Speaker 1: Hey Carl here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes,
Speaker 1: Spotify or wherever you get Security this week. Also, you
Speaker 1: can get an ad free feed by becoming a five
Speaker 1: dollars a month patron. Go to Patreon dot Security this
Speaker 1: week dot com and sign up, and don't forget discord
Speaker 1: Discord dot Security this week dot com. Lots of good
Speaker 1: stuff happening there. Yeah, I think that's it. So on
Speaker 1: with the podcast. Have you guys seen any concerts lately?
Speaker 2: No, no live concerts. You know, Elvis, Costello and Abba
Speaker 2: are turning together this year. It's a strange combo, but
Speaker 2: they have a figured out who'll be the headliner. So
Speaker 2: watch for Abba and Costello to find out who's on first.
Speaker 3: Yeah, right, Well, welcome to Security this week.
Speaker 4: I'm Carl.
Speaker 2: That's Patrick and Twain.
Speaker 5: No sooner had we talked about fable five last week,
Speaker 5: like as soon as it dropped anthropic disabled access to
Speaker 5: it to comply with and mythos five to comply with
Speaker 5: government directed.
Speaker 6: As soon as it dropped it dropped.
Speaker 2: So the government basically said this stuff even you know Fable,
Speaker 2: which is the consumer facing version of Mythos, it's too
Speaker 2: it's too sensitive. You can't Is that the best advertising ever? Yeah?
Speaker 4: Oh my god, yes, it's too good. It's so powerful
Speaker 4: you got to pull it down.
Speaker 2: They were worried about foreign governments getting access to it,
Speaker 2: but they just they had to disable it for everybody.
Speaker 4: I don't know.
Speaker 6: I honestly, maybe I'm maybe I'm becoming conspiracy theorist. I
Speaker 6: think they just don't like anthropic. Well that's true, and
Speaker 6: they're doing everything they can to just mess with them.
Speaker 6: But it's backfiring.
Speaker 4: Oh yeah, everybody wants this model now. It's funny. One
Speaker 4: of our listeners, Waldo, had posted this. It was like Duayane,
Speaker 4: lots of timing of releasing the podcast is cursed Fable.
Speaker 4: Fable has now been pulled. Blah blah blah blah blah.
Speaker 4: So good, good call there, Waldo. We're going to start
Speaker 4: doing maybe a live stream all the time.
Speaker 6: Don't promise what we can't deliver.
Speaker 4: I know people will jump on this. No, So what's
Speaker 4: what's even crazier is the directive was don't allow foreign
Speaker 4: nationals access, including foreign nationals that work for Anthropic and
Speaker 4: foreign nationals that live in the United States. So they
Speaker 4: were like, it's like you ever just turn it off?
Speaker 6: So you got two Chads and a Steve working a
Speaker 6: throp it, They're like, I don't know, you should talk
Speaker 6: to friends who did this?
Speaker 4: Who do we deny access to this?
Speaker 2: You gotta talk to Steve.
Speaker 6: So predictions when do you think it'll come back.
Speaker 2: After Trump leave's office?
Speaker 6: Oh wow, that's.
Speaker 4: So.
Speaker 6: What I think is more likely is that they're going
Speaker 6: to build another model, the next model, and they're not
Speaker 6: going to trumpet these kinds of.
Speaker 4: As the cybersecurity offensive killing and they're just going to
Speaker 4: release a new one and it'll be better than fable
Speaker 4: and it'll circumvent it because they'll they basically fed the
Speaker 4: government the tools necessary to demise Well.
Speaker 2: You know what, though, I mean, the news is pretty
Speaker 2: smart about picking up on how powerful these things are.
Speaker 2: So if they do that, then you know the word's
Speaker 2: going to get around that they did.
Speaker 6: Well, there's also one hundred cybersecurity executives who've written a
Speaker 6: letter that said that this is actually making the US
Speaker 6: weaker because it's taking away a tool that they were
Speaker 6: using actively to find vulnerabilities and fix them exactly.
Speaker 2: Yeah, and that's concerning.
Speaker 6: And does this kill Project Last Wing? I didn't think
Speaker 6: about that. Does this mean the Project glass Wing is
Speaker 6: on hold because you have foreign nationals even working for
Speaker 6: the US government.
Speaker 4: Ah, that's a great question. I don't know.
Speaker 6: I don't know the answer to that.
Speaker 4: Yeah, I don't know. I mean, I don't know it does.
Speaker 4: And so chatch ept there was what was it, GPT
Speaker 4: five to four cyber was out there. I'm sure you
Speaker 4: know Grock has some offensive cybery capabilities, Like is this
Speaker 4: universal where they're like, hey, you know what, everybody needs
Speaker 4: to stop releasing these models that can attack well, you know, software,
Speaker 4: or is it only anthropic where they're like, dude, yours
Speaker 4: is so good. You can't dude, leave it to these
Speaker 4: damn democrats to regulately.
Speaker 2: Oh wait a minute, So tune in next week when
Speaker 2: we will announce that Claude Sonnet is going away.
Speaker 6: On that it will be replaced by Quinn.
Speaker 2: Yeah, Quenn exactly. All right, So this one is funny.
Speaker 2: Nottingham University says student records rated after Shiny Hunters claimed
Speaker 2: cyber attack. Says the sheriff of Noddingham.
Speaker 6: Oh no, Well, who'd you think would announce it? Made
Speaker 6: Marion right?
Speaker 2: Well, I thought maybe that the hackers would be called
Speaker 2: Robin Hood, because yeah.
Speaker 4: The Shiny Hunters have been busy. Huh Yeah, it's like
Speaker 4: every week we've had we've had a story with Shiny Hunters.
Speaker 6: They have access to fable.
Speaker 4: So what happened maybe I don't know. So there's not
Speaker 4: a lot of detail that forensics are still ongoing. The
Speaker 4: only details we do have is a there was a
Speaker 4: there was a chunk of data that was actually I
Speaker 4: think it was a ten gig ten gig data set
Speaker 4: that was released to Have I Been Pooned? Okay, So
Speaker 4: for those of you, I know, I don't think we've
Speaker 4: talked about. Is Troy even there anymore? Does anybody know?
Speaker 1: Yeah?
Speaker 6: I think it's still his.
Speaker 2: He's got to be at least a figurehead. I don't know.
Speaker 4: Yeah, I don't know. I know. I know at one
Speaker 4: point there was some big cybersecurity conglomerate that took it over, but.
Speaker 6: I think he's still involved.
Speaker 4: Okay. Have I Been Pooned is a site that keeps
Speaker 4: track of your information in data breaches, whether it's emails
Speaker 4: and passwords, so if you go there and actually type
Speaker 4: in your email address, and I know this sounds like
Speaker 4: terrible advice, right, like, Hey, go to this site Have
Speaker 4: I Been Pooned? And type in your most current password
Speaker 4: and see if it's been breached. Like you can do that,
Speaker 4: and most people be like, I'm not putting my password
Speaker 4: in this site. That's insane. However, I can tell you
Speaker 4: from a cybersecurity standpoint, the way that the exchange of
Speaker 4: data happens. Even Have I Been Pooned doesn't know which
Speaker 4: password you typed in?
Speaker 6: Well, but don't don't. They have have mechanism where you
Speaker 6: can just give them your email and then email that
Speaker 6: email yep, the list of credentials that are exposed.
Speaker 4: Yeah, and they won't give you full credentials or anything
Speaker 4: like that. But if you were curious about a password,
Speaker 4: you could type in a password as well. And even,
Speaker 4: like I said, even Have I Been Poned doesn't know
Speaker 4: what password you typed in because the algorithm they actually
Speaker 4: take your passwords, seed it in with a bunch of
Speaker 4: other passwords and then check.
Speaker 6: So the overlap, just FYI, the overlap between our database
Speaker 6: and their database and the database of all the hacking
Speaker 6: syndicates and all the government, and you know, it's a
Speaker 6: ninety five overlap. We might have passwords they don't have.
Speaker 6: They might have passwords we don't have. So it's not
Speaker 6: like it's this is the only source.
Speaker 4: No.
Speaker 6: No, this is a good source that's being used for good.
Speaker 6: There's lots of other bad sources that are being used
Speaker 6: for bad, and then there's us in the middle.
Speaker 2: Speaking of you, guys, I mentioned you on Coded with AI.
Speaker 2: We were talking about Microsoft's new AI models. Yep, and
Speaker 2: they run on Foundry and Azure. But they're also going
Speaker 2: to be running they're going to allow you to run
Speaker 2: them locally. Oh on Foundry local and the code model
Speaker 2: for example, it's different because it will go it will
Speaker 2: start with the NPU and if that's not there, you
Speaker 2: go to the GPU and when that runs out of
Speaker 2: steamily use the CPU. Wow. So they're claiming that it's
Speaker 2: faster than like everything out there. The reason that I
Speaker 2: mentioned you is because we were talking about my big
Speaker 2: Olama machine and I said, you know, compared to what
Speaker 2: Patrick and Dwayne run, this is a gaming laptop. Yeah,
Speaker 2: we may have a pretty bit.
Speaker 6: Weird looking at the next generation of hardware. Oh yeah, yeah,
Speaker 6: I know, And unfortunately the next generation is is a
Speaker 6: six figure right yeah.
Speaker 4: Yeah, when you start looking at the really big Grace
Speaker 4: Blackwell chips like, yeah, those things outpace man. Yea, they're
Speaker 4: doing awesome.
Speaker 6: So do you know how much memory you need from
Speaker 6: those systems? Because one of the things about LM Studio
Speaker 6: that kind of broke it is if you wanted to
Speaker 6: run a big model, you need a system that was
Speaker 6: not you know, you couldn't run on a laptop anymore.
Speaker 4: Okay, so good, good question. So right now, one of
Speaker 4: the most sort of commodity ways for you to run
Speaker 4: these would be on a GB ten, which is and
Speaker 4: they're ace Who's has the Dell has them, and video
Speaker 4: has them whatever. There's these tiny little you know, nuxt
Speaker 4: boxes that.
Speaker 6: Yeah, but they're even those are about five thousand.
Speaker 4: Dollars, right, I say, come on, I mean cheap, like
Speaker 4: you might as well pick.
Speaker 6: Up a copy. Okay, diamond case, Scrooge McDuck.
Speaker 2: I got mine for six grand online. It's got ninety
Speaker 2: six gigs of RAM, It's got thirty two gigs of
Speaker 2: v RAM. Yeah nice, it does not have an NPU.
Speaker 6: But in the good old days of hugging face when
Speaker 6: no one knew what the hell that was. You could
Speaker 6: run a state of the art model basically on a laptop,
Speaker 6: but now we've eclipsed that. So I'm wondering whether.
Speaker 4: Yeah, well, the front yeah, the frontier models or not
Speaker 4: are never going to be run locally. They're just they're
Speaker 4: too big. But you can take a really good, reasonably
Speaker 4: a three hundred and thirty billion parameter model which is
Speaker 4: awesome and sizable, and you can throw it on a
Speaker 4: cluster of you know, four GB tens with a InfiniBand
Speaker 4: connection between them, and it'll run reasonably well.
Speaker 6: And that's within the limits of most companies, little tech shops.
Speaker 6: Oh yeah it's not, but not the average listener.
Speaker 4: Fifteen grand. You can get fifteen twenty grand, Yeah, four nodes,
Speaker 4: an infinite band switch and run it.
Speaker 6: I was talking to a guy yesterday who was stressing
Speaker 6: out about six dollars, you know, because of one request
Speaker 6: from you know.
Speaker 4: But if you well, hold on, if you look at
Speaker 4: fifteen grand to run your own like GB ten infinite
Speaker 4: band cluster, or you look at one month of tokens,
Speaker 4: I mean it's about the same.
Speaker 2: At this point, it's like about the same. Yeah, yeah,
Speaker 2: yeah it can and the corporation, it could be, and
Speaker 2: that fifteen grand is a one time purchase. You don't
Speaker 2: pay for tokens after that. Yeah, run it, run it. Yeah, absolutely,
Speaker 2: So that's where the future is going. I was convinced
Speaker 2: to that months ago. All right, So Nottingham University, do
Speaker 2: we finish this story?
Speaker 4: So, needless to say, Nottingham has had all sorts of issues.
Speaker 4: There's another they said, the attack could hardly have come
Speaker 4: at the worst time for Nottingham, which is embroiled in
Speaker 4: a dispute with staff, confirming hundreds of redundancies over the
Speaker 4: next three years. So not only is it they're they're
Speaker 4: fighting with their own staff, they're downsizing, and their staff
Speaker 4: has decided not to mark final grades wow as in retaliation,
Speaker 4: which means the students are kind of in trouble there,
Speaker 4: and they're they're planning on if they don't resolve the
Speaker 4: issue with the staff, they're just gonna guess what the
Speaker 4: students get for grades.
Speaker 5: Wow.
Speaker 4: They're just gonna take their old grades and see what
Speaker 4: the trend line looks like and give them that.
Speaker 6: Wow jackpot if you just start slacking off, no, right.
Speaker 4: And then unfortunately then they also got hit with this
Speaker 4: data breach. So they're they're in, they're a world of hurt.
Speaker 4: So this data breach could include names, addresses, phone numbers, ethnicities, disabilities,
Speaker 4: passport numbers, and information related to academic enrollment and fee payment.
Speaker 4: So according to have ivanponed.
Speaker 2: Wow, yikes.
Speaker 4: Yeah, they say they've notified all the people who were involved,
Speaker 4: but that's four hundred and fifty thousand people, including alumni.
Speaker 4: So I don't know if that's true or not.
Speaker 6: But you're not an alumni of Nottingham University.
Speaker 4: I am not.
Speaker 2: No, all right, So we have two stories about that.
Speaker 2: The next one is the same story. University of Nottingham
Speaker 2: conference preach Chapter Hackers League data. So let's get that
Speaker 2: out and let's move on.
Speaker 4: Love it.
Speaker 2: Okay, Junior hacker used tail scale in open ssh to
Speaker 2: keep access after his seat two went offline.
Speaker 6: So I thought this was interesting for a couple of reasons.
Speaker 6: The first is we're we're talking about AI aii. You
Speaker 6: have to actually know what you're doing to do sophisticated
Speaker 6: things here. You know, could you point at an app
Speaker 6: and say, hey, I want you to develop something, But
Speaker 6: then you've got to still do all the jumps of
Speaker 6: getting getting there, understanding how to use the shell building.
Speaker 6: Like half the time when I talk to my AI,
Speaker 6: it's telling me to do stuff right, And a lot
Speaker 6: of times I'm like, no, you work for me, and
Speaker 6: it's still like yeah, but I can't I get these
Speaker 6: little arms, this little tea, yeah, and I can't reach,
Speaker 6: so so I have I end up work doing the
Speaker 6: bidding of the AI. You got to know something, or
Speaker 6: it takes forever, Like if you don't know permissions or
Speaker 6: file access firewall rules, it takes it'll take forever for
Speaker 6: the AI to walk you through.
Speaker 2: And probably will not end up correct exactly.
Speaker 6: Yeah, so there's still a skill here. And this is
Speaker 6: a kid I did. I don't know if they said
Speaker 6: the age.
Speaker 4: So this kid has not been found yet, but they're
Speaker 4: speculating he's a junior hacker. Speculating it's a kid or she. Yeah,
Speaker 4: because they're speculating because of the hours of operation.
Speaker 6: Oh I thought they just used slating. No one understood.
Speaker 4: Oh no, it's like three pm in the afternoon.
Speaker 2: Yeah, three pm when they get home from school.
Speaker 4: Then like it lights up, and then occasionally the kid
Speaker 4: stays up for five hours at night, you know, doing
Speaker 4: hacky hacky things. But then goes dark at like seven
Speaker 4: am to like three in the afternoon. Wow.
Speaker 6: And when demon Hunters cape up, Demon Hunters is on,
Speaker 6: it's they're never lacking.
Speaker 4: Right exactly, So it is interesting. So this is they
Speaker 4: they assume, well they know just from forensics. This is
Speaker 4: a French speaking actor broke into a small French automotive business,
Speaker 4: so very local.
Speaker 6: Wait a minute, Dwayne knows some French.
Speaker 4: It depends on who you ask. You ask French speaking people.
Speaker 4: Dwayne knows no French, want them to.
Speaker 2: Think you might have misunderstood when he says, excuse my
Speaker 2: French all the time?
Speaker 4: Yeah, exactly.
Speaker 2: I don't think that's differentially French.
Speaker 6: Okay, So a.
Speaker 4: French speaking we're going to assume child minor broke into
Speaker 4: a French automotive business planting a key lagger. And I
Speaker 4: love how if you read through this, it's like, yeah,
Speaker 4: planted a keylogger and a C two S command of
Speaker 4: control communicating back to a Havoc server. Havoc is very
Speaker 4: well known as a gaming server. So if you want
Speaker 4: to run a Minecraft server on the Internet, you just
Speaker 4: go to Havoc and you you wreak set up. You
Speaker 4: click I have it. You click I want to I
Speaker 4: want a Minecraft server. Right, so they're more known for
Speaker 4: their game servers, not necessarily their C two's I guess.
Speaker 6: But when it went down, they maintain persistence.
Speaker 4: Yeah, so when it went down, this this kid, although
Speaker 4: it is funny and here they say his op sec
Speaker 4: is absolutely terrible, but this what he did is he
Speaker 4: actually installed Tailscale. Tailscale is a mesh network. So what
Speaker 4: it allows is my home computer. If I install tail
Speaker 4: Scale on my home computer and installed installed Tailscale at
Speaker 4: the attacked site, it looks like the two computers are
Speaker 4: on the same network. So now I can just play
Speaker 4: at home. It'd be just like trying to reach to
Speaker 4: a computer that's sitting on my network. I can do
Speaker 4: it over this encrypted tail Scale. So okay, installed tail Scale.
Speaker 4: Kid probably used to using it to game with his
Speaker 4: buddies or her buddies. Right where they install all tailscale
Speaker 4: and they run a local game so and then just
Speaker 4: have a land party basically right, and having points that
Speaker 4: this is also a game server company that sure you
Speaker 4: can install other software on.
Speaker 3: It.
Speaker 4: Is they also kind of rail on this kid, saying
Speaker 4: like fifty or seventy five percent of the commands. This
Speaker 4: kid typed We're like, not right, because he was key
Speaker 4: logging himself while typing as well. Unfortunately, so yet geez,
Speaker 4: just a lot of things that you can tell this
Speaker 4: isn't a seasoned operator, and it's not because of Tailscapan.
Speaker 4: There are operators that have used tail scale, right, APT
Speaker 4: thirty one has used tailscale in twenty twenty four and
Speaker 4: twenty twenty five. Scattered Spiders used tailscale, Like tailscale has
Speaker 4: been used in a lot of operations. Just you could
Speaker 4: tell this person's not a seasoned operator, right, let's put
Speaker 4: it that way.
Speaker 2: Okay, Well, this seems like a good time to take
Speaker 2: a break, so we'll be right back after these very
Speaker 2: important messages. Don't you go away, and we're back. It's
Speaker 2: security this week. I'm Carls Dwayne. That's Patrick, And before
Speaker 2: we talk about the next story, I got a little
Speaker 2: story for you. I'm actually on vacation. I'm in a
Speaker 2: hotel room and with my wife.
Speaker 4: Well, thank you for joining, Thank you for your service, Carl.
Speaker 2: Yeah, of course. So I'm at this hotel and I
Speaker 2: have with me a T mobile Mai Fi device nice,
Speaker 2: which I love because just about everywhere I use it,
Speaker 2: I get like two hundred and fifty megabits down, whereas
Speaker 2: Hotel Wi Fi, I'm lucky if I get twenty, you know, yep.
Speaker 2: And so it's been fine going through this whole thing.
Speaker 2: We finally get to this hotel in New Jersey because
Speaker 2: Kelly's visiting one of her friends from high school, and
Speaker 2: I'm at this little in this little town. The Mai
Speaker 2: Fi device is registering like point four megabits. I get
Speaker 2: like one bar of five G and my phone's getting lte.
Speaker 2: I can't use my phone, so I accept the like,
Speaker 2: I go on to the Hotel Wi Fi, which I
Speaker 2: never do, and I accept the free version. There's a
Speaker 2: free version then five dollars a day, and I just
Speaker 2: accept the free version. The free version gives me, oh,
Speaker 2: three megabits.
Speaker 6: Oooh. I mean that's a lot more than you are getting.
Speaker 2: It's a lot more than I'm getting. But then I'm like,
Speaker 2: you know what, I need to go back and register
Speaker 2: for the five dollars a day and see if that works.
Speaker 2: So I pull up my phone because it's a different device, right,
Speaker 2: and I log in to the five dollars a day. Boom,
Speaker 2: two hundred and fifty megabits. Yes, wow, Now how do
Speaker 2: I get that on my laptop, because my laptop is
Speaker 2: already logged in. Every time I connect to the Wi
Speaker 2: Fi network, it's pegged me at the lower rate. So
Speaker 2: I figured it out. You go to settings in Windows
Speaker 2: eleven and you go to network settings, and you go
Speaker 2: to Wi Fi and Underwi Fi there's this thing to
Speaker 2: randomize your Mac address. Duayne's laughing. You basically turn that
Speaker 2: on and WiFi thinks, oh, this is a new computer.
Speaker 2: So you log off the network, you log back on,
Speaker 2: and it brings you to that the you know, reconnect
Speaker 2: with your browser thing, and you get to selected against
Speaker 2: book A two hundred and fifty Mega.
Speaker 4: But all right, here's what else I'll tell you, Carl. Yeah,
Speaker 4: so let's say somebody else in the hotel paid for
Speaker 4: five dollars WiFi. You could throw up an air listener
Speaker 4: see their Mac address so evil, Then d off them
Speaker 4: off the Wi Fi and make your macaddress look like theirs,
Speaker 4: and when you connect, you get.
Speaker 2: The five dollars Wi Fi.
Speaker 6: Well, they get screwed and they get offline. Dwayne.
Speaker 2: If I go down to Starbucks and get a latte,
Speaker 2: I've spent five dollars, so I'm not worried about the
Speaker 2: five dollars. I was more worried that I couldn't actually
Speaker 2: use the Internet while I was here.
Speaker 4: But I'm just saying, if that's something you were looking
Speaker 4: to do at some point, I just.
Speaker 2: Well, you know, I wouldn't know how to do that.
Speaker 2: You do, you know how to fool that, But in
Speaker 2: the Windows settings, it's just a switch. It's either on
Speaker 2: or off, and you get a random Mac address, So
Speaker 2: I don't know how to provide a real Mac address to.
Speaker 6: You know, Carl does something wholesome and useful and Dwayne
Speaker 6: turns it into.
Speaker 2: Dwayne's Like, Carl, you know, you have so much to learn.
Speaker 4: Twains like called the free found I found a straight
Speaker 4: kitten and I saved it in Dwayne's Like, you know,
Speaker 4: you make a really good shake out of them.
Speaker 2: Yeah. Yeah, you can make some nice gloves, all right.
Speaker 2: So a couple more stories here. Uh. Cybersecurity Dives says
Speaker 2: Nation state rivals linked to majority of consequential attacks targeting
Speaker 2: critical UK sites.
Speaker 6: Yeah, this is this is a more of a when
Speaker 6: when we talk about infrastructure, you know, Internet, industrial control systems.
Speaker 6: I see s there's a there's a misnomer out there
Speaker 6: that it's just like random hackers trying to cause mayhem,
Speaker 6: and it's not this. This shows that it's governments, and
Speaker 6: that makes a lot of sense because you know it's
Speaker 6: Russia and China. Russia drag anchors to destroy network and
Speaker 6: phone cables. That's just malicious. They they I think it's
Speaker 6: stupid for them to do it. And I also think
Speaker 6: it's stupid for government actors to to to reveal their
Speaker 6: techniques when there's not an active war going on, because
Speaker 6: all you're doing is hardening your enemy. And what's happening
Speaker 6: here is we're seeing that it's the governments that are
Speaker 6: hacking each other and seeing, well, can we get into
Speaker 6: this system? Can we get into that system? But most
Speaker 6: of the time they're too noisy and they get caught.
Speaker 6: And again, I'm going to go back to my thesis,
Speaker 6: which is I think that all governments are hacking each
Speaker 6: other all the time. What and the ones we hear
Speaker 6: about just kind of suck at it, right, And the
Speaker 6: ones we never hear about, like the United States, they're
Speaker 6: actually pretty good at it.
Speaker 4: They know what they're doing.
Speaker 6: The Dwane knows a lot about the concept of noisiness, like,
Speaker 6: you know, you might you might risk losing your foothold
Speaker 6: so that you don't get discovered.
Speaker 2: Yep, Dwayne, why are you doing this podcast because you're
Speaker 2: always letting trade secrets out of the bag and giving
Speaker 2: people career criminal career.
Speaker 4: Advice, criminal career advice. I know, right right. I don't
Speaker 4: listen to Carl. I don't give him the good stuff.
Speaker 6: He's the dread pirate Roberts.
Speaker 2: I don't buy what Patrick is saying about you right now, right.
Speaker 2: He knows about noise, he knows how to make it.
Speaker 4: Yeah, I do. Sometimes we do. Actually, honestly, it's a
Speaker 4: great way hotel.
Speaker 6: You got to tell him that.
Speaker 4: When we're on a network, there are sometimes So let's say,
Speaker 4: let's just say we're on a bank somewhere.
Speaker 2: I have a feeling that the song is coming up
Speaker 2: right now. Are you about to give some Yeah, yeah.
Speaker 4: It's yeah. Well, you know you're on a network, and
Speaker 4: you know you're being watched by a sock Security Operation Center,
Speaker 4: and you know you're being watched by you know, different
Speaker 4: or something like that, DRS and seasart. Yeah whatever. So
Speaker 4: while we're operating on that network, I may have one
Speaker 4: of my operators go be as loud as possible somewhere
Speaker 4: else on the network, like attack that database over and
Speaker 4: hit it with a billion passwords and just cause mayhem
Speaker 4: over there.
Speaker 2: It's like the typical distraction.
Speaker 4: Throw a piece of malware on there and watch what happens. Yeah,
Speaker 4: so you knock over a liquor store so you can
Speaker 4: hit the bank right exactly, And while all the sea
Speaker 4: shart team and the soccer are looking at this thing
Speaker 4: and they're looking at the alerts, we're quietly expiltrating data
Speaker 4: from like another piece of the network.
Speaker 6: Yeah okay, But you'll also be on an engagement where
Speaker 6: you'll be like they want to know if they see you,
Speaker 6: and we're down to last day and it's like they've
Speaker 6: never seen us. Let's ring a gong.
Speaker 4: Yeah, we've had some of those where they're like, hey,
Speaker 4: we're paying like we're paying a million dollars for this
Speaker 4: operation center, and you just won't. They're going to find you.
Speaker 4: It's like the fourth day and we're like, okay, they
Speaker 4: got us, right, and he's like, oh, it can be.
Speaker 4: It's like no, they.
Speaker 6: Start, well, yeah, you want to know when you were
Speaker 6: going to start?
Speaker 4: Yeah, ok yeah, And we'll do the equivalent of like
Speaker 4: throwing a hand grenade in the network, and we're like okay,
Speaker 4: and we just keep getting louder and louder and louder
Speaker 4: until it's like we're literally taking like known pieces of
Speaker 4: malware and putting them on a box and they're like.
Speaker 6: Ah, we saw you.
Speaker 4: And we're like, oh, dear god, okay.
Speaker 6: Yes, we set up a flare.
Speaker 2: You have to appear as a talking head on somebody's
Speaker 2: desktop saying hey, I'm right here.
Speaker 4: You please call the sock and tell them you've been hacked.
Speaker 4: Thank you, thank you very much. We usually send an
Speaker 4: email to the sock saying hey, guys.
Speaker 6: Would you click on this link for us please? Well,
Speaker 6: we've gotten some vendors kicked out because it's like.
Speaker 4: But I will tell you there are there are a
Speaker 4: lot of really good There are a lot of really
Speaker 4: good monitoring teams and socks out there. There are some that, man,
Speaker 4: no matter how we move around a network, they're like, yeah,
Speaker 4: we saw this, we saw this, we saw this. So
Speaker 4: there there are the right ways to do this. It's
Speaker 4: not like it's not like, oh my god, we're you know,
Speaker 4: kind of in trouble. Anyways, there's there's a way to
Speaker 4: do it. It's hard, but it's rare. It is absolutely.
Speaker 6: It is rare too. It's there's there's a lot of
Speaker 6: people that are willing to do the minimum, which is
Speaker 6: just theater security theater. And that's the problem.
Speaker 2: Yeah.
Speaker 6: So, and it gives gives a bad name to the
Speaker 6: whole industry.
Speaker 2: All right, So we move on to our top story.
Speaker 4: Love it.
Speaker 6: You know, I knew this top story tonight.
Speaker 2: I knew this would happen someday. You know. Forty net, forty, this,
Speaker 2: forty that, forty, your mother, forty, your father, Amahama bla.
Speaker 6: Baramas, thousand systems vulnerable.
Speaker 2: Yeah. So so this campaign called for to bleed exposed
Speaker 2: seventy five thousand, forty net firewalls worldwide.
Speaker 6: So now wait, that's half of all exposed to the
Speaker 6: inetic right, yes, yeah, yeah, it's crazy.
Speaker 4: Sorry.
Speaker 2: I have a customer that uses forty net firewall, and
Speaker 2: every one of these forty net hacks that comes up,
Speaker 2: I send them that are linked to the article and
Speaker 2: they're like, now we don't have to worry about that.
Speaker 2: We're just the firewall. Now we don't. We're just the firewall.
Speaker 2: Oh now they gotta worry about it.
Speaker 5: Yeah.
Speaker 4: Yeah, And this one, this one's interesting. There's it's a
Speaker 4: massive surface of attack, right, And like Patrick had said,
Speaker 4: you know, if you go to a showdown and you
Speaker 4: search for you know, ford neet in headers, right, you
Speaker 4: can see that about half of them are now exposed
Speaker 4: in this massive credential uh you know breach attack. But
Speaker 4: as you dig into this article, it's like, okay, so
Speaker 4: where'd all these credentials come from? Where'd all these user
Speaker 4: names and passwords for all these fordaints come from? Right.
Speaker 4: Over the course of the years here we've talked about
Speaker 4: I don't even know how many doesn't exploits on on Fordinet, right,
Speaker 4: And every time we talk about an exploit like oh,
Speaker 4: here's an off bypass, or here's a way to steal
Speaker 4: the config files or you know this new CVE just
Speaker 4: came up, we always said you have to cycle your
Speaker 4: user names and passwords, you have to cycle all of
Speaker 4: your SSL certificates, et cetera. These to anngels they're speculating
Speaker 4: right now, we're stolen during those exploits, during when their
Speaker 4: gd were hot. Yeah, and they never changed them. So yeah,
Speaker 4: that's uh, it is no bueno.
Speaker 6: No oh he stole my You stole my my saying here.
Speaker 4: No moss so uh, this this is keeps getting I
Speaker 4: think is French for bad. Sorry, moll, Yeah, you speak French.
Speaker 4: You could be that little girl. Thank you, thank you.
Speaker 6: So we've got this thing where they're talking about half
Speaker 6: of all the fortinets out there, and Carl greg gave
Speaker 6: a great point where he said he's talked to people like,
Speaker 6: oh no, it doesn't apply to us. Oh no, it
Speaker 6: doesn't apply to us, And a lot of people are
Speaker 6: just like, oh they're immune to it. They're just patching. Now,
Speaker 6: you Dwayne have talked about this thing called zero days. Yeah,
Speaker 6: before what what do you what do you make of that?
Speaker 6: What do you make of the you know, what this
Speaker 6: is doing to change how we have to address because
Speaker 6: SISA recently came out with a change in guidance and
Speaker 6: how like levels of urgency.
Speaker 4: Yeah, yeah, so it's interesting. I've been shifting my talks
Speaker 4: recently to it used to be patch, patch, patch, and
Speaker 4: then keep patching, and now we're seeing in twenty twenty
Speaker 4: five it would take I think it was the zero
Speaker 4: day clock. You can go view it if I remember correctly.
Speaker 4: Twenty twenty five, it took a week to create an exploit.
Speaker 4: Now it takes a day and by next year they
Speaker 4: think it's going to be one minute, so you'll be
Speaker 4: able to create a zero day on any piece of
Speaker 4: software in one minute using AA. So patching is yeah,
Speaker 4: using AI, so patching is just not fast enough anymore.
Speaker 4: So from that perspective, you have to go back to
Speaker 4: the basics of blocking and tackling like it used to be.
Speaker 4: You could be lazy, you could say, you know what,
Speaker 4: I'm not going to worry about basic policies. I'm not
Speaker 4: gonna worry about basic procedures. I'm not going to worry
Speaker 4: about business continuity. I'm not gonna worry about any of
Speaker 4: that stuff. My vendors will find the bugs, they'll send
Speaker 4: me a patch, I'll patch, and I'll be good. And
Speaker 4: that used to be okay, right, and now you have
Speaker 4: to get back to that basic blocking and tackling with cybersecurity.
Speaker 4: You have to be I need to have the right
Speaker 4: I need to be in compliance. I need to make
Speaker 4: sure that I have the right policies set in place.
Speaker 4: I need to have the right procedures to follow those policies.
Speaker 4: Because it's not an if I get breached, what am
Speaker 4: I going to do to recover? It's a when I
Speaker 4: get when what am I going to do to get
Speaker 4: to recover? And you've heard us say that plenty of
Speaker 4: times on this show.
Speaker 6: It's like defense in depth, Yes, exactly, all sorts of
Speaker 6: things like that.
Speaker 2: Yeah, absolutely, all right, Well that's good advice to end on.
Speaker 2: And I guess that's what we found last week, and
Speaker 2: we'll see you next week on Security this week, Bye bye, bye, guys,