WEBVTT 1 00:00:00.320 --> 00:00:03.200 Hey Carl here, we're on a mission to find new 2 00:00:03.240 --> 00:00:05.919 fans of the show. I mean, where else can you 3 00:00:05.960 --> 00:00:10.240 get real life comedy and horror in one podcast. You 4 00:00:10.279 --> 00:00:13.640 can do your part by leaving us a review on iTunes, Spotify, 5 00:00:13.759 --> 00:00:16.879 or wherever you get Security this week. Also, you can 6 00:00:16.920 --> 00:00:19.399 get an ad free feed by becoming a five dollars 7 00:00:19.399 --> 00:00:22.239 a month patron. Go to Patreon dot Security this week 8 00:00:22.320 --> 00:00:26.160 dot com and sign up, and don't forget Discord. Discord 9 00:00:26.199 --> 00:00:28.839 dot Security this week dot com. Lots of good stuff 10 00:00:28.879 --> 00:00:32.439 happening there. Yeah, I think that's it. So on with 11 00:00:32.560 --> 00:00:33.200 the podcast. 12 00:00:34.159 --> 00:00:36.840 Hey guys, I'm sorry I sound like very white today, 13 00:00:36.880 --> 00:00:39.600 but I've got a cold, so I got some sexy 14 00:00:39.640 --> 00:00:45.759 flam going on. Sorry. So, a drunk staggers into a 15 00:00:45.799 --> 00:00:49.000 Catholic church and sits down in a confession booth and 16 00:00:49.039 --> 00:00:52.439 he says nothing, And the priest you know, is waiting 17 00:00:52.560 --> 00:00:56.280 for something and gives a little coffica, and the guy 18 00:00:56.320 --> 00:00:59.960 still says nothing. He taps on the window, the door 19 00:01:00.119 --> 00:01:03.560 or whatever, and the guy still says nothing. And then 20 00:01:03.560 --> 00:01:06.000 he taps a little bit louder. He knocks a little louder, 21 00:01:06.159 --> 00:01:09.400 and he hears this voice say it's no use. There's 22 00:01:09.439 --> 00:01:11.359 no toilet paper over here either. 23 00:01:19.560 --> 00:01:20.439 I've been to that church. 24 00:01:29.640 --> 00:01:32.359 Welcome back to security this week. I'm Carl Franklin. That's 25 00:01:32.359 --> 00:01:35.280 Patrick Kines and Dwayne Laflotte, and we got a few 26 00:01:35.319 --> 00:01:38.359 stories here. This one Reuter's is reporting I ran linked 27 00:01:38.400 --> 00:01:43.920 hackers breach FBI director's personal email, published photos and documents. 28 00:01:45.400 --> 00:01:49.159 So from the headline, is it published photos and documents 29 00:01:49.200 --> 00:01:53.000 like it breaches those or publishes photos in documents. 30 00:01:53.000 --> 00:01:56.439 I think they published their photo, his photos and documents. Now, 31 00:01:57.840 --> 00:01:59.840 some of this guy, you know, the director of the 32 00:01:59.879 --> 00:02:02.920 FBI's public photos that they put out on purpose, are 33 00:02:02.920 --> 00:02:07.480 more embarrassing than anything I've heard about. So I mean, yeah, 34 00:02:07.519 --> 00:02:11.240 this is news, but it's supposedly there's no government information 35 00:02:11.360 --> 00:02:15.360 in here. So far, there's no confidential information, you know, 36 00:02:15.360 --> 00:02:19.240 other than personal So I haven't seen anything surface that 37 00:02:19.319 --> 00:02:23.159 says and here's the scandal. The scandal is he should 38 00:02:23.159 --> 00:02:25.800 have been better about a security. But we have many 39 00:02:26.120 --> 00:02:29.120 historical figures in politics that have been been fished and 40 00:02:29.159 --> 00:02:30.560 hacked and yeah, the same way. 41 00:02:30.680 --> 00:02:33.159 So it's just an embarrassment play kind of I think. 42 00:02:33.199 --> 00:02:36.680 So again, it's early days, but I would assume this 43 00:02:36.719 --> 00:02:39.439 has been sliced and diced, and there's if there was 44 00:02:39.479 --> 00:02:42.919 a smoking gun, you know, admission of something, we'd see it. 45 00:02:43.360 --> 00:02:45.360 And they say this was an old account, right, it 46 00:02:45.439 --> 00:02:51.360 hadn't been accessed since twenty nineteen. The account credentials were 47 00:02:51.400 --> 00:02:58.439 actually in an old breach. Oh wow, So no MFA. Okay, 48 00:02:58.520 --> 00:03:04.400 that's actually pretty terrib But so the prevailing speculation right 49 00:03:04.439 --> 00:03:07.680 now is, well, at least he's not in law enforcement. 50 00:03:08.520 --> 00:03:15.759 Oh wait, the prevailing speculation is the attackers grabbed these 51 00:03:15.840 --> 00:03:18.400 credentials off of an old breach and finally get around 52 00:03:18.439 --> 00:03:22.280 to credential stuffing them into Gmail and then pulled up. 53 00:03:22.439 --> 00:03:24.919 And it's a Gmail account. And I'll be honest, I 54 00:03:25.120 --> 00:03:28.280 don't share my Gmail account, but there's nothing in it 55 00:03:28.319 --> 00:03:30.280 that I would be of any use to anybody. I 56 00:03:30.280 --> 00:03:32.919 don't use it for anything. There's lots and lots and 57 00:03:32.960 --> 00:03:33.719 lots of spam. 58 00:03:33.919 --> 00:03:35.800 Well, what do you use that's better than or more 59 00:03:35.840 --> 00:03:36.759 secure than Gmail? 60 00:03:37.120 --> 00:03:40.240 I use my corporate account. I don't have a personal line. 61 00:03:40.360 --> 00:03:42.719 But what's the what's the system? Is it? Is it 62 00:03:42.759 --> 00:03:43.919 an outlook system? 63 00:03:44.039 --> 00:03:48.080 Is it a It's it's Microsoft off Microsoft hosted Microsoft, okay, 64 00:03:48.120 --> 00:03:52.199 and guarded by Dwayne I almost thought he wasn't going 65 00:03:52.240 --> 00:03:54.360 to say I know, right. He was almost like, I 66 00:03:54.360 --> 00:03:56.800 almost didn't say. I didn't say which Microsoft. It might 67 00:03:56.840 --> 00:03:57.520 be the secret one. 68 00:03:57.599 --> 00:04:00.719 Oh okay, all right, So this is a big story, 69 00:04:00.879 --> 00:04:04.840 so big. My pharmacystem driving through from me, goes Carl. 70 00:04:04.919 --> 00:04:08.599 Did you hear about this Claude code source code appears 71 00:04:08.639 --> 00:04:11.639 to have leaked? And here's what we know. Yeah, this 72 00:04:11.680 --> 00:04:13.400 is from venture Beat, half. 73 00:04:13.280 --> 00:04:16.759 A million lines. What I think the biggest outcome from 74 00:04:16.800 --> 00:04:19.480 this is it's giving a big leg up to the competition. 75 00:04:19.720 --> 00:04:22.720 The competition gets to see what they're doing. You can't 76 00:04:22.959 --> 00:04:25.319 there's no patent on any of this stuff. It's trademark, 77 00:04:25.399 --> 00:04:27.399 but you don't have to change it that much. In hell, 78 00:04:27.639 --> 00:04:29.600 Claude code could probably change it for you enough that 79 00:04:29.639 --> 00:04:35.839 it wouldn't match. So it's a major mistake. It gives 80 00:04:37.639 --> 00:04:39.839 help to those who are trying to catch up to Claude. 81 00:04:39.879 --> 00:04:41.959 It just means they got to run faster. That said, 82 00:04:42.079 --> 00:04:44.839 I think in light of their controversy with the military, 83 00:04:45.120 --> 00:04:47.319 they out came out pretty good. They came out with 84 00:04:47.720 --> 00:04:51.079 rising revenue, and the reaction by open Ai is actually 85 00:04:51.120 --> 00:04:53.639 hurt open Ai more than it's hurt Claude. 86 00:04:53.639 --> 00:04:55.560 Well, they weren't going to play that game. Nope, it's 87 00:04:55.600 --> 00:04:56.160 basically it. 88 00:04:56.360 --> 00:04:59.639 Yeah, and this the way that this quote unquote leaked. 89 00:05:01.600 --> 00:05:04.480 We we look for this type of thing when we're attacking 90 00:05:04.560 --> 00:05:09.000 applications all the time. So they have a you guys 91 00:05:09.040 --> 00:05:10.879 have all like if you've done C plus plus development 92 00:05:10.920 --> 00:05:12.920 and that sort of stuff, or if you've tried to 93 00:05:13.040 --> 00:05:16.920 you know, read. Let's say you're you're trying to debug 94 00:05:17.319 --> 00:05:19.399 a C plus plus program or a driver or whatever. 95 00:05:19.560 --> 00:05:23.199 Good luck, I know, right, there are all these P 96 00:05:23.319 --> 00:05:25.000 two B files and all sorts of things you can 97 00:05:25.000 --> 00:05:27.800 load up so that while that particular code is running, 98 00:05:28.199 --> 00:05:31.480 you know where the code is at. Right, they're debug files, 99 00:05:32.079 --> 00:05:34.639 and there are debug files that you can use to 100 00:05:34.839 --> 00:05:38.199 map the running code to actual code, so you can 101 00:05:38.240 --> 00:05:43.519 debug running live applications. In Java, that's called Java map, 102 00:05:43.600 --> 00:05:46.720 So there's a map file where you can actually see 103 00:05:46.759 --> 00:05:50.399 like comments and code and all sorts of other things. 104 00:05:51.519 --> 00:05:54.040 But it's never supposed to be deployed with the application. 105 00:05:54.959 --> 00:05:57.519 So and we see it all the time where you know, 106 00:05:57.639 --> 00:06:00.319 we'll reach into uh, you know, hosted Java applic cation 107 00:06:00.439 --> 00:06:02.319 in some way and just pull down that map file 108 00:06:02.360 --> 00:06:04.079 and say, okay, cool, now we know how kind of 109 00:06:04.120 --> 00:06:08.040 everything's working on the back end. Yeah, so you got 110 00:06:08.040 --> 00:06:11.279 to be careful with what you actually push into where 111 00:06:11.720 --> 00:06:12.079 all right. 112 00:06:12.680 --> 00:06:14.720 So it's not like you could fork the repo out 113 00:06:14.759 --> 00:06:15.720 and run your own cloud. 114 00:06:15.959 --> 00:06:18.720 No, gosh, I don't know that you'd have the compute 115 00:06:18.800 --> 00:06:24.120 that would be impressive. But the interesting sort of secret 116 00:06:24.199 --> 00:06:29.639 sauce here though, is it defines how claud actually and 117 00:06:29.639 --> 00:06:31.399 one of the things that was the most important thing 118 00:06:31.439 --> 00:06:35.480 to leak was it defines how claud code actually splits 119 00:06:35.480 --> 00:06:39.759 its memory apart. So when you're talking to these lms 120 00:06:41.800 --> 00:06:44.560 as you if you just ask it like information about 121 00:06:44.600 --> 00:06:47.120 the weather or the area whatever, real quick, not a problem. 122 00:06:47.199 --> 00:06:49.120 It has this transient memory. It does a pretty good 123 00:06:49.160 --> 00:06:52.319 job for any of you who are using either GitHub 124 00:06:52.319 --> 00:06:54.959 code or cloud code or whatever. You'll notice over time, 125 00:06:56.040 --> 00:06:59.879 as your conversessions are getting more and more complex, as 126 00:07:00.160 --> 00:07:02.639 it's getting deeper and deeper, as you're talking about multi 127 00:07:02.680 --> 00:07:05.759 layered architecture, et cetera, et cetera, there are times it 128 00:07:05.800 --> 00:07:08.600 loses its mind, right and it's like, oh, I didn't 129 00:07:08.680 --> 00:07:11.879 remember that we were using AWS, and you're like, well. 130 00:07:11.759 --> 00:07:12.199 That's weird. 131 00:07:12.240 --> 00:07:15.000 We talked about it yesterday, but we've had you know, 132 00:07:15.560 --> 00:07:20.800 tons of hours of conversation since then. So Claude code 133 00:07:20.920 --> 00:07:27.079 is actually better at this remembering things than other automated code, 134 00:07:28.360 --> 00:07:34.279 you know, applications and are you know interfaces LMS agents, yeah, agents. 135 00:07:34.279 --> 00:07:37.399 And in this case, what this code revealed was how 136 00:07:37.480 --> 00:07:41.600 they're actually doing that memory management. So they're actually breaking memory. 137 00:07:41.720 --> 00:07:44.079 Usually there's like a memory m D file and people 138 00:07:44.240 --> 00:07:46.800 just you know, the agent's just dump tons of stuff 139 00:07:46.839 --> 00:07:49.000 in there. Everything it remembers is in there, and sometimes 140 00:07:48.800 --> 00:07:51.839 it's it's compressed, and then it extends and it compresses 141 00:07:51.879 --> 00:07:54.959 and extends and that sort of stuff. In Claude code, 142 00:07:54.959 --> 00:07:57.639 what they're actually doing is they have three different memory 143 00:07:57.879 --> 00:08:00.759 layers and one of them is just a pointer, just 144 00:08:00.839 --> 00:08:03.360 a single line for everything it remembers, and it's a 145 00:08:03.360 --> 00:08:06.480 pointer out to another layer. And you can think of 146 00:08:06.519 --> 00:08:12.399 it like they're doing short term, long term instant memory. 147 00:08:13.040 --> 00:08:15.920 So like, oh, well, when we're talking about something, it's 148 00:08:15.959 --> 00:08:17.959 you know, top of mind, right, and then what I'm 149 00:08:17.959 --> 00:08:19.680 going to do is as I compress that, I'm going 150 00:08:19.720 --> 00:08:23.839 to have a pointer out to a longer term memory file, right, 151 00:08:23.920 --> 00:08:25.399 and so on and so forth. So they have this 152 00:08:25.480 --> 00:08:28.720 structured way of managing memory that was giving them a 153 00:08:28.759 --> 00:08:29.480 competitive edge. 154 00:08:29.519 --> 00:08:33.120 It's kind of like skills in GitHub copilot. Gitthub copilot 155 00:08:33.360 --> 00:08:36.120 allows you to have skills which you can, you know, 156 00:08:36.200 --> 00:08:40.759 separate into different columns or whatever, and then those skills 157 00:08:40.759 --> 00:08:44.960 are picked up whenever the keywords are hit yep, yeah, 158 00:08:45.039 --> 00:08:47.080 or whenever the description matches. 159 00:08:46.720 --> 00:08:48.120 And Claude has something similar to that. 160 00:08:48.320 --> 00:08:51.000 Yeah, so it seems similar to that. Yeah, whereas you know, 161 00:08:51.039 --> 00:08:54.840 and then basically anything that goes in that silo gets 162 00:08:54.879 --> 00:08:56.639 updated in that skills MD file. 163 00:08:56.840 --> 00:08:58.840 But it's you know, it's some of their secret sauce. 164 00:08:58.879 --> 00:09:01.120 It's not everything. It's not the game. 165 00:09:01.519 --> 00:09:03.960 It's not like somebody downloaded the entire model in huzza. 166 00:09:04.120 --> 00:09:06.279 Now they're running right clawed at home. 167 00:09:06.600 --> 00:09:09.879 And if this is, if this, if we start seeing 168 00:09:09.960 --> 00:09:13.360 this functionality show up in other models, then it just 169 00:09:13.399 --> 00:09:16.559 shows that Claud's operating at another level. Yeah, okay, that 170 00:09:16.600 --> 00:09:18.799 they deserve to be one of the top two, you know, 171 00:09:18.919 --> 00:09:19.679 frontier models. 172 00:09:19.679 --> 00:09:22.200 All right, So this next story is really cool, and 173 00:09:22.240 --> 00:09:25.000 I know Dwayne's gonna really love this. I love these 174 00:09:25.039 --> 00:09:25.840 types of stories. 175 00:09:25.919 --> 00:09:27.759 I thought this was going to be the topic. 176 00:09:28.279 --> 00:09:30.639 Yeah, I thought so too, because we talked about it 177 00:09:30.679 --> 00:09:34.360 before row Hammer. So new roe Hammer attacks get complete 178 00:09:34.399 --> 00:09:39.759 control of machines running en video GPUs. I remember row 179 00:09:39.799 --> 00:09:44.879 Hammer was one of these things that looked at memory 180 00:09:45.279 --> 00:09:48.279 next to the memory bank that you were on because 181 00:09:48.320 --> 00:09:52.159 it overheated a bit or something like that. It was 182 00:09:52.639 --> 00:09:55.080 the perfect side what do you call it? A side 183 00:09:55.120 --> 00:09:55.679 chain attack? 184 00:09:55.960 --> 00:09:57.080 Side channel? Side channel? 185 00:09:57.159 --> 00:09:59.840 Yeah, side channel. Wow? So what happened here? 186 00:10:00.360 --> 00:10:03.639 So researchers were like, hey, roe Hammer was really kind 187 00:10:03.639 --> 00:10:06.039 of cool, right, that was fun. We listened to security 188 00:10:06.039 --> 00:10:09.879 this week and we think row Hammer's awesome. What if 189 00:10:10.240 --> 00:10:14.720 we could get row Hammer to work on other CPUs, 190 00:10:14.799 --> 00:10:19.080 like maybe GPUs. Right, So if I take a graphics 191 00:10:19.080 --> 00:10:24.399 processing unit, which is it's a CPU just specialized, right, 192 00:10:25.120 --> 00:10:29.039 can I not only manipulate it in a side channel 193 00:10:29.080 --> 00:10:33.080 attack by heating up bits and corrupting bits of memory 194 00:10:33.120 --> 00:10:35.200 and that sort of stuff, but can I do it 195 00:10:35.279 --> 00:10:36.440 in some interesting way? 196 00:10:36.879 --> 00:10:37.039 Right? 197 00:10:37.080 --> 00:10:38.879 Can I do it so I can gain access to 198 00:10:38.919 --> 00:10:41.960 the system. What they were able to do here is 199 00:10:42.519 --> 00:10:49.039 modeling it after the original row Hammer is manipulate the 200 00:10:49.039 --> 00:10:53.159 The RTX you know attack is an RTX attack against 201 00:10:53.240 --> 00:10:57.399 the Nvidia cards. Manipulate it to actually do the same thing, 202 00:10:57.519 --> 00:11:00.799 kind of corrupt memory, flipping bits that's where stuff. But 203 00:11:00.919 --> 00:11:03.519 they did it not so it just crashed. They actually 204 00:11:03.559 --> 00:11:09.159 could infect paging memory that then goes out to the driver. 205 00:11:09.679 --> 00:11:13.039 Oh for the video driver for your computer. Wow, the 206 00:11:13.120 --> 00:11:15.759 video driver, as we all know, is running at like 207 00:11:15.799 --> 00:11:18.840 the highest level privilege. Right, So at this point they 208 00:11:18.919 --> 00:11:24.120 now have and there are two examples of this, they 209 00:11:24.159 --> 00:11:26.919 now have the ability to get a root level shell 210 00:11:28.960 --> 00:11:34.000 on a system by manipulating the bits and using this architecture, 211 00:11:34.000 --> 00:11:34.919 which is really kind of cool. 212 00:11:35.039 --> 00:11:38.000 What this kind of attack reminds me is that, you know, 213 00:11:38.000 --> 00:11:43.279 in twenty fourteen they first demonstrated a repeated like hammering attack. 214 00:11:44.200 --> 00:11:47.279 There was no AI to aid with that, right, And 215 00:11:47.399 --> 00:11:49.519 this is a you'll notice that in this story I 216 00:11:50.000 --> 00:11:52.440 didn't see any reference to and they used AI to 217 00:11:52.480 --> 00:11:56.120 figure it out. This is creative humans looking at a 218 00:11:56.120 --> 00:11:57.759 system and saying, I wonder what I can do with that. 219 00:11:58.440 --> 00:12:00.840 And so it's I think these are advanced attacks are 220 00:12:00.840 --> 00:12:02.720 still the domain of people. 221 00:12:03.200 --> 00:12:06.720 Yeah, I agree in some ways and in some ways not. 222 00:12:06.799 --> 00:12:09.720 I think you're going to start to see research agents 223 00:12:09.759 --> 00:12:12.639 get really really good at understanding Oh okay, this is 224 00:12:12.679 --> 00:12:16.559 the physical architecture, right, and how do we manipulate that 225 00:12:16.600 --> 00:12:20.600 physical architecture to affect the software layer, because in this 226 00:12:20.639 --> 00:12:23.399 case it's it's very similar. Like you know, you might say, well, 227 00:12:23.399 --> 00:12:25.919 how do I fix this right right now that now 228 00:12:25.960 --> 00:12:28.360 that somebody can get something to run on my computer 229 00:12:28.360 --> 00:12:30.919 that's going to get a you know, a highly privileged shell, 230 00:12:31.039 --> 00:12:33.320 how do I fix this? And and the same thing 231 00:12:33.360 --> 00:12:37.840 with CPUs. It's a well from the architecture hardware architecture stance, 232 00:12:38.159 --> 00:12:43.480 you can't or you looks the way the hardware architecture works, 233 00:12:43.639 --> 00:12:46.879 right and how it's late literally laid out, and how 234 00:12:46.879 --> 00:12:50.000 the chips are laid out. But from the software side, 235 00:12:50.320 --> 00:12:52.600 you could say, well, we'll invent a new driver that 236 00:12:52.639 --> 00:12:55.320 actually double checks paging memory or double checks whatever, right, 237 00:12:55.440 --> 00:12:57.320 so there are ways there. 238 00:12:57.399 --> 00:12:59.000 It's going to slow everything down, though. 239 00:12:59.039 --> 00:13:02.000 Yeah, exactly, there will be updates to drivers that will 240 00:13:02.320 --> 00:13:06.480 mitigate this. Luckily, it was researchers that found this, so 241 00:13:07.000 --> 00:13:09.720 you know, it's an interesting find. I love side channel attacks. 242 00:13:09.720 --> 00:13:12.159 I'm glad you know we incorporated in the show. 243 00:13:12.200 --> 00:13:15.559 But here's the real question, which is how luckily am 244 00:13:15.600 --> 00:13:18.080 I to get infected with something that's going to do 245 00:13:18.159 --> 00:13:18.559 that to me. 246 00:13:18.840 --> 00:13:21.240 Well, and what kind of access to you know, you 247 00:13:21.279 --> 00:13:23.120 can't do this over the internet. You have got to 248 00:13:23.120 --> 00:13:25.840 be on the system, I assume. 249 00:13:26.080 --> 00:13:28.360 So, yeah, you do have to be on the system. 250 00:13:28.399 --> 00:13:30.519 This is think of this more like a privesque than 251 00:13:31.320 --> 00:13:34.440 a remote exploit. Okay, right, so if you're on Box 252 00:13:34.799 --> 00:13:37.559 and it's reasonably hardened, this might be a way that 253 00:13:37.639 --> 00:13:41.559 I'd call a command and then exploit the GPU to 254 00:13:41.639 --> 00:13:43.440 then give root level access to that command. 255 00:13:43.559 --> 00:13:45.159 Extreme living off the land. 256 00:13:45.120 --> 00:13:47.279 Yeah, so it's it's very much this is a This 257 00:13:47.360 --> 00:13:49.440 is more a privesque than a remote exploit. 258 00:13:49.559 --> 00:13:54.159 This is like eating crickets. How is this like eating crickets? Well, 259 00:13:54.360 --> 00:13:56.559 Extreme living off the land? You can't find anywhere. 260 00:13:56.559 --> 00:13:58.639 Oh my god, I see what you did there? 261 00:13:58.919 --> 00:14:01.679 I see are you watching Survivor again? 262 00:14:01.840 --> 00:14:02.879 Can't find any squirrels? 263 00:14:02.919 --> 00:14:04.720 So yeah, I see what you did there. I wish 264 00:14:04.720 --> 00:14:07.360 you didn't, but I see. Thank you for that. 265 00:14:07.480 --> 00:14:10.120 Patrick's kind of a sleep would go on Survivor and win. 266 00:14:11.519 --> 00:14:13.639 Yes, I would say like the likelihood of this is 267 00:14:13.679 --> 00:14:18.200 extremely low. You know, first off, if you're running a 268 00:14:18.240 --> 00:14:22.240 hardened PC where they can't get they the attackers can't 269 00:14:22.240 --> 00:14:28.120 get an administrative shell. You probably didn't get infected anyways, right, 270 00:14:28.159 --> 00:14:30.200 because you're very careful with what you're doing. You're very 271 00:14:30.200 --> 00:14:32.840 careful with your architecture. So most home users, if they're 272 00:14:32.840 --> 00:14:35.919 gonna if they run something that exploits their computer, the 273 00:14:36.039 --> 00:14:38.480 chances of them going, oh, now we need a side 274 00:14:38.559 --> 00:14:40.360 channel attack on there is probably low. 275 00:14:40.720 --> 00:14:41.440 Yeah. 276 00:14:41.519 --> 00:14:43.679 Yeah, so just be careful, you know, be careful of 277 00:14:43.720 --> 00:14:46.600 the normal stuff. In this particular case, that's. 278 00:14:46.399 --> 00:14:48.519 Like standing in the living room and saying, can I 279 00:14:48.559 --> 00:14:50.600 get into the kitchen through the bathroom window? 280 00:14:50.919 --> 00:14:54.240 Mm hmmm yeah, and you're like why, I mean, I 281 00:14:54.279 --> 00:14:57.080 probably could, but who cares? Right, Yeah, because that's where 282 00:14:57.080 --> 00:14:57.720 the crickets are. 283 00:14:58.000 --> 00:14:58.799 Yeah. 284 00:14:58.840 --> 00:15:01.279 So, like I said, it's an interesting attack. I love 285 00:15:01.320 --> 00:15:06.080 these type attacks, just you know, physical hardware causing bit flipping. 286 00:15:06.519 --> 00:15:06.919 Yeah. 287 00:15:06.960 --> 00:15:09.519 Well, it's the thinking outside the box. It's the like, 288 00:15:09.960 --> 00:15:11.519 oh my god, well, how did they think of this? 289 00:15:11.919 --> 00:15:14.200 Yeah, that's so cool. In this case, I mean, how 290 00:15:14.200 --> 00:15:16.440 did they think of this? They probably went, hm, roe 291 00:15:16.440 --> 00:15:20.440 Hammer was neat, right, could we do it somewhere else? 292 00:15:20.519 --> 00:15:21.240 And yeah you can. 293 00:15:21.480 --> 00:15:24.600 So you're saying the suspect is someone who likes roe Hammer. 294 00:15:24.759 --> 00:15:28.919 Hmmm, I know, right, huh weird. Time to go, boys, 295 00:15:29.039 --> 00:15:29.440 Time to go. 296 00:15:31.000 --> 00:15:34.720 If we only knew someone like that. Okay, so this 297 00:15:34.799 --> 00:15:38.600 is a good one, not a good one. Adobe data 298 00:15:38.639 --> 00:15:43.639 breach thirteen millions support tickets, employee records, and bug reports 299 00:15:43.759 --> 00:15:48.960 allegedly exposed by hacker mister Raccoon, not the mister raccoon. 300 00:15:49.360 --> 00:15:51.120 And this could be a gift that keeps on giving 301 00:15:51.120 --> 00:15:54.639 because you know, bug reports can also be vulnerabilities. 302 00:15:54.840 --> 00:15:58.759 Right, yikes, yeah, I mean this, this is a time, 303 00:15:59.000 --> 00:16:02.279 This is a this is a tip as old as time. Right, gosh, 304 00:16:02.320 --> 00:16:03.960 how did this or as old as Adobe at least? 305 00:16:04.000 --> 00:16:04.159 I know? 306 00:16:04.240 --> 00:16:05.360 Right, how did this? Well? 307 00:16:05.600 --> 00:16:07.759 You know, it's funny you say that. Uh, they were 308 00:16:07.960 --> 00:16:11.559 for years. My team was always like not today, Adobe, 309 00:16:11.679 --> 00:16:13.759 Like we're like here. Every time it was like you 310 00:16:13.799 --> 00:16:17.480 need to update Adobe, We're like, huzzah, no, that's definitely Russia. 311 00:16:17.720 --> 00:16:20.840 My browsers shows pdf. I was just fine. I do 312 00:16:20.919 --> 00:16:24.840 not need your Acrobat reader. Do you remember going Away? 313 00:16:24.879 --> 00:16:27.799 Do you guys remember Flash? I mean ye, yeah, you 314 00:16:27.840 --> 00:16:31.159 were updating that player constantly. People just keep clicking yes, 315 00:16:31.840 --> 00:16:34.159 no matter what pop time, and every time it installed 316 00:16:34.200 --> 00:16:35.240 new malware. 317 00:16:37.240 --> 00:16:41.200 Sometimes for Adobe, sometimes for other people. You know, who knew. 318 00:16:42.279 --> 00:16:46.399 So this is this is an initial footholder saying from 319 00:16:46.440 --> 00:16:49.679 the attacker and mister Raccoon sent a militia's email to 320 00:16:49.720 --> 00:16:50.639 a support employee. 321 00:16:50.799 --> 00:16:54.559 The hacker names are getting so much less cool, I know, right, Yeah, 322 00:16:54.639 --> 00:16:56.559 I think that's the story. 323 00:16:57.279 --> 00:17:00.639 Well, I think this is so for sure hacker. When 324 00:17:00.639 --> 00:17:02.919 he was young, his name was Rocky. 325 00:17:03.879 --> 00:17:06.039 So now he's missed your record then you know, now 326 00:17:06.079 --> 00:17:08.559 he's miscud. 327 00:17:11.519 --> 00:17:14.599 Jester was a great name. He's I haven't seen anything 328 00:17:14.599 --> 00:17:18.200 from the Jester in a long time. Yeah, I think 329 00:17:18.200 --> 00:17:22.119 he's he's falling off the face of the planet. But so, yeah, 330 00:17:22.160 --> 00:17:25.119 this is uh, you know, phishing email out to a 331 00:17:25.160 --> 00:17:28.920 support employee who was then conned into installing a rat 332 00:17:29.000 --> 00:17:31.720 remote access trojan and then at that point you have 333 00:17:31.759 --> 00:17:35.720 full control over the employees computer, which means huzza, you 334 00:17:35.759 --> 00:17:38.519 get access to support tickets because you are a support 335 00:17:38.559 --> 00:17:42.200 engineer at this point. So yeah, I don't know if 336 00:17:42.200 --> 00:17:45.480 this is better training for the support engineers. Did did 337 00:17:45.720 --> 00:17:49.440 Did they say whether this was actually uh Adobe supporter 338 00:17:49.519 --> 00:17:51.119 or do they do? We know if they outsource it, 339 00:17:51.599 --> 00:17:53.680 because we've seen those style of attacks quite a bit. 340 00:17:53.759 --> 00:18:00.839 Now, as the outsource stated it just said his support Hmmm, person, if. 341 00:18:00.359 --> 00:18:03.680 I although here, here's what I will tell you. Adobe 342 00:18:03.759 --> 00:18:06.240 at this point has not confirmed that this is a 343 00:18:06.240 --> 00:18:09.160 core system breach. So if this is a third party 344 00:18:09.160 --> 00:18:12.200 support team, you better bet Adobe's going to go Oh, 345 00:18:12.359 --> 00:18:13.079 it wasn't us. 346 00:18:13.240 --> 00:18:14.279 It was true. 347 00:18:14.519 --> 00:18:17.799 It was this third party who had all of our data. 348 00:18:17.839 --> 00:18:19.960 You know, we'll we're going to get rid of them 349 00:18:20.039 --> 00:18:20.839 and get a new Well. 350 00:18:20.920 --> 00:18:22.480 Yeah, this seems like a good time to do a 351 00:18:22.480 --> 00:18:26.640 public service announcement for have I Been Poned? So anytime 352 00:18:26.680 --> 00:18:29.000 there's a massive data breach, or you know, maybe even 353 00:18:29.200 --> 00:18:31.279 every other day, you should go to Have I Been Poned? 354 00:18:31.279 --> 00:18:33.599 Putting your email address and see if it's on the 355 00:18:33.680 --> 00:18:37.839 list of breached accounts. And if it is, it'll tell 356 00:18:37.839 --> 00:18:42.960 you what you know where what website and what a email? Yeah? 357 00:18:43.000 --> 00:18:46.039 What email? And you should change that password right. 358 00:18:46.440 --> 00:18:48.039 And one of the one of the real big tips 359 00:18:48.039 --> 00:18:49.839 here is that if you want to stay in the 360 00:18:49.839 --> 00:18:52.559 good graces of your employer, don't use your work email 361 00:18:52.599 --> 00:18:53.920 for anything other than work. 362 00:18:54.240 --> 00:18:57.480 That's right, all right, Break time, yep, break time. Okay, 363 00:18:57.519 --> 00:18:59.240 we'll take a break. We'll be right back after these 364 00:18:59.319 --> 00:19:05.920 very important sites and we're back it's security this week. 365 00:19:05.960 --> 00:19:08.839 I'm Carl, that's Dwaine, that's Patrick, and we're here for 366 00:19:09.000 --> 00:19:16.079 your informational and educational and entertainmental pleasure. How about that. 367 00:19:16.440 --> 00:19:19.000 So, if there's a if there's a nine point eight 368 00:19:19.880 --> 00:19:23.400 CVSS score, and we've already talked about Adobe, and I 369 00:19:23.599 --> 00:19:26.480 tell you that that Microsoft's not in the news today 370 00:19:26.759 --> 00:19:31.039 for this episode, and WordPress is not in the news, 371 00:19:31.079 --> 00:19:34.519 who could it be? Who's Who's Who's very likely to 372 00:19:34.559 --> 00:19:36.400 have that kind of I don't like to pick on 373 00:19:36.440 --> 00:19:38.920 this company because they have so many products, but they're 374 00:19:39.000 --> 00:19:40.319 really always here. 375 00:19:41.480 --> 00:19:45.839 Cisco, and not the guys who give straws out to McDonald's, 376 00:19:45.839 --> 00:19:47.160 to the other cisca. 377 00:19:48.359 --> 00:19:52.119 So and this Cisco. Their products are not made in America, 378 00:19:52.160 --> 00:19:54.480 by the way, see last week's show. 379 00:19:54.880 --> 00:19:57.160 Yeah, I mean you can't even buy them, can't even 380 00:19:57.200 --> 00:20:01.119 buy them. This one here again, this one's this is 381 00:20:01.200 --> 00:20:04.440 another interesting one. The core issue and I'm going to 382 00:20:04.440 --> 00:20:05.839 read this, I'm going to read this out where the 383 00:20:05.839 --> 00:20:11.279 core issue lies within the password change functionality of the 384 00:20:11.319 --> 00:20:16.559 Cisco IMC software, and that's their integrated management controller. The 385 00:20:16.599 --> 00:20:19.200 CVE is going to be twenty twenty six two hundred 386 00:20:19.839 --> 00:20:21.880 nine to three you'll want to check that out. 387 00:20:22.519 --> 00:20:22.720 Listen. 388 00:20:22.759 --> 00:20:25.000 If you're running Cisco IMC, you're definitely going to want 389 00:20:25.000 --> 00:20:27.200 to patch. Anyways, it's a nine point eight. It's a 390 00:20:27.240 --> 00:20:28.000 nine point eight, so. 391 00:20:28.799 --> 00:20:33.200 And it lets hackers bypass off and admins urged to update. 392 00:20:32.960 --> 00:20:37.440 And get in as admin. So, due to an improper 393 00:20:37.599 --> 00:20:44.799 processing of incoming password change requests, a remote, unauthenticated attacker 394 00:20:45.519 --> 00:20:48.799 can exploit this flaw by sending a specially crafted HTP 395 00:20:48.920 --> 00:20:53.599 request to a vulnerable device. Successfully exploitation allows the attacker 396 00:20:53.599 --> 00:20:57.079 to bypass standard authentication mechanisms and modify the password of 397 00:20:57.119 --> 00:21:00.319 an existing user. So let me break that down. That's 398 00:21:00.359 --> 00:21:07.359 you're saying. The change password page doesn't actually verify the 399 00:21:07.400 --> 00:21:11.480 old password, just changes it. So I say, I want 400 00:21:11.480 --> 00:21:13.839 to be admint. I forgot my password, and it says 401 00:21:13.839 --> 00:21:15.720