Speaker 1: Hey Carl here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes, Spotify,
Speaker 1: or wherever you get Security this week. Also, you can
Speaker 1: get an ad free feed by becoming a five dollars
Speaker 1: a month patron. Go to Patreon dot Security this week
Speaker 1: dot com and sign up, and don't forget Discord. Discord
Speaker 1: dot Security this week dot com. Lots of good stuff
Speaker 1: happening there. Yeah, I think that's it. So on with
Speaker 1: the podcast.
Speaker 2: Hey guys, I'm sorry I sound like very white today,
Speaker 2: but I've got a cold, so I got some sexy
Speaker 2: flam going on. Sorry. So, a drunk staggers into a
Speaker 2: Catholic church and sits down in a confession booth and
Speaker 2: he says nothing, And the priest you know, is waiting
Speaker 2: for something and gives a little coffica, and the guy
Speaker 2: still says nothing. He taps on the window, the door
Speaker 2: or whatever, and the guy still says nothing. And then
Speaker 2: he taps a little bit louder. He knocks a little louder,
Speaker 2: and he hears this voice say it's no use. There's
Speaker 2: no toilet paper over here either.
Speaker 3: I've been to that church.
Speaker 2: Welcome back to security this week. I'm Carl Franklin. That's
Speaker 2: Patrick Kines and Dwayne Laflotte, and we got a few
Speaker 2: stories here. This one Reuter's is reporting I ran linked
Speaker 2: hackers breach FBI director's personal email, published photos and documents.
Speaker 2: So from the headline, is it published photos and documents
Speaker 2: like it breaches those or publishes photos in documents.
Speaker 3: I think they published their photo, his photos and documents. Now,
Speaker 3: some of this guy, you know, the director of the
Speaker 3: FBI's public photos that they put out on purpose, are
Speaker 3: more embarrassing than anything I've heard about. So I mean, yeah,
Speaker 3: this is news, but it's supposedly there's no government information
Speaker 3: in here. So far, there's no confidential information, you know,
Speaker 3: other than personal So I haven't seen anything surface that
Speaker 3: says and here's the scandal. The scandal is he should
Speaker 3: have been better about a security. But we have many
Speaker 3: historical figures in politics that have been been fished and
Speaker 3: hacked and yeah, the same way.
Speaker 2: So it's just an embarrassment play kind of I think.
Speaker 3: So again, it's early days, but I would assume this
Speaker 3: has been sliced and diced, and there's if there was
Speaker 3: a smoking gun, you know, admission of something, we'd see it.
Speaker 4: And they say this was an old account, right, it
Speaker 4: hadn't been accessed since twenty nineteen. The account credentials were
Speaker 4: actually in an old breach. Oh wow, So no MFA. Okay,
Speaker 4: that's actually pretty terrib But so the prevailing speculation right
Speaker 4: now is, well, at least he's not in law enforcement.
Speaker 4: Oh wait, the prevailing speculation is the attackers grabbed these
Speaker 4: credentials off of an old breach and finally get around
Speaker 4: to credential stuffing them into Gmail and then pulled up.
Speaker 3: And it's a Gmail account. And I'll be honest, I
Speaker 3: don't share my Gmail account, but there's nothing in it
Speaker 3: that I would be of any use to anybody. I
Speaker 3: don't use it for anything. There's lots and lots and
Speaker 3: lots of spam.
Speaker 2: Well, what do you use that's better than or more
Speaker 2: secure than Gmail?
Speaker 3: I use my corporate account. I don't have a personal line.
Speaker 2: But what's the what's the system? Is it? Is it
Speaker 2: an outlook system?
Speaker 3: Is it a It's it's Microsoft off Microsoft hosted Microsoft, okay,
Speaker 3: and guarded by Dwayne I almost thought he wasn't going
Speaker 3: to say I know, right. He was almost like, I
Speaker 3: almost didn't say. I didn't say which Microsoft. It might
Speaker 3: be the secret one.
Speaker 2: Oh okay, all right, So this is a big story,
Speaker 2: so big. My pharmacystem driving through from me, goes Carl.
Speaker 2: Did you hear about this Claude code source code appears
Speaker 2: to have leaked? And here's what we know. Yeah, this
Speaker 2: is from venture Beat, half.
Speaker 3: A million lines. What I think the biggest outcome from
Speaker 3: this is it's giving a big leg up to the competition.
Speaker 3: The competition gets to see what they're doing. You can't
Speaker 3: there's no patent on any of this stuff. It's trademark,
Speaker 3: but you don't have to change it that much. In hell,
Speaker 3: Claude code could probably change it for you enough that
Speaker 3: it wouldn't match. So it's a major mistake. It gives
Speaker 3: help to those who are trying to catch up to Claude.
Speaker 3: It just means they got to run faster. That said,
Speaker 3: I think in light of their controversy with the military,
Speaker 3: they out came out pretty good. They came out with
Speaker 3: rising revenue, and the reaction by open Ai is actually
Speaker 3: hurt open Ai more than it's hurt Claude.
Speaker 2: Well, they weren't going to play that game. Nope, it's
Speaker 2: basically it.
Speaker 4: Yeah, and this the way that this quote unquote leaked.
Speaker 4: We we look for this type of thing when we're attacking
Speaker 4: applications all the time. So they have a you guys
Speaker 4: have all like if you've done C plus plus development
Speaker 4: and that sort of stuff, or if you've tried to
Speaker 4: you know, read. Let's say you're you're trying to debug
Speaker 4: a C plus plus program or a driver or whatever.
Speaker 4: Good luck, I know, right, there are all these P
Speaker 4: two B files and all sorts of things you can
Speaker 4: load up so that while that particular code is running,
Speaker 4: you know where the code is at. Right, they're debug files,
Speaker 4: and there are debug files that you can use to
Speaker 4: map the running code to actual code, so you can
Speaker 4: debug running live applications. In Java, that's called Java map,
Speaker 4: So there's a map file where you can actually see
Speaker 4: like comments and code and all sorts of other things.
Speaker 4: But it's never supposed to be deployed with the application.
Speaker 4: So and we see it all the time where you know,
Speaker 4: we'll reach into uh, you know, hosted Java applic cation
Speaker 4: in some way and just pull down that map file
Speaker 4: and say, okay, cool, now we know how kind of
Speaker 4: everything's working on the back end. Yeah, so you got
Speaker 4: to be careful with what you actually push into where
Speaker 4: all right.
Speaker 2: So it's not like you could fork the repo out
Speaker 2: and run your own cloud.
Speaker 4: No, gosh, I don't know that you'd have the compute
Speaker 4: that would be impressive. But the interesting sort of secret
Speaker 4: sauce here though, is it defines how claud actually and
Speaker 4: one of the things that was the most important thing
Speaker 4: to leak was it defines how claud code actually splits
Speaker 4: its memory apart. So when you're talking to these lms
Speaker 4: as you if you just ask it like information about
Speaker 4: the weather or the area whatever, real quick, not a problem.
Speaker 4: It has this transient memory. It does a pretty good
Speaker 4: job for any of you who are using either GitHub
Speaker 4: code or cloud code or whatever. You'll notice over time,
Speaker 4: as your conversessions are getting more and more complex, as
Speaker 4: it's getting deeper and deeper, as you're talking about multi
Speaker 4: layered architecture, et cetera, et cetera, there are times it
Speaker 4: loses its mind, right and it's like, oh, I didn't
Speaker 4: remember that we were using AWS, and you're like, well.
Speaker 2: That's weird.
Speaker 4: We talked about it yesterday, but we've had you know,
Speaker 4: tons of hours of conversation since then. So Claude code
Speaker 4: is actually better at this remembering things than other automated code,
Speaker 4: you know, applications and are you know interfaces LMS agents, yeah, agents.
Speaker 4: And in this case, what this code revealed was how
Speaker 4: they're actually doing that memory management. So they're actually breaking memory.
Speaker 4: Usually there's like a memory m D file and people
Speaker 4: just you know, the agent's just dump tons of stuff
Speaker 4: in there. Everything it remembers is in there, and sometimes
Speaker 4: it's it's compressed, and then it extends and it compresses
Speaker 4: and extends and that sort of stuff. In Claude code,
Speaker 4: what they're actually doing is they have three different memory
Speaker 4: layers and one of them is just a pointer, just
Speaker 4: a single line for everything it remembers, and it's a
Speaker 4: pointer out to another layer. And you can think of
Speaker 4: it like they're doing short term, long term instant memory.
Speaker 4: So like, oh, well, when we're talking about something, it's
Speaker 4: you know, top of mind, right, and then what I'm
Speaker 4: going to do is as I compress that, I'm going
Speaker 4: to have a pointer out to a longer term memory file, right,
Speaker 4: and so on and so forth. So they have this
Speaker 4: structured way of managing memory that was giving them a
Speaker 4: competitive edge.
Speaker 2: It's kind of like skills in GitHub copilot. Gitthub copilot
Speaker 2: allows you to have skills which you can, you know,
Speaker 2: separate into different columns or whatever, and then those skills
Speaker 2: are picked up whenever the keywords are hit yep, yeah,
Speaker 2: or whenever the description matches.
Speaker 3: And Claude has something similar to that.
Speaker 2: Yeah, so it seems similar to that. Yeah, whereas you know,
Speaker 2: and then basically anything that goes in that silo gets
Speaker 2: updated in that skills MD file.
Speaker 3: But it's you know, it's some of their secret sauce.
Speaker 3: It's not everything. It's not the game.
Speaker 4: It's not like somebody downloaded the entire model in huzza.
Speaker 4: Now they're running right clawed at home.
Speaker 3: And if this is, if this, if we start seeing
Speaker 3: this functionality show up in other models, then it just
Speaker 3: shows that Claud's operating at another level. Yeah, okay, that
Speaker 3: they deserve to be one of the top two, you know,
Speaker 3: frontier models.
Speaker 2: All right, So this next story is really cool, and
Speaker 2: I know Dwayne's gonna really love this. I love these
Speaker 2: types of stories.
Speaker 3: I thought this was going to be the topic.
Speaker 2: Yeah, I thought so too, because we talked about it
Speaker 2: before row Hammer. So new roe Hammer attacks get complete
Speaker 2: control of machines running en video GPUs. I remember row
Speaker 2: Hammer was one of these things that looked at memory
Speaker 2: next to the memory bank that you were on because
Speaker 2: it overheated a bit or something like that. It was
Speaker 2: the perfect side what do you call it? A side
Speaker 2: chain attack?
Speaker 4: Side channel? Side channel?
Speaker 2: Yeah, side channel. Wow? So what happened here?
Speaker 4: So researchers were like, hey, roe Hammer was really kind
Speaker 4: of cool, right, that was fun. We listened to security
Speaker 4: this week and we think row Hammer's awesome. What if
Speaker 4: we could get row Hammer to work on other CPUs,
Speaker 4: like maybe GPUs. Right, So if I take a graphics
Speaker 4: processing unit, which is it's a CPU just specialized, right,
Speaker 4: can I not only manipulate it in a side channel
Speaker 4: attack by heating up bits and corrupting bits of memory
Speaker 4: and that sort of stuff, but can I do it
Speaker 4: in some interesting way?
Speaker 2: Right?
Speaker 4: Can I do it so I can gain access to
Speaker 4: the system. What they were able to do here is
Speaker 4: modeling it after the original row Hammer is manipulate the
Speaker 4: The RTX you know attack is an RTX attack against
Speaker 4: the Nvidia cards. Manipulate it to actually do the same thing,
Speaker 4: kind of corrupt memory, flipping bits that's where stuff. But
Speaker 4: they did it not so it just crashed. They actually
Speaker 4: could infect paging memory that then goes out to the driver.
Speaker 4: Oh for the video driver for your computer. Wow, the
Speaker 4: video driver, as we all know, is running at like
Speaker 4: the highest level privilege. Right, So at this point they
Speaker 4: now have and there are two examples of this, they
Speaker 4: now have the ability to get a root level shell
Speaker 4: on a system by manipulating the bits and using this architecture,
Speaker 4: which is really kind of cool.
Speaker 3: What this kind of attack reminds me is that, you know,
Speaker 3: in twenty fourteen they first demonstrated a repeated like hammering attack.
Speaker 3: There was no AI to aid with that, right, And
Speaker 3: this is a you'll notice that in this story I
Speaker 3: didn't see any reference to and they used AI to
Speaker 3: figure it out. This is creative humans looking at a
Speaker 3: system and saying, I wonder what I can do with that.
Speaker 3: And so it's I think these are advanced attacks are
Speaker 3: still the domain of people.
Speaker 4: Yeah, I agree in some ways and in some ways not.
Speaker 4: I think you're going to start to see research agents
Speaker 4: get really really good at understanding Oh okay, this is
Speaker 4: the physical architecture, right, and how do we manipulate that
Speaker 4: physical architecture to affect the software layer, because in this
Speaker 4: case it's it's very similar. Like you know, you might say, well,
Speaker 4: how do I fix this right right now that now
Speaker 4: that somebody can get something to run on my computer
Speaker 4: that's going to get a you know, a highly privileged shell,
Speaker 4: how do I fix this? And and the same thing
Speaker 4: with CPUs. It's a well from the architecture hardware architecture stance,
Speaker 4: you can't or you looks the way the hardware architecture works,
Speaker 4: right and how it's late literally laid out, and how
Speaker 4: the chips are laid out. But from the software side,
Speaker 4: you could say, well, we'll invent a new driver that
Speaker 4: actually double checks paging memory or double checks whatever, right,
Speaker 4: so there are ways there.
Speaker 2: It's going to slow everything down, though.
Speaker 4: Yeah, exactly, there will be updates to drivers that will
Speaker 4: mitigate this. Luckily, it was researchers that found this, so
Speaker 4: you know, it's an interesting find. I love side channel attacks.
Speaker 4: I'm glad you know we incorporated in the show.
Speaker 2: But here's the real question, which is how luckily am
Speaker 2: I to get infected with something that's going to do
Speaker 2: that to me.
Speaker 3: Well, and what kind of access to you know, you
Speaker 3: can't do this over the internet. You have got to
Speaker 3: be on the system, I assume.
Speaker 4: So, yeah, you do have to be on the system.
Speaker 4: This is think of this more like a privesque than
Speaker 4: a remote exploit. Okay, right, so if you're on Box
Speaker 4: and it's reasonably hardened, this might be a way that
Speaker 4: I'd call a command and then exploit the GPU to
Speaker 4: then give root level access to that command.
Speaker 3: Extreme living off the land.
Speaker 4: Yeah, so it's it's very much this is a This
Speaker 4: is more a privesque than a remote exploit.
Speaker 3: This is like eating crickets. How is this like eating crickets? Well,
Speaker 3: Extreme living off the land? You can't find anywhere.
Speaker 4: Oh my god, I see what you did there?
Speaker 2: I see are you watching Survivor again?
Speaker 3: Can't find any squirrels?
Speaker 4: So yeah, I see what you did there. I wish
Speaker 4: you didn't, but I see. Thank you for that.
Speaker 2: Patrick's kind of a sleep would go on Survivor and win.
Speaker 4: Yes, I would say like the likelihood of this is
Speaker 4: extremely low. You know, first off, if you're running a
Speaker 4: hardened PC where they can't get they the attackers can't
Speaker 4: get an administrative shell. You probably didn't get infected anyways, right,
Speaker 4: because you're very careful with what you're doing. You're very
Speaker 4: careful with your architecture. So most home users, if they're
Speaker 4: gonna if they run something that exploits their computer, the
Speaker 4: chances of them going, oh, now we need a side
Speaker 4: channel attack on there is probably low.
Speaker 2: Yeah.
Speaker 4: Yeah, so just be careful, you know, be careful of
Speaker 4: the normal stuff. In this particular case, that's.
Speaker 3: Like standing in the living room and saying, can I
Speaker 3: get into the kitchen through the bathroom window?
Speaker 4: Mm hmmm yeah, and you're like why, I mean, I
Speaker 4: probably could, but who cares? Right, Yeah, because that's where
Speaker 4: the crickets are.
Speaker 2: Yeah.
Speaker 4: So, like I said, it's an interesting attack. I love
Speaker 4: these type attacks, just you know, physical hardware causing bit flipping.
Speaker 2: Yeah.
Speaker 3: Well, it's the thinking outside the box. It's the like,
Speaker 3: oh my god, well, how did they think of this?
Speaker 4: Yeah, that's so cool. In this case, I mean, how
Speaker 4: did they think of this? They probably went, hm, roe
Speaker 4: Hammer was neat, right, could we do it somewhere else?
Speaker 2: And yeah you can.
Speaker 3: So you're saying the suspect is someone who likes roe Hammer.
Speaker 4: Hmmm, I know, right, huh weird. Time to go, boys,
Speaker 4: Time to go.
Speaker 2: If we only knew someone like that. Okay, so this
Speaker 2: is a good one, not a good one. Adobe data
Speaker 2: breach thirteen millions support tickets, employee records, and bug reports
Speaker 2: allegedly exposed by hacker mister Raccoon, not the mister raccoon.
Speaker 3: And this could be a gift that keeps on giving
Speaker 3: because you know, bug reports can also be vulnerabilities.
Speaker 4: Right, yikes, yeah, I mean this, this is a time,
Speaker 4: This is a this is a tip as old as time. Right, gosh,
Speaker 4: how did this or as old as Adobe at least?
Speaker 2: I know?
Speaker 3: Right, how did this? Well?
Speaker 4: You know, it's funny you say that. Uh, they were
Speaker 4: for years. My team was always like not today, Adobe,
Speaker 4: Like we're like here. Every time it was like you
Speaker 4: need to update Adobe, We're like, huzzah, no, that's definitely Russia.
Speaker 2: My browsers shows pdf. I was just fine. I do
Speaker 2: not need your Acrobat reader. Do you remember going Away?
Speaker 2: Do you guys remember Flash? I mean ye, yeah, you
Speaker 2: were updating that player constantly. People just keep clicking yes,
Speaker 2: no matter what pop time, and every time it installed
Speaker 2: new malware.
Speaker 4: Sometimes for Adobe, sometimes for other people. You know, who knew.
Speaker 4: So this is this is an initial footholder saying from
Speaker 4: the attacker and mister Raccoon sent a militia's email to
Speaker 4: a support employee.
Speaker 3: The hacker names are getting so much less cool, I know, right, Yeah,
Speaker 3: I think that's the story.
Speaker 2: Well, I think this is so for sure hacker. When
Speaker 2: he was young, his name was Rocky.
Speaker 3: So now he's missed your record then you know, now
Speaker 3: he's miscud.
Speaker 4: Jester was a great name. He's I haven't seen anything
Speaker 4: from the Jester in a long time. Yeah, I think
Speaker 4: he's he's falling off the face of the planet. But so, yeah,
Speaker 4: this is uh, you know, phishing email out to a
Speaker 4: support employee who was then conned into installing a rat
Speaker 4: remote access trojan and then at that point you have
Speaker 4: full control over the employees computer, which means huzza, you
Speaker 4: get access to support tickets because you are a support
Speaker 4: engineer at this point. So yeah, I don't know if
Speaker 4: this is better training for the support engineers. Did did
Speaker 4: Did they say whether this was actually uh Adobe supporter
Speaker 4: or do they do? We know if they outsource it,
Speaker 4: because we've seen those style of attacks quite a bit.
Speaker 3: Now, as the outsource stated it just said his support Hmmm, person, if.
Speaker 4: I although here, here's what I will tell you. Adobe
Speaker 4: at this point has not confirmed that this is a
Speaker 4: core system breach. So if this is a third party
Speaker 4: support team, you better bet Adobe's going to go Oh,
Speaker 4: it wasn't us.
Speaker 3: It was true.
Speaker 4: It was this third party who had all of our data.
Speaker 4: You know, we'll we're going to get rid of them
Speaker 4: and get a new Well.
Speaker 2: Yeah, this seems like a good time to do a
Speaker 2: public service announcement for have I Been Poned? So anytime
Speaker 2: there's a massive data breach, or you know, maybe even
Speaker 2: every other day, you should go to Have I Been Poned?
Speaker 2: Putting your email address and see if it's on the
Speaker 2: list of breached accounts. And if it is, it'll tell
Speaker 2: you what you know where what website and what a email? Yeah?
Speaker 2: What email? And you should change that password right.
Speaker 3: And one of the one of the real big tips
Speaker 3: here is that if you want to stay in the
Speaker 3: good graces of your employer, don't use your work email
Speaker 3: for anything other than work.
Speaker 2: That's right, all right, Break time, yep, break time. Okay,
Speaker 2: we'll take a break. We'll be right back after these
Speaker 2: very important sites and we're back it's security this week.
Speaker 2: I'm Carl, that's Dwaine, that's Patrick, and we're here for
Speaker 2: your informational and educational and entertainmental pleasure. How about that.
Speaker 3: So, if there's a if there's a nine point eight
Speaker 3: CVSS score, and we've already talked about Adobe, and I
Speaker 3: tell you that that Microsoft's not in the news today
Speaker 3: for this episode, and WordPress is not in the news,
Speaker 3: who could it be? Who's Who's Who's very likely to
Speaker 3: have that kind of I don't like to pick on
Speaker 3: this company because they have so many products, but they're
Speaker 3: really always here.
Speaker 4: Cisco, and not the guys who give straws out to McDonald's,
Speaker 4: to the other cisca.
Speaker 2: So and this Cisco. Their products are not made in America,
Speaker 2: by the way, see last week's show.
Speaker 4: Yeah, I mean you can't even buy them, can't even
Speaker 4: buy them. This one here again, this one's this is
Speaker 4: another interesting one. The core issue and I'm going to
Speaker 4: read this, I'm going to read this out where the
Speaker 4: core issue lies within the password change functionality of the
Speaker 4: Cisco IMC software, and that's their integrated management controller. The
Speaker 4: CVE is going to be twenty twenty six two hundred
Speaker 4: nine to three you'll want to check that out.
Speaker 3: Listen.
Speaker 4: If you're running Cisco IMC, you're definitely going to want
Speaker 4: to patch. Anyways, it's a nine point eight. It's a
Speaker 4: nine point eight, so.
Speaker 2: And it lets hackers bypass off and admins urged to update.
Speaker 4: And get in as admin. So, due to an improper
Speaker 4: processing of incoming password change requests, a remote, unauthenticated attacker
Speaker 4: can exploit this flaw by sending a specially crafted HTP
Speaker 4: request to a vulnerable device. Successfully exploitation allows the attacker
Speaker 4: to bypass standard authentication mechanisms and modify the password of
Speaker 4: an existing user. So let me break that down. That's
Speaker 4: you're saying. The change password page doesn't actually verify the
Speaker 4: old password, just changes it. So I say, I want
Speaker 4: to be admint. I forgot my password, and it says
Speaker 4: what's the old password? And I say I don't know,
Speaker 4: and say what's the new password? And it's let me
Speaker 4: in and it just changes it. Wow, that doesn't that
Speaker 4: sounds like nobody qate that. No, it's so helpful. Nobody
Speaker 4: even looked at that, So that makes it I don't know,
Speaker 4: you know what.
Speaker 2: I bet it was these infuriating I bet it was
Speaker 2: a feature request.
Speaker 3: It was developed in Canada. They're very polite up there.
Speaker 4: They're they're like, hey, what if they don't remember their password? Eh, hey,
Speaker 4: just like you know, don't even look at it, just
Speaker 4: give them the new password.
Speaker 3: I don't know that it's built in Canadian. I'm sorry.
Speaker 4: That's I I to all my Canadian friends. I first off,
Speaker 4: I apologize at the accent. Secondly, my family's from Canada,
Speaker 4: so I can pick on them.
Speaker 2: It's fine. Okay, So, yeah, this is bad? Is there
Speaker 2: a patch?
Speaker 4: Yeah?
Speaker 2: Bad?
Speaker 3: Understatement of the episode?
Speaker 2: Is there patch?
Speaker 4: The patch has hit it with a hammer, I believe.
Speaker 4: I'm pretty sure that's the that's the patch. I didn't
Speaker 4: see anything in here.
Speaker 3: In mitigation Admin's urge to update is in the is in.
Speaker 4: The Yeah there you go? Okay, all right, so there
Speaker 4: is a patch active exploitation. Cisco has found there is
Speaker 4: no active exploitation in the public, however, go patch.
Speaker 2: Well, our old friend Android is in the news again.
Speaker 2: Android Alert fifty Google Play apps linked to no voice
Speaker 2: malware reached two point three million downloads. No voice malware.
Speaker 2: That's like me, that's what I have right now. I
Speaker 2: have no voice malware.
Speaker 4: This you know, we always talk about like, oh, there's
Speaker 4: malware for Android, there's malware for Android, and then you know,
Speaker 4: it comes out that it's like, oh, well, it was
Speaker 4: a sideloaded app. And for those of you haven't been listening,
Speaker 4: sideloaded apps are like it was never submitted to the
Speaker 4: play Store and somebody had to hack their own phone
Speaker 4: and then root it so that they could drag the
Speaker 4: APK over and blah blah. And of course if you're
Speaker 4: running code that's never been checked by anybody, yeah, you
Speaker 4: know you're gonna get hacked. In this case, though, this
Speaker 4: was not sideloaded really yeah yeah. While many malware targets
Speaker 4: Androids usually often come from sideloaded apps or installed app downloaded,
Speaker 4: this now instead compromised Google play Store.
Speaker 2: Yeah yeah.
Speaker 4: Good by building and deploying harmless looking games and cleaners
Speaker 4: in image galleries and the Google play Store, the attacker
Speaker 4: was able to hide malware behavior during Google's code review
Speaker 4: until after somebody had installed it. And we've talked about
Speaker 4: this where that's a black guy. Yeah, where you go
Speaker 4: and you write up an innocuous piece of software, right right,
Speaker 4: it's an app that does something useful or nothing, and yeah,
Speaker 4: or well you want to get people to download it, right,
Speaker 4: So right, it has to do something useful. Let's say
Speaker 4: it's your open claw monitoring app for your entry. Right,
Speaker 4: there's there's a lot of people who would downloind that
Speaker 4: lottery number pickers. Yeah, yeah, something along those lines. Yeah,
Speaker 4: And then in and update, because updates you can push
Speaker 4: directly down, right, I can have the app update itself,
Speaker 4: and Google place Work can look at updates and that
Speaker 4: sort of stuff. But if I obfuscate it, it's much
Speaker 4: it goes under less rigorous, let's put it that way.
Speaker 4: So yeah, here we say be careful what you download
Speaker 4: from the play Store as well.
Speaker 2: Unfortunately, and by that we don't mean that you should
Speaker 2: practice ESP and know what's coming down in that update.
Speaker 2: And so there is no way to be careful, just
Speaker 2: you know.
Speaker 4: So here's what I do, and I'm going to anytime,
Speaker 4: and I've I've trained my kids to do the same
Speaker 4: thing painfully, like usually locking them out of their devices
Speaker 4: until and and having me approve apps until they know
Speaker 4: how to do this. So, like on your device, when
Speaker 4: you go to download something from the play Store or
Speaker 4: you go to download something from the Apple Store, if
Speaker 4: you scroll down, first off, there are two different things.
Speaker 4: I look at one, who's the developer, and there's usually
Speaker 4: a link for the developer. There's usually more information what
Speaker 4: other apps have they put out there? How reliable are
Speaker 4: they that.
Speaker 2: Sort of stuff.
Speaker 4: If it's a developer you've never heard of and this
Speaker 4: is their only app, maybe don't download it, right. And
Speaker 4: I hate to say that, because I'm sure there's tons
Speaker 4: of you know, new developers out there who really want
Speaker 4: to apply this, you know, who really want to put
Speaker 4: together an app to help people. But if I see
Speaker 4: that they only have one app.
Speaker 2: Also the developer's name, yes, can can be it, you know,
Speaker 2: if it's mister cool wears yes, for example, Yeah, as
Speaker 2: opposed to you like Dell support, where you're.
Speaker 4: Like, okay, yeah, although I might not download their stuff either.
Speaker 4: But secondly, secondly, okay, that's one number two. Each of
Speaker 4: these apps is required to request the types of rights
Speaker 4: the app needs. I don't know why I'm drawing a
Speaker 4: blank on what that's called. It's a permissions. Yeah, it's
Speaker 4: not permitted. It is permissions, but there's a requirements or
Speaker 4: now all right, discord, tell me what it is at
Speaker 4: some point. But there's there's like there's a term for it.
Speaker 4: There's where when you submit your app, your app has
Speaker 4: to ask for these things. Yeah, and it has to
Speaker 4: be displayed. Right, So there's a file that says the
Speaker 4: type of permissions you need and if those permissions are egregious,
Speaker 4: like oh, this is a screenshot app, but I need
Speaker 4: access to your geolocation and they need your name and
Speaker 4: I need your contact list and it's so look at
Speaker 4: those two right, you should validate those two things. Do
Speaker 4: you trust the developer and do you trust the permissions
Speaker 4: they need align with what they're saying the app does?
Speaker 4: And if you don't, don't download it.
Speaker 2: And I need to access via UDP server in Ukraine.
Speaker 4: So yeah, I you know, that's my recommendation.
Speaker 3: I agree.
Speaker 2: You know, we won't.
Speaker 4: We all don't have you know, cyber esp but there
Speaker 4: are some things you can still do.
Speaker 2: Very good you heard it hear from Dwayne. Yeah, all right.
Speaker 2: The next story weaponizing the Protectors Team PCPs multi stage
Speaker 2: supply chain attack on security infrastructure. So this is basically
Speaker 2: people that are using tools that security people use like
Speaker 2: you guys, and weaponize them to use them against security people.
Speaker 3: Yeah, you know, if you leave a shotgun by your
Speaker 3: door and a bad guy gets in, they got a shotgun, handy.
Speaker 3: If you have these tools on the system, then they
Speaker 3: can be used against the system. It's living living off
Speaker 3: the land again.
Speaker 2: Yeah, So what happened in this particular situation is a
Speaker 2: few attacks, right, Yeah, and a lot.
Speaker 4: Of these end up being and we've seen we've already
Speaker 4: announced some of these, like trivia, like the Aqua security
Speaker 4: trivia we talked about last week, right, and that was
Speaker 4: a supply chain attack. So this is just a really
Speaker 4: good this article is a really good kind of summary
Speaker 4: of some of the ones we've talked about, some of
Speaker 4: the ones we haven't talked about, just because you're there
Speaker 4: are so many different attacks that go on out there,
Speaker 4: so we wanted everybody to have kind of access to
Speaker 4: what are the what's the state of the art in
Speaker 4: these core sort of supply chain attacks, And like I said,
Speaker 4: Trivia was one of them. But k I C S.
Speaker 4: I don't know if that's pronounced kicks or you know whatever,
Speaker 4: guys is whatever.
Speaker 3: Yeah, keeping infrastructure is secure code.
Speaker 4: Yeah, and light LLLM. So there's a couple of different
Speaker 4: you know, open source packages out there that over time
Speaker 4: have been exploited in different ways. So One of the
Speaker 4: things we want to do is kind of give you
Speaker 4: eyes on this and just be careful with and announce
Speaker 4: when you download open source projects.
Speaker 2: This thing compromised at least sixteen organizations and they're listed
Speaker 2: in this article. Yep, my goodness. Yeah.
Speaker 4: And some of this was you know, some of these
Speaker 4: are exploits we've talked about in the past, like react
Speaker 4: to shell. Some of these are new deployment pipeline attacks
Speaker 4: like we had talked about last week. So just this
Speaker 4: is a good read to go through and be like, hey,
Speaker 4: am I using any of these versions?
Speaker 2: You know?
Speaker 4: If I think some of my like my open aikeys
Speaker 4: were compromised through you know, let's say, like you know,
Speaker 4: whatever a package I download, maybe I need to rotate
Speaker 4: those that's worst.
Speaker 2: Hey Dwayne, yeah, I'm going to send you a hundred bucks,
Speaker 2: but you have to download Duke to receive it. Do
Speaker 2: you see? Go ahead? I'll wait, go ahead, install that.
Speaker 4: This is This is usually where I reply and say
Speaker 4: I tried to I tried to install it multiple times
Speaker 4: and then there's an error, Am I do I have
Speaker 4: the right URL?
Speaker 2: Here it is?
Speaker 4: And then I give them back another RL that they
Speaker 4: click on that's fully loaded with a lot of listeners.
Speaker 2: All right, So here's the story. A publicly accessible Amazon
Speaker 2: hosted storage server allowed anyone with a web browser to
Speaker 2: access potentially one hundreds of thousands of people's personal data
Speaker 2: without needing a password. This included driver's life since his
Speaker 2: passport's another personal information collected by the Duke app. That's
Speaker 2: do you see a money transfer service service owned by
Speaker 2: Toronto based Dualles Dualles du A l ees And I
Speaker 2: don't know why. I'm close in Mexico than Canada Dualles,
Speaker 2: but it could be duels. I don't know if you're
Speaker 2: in Canada, be duals A.
Speaker 4: I guess duels A, So maybe that's is Canadian. It's
Speaker 4: a Canadian app duels A duels Actually it says Toronto based,
Speaker 4: so maybe I don't know, maybe it is. Maybe it
Speaker 4: is dual Okay, So yeah, and this is a money
Speaker 4: transfer service.
Speaker 3: Uh.
Speaker 4: The interesting thing apart it, this is an Amazon hosted
Speaker 4: storage server. And this storage server had three hundred and
Speaker 4: sixty thousand files Canadian government issue blah blah blah. Right,
Speaker 4: lots of information on it. First off, this is an
Speaker 4: app and a lot of people, a lot of developers
Speaker 4: think there's no way for people to pull keys and
Speaker 4: information out of my app, and that, I will tell
Speaker 4: you is entirely wrong. It is very easy to take
Speaker 4: you know, either you know an APK or whatever, even
Speaker 4: an iPhone app, tear it apart and find what keys
Speaker 4: you're using to call them back end and find information
Speaker 4: like that, right, I mean, heck, you can even just
Speaker 4: pass all that data through a proxy and start looking
Speaker 4: at the data. So there's there's many different ways for
Speaker 4: you to identify what's getting called on the back end.
Speaker 4: So this is really more of a story of if
Speaker 4: you assume people are going to get access to this data,
Speaker 4: so a CP assume people are going to see these files,
Speaker 4: assume people you know a lot of time less developers
Speaker 4: when we want to hide something, you know, we don't
Speaker 4: use obscurity as the only thing, but a lot of
Speaker 4: us do use quidd quitted URLs right or s three
Speaker 4: buckets that are massive quitted you know spaces. So you're
Speaker 4: not going to guess it, you're not going to perforce it, right,
Speaker 4: So but for you to assume that nobody's gonna find
Speaker 4: it is absurd, right.
Speaker 3: Yeah, Security through obscurity is a layer in a multi
Speaker 3: layered defense. But it can't be the only thing.
Speaker 2: Right right, Yeah, absolutely, Patrick, It's like rolling the windows
Speaker 2: up and keeping your car in lock.
Speaker 3: Yeah.
Speaker 2: Good.
Speaker 3: An analogy he recently is we m one tanks don't
Speaker 3: rely on their paint color for their security, but we
Speaker 3: don't paint a marge.
Speaker 4: Yeah right, exactly. Yeah, so there's still a little bit
Speaker 4: of obscure in the area. So in this particular case,
Speaker 4: like if I can find that that those shared folders
Speaker 4: on this hosted server, you should have another layer that
Speaker 4: the data should be encrypted. The data should be pulled
Speaker 4: off if not needed on that server.
Speaker 2: The data like should have an authentication layer.
Speaker 4: There should be Yeah, absolutely, there should be other ways
Speaker 4: that you're protecting this data other than just this is
Speaker 4: you know, a server you hope nobody finds.
Speaker 3: Exactly the same as an unencrypted AWOS bucket. Yeah, it's
Speaker 3: exactly the same.
Speaker 2: You know.
Speaker 4: It's funny, that's really It used to be everybody had
Speaker 4: these open s three buckets, right, and you could just
Speaker 4: find all sorts of cool data, and there were all
Speaker 4: sorts of hacker tools to just sort of surf them. Now,
Speaker 4: if you want to have an open s three bucket
Speaker 4: in Amazon, it's like you got to sign away your
Speaker 4: first born. It is almost to approve it to come
Speaker 4: to your house. But the interview you yeah, exactly, it's insane,
Speaker 4: Like yeah, so, I mean, kudos to Amazon Web Services
Speaker 4: for for locking a lot of that stuff down.
Speaker 2: Well, but yeah, here's the thing. I have no problem
Speaker 2: with buckets that are publicly allowed read access right because
Speaker 2: there's just a bunch of files. Go ahead, download all
Speaker 2: the files you want, but not going to allow write
Speaker 2: access right right, no surre, Yeah, absolutely, yeah.
Speaker 4: And it depends on the type of data like if
Speaker 4: this is you know, W two's for everybody at you
Speaker 4: know IBM, right right, all right, maybe you don't want
Speaker 4: read only there.
Speaker 2: But if they're like security this week ap is so
Speaker 2: for example.
Speaker 4: Yeah, absolutely great, place yourself out, yep, yep, yep.
Speaker 2: We're not going to complain if you download them and
Speaker 2: distribute them yourself, go ahead, go for it. Yeah I
Speaker 2: would want to do that. I have no idea. But okay,
Speaker 2: all right, are we done with that one?
Speaker 4: I think uh no, I want to say I think
Speaker 4: we're going to start to see a lot more of
Speaker 4: these types of things. I think as we see as
Speaker 4: we're seeing vibe coded applications. And I'm not saying this
Speaker 4: is vibe coded. I'm just I'm going more on the
Speaker 4: ranti of AI and vibe coding where we see things.
Speaker 4: As we start to see a lot more vibe coding
Speaker 4: and we see vibe coded by people who are either
Speaker 4: new to development or don't understand architecture like production secure architecture,
Speaker 4: We're going to see a lot more applications and files
Speaker 4: being you mean.
Speaker 3: Most of the developers have ever met?
Speaker 2: Wow, this is wow.
Speaker 4: We're going to see a lot more files and sensitive
Speaker 4: data being deployed into cloud environments where they where the
Speaker 4: developers may or may not understand the ramifications of what
Speaker 4: they're doing.
Speaker 2: Right. Well, all right, main story this week and this
Speaker 2: should scare you. Axios NPM package compromised supply chain attack
Speaker 2: hits JavaScript HTTP client. Think about that for a second.
Speaker 2: JavaScript HP how important is that? Right? I mean?
Speaker 3: Who uses that?
Speaker 2: Okay, anybody whouses a JavaScript framework to do any kind
Speaker 2: of UI at all is using a JavaScript HTD client
Speaker 2: with one hundred million plus weekly downloads weekly. Yeah.
Speaker 3: To put this in context, if you if you updated
Speaker 3: Claude code after the act, after the you know the
Speaker 3: code source code exposure from slightly after midnight to about
Speaker 3: three point thirty in the morning London time on the
Speaker 3: thirty first, you may have received the trojanized version of Axios.
Speaker 4: Yes.
Speaker 2: Wow.
Speaker 3: So just to put it in perspective of like it's
Speaker 3: it's like it's like they said, like, you know, transparent
Speaker 3: food dye number fifteen will kill you and you have
Speaker 3: no idea what.
Speaker 2: It's in transparent food due Yeah, exactly, Yeah, it's Axios.
Speaker 4: Is interesting. So, like Carl had said, this is an
Speaker 4: HTTP client right for JavaScript, so calling back in pages
Speaker 4: and that sort of stuff, which JavaScript heads up does
Speaker 4: all the time. Interestingly enough, all the time. There is
Speaker 4: a client in Java, in the Java script world that
Speaker 4: does this. It's actually a native library, but it didn't
Speaker 4: have as many features as people had liked early on,
Speaker 4: and a lot of people had adopted Axios. You know,
Speaker 4: fast forward to bajillion years and people just keep using Axios.
Speaker 2: Because they're used to it.
Speaker 4: You know, they like Axios, And I'm sure on our
Speaker 4: discord people can tell me why they would use Axios
Speaker 4: as opposed to the local libraries. But in this particular case,
Speaker 4: what happened is a lot of these libraries are sometimes
Speaker 4: sort of supported by an individual developer or or a
Speaker 4: small group of developers who don't you know, don't work
Speaker 4: for a large corporation, don't go through the normal sort
Speaker 4: of rollout process and that sort of stuff. And in
Speaker 4: this particular case, the developer who one of the developers
Speaker 4: who maintains this repository got hacked, social engineered, lost is
Speaker 4: you know access. We see that his repository accounts got
Speaker 4: switched over to a proton mail account and then there
Speaker 4: were new uh, you know, new updates coming down. So
Speaker 4: what's what's actually sort of really interesting about this is
Speaker 4: the way how Cleannes was in installing a back door.
Speaker 4: So one of the things you're gonna want to look
Speaker 4: for if you're if you're using Axios and you're using
Speaker 4: the corresponding versions, which are one dot fourteen dot one
Speaker 4: or notice not through but or zero dot thirty dot four,
Speaker 4: if you're using those, you'll want to look for and
Speaker 4: I want to get the library right.
Speaker 3: Well, while you're doing that, remember that most people don't
Speaker 3: go and get Axios. They're using it because they're using
Speaker 3: something that uses it, just like log forge.
Speaker 4: Correct, right, yeah, absolutely, it's just a library, right, so
Speaker 4: you supply chain, Yeah, you don't know NPM. You pull
Speaker 4: this stuff down and it's just installed. So what happens
Speaker 4: is this Axios. What they've done is they've said, oh,
Speaker 4: by the way, we have a dependency now of plane
Speaker 4: Dash Crypto dash JS version four, dot two, dot one.
Speaker 4: There is a crypto dash JS which is pretty common
Speaker 4: to have, so Plane Dash Crypto dash JS. If you
Speaker 4: see that you've been compromised, you want to be careful.
Speaker 4: But what's really interesting is it says it's a requirement.
Speaker 4: So the initial check on Axios is obviously virus free.
Speaker 4: It pulls down this requirement, it installs the remote access trojan,
Speaker 4: and then it cleans itself up, so when the install
Speaker 4: is done, it still looks like it's virus free. Although
Speaker 4: now you have a backdoor installed.
Speaker 2: Wow.
Speaker 4: So this one's reasonably hard to find and with one
Speaker 4: hundred million weekly downloads. Yeah, you want to double check
Speaker 4: and see if you actually have this installed.
Speaker 2: So if you have it installed, are you screwed?
Speaker 4: Yes? Yeah, I mean literally the comments on the internet
Speaker 4: or if you have this installed, you need to go.
Speaker 4: First off, you need to burn down the infrastructure you
Speaker 4: have there. Ideally it's in a cloud and you can
Speaker 4: just burn it down and roll it back and whatever.
Speaker 4: But the other thing you need to do is you
Speaker 4: need to assume that any keys anything in your dot
Speaker 4: E and V file, any whether it's opening eye keys,
Speaker 4: whether it's back end keys, whether it's aki a ki
Speaker 4: K keys. Yeah, anything you have access to that doesn't
Speaker 4: prompt you for a password.
Speaker 2: Any configuration.
Speaker 4: Yeah, whatever you would have keys for, whatever you would
Speaker 4: have in your environmental file, whatever you would have for
Speaker 4: passwords for local databases like, you can assume all of
Speaker 4: that's probably already been taken and you need to go
Speaker 4: start rotating keys and passwords.
Speaker 2: Wow, yikes, that's a that's a bad one.
Speaker 3: Do we think something like an a virus is going
Speaker 3: to pick this up looking for this file?
Speaker 2: No?
Speaker 4: I don't think so. Uh. I mean, could you have
Speaker 4: a could you could there be a package or a
Speaker 4: custom you know, thing deployed that only looks for this
Speaker 4: version of you know, playing crypto jass maybe And then
Speaker 4: but the problem is there's no known malware in it, right,
Speaker 4: So yeah, eh so ultimately yes, could could we say, oh, well,
Speaker 4: if you find this, just assume they've been compromised.
Speaker 2: Maybe? So it be nice to have a tool that
Speaker 2: you could run on your machine that would look at
Speaker 2: all your NPM installs and see if you could find it.
Speaker 3: It really should be something that the antivirus looks for us,
Speaker 3: Like you know with this this this file name is
Speaker 3: up to no good. Let's look at it, let's look
Speaker 3: at its size, and we know it's not it doesn't
Speaker 3: have malware in it. It is malware, right, Yeah.
Speaker 2: Well do modern antivirus applications allow you to enter file
Speaker 2: names that you wanted to find, so.
Speaker 4: You can you can block certain files by name. The
Speaker 4: problem with that is a lot of them don't take
Speaker 4: that as sort of an important feature because viruses can
Speaker 4: generally and more often than not, will change their names,
Speaker 4: especially malware.
Speaker 2: Right.
Speaker 4: So it's like, oh, well the file name doesn't matter
Speaker 4: in this particular case because we can isolate it to
Speaker 4: a small version.
Speaker 3: And they caught it quick.
Speaker 4: That was deployed and it was real, It was caught
Speaker 4: relatively quickly. Yeah, you know what the name of the
Speaker 4: file is.
Speaker 2: But so you could do a duras slash ass if
Speaker 2: you really wanted to.
Speaker 4: And there's there's a couple IP addresses in this article
Speaker 4: from trend that we put out here. There's a couple
Speaker 4: IP addresses for the command and control structure. Obviously don't
Speaker 4: click on any of them, but s fr clak is
Speaker 4: one of them. Call are hys dot com is another one,
Speaker 4: and there's a couple IP addresses. So just needless to say,
Speaker 4: if you see you know, that's another way we would
Speaker 4: detect it as hey, what what's coming off the box?
Speaker 4: And especially in custom ports in this particular one port
Speaker 4: eight thousand is what it calls off the box, which
Speaker 4: is weird.
Speaker 2: So yeah, all right, So let's answer the question, Duane,
Speaker 2: you think this is worse than Log for J.
Speaker 4: I do? And I yeah, I do, I actually do. Well,
Speaker 4: let me put it this way. I think the the
Speaker 4: blast radius won't be as big. Okay, because Log for
Speaker 4: J nobody knew where log for J was. Right in
Speaker 4: this particular case, the blast radius could potentially be in
Speaker 4: that time frame I don't know, I'll call it hundreds
Speaker 4: of millions of people. But the damages could be greater
Speaker 4: with this right problem being is LOG for J you
Speaker 4: needed to go find the person who install that version
Speaker 4: so that you could exploit them. In this case, if
Speaker 4: you installed this version, it reached out to you. Right,
Speaker 4: It reached out to the hackers, so the hackers didn't
Speaker 4: have to go discover you. Yeah right. There was a
Speaker 4: ten hour window where you just called into the hackers environment.
Speaker 4: So the damages can be greater. But I don't think
Speaker 4: it's going to be as ubiquitous. I don't think you're
Speaker 4: going to see this for the next six months like
Speaker 4: you did with log for j where it was hard
Speaker 4: to find what was using it.
Speaker 2: Well, we'll see because there's going to be more episodes
Speaker 2: of security this week. But that's all for this week,
Speaker 2: So we'll see you next week on Security this week,
Speaker 2: Bye bye bye. I gues