WEBVTT 1 00:00:00.320 --> 00:00:03.200 Hey Carl here, we're on a mission to find new 2 00:00:03.240 --> 00:00:05.919 fans of the show. I mean, where else can you 3 00:00:05.960 --> 00:00:10.240 get real life comedy and horror in one podcast. You 4 00:00:10.279 --> 00:00:13.000 can do your part by leaving us a review on iTunes, 5 00:00:13.039 --> 00:00:16.719 Spotify or wherever you get Security this week. Also, you 6 00:00:16.719 --> 00:00:19.079 can get an ad free feed by becoming a five 7 00:00:19.120 --> 00:00:22.039 dollars a month patron. Go to Patreon dot Security this 8 00:00:22.079 --> 00:00:25.320 week dot com and sign up, and don't forget discord 9 00:00:25.600 --> 00:00:28.519 Discord dot Security this week dot com. Lots of good 10 00:00:28.559 --> 00:00:32.320 stuff happening there. Yeah, I think that's it. So on 11 00:00:32.359 --> 00:00:35.759 with the podcast. Have you guys seen any concerts lately? 12 00:00:36.280 --> 00:00:39.359 No, no live concerts. You know, Elvis, Costello and Abba 13 00:00:39.479 --> 00:00:43.000 are turning together this year. It's a strange combo, but 14 00:00:43.359 --> 00:00:45.759 they have a figured out who'll be the headliner. So 15 00:00:45.920 --> 00:00:48.640 watch for Abba and Costello to find out who's on first. 16 00:00:49.640 --> 00:01:01.799 Yeah, right, Well, welcome to Security this week. 17 00:01:01.840 --> 00:01:02.320 I'm Carl. 18 00:01:02.399 --> 00:01:03.439 That's Patrick and Twain. 19 00:01:04.560 --> 00:01:12.319 No sooner had we talked about fable five last week, 20 00:01:12.840 --> 00:01:16.560 like as soon as it dropped anthropic disabled access to 21 00:01:16.640 --> 00:01:19.760 it to comply with and mythos five to comply with 22 00:01:19.879 --> 00:01:21.239 government directed. 23 00:01:20.879 --> 00:01:22.439 As soon as it dropped it dropped. 24 00:01:23.000 --> 00:01:27.599 So the government basically said this stuff even you know Fable, 25 00:01:27.640 --> 00:01:32.400 which is the consumer facing version of Mythos, it's too 26 00:01:33.280 --> 00:01:37.280 it's too sensitive. You can't Is that the best advertising ever? Yeah? 27 00:01:37.359 --> 00:01:39.640 Oh my god, yes, it's too good. It's so powerful 28 00:01:39.920 --> 00:01:40.920 you got to pull it down. 29 00:01:42.319 --> 00:01:45.519 They were worried about foreign governments getting access to it, 30 00:01:45.560 --> 00:01:48.439 but they just they had to disable it for everybody. 31 00:01:48.519 --> 00:01:48.840 I don't know. 32 00:01:49.000 --> 00:01:52.519 I honestly, maybe I'm maybe I'm becoming conspiracy theorist. I 33 00:01:52.519 --> 00:01:55.280 think they just don't like anthropic. Well that's true, and 34 00:01:55.319 --> 00:01:57.599 they're doing everything they can to just mess with them. 35 00:01:57.640 --> 00:01:58.439 But it's backfiring. 36 00:01:58.560 --> 00:02:01.239 Oh yeah, everybody wants this model now. It's funny. One 37 00:02:01.280 --> 00:02:06.040 of our listeners, Waldo, had posted this. It was like Duayane, 38 00:02:07.400 --> 00:02:10.520 lots of timing of releasing the podcast is cursed Fable. 39 00:02:11.120 --> 00:02:13.680 Fable has now been pulled. Blah blah blah blah blah. 40 00:02:13.759 --> 00:02:15.879 So good, good call there, Waldo. We're going to start 41 00:02:15.879 --> 00:02:17.759 doing maybe a live stream all the time. 42 00:02:17.840 --> 00:02:19.319 Don't promise what we can't deliver. 43 00:02:19.520 --> 00:02:23.120 I know people will jump on this. No, So what's 44 00:02:23.319 --> 00:02:28.800 what's even crazier is the directive was don't allow foreign 45 00:02:29.000 --> 00:02:35.960 nationals access, including foreign nationals that work for Anthropic and 46 00:02:36.120 --> 00:02:38.960 foreign nationals that live in the United States. So they 47 00:02:38.960 --> 00:02:42.840 were like, it's like you ever just turn it off? 48 00:02:43.960 --> 00:02:49.319 So you got two Chads and a Steve working a 49 00:02:49.520 --> 00:02:51.879 throp it, They're like, I don't know, you should talk 50 00:02:51.919 --> 00:02:53.639 to friends who did this? 51 00:02:54.599 --> 00:02:56.560 Who do we deny access to this? 52 00:02:58.520 --> 00:02:59.560 You gotta talk to Steve. 53 00:03:00.159 --> 00:03:02.639 So predictions when do you think it'll come back. 54 00:03:02.800 --> 00:03:04.039 After Trump leave's office? 55 00:03:04.280 --> 00:03:05.719 Oh wow, that's. 56 00:03:06.759 --> 00:03:06.840 So. 57 00:03:06.879 --> 00:03:08.759 What I think is more likely is that they're going 58 00:03:08.840 --> 00:03:12.000 to build another model, the next model, and they're not 59 00:03:12.039 --> 00:03:13.840 going to trumpet these kinds of. 60 00:03:14.240 --> 00:03:17.319 As the cybersecurity offensive killing and they're just going to 61 00:03:17.360 --> 00:03:19.840 release a new one and it'll be better than fable 62 00:03:20.080 --> 00:03:24.319 and it'll circumvent it because they'll they basically fed the 63 00:03:24.360 --> 00:03:27.240 government the tools necessary to demise Well. 64 00:03:27.280 --> 00:03:29.759 You know what, though, I mean, the news is pretty 65 00:03:29.759 --> 00:03:32.360 smart about picking up on how powerful these things are. 66 00:03:33.080 --> 00:03:36.199 So if they do that, then you know the word's 67 00:03:36.240 --> 00:03:37.919 going to get around that they did. 68 00:03:38.120 --> 00:03:44.199 Well, there's also one hundred cybersecurity executives who've written a 69 00:03:44.319 --> 00:03:47.039 letter that said that this is actually making the US 70 00:03:47.120 --> 00:03:49.919 weaker because it's taking away a tool that they were 71 00:03:50.000 --> 00:03:53.240 using actively to find vulnerabilities and fix them exactly. 72 00:03:53.759 --> 00:03:55.319 Yeah, and that's concerning. 73 00:03:55.400 --> 00:03:58.080 And does this kill Project Last Wing? I didn't think 74 00:03:58.080 --> 00:04:00.879 about that. Does this mean the Project glass Wing is 75 00:04:00.919 --> 00:04:04.280 on hold because you have foreign nationals even working for 76 00:04:04.280 --> 00:04:05.039 the US government. 77 00:04:05.280 --> 00:04:08.000 Ah, that's a great question. I don't know. 78 00:04:08.039 --> 00:04:08.960 I don't know the answer to that. 79 00:04:09.039 --> 00:04:11.960 Yeah, I don't know. I mean, I don't know it does. 80 00:04:12.240 --> 00:04:16.959 And so chatch ept there was what was it, GPT 81 00:04:17.360 --> 00:04:20.720 five to four cyber was out there. I'm sure you 82 00:04:20.759 --> 00:04:24.800 know Grock has some offensive cybery capabilities, Like is this 83 00:04:24.920 --> 00:04:28.120 universal where they're like, hey, you know what, everybody needs 84 00:04:28.160 --> 00:04:32.160 to stop releasing these models that can attack well, you know, software, 85 00:04:32.240 --> 00:04:34.720 or is it only anthropic where they're like, dude, yours 86 00:04:34.759 --> 00:04:37.319 is so good. You can't dude, leave it to these 87 00:04:37.399 --> 00:04:39.079 damn democrats to regulately. 88 00:04:39.120 --> 00:04:46.079 Oh wait a minute, So tune in next week when 89 00:04:46.079 --> 00:04:49.839 we will announce that Claude Sonnet is going away. 90 00:04:50.920 --> 00:04:53.319 On that it will be replaced by Quinn. 91 00:04:53.680 --> 00:04:57.800 Yeah, Quenn exactly. All right, So this one is funny. 92 00:04:57.959 --> 00:05:02.480 Nottingham University says student records rated after Shiny Hunters claimed 93 00:05:02.560 --> 00:05:08.480 cyber attack. Says the sheriff of Noddingham. 94 00:05:08.519 --> 00:05:10.879 Oh no, Well, who'd you think would announce it? Made 95 00:05:10.920 --> 00:05:11.800 Marion right? 96 00:05:12.079 --> 00:05:15.079 Well, I thought maybe that the hackers would be called 97 00:05:15.160 --> 00:05:18.279 Robin Hood, because yeah. 98 00:05:18.040 --> 00:05:20.439 The Shiny Hunters have been busy. Huh Yeah, it's like 99 00:05:20.480 --> 00:05:23.680 every week we've had we've had a story with Shiny Hunters. 100 00:05:23.839 --> 00:05:24.879 They have access to fable. 101 00:05:27.639 --> 00:05:31.000 So what happened maybe I don't know. So there's not 102 00:05:31.040 --> 00:05:34.240 a lot of detail that forensics are still ongoing. The 103 00:05:34.279 --> 00:05:36.839 only details we do have is a there was a 104 00:05:36.959 --> 00:05:38.560 there was a chunk of data that was actually I 105 00:05:38.560 --> 00:05:41.519 think it was a ten gig ten gig data set 106 00:05:41.920 --> 00:05:44.600 that was released to Have I Been Pooned? Okay, So 107 00:05:44.639 --> 00:05:46.040 for those of you, I know, I don't think we've 108 00:05:46.079 --> 00:05:48.680 talked about. Is Troy even there anymore? Does anybody know? 109 00:05:48.720 --> 00:05:48.879 Yeah? 110 00:05:48.920 --> 00:05:49.480 I think it's still his. 111 00:05:49.759 --> 00:05:52.920 He's got to be at least a figurehead. I don't know. 112 00:05:53.079 --> 00:05:55.120 Yeah, I don't know. I know. I know at one 113 00:05:55.120 --> 00:05:58.480 point there was some big cybersecurity conglomerate that took it over, but. 114 00:05:59.680 --> 00:06:01.120 I think he's still involved. 115 00:06:01.279 --> 00:06:04.199 Okay. Have I Been Pooned is a site that keeps 116 00:06:04.360 --> 00:06:08.319 track of your information in data breaches, whether it's emails 117 00:06:08.319 --> 00:06:10.680 and passwords, so if you go there and actually type 118 00:06:10.680 --> 00:06:12.639 in your email address, and I know this sounds like 119 00:06:12.800 --> 00:06:16.160 terrible advice, right, like, Hey, go to this site Have 120 00:06:16.240 --> 00:06:18.279 I Been Pooned? And type in your most current password 121 00:06:18.319 --> 00:06:21.480 and see if it's been breached. Like you can do that, 122 00:06:21.800 --> 00:06:23.959 and most people be like, I'm not putting my password 123 00:06:24.000 --> 00:06:27.279 in this site. That's insane. However, I can tell you 124 00:06:27.360 --> 00:06:30.879 from a cybersecurity standpoint, the way that the exchange of 125 00:06:30.959 --> 00:06:34.720 data happens. Even Have I Been Pooned doesn't know which 126 00:06:34.720 --> 00:06:35.680 password you typed in? 127 00:06:35.720 --> 00:06:38.199 Well, but don't don't. They have have mechanism where you 128 00:06:38.240 --> 00:06:40.480 can just give them your email and then email that 129 00:06:40.680 --> 00:06:43.680 email yep, the list of credentials that are exposed. 130 00:06:43.920 --> 00:06:45.959 Yeah, and they won't give you full credentials or anything 131 00:06:46.000 --> 00:06:48.680 like that. But if you were curious about a password, 132 00:06:48.680 --> 00:06:51.079 you could type in a password as well. And even, 133 00:06:51.120 --> 00:06:52.720 like I said, even Have I Been Poned doesn't know 134 00:06:52.720 --> 00:06:55.480 what password you typed in because the algorithm they actually 135 00:06:55.800 --> 00:06:57.720 take your passwords, seed it in with a bunch of 136 00:06:57.800 --> 00:06:59.759 other passwords and then check. 137 00:07:00.079 --> 00:07:04.480 So the overlap, just FYI, the overlap between our database 138 00:07:04.519 --> 00:07:07.360 and their database and the database of all the hacking 139 00:07:07.399 --> 00:07:10.720 syndicates and all the government, and you know, it's a 140 00:07:10.839 --> 00:07:14.480 ninety five overlap. We might have passwords they don't have. 141 00:07:14.560 --> 00:07:16.839 They might have passwords we don't have. So it's not 142 00:07:16.920 --> 00:07:18.839 like it's this is the only source. 143 00:07:19.000 --> 00:07:19.199 No. 144 00:07:19.199 --> 00:07:22.279 No, this is a good source that's being used for good. 145 00:07:23.680 --> 00:07:25.879 There's lots of other bad sources that are being used 146 00:07:25.879 --> 00:07:27.240 for bad, and then there's us in the middle. 147 00:07:28.879 --> 00:07:32.399 Speaking of you, guys, I mentioned you on Coded with AI. 148 00:07:33.319 --> 00:07:37.399 We were talking about Microsoft's new AI models. Yep, and 149 00:07:37.519 --> 00:07:42.519 they run on Foundry and Azure. But they're also going 150 00:07:42.560 --> 00:07:44.399 to be running they're going to allow you to run 151 00:07:44.439 --> 00:07:49.560 them locally. Oh on Foundry local and the code model 152 00:07:49.639 --> 00:07:53.040 for example, it's different because it will go it will 153 00:07:53.040 --> 00:07:55.480 start with the NPU and if that's not there, you 154 00:07:55.600 --> 00:07:58.079 go to the GPU and when that runs out of 155 00:07:58.079 --> 00:08:01.519 steamily use the CPU. Wow. So they're claiming that it's 156 00:08:01.600 --> 00:08:04.959 faster than like everything out there. The reason that I 157 00:08:05.240 --> 00:08:07.920 mentioned you is because we were talking about my big 158 00:08:07.959 --> 00:08:10.680 Olama machine and I said, you know, compared to what 159 00:08:10.759 --> 00:08:15.439 Patrick and Dwayne run, this is a gaming laptop. Yeah, 160 00:08:15.519 --> 00:08:17.160 we may have a pretty bit. 161 00:08:17.079 --> 00:08:20.920 Weird looking at the next generation of hardware. Oh yeah, yeah, 162 00:08:21.120 --> 00:08:24.720 I know, And unfortunately the next generation is is a 163 00:08:24.759 --> 00:08:26.439 six figure right yeah. 164 00:08:26.560 --> 00:08:29.439 Yeah, when you start looking at the really big Grace 165 00:08:29.480 --> 00:08:33.519 Blackwell chips like, yeah, those things outpace man. Yea, they're 166 00:08:33.519 --> 00:08:34.080 doing awesome. 167 00:08:34.200 --> 00:08:36.320 So do you know how much memory you need from 168 00:08:36.320 --> 00:08:38.480 those systems? Because one of the things about LM Studio 169 00:08:38.519 --> 00:08:40.519 that kind of broke it is if you wanted to 170 00:08:40.600 --> 00:08:42.879 run a big model, you need a system that was 171 00:08:43.120 --> 00:08:45.759 not you know, you couldn't run on a laptop anymore. 172 00:08:45.759 --> 00:08:49.080 Okay, so good, good question. So right now, one of 173 00:08:49.080 --> 00:08:51.360 the most sort of commodity ways for you to run 174 00:08:51.360 --> 00:08:54.320 these would be on a GB ten, which is and 175 00:08:54.360 --> 00:08:57.240 they're ace Who's has the Dell has them, and video 176 00:08:57.240 --> 00:08:59.799 has them whatever. There's these tiny little you know, nuxt 177 00:09:00.240 --> 00:09:02.320 boxes that. 178 00:09:02.600 --> 00:09:04.799 Yeah, but they're even those are about five thousand. 179 00:09:04.519 --> 00:09:06.679 Dollars, right, I say, come on, I mean cheap, like 180 00:09:06.720 --> 00:09:07.480 you might as well pick. 181 00:09:07.360 --> 00:09:10.399 Up a copy. Okay, diamond case, Scrooge McDuck. 182 00:09:10.759 --> 00:09:14.480 I got mine for six grand online. It's got ninety 183 00:09:14.480 --> 00:09:17.679 six gigs of RAM, It's got thirty two gigs of 184 00:09:17.799 --> 00:09:20.559 v RAM. Yeah nice, it does not have an NPU. 185 00:09:20.759 --> 00:09:24.360 But in the good old days of hugging face when 186 00:09:24.360 --> 00:09:26.639 no one knew what the hell that was. You could 187 00:09:26.679 --> 00:09:30.080 run a state of the art model basically on a laptop, 188 00:09:30.200 --> 00:09:33.320 but now we've eclipsed that. So I'm wondering whether. 189 00:09:33.120 --> 00:09:35.360 Yeah, well, the front yeah, the frontier models or not 190 00:09:35.480 --> 00:09:37.799 are never going to be run locally. They're just they're 191 00:09:37.799 --> 00:09:41.200 too big. But you can take a really good, reasonably 192 00:09:41.279 --> 00:09:45.039 a three hundred and thirty billion parameter model which is 193 00:09:45.519 --> 00:09:47.919 awesome and sizable, and you can throw it on a 194 00:09:47.919 --> 00:09:53.279 cluster of you know, four GB tens with a InfiniBand 195 00:09:53.279 --> 00:09:55.799 connection between them, and it'll run reasonably well. 196 00:09:55.840 --> 00:09:59.879 And that's within the limits of most companies, little tech shops. 197 00:10:00.200 --> 00:10:03.200 Oh yeah it's not, but not the average listener. 198 00:10:03.240 --> 00:10:06.840 Fifteen grand. You can get fifteen twenty grand, Yeah, four nodes, 199 00:10:07.080 --> 00:10:08.759 an infinite band switch and run it. 200 00:10:08.759 --> 00:10:10.679 I was talking to a guy yesterday who was stressing 201 00:10:10.679 --> 00:10:13.559 out about six dollars, you know, because of one request 202 00:10:13.559 --> 00:10:14.200 from you know. 203 00:10:14.320 --> 00:10:15.960 But if you well, hold on, if you look at 204 00:10:16.039 --> 00:10:20.960 fifteen grand to run your own like GB ten infinite 205 00:10:21.000 --> 00:10:23.360 band cluster, or you look at one month of tokens, 206 00:10:23.399 --> 00:10:24.440 I mean it's about the same. 207 00:10:24.600 --> 00:10:27.000 At this point, it's like about the same. Yeah, yeah, 208 00:10:27.080 --> 00:10:29.840 yeah it can and the corporation, it could be, and 209 00:10:29.879 --> 00:10:31.960 that fifteen grand is a one time purchase. You don't 210 00:10:32.000 --> 00:10:36.360 pay for tokens after that. Yeah, run it, run it. Yeah, absolutely, 211 00:10:36.440 --> 00:10:38.519 So that's where the future is going. I was convinced 212 00:10:38.559 --> 00:10:42.440 to that months ago. All right, So Nottingham University, do 213 00:10:42.600 --> 00:10:43.840 we finish this story? 214 00:10:44.600 --> 00:10:47.559 So, needless to say, Nottingham has had all sorts of issues. 215 00:10:47.600 --> 00:10:52.279 There's another they said, the attack could hardly have come 216 00:10:52.320 --> 00:10:54.320 at the worst time for Nottingham, which is embroiled in 217 00:10:54.360 --> 00:11:00.320 a dispute with staff, confirming hundreds of redundancies over the 218 00:11:00.360 --> 00:11:03.799 next three years. So not only is it they're they're 219 00:11:03.840 --> 00:11:06.840 fighting with their own staff, they're downsizing, and their staff 220 00:11:06.919 --> 00:11:11.000 has decided not to mark final grades wow as in retaliation, 221 00:11:11.120 --> 00:11:13.639 which means the students are kind of in trouble there, 222 00:11:14.879 --> 00:11:18.720 and they're they're planning on if they don't resolve the 223 00:11:18.759 --> 00:11:21.399 issue with the staff, they're just gonna guess what the 224 00:11:21.399 --> 00:11:22.519 students get for grades. 225 00:11:22.600 --> 00:11:22.759 Wow. 226 00:11:22.799 --> 00:11:26.000 They're just gonna take their old grades and see what 227 00:11:26.039 --> 00:11:28.279 the trend line looks like and give them that. 228 00:11:28.120 --> 00:11:33.200 Wow jackpot if you just start slacking off, no, right. 229 00:11:33.679 --> 00:11:36.000 And then unfortunately then they also got hit with this 230 00:11:36.120 --> 00:11:38.399 data breach. So they're they're in, they're a world of hurt. 231 00:11:38.759 --> 00:11:45.360 So this data breach could include names, addresses, phone numbers, ethnicities, disabilities, 232 00:11:45.960 --> 00:11:50.440 passport numbers, and information related to academic enrollment and fee payment. 233 00:11:50.840 --> 00:11:53.360 So according to have ivanponed. 234 00:11:52.919 --> 00:11:53.879 Wow, yikes. 235 00:11:54.120 --> 00:11:58.120 Yeah, they say they've notified all the people who were involved, 236 00:11:58.159 --> 00:12:01.159 but that's four hundred and fifty thousand people, including alumni. 237 00:12:01.320 --> 00:12:03.080 So I don't know if that's true or not. 238 00:12:03.240 --> 00:12:05.759 But you're not an alumni of Nottingham University. 239 00:12:05.840 --> 00:12:06.480 I am not. 240 00:12:07.200 --> 00:12:10.200 No, all right, So we have two stories about that. 241 00:12:10.360 --> 00:12:13.080 The next one is the same story. University of Nottingham 242 00:12:13.120 --> 00:12:15.600 conference preach Chapter Hackers League data. So let's get that 243 00:12:15.679 --> 00:12:16.759 out and let's move on. 244 00:12:17.120 --> 00:12:17.399 Love it. 245 00:12:17.440 --> 00:12:21.320 Okay, Junior hacker used tail scale in open ssh to 246 00:12:21.399 --> 00:12:24.639 keep access after his seat two went offline. 247 00:12:25.080 --> 00:12:28.240 So I thought this was interesting for a couple of reasons. 248 00:12:28.440 --> 00:12:32.600 The first is we're we're talking about AI aii. You 249 00:12:32.879 --> 00:12:37.879 have to actually know what you're doing to do sophisticated 250 00:12:37.879 --> 00:12:41.080 things here. You know, could you point at an app 251 00:12:41.120 --> 00:12:43.360 and say, hey, I want you to develop something, But 252 00:12:43.399 --> 00:12:45.759 then you've got to still do all the jumps of 253 00:12:46.360 --> 00:12:49.799 getting getting there, understanding how to use the shell building. 254 00:12:50.039 --> 00:12:51.759 Like half the time when I talk to my AI, 255 00:12:51.879 --> 00:12:54.120 it's telling me to do stuff right, And a lot 256 00:12:54.120 --> 00:12:56.200 of times I'm like, no, you work for me, and 257 00:12:56.240 --> 00:12:58.000 it's still like yeah, but I can't I get these 258 00:12:58.000 --> 00:13:02.279 little arms, this little tea, yeah, and I can't reach, 259 00:13:02.840 --> 00:13:04.919 so so I have I end up work doing the 260 00:13:04.919 --> 00:13:07.759 bidding of the AI. You got to know something, or 261 00:13:07.799 --> 00:13:12.000 it takes forever, Like if you don't know permissions or 262 00:13:12.159 --> 00:13:16.159 file access firewall rules, it takes it'll take forever for 263 00:13:16.200 --> 00:13:17.440 the AI to walk you through. 264 00:13:17.399 --> 00:13:20.080 And probably will not end up correct exactly. 265 00:13:20.200 --> 00:13:22.679 Yeah, so there's still a skill here. And this is 266 00:13:22.679 --> 00:13:24.879 a kid I did. I don't know if they said 267 00:13:24.879 --> 00:13:25.320 the age. 268 00:13:25.879 --> 00:13:28.440 So this kid has not been found yet, but they're 269 00:13:28.600 --> 00:13:33.639 speculating he's a junior hacker. Speculating it's a kid or she. Yeah, 270 00:13:33.679 --> 00:13:37.480 because they're speculating because of the hours of operation. 271 00:13:37.559 --> 00:13:39.759 Oh I thought they just used slating. No one understood. 272 00:13:39.840 --> 00:13:42.159 Oh no, it's like three pm in the afternoon. 273 00:13:42.240 --> 00:13:44.279 Yeah, three pm when they get home from school. 274 00:13:44.440 --> 00:13:47.840 Then like it lights up, and then occasionally the kid 275 00:13:47.919 --> 00:13:50.440 stays up for five hours at night, you know, doing 276 00:13:50.480 --> 00:13:53.120 hacky hacky things. But then goes dark at like seven 277 00:13:53.159 --> 00:13:55.440 am to like three in the afternoon. Wow. 278 00:13:55.480 --> 00:13:57.879 And when demon Hunters cape up, Demon Hunters is on, 279 00:13:57.960 --> 00:13:59.519 it's they're never lacking. 280 00:13:59.480 --> 00:14:03.200 Right exactly, So it is interesting. So this is they 281 00:14:03.320 --> 00:14:06.240 they assume, well they know just from forensics. This is 282 00:14:06.240 --> 00:14:10.440 a French speaking actor broke into a small French automotive business, 283 00:14:10.440 --> 00:14:11.120 so very local. 284 00:14:11.360 --> 00:14:13.840 Wait a minute, Dwayne knows some French. 285 00:14:14.840 --> 00:14:17.559 It depends on who you ask. You ask French speaking people. 286 00:14:17.639 --> 00:14:21.039 Dwayne knows no French, want them to. 287 00:14:20.960 --> 00:14:24.200 Think you might have misunderstood when he says, excuse my 288 00:14:24.279 --> 00:14:25.320 French all the time? 289 00:14:25.639 --> 00:14:26.440 Yeah, exactly. 290 00:14:26.519 --> 00:14:28.360 I don't think that's differentially French. 291 00:14:29.000 --> 00:14:32.679 Okay, So a. 292 00:14:32.759 --> 00:14:37.519 French speaking we're going to assume child minor broke into 293 00:14:37.519 --> 00:14:42.440 a French automotive business planting a key lagger. And I 294 00:14:42.480 --> 00:14:45.720 love how if you read through this, it's like, yeah, 295 00:14:45.879 --> 00:14:48.240 planted a keylogger and a C two S command of 296 00:14:48.279 --> 00:14:52.559 control communicating back to a Havoc server. Havoc is very 297 00:14:52.600 --> 00:14:55.399 well known as a gaming server. So if you want 298 00:14:55.399 --> 00:14:57.480 to run a Minecraft server on the Internet, you just 299 00:14:57.480 --> 00:15:00.559 go to Havoc and you you wreak set up. You 300 00:15:00.600 --> 00:15:03.039 click I have it. You click I want to I 301 00:15:03.080 --> 00:15:06.600 want a Minecraft server. Right, so they're more known for 302 00:15:06.679 --> 00:15:09.879 their game servers, not necessarily their C two's I guess. 303 00:15:09.919 --> 00:15:12.799 But when it went down, they maintain persistence. 304 00:15:13.039 --> 00:15:16.919 Yeah, so when it went down, this this kid, although 305 00:15:16.960 --> 00:15:19.120 it is funny and here they say his op sec 306 00:15:19.279 --> 00:15:22.679 is absolutely terrible, but this what he did is he 307 00:15:22.720 --> 00:15:26.480 actually installed Tailscale. Tailscale is a mesh network. So what 308 00:15:26.519 --> 00:15:30.039 it allows is my home computer. If I install tail 309 00:15:30.080 --> 00:15:33.039 Scale on my home computer and installed installed Tailscale at 310 00:15:33.159 --> 00:15:37.039 the attacked site, it looks like the two computers are 311 00:15:37.039 --> 00:15:39.759 on the same network. So now I can just play 312 00:15:39.919 --> 00:15:42.320 at home. It'd be just like trying to reach to 313 00:15:42.320 --> 00:15:44.200 a computer that's sitting on my network. I can do 314 00:15:44.240 --> 00:15:47.799 it over this encrypted tail Scale. So okay, installed tail Scale. 315 00:15:48.639 --> 00:15:51.200 Kid probably used to using it to game with his 316 00:15:51.240 --> 00:15:54.120 buddies or her buddies. Right where they install all tailscale 317 00:15:54.120 --> 00:15:55.879 and they run a local game so and then just 318 00:15:55.919 --> 00:15:58.360 have a land party basically right, and having points that 319 00:15:58.960 --> 00:16:01.440 this is also a game server company that sure you 320 00:16:01.480 --> 00:16:02.879 can install other software on. 321 00:16:04.480 --> 00:16:04.600 It. 322 00:16:04.679 --> 00:16:07.840 Is they also kind of rail on this kid, saying 323 00:16:10.000 --> 00:16:12.799 like fifty or seventy five percent of the commands. This 324 00:16:12.879 --> 00:16:17.960 kid typed We're like, not right, because he was key 325 00:16:18.039 --> 00:16:22.000 logging himself while typing as well. Unfortunately, so yet geez, 326 00:16:22.200 --> 00:16:24.399 just a lot of things that you can tell this 327 00:16:24.480 --> 00:16:27.279 isn't a seasoned operator, and it's not because of Tailscapan. 328 00:16:27.720 --> 00:16:30.600 There are operators that have used tail scale, right, APT 329 00:16:30.759 --> 00:16:32.840 thirty one has used tailscale in twenty twenty four and 330 00:16:32.840 --> 00:16:38.039 twenty twenty five. Scattered Spiders used tailscale, Like tailscale has 331 00:16:38.039 --> 00:16:40.519 been used in a lot of operations. Just you could 332 00:16:40.559 --> 00:16:44.399 tell this person's not a seasoned operator, right, let's put 333 00:16:44.440 --> 00:16:44.799 it that way. 334 00:16:44.840 --> 00:16:47.399 Okay, Well, this seems like a good time to take 335 00:16:47.399 --> 00:16:49.639 a break, so we'll be right back after these very 336 00:16:49.639 --> 00:16:56.080 important messages. Don't you go away, and we're back. It's 337 00:16:56.080 --> 00:16:59.600 security this week. I'm Carls Dwayne. That's Patrick, And before 338 00:16:59.639 --> 00:17:01.240 we talk about the next story, I got a little 339 00:17:01.240 --> 00:17:04.319 story for you. I'm actually on vacation. I'm in a 340 00:17:04.319 --> 00:17:07.240 hotel room and with my wife. 341 00:17:07.279 --> 00:17:10.000 Well, thank you for joining, Thank you for your service, Carl. 342 00:17:10.000 --> 00:17:14.720 Yeah, of course. So I'm at this hotel and I 343 00:17:14.720 --> 00:17:18.920 have with me a T mobile Mai Fi device nice, 344 00:17:18.960 --> 00:17:22.480 which I love because just about everywhere I use it, 345 00:17:22.559 --> 00:17:25.079 I get like two hundred and fifty megabits down, whereas 346 00:17:25.119 --> 00:17:28.119 Hotel Wi Fi, I'm lucky if I get twenty, you know, yep. 347 00:17:28.240 --> 00:17:32.359 And so it's been fine going through this whole thing. 348 00:17:32.440 --> 00:17:34.599 We finally get to this hotel in New Jersey because 349 00:17:34.680 --> 00:17:37.880 Kelly's visiting one of her friends from high school, and 350 00:17:38.440 --> 00:17:44.559 I'm at this little in this little town. The Mai 351 00:17:44.640 --> 00:17:49.759 Fi device is registering like point four megabits. I get 352 00:17:49.799 --> 00:17:54.880 like one bar of five G and my phone's getting lte. 353 00:17:55.440 --> 00:17:59.359 I can't use my phone, so I accept the like, 354 00:17:59.440 --> 00:18:02.000 I go on to the Hotel Wi Fi, which I 355 00:18:02.039 --> 00:18:05.799 never do, and I accept the free version. There's a 356 00:18:05.839 --> 00:18:08.480 free version then five dollars a day, and I just 357 00:18:08.519 --> 00:18:11.599 accept the free version. The free version gives me, oh, 358 00:18:12.119 --> 00:18:13.440 three megabits. 359 00:18:13.640 --> 00:18:16.160 Oooh. I mean that's a lot more than you are getting. 360 00:18:16.400 --> 00:18:18.400 It's a lot more than I'm getting. But then I'm like, 361 00:18:18.519 --> 00:18:21.440 you know what, I need to go back and register 362 00:18:21.759 --> 00:18:25.039 for the five dollars a day and see if that works. 363 00:18:25.039 --> 00:18:27.519 So I pull up my phone because it's a different device, right, 364 00:18:28.240 --> 00:18:32.480 and I log in to the five dollars a day. Boom, 365 00:18:32.519 --> 00:18:37.119 two hundred and fifty megabits. Yes, wow, Now how do 366 00:18:37.279 --> 00:18:40.440 I get that on my laptop, because my laptop is 367 00:18:40.480 --> 00:18:42.440 already logged in. Every time I connect to the Wi 368 00:18:42.480 --> 00:18:46.359 Fi network, it's pegged me at the lower rate. So 369 00:18:47.000 --> 00:18:51.440 I figured it out. You go to settings in Windows 370 00:18:51.519 --> 00:18:54.640 eleven and you go to network settings, and you go 371 00:18:54.720 --> 00:18:57.079 to Wi Fi and Underwi Fi there's this thing to 372 00:18:57.279 --> 00:19:03.279 randomize your Mac address. Duayne's laughing. You basically turn that 373 00:19:03.440 --> 00:19:07.200 on and WiFi thinks, oh, this is a new computer. 374 00:19:07.519 --> 00:19:09.640 So you log off the network, you log back on, 375 00:19:09.720 --> 00:19:12.640 and it brings you to that the you know, reconnect 376 00:19:12.640 --> 00:19:15.079 with your browser thing, and you get to selected against 377 00:19:15.119 --> 00:19:16.480 book A two hundred and fifty Mega. 378 00:19:16.559 --> 00:19:18.680 But all right, here's what else I'll tell you, Carl. Yeah, 379 00:19:18.720 --> 00:19:22.319 so let's say somebody else in the hotel paid for 380 00:19:22.400 --> 00:19:26.400 five dollars WiFi. You could throw up an air listener 381 00:19:26.519 --> 00:19:31.160 see their Mac address so evil, Then d off them 382 00:19:31.319 --> 00:19:34.720 off the Wi Fi and make your macaddress look like theirs, 383 00:19:34.720 --> 00:19:35.920 and when you connect, you get. 384 00:19:35.799 --> 00:19:37.000 The five dollars Wi Fi. 385 00:19:37.559 --> 00:19:41.680 Well, they get screwed and they get offline. Dwayne. 386 00:19:41.720 --> 00:19:43.880 If I go down to Starbucks and get a latte, 387 00:19:44.079 --> 00:19:46.640 I've spent five dollars, so I'm not worried about the 388 00:19:46.680 --> 00:19:49.599 five dollars. I was more worried that I couldn't actually 389 00:19:49.759 --> 00:19:51.440 use the Internet while I was here. 390 00:19:51.799 --> 00:19:54.039 But I'm just saying, if that's something you were looking 391 00:19:54.039 --> 00:19:55.559 to do at some point, I just. 392 00:19:55.680 --> 00:19:58.240 Well, you know, I wouldn't know how to do that. 393 00:19:58.319 --> 00:20:00.359 You do, you know how to fool that, But in 394 00:20:00.640 --> 00:20:02.920 the Windows settings, it's just a switch. It's either on 395 00:20:03.039 --> 00:20:04.960 or off, and you get a random Mac address, So 396 00:20:05.039 --> 00:20:08.440 I don't know how to provide a real Mac address to. 397 00:20:08.680 --> 00:20:12.039 You know, Carl does something wholesome and useful and Dwayne 398 00:20:12.119 --> 00:20:12.839 turns it into. 399 00:20:14.160 --> 00:20:16.799 Dwayne's Like, Carl, you know, you have so much to learn. 400 00:20:17.599 --> 00:20:22.359 Twains like called the free found I found a straight 401 00:20:22.440 --> 00:20:24.200