --> 00:18:24.000 so I could tear it apart later. But yeah, so 351 00:18:24.839 --> 00:18:27.160 that was funny. Though. Well, I'm well done. I think 352 00:18:27.200 --> 00:18:28.279 that was larsk. 353 00:18:28.400 --> 00:18:31.000 I think we got to send that personal lock pick set. 354 00:18:31.079 --> 00:18:33.440 I think so I'm gonna do it. Yes, lock picks 355 00:18:33.480 --> 00:18:36.839 to you, sir or ma'am, but lockpicks to you all right, 356 00:18:36.880 --> 00:18:38.039 so I will hit you up privately. 357 00:18:38.200 --> 00:18:41.240 Okay, we done with that story. Weird, terrible, but you 358 00:18:41.279 --> 00:18:42.319 know what are you gonna do? 359 00:18:42.480 --> 00:18:42.839 Patch? 360 00:18:42.920 --> 00:18:46.920 All right? Next story, g seven countries release AI S 361 00:18:46.960 --> 00:18:50.640 bomb guidance, so we know what software bill of materials is, 362 00:18:50.680 --> 00:18:53.839 but now there's and there's a bomb for AI. 363 00:18:54.119 --> 00:18:57.680 So basically here's the thing. A software bill of materials 364 00:18:57.880 --> 00:18:59.839 is needed because we need to know what you have 365 00:19:00.359 --> 00:19:02.720 in the military dependencies when you had when you were 366 00:19:02.759 --> 00:19:04.880 defending something, you had to know what we were defending. 367 00:19:04.960 --> 00:19:07.200 You to know what your inventory was, what your people were, 368 00:19:07.839 --> 00:19:10.000 your vehicles, things like that. To defend you have to 369 00:19:10.000 --> 00:19:11.119 have an inventory. 370 00:19:11.200 --> 00:19:15.920 So it's not unlike if you're defending from an attacker, exactly, exactly. 371 00:19:16.240 --> 00:19:18.480 So the software bill of materials is something we've been 372 00:19:18.519 --> 00:19:20.680 talking about for a long time. Yeah, you don't know 373 00:19:20.720 --> 00:19:22.440 what you have, you don't know how to protect it. 374 00:19:22.880 --> 00:19:27.640 That also applies to crypto. Okay, so a C bomb 375 00:19:28.079 --> 00:19:30.839 is a cryptographic bill of materials, meaning in order to 376 00:19:30.839 --> 00:19:33.680 become quantum safe, see I work that in in order 377 00:19:33.720 --> 00:19:36.519 to become quantum safe, I'm already asleep. You have to 378 00:19:37.079 --> 00:19:39.160 you have to know where you're using crypto and what 379 00:19:39.240 --> 00:19:41.839 kind of crypto you're using. Well, that is now true, 380 00:19:41.880 --> 00:19:45.440 and it's painfully obvious that you need that for AI 381 00:19:45.559 --> 00:19:49.319 as well, because shadow it T used to be a 382 00:19:49.359 --> 00:19:52.240 problem with in the access days, in the mainframe days, 383 00:19:52.240 --> 00:19:54.079 and we you know, those of us with gray hair 384 00:19:54.119 --> 00:19:55.920 remember that, and the young people don't. 385 00:19:56.319 --> 00:19:58.880 I tell everybody what shadow i T is. 386 00:19:58.920 --> 00:20:02.960 Shadow it is. Hey, I need the powers that be 387 00:20:03.079 --> 00:20:04.920 to help me solve this problem. And they're like, go 388 00:20:05.559 --> 00:20:08.039 sit on an egg. I can't. I don't have time 389 00:20:08.039 --> 00:20:11.160 for you today. So they go solve it themselves. And 390 00:20:11.200 --> 00:20:14.200 so they vibe coding, or they're they're they're chatting, or 391 00:20:14.240 --> 00:20:16.920 they have little devices that they bring the meetings that 392 00:20:17.000 --> 00:20:20.160 are recording all the secrets and the NBA material and 393 00:20:20.200 --> 00:20:22.440 it's sending out off to the cloud. If you don't 394 00:20:22.480 --> 00:20:25.000 know what AI is inside the walls, you don't know 395 00:20:25.039 --> 00:20:26.960 how to secure it and lock it down. 396 00:20:27.160 --> 00:20:32.359 So we're talking about the LM hosts, the models, all 397 00:20:32.680 --> 00:20:33.200 all of that. 398 00:20:33.480 --> 00:20:36.920 Now everything you can talk to is potentially. 399 00:20:36.640 --> 00:20:39.880 Yeah, take Zoom right now, what code basis they have 400 00:20:39.920 --> 00:20:41.599 access to? I don't know if you guys have seen 401 00:20:41.640 --> 00:20:44.160