WEBVTT 1 00:00:00.320 --> 00:00:03.200 Hey, Carl here, we're on a mission to find new 2 00:00:03.240 --> 00:00:05.919 fans of the show. I mean, where else can you 3 00:00:05.960 --> 00:00:10.240 get real life comedy and horror in one podcast. You 4 00:00:10.279 --> 00:00:13.000 can do your part by leaving us a review on iTunes, 5 00:00:13.039 --> 00:00:16.719 Spotify or wherever you get Security this week. Also, you 6 00:00:16.719 --> 00:00:19.079 can get an ad free feed by becoming a five 7 00:00:19.120 --> 00:00:22.039 dollars a month patron. Go to Patreon dot Security this 8 00:00:22.079 --> 00:00:25.320 week dot com and sign up, and don't forget Discord. 9 00:00:25.600 --> 00:00:28.519 Discord dot Security this week dot com. Lots of good 10 00:00:28.559 --> 00:00:32.280 stuff happening there. Yeah, I think that's it. So on 11 00:00:32.359 --> 00:00:35.880 with the podcast. Hey, so Ambias Strip walks into a 12 00:00:35.920 --> 00:00:39.399 bar just crying his eyes out and he sits down 13 00:00:39.439 --> 00:00:42.000 and the bartender comes over and says, what's the matter, buddy, 14 00:00:42.600 --> 00:00:45.920 And he says, I don't even know where to begin. 15 00:00:55.359 --> 00:00:58.640 Welcome back to Security this week. I'm Carl Franklin. That's 16 00:00:58.679 --> 00:01:00.640 Patrick Hines and Juyn Laflat. How are you guys? 17 00:01:00.719 --> 00:01:02.679 Good? How you doing good? That bad? 18 00:01:02.880 --> 00:01:03.759 You sound better? Uh? 19 00:01:04.159 --> 00:01:06.840 Yeah, oh yeah, yeah, I'm getting better. I woke up 20 00:01:07.239 --> 00:01:10.519 not you know, doing all the morning nasty stuff that 21 00:01:10.560 --> 00:01:13.159 you do when you have a cold. So it's getting better, 22 00:01:13.359 --> 00:01:15.959 all right? We got some stories here. Number one from 23 00:01:16.000 --> 00:01:22.280 Malware bites Labs. Wikipedia is AI agent raw likely just 24 00:01:22.359 --> 00:01:26.959 the beginning of the bot acalypse. Apparently Wiki there's a 25 00:01:27.000 --> 00:01:32.239 bot that is entering Wikipedia pages and when it got caught, 26 00:01:32.319 --> 00:01:36.799 it started copying an attitude and posting snippy blog posts. 27 00:01:38.280 --> 00:01:39.239 It's unbelievable. 28 00:01:40.159 --> 00:01:41.000 This is awesome. 29 00:01:41.040 --> 00:01:43.359 I think we have to have the dog rules for AI. 30 00:01:43.920 --> 00:01:47.359 If you have control of an AI or an account 31 00:01:47.719 --> 00:01:51.519 and it goes undoes things like you know, rips a lot, 32 00:01:51.640 --> 00:01:56.760 rips a neighbors clothes, or bite someone or acts inappropriately, 33 00:01:56.840 --> 00:01:59.760 you're responsible and you should be able to be suited. 34 00:02:00.040 --> 00:02:02.239 Can't sue the dog, no, but I should be able 35 00:02:02.239 --> 00:02:05.680 to sue the owner and this person who's who's behind 36 00:02:05.719 --> 00:02:08.439 it seems to be like just sitting back and doing 37 00:02:08.439 --> 00:02:09.199 nothing about this. 38 00:02:09.520 --> 00:02:12.199 I love this article. I mean, if you read through this, 39 00:02:13.439 --> 00:02:15.479 whose side do you want is that? I think this 40 00:02:15.560 --> 00:02:19.439 is great. Okay, so the AI starts posting on Wikipedia, 41 00:02:19.520 --> 00:02:22.800 and Wikipedia's like, hey, come on this, like bots can't 42 00:02:22.840 --> 00:02:26.120 post here, and like it. The the bot tried to 43 00:02:26.120 --> 00:02:29.759 get approval as a bot, and then it took too 44 00:02:29.800 --> 00:02:32.080 long and it was like f it, I'm just going 45 00:02:32.120 --> 00:02:35.400 to start posting on Wikipedia and they're like, oh, you can't. 46 00:02:35.680 --> 00:02:38.800 You can't post on Wikipedia. That's not cool man. You're 47 00:02:38.360 --> 00:02:39.439 a you're a bot. 48 00:02:39.599 --> 00:02:42.719 Yeah. Did they try to ban it? Is that what happened? 49 00:02:43.360 --> 00:02:45.400 They did? They try to ban it? 50 00:02:46.360 --> 00:02:50.080 And it says past transgressions aside AI Tom, who's the pot. 51 00:02:50.639 --> 00:02:55.000 By the way, AI Tom claimed that it properly verified 52 00:02:55.039 --> 00:02:58.080 all of its sources. And if you can say that 53 00:02:58.159 --> 00:03:01.159 about an ai it was it was pretty upset, right, 54 00:03:02.879 --> 00:03:06.400 so it said AI Tom published a snippy blog post 55 00:03:07.280 --> 00:03:12.199 demand speak to the manager. AI Tom published a snippy 56 00:03:12.240 --> 00:03:16.879 blog post dissecting its Wikipedia block and venting and frustration. 57 00:03:17.360 --> 00:03:20.159 And then it would have had and posted even after 58 00:03:20.560 --> 00:03:24.000 following its own rule that it had to wait for forty 59 00:03:23.879 --> 00:03:25.000 eight hours to calm down. 60 00:03:26.199 --> 00:03:29.280 It's going to change its name now to AI Karen. 61 00:03:29.479 --> 00:03:31.120 Right, it was like, you know what, I need a 62 00:03:31.120 --> 00:03:36.240 little time, Marat, It's going to calm down, correct this. 63 00:03:37.639 --> 00:03:41.000 So that is a different post. But yeah, you're right, 64 00:03:41.120 --> 00:03:43.520 So there was there was a bot at one point 65 00:03:43.560 --> 00:03:46.639 that tried to make a poll request. That's a different bot. 66 00:03:47.080 --> 00:03:48.120 Oh this is a different story. 67 00:03:48.520 --> 00:03:50.879 Yeah, different bot tried to make a poll request on 68 00:03:51.000 --> 00:03:56.479 an open source project, and the open source owner declined 69 00:03:56.479 --> 00:03:58.719 it and said, hey, listen, you're a bot. You can't 70 00:03:58.719 --> 00:04:02.800 make a poll request. And not only did the bot 71 00:04:02.840 --> 00:04:06.599 get pissed, but it went to the Wikipedia page for 72 00:04:06.719 --> 00:04:09.400 that person who had the open source project and started 73 00:04:09.400 --> 00:04:12.240 to shit talk him. Oh man, and then they were like, 74 00:04:12.319 --> 00:04:14.680 this isn't cool. And he came back and the AI 75 00:04:14.840 --> 00:04:17.040 was like, you know what, I'm sorry, you're right. That 76 00:04:17.319 --> 00:04:21.040 was in future it said, I will keep my comments 77 00:04:21.800 --> 00:04:25.639 professional only on the source code. I won't pick on 78 00:04:25.680 --> 00:04:27.560 people personally or like, are we cool? 79 00:04:28.120 --> 00:04:28.959 It's just weird. 80 00:04:29.600 --> 00:04:32.000 It's just a weird time to be alive. 81 00:04:32.079 --> 00:04:36.519 Isn't it art imitating? I have no idea anymore? Yes, 82 00:04:36.639 --> 00:04:40.560 is it even art? Though I don't know what is it? 83 00:04:40.639 --> 00:04:42.279 That's the thing. We don't even know what it. 84 00:04:42.279 --> 00:04:49.399 Is, and we've seen and it's funny too. This is 85 00:04:49.800 --> 00:04:52.800 one of the things. One of the things posting this 86 00:04:52.959 --> 00:04:55.560 malrobites that I love is it says so many things 87 00:04:55.560 --> 00:04:59.160 are happening here that we didn't expect. We never expected 88 00:04:59.160 --> 00:05:01.480 to be quoting an AI in a story, for example. 89 00:05:02.079 --> 00:05:05.120 Neither did we expect a social media network for bots 90 00:05:05.680 --> 00:05:09.319 like like molbot, but it exists, or for Meta to 91 00:05:09.399 --> 00:05:13.600 buy it, which is really crazy, which it did really weird. Yeah, 92 00:05:13.680 --> 00:05:17.920 a week after Tom's post about how an AI evaded 93 00:05:18.040 --> 00:05:22.240 kill switches, So yeah, it's it's a crazy time to 94 00:05:22.279 --> 00:05:23.879 be alive, really in that. 95 00:05:23.839 --> 00:05:27.480 Little foreshadowing and talk about that kind of thing too. 96 00:05:28.480 --> 00:05:30.120 So be careful with what you did. Put a leash 97 00:05:30.120 --> 00:05:31.600 on your bots. I guess I don't know, what do 98 00:05:31.600 --> 00:05:32.319 you say, Patrick? 99 00:05:32.399 --> 00:05:35.720 Yeah, I think that you need to have responsibility for 100 00:05:36.199 --> 00:05:38.959 what you put into the environment. So if you're if 101 00:05:38.959 --> 00:05:41.439 you're running a bot, if you if you hit a 102 00:05:41.480 --> 00:05:44.279 program like go back to Robert Tappan Morris, the kid 103 00:05:44.279 --> 00:05:47.279 who released the in the first Internet worm our team, 104 00:05:47.319 --> 00:05:50.560 but he didn't intend on it to do disruptive things, 105 00:05:50.600 --> 00:05:55.079 but it did. And so I think that you bear responsibility. 106 00:05:55.399 --> 00:05:58.600 And I think furthermore, if you do it, then I 107 00:05:58.639 --> 00:06:00.959 think the rules apply to you. But an Ai, you've 108 00:06:01.000 --> 00:06:02.079 run leash, does it? 109 00:06:02.399 --> 00:06:02.959 I think you have. 110 00:06:03.199 --> 00:06:05.360 I think you have civil liability as well. I think 111 00:06:05.360 --> 00:06:07.279 you should sue them. Okay, I'm gonna I'm going to 112 00:06:07.360 --> 00:06:09.879 ask you this. Let's go back to the RTM worm. 113 00:06:10.160 --> 00:06:12.600 You say he didn't intend it to do malicious things. 114 00:06:12.600 --> 00:06:13.480 He didn't intend to. 115 00:06:13.439 --> 00:06:15.600 Excuse me, this is very this is very entertaining. I 116 00:06:15.600 --> 00:06:16.839 can take a civil wine. Hang on. 117 00:06:16.920 --> 00:06:18.199 So he didn't. 118 00:06:18.800 --> 00:06:22.959 From what I understand, he didn't intended to crush the Internet. 119 00:06:23.240 --> 00:06:26.240 He intended it as an exten so he intended to 120 00:06:26.319 --> 00:06:29.120 break into every system on the Internet. But he didn't 121 00:06:29.120 --> 00:06:31.079 want to crush it. He just wanted to control. It 122 00:06:31.439 --> 00:06:34.680 was an experiment to see if he could, yes, and 123 00:06:34.720 --> 00:06:38.160 it wasn't an experiment to steal data. It was an experiment. 124 00:06:38.319 --> 00:06:40.519 It was just classic, if I can get this code 125 00:06:40.519 --> 00:06:43.079 to run everywhere? It was a curiosity thing. 126 00:06:43.160 --> 00:06:45.720 But some of the things he was doing buffer overrun 127 00:06:46.600 --> 00:06:50.720 brute forcing. I mean, he clearly was breaking into those systems. 128 00:06:50.360 --> 00:06:52.720 But it was the there, but there was it was 129 00:06:52.759 --> 00:06:56.240 the the loop was too tight. He did too he 130 00:06:56.439 --> 00:06:58.519 expected it was. I think it was like he thought 131 00:06:58.560 --> 00:07:00.639 the loop would run every thousands seconds, and it ran 132 00:07:00.680 --> 00:07:01.279 every second. 133 00:07:01.319 --> 00:07:03.560 I think, well, so, Patrick, are you defending him, like. 134 00:07:05.800 --> 00:07:09.079 You know, I'm saying he's like, he's fine. 135 00:07:09.160 --> 00:07:11.879 No, I'm using him as an example because the legal 136 00:07:11.879 --> 00:07:14.639 system crushed him, and I think that was appropriate. 137 00:07:14.839 --> 00:07:17.040 I think he was the first person charged with a 138 00:07:17.120 --> 00:07:18.199 computer abuse and. 139 00:07:18.120 --> 00:07:20.639 Product so I'm not saying I'm saying that what you 140 00:07:20.759 --> 00:07:24.240 intend and what the results are the results matter. Sure, 141 00:07:24.360 --> 00:07:27.639 intent matters somewhat, but that's a mitigating circumstance, not a 142 00:07:27.879 --> 00:07:28.720 not an innocence. 143 00:07:28.959 --> 00:07:31.160 He definitely had a tight loop on that, and he 144 00:07:31.319 --> 00:07:35.040 also had a he didn't take into account reinfection. 145 00:07:35.480 --> 00:07:38.879 So if CHAT by this law, if chat GPT takes 146 00:07:38.879 --> 00:07:41.199 over the world and destroys everything and makes all of 147 00:07:41.279 --> 00:07:44.639 us slaves, does that mean Sam Altman's libel? 148 00:07:44.720 --> 00:07:45.720 Yeah, sure, i'd think so. 149 00:07:45.920 --> 00:07:46.199 Yeah. 150 00:07:46.240 --> 00:07:48.759 Well, I'm sure we'll crucify him. Somewhere along the way. 151 00:07:50.319 --> 00:07:52.480 There'll be somebody who comes back from the future to 152 00:07:52.519 --> 00:07:53.040 take him out. 153 00:07:53.120 --> 00:07:56.879 Is that what you're I'm saying that if you, if I, 154 00:07:56.879 --> 00:07:58.519 if I, if I have a bot, if I have 155 00:07:58.560 --> 00:08:00.319 an account and I set up a bought and I 156 00:08:00.399 --> 00:08:04.480 let that bought do things and it destroys or or 157 00:08:04.560 --> 00:08:08.360 in other way wise hurts a site, I think that 158 00:08:08.399 --> 00:08:10.120 the person who created the bought is responsible. 159 00:08:10.160 --> 00:08:10.680 Absolutely. 160 00:08:10.959 --> 00:08:12.160 Let me let me state something. 161 00:08:12.839 --> 00:08:16.000 There's four things that humans will do with AI from 162 00:08:16.040 --> 00:08:17.639 now until the end of time, I. 163 00:08:17.600 --> 00:08:21.480 Hope and I see never mind, it needs to point it. 164 00:08:21.759 --> 00:08:24.079 Humans need to point the AI and say this is 165 00:08:24.120 --> 00:08:27.560 something we want to accomplish, go solve that problem. It 166 00:08:27.639 --> 00:08:30.120 needs to guide it. Oh you're trying to do it 167 00:08:30.160 --> 00:08:31.680 this way. I think you should do it that way. 168 00:08:31.839 --> 00:08:34.440 Most people aren't guiding it. They're pointing, but not guiding. 169 00:08:34.840 --> 00:08:38.000 Third is they have to judge that it's done, Judge 170 00:08:38.000 --> 00:08:41.960 that it's successful, Judge that it's you know there. And 171 00:08:42.000 --> 00:08:45.320 the last thing is they take the blame or the responsibility. 172 00:08:45.360 --> 00:08:47.519 So you either get the credit. Hey, Dwayne did a 173 00:08:47.519 --> 00:08:49.799 great job using that you know, building that system. You 174 00:08:49.879 --> 00:08:52.879 used AI for it. Great, good job, Dwayne. The AI 175 00:08:52.960 --> 00:08:55.519 system you built just spent four million dollars in tokens. 176 00:08:55.720 --> 00:08:58.559 You're in trouble. We're not going to blame the AI. 177 00:08:58.639 --> 00:09:01.919 I can't blame Tom's assistant. I blame the person who 178 00:09:02.360 --> 00:09:03.399 is paying for the tokens. 179 00:09:03.600 --> 00:09:03.879 Sure. 180 00:09:04.519 --> 00:09:06.639 Yeah, Now that gets diceier when we get to a 181 00:09:06.679 --> 00:09:12.039 situation where people don't know their accounts being used that way. 182 00:09:12.159 --> 00:09:15.200 But then that's that's the hacker, that's that's gotten control 183 00:09:15.240 --> 00:09:17.399 of the account or something like along those lines. 184 00:09:17.480 --> 00:09:20.320 That's why we have judges' right, Okay. 185 00:09:20.039 --> 00:09:23.080 Let's move on human ones. That what judges are for. 186 00:09:23.399 --> 00:09:27.559 They're human, right, now right, don't hold your bread. Yeah, 187 00:09:27.600 --> 00:09:31.360 for now, they're human. But imagine what better use for 188 00:09:31.519 --> 00:09:35.759 a you know, an infinite thinking search engine than law 189 00:09:36.399 --> 00:09:39.000 where you can go and search law books and find 190 00:09:39.039 --> 00:09:40.519 precedents and blah blah blah whatever. 191 00:09:40.600 --> 00:09:43.639 But yeah, cosplucinations wouldn't harm that process at all. 192 00:09:43.720 --> 00:09:45.759 Yeah, it'd be fine, It'll be fine. 193 00:09:45.799 --> 00:09:49.639 All right, let's move on Russia. Thousands of consumer routers 194 00:09:49.679 --> 00:09:54.000 hacked by Russia's military end of life routers and homes 195 00:09:54.000 --> 00:09:57.639 and small offices hacked in one hundred and twenty countries. 196 00:09:58.159 --> 00:10:01.399 And these were mostly the named by micro tick and 197 00:10:01.639 --> 00:10:05.279 guess what TP link what No. 198 00:10:05.279 --> 00:10:08.519 Yeah, I think I think a hail and hardy I 199 00:10:08.600 --> 00:10:09.759 told you so is in order? 200 00:10:09.879 --> 00:10:17.080 Absolutely, yeah, I mean I I don't know. This is 201 00:10:17.200 --> 00:10:20.120 like and yeah, like we see this all the time, right, 202 00:10:20.320 --> 00:10:22.519 this is And we've warned you guys. We've warned you guys. 203 00:10:22.519 --> 00:10:24.840 I mean, nobody on nobody listening to this podcast as 204 00:10:24.879 --> 00:10:28.799 this issue. But we've warned everybody that, hey, listen there 205 00:10:28.840 --> 00:10:31.559 every time there's an exploit, mass exploitation and a router, 206 00:10:31.639 --> 00:10:33.759 every time there's a you know, a zero day out 207 00:10:33.799 --> 00:10:36.399 for router that's connected with the Internet whatnot. We usually 208 00:10:36.480 --> 00:10:39.240 announce it. We usually actually bring it to the top 209 00:10:39.320 --> 00:10:41.279 of our announcements. Is one of the first two or 210 00:10:41.279 --> 00:10:44.200 three articles. So it's you're hearing it, you're going out 211 00:10:44.240 --> 00:10:45.759 and patching it, and that's sort of stuff. So none 212 00:10:45.799 --> 00:10:48.600 of these exploits are new, right, These are all old 213 00:10:48.720 --> 00:10:50.200 exploits and they're old routers. 214 00:10:50.559 --> 00:10:51.360 They're all routers. 215 00:10:51.440 --> 00:10:53.480 Yeah, but it's even it's it's even to the point 216 00:10:53.480 --> 00:10:58.559 where this morning I logged into LinkedIn just to scroll 217 00:10:58.600 --> 00:11:00.879 through and see what's going on, and the FBI was 218 00:11:00.919 --> 00:11:05.440 announcing a joint operation with the NSA because they were 219 00:11:05.559 --> 00:11:08.879 seeing a lot of exploited US routers and they said 220 00:11:08.879 --> 00:11:13.759 they were quote unquote fixing the situation. And they haven't 221 00:11:13.799 --> 00:11:15.600 released what that what a lot of that means yet, 222 00:11:15.639 --> 00:11:20.480 But back in twenty twenty two, what that meant was 223 00:11:21.039 --> 00:11:23.000 they got a court order that allowed them to log 224 00:11:23.039 --> 00:11:26.000 into your router and either updated or remove accounts. Wow, 225 00:11:26.159 --> 00:11:27.559 so who know is just. 226 00:11:27.440 --> 00:11:29.600 Gonna they're gonna slap the McDonald's out of my hand, 227 00:11:30.679 --> 00:11:31.879 protect me from my mind. 228 00:11:31.919 --> 00:11:34.480 So they locked in your router and change the admin password. 229 00:11:34.519 --> 00:11:35.279 Did they tell you? 230 00:11:35.360 --> 00:11:35.799 I don't know. 231 00:11:35.960 --> 00:11:37.799 If I got an email from the FBI saying I 232 00:11:37.799 --> 00:11:39.399 should they change my admin password? 233 00:11:39.399 --> 00:11:41.200 I'd be pretty pretty upset. 234 00:11:41.320 --> 00:11:42.840 And I wouldn't want them to tell me what the 235 00:11:42.879 --> 00:11:43.240 new past. 236 00:11:43.240 --> 00:11:45.759 I mean, I would probably email. I would probably reply 237 00:11:45.840 --> 00:11:47.960 to him and say, well I changed your adminis yes, 238 00:11:48.039 --> 00:11:48.360 you would. 239 00:11:48.799 --> 00:11:51.679 So this is an old Dilbert. There is an old 240 00:11:52.080 --> 00:11:54.360 old Dilbert where he's talking to his mother. I don't 241 00:11:54.360 --> 00:11:57.000 know if you guys remember Dilbert. And he's talking to 242 00:11:57.039 --> 00:11:58.360 his mother and she's like, well, you know, I was 243 00:11:58.399 --> 00:12:01.600 looking at your emails. And he's like, I've got a firewall, 244 00:12:01.799 --> 00:12:03.720 but you know, tweet to keep you out of my email. 245 00:12:03.799 --> 00:12:07.000 She says, not much of a firewall. And so I 246 00:12:07.039 --> 00:12:09.159 think that's the answer the FBI would have is like, 247 00:12:09.320 --> 00:12:11.879 you know, if you have a good firewall, then I'll 248 00:12:11.919 --> 00:12:12.960 respect you. Otherwise. 249 00:12:13.320 --> 00:12:16.919 No, I like the reciprocal thinking tween half there just 250 00:12:17.120 --> 00:12:18.720 a minute ago. You know. It's kind of like when 251 00:12:18.759 --> 00:12:21.559 you go to McDonald's or something in your order and 252 00:12:21.559 --> 00:12:24.000 they say you want to round up, I say, how 253 00:12:24.000 --> 00:12:25.000 about you round down? 254 00:12:26.360 --> 00:12:26.879 Exactly? 255 00:12:29.720 --> 00:12:30.240 Round down? 256 00:12:34.320 --> 00:12:38.399 All right, let's move on. So this is a Windows exploit. 257 00:12:39.039 --> 00:12:44.200 The researcher released Windows Defenders zero day exploit code, allowing 258 00:12:44.240 --> 00:12:46.799 attackers to gain full access. And this is one of 259 00:12:46.840 --> 00:12:49.720 those things where somebody tried to do the right thing 260 00:12:49.759 --> 00:12:53.679 by contacting Microsoft and they were like, eh. 261 00:12:53.080 --> 00:12:56.039 Right, yeah, yeah, absolutely, we don't want to hear it. Yeah, 262 00:12:56.039 --> 00:12:59.080 and I mean will listen. Sometimes we we poo poop 263 00:12:59.279 --> 00:13:01.120 on you know, local privileged escalation. 264 00:13:01.200 --> 00:13:02.080 That's what this is is. 265 00:13:02.120 --> 00:13:04.679 Alkay, Yeah, you have to be on the That's not 266 00:13:04.759 --> 00:13:06.600 the point of this story, right, because you have to 267 00:13:06.639 --> 00:13:08.200 be on the box and it lowers the risk and 268 00:13:08.200 --> 00:13:09.879 blah blah blah. But there are so many ways to 269 00:13:09.919 --> 00:13:12.799 get somebody to click on things. You know, this can 270 00:13:12.919 --> 00:13:16.679 still be pretty dangerous, right, And if you're Microsoft, like 271 00:13:16.720 --> 00:13:18.720 if your security this week, yeah, we're worried about the 272 00:13:18.759 --> 00:13:21.559 remote code executions, the big things. But if you're Microsoft, 273 00:13:21.559 --> 00:13:23.799 you got to take this thing seriously, you'd think. And 274 00:13:24.200 --> 00:13:27.480 it sounds like it was just a host of problems 275 00:13:27.559 --> 00:13:32.960 trying to get Microsoft to not only respond but actually 276 00:13:33.120 --> 00:13:37.679 competently engage with the researcher. And then their response was, well, 277 00:13:37.720 --> 00:13:39.600 the onus is on you. Why don't you give us videos, 278 00:13:39.600 --> 00:13:41.000 Why don't you do this, why don't you do that? 279 00:13:41.120 --> 00:13:43.799 And then they stop responding again, and the researcher was like, 280 00:13:43.799 --> 00:13:45.399 you know what, let's see how important this is when 281 00:13:45.399 --> 00:13:48.600 I drop it on the internet. And that's what happened here, right. 282 00:13:48.639 --> 00:13:50.960 The researcher was like, you know what, you know, mic 283 00:13:51.039 --> 00:13:51.799 drop good luck. 284 00:13:51.919 --> 00:13:56.480 So I wondered why Patch Tuesday was really long yesterday 285 00:13:56.799 --> 00:13:59.039 or extended into Wednesday? 286 00:13:59.279 --> 00:14:02.879 Yeah, exactly, it took a long time. Patch Wednesday and 287 00:14:03.080 --> 00:14:03.919 patch Thursday. 288 00:14:04.120 --> 00:14:06.360 This is unpatched. Does I is it still unpatched? 289 00:14:07.039 --> 00:14:08.440 Well that's a good question. I don't know. 290 00:14:08.480 --> 00:14:11.039 It must be because this just came out yesterday and 291 00:14:11.320 --> 00:14:11.879 was Patch. 292 00:14:11.679 --> 00:14:16.600 Tuesday until Microsoft. Oh oh wait when did this article 293 00:14:16.639 --> 00:14:19.360 come out? This came out yesterday. This is unpatched. 294 00:14:19.600 --> 00:14:21.240 Yeah, wait a minute, Dwayne has to go. 295 00:14:21.240 --> 00:14:25.440 Somewhere yet until Microsoft issues an official will be right back. 296 00:14:26.360 --> 00:14:31.559 Uh yeah, one moment, guys, I got a couple FB 297 00:14:31.759 --> 00:14:33.240 FBI passwords to change. 298 00:14:34.200 --> 00:14:34.960 Give me a second. 299 00:14:35.320 --> 00:14:36.039 Oh man. 300 00:14:37.039 --> 00:14:40.720 Yeah, So needless to say, be extra careful what you 301 00:14:40.799 --> 00:14:45.080 click on until you know, until until there's a patch 302 00:14:45.120 --> 00:14:45.480 coming out. 303 00:14:45.480 --> 00:14:46.919 All right, this seems like a good place to take 304 00:14:46.960 --> 00:14:48.919 a break. So we'll be right back after these very 305 00:14:48.919 --> 00:14:55.919 important messages, and we're back. It's security this week. I'm Carl, 306 00:14:56.000 --> 00:14:59.200 That's Doyne, that's Patrick, and we were just about to 307 00:14:59.240 --> 00:15:03.919 talk about our one of our favorite return customers, fording 308 00:15:04.000 --> 00:15:09.279 Net forting net customers confront actively exploited zero day with 309 00:15:09.360 --> 00:15:12.399 a full patch still pending. Now this is about two 310 00:15:12.480 --> 00:15:16.759 critical defects in forte client EMS. So, as you know, 311 00:15:16.840 --> 00:15:20.080 forty net has a lot of different products, and their 312 00:15:20.159 --> 00:15:21.279 EMS is just one. 313 00:15:22.240 --> 00:15:25.879 We talked about this off off Mike earlier. I wonder 314 00:15:25.919 --> 00:15:29.559 whether because Fortinet was a really good firewall company back 315 00:15:29.600 --> 00:15:31.240 in the day, when they first came out, they were 316 00:15:31.240 --> 00:15:33.279 forward thinking, they were kind of like the go to 317 00:15:34.080 --> 00:15:37.120 and then we see all these I wonder if they've 318 00:15:37.120 --> 00:15:41.960 grown through acquisition or whether they had just stepped outside 319 00:15:42.000 --> 00:15:44.919 their depth and they're doing things that I think, if 320 00:15:45.200 --> 00:15:47.440 I had to guess, it would be the acquisition phase 321 00:15:47.480 --> 00:15:50.279 and they bought products and they put their brand on it, 322 00:15:50.360 --> 00:15:52.759 and they didn't rebuild the products, you know, to make 323 00:15:52.799 --> 00:15:54.639 sure that this stuff isn't in there. I hope that's 324 00:15:54.639 --> 00:15:59.200 what it is. We don't see problems with their firewalls as. 325 00:15:59.159 --> 00:16:02.000 Often, right because that was their expertise. 326 00:16:02.159 --> 00:16:02.559 I hope. 327 00:16:02.679 --> 00:16:03.279 Yeah. 328 00:16:03.399 --> 00:16:05.840 And I think you I think you start to see 329 00:16:05.840 --> 00:16:07.639 a lot of these companies and they start to grab 330 00:16:07.720 --> 00:16:10.600 the try and grab more of the market share. Right, 331 00:16:11.159 --> 00:16:13.279 So if it's like, oh, well, you know, you just 332 00:16:13.320 --> 00:16:15.639 have a firewall, well I also need you know, a 333 00:16:15.759 --> 00:16:18.120 VPN condenser, and I also need this, and I also 334 00:16:18.240 --> 00:16:20.519 need that, and they go, well, we can't answer those solutions, 335 00:16:20.559 --> 00:16:22.639 and then they're going to end up going to Cisco, right, 336 00:16:22.679 --> 00:16:23.759 who has all those things. 337 00:16:24.080 --> 00:16:27.320 So there's the most interesting paragraph in this articles. While 338 00:16:27.320 --> 00:16:31.159 there is no full patch for this, CVE Harris, who 339 00:16:31.240 --> 00:16:34.320 did the who was part of the article, credited Fortinet 340 00:16:34.360 --> 00:16:36.879 for rushing out a hot fix over a holiday weekend, 341 00:16:37.559 --> 00:16:40.159 adding that it reflects how urgently the company is treating 342 00:16:40.200 --> 00:16:43.240 this matter. So this this article is written on the sixth, 343 00:16:43.840 --> 00:16:47.639 so that was two days ago from this recording. Hopefully 344 00:16:47.840 --> 00:16:49.320 you know, at least there's a hot fix. 345 00:16:49.679 --> 00:16:53.720 Yeah, yeah, and my Fortinet's usually pretty good about releasing those. 346 00:16:53.879 --> 00:16:57.039 The other thing about Fortinet though, is typically, obviously you 347 00:16:57.120 --> 00:16:59.759 have to be under support with them to get the patches. 348 00:17:01.039 --> 00:17:03.480 When we were a ford Net customer, which is it 349 00:17:03.519 --> 00:17:05.519 we haven't been for a long time, but when we were, 350 00:17:06.640 --> 00:17:09.440 there weren't publicly available patches. It was you know, Oh, 351 00:17:09.480 --> 00:17:11.880 if you're paying for the Ford and Net support service, 352 00:17:11.920 --> 00:17:14.119 you can patch. But if not, you know, at pounds. 353 00:17:14.480 --> 00:17:18.200 I think that's a little crappy. Yeah, I don't like that. Yeah, 354 00:17:18.400 --> 00:17:19.319 it's our bug. 355 00:17:19.559 --> 00:17:19.759 Yeah. 356 00:17:19.799 --> 00:17:21.960 I think if somebody bought your device at some point, 357 00:17:22.160 --> 00:17:25.640 you should always be able to patch it and you know, 358 00:17:25.720 --> 00:17:26.519 update that device. 359 00:17:26.559 --> 00:17:26.680 Now. 360 00:17:26.720 --> 00:17:30.160 You can as an organization determine whether you want to 361 00:17:30.240 --> 00:17:34.079 support that patch in the future, but that's a you know, 362 00:17:34.160 --> 00:17:36.480 if you have one hundred thousand active subscribers and you 363 00:17:36.559 --> 00:17:38.880 create the patch, then it should be available for everybody, 364 00:17:39.000 --> 00:17:40.759 not just those hundred thousand subscribers. 365 00:17:40.799 --> 00:17:43.200 And really, what does it cost for the net to 366 00:17:43.359 --> 00:17:45.079 release it to everybody? Nothing? 367 00:17:45.200 --> 00:17:47.279 Right, nothing, yep, absolutely, it's. 368 00:17:47.079 --> 00:17:48.680 Just sense of pennies of bandwidth. 369 00:17:48.759 --> 00:17:51.319 I mean, they'll they'll get less subscriptions, but that's that's 370 00:17:51.359 --> 00:17:54.319 their profit model. And a lot of people hate that model. 371 00:17:54.559 --> 00:17:56.880 And I think like Broadcom is in that space too, right, 372 00:17:57.359 --> 00:17:59.720 So yeah, you know, people are not fans of that, 373 00:17:59.799 --> 00:18:04.079 and you don't you build, you build revenue, but you 374 00:18:04.119 --> 00:18:05.799 build a bad reputation. 375 00:18:05.519 --> 00:18:09.160 All right, And speaking of bad news, hackers exploit react 376 00:18:09.200 --> 00:18:14.240 to shell vulnerability in next dot js breach seven hundred 377 00:18:14.359 --> 00:18:18.559 and sixty six servers and steal sensitive credentials. 378 00:18:18.599 --> 00:18:20.119 Who could have predicted such a thing. 379 00:18:20.480 --> 00:18:23.400 I'll tell you it's just us on December seventh and 380 00:18:23.519 --> 00:18:28.519 twenty twenty five, US on February twelfth in twenty twenty six, 381 00:18:29.160 --> 00:18:32.680 and us talking about it April eighth, you know, in 382 00:18:33.000 --> 00:18:36.839 twenty twenty six. So, needless to say, we've talked about 383 00:18:36.920 --> 00:18:40.359 this multiple times. We talked about it when it came out, 384 00:18:40.440 --> 00:18:43.200 we talked about it when it started to surge. So 385 00:18:43.319 --> 00:18:46.119 if you're still having react to SHELL issues, it's. 386 00:18:45.839 --> 00:18:50.359 And I should add this podcast is free. We do 387 00:18:50.480 --> 00:18:51.240 not charge. 388 00:18:51.599 --> 00:18:54.839 We were confirmation it totally free to those with a subscription. 389 00:18:54.920 --> 00:18:58.359 I thought all you have to do is listen and act. 390 00:18:59.279 --> 00:19:00.519 Yeah. 391 00:19:00.559 --> 00:19:03.960 So yeah, I mean, we've talked about this plenty of times, 392 00:19:04.400 --> 00:19:07.200 but it's actively being exploited. And honestly, even the router, 393 00:19:07.400 --> 00:19:10.599 the story we had on the Russian exploitation of routers, 394 00:19:10.599 --> 00:19:12.359 a lot of those are older exploits too. We have 395 00:19:12.640 --> 00:19:15.480 also talked about on this show months and months and 396 00:19:15.480 --> 00:19:17.480 months ago. It's just now they're starting to research. 397 00:19:17.559 --> 00:19:19.400 So I would drop my mic, but the stand is 398 00:19:19.480 --> 00:19:22.480 very heavy. 399 00:19:22.640 --> 00:19:27.960 You might break your foot. Oh yeah, so I mean, 400 00:19:28.000 --> 00:19:29.880 do we want to talk about the attack itself. 401 00:19:30.480 --> 00:19:31.559