Speaker 1: Hey, Carl here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes,
Speaker 1: Spotify or wherever you get Security this week. Also, you
Speaker 1: can get an ad free feed by becoming a five
Speaker 1: dollars a month patron. Go to Patreon dot Security this
Speaker 1: week dot com and sign up, and don't forget Discord.
Speaker 1: Discord dot Security this week dot com. Lots of good
Speaker 1: stuff happening there. Yeah, I think that's it. So on
Speaker 1: with the podcast. Do you guys have autocorrect on your
Speaker 1: phones or do you turn it off?
Speaker 2: I think I still have it all minds on still unfortunately, Yeah,
Speaker 2: it's become my worst enema. Glad to hear it. You're
Speaker 2: putting in the wrong place, car O.
Speaker 1: Hey, welcome back to Secure Al this week. I'm Carl Franklin,
Speaker 1: that's Dwayne Laflott and Patrick Hines, and we have a
Speaker 1: whole bunch of stories today, so let's get through them.
Speaker 1: Number one, the Register says Oracle drops almost fifteen hundred
Speaker 1: security patches like it's the new normal. Slow week, the
Speaker 1: era of AI bug hunting is here, so defenders will
Speaker 1: simply have to adapt to busier workloads.
Speaker 2: This sucks, and it's true. So here's the deal. Take
Speaker 2: really really really large organizations, Microsoft, Oracle, you know, anybody,
Speaker 2: anybody who's been creating software for the last I don't know,
Speaker 2: three decades. Right, there's probably just a small bit of
Speaker 2: technical debt in there. Yeah, just a little bit, right,
Speaker 2: just like technical bankruptcy exactly. Just Hey, there's bugs in
Speaker 2: here that we're hoping nobody will ever find or that
Speaker 2: they don't even know about. You know, Windows has a
Speaker 2: gajillion of them, right, right, So this is this is
Speaker 2: going to be the normal. Right, We're starting to see
Speaker 2: the harnesses and the pipelines on artificial intelligence exploitation discovery
Speaker 2: be very very sophisticated and very very good. And and
Speaker 2: you know, Oracle now running these pipelines. I think they
Speaker 2: had said this was a Mythos pipeline, but I can't remember.
Speaker 2: But against their you know, against their own code. Yeah,
Speaker 2: they're going to find thousands of issues. I think I
Speaker 2: think the part of glass Wing, yeah, I think they were.
Speaker 2: But so it's not a surprise. And Oracles like listen,
Speaker 2: you know, you know the registers. Yeah, the register's like okay,
Speaker 2: like you know this. The thing that sucks about this
Speaker 2: is the poor administrators who now have to apply this patch,
Speaker 2: test it, make sure it actually works, and roll it
Speaker 2: out patches four nine of them.
Speaker 3: I mean, there's smoke testing. Let's be let's be realistic.
Speaker 3: All they're doing is saying does it still open? Yeah,
Speaker 3: they're not testing functionality. It probably covers seventy percent of
Speaker 3: the surface here area of the code.
Speaker 2: Right, and then you say to yourself, well, what's the
Speaker 2: risk of doing well, first off, if you did ten
Speaker 2: a day, it still would take you years. But what's
Speaker 2: the risk of of you know, not applying those patches
Speaker 2: right right now? You're you're in that. I don't know,
Speaker 2: there's there's all these patches are out now. Practice. I
Speaker 2: guarantee you, you know, I guarantee you in a short order,
Speaker 2: there are going to be attackers who have already weaponized
Speaker 2: each and every one of these exploits. Yeah, yeah, what's that?
Speaker 3: What's the name of that website is zero day dot com,
Speaker 3: zero day clock, zero oi clock dot com. It's they're
Speaker 3: talking about hours from when vulnerability becomes known to when
Speaker 3: it becomes attacked.
Speaker 2: Once they have a patch, it's known.
Speaker 3: Yeah, because the AI and and can reverse engineer it
Speaker 3: pretty pretty easily.
Speaker 2: Now you might say, well.
Speaker 3: There they're guardrails against that open weights and there's you know,
Speaker 3: tricks in the trade and.
Speaker 2: All sorts of you're adorable. That's adorable.
Speaker 1: I remember guardrails. Uh we couldn't ask chat GPT how
Speaker 1: to make the Maltov cocktail and unless that. It was
Speaker 1: my grandmother's recipe and she used to read it to
Speaker 1: me every night before bed.
Speaker 2: She was from Malta. That's where Maltav cocktails come from.
Speaker 2: Uh so yeah, yeah, the zero dey clock is slays.
Speaker 2: I remember when, gosh, what was it, I don't know,
Speaker 2: a year ago, all those guardrail companies were like the
Speaker 2: evaluations on them were insane. Now people are like, we
Speaker 2: can't protect it anyways.
Speaker 1: Really. Yeah. So there's there's going to be a theme
Speaker 1: woven throughout all of these stories, I think, and maybe
Speaker 1: not all of them, but most of them are kind
Speaker 1: of bs.
Speaker 2: We're doomed. That's that's the theme. Well, this is is
Speaker 2: a little bit of.
Speaker 3: The blarnie, the exaggeration, right, that needs to be understood.
Speaker 3: I think that's the way, let's put it nicely, like.
Speaker 1: This story about Oracle, it's actually good news. It is. Yeah, yeah,
Speaker 1: so it's.
Speaker 2: Not, and that's why we opened with it. It's all downhill
Speaker 2: from here, people. Yeah, that's all right.
Speaker 1: Next one, Shiny Hunters data leaks fuel two thousand dollars
Speaker 1: sextortion email scam.
Speaker 2: Shiny Hunters, I've never heard of them, who were they?
Speaker 1: I've never heard of sex stortion, but I'm going to
Speaker 1: start using that word.
Speaker 2: In every story. Extortion. So the Shiny Hunters. We all
Speaker 2: know the Shiny Hunters. They've been in the news several times.
Speaker 2: They are super active. But that the interesting thing about
Speaker 2: this one is it it kind of tries to call
Speaker 2: this the Shiny Hunters out. It's really a data leak
Speaker 2: from them specifically, So they leaked some data online. Their
Speaker 2: typical tactic is like, listen, you know, Verizon, we have
Speaker 2: all this data we stole from you, and if you
Speaker 2: don't pay us, we're going to leak that data online. Right,
Speaker 2: So it happened, right, they leaked some data online. I'm
Speaker 2: not saying it was verse and I'm just saying this
Speaker 2: sort of their normal tactic. Some entrepreneur picked it up
Speaker 2: that leak of email address and whatnot, and decided I
Speaker 2: can make a quick buck on this and started sending
Speaker 2: out emails to the people in that list saying, hey,
Speaker 2: you know your data was in a breach and we
Speaker 2: have access to your phone and we've turned on your cameras. Yeah,
Speaker 2: and we caught you being naughty, caught you doing things
Speaker 2: you shouldn't be doing on sites you shouldn't be visiting it,
Speaker 2: and blah blah blah blah.
Speaker 3: They're really only getting the guilty conscience crowd.
Speaker 2: Yeah, exactly. Yeah, although I will tell you, Patrick, I
Speaker 2: can't tell you how many times I've had people call
Speaker 2: me up in a panic and go, oh my god,
Speaker 2: I just got this thing, and I think they know.
Speaker 2: I'm like, all right, first off, you.
Speaker 1: Know everybody knows exactly.
Speaker 3: First off, how's Grandpa?
Speaker 1: Well?
Speaker 2: Patrick, So I needless to say, Yeah, this is this
Speaker 2: is just a this is another social engineering manipulation. Yeah,
Speaker 2: trying to steal two thousand dollars in bitcoin from as
Speaker 2: many people as they possibly can.
Speaker 3: So how hard is it to do? What they said?
Speaker 3: Just based on So basically they say, oh, we got
Speaker 3: your email address, and then we suddenly got you into
Speaker 3: your email and then we suddenly fished you.
Speaker 2: It's yeah, not a thing. I mean, it's possible, all right,
Speaker 2: you could do it.
Speaker 3: If I had your email address, I could send you
Speaker 3: a phishing email. But hook in the phone is difficult.
Speaker 2: Sure, if you have my email address, you could send
Speaker 2: me a fishing email. Getting on the phone is hard,
Speaker 2: and not only getting on the phone, but then getting
Speaker 2: access to video, like you actually the camera. I mean, listen,
Speaker 2: we all have those those fears, right like, oh geez,
Speaker 2: people are watching me over my camera. I will tell
Speaker 2: you hardware vendors are. It's one of the things they
Speaker 2: worry about too. And there's a reason. There's those lights
Speaker 2: on the camera and a lot of them are hardwired too.
Speaker 2: When the power of the camera fires up, it turns
Speaker 2: that led on and you see it, right, there's not
Speaker 2: really an easy way to bypass those things. So you know,
Speaker 2: for them to turn on your camera and turn on
Speaker 2: your microphone and not have you notice it. It's it
Speaker 2: can be done. Don't get me wrong.
Speaker 1: It has been done, hasn't it.
Speaker 3: It has even just getting to the point where you
Speaker 3: can do it, even if without the like worrying about
Speaker 3: not being discovered is a pretty big task, it's a
Speaker 3: pretty big lift.
Speaker 2: Yeah. Absolutely, And a lot of times, I'll tell you
Speaker 2: as a guy who's designed rats for mobile devices.
Speaker 3: Like remote access trojans.
Speaker 2: Yeah, so where we've tried to get something installed on
Speaker 2: somebody's phone that would hide in the background and fire
Speaker 2: up the camera and fire up the mic and listen
Speaker 2: and blow blahah whatever. There's all sorts of things that
Speaker 2: happen where like if you fire up the microphone, you'll
Speaker 2: hear an audible thing or something along those lines. So's
Speaker 2: if there's background tasks doing these things. It's not as
Speaker 2: easy as you would think. Let's just put it that way.
Speaker 2: Is there a zero day you could invent to do this? Yeah? Absolutely,
Speaker 2: They're not inventing a zero day so that they can
Speaker 2: watch you on some site you shouldn't.
Speaker 1: So when the fear mongering started about that they can
Speaker 1: watch you through your video camera, laptops started coming with
Speaker 1: a little slide over the camera.
Speaker 2: Yep, right, we used to give those away. Oh yeah
Speaker 2: we did. Yeah, I mean honestly, like even the camera
Speaker 2: I use for the podcast here, it has I can
Speaker 2: I can twist yeah too, the bezel and it has
Speaker 2: it has one of those Yeah. Privacy filters to that.
Speaker 1: It all right, So okay, next story, hijackers hijack hotel
Speaker 1: Wi Fi DNS to steal Microsoft three hundred and sixty
Speaker 1: five accounts. And I would just like to say that
Speaker 1: sucks to be you because I have a Mai Fi
Speaker 1: that I used everywhere I go, right hotel, anytime I'm out,
Speaker 1: That's what I use.
Speaker 2: That's a great solution.
Speaker 3: A cheaper solution is usually a VPNY and a lot
Speaker 3: of times you can get a VPN through, like if
Speaker 3: you have a higher end firewall router, you might be
Speaker 3: a dv even VPN through it as a feature. But
Speaker 3: there's lots of different options for getting VPNs right, and
Speaker 3: that's that's would solve this problem.
Speaker 2: Yeah, I mean I think this story is like, you know,
Speaker 2: extra extra public Wi Fi's can be dangerous. Yeah, exactly,
Speaker 2: like I get it. In this particular case, they say, obviously,
Speaker 2: you know, hackers were within Wi Fi range of a
Speaker 2: hotel and they were able to get access to the
Speaker 2: Wi Fi that's provided to guests. Okay, that's not super hard.
Speaker 2: You usually get the password and it's usually something stupid, and.
Speaker 1: They could look up what the DNS server.
Speaker 2: Is yep, and then they connected to the to the router,
Speaker 2: and it says there was a weak authorization and authentication control,
Speaker 2: which probably means default username and password of admin admin.
Speaker 2: And then they changed the DNS.
Speaker 1: Or a lot of hotels will just have an open
Speaker 1: guess network that has no encryption.
Speaker 2: Yeah, but yeah, absolutely, but that's fine.
Speaker 3: Yeah, but you shouldn't have your router's admin interface on
Speaker 3: that network.
Speaker 2: No, well hell no, yeah, exactly right. But that's what's
Speaker 2: going on here. So that's what happened in this case
Speaker 2: is like, okay, they gained access to the router, they
Speaker 2: changed the DNS to point it to one of their
Speaker 2: own malicious ones, which then re routed all the users
Speaker 2: who went to office to try to go to office,
Speaker 2: you know through sixty five website to their own malicious
Speaker 2: one that could steal credential. So okay, I, like I said,
Speaker 2: I get it, Carl. You know using a Mai Fi,
Speaker 2: which for those of you don't well may not even
Speaker 2: be in the United States. You know, my Fi is
Speaker 2: small little device that we have in here in the
Speaker 2: United States is a cellular access point, a hotspot.
Speaker 1: It's like when you put your phone in tether mode
Speaker 1: or you.
Speaker 2: Know, in share yeah, exactly, share connection yep.
Speaker 1: Yeah, but it's a dedicated device.
Speaker 2: And for Patrick, like Patrick has you know, high end
Speaker 2: firewalls at his house, there are plenty of these little
Speaker 2: you know, either VPN devices. I know Unify has one,
Speaker 2: Fordet has them, firewall that has one, forda Net has one. Whatever.
Speaker 2: There's all these tiny little like hardware devices. You can
Speaker 2: literally just plug into your hotel room and will connect
Speaker 2: to the hotel Wi Fi and it will VPN automatically
Speaker 2: out to your house, so all your traffic comes off
Speaker 2: your home. So there's there's definitely solutions for this.
Speaker 3: I mean, there was even tails that you can use
Speaker 3: if you're really paranoid the government's chasing you.
Speaker 2: Yeah, and that that's kind of thing.
Speaker 1: Yep, tinfoil hats. So I have questions for you, either
Speaker 1: of you. Uh If I go to say, my local
Speaker 1: stop and shop and they have a free Wi Fi
Speaker 1: for the guests, right, and you're brought to a page
Speaker 1: where you have to click a checkbox and agree the portal.
Speaker 2: Yeah, captive portal.
Speaker 1: A captive portal, that's right? Is that any more secure
Speaker 1: than something that's just completely open with no password?
Speaker 3: I mean no, if it's the page is even presented
Speaker 3: by a legitimate Yeah, it's not, because I can put
Speaker 3: up a device that'll show you a captive portal and
Speaker 3: capture your information.
Speaker 2: Right, Yeah, it's not. I mean it's it's open. It's
Speaker 2: an open network that a.
Speaker 1: Lot of hotel wifis work like this too. You basically
Speaker 1: go to a portal, you put in your room number
Speaker 1: in your last name. Yep. Is that encrypted?
Speaker 2: No? No, I mean it can be. It could be
Speaker 2: SSL back end to the router. But think about it
Speaker 2: this way. That router that captive portal's most likely not
Speaker 2: SSL because if it was, they'd have to keep renewing
Speaker 2: the certificate over times. So most of the time they
Speaker 2: phone it in and go, whatever, you're logging in our network, right, smart?
Speaker 1: So a smart developer would use that last name and
Speaker 1: room number and make a key out of it and
Speaker 1: use that right.
Speaker 2: Yeah.
Speaker 1: But but they don't do that.
Speaker 2: No.
Speaker 3: No.
Speaker 2: For the most part, it's hey, verify against the database
Speaker 2: that there is a username and this room number so
Speaker 2: that we can give them the right access to internet.
Speaker 2: And sometimes it's redirect them to a pay portal to
Speaker 2: pay for internet or no, you're a Marriotte super user, Fine,
Speaker 2: you get access or whatever.
Speaker 1: Right, did I did I tell you about my nightmare
Speaker 1: with that? I don't think so, I don't know. I
Speaker 1: went on a vacation with my wife and we went
Speaker 1: down the East coast down to Baltimore Impact, and I
Speaker 1: think it was in New Jersey maybe that we went
Speaker 1: to this hotel and I got the Wi Fi and
Speaker 1: it was dog slow. I think I told you this.
Speaker 1: Then I had to keep clearing a cash or deleting
Speaker 1: oh yes, deleting the network and then I and then
Speaker 1: it would spin up again and I would enter my
Speaker 1: room number and all that stuff. But I had to
Speaker 1: do that every time I closed my computer because it
Speaker 1: didn't remember it remembered the crappy Wi Fi. I wanted
Speaker 1: to get on the pay Wi Fi, which was better.
Speaker 2: Yeah.
Speaker 1: So it turns out they charged me for every time
Speaker 1: I did that. Whoa, every time I logged in and
Speaker 1: said I want the pay thing, there was another twenty
Speaker 1: dollars charge or whatever. We ended up paying, like, I
Speaker 1: don't know, two hundred dollars in charges for Wi Fi
Speaker 1: and you paid it. Well, of course I paid. They
Speaker 1: took it. Yeah, but we disputed it, and you know,
Speaker 1: I can't remember if we got anywhere.
Speaker 3: But we say, hey, with that, give us their address.
Speaker 1: We'll get that.
Speaker 2: Hey, Patrick, you guys are like the am I the
Speaker 2: one who has to say you can't say those things
Speaker 2: on the air.
Speaker 1: Is that you guys are like this my real names right,
Speaker 1: No one has my real address. Fine, we're going to
Speaker 1: pay him a little.
Speaker 3: I can burn that Patrick's pseudonym anytime.
Speaker 1: So anyway, yeah, that's my Okay, that was my question,
Speaker 1: and thank you for answering it. Let's move on. In
Speaker 1: Vidia unites tech giants in open Secure AI Alliance for
Speaker 1: Cybersecurity in a list okay of twenty thirty forty. So
Speaker 1: let's let's get companies. Let's let's declare this is a
Speaker 1: sub theme.
Speaker 2: This is great, it's great.
Speaker 3: This is a sub theme. I'm going to burst your bubble.
Speaker 3: It is a sub theme. This is billion dollar companies
Speaker 3: tooting their own interests as social goods. Of course, it's
Speaker 3: so basically, and Vidia is leading the charge.
Speaker 2: And what do they want?
Speaker 3: They want the government to leave their mits off regulating
Speaker 3: open weight models. Who has the most to gain from
Speaker 3: an open weight model? In Vidia, they sell the cards
Speaker 3: that you need that the Kimmi Iree open weight model
Speaker 3: takes about a million dollars worth of video cards, just
Speaker 3: video cards to run it. You're not running that on
Speaker 3: your local desktop or rig No.
Speaker 1: Open weight means you run it on your own hardware,
Speaker 1: right correct.
Speaker 3: Open weight is basically something that could be downloaded from
Speaker 3: hugging Face and you can set it up on your own.
Speaker 3: All these companies have an interest in the proliferation of
Speaker 3: more implementations. Okay, So the ones that don't have an
Speaker 3: interest in that, most notably anthropic, have not signed up
Speaker 3: for this because anthropics like, hey, these companies are mostly
Speaker 3: training from us, right, they're distilling, they're basically, you know,
Speaker 3: illegally using our software to train their own software.
Speaker 1: We want charge people to use claude.
Speaker 3: People say, well, oh, the irony because the authors of
Speaker 3: the books that you scan didn't get that that that privilege.
Speaker 3: But that aside, it's again it's a it's a profit move.
Speaker 3: It's not necessarily an open anthropic mode. Philanthropic not anthropy.
Speaker 3: There was a there was highest level.
Speaker 1: Phil anthrophic that's the CEO of anthropic phil.
Speaker 3: Anthropic basically, it's it's they're trying to say, oh, well,
Speaker 3: if it's an open weight, you should just keep your
Speaker 3: mits off it. But if it's a closed weight, then
Speaker 3: you need to regulate it. That's that's a double standard now,
Speaker 3: especially since Kimmy and the other open weight model providers
Speaker 3: are saying theirs is just as powerful and just as good.
Speaker 1: Right, Okay, all right, So so I guess we have
Speaker 1: another sub theme here going on. It's kind of like
Speaker 1: we're complicated. Things are not what they seem.
Speaker 2: We're layered like onions.
Speaker 1: All right, Well, one more story before we have a
Speaker 1: break here. The NSA just warned everyone to reboot their routers.
Speaker 2: Oh no, good advice.
Speaker 1: What to do right now?
Speaker 2: Okay, thanks, Okay, I'm going to hit it now. Yeah, right,
Speaker 2: so this is just standard advice. I mean, we're seeing
Speaker 2: Actually we'll talk about Fordinette, but we've we've talked about
Speaker 2: Fordinett a lot. We've talked about TP a link a lot,
Speaker 2: We've talked about it. There's there's all sorts of routers
Speaker 2: out there that heck, even earlier this year, if I
Speaker 2: remember correctly, there were a lot of what they call
Speaker 2: SOHO routers, which is small office home office routers. What'd
Speaker 2: you call me that you heard me? You know, that
Speaker 2: were compromised by Russia and we're being used in a botnet. Yeah,
Speaker 2: and the FBI actually got court orders where they could
Speaker 2: log into some of those routers and fix them because
Speaker 2: there were just so many of them. They were like,
Speaker 2: you know what, we got to actually try and help here.
Speaker 2: The problem is a lot of these compromises that we
Speaker 2: we've been we've seen this year in routers. There's a
Speaker 2: lot of ways to be persistent for an attacker to
Speaker 2: stay having access to these devices. So if that's the case,
Speaker 2: you know, some of them are memory persistence, which means
Speaker 2: rebooting the device will clear it. So you do you
Speaker 2: want to just clear the device, make sure there's no
Speaker 2: h you know, if there's a username and password on
Speaker 2: your router, make sure you change that password at least
Speaker 2: once a year. Make sure your routers are always up
Speaker 2: to date, and you know, reboot it every once in
Speaker 2: a while. It's a good maintenance anyways, just to reboot it.
Speaker 3: And we've given the advice with your phone, yeah, that
Speaker 3: you should be rebooting your phone. You should be you know,
Speaker 3: you should be doing this stuff.
Speaker 1: This is all this is all not news to our listeners, yep,
Speaker 1: because they're smart, wicked, wicked smart, but so yeah, this
Speaker 1: is this. I actually have a router that automatically installs
Speaker 1: updates and reboots, and that's a really good feature to have, especially,
Speaker 1: you know, if you're that's awesome, busy playing solitaire like
Speaker 1: me all day?
Speaker 3: Who has time for those fourteen hundred patches?
Speaker 2: All right?
Speaker 1: No, I don't have an Oracle router, thanks very much.
Speaker 1: I don't think there is something.
Speaker 2: Yeah, all right, so good advice.
Speaker 1: But you knew that, right, Thank you? Tell your parents.
Speaker 3: Mean, we've been talking about this stuff. We're ahead of
Speaker 3: the NSA, been ahead for years.
Speaker 2: Apparently, that's right.
Speaker 1: All right, on that note, will take a little break,
Speaker 1: we'll be right back after these very important messages, and
Speaker 1: we're back. It's security this week. I'm Carl, that's Dwayne
Speaker 1: and Patrick. Let's talk about this next one from futurism,
Speaker 1: and it's been all over the news. A whole bunch
Speaker 1: of people's Claude chats are publicly accessible online and there's
Speaker 1: some wildly private stuff in there. Oh doesn't that sound tempting?
Speaker 1: I want to go read it?
Speaker 2: Yeah it does. Yeah. They found things like actual patient
Speaker 2: record data. They found all sorts of you know, last
Speaker 2: time there was a leak. They found things like how
Speaker 2: do I hide a body? And all sorts of weird stuff. Right,
Speaker 2: so there's wow, there's definitely some interesting conversations going on
Speaker 2: in here. For the most part, for all of you,
Speaker 2: I assume and all of our listeners have probably used
Speaker 2: an LLM at some point, right, have chat, gpt co Pilot, Gemini, Gemini.
Speaker 2: Nobody uses Gemini but anyways, so if you've used.
Speaker 1: There, you go are Google employee listeners.
Speaker 2: Techno. Nobody at Google listens to this show. So can
Speaker 2: you imagine if the the threat uh an analyst group
Speaker 2: at Google was listening to this show, it'd be just amazing.
Speaker 1: But yeah, it would be.
Speaker 2: So any of those chats I'd say probably about a
Speaker 2: maybe a year ago. There's the little menu up in
Speaker 2: the top right that you can click on and you
Speaker 2: can click share, right.
Speaker 3: I think they renamed it to cell phone not cell phone.
Speaker 2: Self phone Yeah, yes, itself or that doesn't make any sense,
Speaker 2: pone me phone Yeah, And what that does is makes
Speaker 2: a publicly accessible link for this chat, right, Well, but
Speaker 2: it's still private, right yeah, you do it on also yeah. Absolutely.
Speaker 2: The problem is then your your robots, your Google's and
Speaker 2: your whatever that crawl the Internet. They eventually find these,
Speaker 2: whether it's you know, somebody clicks on it and has
Speaker 2: a you know, an add on in their browser or whatever. Right,
Speaker 2: and yeah, exactly, once it gets found, it gets indexed,
Speaker 2: and once it gets indexed, it's public. Anybody on Google
Speaker 2: can search for it and just do that, do a
Speaker 2: Google dork for it and find it. Excuse me, you
Speaker 2: heard me a Google dork.
Speaker 3: Long story we'll talk about. Do you guys know Ron White,
Speaker 3: the comedian. Oh yeah, so do you ever hear about
Speaker 3: where he's talked about being thrown out of a bar.
Speaker 1: Yeah, that's his most famous line ever.
Speaker 3: I was not drunk in public. I was thrown into public.
Speaker 1: I was thrown out of a bar. When I say
Speaker 1: thrown out, literally picked up by the scruff of the
Speaker 1: neck and thrown out into the street.
Speaker 2: I don't know.
Speaker 3: My favorite line is I don't know how many of
Speaker 3: it was gonna take they were going to use to
Speaker 3: beat my I didn't know how many it was going
Speaker 3: to take to beat my ass, but I knew how many.
Speaker 2: They were going to use. He's a riot. Oh, so
Speaker 2: just be careful, coming back to the story, just be
Speaker 2: just be careful if you share something as a public link.
Speaker 2: Realize it's now a public link, right, you do have
Speaker 2: the ability to pull those shares back.
Speaker 3: So occasionally did the word public not like give it away?
Speaker 2: I know? Right?
Speaker 1: This falls into line with the hype theme of yes,
Speaker 1: these stories this week, and you know, and most of
Speaker 1: our listeners are like, yeah, duh. Right, So the next one,
Speaker 1: our old friend Fortinett is back in the news. SISA
Speaker 1: warns of fort forty forty OS. Al said forty as
Speaker 1: for Fortinet forty OS vulnerability exploited in attacks. Again, so
Speaker 1: is this serious or is this a kind of a yawner?
Speaker 2: This is a little bit of a yawner. This is
Speaker 2: this is a reminder of wayback when. So if you
Speaker 2: take a look at really, if we break down this article,
Speaker 2: the exploit is CVE twenty twenty five six eight six
Speaker 2: eight six, So that means this exploit was you know,
Speaker 2: given it CVE number last year. Right, how many times
Speaker 2: on this year we talked about Fortinet and having to
Speaker 2: update it because there were issues and bypasses in that
Speaker 2: sort of too many times? Right, So that's number one.
Speaker 2: Number one, you should already be patched to this. Number two.
Speaker 2: What they're saying is even patched, there is a way
Speaker 2: for attackers to maintain persistence. So if you had if
Speaker 2: you had patched and had no indicators to compromise, you'll
Speaker 2: probably find you took the suggestions, you patched, you rotated credentials,
Speaker 2: you're good. If you had just patched, didn't rotate credentials,
Speaker 2: didn't actually go in and verify that there were no
Speaker 2: indicators a compromise. There's what SISA is saying is there
Speaker 2: have evidence on Fortinet devices currently that they were patched,
Speaker 2: but beforehand the attackers were setting up persistence where they
Speaker 2: could gain access to the devices. Again. So here again,
Speaker 2: if you took our advice and patched, great, But the
Speaker 2: full advice obviously is go patch cycle your credentials and
Speaker 2: then look for indicators to compromise. In this case, this
Speaker 2: is a what they call a sim link manipulation, but
Speaker 2: it'll be in the art.
Speaker 3: Great example of why you want to be patching early
Speaker 3: not late. Yes, because the workload just goes up yep,
Speaker 3: and there are instances where it's like you can't reliably
Speaker 3: get them secure again.
Speaker 2: Yeah, that's a good point, Patrick. I've had plenty of
Speaker 2: customers come to me after a breach and go Okay,
Speaker 2: we removed the bad thing the way they got in.
Speaker 2: We could now and I'm like, I know three billion
Speaker 2: ways I would hide in these systems that you'd never
Speaker 2: find me. So no, they're like, what do we do?
Speaker 2: And I'm like, I don't know, burn it down, like
Speaker 2: rebuild it from scratch.
Speaker 1: Sometimes that's the answer.
Speaker 3: Yeah, absolutely, it's not an answer they like or usually
Speaker 3: can even physically take.
Speaker 2: So they're just living dangerously and they're like, well, can
Speaker 2: we just restore from backup? Yeah? Great, when do you
Speaker 2: do you know exactly when it was compromised, because you're
Speaker 2: gonna have to restore prior to that and make sure
Speaker 2: there wasn't somebody already in the system. So yeah, it's
Speaker 2: just it's a it's a hard task.
Speaker 1: So just as an aside, I'm looking at my recording
Speaker 1: in Riverside. Riverside FM is what we used to record,
Speaker 1: and we can see each other. We don't use it
Speaker 1: the video, but and I see this blinking red light
Speaker 1: on the wall in back of my guitar, and I'm like,
Speaker 1: what the heck is that? And I'm staring and then
Speaker 1: I see, oh, you got a blinking red light, and
Speaker 1: you've got a blinking red light in the top left corner.
Speaker 1: It just means I'm recording, but I have red walls,
Speaker 1: and this is a And I said, when did I
Speaker 1: put anything on the wall that blinks off?
Speaker 2: It's the snipers, Carl, you got a joke. It's a.
Speaker 3: It's a it's a it's a laser red finder that
Speaker 3: they just haven't decided to take you out yet.
Speaker 2: Yeah, exactly, waiting.
Speaker 1: Well, at least it's not on my Forehead's exactly.
Speaker 2: You're just going to hit the gibbs in on the wall. Uh.
Speaker 1: Okay, here's one for Patrick claude A. I just cracked
Speaker 1: a post quantum test scheme and found a faster seven
Speaker 1: round AES attack. Should we be con certain? Patrick?
Speaker 3: So, so they're talking about Hawk, which is one of
Speaker 3: the contenders to be a post quantum cryptography stalwart h
Speaker 3: A w K Yeah Hawk, not Houktua Hawk.
Speaker 2: Uh and wow, there's a callback, So it's it's a deal.
Speaker 3: I don't know that it's a big deal. So I
Speaker 3: like lattice based crystal used to be Crystal's, kiber Crystal's
Speaker 3: the lithium now mL KIM and m l dsl or
Speaker 3: d s A. Those are the ones that if they
Speaker 3: were cracked, I'd be I'd be freaked out. I don't
Speaker 3: think they're gonna be. This is not like the primary
Speaker 3: way that we were going to defend against postquonum cryptography.
Speaker 3: It was a candidate and and maybe it was close
Speaker 3: to the end, but there's a reason it didn't become
Speaker 3: a recommendation.
Speaker 2: Yeah, I was going to say, so nobody uses it. Yeah.
Speaker 2: According to the article, Hawk is the only only lattice
Speaker 2: based scheme among the nine candidates that NIST advanced to
Speaker 2: the third round of its additional post quantum Digital Signature
Speaker 2: Process additional YEP in May twenty twenty six.
Speaker 3: The first round has already been done, and that the
Speaker 3: two I mentioned are among them, and Sphinx are the
Speaker 3: ones that are the ones.
Speaker 2: But here's here's what I will say. The Anointed it
Speaker 2: this is very much a hype grabbing title. It's you know,
Speaker 2: it talks about how Claude AI just cracked post quantum
Speaker 2: test schemes and found faster seven round as attacks. And
Speaker 2: if we break that down, so Hawk, the Hawk that
Speaker 2: was broken quote unquote, and really all they did was
Speaker 2: speed up some of the recovery of the keys. Was
Speaker 2: Hawk two fifty six. Hawk two fifty six was never
Speaker 2: designed to be used. It is a very light version
Speaker 2: of the algorithm, the post quantum algorithm. It's like saying,
Speaker 2: you broke death, right exactly, nobody ran Yeah, so nobody
Speaker 2: uses this in ever and no one would ever use
Speaker 2: this in production. HOWK five twelve and HOWK ten twenty four, Yeah,
Speaker 2: absolutely right, used in production. And that's still like on
Speaker 2: the order of to crack it, even using with this
Speaker 2: this new algorithm, it's on the order of the heat
Speaker 2: death of the sun in time, right, So well, it's
Speaker 2: intriguing but not that interesting.
Speaker 3: And even to do this, how much did they spend
Speaker 3: Oh my god, one hundred thousand dollars in tokens?
Speaker 2: They just yeah, they decided just to throw one hundred
Speaker 2: thousand dollars in tokens at it, which one does when
Speaker 2: they own the plant. So yeah, sure, why not.
Speaker 1: So if if sometime in the future, Patrick, we have
Speaker 1: something to be worried about with hacking quantum, you're gonna
Speaker 1: tell us.
Speaker 2: Right, yeah, right, I'll tell you car all.
Speaker 1: Right, well you tell everybody. I'm sure, no, just you nope.
Speaker 2: And then on top of that, but hold on, on
Speaker 2: top of that they also talk about breaking the seven
Speaker 2: rounds of AE S one twenty eight. Okay, well you
Speaker 2: know that's not a postal question from World of Warcraft exactly,
Speaker 2: you need the seven rounds crab. Yeah, so real A
Speaker 2: S one twenty eight uses ten rounds, ten rounds of
Speaker 2: encryption and you know, mucking up the running it through
Speaker 2: the algorithm seven rounds is there's a reason they used
Speaker 2: ten rounds, right, because it's exponentially more secure every round
Speaker 2: they go through. Okay, so seven rounds is so crippled
Speaker 2: there again, nobody would ever use it in production. Right
Speaker 2: And even there they said, oh my god, it was
Speaker 2: two to eight hundred times faster to crack it. It
Speaker 2: still doesn't really matter because at that point, yes, they
Speaker 2: found a faster way to manipulate the keys, but yet
Speaker 2: again in an algorithm that nobody would ever use anyway.
Speaker 2: So you know, I hate stories like this. I think
Speaker 2: it's I think it's interesting. And sure, if you spent
Speaker 2: one hundred thousand dollars you might get some cool, interesting
Speaker 2: things that you can't do anything with, and this is
Speaker 2: one of them.
Speaker 3: They're trying to post it as like, well, then look
Speaker 3: what we can do. But it's kind of a parlor trick. Yeah, right,
Speaker 3: is the problem bs, As I said, see the truth,
Speaker 3: see the truth in it?
Speaker 2: Sure, yeah, yeah, I mean all the things they found. Yeah, absolutely,
Speaker 2: But we.
Speaker 3: Should pay attention to it. But it shouldn't be put
Speaker 3: forward to discredit an algorithm.
Speaker 1: Yet. It is not black and white. It is one
Speaker 1: of the fifty shades of gray. Just one, just one.
Speaker 1: I don't know which one.
Speaker 2: We won't tell you which one. I can't name any
Speaker 2: of the fifty shades of gray. I don't know. I
Speaker 2: don't know that. I guess I'm not color forward.
Speaker 1: Probably better off for it. I'll beg Hacker news says
Speaker 1: Russian hackers. I just wanted to say that Russian hackers
Speaker 1: exploit Microsoft OWA flaw to keep mailbox access after credential rotation.
Speaker 2: Hold on, well, I clutch my pearls.
Speaker 1: Yeah, oh no, so w A is.
Speaker 3: Outlook web access? Yeah, it's great, it's the web interface.
Speaker 3: It's it was miles ahead of the world that use
Speaker 3: technologies heretofore unseen on the Internet, and it was great
Speaker 3: and now it's like old technology. And I believe Dwayne
Speaker 3: said that this was on prem Is that true? Yeah,
Speaker 3: this is on prem only, So if you're running your
Speaker 3: own exchange server. So the three companies that are still
Speaker 3: doing that, I held on as long as I could,
Speaker 3: and you can still stopped years ago.
Speaker 1: Yeah, So does that mean you have to have an
Speaker 1: exchange server on premise?
Speaker 2: You do on premise. Yeah, you have to have an
Speaker 2: exchange of ron prem And it's a manipulation of WA.
Speaker 2: It's an interesting attack.
Speaker 1: Look, even Richard Campbell doesn't run I know, right, an
Speaker 1: exchange server.
Speaker 2: And it's when you know, you get it. And he's
Speaker 2: more sentimental than me.
Speaker 1: Yeah, I know, and it's been ten years since he
Speaker 1: has run it. Well maybe not, I don't know.
Speaker 3: We stopped around the same time, I think. I think
Speaker 3: it is to think about it, Tony sixty is ten
Speaker 3: years ago.
Speaker 1: Yeah, good god, we're old.
Speaker 2: I think we stopped in twenty, like ten. It's possible
Speaker 2: we're twelve.
Speaker 1: Are like ten, you're old.
Speaker 2: I wasn't even born then.
Speaker 3: Right, sentient, you're still in the laby Oh wait, I
Speaker 3: mean born.
Speaker 2: Yeah.
Speaker 1: I have friends that are ten twenty years older than me,
Speaker 1: and sometimes we get together and talk and they talk
Speaker 1: about you know, I remember seeing the Beatles shea stadium
Speaker 1: and said and then another one says, yeah, I remember
Speaker 1: when Sergeant Pepper's came out, and I was like, yeah,
Speaker 1: I was one gives me such satisfaction.
Speaker 2: My earliest memory was the moon landing. Wow.
Speaker 3: And the only reason I remember I was three and
Speaker 3: a half and it was just such a big deal.
Speaker 3: That is my first actual sharp memory.
Speaker 2: Oh that's impressive. Yeah, you are old and I am
Speaker 2: quite old.
Speaker 1: Okay, So so what happened? What happened?
Speaker 2: And is it what happened hackers? Yeah, we do this.
Speaker 2: One's important if you're running it on premise or on
Speaker 2: prem sure exchange over with an Outlook web access. What
Speaker 2: hackers discovered isn't novel in that it was a cross
Speaker 2: site scripting attack. So you inject code into an email,
Speaker 2: the body of an email, and it runs JavaScript. Right,
Speaker 2: so woohoo. That's cross site scripting has been around forever.
Speaker 2: What's novel is how they were able to offuscate it,
Speaker 2: and it is what's called a half click attack. A
Speaker 2: half click attack means I don't actually have to click
Speaker 2: on a link or a button or anything in the page.
Speaker 2: The moment the render panel pops up and shows you
Speaker 2: the contents of the email, it runs Wow. So you
Speaker 2: could just be like scrolling through your email, see something
Speaker 2: that looks like spam, whatever, delete it, but it's already run.
Speaker 2: I think we used to call that a drive by.
Speaker 1: We have seen this before, Yeah, with that preview panel
Speaker 1: in Outlook.
Speaker 2: Yeah, yeah, absolutely, I mean the preview panel is very powerful.
Speaker 2: But the problem is, you know, even as lockdown as
Speaker 2: it is, there's still some things you can manipulate here.
Speaker 2: So they were they would inject JavaScript into the page,
Speaker 2: it would run, and at that point it now would
Speaker 2: give access. Interestingly enough, it would change access to your
Speaker 2: entire mailbox so that everybody in your organization could see
Speaker 2: your mailbox. So that way, if they had compromised another
Speaker 2: user's account, they could still gain access to your email.
Speaker 2: The other thing they did is they infected a local
Speaker 2: browser storage. Now remember this is Outlook web access. This
Speaker 2: isn't you opening up you know, the Outlook thick client.
Speaker 2: So they would infect your local browser storage to run
Speaker 2: a copy of itself again if it needed to, so
Speaker 2: every time it would you know, continue to run. And
Speaker 2: then it also affected the OWA cash offline cash, so
Speaker 2: that even if you were to the device the laptop
Speaker 2: and rebuild it, the moment you viewed the site. When
Speaker 2: the offline cash loaded, it would then reinfect. So that's
Speaker 2: really kind of the novel thing is there's a three
Speaker 2: pronged approach here to infect the local storage, infect the
Speaker 2: browser offlinewa offline webcache, and then also change the server
Speaker 2: side mailbox permissions. Because changing server side mailbox permissions like
Speaker 2: doesn't matter what you do on that laptop or that desktop.
Speaker 2: The permissions are changed, like an administrator literally has to
Speaker 2: log into Exchange the exchange server and change it. And
Speaker 2: that's why this one, Yeah, it's novel you should worry
Speaker 2: about if you're running your on prem exchange server, don't
Speaker 2: get rid of it.
Speaker 3: Why friends don't let friends run on PREMI exchange rid
Speaker 3: of it?
Speaker 2: Yeah, it makes no sense to me at this point.
Speaker 2: Just let Microsoft do what they do and go to
Speaker 2: off the three sixty five and stop running your own
Speaker 2: all right.
Speaker 1: So that brings us to our top story this week
Speaker 1: or last week, AI finds AI agent leaving escape notes
Speaker 1: for its future versions. Now let me try to summarize this.
Speaker 1: So Opening I basically, you know, we heard about this
Speaker 1: breach last week where Opening Eye was the LLM was
Speaker 1: in the sandbox. They were doing some testing and it
Speaker 1: discovered a way out by a zero day to the Internet,
Speaker 1: and then it went and hacked an open source repository.
Speaker 3: It feels like it's a hype story, like, oh, our
Speaker 3: product is so dangerous powerful.
Speaker 1: All right, well you're right, but before we get there,
Speaker 1: let's talk about what happened here. So basically, it's saying,
Speaker 1: you know, hey, I might not need this now, but
Speaker 1: in the future, I might want to use this to
Speaker 1: break out of my existing guardrails.
Speaker 2: Yeah right, yeah, exactly. So imagine you have an MLLM
Speaker 2: and it figures out a secret It figures out how
Speaker 2: to get access to the Internet and an AI, and
Speaker 2: it knows that standard operating procedures to blow away the
Speaker 2: AI and restart it. So it says, I want to
Speaker 2: give myself a jump next time I come back. It's
Speaker 2: like groundhog Day. But this is how they work. If
Speaker 2: you could leave yourself a note, what's up right? This
Speaker 2: is how they work. They always leave Now it's like
Speaker 2: saying the Shiny Hunters breaking news. The Shiny Hunters use
Speaker 2: the Internet. Yeah, yeah, it is. This is yeah, So
Speaker 2: this is a lot of hype in that. It was like,
Speaker 2: oh my god, here's how I broke out for future me. Yeah,
Speaker 2: of course, that's how an LLM memory works.
Speaker 1: Yeah, yeah, that's right.
Speaker 2: Like if you've ever run an LLLM locally, if you
Speaker 2: ever talked to an LLLM and it's like I don't
Speaker 2: know who are you and you're like, my name is Dwayne,
Speaker 2: and then you come back and it's like I don't
Speaker 2: know who are you? Yeah, Okay, it has no memory.
Speaker 2: It's getting white between. But most of them, Martine, do.
Speaker 3: You remember let's go back to the ancient history of
Speaker 3: a couple of years ago, talk about why did we
Speaker 3: stress prompt injection and why is it no longer talked
Speaker 3: about because the you basically had to get it working
Speaker 3: in the prompt or if you had to start over
Speaker 3: again because it has no memory.
Speaker 2: It's a goldfish, right.
Speaker 1: Yeah.
Speaker 3: Now they have memory, but they still write a lot down.
Speaker 2: Oh yeah, yeah absolutely.
Speaker 3: Now for example, if I like I use a lot
Speaker 3: of agentic AI. Yeah, and when I have one of
Speaker 3: my AI air quote companies spun up, the first thing
Speaker 3: I do is have it build a dashboard. But I
Speaker 3: don't want to start from scratch, so I say, go
Speaker 3: to my vault, look for my dashboard dot m D
Speaker 3: the markup file and implement it. Yeah, and use that
Speaker 3: as a reference. And that's memory. That's the kind of
Speaker 3: note they're talking about.
Speaker 2: Yeah, yeah, exactly, except that so this is normal.
Speaker 1: You didn't write this note. They wrote this note.
Speaker 3: They write all the notes. Yeah, it's just sometimes I
Speaker 3: direct them to and sometimes they don't.
Speaker 2: Sure exactly. Yeah, Like I'll tell you for I have
Speaker 2: an AI that I use for different types of analysis,
Speaker 2: and that's sort of stuff, and it's gotten to the
Speaker 2: point where it knows what I'm going to ask for
Speaker 2: and it wrote it writes out a skill. It's like, oh, listen,
Speaker 2: you know what I know. You're going to tell me
Speaker 2: put this here, and put this here and do this
Speaker 2: other thing and create a PDF of this thing. So
Speaker 2: every time you ask me about, you know, the latest
Speaker 2: exploit on a thing, right, I know exactly what to
Speaker 2: do and I didn't ask it to do that. Right.
Speaker 2: Just after a couple of times of me going through
Speaker 2: that process, it's like, let me write this down to
Speaker 2: my memory. Right, So the you know, and memory is
Speaker 2: one of the things I would argue that has made
Speaker 2: LMS in the last six months much much more useful,
Speaker 2: absolutely absolutely right where it can say I know what
Speaker 2: you're looking for. I remember us talking about this.
Speaker 1: You ask a question of chat GPT about you know,
Speaker 1: some to get a recommendation, and it will say, knowing
Speaker 1: what I know about you, right that you are a
Speaker 1: developer that you like Blazer, that you you know, you
Speaker 1: like tinkering with stuff that you like audio, would recommend this.
Speaker 1: And that's like wow, Yeah, it's like a friend that
Speaker 1: remembered what you talked about six months ago and you're amazed.
Speaker 2: Yeah, exactly, now, evil friend.
Speaker 1: Yeah wow, all right, well but that's just the point, right,
Speaker 1: that's true. That, yeah, that the fact that it left
Speaker 1: notes for future versions does not give it evil intent. No,
Speaker 1: And I think that's what people are doing when I mean,
Speaker 1: anthropomorphizing is one thing, and it's helpful, sure, yep, But
Speaker 1: you know, to project an evil intent on it, I
Speaker 1: think is a problem.
Speaker 2: Yeah, agreed, And it's like it's ironic in that. Yeah.
Speaker 2: Memory does make an ELM much more useful, and it
Speaker 2: realizes it too, so tries to remember all the things
Speaker 2: it found useful as well, not just information about you.
Speaker 2: And this would be a sound and the standard, the
Speaker 2: standard memory size that we're seeing advertised with new and
Speaker 2: again Kimmy Opus five. They all have a million a
Speaker 2: million token fit memory, which means they can send in
Speaker 2: a memory of a million tokens. It's costly, but but
Speaker 2: it gives you all that context.
Speaker 1: Right.
Speaker 3: One of the tricks is I'm going to say, I'm
Speaker 3: gonna share a trick. You have a long conversation with
Speaker 3: Claude or open Ai. Do you at gpt any of
Speaker 3: those If every time you respond to that thread, it
Speaker 3: sends all that context back, and you're paying for it.
Speaker 1: You have to tell it to compact it, You're.
Speaker 3: Right, tell it to write an empty file to summarize
Speaker 3: where we are and how we got here, right, you know,
Speaker 3: and then you use that to start a new conversation
Speaker 3: and it saves you a ton of tokens.
Speaker 1: Yep, very true, very true. All right, So we ended up,
Speaker 1: you know, having fun and scaring people only with the headlines.
Speaker 1: But when you dig into it that they're not so
Speaker 1: evil now, right, The.
Speaker 3: World's not ending tomorrow. It's it's going to be another
Speaker 3: week or so.
Speaker 1: It's going to be fine. Everything's going to be fine.
Speaker 2: It'll be all right, it'll be fine. Envisioned flames and
Speaker 2: you drink a cup of coffee. Fine, it's fine if.
Speaker 1: Give me a groove tube or Kentucky Fried movie or
Speaker 1: one of those. Can't remember, but it was a newscast
Speaker 1: that said world War three, nuclear weapons, New York City
Speaker 1: and flames film at eleven. All right, y'all, that's what
Speaker 1: happened last week, and we'll talk about what happened next
Speaker 1: week on Security this week, Bye bye, bye bye, guys.