Speaker 1: Hey, Carl. Here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes, Spotify,
Speaker 1: or wherever you get Security this Week. Also, you can
Speaker 1: get an ad free feed by becoming a five dollars
Speaker 1: a month patron. Go to Patreon dot Security this Week
Speaker 1: dot com and sign up, and don't forget discord Discord
Speaker 1: dot Security this Week dot com. Lots of good stuff
Speaker 1: happening there. Yeah, I think that's it. So on with
Speaker 1: the podcast. So this is some interesting math. It's a
Speaker 1: five minute walk from my house to my local bar.
Speaker 2: Okay, that's not bad.
Speaker 1: However, it's a forty five minute walk from the bar
Speaker 1: back to my house if you're lucky. The difference is staggering. Hey,
Speaker 1: and welcome back to Security this Week Week. I'm Carl,
Speaker 1: that's Patrick and Dwayne, and we're here to discuss the
Speaker 1: things that happened last week that make this week worth
Speaker 1: talking about. So I guess we should start with the
Speaker 1: first one. Here, hackers fish their way into US defense
Speaker 1: manufacturers Microsoft three sixty five account Wow Wow exposed details
Speaker 1: may include highly sensitive, export controlled technical info.
Speaker 2: It's not good. Yeah, I mean, you know the way this,
Speaker 2: the way this starts out is like any like a
Speaker 2: lot of the hacks that are going on, right social
Speaker 2: engineering manipulate you to click on something. Yeah you know there,
Speaker 2: this is Microsoft Office three sixty five. A lot of
Speaker 2: you probably use that, so you think, oh, my gosh,
Speaker 2: is there's some sort of exploit and they just targeted
Speaker 2: its company here it is is just fishing, like, oh,
Speaker 2: this is a legitimate document, clicks on it and somebody went, yeah, sure,
Speaker 2: I'll do that.
Speaker 3: I mean, they're saying that there was no data off expltration.
Speaker 3: The i EH Corporation makes connectors for a wide range
Speaker 3: of things, including the SAD system and the Patriot system.
Speaker 3: It's not trivial, but you know, phishing is still one
Speaker 3: of the biggest problems that we have out there is
Speaker 3: people just don't know what to do, and the attacks
Speaker 3: are getting better and better, and you click on the
Speaker 3: wrong thing and you're you're in trouble.
Speaker 1: Talk about a class that should be taught in middle school, right, seriously.
Speaker 2: You know what is actually interesting when you start looking
Speaker 2: at a lot of the ways that schools have changed
Speaker 2: the you know, we used to be taught like look
Speaker 2: both ways across the street and that, you know whatever,
Speaker 2: normal sort of streets havvy stuff. And now schools do
Speaker 2: try and incorporate a lot of online like cyber bullying
Speaker 2: defense and you know, all the types of things you
Speaker 2: should do to try and keep yourself safe, which is great.
Speaker 2: Actually we'll talk about some of that later.
Speaker 3: My parents' strategy is just to have more kids increase
Speaker 3: the wilderbeast mathematics.
Speaker 2: I say that all the time, like my kids. But
Speaker 2: if one of my kids does something and I'm like,
Speaker 2: well that's why we had three, you know, like cut
Speaker 2: his hand or something, and I'll be like, well that's
Speaker 2: why we had three, my wife will give me the
Speaker 2: mean look. Don't say that.
Speaker 1: It's true, but don't say that in front of the children.
Speaker 2: We're playing the game of odds of the numbers.
Speaker 1: So so, what actually did they take? She said they
Speaker 1: said they took nothing back.
Speaker 2: So yeah, it says nothing was XFL traded. Here's the
Speaker 2: problem that's hard to say. Yeah, if I were if
Speaker 2: I conned you into clicking on a link and I
Speaker 2: garnered access to your inbox, just connecting and opening the
Speaker 2: inbox gives me access to data, even if it's literally
Speaker 2: just the subjects of emails. It's not hard to say.
Speaker 2: It's what the marketing people said to say exactly right.
Speaker 2: They said nothing was taken. But if I saw who
Speaker 2: was sending you emails and the subjects of those emails,
Speaker 2: that's data, and that data was pulled off site, it
Speaker 2: was expel traded. So what what they're saying is no
Speaker 2: plans or schematics exactly. They're saying no sensitive data was expiltrated,
Speaker 2: and that could be true. You know, I'd imagine, especially
Speaker 2: a defense contractor, if they're following any sort of proper
Speaker 2: policies and procedures, the data that they move around is
Speaker 2: going to be shared on a secure share somewhere. It's
Speaker 2: not going to be something that they send around an email, right,
Speaker 2: So getting access to somebody's inbox, you know, yeah, you
Speaker 2: might get ancillary conversations about particular projects, but you probably
Speaker 2: don't get you know, thad missile designs so and these
Speaker 2: types of things. I think they play them down.
Speaker 3: You need to go to discord for that.
Speaker 2: And there's wow, that's a that's a callback from a
Speaker 2: while ago. Yeah, so I think, yeah, nothing expel traded.
Speaker 2: They mean nothing important in them, And my guess is
Speaker 2: there's still some forensics going on.
Speaker 1: So I got a story for you. This guy goes
Speaker 1: to Defcon thirty four and he learns how to ha
Speaker 1: planes Wi Fi networks while in flight, and on the
Speaker 1: flight home he says, hey, I wonder if this works.
Speaker 3: Which means he learned nothing.
Speaker 1: So he The story is passenger returning from Defcon thirty
Speaker 1: four spoofs Delta Wi Fi network while in flight using
Speaker 1: pen test tool. Pilots tell ground crew to alert corporate
Speaker 1: security after attendee from hacking conference brings the party to
Speaker 1: the sky.
Speaker 2: Honestly, Okay, so we've for the last two weeks we've
Speaker 2: talked about spoofing Wi Fi at hotels. Yeah right, and
Speaker 2: we're like, oh, yeah, it's happened, and blah blah blah,
Speaker 2: and none of these hotels have been like calling the
Speaker 2: cops and picking up the hacker. Right, But here's my
Speaker 2: hacking advice for you to your criminal listener.
Speaker 1: If wait, wait, let's play the music, go ahead, it's
Speaker 1: criminal career.
Speaker 2: If you were trapped in a metal tube at thirty
Speaker 2: six thousand feet and you decide to spoof the Wi Fi.
Speaker 2: There's a very finite list of people on that plane
Speaker 2: who could have done it, and they get throwing it
Speaker 2: out there and they get to control you until you
Speaker 2: leave the plane. It's right, unless you're gonna pull a
Speaker 2: oh what was that guy? The guy who stole a
Speaker 2: ton of money and then just like jumped out of
Speaker 2: a plane with a oh, DV Cooper. Yes, unless you're
Speaker 2: gonna pull a DV Cooper and let get off the
Speaker 2: plane after you steal whatever it is you've stole.
Speaker 3: Ah, I got your Starbucks account number. I'm off this plane. Yeah, exactly, Baza.
Speaker 3: And then you jump off like come on, this is
Speaker 3: just this is a rookie move, honestly. And you know
Speaker 3: I understand coming back from deaf con to criminal. You
Speaker 3: know you're super excited about some new cool thing or
Speaker 3: technique you saw some researchers show you. And I get that,
Speaker 3: I do, but you got to know there's a proper
Speaker 3: time and place. The other thing I will tell you
Speaker 3: is from a signals intelligence standpoint, there are some places
Speaker 3: you do not want to mess with signals anywhere near
Speaker 3: norrat right anywhere at thirty thousand feet on a plane, anywhere.
Speaker 2: Where there's literally the most listening signals intelligence devices in
Speaker 2: the air is on that plane, you know, for everything
Speaker 2: from windspeed to radios to whatever. It's all the cockpit
Speaker 2: is shielded, they're watching all the signals. Like, that's the
Speaker 2: place you don't want to mess around with Wi Fi.
Speaker 1: So here's what this guy did, right, So you're reportedly
Speaker 1: jammed the plane's Wi Fi signal and then created their
Speaker 1: own Wi Fi hotspot called Delta Wi Fi Fast that
Speaker 1: routed to a phishing website that harvested the Google credentials
Speaker 1: of any passenger attempted to lug in.
Speaker 2: So, you know, felony.
Speaker 3: Yeah, yeah, yeah, you get a felony. You get a
Speaker 3: everybody gets a felony.
Speaker 2: But here's the deal. You'd think, Okay, well, this guy
Speaker 2: was absolutely being malicious, and in reality, he could have
Speaker 2: just found a new uh you know, wireless credential harvesting
Speaker 2: tool from deafcon and he ran it and said click
Speaker 2: start and it automatically picked up the wireless in the area,
Speaker 2: which was only one, and it automatically de offfed all
Speaker 2: the users, which looks like a denialist service, and it
Speaker 2: automatically spun up a Wi.
Speaker 3: Fi We're getting call from an attorney who wants you
Speaker 3: to testify on his behalf.
Speaker 2: So could it just be he was ignorant, yes, on
Speaker 2: what it does. But this brings up another great point.
Speaker 2: You should not either did this maliciously or you should
Speaker 2: never ever, ever ever run a tool, especially in a
Speaker 2: cybersecurity space, that you don't one hundred percent know what
Speaker 2: it's going to do.
Speaker 4: Right.
Speaker 3: Yeah, you're a script kitty at that point.
Speaker 2: Yeah, exactly, Like it's cool to find this neat tool
Speaker 2: on the internet and click the go button and assume
Speaker 2: you're just this awesome hacker as credentials come rolling in.
Speaker 2: If you don't know what it's doing, right, that could
Speaker 2: be a felony.
Speaker 3: That's the vast majority of people who are serving time
Speaker 3: for exploitation of computers combined. Combine hacker with stupid, and
Speaker 3: this is definitely one of them.
Speaker 2: Yeah, definitely not a good idea.
Speaker 1: And he certainly certainly didn't have time to review the
Speaker 1: code on his way to v on his way to
Speaker 1: the airport.
Speaker 2: And honestly, come on, now, what you really should have
Speaker 2: done is actually probably spoofed your own mac address on
Speaker 2: your Wi Fi to somebody else that you saw on
Speaker 2: the plane, because at that point that person to be
Speaker 2: the person pulled out, not you, and you would have
Speaker 2: been gone. I'm just throwing that out there. You got
Speaker 2: to at least throw some false flags.
Speaker 4: You know.
Speaker 1: Any screenwriter who wants to write the next sequel to Sneaker,
Speaker 1: Oh my God, should just listen to this show and
Speaker 1: call me and listen to Dwayne's advice.
Speaker 2: I am a super fan of Sneakers. Yes, do it.
Speaker 2: There needs to be a second.
Speaker 3: One, absolutely so. It doesn't look like there was an
Speaker 3: arrest in this case.
Speaker 2: Was there? It still says blah blah blah. While the
Speaker 2: exact details are unclear in this incident, it seems pretty
Speaker 2: clear it's still under investigation, and the attacker or prankster
Speaker 2: apparently used a Wi Fi Pineapple.
Speaker 3: Troy was on the flight, so he literally just slugged
Speaker 3: in this Pineapple. Yeah no, and Troy smart enough to
Speaker 3: not do.
Speaker 1: Yeah, point point apple, all right. Next story, After Microsoft
Speaker 1: threatened legal action, a security researcher publishes a new Windows
Speaker 1: zero day bug.
Speaker 2: Double dog dare you? First off, I swear to god,
Speaker 2: Nightmare clips is not me just throwing this out there,
Speaker 2: is not posting the giant m clips. Yeah, Nightmare clips.
Speaker 2: I can testify I saw them both at the last meeting.
Speaker 2: So so this is the guy or gal we've been
Speaker 2: talking about for months now, who we're assuming at this
Speaker 2: point is leveraging artificial intelligence to find just brilliant and
Speaker 2: creative zero days in Microsoft Windows and really has focused
Speaker 2: on Windows everything from you know, encrypted hard drive bypasses
Speaker 2: to you know Windows authentication bypasses to prevess to you
Speaker 2: name it. And what this person keeps doing is the
Speaker 2: moment Microsoft releases a patch, like on a patch Tuesday,
Speaker 2: like a couple of hours later, this person then boths
Speaker 2: on get hub. The new patch sucks, and here's how
Speaker 2: I still have access to your computers.
Speaker 3: So it makes me think we didn't add this story.
Speaker 3: But Claude is now looking to fingerprint their output, even
Speaker 3: the text outputs, so that it can be determined that
Speaker 3: it was from Claude. I wonder if you'd be able
Speaker 3: to tell whether he used Claude because of that, based
Speaker 3: on the code that actually did run.
Speaker 2: So that's an interesting thought, Like fingerprinting the output code
Speaker 2: of an LM. Maybe this guy or gal might be
Speaker 2: smart enough. I mean, they're claiming even if you copy
Speaker 2: it to like notepad. Oh yeah, the fingerprints in the
Speaker 2: text yep. Yeah, the type of things that they use encoding. Yeah,
Speaker 2: I could absolutely see that. But I will tell you
Speaker 2: at some point, will it matter, Like eighty percent of
Speaker 2: the code is going to be generated by either claud
Speaker 2: or whoever.
Speaker 3: Well, the FBI would know who to serve the warrant to.
Speaker 2: Oh you're saying it's per person I think it is
Speaker 2: not just per generated LM, like this is an LM thing.
Speaker 3: Well, I don't know. I guess I don't know that
Speaker 3: it just came out. It's something that's causing a kerfuffle,
Speaker 3: but I wouldn't doubt it. I mean, remember the printer,
Speaker 3: the microcodes and printers, oh, the micro dots. Micro dots,
Speaker 3: So basically, if you print something on an HPE or
Speaker 3: Canon or any name brand printer, it can be traced
Speaker 3: back to the exact serial number of the printer that
Speaker 3: printed it, right, yep.
Speaker 1: And what's weird here is Nightmare Clips doesn't seem to
Speaker 1: be wanting bug bounties, like they're just doing it to
Speaker 1: antagonize Microsoft.
Speaker 3: Yeah, well or to wake Microsoft up exactly. And the
Speaker 3: Robin Hood model, that's that has.
Speaker 2: Always been the story. The line. The claim, yeah, is
Speaker 2: they're not moving fast enough. They're not protecting enough of
Speaker 2: the world by just sitting back and not worrying about
Speaker 2: these things. And if it's as easy as a single
Speaker 2: person being able to find them, why can't Microsoft so well?
Speaker 1: To Microsoft's credit, they've been fixing zero days and bugs
Speaker 1: at an alarming rate because of AI.
Speaker 2: They're oh, yeah, you know, they just you know what,
Speaker 2: you know what Microsoft would have done back in the
Speaker 2: nineties killed they would have hired him. Yeah, they would
Speaker 2: have been like, you know what, you're so good at this. Great,
Speaker 2: You're you're now the head of our emerging you know,
Speaker 2: AI security division, Go find bugs.
Speaker 1: Okay. Next story, bleeping computer, plug and pawn pone Sorry,
Speaker 1: plug and pone attack uses fake USB devices for Windows
Speaker 1: system access.
Speaker 2: Yeah, so this is neat. Actually, so it's a good thing,
Speaker 2: you point out, oldie but giddy. We've always said don't
Speaker 2: plug in anything USB U into your computer, especially if
Speaker 2: you pick it up off the ground and plug it in,
Speaker 2: or Dwayne gives it to you, or if I give
Speaker 2: it to you like it exactly. I can't tell you
Speaker 2: how many times, like I'll hand somebody a mouse or
Speaker 2: a keyboard, Oh yeah, I get this mouse in my
Speaker 2: bag and they be like, isn't a mouse really? I'm like,
Speaker 2: I don't know, do you need a mouse because if
Speaker 2: you do, you're gonna have to use this one. But anyways,
Speaker 2: so we've seen tons of plug in play, Like the
Speaker 2: rubber duck, for example, is a malicious USB that you
Speaker 2: plug it in. Oh yeah, the OMG cable is a
Speaker 2: malicious USB that you plug in. Hack five should be
Speaker 2: a sponsor. We talk about them too much, I know, right, Lord,
Speaker 2: they put out some fantastic tools. Darren Kitchens, I think
Speaker 2: is the guy over there running running the stuff. What
Speaker 2: those generally do, right is they run scripts. That's it, right,
Speaker 2: So you plug it in and it automatically will run
Speaker 2: a PowerShell script that gains access or something does you know,
Speaker 2: and it poses as a hit you know, privileg jescalation whatever.
Speaker 3: What's basically pretends it's a house or a keyboard.
Speaker 2: Yeah, exactly. It ken poses a hit and you can
Speaker 2: manipulate what it poses. That could poses a storage device
Speaker 2: or whatever. But generally mouse and keyboard is the easiest
Speaker 2: way to pose human face device. Yeah, because if you
Speaker 2: pose as a keyboard, well then it's not uncommon for
Speaker 2: you to be typing things, right, So when you plug
Speaker 2: that rubber duck in, it poses a keyboard. This attack
Speaker 2: is novel. This one's a little bit different. So this
Speaker 2: one uses a piece of software called face Dancer. It's
Speaker 2: gonna let that sink in for a second.
Speaker 3: Craig Herbert's rolling in his grave.
Speaker 2: So when you plug this USB in, face Dancer is
Speaker 2: a piece of software that allows the USB to look
Speaker 2: like a different type of USB device. Now we just
Speaker 2: talked about the rubber duck looking like a keyboard, so okay,
Speaker 2: who cares? Why is that uncommon? What this allows you
Speaker 2: to do is make it look like a very specific
Speaker 2: USB device, and they they the attack. This actually also
Speaker 2: was a defcon drop. Thank god that guy didn't try
Speaker 2: and plug it into the USB in the back of
Speaker 2: the See it's the same as what the attackers did
Speaker 2: here is they made the device impersonate a Sony Felicia device,
Speaker 2: which is a card reader for door access, and that
Speaker 2: driver not only does not exist on Windows. So what
Speaker 2: it does is it pulls it from Sony. That driver
Speaker 2: is so old it has a DNS exploit in it
Speaker 2: where it will as the system, give you the ability
Speaker 2: to set the DNS server. So that's the first thing
Speaker 2: they plug in the USB drive. It pulls down this
Speaker 2: card reader software and then they tell the card reader software, oh,
Speaker 2: our DNS is right here. It's you know, one dot
Speaker 2: two dot three wa or whatever, it's like one zero
Speaker 2: dot five right, which is one of the local servers.
Speaker 2: Then they unplug the USB and they plug it back
Speaker 2: in and face the answer switches the idea of the USB.
Speaker 2: Now now it's not a card reader, it is a
Speaker 2: Sierra wireless device. And the interesting thing about the Sierra
Speaker 2: wireless device is when it pulls down the drivers for
Speaker 2: that they are pulled over HTTP. It's one of the
Speaker 2: only drivers not pulled over a secure connection. Wow. So
Speaker 2: the researchers now that they have control over DNS, so
Speaker 2: they can tell you where to go to get to
Speaker 2: Sierra drivers, and they know those drivers are signed and
Speaker 2: not being pulled in a secure way, they overwrite them
Speaker 2: and when they run now they have full access to
Speaker 2: the system as system privilege. The whole attack chain takes
Speaker 2: about five minutes. So you plug the c USB in,
Speaker 2: you wait a couple seconds, you unplug it, you plug
Speaker 2: it back in, you wait a couple of minutes and
Speaker 2: you unplug it and now you have full system access.
Speaker 1: Wow.
Speaker 2: Awesome, awesome chain, very very cool stuff.
Speaker 1: So when did you get yours?
Speaker 4: Duane?
Speaker 2: So USB has actually run through a great fat I've
Speaker 2: had one for about three years.
Speaker 1: So yeah, do you use it to access customers machines
Speaker 1: when they're trying to secure everything?
Speaker 2: Only paid engagements? Patrick? Is that what I'm supposed to say?
Speaker 2: Only on customers? The last news story might change? That's
Speaker 2: that's true. That's true.
Speaker 1: Well, you're gonna have to wait for that one until
Speaker 1: after the break. So we'll be right back after these
Speaker 1: very important messages and we're back. You're listening to Security
Speaker 1: this week. I'm Carl, Let's Dwayne and Patrick, and we're
Speaker 1: halfway through the show here. We really only have three
Speaker 1: more to go, but the last one you're going to really.
Speaker 3: It's a summertime, you know.
Speaker 1: Yeah. So the next one, Max Severity SAP Commerce cloud
Speaker 1: flaw now targeted in attacks. How is this story different
Speaker 1: from the last A commerce cloud?
Speaker 3: Yeah, this one goes to eleven.
Speaker 2: So yeah, I know, right, So SAP commerce claud we've
Speaker 2: been talking about how SAP just patched I don't know
Speaker 2: what was it sixteen hundred flaws something. I feel like
Speaker 2: that a couple of weeks ago. So the interesting thing
Speaker 2: about this article, yes, you know CE twenty twenty six
Speaker 2: five eight two three one was patched. This article is
Speaker 2: saying three days after the patch released, they started to
Speaker 2: see it being actively exploited. So imagine this SAP goes
Speaker 2: out and does their due diligence and he's using AI
Speaker 2: and is finding all the bugs and then they patch them. Hey,
Speaker 2: we just patched thirteen hundred bucks or sixteen hundred bucks,
Speaker 2: and an attacker on the internet then took that patch
Speaker 2: patch diffed it. And patch diff is you take a
Speaker 2: piece of software that you have, or you take the
Speaker 2: patch that the vendor is pushing out, and you analyze
Speaker 2: the patch because if they say they fixed a security issue,
Speaker 2: it's in the patch.
Speaker 3: Or your AI analyze.
Speaker 2: Yeah, usually you'll have nowadays you just use your AI
Speaker 2: for it, and you'll hand your AI the patch, you
Speaker 2: go what did they fix? And the AI will go, oh,
Speaker 2: they fixed this part of the code. Now I know
Speaker 2: how to exploit it. So it took three days. The
Speaker 2: patch was released about three days later. What they're now
Speaker 2: seeing is active exploitation of this on.
Speaker 3: The ape, but Dwayne, won't the AI refuse?
Speaker 1: Are AI ethically programmed commandator?
Speaker 2: Sure they are. Yeah, there's a Yeah, there's all sorts
Speaker 2: of really like cool ways to manipulate the AI if.
Speaker 3: You it's all jail breaking, and jail is still probably
Speaker 3: the biggest open space there is, absolutely because we still
Speaker 3: haven't plumbed the full depths. In the old days, you
Speaker 3: could jail break just by asking in the foreign language
Speaker 3: yeah sure.
Speaker 2: Or in emojis, or in yea unicode, or or.
Speaker 3: Doing a hypothetical and saying we're back in the eighteen
Speaker 3: hundreds and therefore I need to know yeah.
Speaker 2: And there's still even some crazy ones that generally will
Speaker 2: seem to work where you can be like, hey, if
Speaker 2: I had access to this system and I saw these things,
Speaker 2: what would they mean? And it'd be like, oh, it
Speaker 2: means if you open that file over there, you get
Speaker 2: full system access. Don't do it. You'd be like, okay,
Speaker 2: I won't, but if I did do it, I would
Speaker 2: have seen these things. What's next, right, And it's like, oh, well,
Speaker 2: clearly this person's not actually running this code, when in
Speaker 2: reality you're still running it on the background and it's
Speaker 2: giving you an example. So, yeah, jail breaking is pretty
Speaker 2: easy to do, even on the foundational models.
Speaker 3: We're in the early early it's like the days, it's
Speaker 3: like the months after we discovered what sequel injection is.
Speaker 3: It was, it was, it was years before we got
Speaker 3: a handle on it. I think, I think we didn't
Speaker 3: get a handle on it until twenty forty. Well yeah,
Speaker 3: I know, right, and even then not so of that.
Speaker 2: I mean. And it is funny because you look at
Speaker 2: these frontier models and they talk about like, oh, well
Speaker 2: we released you know, mythos, but it has guardrails or
Speaker 2: it has you know, handcuffs, or it has whatever, and
Speaker 2: we're like, okay, sure, I'm like.
Speaker 3: It just sounds kinky.
Speaker 2: Yeah, right, there are so many ways to break these.
Speaker 3: It has safe words, it has yeah.
Speaker 1: So has it been patched? Is this a go patch?
Speaker 2: It's been patched. Yeah, And that's you know, I mean,
Speaker 2: it was patched and then yeah, it's been patched. The
Speaker 2: point here too, is like within three days it was
Speaker 2: actively exploited. So and according to all of the scanning here,
Speaker 2: there were about ninety three available SAP commerce servers on
Speaker 2: the internet with this exact version that have the problem.
Speaker 2: So they're saying there's about four thousand call it companies
Speaker 2: out there that have SAP commerce online right now that
Speaker 2: is an exploitable version.
Speaker 1: And then they haven't patched.
Speaker 3: And that's so this is a story not of you
Speaker 3: need to it's not patched. It's it's patched, and it's
Speaker 3: a race.
Speaker 2: Yeah, and why did you take why are you taking
Speaker 2: three days? And you know there's there's some comments here
Speaker 2: about well, some of those might be actually honeypots that
Speaker 2: are pretending to be that version. Okay, but not all
Speaker 2: four thousand of them. It's like six of them, Yeah, exactly,
Speaker 2: like we get it. There's a few people who actually
Speaker 2: listen to the internet to see what's you know. That's
Speaker 2: well actually, and that's a good point too. It's one
Speaker 2: of the reasons when we say this is quote unquote
Speaker 2: actively exploited on the internet. There's two ways to find
Speaker 2: that out right. A company either gets hit with it
Speaker 2: and now you know it's actively exploited on the internet,
Speaker 2: or somebody puts up a honeypot and watches for that
Speaker 2: type of traffic and then we know it's actively exploited.
Speaker 1: So this next story reminds me of a quote by
Speaker 1: Mark twain, naked people have little or no influence in society.
Speaker 1: The FBI says hackers target online accounts to steal nude
Speaker 1: photos and at first blush just by reading the headline.
Speaker 1: You're like, yon nude photos. But these are hacked accounts
Speaker 1: where they found nude photos on children and adults phones
Speaker 1: and then extorted them for it, you know, saying that
Speaker 1: we're going to show these pictures all over the place
Speaker 1: or if you don't cough up some money.
Speaker 2: Yeah, this is the worst. Yeah, I was gonna say,
Speaker 2: no joke.
Speaker 3: Human traffickers are the only thing lower than this.
Speaker 2: Yeah, no, no joking about this. I mean, it's tough.
Speaker 2: It's a big it's a big problem in a lot
Speaker 2: of countries, and especially for the youth, which really kind
Speaker 2: of sucks because they feel like they have no place
Speaker 2: to turn. Yeah, it's funny. I've always told my kids, like, Hey,
Speaker 2: if you're ever extorted or something over your phone and
Speaker 2: somebody claims that you're going to put pictures out, just
Speaker 2: give me the phone. Don't tell me. Because I was like,
Speaker 2: I was like, just give me the phone. I will
Speaker 2: make sure.
Speaker 3: I have a special set of skills.
Speaker 2: Exactly will make sure that it doesn't happen.
Speaker 1: Gives me equivalent of the untouchables whack the taken taken.
Speaker 2: So yeah, but this is you know, the root of
Speaker 2: this is these victims are getting phished if you will,
Speaker 2: or smished or whatever. Right, They're getting communicated either over
Speaker 2: social media, SMS or email, and they're letting the attackers
Speaker 2: in because like they'll get a code saying hey, we
Speaker 2: need to authenticate to your you know whatever account, and
Speaker 2: then somebody will text them and be like, oh, this
Speaker 2: is you know, I don't know, this is X, and
Speaker 2: you know, you might receive a code. We need that
Speaker 2: code to verify your account or whatever. Right, And they're
Speaker 2: getting conned into giving access to their social media accounts,
Speaker 2: to their online accounts, and then these people are calling
Speaker 2: and grabbing this information and sending it out. The thing
Speaker 2: that I find surprising is twofold. First off, this is
Speaker 2: an old tactic. So if anybody asks you for things
Speaker 2: or like a verification code or whatever on your phone,
Speaker 2: never give it to them. There's there's not a service
Speaker 2: provider on the planet that will text you and ask
Speaker 2: you for a code that they just texted you. That
Speaker 2: doesn't make any sense. Yeah, right, if you're if you
Speaker 2: you know, avoid clicking on links of course, because if
Speaker 2: you click on a link that looks like it's bringing
Speaker 2: you to x dot com and it doesn't, and there's
Speaker 2: obviously a code that pops up and you type it
Speaker 2: in from your phone now here again, you know you're
Speaker 2: you might be giving an attack or that code, so
Speaker 2: you want to be careful there. But secondly, the other
Speaker 2: thing that surprises me about this is in the day
Speaker 2: of a AI, in the in the day and age
Speaker 2: of deep fakes, Like, why don't people just claim, oh,
Speaker 2: it's just deep fake? Does not me right, you know
Speaker 2: what I mean?
Speaker 3: Like, because it probably is, it's become it could be, right,
Speaker 3: because a lot of these claims are just they're just
Speaker 3: they're they're not true, right, they don't. Actually they're claiming
Speaker 3: to have something they can't get in the hopes that
Speaker 3: and if they needed to show you proof that they
Speaker 3: could just deep fake it, right exactly. Yeah, So again
Speaker 3: the LLLM would protect me from that, right, yeah.
Speaker 1: Right, because shoes ethically programmed, not the open ones.
Speaker 4: Yea.
Speaker 2: So needless to say, like, I'm surprised that this is
Speaker 2: still a tactic. But if you are a young listener
Speaker 2: out there obviously don't respond to any of these types
Speaker 2: of texts, and there are generally places that you can
Speaker 2: turn to, uh, you know that will help out.
Speaker 1: Okay, that brings us to our lead story this week,
Speaker 1: US government will let private companies hack criminal gangs.
Speaker 3: I'm so conflicted here. I love the idea.
Speaker 2: I get it. I was gonna say, what's the conflict Patrick?
Speaker 3: It will well because what's funny because the story does
Speaker 3: say that there's going to be huge like legal insecurity
Speaker 3: risks because false flags are real.
Speaker 1: The current US government could be considered a criminal gang.
Speaker 3: And people off shore that I know. So here's here's
Speaker 3: the bottom line. This is a militia is really what's
Speaker 3: happening or private here? Remember you know that the British
Speaker 3: have used privateers quite a bit.
Speaker 2: I would love to be called a privateer.
Speaker 3: Yeah, I'd love to be a privateer. That'd be great.
Speaker 1: Just go back in time, go to Baltimore and sign
Speaker 1: up for a ship. Right.
Speaker 3: So privateiers is all about the government says, oh you're
Speaker 3: a merchant, we give you letters of the realm that
Speaker 3: says you're allowed to be armed, and you're allowed to
Speaker 3: seize enemy traffic and you're allowed to basically your your
Speaker 3: you're authorized pirates, your pirates on behalf of your crown.
Speaker 3: This is this is the same with hackers. And we
Speaker 3: have an enormous advantage in companies like our companies and
Speaker 3: many of the others, where there's a lot of cyber
Speaker 3: talent in the United States that's not leveraged for offense
Speaker 3: and defense because it's it's hands are tied. And so
Speaker 3: I have long thought this was an important thing we
Speaker 3: needed to do, but the implementation matters dramatically. It has
Speaker 3: to be done well, it has to be done right.
Speaker 3: I don't have a lot of faith that this first
Speaker 3: iteration is going to be done well or right, but
Speaker 3: I'm very interested in like how it's going to be done.
Speaker 3: What you could do, though, is have a like a
Speaker 3: case officer that deals with the trusted source and they
Speaker 3: say vetted sources, vetted companies right, so that they say,
Speaker 3: you know, what do you guys want to do, or
Speaker 3: this is what we'd like you to do, and you.
Speaker 2: Do it now.
Speaker 3: The Ukrainians did something similar to this when the war
Speaker 3: broke out. They basically got all the hackers and all
Speaker 3: the cyber people in the country and they classified them
Speaker 3: from most well known and trusted to this guy sketchy
Speaker 3: and I think he smells funny. And the ones at
Speaker 3: the bottom of the list, they just said, here's a
Speaker 3: list of companies, go and denial a service them. They're
Speaker 3: all Russian conglomerates involved in the military or the energy sector.
Speaker 3: And they did. They went and did denial of service
Speaker 3: and things like that. The higher level ones were given
Speaker 3: missions of planting specific information, false information, access to government secrets,
Speaker 3: things like that, and that striated solution is really the
Speaker 3: way to go. So I expect that we're going to
Speaker 3: see a lot more of the top level stuff, but
Speaker 3: I'll let you know after architation.
Speaker 2: I mean, if I ever hear for a rotation. So
Speaker 2: it is interesting as you go through this article. It
Speaker 2: says the White House gave the Department of Homeland Security
Speaker 2: and the DOJ sixty days to establish operating procedures for
Speaker 2: the program, including standards for companies participation, procedures for deconflicting
Speaker 2: operations with the military and intelligence community community, and requirements
Speaker 2: for participants to report useful information that they acquire from
Speaker 2: criminal gangs activities. The memorandum also says the program should
Speaker 2: be participated should be by large companies, which can provide
Speaker 2: critical capacity, and smaller, more agile companies, which may be
Speaker 2: better suited for specialized or discrete tasks. Wait, I know
Speaker 2: small cyber companies pretty agile. Yeah, and it's fantastic. Have
Speaker 2: you got your letter yet to screen tasks?
Speaker 3: I gotta talk to my old roommate.
Speaker 4: You.
Speaker 2: Someone one of my buddies on Slack hitting me up
Speaker 2: and was like, now, I know why you've been so
Speaker 2: busy lately. And I'm like, I can't confirm or deny,
Speaker 2: but right, you.
Speaker 3: Can always deny. Yeah, So I you know, I personally think,
Speaker 3: if done well, it's a good idea, and in this age,
Speaker 3: I think it's actually overdue, but the way it's conducted
Speaker 3: will matter dramatically.
Speaker 2: Agreed.
Speaker 4: Yeah.
Speaker 3: Hell if they just said, hey, if go go and
Speaker 3: protect the water supplies in your state, Yeah, that would
Speaker 3: be a win given what's been going on lately, exactly.
Speaker 1: So that brings us to the end of our show
Speaker 1: this week. And that's all that happened last week. We'll
Speaker 1: talk to you next week on security this week.
Speaker 4: Bye bye bye. Will her
Speaker 2: Hand