Speaker 1: Hey, Carl here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes, Spotify,
Speaker 1: or wherever you get Security this Week. Also, you can
Speaker 1: get an ad free feed by becoming a five dollars
Speaker 1: a month patron. Go to Patreon dot Security this Week
Speaker 1: dot com and sign up, and don't forget discord Discord
Speaker 1: dot Security this Week dot com. Lots of good stuff
Speaker 1: happening there. Yeah, I think that's it. So on with
Speaker 1: the podcast. So this man wakes up in the hospital.
Speaker 1: The phone rings. Doctor tells the man, I have really
Speaker 1: bad news. You're very sick after your collapse yesterday. We
Speaker 1: ordered several tests. You have avian flu ebola, your HIV positive,
Speaker 1: and you have hepatitis. Wow. The guy says, what are
Speaker 1: you gonna do? Doc replies, well, for starters, we're putting
Speaker 1: you on a strict diet of only pizza. He says,
Speaker 1: Will that really help me? Doc says no, but it's
Speaker 1: the only thing I can fit under the door. Nothing
Speaker 1: but serious, serious security talk here at Security this Week.
Speaker 1: I'm Carl Franklin. That's Patrick Hines and Dwaine Laflatte.
Speaker 2: Are we changing format?
Speaker 1: I was gonna say that doesn't sound like all right,
Speaker 1: we have six stories today. Let's start with this one.
Speaker 1: US Cyber Agency SISSA. But you know SISSA, so we
Speaker 1: had we had, we did have a Yeah, they do
Speaker 1: the scores, right, US Cyber Agency SISSA exposed reams of
Speaker 1: passwords and cloud keys to the open Web.
Speaker 2: Yeah, they're supposed to be better than this is what
Speaker 2: you're trying to say.
Speaker 1: I think, yeah, yeah, I mean this is SISSA. They
Speaker 1: give us the scores.
Speaker 3: Cyber Cybersecurity, Infrastructure and Security Agency. There's a lot of
Speaker 3: security in that name for someone who released a bunch
Speaker 3: of passwords.
Speaker 2: This never happened with Jen was running that show.
Speaker 3: I know, right, Jen's got to come back West Point
Speaker 3: Grad's right player of the guitar.
Speaker 1: Yeah, I know.
Speaker 3: I think she's happy where she is.
Speaker 2: I think it's pretty geeky that we know that.
Speaker 1: I didn't know you knew Jen.
Speaker 2: She went to West FO.
Speaker 1: You're on a first name basis with it.
Speaker 3: We only wish we knew Jen. We knew not.
Speaker 2: I'm very I'm very Kevin Bacon from Jen I know
Speaker 2: a lot of people who know her. She knows a
Speaker 2: lot of people that know me.
Speaker 1: But I do not know her.
Speaker 2: Okay, so wait, wait when Jenny Easterly?
Speaker 3: Yeah, when were you at West Point?
Speaker 2: I graduated eighty eight.
Speaker 3: When did she graduate? You know, I think she was within.
Speaker 2: A few years. I think we were there. You would
Speaker 2: have to look it up to know.
Speaker 1: Anyway, let's talk about this story. So the US Cybersecurity
Speaker 1: Agency says I may have escaped a sizable security breach
Speaker 1: thanks to a good faith security researcher who identified publy
Speaker 1: exposed credentials that allowed access to government cloud and internal
Speaker 1: agency system So were they compromised or were they not?
Speaker 3: I mean, it's just as much a compromise as if
Speaker 3: you take all of your passwords that you may have
Speaker 3: and put them out on your public website.
Speaker 1: All right, So nobody actually used them as far as
Speaker 1: we know now.
Speaker 3: So according to this, they're pretty sure that this cybersecurity
Speaker 3: researcher late On I believe is his name. Okay, I'm
Speaker 3: sure I'm butchering that found this before anybody else and
Speaker 3: reported it relatively quickly, And it was first reported by
Speaker 3: Brian Krabbs. We all know Brian Crabbs does a great job.
Speaker 3: So moral of the story. The way this kind of
Speaker 3: looks is there's a contractor doing work for SISSA. I'm
Speaker 3: not entirely sure why he had a spreadsheet or sheheet
Speaker 3: a spreadsheet of user names and passwords for valid government
Speaker 3: insights and then went to make a GitHub commit and
Speaker 3: committed it up to a public repo.
Speaker 1: Got to be careful where you save those spreadsheets.
Speaker 3: And then somebody saw it and save.
Speaker 1: Them outside of the reposts.
Speaker 3: Right exactly. Hey, listen, if you're vibe coding, mister contractor,
Speaker 3: maybe ask the AI not to put secret stuff in
Speaker 3: the in the directory that's coming public.
Speaker 2: I'm pretty sure that's that's a good conclusion.
Speaker 1: It was probably right.
Speaker 3: There might have been a little vibe coding at all.
Speaker 3: We're not confirming it here, but it's entirely possible.
Speaker 1: You can neither confirm nor deny, but it does.
Speaker 3: It does point out like you have a cybersecurity Infrastructure
Speaker 3: agency department that's totally focused on you know, cyber and
Speaker 3: and the right things to do, and they put our
Speaker 3: recommendations around tabletop, you know, exercises you should do with
Speaker 3: your organization, and you know, all sorts of really great
Speaker 3: information about how to protect yourself as an organization. And
Speaker 3: then you know, even they who are more cyber conscious
Speaker 3: than most could have something like this happened.
Speaker 1: So you never know.
Speaker 2: So it'll be interesting if there's any followup for the
Speaker 2: those were wondering. Jen At graduated two years after mem
Speaker 2: nolascin ninety so wait, she would have been a plebe
Speaker 2: when I was a junior.
Speaker 3: When you were a junior, I would have been very mean,
Speaker 3: so you could have you could have done mean things.
Speaker 2: I was usually harassing my classmates because I was the
Speaker 2: first sergeant, so I was more likely to be harassing
Speaker 2: them than God.
Speaker 1: I could have bumped into her in the hallway or
Speaker 1: stolen her gaze over a cup of coffee.
Speaker 2: Yeh, I just know that on LinkedIn. I think we
Speaker 2: have a lot of people in common.
Speaker 1: Interesting. Okay, anyway, let's move on. Cyber Unicorn Sierra Sierra
Speaker 1: cy E r A acquires five month old startup Genie
Speaker 1: Security and fifty million dollar deal. So it's an Israeli
Speaker 1: startup with just five employees, joints cybersecurity company with acquisition Spree.
Speaker 3: First off, they got a couple of things going for
Speaker 3: him there is rarely, which means you know security, right,
Speaker 3: I mean all your firewall.
Speaker 2: Companies positive bias. Is that what you're saying, Yeah, exactly,
Speaker 2: That's what I'm yeah. So this the reason this story
Speaker 2: is here is because this market's a little crazy. People
Speaker 2: don't know where cyber is going, whether it's going away,
Speaker 2: which has been predicted for thirty years by people including
Speaker 2: Dwayne and I at one point, and there's a lot
Speaker 2: of fear. There's a lot of people who are trying
Speaker 2: to figure out where it's going. I think it's going
Speaker 2: to be more of the same. We've noticed that there
Speaker 2: are more patches in every more vulnerabilities in every patch.
Speaker 2: Things are accelerating, but it's been on that trajectory for
Speaker 2: a while. This will be a big evolution in what
Speaker 2: cyber means and what protection looks like. But I don't
Speaker 2: think the industry itself goes away. I don't think the
Speaker 2: industry automates to the head of a pin on AI
Speaker 2: or anything like that. But it it's definitely changing. So
Speaker 2: this is a sign of these times that a five
Speaker 2: month old, five persons startup can sell for fifty million dollars.
Speaker 2: Some of that's going to just be hyped, that's going
Speaker 2: to wash away, and some of it going to be
Speaker 2: they just have a really good idea or they're doing
Speaker 2: things in a very interesting way.
Speaker 3: So fifty million dollars five months start up, ten million
Speaker 3: dollars a month they earned invaluation. That's on an idea,
Speaker 3: not bad on an idea. So that's yeah, that's insane.
Speaker 2: So this isn't really a news like that we normally cover,
Speaker 2: but but it's it is. You're going to see a
Speaker 2: lot more stories like this. There's a lot more you know,
Speaker 2: the market punishing incumbents like like CrowdStrike and Carbon Black
Speaker 2: because of an announcement of an AI that might come
Speaker 2: out that might change things. Everybody's waiting for where the
Speaker 2: chips are going to fall. I don't think we're going
Speaker 2: to know this year.
Speaker 3: Yeah, although, okay, there's gonna be a lot of awesome
Speaker 3: things this year. I know, I know some of the
Speaker 3: some of the things that we're working on are awesome.
Speaker 2: Okay, and that should scare us all.
Speaker 3: It's gonna be a lot of awesome things.
Speaker 1: Yeah, things that we can't talk about.
Speaker 3: Things we can't talk about, but things that are awesome.
Speaker 2: Wow, it's getting through.
Speaker 1: Oh, my god. All right, next story, Webworm deploys Echo
Speaker 1: creep and graph worm backdoors using Discord and Microsoft graph API.
Speaker 1: You know, if I just read that out of context
Speaker 1: to my mom, she would think I'd lost my mind.
Speaker 3: Oh wait, yeah, read this sentence, Carl.
Speaker 1: Hey mom. Webworm deploys Echo creep and graph worm backdoors
Speaker 1: using Discord and MS graph APIs plan.
Speaker 3: Is don't judge in one one because you're having a stroke.
Speaker 1: She just parachute in from over here.
Speaker 3: And yeah, it doesn't get any better. The third paragraph
Speaker 3: in a tax mounted by the group have leveraged remote
Speaker 3: access trojans. All right, we all know what rats are, right.
Speaker 3: Piece of malware allows somebody to access your system, like
Speaker 3: ghost Rat nine to two rat aka the Hydrack and
Speaker 3: mick Rat with cheese. The threat actor is said to
Speaker 3: overlap with China's Nexus cluster, tracked as Phishmonger or Aquatic
Speaker 3: Panda six Little Monkeys in the Space Pirates Six Little
Speaker 3: Monkeys is best known for deploying ghost Rat. Like, what
Speaker 3: the hell?
Speaker 1: What do you think of that? Mom?
Speaker 3: Exactly? It's it's like some sort of japanimation thing, like
Speaker 3: we're I don't know what we're talking about. Anymore.
Speaker 1: It's the most surreal sentence I've ever read on the internet.
Speaker 3: Yeah, a paragraph rather six little monkeys working with the
Speaker 3: phishmongers in the space prits. I mean, I thought I'd
Speaker 3: never see it in my life, but there you go.
Speaker 1: All right, So in English, what happened here?
Speaker 2: So the space.
Speaker 3: To follow me here. So all this is is this
Speaker 3: is a quick warning that we've talked about commanding control
Speaker 3: in the past, right, So, if you have a piece
Speaker 3: of malicious software sitting on your network, it's probably reaching
Speaker 3: out somewhere. Commanding control is much harder to detect on
Speaker 3: your network if it's using valid channels. So, for example,
Speaker 3: if I'm reaching out over DNS, or I'm reaching out
Speaker 3: over web traffic or like, you probably won't pick that
Speaker 3: up right now. Corporate networks generally inspect web traffic, right
Speaker 3: so they can see what's inside web traffic, So you
Speaker 3: don't want to use web traffic. Corporate networks a lot
Speaker 3: of times will use secure DNS, so kind of hard
Speaker 3: for you to breach that as well and use it
Speaker 3: as a command control structure. But then again, corporate networks
Speaker 3: will also use things like Microsoft Office, and they sometimes
Speaker 3: will use chat programs like Discord, so it's harder to
Speaker 3: inspect that traffic. So what this is saying is there's
Speaker 3: a lot of threat actors out there that are now
Speaker 3: piggybacking on Discord as a command and control which is
Speaker 3: funny because we've been doing it for a year or quarter,
Speaker 3: but piggybacking Discord for command and control because it's harder
Speaker 3: to detect the traffic that's inside there, and also using
Speaker 3: the Microsoft Graph API. If the Microsoft Graph API sounds
Speaker 3: like it might be familiar, if you guys have been
Speaker 3: listening to this show for a while, which we should.
Speaker 1: We should tell everybody what it is. I mean, it's
Speaker 1: basically the one API to rule them all for your accounts, right,
Speaker 1: what could go wrong? It's it's basically gives you access
Speaker 1: to all of your documents, your Excel, spreadsheets, your Mike
Speaker 1: you know what is it? Three sixty Yeah, all that
Speaker 1: stuff in one place. It's just one huge API for
Speaker 1: you and your account to go get everything that you
Speaker 1: can do on Microsoft's websites.
Speaker 3: And there used to be, uh, there was a tactic
Speaker 3: called token tactics. So if you guys look up token
Speaker 3: tactics where you could actually request a user's graph API
Speaker 3: through a sneaky social engineering way and then gain access
Speaker 3: to their accounts, and then have the ability to renew
Speaker 3: your token every ninety days that you contain, you'd still
Speaker 3: maintain access to their to their accounts, their you know,
Speaker 3: Microsoft Office Suite without them ever seeing you log in,
Speaker 3: even if you change your password. So there's a lot
Speaker 3: of really kind of cool things you could do with
Speaker 3: the graph API. A while ago, some of that's been
Speaker 3: shut down, but now it's being used for commanding control.
Speaker 1: So hang on second, my interns at the door, what,
Speaker 1: oh no, thanks, elliit Later he just brought me a micrat.
Speaker 4: With cheese, sit down with the Space pirates in this
Speaker 4: six little monkeys, Yeah exactly, mcrat.
Speaker 1: All right, So you know, this is just a tale
Speaker 1: of woe. There's nothing really that anybody can do about it.
Speaker 1: Stuff happens.
Speaker 3: Yeah, and I think a lot of it is like,
Speaker 3: no matter how good you are at monitoring outbound traffic,
Speaker 3: there's still gonna be ways that people can get past that.
Speaker 3: So defense and depth, like Patrick is always talking about,
Speaker 3: is key here, right, Don't just trust one outbound filtering
Speaker 3: rule to make sure that oh we're not getting hit
Speaker 3: with this this type of traffic, you know, you obviously
Speaker 3: need point detection on laptops and desktops. You need to
Speaker 3: make sure that if Discord is not a corporate communications
Speaker 3: platform for you, heads up block it, right, That's probably
Speaker 3: the safest thing.
Speaker 2: So I'm going to say something very Dwayne esque that
Speaker 2: I should probably have edited out, but I probably won't
Speaker 2: if I.
Speaker 3: So the sick way, do I have to get the lawyers? Now?
Speaker 2: Should I play the music?
Speaker 1: Patrick?
Speaker 2: It's the signal protocol is published and you can write
Speaker 2: your own rapper and use the signal protocol. Would that
Speaker 2: be distinguishable? So if you get an organization that uses
Speaker 2: signal and you had a agent or piece of code
Speaker 2: that was using would that be discernible? So by the
Speaker 2: by the perimeter.
Speaker 3: Here will tell you the signal protocol is the way
Speaker 3: that you can wrap the messages, but not necessarily the
Speaker 3: ports on back end server and that sort of stuff.
Speaker 3: So could I could I mimic the way signal actually
Speaker 3: talks through the network, Probably you wouldn't be able to
Speaker 3: intercept it. You're absolutely right, I mean, that's probably a
Speaker 3: very secure way for you to transmit data. Honestly, even
Speaker 3: using maybe something like the signal CLI on a rat
Speaker 3: of some sort where you can just send messages through
Speaker 3: a normal signal protocol and the signal.
Speaker 1: Servers to idea.
Speaker 3: Twayne, I like that, all right, signal.
Speaker 1: Now you got to put the theme song in there somewhere.
Speaker 1: All right, Well, take a break, okay, and we'll be
Speaker 1: right back after these very very very very important messages.
Speaker 1: And we're back. It's Security of this week. I'm Carl.
Speaker 1: Let's Dwayne and Patrick, and we got a couple more
Speaker 1: interesting stories here. Cisco warns of new critical s D
Speaker 1: one flaw exploited in zero day attacks. And this is
Speaker 1: a ten, isn't it? It's a ten.
Speaker 2: They stuck the landing.
Speaker 3: I know, right, well done? Uh yeah, I think this
Speaker 3: is a ten because A not hard to exploit. B
Speaker 3: you gain administrative access and get to manipulate the sd
Speaker 3: WAN fabric and.
Speaker 2: CE definitely on the internet.
Speaker 1: People put it on.
Speaker 3: The internet, right, so super accessible.
Speaker 2: Well it's not really much good without the Internet.
Speaker 3: Yeah, I got this awesome network that can't talk to anything.
Speaker 3: The thing is a network at that point. Yeah, the
Speaker 3: thing that I work, Yeah exactly, it's definitely a not work.
Speaker 3: The thing I find fascinating about and we've seen several
Speaker 3: styles of attacks like this is why oh, why oh,
Speaker 3: why would you put management access because you have to
Speaker 3: hit the management interface? Why would you put management access
Speaker 3: out on the internet? And if you did for a
Speaker 3: particular reason, why wouldn't you point it at a trusted
Speaker 3: IP address, like oh, only my house IPEE can hit
Speaker 3: this management interface on the internet so that I can
Speaker 3: come and you know whatever. But it just it doesn't
Speaker 3: make any sense to me when we see firewalls being
Speaker 3: exploited remotely and you go, well, how's that possible? Firewalls
Speaker 3: drop traffic? Oh unless you tell it. Yeah, listen to
Speaker 3: management traffic on the internet, which still blows my mind.
Speaker 1: Now I'm reading this and I don't see that there's
Speaker 1: a patch available. But I do see that in this
Speaker 1: is May twentieth when recording this, that SISA has added
Speaker 1: this flaw to the Known Exploited Vulnerabilities Catalog, ordering federal
Speaker 1: agents to patch affected devices by May seventeenth. Right, okay,
Speaker 1: but I don't see any patch.
Speaker 3: Any any listed patch now, So in this case, the
Speaker 3: patch immediately is really a remediation step, so they're unplug it. Yeah, yeah, honestly,
Speaker 3: you know you're not far off evacurate there, unplug it.
Speaker 3: It's the the remediation step is don't put the management
Speaker 3: interface on the internet.
Speaker 2: Friends. Don't let friends manage from the internet.
Speaker 1: Yeah, that's right.
Speaker 3: And if you have to for some reason, then restrict
Speaker 3: it to a non.
Speaker 1: IP and use a VPN.
Speaker 3: Yeah. Yeah, so that there's a bunch of different ways
Speaker 3: that you can secure this so that people can't get
Speaker 3: access to it. But yeah, this is being actively exploited.
Speaker 3: That's one of the other reasons this is so high.
Speaker 3: So if you are running I don't even think we
Speaker 3: mentioned the CV this is CVE twenty twenty six two
Speaker 3: one eight two. Yeah, if you are running a Cisco
Speaker 3: Catalyst sd WAN controller, there is an authentication bypass and
Speaker 3: you need to go out and make sure your management
Speaker 3: interface is not accessible on the internet.
Speaker 1: Just do it when you get to work. Man. Yeah, right,
Speaker 1: come on, you know.
Speaker 3: I didn't even tell you. Carl. On the Discord group,
Speaker 3: we had a savvy listener hit us up about our
Speaker 3: last recording.
Speaker 1: Okay, and the and the text.
Speaker 3: Goes something like this, Oh, lords of the iPhone, who
Speaker 3: who was it during this recording of security this week?
Speaker 3: Who had an Android device being out at about twenty
Speaker 3: four minutes in.
Speaker 1: Oh was that? And it was?
Speaker 3: It was actually on my desk. I do I have
Speaker 3: a sam and even named the device I do, I
Speaker 3: have a Samsung Android device sitting on my desk.
Speaker 1: Here started making happy noises, Yeah.
Speaker 3: Making happy noises because we do a lot of testing, right,
Speaker 3: tearing apart devices and that sort of stuff, and that
Speaker 3: one was just happened to be charging on my desk
Speaker 3: so I could tear it apart later. But yeah, so
Speaker 3: that was funny. Though. Well, I'm well done. I think
Speaker 3: that was larsk.
Speaker 1: I think we got to send that personal lock pick set.
Speaker 3: I think so I'm gonna do it. Yes, lock picks
Speaker 3: to you, sir or ma'am, but lockpicks to you all right,
Speaker 3: so I will hit you up privately.
Speaker 1: Okay, we done with that story. Weird, terrible, but you
Speaker 1: know what are you gonna do?
Speaker 2: Patch?
Speaker 1: All right? Next story, g seven countries release AI S
Speaker 1: bomb guidance, so we know what software bill of materials is,
Speaker 1: but now there's and there's a bomb for AI.
Speaker 2: So basically here's the thing. A software bill of materials
Speaker 2: is needed because we need to know what you have
Speaker 2: in the military dependencies when you had when you were
Speaker 2: defending something, you had to know what we were defending.
Speaker 2: You to know what your inventory was, what your people were,
Speaker 2: your vehicles, things like that. To defend you have to
Speaker 2: have an inventory.
Speaker 3: So it's not unlike if you're defending from an attacker, exactly, exactly.
Speaker 2: So the software bill of materials is something we've been
Speaker 2: talking about for a long time. Yeah, you don't know
Speaker 2: what you have, you don't know how to protect it.
Speaker 2: That also applies to crypto. Okay, so a C bomb
Speaker 2: is a cryptographic bill of materials, meaning in order to
Speaker 2: become quantum safe, see I work that in in order
Speaker 2: to become quantum safe, I'm already asleep. You have to
Speaker 2: you have to know where you're using crypto and what
Speaker 2: kind of crypto you're using. Well, that is now true,
Speaker 2: and it's painfully obvious that you need that for AI
Speaker 2: as well, because shadow it T used to be a
Speaker 2: problem with in the access days, in the mainframe days,
Speaker 2: and we you know, those of us with gray hair
Speaker 2: remember that, and the young people don't.
Speaker 1: I tell everybody what shadow i T is.
Speaker 2: Shadow it is. Hey, I need the powers that be
Speaker 2: to help me solve this problem. And they're like, go
Speaker 2: sit on an egg. I can't. I don't have time
Speaker 2: for you today. So they go solve it themselves. And
Speaker 2: so they vibe coding, or they're they're they're chatting, or
Speaker 2: they have little devices that they bring the meetings that
Speaker 2: are recording all the secrets and the NBA material and
Speaker 2: it's sending out off to the cloud. If you don't
Speaker 2: know what AI is inside the walls, you don't know
Speaker 2: how to secure it and lock it down.
Speaker 1: So we're talking about the LM hosts, the models, all
Speaker 1: all of that.
Speaker 2: Now everything you can talk to is potentially.
Speaker 3: Yeah, take Zoom right now, what code basis they have
Speaker 3: access to? I don't know if you guys have seen
Speaker 3: the latest incarnation of Zoom. If you install it on
Speaker 3: your desktop, if you fire up a Microsoft Teams meeting,
Speaker 3: not Zoom, a Teams meeting, Zoom pops up and says,
Speaker 3: do you want me to take notes?
Speaker 1: I have seen that.
Speaker 2: I did not see that.
Speaker 3: Yeah, yeah, yeah. The latest one will now say anytime
Speaker 3: you are in a video and or voice call, anytime
Speaker 3: the mic pops up, it'll be like, do you want
Speaker 3: me to take notes? I see, I see you're doing
Speaker 3: a thing. I can take notes and that's all passing
Speaker 3: through their AI. It's very h and you ask yourself,
Speaker 3: so what AI are they using, and what are the ramifications?
Speaker 2: And which Chinese cities it hosted it?
Speaker 1: I think the word is province, But which province they
Speaker 1: have cities? That's true?
Speaker 3: No, no, just provinces. Uh so, yeah, needless to say,
Speaker 3: I think it's important.
Speaker 1: So why why is it called an AI S bomb
Speaker 1: and not just an AI bomb?
Speaker 2: It should be an A bomb, A bomb AI bill
Speaker 2: of materials.
Speaker 1: Right, I guess because software.
Speaker 2: It's k I, not AI. Huh ok because KUNLUS is
Speaker 2: artificial kul intelligence k E.
Speaker 3: That's thanks.
Speaker 1: So this is guidance from government agencies, from the group
Speaker 1: of seven that jointly published this guidance to help organizations
Speaker 1: create an S bomb for a So here's the thing.
Speaker 2: We are woefully behind in S bomb. Yeah, and so
Speaker 2: now we're just piling on and crypto bomb and A bomb.
Speaker 3: And I was gonna say, it's it's on the queue.
Speaker 3: We'll work on it in about ten or twelve years.
Speaker 2: I think the only one we're up to speed with
Speaker 2: is lip bomb. That's it.
Speaker 3: Yeah, exactly, good call, good call, all right.
Speaker 1: So the feature story is not about the man who
Speaker 1: woke up in a hospital, but it's the first public
Speaker 1: mac Os kernel memory corruption exploit on Apple M five.
Speaker 1: And the reason it's a feature story is because you
Speaker 1: don't really hear of problems with Max and mac Os
Speaker 1: being attacked.
Speaker 2: Or isn't it like designed to not have memory problems?
Speaker 2: That's the whole Yeah, so yeah, valu wick, isn't it?
Speaker 3: Yeah? Apple spent I don't know, five years and billions
Speaker 3: of dollars on what they call Memory into Integrity and
Speaker 3: Force m I E.
Speaker 2: How's that working out?
Speaker 3: Uh? Well, it's it's actually been pretty awesome up til now.
Speaker 2: Somebody, we are.
Speaker 1: The iPhone, the lords of the iPhone apparently.
Speaker 3: Yeah, the low words of the iPhone say it's awesome.
Speaker 3: Som i E is the culmination of an unprecedented design
Speaker 3: and engineering effort spanning half a decade that combines unique
Speaker 3: strengths of Apple silicon hardware and advanced operating system security
Speaker 3: to make sure that memory corruption doesn't happen. And then
Speaker 3: if you take a look at this article, there are
Speaker 3: two guys standing in front of the Apple, you know,
Speaker 3: the Apple signing Cooper Tino mm hmm. And if you
Speaker 3: zoom in on that picture that's redacted.
Speaker 1: Yeah, that's right. I wondered why the red square. It's
Speaker 1: a big red square if you.
Speaker 3: Read interestingly enough, if you read above it, it says
Speaker 3: from type confusion to root. Okay, so they're using type
Speaker 3: confusion and they say they're not going to publish anything
Speaker 3: until uh, you know, until you into has been patched.
Speaker 3: And then if you look at the first look at
Speaker 3: the video, they actually, oddly enough in this video show
Speaker 3: a bunch of the memory addresses that they're actually attacking.
Speaker 3: So you can probably reasonably say, AI will look at
Speaker 3: the picture and the video the spray that they're doing
Speaker 3: here and say, oh, yeah, I know what they're attacking.
Speaker 1: So the most interesting thing about this whole article is
Speaker 1: that the engineers of the people that wrote the article,
Speaker 1: working together with Mythos Preview, built a working exploit in
Speaker 1: five days. Yeah, isn't so, you know, I guess they're
Speaker 1: the good guys.
Speaker 2: But did they go to arubafore the other three?
Speaker 3: I mean, yeah, whats it so long? I don't even understand.
Speaker 1: Says we wanted Early this week, we had a meeting
Speaker 1: at Apple Park and Coupertino. While there, we also shared
Speaker 1: with Apple our latest vulnerability research report, the first public
Speaker 1: Maco S Colonel Memory cre exploit on M five Silicon
Speaker 1: Surviving Mie. It was laser printed in honor of our
Speaker 1: hacker friends. We wanted to report it in person instead
Speaker 1: of getting buried in the submission flood that some unfortunate
Speaker 1: poone to own participants just experience. Most respected hackers avoid
Speaker 1: human interaction whenever possible, So this physical strategy may give
Speaker 1: us a slight edge in the eternal race for five
Speaker 1: minutes of faming glory on Twitter.
Speaker 3: True story.
Speaker 1: So this is the story of the exploit in our
Speaker 1: field trip. Full technical details will be shared after Apple
Speaker 1: fixes the vulnerabilities in attack path. Hopefully it won't take
Speaker 1: our beloved company too long. We only budgeted one year
Speaker 1: of domain registration fees for this attack. So it's basically
Speaker 1: two guys who used and I haven't read far enough
Speaker 1: to know where they were from, but they are.
Speaker 2: So are they employees of Apple? Because you've got to
Speaker 2: be with one of the companies or a contractor to
Speaker 2: use myth those right.
Speaker 1: Now, Yeah, that's what that's my question.
Speaker 3: Yeah, are ways to sign up for mythos depending on
Speaker 3: whether you're a reputable security researcher and that sort of stuff.
Speaker 3: I'm gonna leave it at that. What's interesting is if
Speaker 3: you click halfway through this article, there's this mad bugs link, yes,
Speaker 3: where they talk about all of their AI exploits, like
Speaker 3: using using Aida to find bugs in Ida, using Quawa.
Speaker 3: How I got rooted on FreeBSD with a shell script.
Speaker 3: All right, So the mac os one, right, So they
Speaker 3: go through a bunch of places that your reverse engineering
Speaker 3: tools are belonging to us.
Speaker 1: So this is a private hacking security firms Califf. It's
Speaker 1: a security firm from California, trying to keep the Internet
Speaker 1: together by occasionally taking it apart.
Speaker 3: Codex.
Speaker 1: So they somehow got access to Mythos Mythos. Yeah, yeah.
Speaker 2: It may be because they're working on some of the
Speaker 2: maybe the contracts with somebody.
Speaker 3: Yeah or not. I mean, honestly, you can. We could
Speaker 3: apply for Mythos if we wanted to have access to Mythos.
Speaker 3: It's not that big a deal. It's just not it's okay,
Speaker 3: just not great. There are better ways than Mythos too.
Speaker 3: I'm gonna leave it at that.
Speaker 1: Yes, well, thank you, okay, yeah, thanks.
Speaker 3: Going to stop talking.
Speaker 1: Yeah, you should forward the lawyer rock jump on.
Speaker 3: But there yeah, there are better models than.
Speaker 1: Okay, anybody you want to make rat with cheese before
Speaker 1: we sign off.
Speaker 3: Let me ask my Space pirates.
Speaker 1: Okay, Well that's it. That's all that happened that we
Speaker 1: could find anyway in what happened last week, and we'll
Speaker 1: talk to you next week on security this week, Bye bye,
Speaker 1: thanks everybody, my guys,