WEBVTT 1 00:00:00.320 --> 00:00:03.200 Hey, Carl, here, we're on a mission to find new 2 00:00:03.240 --> 00:00:05.919 fans of the show. I mean, where else can you 3 00:00:05.960 --> 00:00:10.240 get real life comedy and horror in one podcast. You 4 00:00:10.279 --> 00:00:13.640 can do your part by leaving us a review on iTunes, Spotify, 5 00:00:13.759 --> 00:00:16.879 or wherever you get Security this week. Also, you can 6 00:00:16.920 --> 00:00:19.399 get an ad free feed by becoming a five dollars 7 00:00:19.399 --> 00:00:22.239 a month patron. Go to Patreon dot Security this week 8 00:00:22.320 --> 00:00:26.160 dot com and sign up, and don't forget discord. Discord 9 00:00:26.199 --> 00:00:28.839 dot Security this week dot com. Lots of good stuff 10 00:00:28.879 --> 00:00:32.439 happening there. Yeah, I think that's it. So on with 11 00:00:32.560 --> 00:00:36.399 the podcast. So I'm shopping in Walmart looking for deodorant, 12 00:00:36.439 --> 00:00:39.159 but I can't find it right, So I asked a 13 00:00:39.200 --> 00:00:42.920 sales associate and she says, do you want the ball type? 14 00:00:43.240 --> 00:00:47.880 Say no, I want the underarm type. 15 00:00:50.000 --> 00:00:51.240 You know, Carl, that was good. 16 00:00:51.679 --> 00:00:53.560 I like that was for all the thirteen year old 17 00:00:53.560 --> 00:00:54.200 boys out there. 18 00:00:54.799 --> 00:00:58.320 That was good. Now now they're googling ball the outterant. 19 00:00:58.560 --> 00:01:03.840 I wish I could pretend I believe that to be true. 20 00:01:09.920 --> 00:01:12.239 All Right, we got a lot of stories today, but 21 00:01:12.640 --> 00:01:17.560 let's start with the FBI Russian hackers now target signal 22 00:01:17.959 --> 00:01:21.400 backup recovery keys, oh, no, signal. 23 00:01:21.680 --> 00:01:23.840 So I mean, signal is kind of the price if 24 00:01:23.879 --> 00:01:26.200 you can get in a signal, that's where people, you know, 25 00:01:26.519 --> 00:01:30.079 we've even had government officials in the in the military 26 00:01:31.200 --> 00:01:35.359 or military adjacent shall we say, who we're talking on it. 27 00:01:35.400 --> 00:01:37.480 So I'm not surprised at all to see this. 28 00:01:37.920 --> 00:01:41.040 We've been counting. Signal is a better alternative to all 29 00:01:41.040 --> 00:01:43.359 these other chat apps What's Happen everything, because it does 30 00:01:43.400 --> 00:01:45.560 do end to end encryption, but that makes it a target, 31 00:01:45.640 --> 00:01:46.200 right right. 32 00:01:46.280 --> 00:01:50.480 The problem with Signal is it's hosted by an open 33 00:01:50.599 --> 00:01:54.359 source company, which I mean, it could be better run 34 00:01:54.400 --> 00:01:58.239 than any other company, but it it doesn't have I 35 00:01:58.239 --> 00:01:59.719 guess it does. I don't feel that it has the 36 00:01:59.799 --> 00:02:02.120 rig to prevent a search and seizure. So if the 37 00:02:02.159 --> 00:02:05.040 government wants to get their records, I don't know how 38 00:02:05.079 --> 00:02:07.719 easily they'd roll over, whereas Apple thought tooth and nail 39 00:02:08.439 --> 00:02:10.639 to protect their users. So there's a bit of a 40 00:02:10.680 --> 00:02:14.520 movement to try to go to systems that are privately held, 41 00:02:14.960 --> 00:02:19.400 and especially ones hosted in Switzerland. And the reason for 42 00:02:19.439 --> 00:02:22.960 that is Switzerland is a jurisdiction that unless you're a 43 00:02:23.120 --> 00:02:26.800 proven terrorist, they're not giving anybody your data, right, and 44 00:02:26.919 --> 00:02:30.000 so like if if I suit Carl for a civil suit, 45 00:02:30.560 --> 00:02:34.080 get ready, Carl. In most places, I can get a 46 00:02:34.120 --> 00:02:37.000 court order and get you know, the data. In Switzerland, 47 00:02:37.120 --> 00:02:38.840 the bar is so high. I'm not going to get 48 00:02:38.840 --> 00:02:40.879 that data. I'm not going to get his private messages. 49 00:02:41.680 --> 00:02:43.639 And the only company I know that's really playing at 50 00:02:43.639 --> 00:02:47.039 a high end in this is called secure Sek. You are, 51 00:02:48.520 --> 00:02:52.159 but I haven't. I haven't used it yet, but I've heard, 52 00:02:52.199 --> 00:02:54.840 I know people who have used it, and we'll probably 53 00:02:54.840 --> 00:02:57.360 see other offerings in that. But it's important that it 54 00:02:57.439 --> 00:02:59.120 be all their data to be hosted in Switzerland. 55 00:02:59.199 --> 00:03:01.439 Well, I don't think this is necessarily a sign that 56 00:03:01.560 --> 00:03:04.039 we should not use signal, but because it was a 57 00:03:04.080 --> 00:03:07.560 phishing campaign, right, Oh, yeah, So this is targeting Signal 58 00:03:07.680 --> 00:03:11.520 users that were tied to Russian intelligence services, and it 59 00:03:11.639 --> 00:03:15.439 evolved to steal signal backup recovery keys so the attackers 60 00:03:15.439 --> 00:03:19.400 could access their historical messages and things like that and 61 00:03:19.560 --> 00:03:20.479 hold them from ransom. 62 00:03:20.840 --> 00:03:22.599 The way you said that made it seem like the 63 00:03:22.759 --> 00:03:25.520 Russians were targeted, I think it's the other way around. Yeah, 64 00:03:25.680 --> 00:03:27.240 the Russians were targeting. 65 00:03:26.879 --> 00:03:29.479 Targeting, Yes, Russian intelligence. 66 00:03:29.000 --> 00:03:32.280 Yes, yes, yes, I was just reading from the from them. Yeah, 67 00:03:32.400 --> 00:03:34.439 bad written article here. 68 00:03:35.000 --> 00:03:39.240 And it's weird too because uh, attackers posed as Signal 69 00:03:39.280 --> 00:03:44.840 support claiming mandatory two factor verification. I've been using Signal 70 00:03:44.840 --> 00:03:47.080 for a very, very long time and I've never ever 71 00:03:47.240 --> 00:03:49.159 ever had Signal support reach out to me. 72 00:03:49.280 --> 00:03:50.360 Is there a Signal support? 73 00:03:50.400 --> 00:03:51.360 I don't even know that there is. 74 00:03:51.439 --> 00:03:52.120 I don't think zo. 75 00:03:53.240 --> 00:03:55.840 I know there's the pop up that says please donate 76 00:03:55.919 --> 00:03:58.319 money so Signal can keep running. But that's about it. 77 00:03:58.439 --> 00:04:00.280 Don't call us, we'll call you kind of thing. 78 00:04:00.400 --> 00:04:05.120 Yeah, yeah, exactly, So you know they're in understanding the platform. 79 00:04:05.199 --> 00:04:08.000 I think makes sense, especially if you're worried about social engineering. 80 00:04:08.680 --> 00:04:11.759 You know, how does this? How does signal work? Are 81 00:04:11.800 --> 00:04:13.840 they ever going to reach out to me? You know? 82 00:04:14.319 --> 00:04:16.920 How can I keep it secure? The other thing that 83 00:04:17.000 --> 00:04:20.240 I find interesting in this is they say that the 84 00:04:20.279 --> 00:04:24.360 impact here was full historical messages in media access. So 85 00:04:24.560 --> 00:04:27.879 for me, most of my conversations burn. Yeah, So for 86 00:04:27.879 --> 00:04:29.879 those of the you that don't use Signal, you can 87 00:04:29.879 --> 00:04:32.519 set a burn on Signal to say, hey, you know, 88 00:04:32.519 --> 00:04:35.560 burn this message after ten minutes right or after twenty 89 00:04:35.600 --> 00:04:37.920 four every twenty four hours, burn all my conversations Tom 90 00:04:37.959 --> 00:04:40.920 Cruise style, Yeah, exactly right, snap the sim throw it 91 00:04:40.959 --> 00:04:42.519 in the trash, grab a new one type thing. 92 00:04:43.000 --> 00:04:44.759 As people with nothing to hide off and. 93 00:04:44.800 --> 00:04:48.879 Do I know what you're talking about back So as 94 00:04:49.160 --> 00:04:52.279 as as a person who burns all of his comms, 95 00:04:52.959 --> 00:04:56.720 I don't know how. Even having the backup keys, they 96 00:04:56.759 --> 00:04:58.800 might allow you into the conversation, but they're not going 97 00:04:58.839 --> 00:05:02.040 to historically pull every thing. So that's another thing, is 98 00:05:02.079 --> 00:05:03.160 just sort of general. 99 00:05:02.920 --> 00:05:04.560 But most people don't burn their. 100 00:05:04.519 --> 00:05:08.399 Keys, exactly general cyber hygiene. If you're using signal, no. 101 00:05:08.519 --> 00:05:11.680 Two things, and this I would say is the takeaway. 102 00:05:12.079 --> 00:05:13.959 One Signal is never going to reach out to you 103 00:05:14.000 --> 00:05:16.560 over signal, so don't give them that. If they don't 104 00:05:16.560 --> 00:05:19.360 give them backup codes, don't give them anything whoever is 105 00:05:19.399 --> 00:05:23.120 reaching out to you. And and number two set up 106 00:05:23.399 --> 00:05:25.920 set up your conversations with like even if you worried, 107 00:05:25.959 --> 00:05:27.439 oh well, I got to go back to this and whatever, 108 00:05:27.480 --> 00:05:29.680 set it up with a four week burn right. Once 109 00:05:29.720 --> 00:05:32.720 a month, the conversation just falls off. There's no reason 110 00:05:32.759 --> 00:05:34.399 to keep that amount of history in there now. 111 00:05:34.480 --> 00:05:38.040 Yeah, So what is the app snapchat that automatically deletes 112 00:05:38.079 --> 00:05:40.879 things after you know whatever immediately. 113 00:05:41.199 --> 00:05:43.360 I think that was the original thing, right, that. 114 00:05:43.360 --> 00:05:45.240 Was the original idea. Yeah, and I know my kids 115 00:05:45.240 --> 00:05:48.279 are crazy about it. And maybe because they felt like 116 00:05:48.439 --> 00:05:52.279 they couldn't get you know, snagged sending stuff to their 117 00:05:52.319 --> 00:05:55.439 friends that their parents would find conjectional. I don't know, 118 00:05:56.240 --> 00:05:59.720 but so you know that it could be built right 119 00:05:59.720 --> 00:06:02.160 in and with signal. It's just an option. 120 00:06:02.279 --> 00:06:04.480 Before we move on. One of the things that you 121 00:06:04.560 --> 00:06:06.560 have to do. And the reason why I went looking 122 00:06:07.000 --> 00:06:09.480 for something other than signal. I do like signal. I 123 00:06:09.480 --> 00:06:13.879 still use signal. It's you can't rest on this stuff. 124 00:06:13.920 --> 00:06:17.720 You have to constantly be waiting for and evaluating the 125 00:06:17.759 --> 00:06:21.920 next thing. So when the next state of the art comes. 126 00:06:22.120 --> 00:06:24.079 Think about some of the things that we've looked at. 127 00:06:24.240 --> 00:06:27.360 There are firewalls that were state of the art, best technology, 128 00:06:27.439 --> 00:06:31.079 and now they're almost a running joke on this podcast. 129 00:06:31.600 --> 00:06:34.399 We've standardized on some of those firewalls. We moved off 130 00:06:34.439 --> 00:06:36.839 of them before they became Swiss cheese. 131 00:06:37.439 --> 00:06:39.399 It's the same reason that you want to replace your 132 00:06:40.199 --> 00:06:43.439 mechanical hard drives well in advance of them failing. 133 00:06:43.519 --> 00:06:47.240 Yeah, oh absolutely, mechanical hard drives. Yeah, I meantime to 134 00:06:47.360 --> 00:06:50.240 failure what's crazy? Who does that? Right? 135 00:06:51.399 --> 00:06:54.399 So, I mean signal is an interesting one. It's not 136 00:06:54.480 --> 00:06:56.480 like the next story's last pass or something like that. 137 00:06:56.560 --> 00:06:59.079 Right. Well, as a matter of fact, Patrick, it is 138 00:06:59.360 --> 00:07:03.600 a lot what last pass confirms data breach in clue 139 00:07:03.800 --> 00:07:07.120 k l u E supply chain attack. And you know 140 00:07:07.480 --> 00:07:10.439 when we thought about stories that we should omit, this 141 00:07:10.800 --> 00:07:13.519 was the top of the list because nobody uses last 142 00:07:13.519 --> 00:07:15.639 pass anymore, right, but apparently people do. 143 00:07:15.920 --> 00:07:18.319 Yeah, I mean it's the last pass word thing you 144 00:07:18.319 --> 00:07:22.600 should use. Yes, throwing that just throwing that out there. 145 00:07:24.199 --> 00:07:33.160 Maybe it's prophetic, pathetic, pathetic, prophetic, pathetic, pathetically prophetic. Yeah, 146 00:07:33.199 --> 00:07:37.160 this this is a this is a compromises ultimately as 147 00:07:37.199 --> 00:07:38.120 a supply chain attack. 148 00:07:38.279 --> 00:07:38.399 Right. 149 00:07:39.399 --> 00:07:43.079 So, in this particular issue, last pass got hit through 150 00:07:43.199 --> 00:07:46.680 what they call clue k l u E, which is 151 00:07:46.680 --> 00:07:50.399 a third party market intelligence platform clue dot piece of software. 152 00:07:50.480 --> 00:07:54.199 I thought the problem was not having no in this case, 153 00:07:54.279 --> 00:07:59.680 the problems having clue. Apparently, so the Icarus extortion group 154 00:08:00.120 --> 00:08:03.360 stole oh off tokens to clue or that clue held 155 00:08:04.639 --> 00:08:08.079 and then was able to then compromise and get inside 156 00:08:08.160 --> 00:08:12.600 of sales force and start reading information out of salesforce 157 00:08:13.560 --> 00:08:16.959 that is associated with last Pass. So really, this isn't 158 00:08:17.040 --> 00:08:20.120 like somebody attacking your personal vault or somebody pulling your 159 00:08:20.120 --> 00:08:23.639 passwords or having access to the things that your vault has. Right, 160 00:08:23.680 --> 00:08:25.959 So we've talked about those things in the past, right 161 00:08:26.000 --> 00:08:30.279 where Last Pass has had these issues, and you know, 162 00:08:30.439 --> 00:08:34.000 things weren't safe there, especially side metadata and those sort 163 00:08:34.039 --> 00:08:35.840 of things notes kept in last past. 164 00:08:36.159 --> 00:08:38.879 I just want to make an observation here. When you're 165 00:08:38.919 --> 00:08:42.440 reading these articles, it's okay to feel like you're watching 166 00:08:42.559 --> 00:08:45.879 Star Trek and they're talking crazy stuff like you don't 167 00:08:46.279 --> 00:08:48.919 you don't even care about what it is. You kind 168 00:08:48.919 --> 00:08:52.080 of get the gist. But here's the actual sentence from here, 169 00:08:52.600 --> 00:08:55.080 and it might just be me that's dumb. The investigation 170 00:08:55.159 --> 00:08:57.159 of the incident did not reveal any evidence that the 171 00:08:57.200 --> 00:09:04.399 attacker accessed Gong related which typically includes customer calls and 172 00:09:04.440 --> 00:09:11.679 emails and b what Gong related This first time I've 173 00:09:11.720 --> 00:09:14.399 heard of Gong related data Gong analytics. 174 00:09:15.480 --> 00:09:23.000 So it's it's marketing intelligence stuff. Okay, So emails, messages 175 00:09:23.679 --> 00:09:25.960 all kind of come under that at Gong platform. 176 00:09:26.120 --> 00:09:29.720 Okay, So they list customer names, phone numbers, and email addresses, 177 00:09:29.720 --> 00:09:34.200 physical addresses support case information and sales or CRM related data. 178 00:09:34.440 --> 00:09:35.440 Yeah, I mean, is. 179 00:09:35.440 --> 00:09:39.480 Gong like a subsidiary, like like a lesser PII. Is 180 00:09:39.480 --> 00:09:41.759 it that category or is it an actual technology? 181 00:09:42.240 --> 00:09:43.960 No, it's an actual technology. 182 00:09:44.320 --> 00:09:46.720 Yeah, it doesn't appear to be an acronym. 183 00:09:46.840 --> 00:09:49.440 Yeah, no, no, no, it's not here. 184 00:09:50.240 --> 00:09:51.559 I mean I used to watch the Gong show. 185 00:09:52.080 --> 00:09:55.440 Yeah, right, that's right. Gene Gene Dancing Machine is my favorite. 186 00:09:55.639 --> 00:09:57.840 Yeah, here you go. You've probably heard of the term 187 00:09:58.159 --> 00:10:02.200 revenue intelligence floating around, and the name Gong almost always 188 00:10:02.200 --> 00:10:04.600 comes up with it. It's the big name in sales 189 00:10:04.679 --> 00:10:07.759 tech promising to pull back the curtain on what's really 190 00:10:07.759 --> 00:10:11.360 happening in your customer conversations. So it looks like it's 191 00:10:11.399 --> 00:10:13.200 a piece of software that helps with that. 192 00:10:13.600 --> 00:10:15.120 This is like tracking, you know. 193 00:10:15.240 --> 00:10:18.360 So not Gong data. No, Gong data was fine, which 194 00:10:18.399 --> 00:10:21.399 I guess is good. So what should our users expect 195 00:10:22.440 --> 00:10:27.240 because okay, my password vault wasn't compromised, although some salesforce 196 00:10:27.320 --> 00:10:31.639 data might have been. I would say expect more phishing 197 00:10:31.679 --> 00:10:32.919 and social engineering attacks. 198 00:10:32.960 --> 00:10:34.919 But your your keys are safe. 199 00:10:34.639 --> 00:10:36.519 For now unless you give them away, as safe as 200 00:10:36.559 --> 00:10:39.440 they can be with less Yeah, exactly, right, So expect 201 00:10:39.440 --> 00:10:42.320 you're going to get emails from say the fake Last 202 00:10:42.360 --> 00:10:44.159 Pass saying oh, we're so sorry, we know there was 203 00:10:44.200 --> 00:10:45.799 a breach, blah blah blah, give us your key so 204 00:10:45.840 --> 00:10:47.279 we can validate it to you or whatever. 205 00:10:47.480 --> 00:10:50.399 Don't fall for We never know when we're twenty four 206 00:10:50.440 --> 00:10:55.720 hours away from one password or Bitwarden being completely humiliated 207 00:10:55.720 --> 00:10:59.080 and completely eviscerated. We don't know. It's just Last Pass 208 00:10:59.200 --> 00:11:01.799 has this record of being in the news in ways 209 00:11:01.799 --> 00:11:02.639 that were unflattering. 210 00:11:03.000 --> 00:11:05.320 Well, for a while, they far more often. Yeah, for 211 00:11:05.360 --> 00:11:07.879 a while they were being they got like two or 212 00:11:07.919 --> 00:11:11.000 three hacks in a row. Is just like boom, boom boom. 213 00:11:11.399 --> 00:11:14.120 And that's when I said, anyway, all right, that's it. 214 00:11:14.399 --> 00:11:14.919 I'm done. 215 00:11:15.159 --> 00:11:18.519 Yeah, it's it's not that you can't be safe with them, 216 00:11:19.000 --> 00:11:21.360 it's that what is it. Jimmy the Greek used to say, 217 00:11:21.399 --> 00:11:22.840 the race is not always to the swift, No, the 218 00:11:22.879 --> 00:11:24.879 fight to the strong. But that's the way to bet right. 219 00:11:26.360 --> 00:11:28.840 And and you know, if if you have indicators of. 220 00:11:28.799 --> 00:11:30.120 Who's Jimmy the Greek. 221 00:11:30.399 --> 00:11:34.240 Jimmy the Greek, he was a famous handicapper back in 222 00:11:34.279 --> 00:11:36.320 the day when you know, horse racing was on TV 223 00:11:36.480 --> 00:11:36.840 and they. 224 00:11:36.759 --> 00:11:37.879 Were only three channels. 225 00:11:38.039 --> 00:11:39.399 Who yeah, you. 226 00:11:39.360 --> 00:11:40.360 Know when I was in my forties. 227 00:11:40.480 --> 00:11:42.639 I mean, you guys predate me. I'm a youngster. So 228 00:11:42.840 --> 00:11:44.960 I'm just saying, was that is that an old timey thing? 229 00:11:45.000 --> 00:11:45.840 I would never date you? 230 00:11:46.080 --> 00:11:48.399 They talked about Jimmy the Greek on the Rockford Files. 231 00:11:48.440 --> 00:11:49.559 That's right, that's. 232 00:11:49.399 --> 00:11:52.559 How old it was, right, Okay, all right? 233 00:11:52.879 --> 00:11:56.440 And you know with Bitwarden, it's it's actually good that 234 00:11:56.919 --> 00:11:59.919 because it's if it gets hacked, really all you have 235 00:12:00.080 --> 00:12:04.320 to do is change your master password, and you're probably okay. 236 00:12:04.399 --> 00:12:08.960 And here's why, because if the all of the other 237 00:12:09.039 --> 00:12:12.559 passwords or whatever are only accessible if the master password 238 00:12:12.600 --> 00:12:15.799 is there, and I know, at least on the phone, 239 00:12:16.759 --> 00:12:20.279 they ask you for your master password after like one 240 00:12:20.360 --> 00:12:24.679 minute of inactivity or two minutes of inactivity, So somebody 241 00:12:24.799 --> 00:12:27.320 actually has to be logged in as you in your 242 00:12:27.360 --> 00:12:30.559 browser and you know, logged in with a cookie or 243 00:12:30.600 --> 00:12:33.759 something in order to hack it. But if somebody just 244 00:12:33.799 --> 00:12:37.000 gets your old master password, they can't access all the 245 00:12:37.039 --> 00:12:37.879 other passwords. 246 00:12:38.000 --> 00:12:41.559 A keylogger would be the problem. And if especially a keylogger, 247 00:12:41.559 --> 00:12:44.320 that gave them them the ability to download your vault. Right, 248 00:12:44.399 --> 00:12:45.440 But that's game over anyway. 249 00:12:45.679 --> 00:12:48.440 Yeah, well that's true, you know, but the first thing 250 00:12:48.600 --> 00:12:52.519 is master password, kill that and then go change all 251 00:12:52.559 --> 00:12:55.919 your passwords, which could take days. Yeah, I ask me 252 00:12:55.960 --> 00:12:56.360 how I know? 253 00:12:56.559 --> 00:12:59.639 You know it's not a bad idea every week to 254 00:12:59.799 --> 00:13:04.879 change a password or to a day, just one a day, 255 00:13:05.159 --> 00:13:08.279 just want to day and you'll eventually in five years 256 00:13:08.320 --> 00:13:09.120 they'll all be changed. 257 00:13:09.279 --> 00:13:15.159 Right. And also have you what is or just have 258 00:13:15.240 --> 00:13:17.000 open claw do it for you because. 259 00:13:17.360 --> 00:13:20.960 Use the same password for there there wait a minute 260 00:13:20.960 --> 00:13:22.080 that there's a. 261 00:13:22.320 --> 00:13:25.440 I know right there is a I was trying to 262 00:13:25.440 --> 00:13:28.279 think of which which password manager it is? There's a 263 00:13:28.279 --> 00:13:30.919 password manager talking about right now having the ability to 264 00:13:31.000 --> 00:13:36.240 change your passwords, like literally go out and systematically once 265 00:13:36.279 --> 00:13:38.240 a week change your passwords. I can't remember whether there 266 00:13:38.279 --> 00:13:42.039 was one password or whether it was the Microsoft password vaults. 267 00:13:42.080 --> 00:13:44.840 And there's there's there. I think that's coming. I think 268 00:13:44.879 --> 00:13:47.399 you're going to start to see artificial intelligence going out 269 00:13:47.440 --> 00:13:50.200 and changing your passwords. The problem there is allowing the 270 00:13:50.200 --> 00:13:55.639 ANI to pick your password in that sometimes it may 271 00:13:55.639 --> 00:13:57.519 be predictable, right. 272 00:13:57.440 --> 00:13:59.960 And the problem is it's an AI, like you can't 273 00:14:00.159 --> 00:14:03.120 download the source code and inspect it for bad stuff. 274 00:14:03.399 --> 00:14:06.120 Nope, yeah, be nice though, it would be nice if 275 00:14:06.120 --> 00:14:06.600 you could do that. 276 00:14:07.559 --> 00:14:10.919 All right, let's move on. Claude moves to the dark side. 277 00:14:11.000 --> 00:14:13.799 What a rogue coding agent could do inside your org? 278 00:14:14.120 --> 00:14:17.960 And this is kind of a just a public service announcement, 279 00:14:18.240 --> 00:14:21.919 Claude Ball. 280 00:14:20.240 --> 00:14:21.879 That's kind of like what could what could a serial 281 00:14:21.960 --> 00:14:22.960 killer do in your kitchen? 282 00:14:24.000 --> 00:14:24.240 Yeah? 283 00:14:24.279 --> 00:14:28.679 Exactly a lot, right, right, Although it's you know, it 284 00:14:28.759 --> 00:14:32.559 is interesting in that, you know, Okay, we've seen attackers 285 00:14:33.039 --> 00:14:34.639 and we talked about this, I think it was in 286 00:14:34.720 --> 00:14:38.320 November where we said, hey, this is the first attack 287 00:14:38.399 --> 00:14:42.320 we've seen some sort of full scale from Chinese actors. Yes, 288 00:14:42.639 --> 00:14:47.039 the leveraging Anthropics models, and they had it. They had 289 00:14:47.080 --> 00:14:49.919 it really a pipeline, and we talked about this all 290 00:14:49.960 --> 00:14:56.159 the time. Listen, glass Wing, whatever, fable, mythos, GPT five 291 00:14:56.679 --> 00:15:00.720 four whatever, it doesn't matter, right, Yeah, the model itself 292 00:15:00.759 --> 00:15:05.440 is great at a part of an attack. It's really 293 00:15:05.519 --> 00:15:08.480 the pipeline that matters. Yeah, right, So in this case 294 00:15:08.519 --> 00:15:11.720 that the novel part of this attack isn't the fact 295 00:15:11.720 --> 00:15:13.919 that they were using a n l M, right, that 296 00:15:14.039 --> 00:15:15.919 there are plenty lms they could use to do this. 297 00:15:16.600 --> 00:15:19.840 It was the fact that they were able to pipeline 298 00:15:19.919 --> 00:15:25.559 it successfully and start from from start to finish not 299 00:15:25.600 --> 00:15:29.039 only get target acquisition, but then also get control over companies. 300 00:15:29.080 --> 00:15:30.679 That's that's really this story. 301 00:15:30.799 --> 00:15:35.159 But how did it happen? Was it just human irresponsibility 302 00:15:35.200 --> 00:15:36.240 that allowed it to happen? 303 00:15:36.440 --> 00:15:36.559 Now? 304 00:15:36.759 --> 00:15:36.840 Not? 305 00:15:36.960 --> 00:15:40.279 Really? This was so okay, all of your lms are 306 00:15:40.279 --> 00:15:42.279 going to have guardrails against this, right right, all the 307 00:15:42.399 --> 00:15:44.679 l Well, they're going to try to you. Yeah, I 308 00:15:44.720 --> 00:15:48.759 can tell you personally. Uh wait, No, I can't tell 309 00:15:48.759 --> 00:15:50.600 you that. Never mind, No, I can't. I tell you. 310 00:15:51.480 --> 00:15:53.559 I tell you personally. It's not very hard. 311 00:15:53.679 --> 00:15:55.960 Button really works, Carl, thanks you. I know, it just 312 00:15:56.000 --> 00:15:57.559 gives them a mild electric shock. 313 00:15:57.799 --> 00:16:03.960 Yeah, I got you. I just apologize. 314 00:16:05.919 --> 00:16:09.240 Uh no, I can't tell you. It's very easy to 315 00:16:09.399 --> 00:16:14.519 convince even the frontier models, you know that, that it 316 00:16:14.679 --> 00:16:18.200 is a pen tester helping you out with a pen test. Yeah, 317 00:16:18.240 --> 00:16:19.879 And a lot of them will come back with, oh, well, 318 00:16:19.879 --> 00:16:21.679 I can't generate that code, or I can't run that 319 00:16:21.759 --> 00:16:24.720 code and talk to it long enough, and it will 320 00:16:24.759 --> 00:16:28.399 be just another member on the team, right, Yeah, yeah, 321 00:16:28.480 --> 00:16:29.840 here's here's a code for that. 322 00:16:30.080 --> 00:16:32.120 Or you know, well, I'm glad you said that, because 323 00:16:32.120 --> 00:16:34.600 when I read this article, it sounded to me like, 324 00:16:34.639 --> 00:16:36.639 you know what, when you watched like the morning news 325 00:16:37.240 --> 00:16:40.120 and they have a segment at the end that says, boy, 326 00:16:40.120 --> 00:16:42.320 it's going to be really hot today. We brought in 327 00:16:42.360 --> 00:16:46.360 a specialist, a doctor to tell you how you can, 328 00:16:46.600 --> 00:16:49.360 you know, stay safe during the heat wave. And the 329 00:16:49.399 --> 00:16:53.799 guy basically says, stay out of the sun, drink plenty 330 00:16:53.840 --> 00:16:57.639 of water, right, you know, take your temperature, don't do 331 00:16:57.679 --> 00:17:01.200 stupid on nine one if you're dizzy, like the dumbest stuff, 332 00:17:01.440 --> 00:17:02.000 stay away. 333 00:17:02.080 --> 00:17:02.759 Fire bad. 334 00:17:03.120 --> 00:17:06.039 Yeah, yeah, fire bad. Right. So that's kind of the 335 00:17:06.119 --> 00:17:09.200 impression I got when I read this skim this article. 336 00:17:09.240 --> 00:17:10.119 But I'm glad that you. 337 00:17:10.920 --> 00:17:13.359 Yeah, it is. It's interesting because I get this a 338 00:17:13.359 --> 00:17:15.000 lot where people are like, oh my god, the ais 339 00:17:15.000 --> 00:17:17.240 are going to attack, and it's like the eyes are 340 00:17:17.240 --> 00:17:19.960 great at a step in the process. Yeah, it's the 341 00:17:20.000 --> 00:17:23.440 whole pipeline, the stringing them together. That that's really where 342 00:17:23.440 --> 00:17:26.599 you need to worry. And it's whoever is the best 343 00:17:26.640 --> 00:17:29.359 at stringing these together, yeah, is going to have the 344 00:17:29.400 --> 00:17:30.279 advantage for a while. 345 00:17:30.319 --> 00:17:32.319 So anyway, it's a good read. We recommend you read it. 346 00:17:32.599 --> 00:17:33.839 Spoiler alert we're the best. 347 00:17:34.240 --> 00:17:38.599 Yeah. Wait, fat forgot That's what I was not supposed 348 00:17:38.599 --> 00:17:39.880 to be able to say. So there you go. 349 00:17:40.319 --> 00:17:41.720 No, I put a marketing spin on it. 350 00:17:41.799 --> 00:17:42.240 Oh, thank you. 351 00:17:42.480 --> 00:17:43.160 I think it works. 352 00:17:44.000 --> 00:17:44.680 I think all right. 353 00:17:44.720 --> 00:17:47.279 So the next one is about oracle over nine hundred 354 00:17:47.440 --> 00:17:51.640 oracle E business instance is exposed to ongoing attacks. It's 355 00:17:51.640 --> 00:17:53.680 not a whole lot, but it's worth mentioning. 356 00:17:53.960 --> 00:17:56.839 I mean, but they're big companies, they're big people who 357 00:17:56.839 --> 00:17:59.559 buy oracle E business services. I think it's I don't. 358 00:17:59.599 --> 00:18:01.519 I think it's they're not small. Yeah, they're not small. 359 00:18:01.640 --> 00:18:02.240 They're not small. 360 00:18:02.319 --> 00:18:04.279 It's not it's not your local gas station. 361 00:18:04.440 --> 00:18:04.640 Yeah. 362 00:18:04.839 --> 00:18:04.960 Uh. 363 00:18:05.160 --> 00:18:11.799 And the problem here is, uh, this is a critical onnauthentication, 364 00:18:12.319 --> 00:18:16.839 unauthenticated flaw that can completely take over the system that 365 00:18:16.960 --> 00:18:21.240 has low complexity and needs no off so so high 366 00:18:21.519 --> 00:18:24.319 contagion score Yeah, CBS S and nine to eight not 367 00:18:25.119 --> 00:18:27.759 super small and the fact that these are exposed on 368 00:18:27.759 --> 00:18:32.279 the Internet really jacks up the security this week's score 369 00:18:32.519 --> 00:18:34.599 right right to be pretty close to that. 370 00:18:35.480 --> 00:18:36.200 No, is Blane. 371 00:18:36.279 --> 00:18:38.079 You know what's funny is so we started this security 372 00:18:38.119 --> 00:18:40.000 this week's score and part of my metric in the 373 00:18:40.039 --> 00:18:42.200 past has always been how hard is it to exploit? 374 00:18:42.400 --> 00:18:42.599 Right? 375 00:18:42.720 --> 00:18:42.920 Right? 376 00:18:43.920 --> 00:18:47.200 You know, how how how easily can you be affected 377 00:18:47.200 --> 00:18:47.519 by it? 378 00:18:47.640 --> 00:18:49.799 Correct? Yeah? If it's on the internet, okay, yeah, that 379 00:18:49.799 --> 00:18:51.720 gives that jacks it up a little bit. Right. If 380 00:18:51.720 --> 00:18:53.799 it's a private land, Okay, that jacks it down a 381 00:18:53.839 --> 00:18:55.960 little bit. If it's you know, you had to do 382 00:18:56.000 --> 00:19:00.000 some sort of real computer gymnastics, trampolines and egg hunters 383 00:19:00.000 --> 00:19:01.799 and all sorts of stuff. Jack sit back up, but 384 00:19:02.000 --> 00:19:03.759 you know, jack it back down a little bit, if. 385 00:19:03.640 --> 00:19:05.960 You already had to get over the firewall. 386 00:19:05.759 --> 00:19:06.480 Yeah, exactly. 387 00:19:06.640 --> 00:19:07.279 Yeah. Yeah. 388 00:19:07.319 --> 00:19:09.920 And how probabilistic is it that that's kind of thing? 389 00:19:10.279 --> 00:19:11.319 How much noise would it be? 390 00:19:11.480 --> 00:19:13.839 I would say a lot of that. Those metrics have 391 00:19:13.920 --> 00:19:17.160 started to change with artificial intelligence, right right. We started 392 00:19:17.160 --> 00:19:19.079 to see I think it was two weeks ago we 393 00:19:19.119 --> 00:19:23.599 reported on a story uh this, I think they called 394 00:19:23.640 --> 00:19:30.119 him a junior junior exploit guy, a junior hacker leveraged 395 00:19:30.160 --> 00:19:32.759 an AI to break into a bunch of you know, 396 00:19:32.839 --> 00:19:38.039 autumn auto mechanic sites, right and maintain persistence and that 397 00:19:38.079 --> 00:19:39.839 sort of stuff. And they were like, literally, this kid 398 00:19:39.839 --> 00:19:42.440 doesn't seem to know what he's doing, but was able 399 00:19:42.480 --> 00:19:45.680 to do that leveraging AI so I could see you know, 400 00:19:45.720 --> 00:19:48.200 our store, our scores probably get a little higher now 401 00:19:48.200 --> 00:19:50.039