WEBVTT

1
00:00:00.320 --> 00:00:03.200
<v Speaker 1>Hey, Carl. Here, we're on a mission to find new

2
00:00:03.240 --> 00:00:05.919
<v Speaker 1>fans of the show. I mean, where else can you

3
00:00:05.960 --> 00:00:10.240
<v Speaker 1>get real life comedy and horror in one podcast. You

4
00:00:10.279 --> 00:00:13.640
<v Speaker 1>can do your part by leaving us a review on iTunes, Spotify,

5
00:00:13.759 --> 00:00:16.879
<v Speaker 1>or wherever you get Security this Week. Also, you can

6
00:00:16.920 --> 00:00:19.399
<v Speaker 1>get an ad free feed by becoming a five dollars

7
00:00:19.399 --> 00:00:22.239
<v Speaker 1>a month patron. Go to Patreon dot Security this Week

8
00:00:22.320 --> 00:00:26.160
<v Speaker 1>dot com and sign up, and don't forget discord Discord

9
00:00:26.199 --> 00:00:28.839
<v Speaker 1>dot Security this Week dot com. Lots of good stuff

10
00:00:28.879 --> 00:00:32.439
<v Speaker 1>happening there. Yeah, I think that's it. So on with

11
00:00:32.520 --> 00:00:36.119
<v Speaker 1>the podcast. So this is some interesting math. It's a

12
00:00:36.159 --> 00:00:38.640
<v Speaker 1>five minute walk from my house to my local bar.

13
00:00:38.840 --> 00:00:39.920
<v Speaker 2>Okay, that's not bad.

14
00:00:39.960 --> 00:00:42.600
<v Speaker 1>However, it's a forty five minute walk from the bar

15
00:00:42.759 --> 00:00:57.479
<v Speaker 1>back to my house if you're lucky. The difference is staggering. Hey,

16
00:00:57.600 --> 00:01:01.159
<v Speaker 1>and welcome back to Security this Week Week. I'm Carl,

17
00:01:01.240 --> 00:01:03.719
<v Speaker 1>that's Patrick and Dwayne, and we're here to discuss the

18
00:01:03.759 --> 00:01:06.480
<v Speaker 1>things that happened last week that make this week worth

19
00:01:06.560 --> 00:01:09.640
<v Speaker 1>talking about. So I guess we should start with the

20
00:01:09.640 --> 00:01:13.000
<v Speaker 1>first one. Here, hackers fish their way into US defense

21
00:01:13.079 --> 00:01:18.840
<v Speaker 1>manufacturers Microsoft three sixty five account Wow Wow exposed details

22
00:01:18.920 --> 00:01:23.760
<v Speaker 1>may include highly sensitive, export controlled technical info.

23
00:01:24.040 --> 00:01:26.640
<v Speaker 2>It's not good. Yeah, I mean, you know the way this,

24
00:01:26.799 --> 00:01:29.200
<v Speaker 2>the way this starts out is like any like a

25
00:01:29.200 --> 00:01:31.439
<v Speaker 2>lot of the hacks that are going on, right social

26
00:01:31.480 --> 00:01:35.799
<v Speaker 2>engineering manipulate you to click on something. Yeah you know there,

27
00:01:36.280 --> 00:01:39.400
<v Speaker 2>this is Microsoft Office three sixty five. A lot of

28
00:01:39.400 --> 00:01:41.680
<v Speaker 2>you probably use that, so you think, oh, my gosh,

29
00:01:41.719 --> 00:01:43.400
<v Speaker 2>is there's some sort of exploit and they just targeted

30
00:01:43.439 --> 00:01:46.480
<v Speaker 2>its company here it is is just fishing, like, oh,

31
00:01:46.519 --> 00:01:50.599
<v Speaker 2>this is a legitimate document, clicks on it and somebody went, yeah, sure,

32
00:01:50.640 --> 00:01:51.120
<v Speaker 2>I'll do that.

33
00:01:51.200 --> 00:01:53.920
<v Speaker 3>I mean, they're saying that there was no data off expltration.

34
00:01:54.120 --> 00:01:58.560
<v Speaker 3>The i EH Corporation makes connectors for a wide range

35
00:01:58.599 --> 00:02:02.599
<v Speaker 3>of things, including the SAD system and the Patriot system.

36
00:02:02.719 --> 00:02:06.719
<v Speaker 3>It's not trivial, but you know, phishing is still one

37
00:02:06.760 --> 00:02:08.560
<v Speaker 3>of the biggest problems that we have out there is

38
00:02:08.599 --> 00:02:11.759
<v Speaker 3>people just don't know what to do, and the attacks

39
00:02:11.759 --> 00:02:14.319
<v Speaker 3>are getting better and better, and you click on the

40
00:02:14.360 --> 00:02:16.360
<v Speaker 3>wrong thing and you're you're in trouble.

41
00:02:16.719 --> 00:02:21.240
<v Speaker 1>Talk about a class that should be taught in middle school, right, seriously.

42
00:02:21.199 --> 00:02:24.080
<v Speaker 2>You know what is actually interesting when you start looking

43
00:02:24.120 --> 00:02:27.360
<v Speaker 2>at a lot of the ways that schools have changed

44
00:02:27.719 --> 00:02:29.960
<v Speaker 2>the you know, we used to be taught like look

45
00:02:30.000 --> 00:02:31.919
<v Speaker 2>both ways across the street and that, you know whatever,

46
00:02:32.000 --> 00:02:35.280
<v Speaker 2>normal sort of streets havvy stuff. And now schools do

47
00:02:35.360 --> 00:02:39.560
<v Speaker 2>try and incorporate a lot of online like cyber bullying

48
00:02:39.719 --> 00:02:41.919
<v Speaker 2>defense and you know, all the types of things you

49
00:02:41.919 --> 00:02:44.360
<v Speaker 2>should do to try and keep yourself safe, which is great.

50
00:02:45.360 --> 00:02:46.759
<v Speaker 2>Actually we'll talk about some of that later.

51
00:02:46.840 --> 00:02:51.080
<v Speaker 3>My parents' strategy is just to have more kids increase

52
00:02:51.199 --> 00:02:55.400
<v Speaker 3>the wilderbeast mathematics.

53
00:02:55.800 --> 00:02:58.199
<v Speaker 2>I say that all the time, like my kids. But

54
00:02:58.280 --> 00:02:59.960
<v Speaker 2>if one of my kids does something and I'm like,

55
00:03:00.039 --> 00:03:02.360
<v Speaker 2>well that's why we had three, you know, like cut

56
00:03:02.360 --> 00:03:03.960
<v Speaker 2>his hand or something, and I'll be like, well that's

57
00:03:03.960 --> 00:03:07.520
<v Speaker 2>why we had three, my wife will give me the

58
00:03:07.560 --> 00:03:09.960
<v Speaker 2>mean look. Don't say that.

59
00:03:11.039 --> 00:03:14.479
<v Speaker 1>It's true, but don't say that in front of the children.

60
00:03:16.120 --> 00:03:18.360
<v Speaker 2>We're playing the game of odds of the numbers.

61
00:03:19.680 --> 00:03:23.439
<v Speaker 1>So so, what actually did they take? She said they

62
00:03:23.439 --> 00:03:24.560
<v Speaker 1>said they took nothing back.

63
00:03:24.680 --> 00:03:27.360
<v Speaker 2>So yeah, it says nothing was XFL traded. Here's the

64
00:03:27.360 --> 00:03:32.639
<v Speaker 2>problem that's hard to say. Yeah, if I were if

65
00:03:32.639 --> 00:03:35.000
<v Speaker 2>I conned you into clicking on a link and I

66
00:03:35.120 --> 00:03:38.520
<v Speaker 2>garnered access to your inbox, just connecting and opening the

67
00:03:38.560 --> 00:03:41.719
<v Speaker 2>inbox gives me access to data, even if it's literally

68
00:03:41.800 --> 00:03:44.439
<v Speaker 2>just the subjects of emails. It's not hard to say.

69
00:03:44.439 --> 00:03:47.479
<v Speaker 2>It's what the marketing people said to say exactly right.

70
00:03:48.319 --> 00:03:51.360
<v Speaker 2>They said nothing was taken. But if I saw who

71
00:03:51.439 --> 00:03:53.719
<v Speaker 2>was sending you emails and the subjects of those emails,

72
00:03:53.759 --> 00:03:57.639
<v Speaker 2>that's data, and that data was pulled off site, it

73
00:03:57.719 --> 00:04:01.240
<v Speaker 2>was expel traded. So what what they're saying is no

74
00:04:01.400 --> 00:04:07.319
<v Speaker 2>plans or schematics exactly. They're saying no sensitive data was expiltrated,

75
00:04:07.360 --> 00:04:09.680
<v Speaker 2>and that could be true. You know, I'd imagine, especially

76
00:04:09.719 --> 00:04:12.599
<v Speaker 2>a defense contractor, if they're following any sort of proper

77
00:04:12.639 --> 00:04:16.279
<v Speaker 2>policies and procedures, the data that they move around is

78
00:04:16.319 --> 00:04:18.519
<v Speaker 2>going to be shared on a secure share somewhere. It's

79
00:04:18.560 --> 00:04:20.879
<v Speaker 2>not going to be something that they send around an email, right,

80
00:04:21.279 --> 00:04:25.399
<v Speaker 2>So getting access to somebody's inbox, you know, yeah, you

81
00:04:25.480 --> 00:04:31.160
<v Speaker 2>might get ancillary conversations about particular projects, but you probably

82
00:04:31.160 --> 00:04:36.959
<v Speaker 2>don't get you know, thad missile designs so and these

83
00:04:37.000 --> 00:04:38.800
<v Speaker 2>types of things. I think they play them down.

84
00:04:39.000 --> 00:04:40.079
<v Speaker 3>You need to go to discord for that.

85
00:04:40.680 --> 00:04:45.800
<v Speaker 2>And there's wow, that's a that's a callback from a

86
00:04:45.839 --> 00:04:50.800
<v Speaker 2>while ago. Yeah, so I think, yeah, nothing expel traded.

87
00:04:50.879 --> 00:04:52.959
<v Speaker 2>They mean nothing important in them, And my guess is

88
00:04:52.959 --> 00:04:54.399
<v Speaker 2>there's still some forensics going on.

89
00:04:54.480 --> 00:04:56.839
<v Speaker 1>So I got a story for you. This guy goes

90
00:04:56.879 --> 00:04:59.839
<v Speaker 1>to Defcon thirty four and he learns how to ha

91
00:05:00.800 --> 00:05:04.560
<v Speaker 1>planes Wi Fi networks while in flight, and on the

92
00:05:04.600 --> 00:05:07.959
<v Speaker 1>flight home he says, hey, I wonder if this works.

93
00:05:07.720 --> 00:05:09.000
<v Speaker 3>Which means he learned nothing.

94
00:05:09.959 --> 00:05:13.839
<v Speaker 1>So he The story is passenger returning from Defcon thirty

95
00:05:13.879 --> 00:05:17.160
<v Speaker 1>four spoofs Delta Wi Fi network while in flight using

96
00:05:17.199 --> 00:05:21.160
<v Speaker 1>pen test tool. Pilots tell ground crew to alert corporate

97
00:05:21.199 --> 00:05:25.279
<v Speaker 1>security after attendee from hacking conference brings the party to

98
00:05:25.360 --> 00:05:25.800
<v Speaker 1>the sky.

99
00:05:27.439 --> 00:05:30.720
<v Speaker 2>Honestly, Okay, so we've for the last two weeks we've

100
00:05:30.720 --> 00:05:34.399
<v Speaker 2>talked about spoofing Wi Fi at hotels. Yeah right, and

101
00:05:35.279 --> 00:05:37.480
<v Speaker 2>we're like, oh, yeah, it's happened, and blah blah blah,

102
00:05:37.560 --> 00:05:39.600
<v Speaker 2>and none of these hotels have been like calling the

103
00:05:39.600 --> 00:05:42.079
<v Speaker 2>cops and picking up the hacker. Right, But here's my

104
00:05:42.160 --> 00:05:44.839
<v Speaker 2>hacking advice for you to your criminal listener.

105
00:05:45.560 --> 00:05:48.720
<v Speaker 1>If wait, wait, let's play the music, go ahead, it's

106
00:05:48.839 --> 00:05:50.160
<v Speaker 1>criminal career.

107
00:05:53.240 --> 00:05:56.399
<v Speaker 2>If you were trapped in a metal tube at thirty

108
00:05:56.399 --> 00:06:01.279
<v Speaker 2>six thousand feet and you decide to spoof the Wi Fi.

109
00:06:02.000 --> 00:06:04.759
<v Speaker 2>There's a very finite list of people on that plane

110
00:06:05.000 --> 00:06:07.040
<v Speaker 2>who could have done it, and they get throwing it

111
00:06:07.040 --> 00:06:09.279
<v Speaker 2>out there and they get to control you until you

112
00:06:09.360 --> 00:06:12.560
<v Speaker 2>leave the plane. It's right, unless you're gonna pull a

113
00:06:12.800 --> 00:06:15.519
<v Speaker 2>oh what was that guy? The guy who stole a

114
00:06:15.519 --> 00:06:17.240
<v Speaker 2>ton of money and then just like jumped out of

115
00:06:17.240 --> 00:06:19.600
<v Speaker 2>a plane with a oh, DV Cooper. Yes, unless you're

116
00:06:19.600 --> 00:06:22.319
<v Speaker 2>gonna pull a DV Cooper and let get off the

117
00:06:22.360 --> 00:06:24.319
<v Speaker 2>plane after you steal whatever it is you've stole.

118
00:06:24.519 --> 00:06:29.759
<v Speaker 3>Ah, I got your Starbucks account number. I'm off this plane. Yeah, exactly, Baza.

119
00:06:30.000 --> 00:06:32.360
<v Speaker 3>And then you jump off like come on, this is

120
00:06:32.519 --> 00:06:35.600
<v Speaker 3>just this is a rookie move, honestly. And you know

121
00:06:35.759 --> 00:06:39.040
<v Speaker 3>I understand coming back from deaf con to criminal. You

122
00:06:39.079 --> 00:06:42.399
<v Speaker 3>know you're super excited about some new cool thing or

123
00:06:42.480 --> 00:06:46.639
<v Speaker 3>technique you saw some researchers show you. And I get that,

124
00:06:46.720 --> 00:06:49.160
<v Speaker 3>I do, but you got to know there's a proper

125
00:06:49.199 --> 00:06:50.800
<v Speaker 3>time and place. The other thing I will tell you

126
00:06:50.920 --> 00:06:56.680
<v Speaker 3>is from a signals intelligence standpoint, there are some places

127
00:06:56.720 --> 00:06:59.879
<v Speaker 3>you do not want to mess with signals anywhere near

128
00:07:00.160 --> 00:07:08.040
<v Speaker 3>norrat right anywhere at thirty thousand feet on a plane, anywhere.

129
00:07:07.519 --> 00:07:12.560
<v Speaker 2>Where there's literally the most listening signals intelligence devices in

130
00:07:12.600 --> 00:07:15.399
<v Speaker 2>the air is on that plane, you know, for everything

131
00:07:15.399 --> 00:07:19.399
<v Speaker 2>from windspeed to radios to whatever. It's all the cockpit

132
00:07:19.480 --> 00:07:21.839
<v Speaker 2>is shielded, they're watching all the signals. Like, that's the

133
00:07:21.839 --> 00:07:24.480
<v Speaker 2>place you don't want to mess around with Wi Fi.

134
00:07:24.560 --> 00:07:28.959
<v Speaker 1>So here's what this guy did, right, So you're reportedly

135
00:07:29.079 --> 00:07:32.639
<v Speaker 1>jammed the plane's Wi Fi signal and then created their

136
00:07:32.680 --> 00:07:36.360
<v Speaker 1>own Wi Fi hotspot called Delta Wi Fi Fast that

137
00:07:36.480 --> 00:07:40.079
<v Speaker 1>routed to a phishing website that harvested the Google credentials

138
00:07:40.120 --> 00:07:42.000
<v Speaker 1>of any passenger attempted to lug in.

139
00:07:42.879 --> 00:07:44.639
<v Speaker 2>So, you know, felony.

140
00:07:45.000 --> 00:07:47.720
<v Speaker 3>Yeah, yeah, yeah, you get a felony. You get a

141
00:07:48.160 --> 00:07:49.879
<v Speaker 3>everybody gets a felony.

142
00:07:50.360 --> 00:07:52.680
<v Speaker 2>But here's the deal. You'd think, Okay, well, this guy

143
00:07:52.800 --> 00:07:57.279
<v Speaker 2>was absolutely being malicious, and in reality, he could have

144
00:07:57.399 --> 00:08:03.279
<v Speaker 2>just found a new uh you know, wireless credential harvesting

145
00:08:03.399 --> 00:08:07.480
<v Speaker 2>tool from deafcon and he ran it and said click

146
00:08:07.519 --> 00:08:10.839
<v Speaker 2>start and it automatically picked up the wireless in the area,

147
00:08:10.839 --> 00:08:13.600
<v Speaker 2>which was only one, and it automatically de offfed all

148
00:08:13.600 --> 00:08:16.319
<v Speaker 2>the users, which looks like a denialist service, and it

149
00:08:16.319 --> 00:08:17.639
<v Speaker 2>automatically spun up a Wi.

150
00:08:17.600 --> 00:08:19.800
<v Speaker 3>Fi We're getting call from an attorney who wants you

151
00:08:19.839 --> 00:08:21.240
<v Speaker 3>to testify on his behalf.

152
00:08:23.680 --> 00:08:27.360
<v Speaker 2>So could it just be he was ignorant, yes, on

153
00:08:27.439 --> 00:08:29.600
<v Speaker 2>what it does. But this brings up another great point.

154
00:08:30.399 --> 00:08:34.080
<v Speaker 2>You should not either did this maliciously or you should

155
00:08:34.120 --> 00:08:37.159
<v Speaker 2>never ever, ever ever run a tool, especially in a

156
00:08:37.159 --> 00:08:40.639
<v Speaker 2>cybersecurity space, that you don't one hundred percent know what

157
00:08:40.720 --> 00:08:41.399
<v Speaker 2>it's going to do.

158
00:08:41.559 --> 00:08:41.679
<v Speaker 4>Right.

159
00:08:41.720 --> 00:08:43.399
<v Speaker 3>Yeah, you're a script kitty at that point.

160
00:08:43.440 --> 00:08:45.720
<v Speaker 2>Yeah, exactly, Like it's cool to find this neat tool

161
00:08:45.759 --> 00:08:47.720
<v Speaker 2>on the internet and click the go button and assume

162
00:08:47.720 --> 00:08:50.399
<v Speaker 2>you're just this awesome hacker as credentials come rolling in.

163
00:08:50.879 --> 00:08:54.519
<v Speaker 2>If you don't know what it's doing, right, that could

164
00:08:54.600 --> 00:08:55.240
<v Speaker 2>be a felony.

165
00:08:55.399 --> 00:08:58.159
<v Speaker 3>That's the vast majority of people who are serving time

166
00:08:58.279 --> 00:09:04.440
<v Speaker 3>for exploitation of computers combined. Combine hacker with stupid, and

167
00:09:04.559 --> 00:09:05.679
<v Speaker 3>this is definitely one of them.

168
00:09:05.799 --> 00:09:07.480
<v Speaker 2>Yeah, definitely not a good idea.

169
00:09:07.480 --> 00:09:10.200
<v Speaker 1>And he certainly certainly didn't have time to review the

170
00:09:10.240 --> 00:09:12.840
<v Speaker 1>code on his way to v on his way to

171
00:09:12.879 --> 00:09:14.039
<v Speaker 1>the airport.

172
00:09:14.000 --> 00:09:16.399
<v Speaker 2>And honestly, come on, now, what you really should have

173
00:09:16.440 --> 00:09:19.080
<v Speaker 2>done is actually probably spoofed your own mac address on

174
00:09:19.120 --> 00:09:21.360
<v Speaker 2>your Wi Fi to somebody else that you saw on

175
00:09:21.399 --> 00:09:23.919
<v Speaker 2>the plane, because at that point that person to be

176
00:09:24.000 --> 00:09:25.799
<v Speaker 2>the person pulled out, not you, and you would have

177
00:09:25.799 --> 00:09:27.600
<v Speaker 2>been gone. I'm just throwing that out there. You got

178
00:09:27.600 --> 00:09:29.000
<v Speaker 2>to at least throw some false flags.

179
00:09:29.039 --> 00:09:29.159
<v Speaker 4>You know.

180
00:09:29.360 --> 00:09:34.240
<v Speaker 1>Any screenwriter who wants to write the next sequel to Sneaker,

181
00:09:34.480 --> 00:09:37.759
<v Speaker 1>Oh my God, should just listen to this show and

182
00:09:37.879 --> 00:09:40.000
<v Speaker 1>call me and listen to Dwayne's advice.

183
00:09:40.159 --> 00:09:43.120
<v Speaker 2>I am a super fan of Sneakers. Yes, do it.

184
00:09:43.200 --> 00:09:44.519
<v Speaker 2>There needs to be a second.

185
00:09:44.240 --> 00:09:46.600
<v Speaker 3>One, absolutely so. It doesn't look like there was an

186
00:09:46.679 --> 00:09:47.759
<v Speaker 3>arrest in this case.

187
00:09:47.919 --> 00:09:51.679
<v Speaker 2>Was there? It still says blah blah blah. While the

188
00:09:51.759 --> 00:09:54.879
<v Speaker 2>exact details are unclear in this incident, it seems pretty

189
00:09:54.879 --> 00:09:58.919
<v Speaker 2>clear it's still under investigation, and the attacker or prankster

190
00:09:59.159 --> 00:10:01.840
<v Speaker 2>apparently used a Wi Fi Pineapple.

191
00:10:04.480 --> 00:10:08.320
<v Speaker 3>Troy was on the flight, so he literally just slugged

192
00:10:08.320 --> 00:10:11.799
<v Speaker 3>in this Pineapple. Yeah no, and Troy smart enough to

193
00:10:11.840 --> 00:10:12.240
<v Speaker 3>not do.

194
00:10:12.720 --> 00:10:19.000
<v Speaker 1>Yeah, point point apple, all right. Next story, After Microsoft

195
00:10:19.120 --> 00:10:23.600
<v Speaker 1>threatened legal action, a security researcher publishes a new Windows

196
00:10:23.840 --> 00:10:25.240
<v Speaker 1>zero day bug.

197
00:10:25.200 --> 00:10:27.679
<v Speaker 2>Double dog dare you? First off, I swear to god,

198
00:10:27.759 --> 00:10:30.320
<v Speaker 2>Nightmare clips is not me just throwing this out there,

199
00:10:30.879 --> 00:10:34.559
<v Speaker 2>is not posting the giant m clips. Yeah, Nightmare clips.

200
00:10:34.840 --> 00:10:36.919
<v Speaker 2>I can testify I saw them both at the last meeting.

201
00:10:40.799 --> 00:10:43.440
<v Speaker 2>So so this is the guy or gal we've been

202
00:10:43.440 --> 00:10:47.240
<v Speaker 2>talking about for months now, who we're assuming at this

203
00:10:47.320 --> 00:10:52.399
<v Speaker 2>point is leveraging artificial intelligence to find just brilliant and

204
00:10:52.480 --> 00:10:57.799
<v Speaker 2>creative zero days in Microsoft Windows and really has focused

205
00:10:57.799 --> 00:11:03.600
<v Speaker 2>on Windows everything from you know, encrypted hard drive bypasses

206
00:11:03.759 --> 00:11:08.480
<v Speaker 2>to you know Windows authentication bypasses to prevess to you

207
00:11:08.559 --> 00:11:12.159
<v Speaker 2>name it. And what this person keeps doing is the

208
00:11:12.279 --> 00:11:15.320
<v Speaker 2>moment Microsoft releases a patch, like on a patch Tuesday,

209
00:11:16.080 --> 00:11:19.399
<v Speaker 2>like a couple of hours later, this person then boths

210
00:11:19.440 --> 00:11:22.360
<v Speaker 2>on get hub. The new patch sucks, and here's how

211
00:11:22.399 --> 00:11:23.799
<v Speaker 2>I still have access to your computers.

212
00:11:24.559 --> 00:11:27.200
<v Speaker 3>So it makes me think we didn't add this story.

213
00:11:27.240 --> 00:11:32.440
<v Speaker 3>But Claude is now looking to fingerprint their output, even

214
00:11:32.480 --> 00:11:34.480
<v Speaker 3>the text outputs, so that it can be determined that

215
00:11:34.480 --> 00:11:37.320
<v Speaker 3>it was from Claude. I wonder if you'd be able

216
00:11:37.360 --> 00:11:40.679
<v Speaker 3>to tell whether he used Claude because of that, based

217
00:11:40.679 --> 00:11:42.279
<v Speaker 3>on the code that actually did run.

218
00:11:44.039 --> 00:11:47.919
<v Speaker 2>So that's an interesting thought, Like fingerprinting the output code

219
00:11:47.919 --> 00:11:51.679
<v Speaker 2>of an LM. Maybe this guy or gal might be

220
00:11:51.720 --> 00:11:53.919
<v Speaker 2>smart enough. I mean, they're claiming even if you copy

221
00:11:53.960 --> 00:11:56.759
<v Speaker 2>it to like notepad. Oh yeah, the fingerprints in the

222
00:11:56.799 --> 00:12:01.080
<v Speaker 2>text yep. Yeah, the type of things that they use encoding. Yeah,

223
00:12:01.080 --> 00:12:03.639
<v Speaker 2>I could absolutely see that. But I will tell you

224
00:12:03.759 --> 00:12:06.919
<v Speaker 2>at some point, will it matter, Like eighty percent of

225
00:12:06.960 --> 00:12:08.960
<v Speaker 2>the code is going to be generated by either claud

226
00:12:09.039 --> 00:12:09.720
<v Speaker 2>or whoever.

227
00:12:09.480 --> 00:12:12.279
<v Speaker 3>Well, the FBI would know who to serve the warrant to.

228
00:12:12.840 --> 00:12:15.159
<v Speaker 2>Oh you're saying it's per person I think it is

229
00:12:15.240 --> 00:12:17.639
<v Speaker 2>not just per generated LM, like this is an LM thing.

230
00:12:17.759 --> 00:12:19.879
<v Speaker 3>Well, I don't know. I guess I don't know that

231
00:12:21.279 --> 00:12:24.240
<v Speaker 3>it just came out. It's something that's causing a kerfuffle,

232
00:12:24.639 --> 00:12:26.559
<v Speaker 3>but I wouldn't doubt it. I mean, remember the printer,

233
00:12:26.720 --> 00:12:30.200
<v Speaker 3>the microcodes and printers, oh, the micro dots. Micro dots,

234
00:12:30.240 --> 00:12:33.720
<v Speaker 3>So basically, if you print something on an HPE or

235
00:12:33.840 --> 00:12:37.000
<v Speaker 3>Canon or any name brand printer, it can be traced

236
00:12:37.039 --> 00:12:38.960
<v Speaker 3>back to the exact serial number of the printer that

237
00:12:39.000 --> 00:12:40.039
<v Speaker 3>printed it, right, yep.

238
00:12:40.200 --> 00:12:43.840
<v Speaker 1>And what's weird here is Nightmare Clips doesn't seem to

239
00:12:43.879 --> 00:12:47.240
<v Speaker 1>be wanting bug bounties, like they're just doing it to

240
00:12:47.279 --> 00:12:48.879
<v Speaker 1>antagonize Microsoft.

241
00:12:48.960 --> 00:12:52.240
<v Speaker 3>Yeah, well or to wake Microsoft up exactly. And the

242
00:12:52.320 --> 00:12:54.879
<v Speaker 3>Robin Hood model, that's that has.

243
00:12:54.840 --> 00:12:59.679
<v Speaker 2>Always been the story. The line. The claim, yeah, is

244
00:13:00.720 --> 00:13:04.279
<v Speaker 2>they're not moving fast enough. They're not protecting enough of

245
00:13:04.360 --> 00:13:07.799
<v Speaker 2>the world by just sitting back and not worrying about

246
00:13:07.799 --> 00:13:10.159
<v Speaker 2>these things. And if it's as easy as a single

247
00:13:10.200 --> 00:13:13.799
<v Speaker 2>person being able to find them, why can't Microsoft so well?

248
00:13:13.840 --> 00:13:18.279
<v Speaker 1>To Microsoft's credit, they've been fixing zero days and bugs

249
00:13:18.320 --> 00:13:21.039
<v Speaker 1>at an alarming rate because of AI.

250
00:13:21.159 --> 00:13:23.759
<v Speaker 2>They're oh, yeah, you know, they just you know what,

251
00:13:23.960 --> 00:13:25.440
<v Speaker 2>you know what Microsoft would have done back in the

252
00:13:25.519 --> 00:13:30.480
<v Speaker 2>nineties killed they would have hired him. Yeah, they would

253
00:13:30.480 --> 00:13:32.200
<v Speaker 2>have been like, you know what, you're so good at this. Great,

254
00:13:32.240 --> 00:13:35.159
<v Speaker 2>You're you're now the head of our emerging you know,

255
00:13:35.240 --> 00:13:38.480
<v Speaker 2>AI security division, Go find bugs.

256
00:13:39.240 --> 00:13:44.399
<v Speaker 1>Okay. Next story, bleeping computer, plug and pawn pone Sorry,

257
00:13:44.879 --> 00:13:48.240
<v Speaker 1>plug and pone attack uses fake USB devices for Windows

258
00:13:48.240 --> 00:13:49.399
<v Speaker 1>system access.

259
00:13:53.600 --> 00:13:55.960
<v Speaker 2>Yeah, so this is neat. Actually, so it's a good thing,

260
00:13:56.000 --> 00:13:58.279
<v Speaker 2>you point out, oldie but giddy. We've always said don't

261
00:13:58.279 --> 00:14:02.240
<v Speaker 2>plug in anything USB U into your computer, especially if

262
00:14:02.240 --> 00:14:03.960
<v Speaker 2>you pick it up off the ground and plug it in,

263
00:14:04.159 --> 00:14:05.840
<v Speaker 2>or Dwayne gives it to you, or if I give

264
00:14:05.879 --> 00:14:09.679
<v Speaker 2>it to you like it exactly. I can't tell you

265
00:14:09.720 --> 00:14:12.360
<v Speaker 2>how many times, like I'll hand somebody a mouse or

266
00:14:12.399 --> 00:14:13.960
<v Speaker 2>a keyboard, Oh yeah, I get this mouse in my

267
00:14:14.000 --> 00:14:17.279
<v Speaker 2>bag and they be like, isn't a mouse really? I'm like,

268
00:14:17.360 --> 00:14:18.840
<v Speaker 2>I don't know, do you need a mouse because if

269
00:14:18.879 --> 00:14:21.639
<v Speaker 2>you do, you're gonna have to use this one. But anyways,

270
00:14:22.600 --> 00:14:25.960
<v Speaker 2>so we've seen tons of plug in play, Like the

271
00:14:26.279 --> 00:14:30.600
<v Speaker 2>rubber duck, for example, is a malicious USB that you

272
00:14:30.639 --> 00:14:33.440
<v Speaker 2>plug it in. Oh yeah, the OMG cable is a

273
00:14:33.480 --> 00:14:36.000
<v Speaker 2>malicious USB that you plug in. Hack five should be

274
00:14:36.000 --> 00:14:39.039
<v Speaker 2>a sponsor. We talk about them too much, I know, right, Lord,

275
00:14:39.600 --> 00:14:42.480
<v Speaker 2>they put out some fantastic tools. Darren Kitchens, I think

276
00:14:42.559 --> 00:14:46.600
<v Speaker 2>is the guy over there running running the stuff. What

277
00:14:46.639 --> 00:14:51.039
<v Speaker 2>those generally do, right is they run scripts. That's it, right,

278
00:14:51.080 --> 00:14:53.840
<v Speaker 2>So you plug it in and it automatically will run

279
00:14:53.879 --> 00:14:57.240
<v Speaker 2>a PowerShell script that gains access or something does you know,

280
00:14:58.200 --> 00:15:00.840
<v Speaker 2>and it poses as a hit you know, privileg jescalation whatever.

281
00:15:00.919 --> 00:15:03.240
<v Speaker 3>What's basically pretends it's a house or a keyboard.

282
00:15:03.559 --> 00:15:06.000
<v Speaker 2>Yeah, exactly. It ken poses a hit and you can

283
00:15:06.039 --> 00:15:08.679
<v Speaker 2>manipulate what it poses. That could poses a storage device

284
00:15:08.720 --> 00:15:10.759
<v Speaker 2>or whatever. But generally mouse and keyboard is the easiest

285
00:15:10.759 --> 00:15:15.120
<v Speaker 2>way to pose human face device. Yeah, because if you

286
00:15:15.200 --> 00:15:17.759
<v Speaker 2>pose as a keyboard, well then it's not uncommon for

287
00:15:17.799 --> 00:15:20.120
<v Speaker 2>you to be typing things, right, So when you plug

288
00:15:20.120 --> 00:15:23.440
<v Speaker 2>that rubber duck in, it poses a keyboard. This attack

289
00:15:23.559 --> 00:15:27.000
<v Speaker 2>is novel. This one's a little bit different. So this

290
00:15:27.039 --> 00:15:30.159
<v Speaker 2>one uses a piece of software called face Dancer. It's

291
00:15:30.240 --> 00:15:32.279
<v Speaker 2>gonna let that sink in for a second.

292
00:15:33.000 --> 00:15:34.639
<v Speaker 3>Craig Herbert's rolling in his grave.

293
00:15:35.559 --> 00:15:39.519
<v Speaker 2>So when you plug this USB in, face Dancer is

294
00:15:39.519 --> 00:15:44.519
<v Speaker 2>a piece of software that allows the USB to look

295
00:15:44.759 --> 00:15:47.720
<v Speaker 2>like a different type of USB device. Now we just

296
00:15:47.759 --> 00:15:50.399
<v Speaker 2>talked about the rubber duck looking like a keyboard, so okay,

297
00:15:50.440 --> 00:15:54.000
<v Speaker 2>who cares? Why is that uncommon? What this allows you

298
00:15:54.039 --> 00:15:56.440
<v Speaker 2>to do is make it look like a very specific

299
00:15:56.639 --> 00:16:01.399
<v Speaker 2>USB device, and they they the attack. This actually also

300
00:16:01.519 --> 00:16:04.679
<v Speaker 2>was a defcon drop. Thank god that guy didn't try

301
00:16:04.679 --> 00:16:06.679
<v Speaker 2>and plug it into the USB in the back of

302
00:16:06.679 --> 00:16:10.679
<v Speaker 2>the See it's the same as what the attackers did

303
00:16:10.720 --> 00:16:16.440
<v Speaker 2>here is they made the device impersonate a Sony Felicia device,

304
00:16:17.759 --> 00:16:23.279
<v Speaker 2>which is a card reader for door access, and that

305
00:16:23.519 --> 00:16:27.840
<v Speaker 2>driver not only does not exist on Windows. So what

306
00:16:27.919 --> 00:16:31.279
<v Speaker 2>it does is it pulls it from Sony. That driver

307
00:16:31.480 --> 00:16:34.120
<v Speaker 2>is so old it has a DNS exploit in it

308
00:16:34.200 --> 00:16:38.039
<v Speaker 2>where it will as the system, give you the ability

309
00:16:38.080 --> 00:16:40.600
<v Speaker 2>to set the DNS server. So that's the first thing

310
00:16:40.679 --> 00:16:42.879
<v Speaker 2>they plug in the USB drive. It pulls down this

311
00:16:42.960 --> 00:16:46.080
<v Speaker 2>card reader software and then they tell the card reader software, oh,

312
00:16:46.120 --> 00:16:47.960
<v Speaker 2>our DNS is right here. It's you know, one dot

313
00:16:47.960 --> 00:16:51.200
<v Speaker 2>two dot three wa or whatever, it's like one zero

314
00:16:51.279 --> 00:16:54.120
<v Speaker 2>dot five right, which is one of the local servers.

315
00:16:55.080 --> 00:16:58.159
<v Speaker 2>Then they unplug the USB and they plug it back

316
00:16:58.240 --> 00:17:02.600
<v Speaker 2>in and face the answer switches the idea of the USB.

317
00:17:02.759 --> 00:17:05.839
<v Speaker 2>Now now it's not a card reader, it is a

318
00:17:05.920 --> 00:17:09.720
<v Speaker 2>Sierra wireless device. And the interesting thing about the Sierra

319
00:17:09.839 --> 00:17:12.680
<v Speaker 2>wireless device is when it pulls down the drivers for

320
00:17:12.880 --> 00:17:18.319
<v Speaker 2>that they are pulled over HTTP. It's one of the

321
00:17:18.319 --> 00:17:21.319
<v Speaker 2>only drivers not pulled over a secure connection. Wow. So

322
00:17:22.039 --> 00:17:25.400
<v Speaker 2>the researchers now that they have control over DNS, so

323
00:17:25.480 --> 00:17:27.039
<v Speaker 2>they can tell you where to go to get to

324
00:17:27.079 --> 00:17:32.079
<v Speaker 2>Sierra drivers, and they know those drivers are signed and

325
00:17:32.480 --> 00:17:36.759
<v Speaker 2>not being pulled in a secure way, they overwrite them

326
00:17:37.200 --> 00:17:38.960
<v Speaker 2>and when they run now they have full access to

327
00:17:39.000 --> 00:17:42.759
<v Speaker 2>the system as system privilege. The whole attack chain takes

328
00:17:42.799 --> 00:17:45.000
<v Speaker 2>about five minutes. So you plug the c USB in,

329
00:17:45.200 --> 00:17:47.200
<v Speaker 2>you wait a couple seconds, you unplug it, you plug

330
00:17:47.240 --> 00:17:48.799
<v Speaker 2>it back in, you wait a couple of minutes and

331
00:17:48.799 --> 00:17:50.960
<v Speaker 2>you unplug it and now you have full system access.

332
00:17:51.000 --> 00:17:51.319
<v Speaker 1>Wow.

333
00:17:52.039 --> 00:17:54.720
<v Speaker 2>Awesome, awesome chain, very very cool stuff.

334
00:17:55.000 --> 00:17:56.240
<v Speaker 1>So when did you get yours?

335
00:17:56.319 --> 00:17:56.799
<v Speaker 4>Duane?

336
00:17:57.279 --> 00:18:00.799
<v Speaker 2>So USB has actually run through a great fat I've

337
00:18:00.799 --> 00:18:02.079
<v Speaker 2>had one for about three years.

338
00:18:03.279 --> 00:18:07.519
<v Speaker 1>So yeah, do you use it to access customers machines

339
00:18:07.519 --> 00:18:09.200
<v Speaker 1>when they're trying to secure everything?

340
00:18:10.319 --> 00:18:13.440
<v Speaker 2>Only paid engagements? Patrick? Is that what I'm supposed to say?

341
00:18:13.480 --> 00:18:19.279
<v Speaker 2>Only on customers? The last news story might change? That's

342
00:18:20.599 --> 00:18:22.240
<v Speaker 2>that's true. That's true.

343
00:18:23.160 --> 00:18:25.400
<v Speaker 1>Well, you're gonna have to wait for that one until

344
00:18:25.440 --> 00:18:27.480
<v Speaker 1>after the break. So we'll be right back after these

345
00:18:27.559 --> 00:18:34.000
<v Speaker 1>very important messages and we're back. You're listening to Security

346
00:18:34.000 --> 00:18:36.920
<v Speaker 1>this week. I'm Carl, Let's Dwayne and Patrick, and we're

347
00:18:36.960 --> 00:18:39.119
<v Speaker 1>halfway through the show here. We really only have three

348
00:18:39.200 --> 00:18:41.640
<v Speaker 1>more to go, but the last one you're going to really.

349
00:18:42.720 --> 00:18:43.880
<v Speaker 3>It's a summertime, you know.

350
00:18:44.000 --> 00:18:49.160
<v Speaker 1>Yeah. So the next one, Max Severity SAP Commerce cloud

351
00:18:49.200 --> 00:18:53.079
<v Speaker 1>flaw now targeted in attacks. How is this story different

352
00:18:53.119 --> 00:18:57.000
<v Speaker 1>from the last A commerce cloud?

353
00:18:59.160 --> 00:19:01.599
<v Speaker 3>Yeah, this one goes to eleven.

354
00:19:04.400 --> 00:19:08.799
<v Speaker 2>So yeah, I know, right, So SAP commerce claud we've

355
00:19:08.799 --> 00:19:12.200
<v Speaker 2>been talking about how SAP just patched I don't know

356
00:19:12.240 --> 00:19:15.359
<v Speaker 2>what was it sixteen hundred flaws something. I feel like

357
00:19:15.400 --> 00:19:18.759
<v Speaker 2>that a couple of weeks ago. So the interesting thing

358
00:19:18.759 --> 00:19:21.960
<v Speaker 2>about this article, yes, you know CE twenty twenty six

359
00:19:22.039 --> 00:19:27.000
<v Speaker 2>five eight two three one was patched. This article is

360
00:19:27.039 --> 00:19:32.720
<v Speaker 2>saying three days after the patch released, they started to

361
00:19:32.759 --> 00:19:36.759
<v Speaker 2>see it being actively exploited. So imagine this SAP goes

362
00:19:36.799 --> 00:19:39.240
<v Speaker 2>out and does their due diligence and he's using AI

363
00:19:39.319 --> 00:19:44.000
<v Speaker 2>and is finding all the bugs and then they patch them. Hey,

364
00:19:44.039 --> 00:19:46.599
<v Speaker 2>we just patched thirteen hundred bucks or sixteen hundred bucks,

365
00:19:47.240 --> 00:19:50.200
<v Speaker 2>and an attacker on the internet then took that patch

366
00:19:50.759 --> 00:19:55.000
<v Speaker 2>patch diffed it. And patch diff is you take a

367
00:19:55.000 --> 00:19:57.400
<v Speaker 2>piece of software that you have, or you take the

368
00:19:57.880 --> 00:20:01.960
<v Speaker 2>patch that the vendor is pushing out, and you analyze

369
00:20:02.000 --> 00:20:05.039
<v Speaker 2>the patch because if they say they fixed a security issue,

370
00:20:05.440 --> 00:20:06.279
<v Speaker 2>it's in the patch.

371
00:20:06.480 --> 00:20:07.799
<v Speaker 3>Or your AI analyze.

372
00:20:08.039 --> 00:20:10.640
<v Speaker 2>Yeah, usually you'll have nowadays you just use your AI

373
00:20:10.720 --> 00:20:12.400
<v Speaker 2>for it, and you'll hand your AI the patch, you

374
00:20:12.400 --> 00:20:15.799
<v Speaker 2>go what did they fix? And the AI will go, oh,

375
00:20:15.839 --> 00:20:19.000
<v Speaker 2>they fixed this part of the code. Now I know

376
00:20:19.039 --> 00:20:21.799
<v Speaker 2>how to exploit it. So it took three days. The

377
00:20:21.839 --> 00:20:24.319
<v Speaker 2>patch was released about three days later. What they're now

378
00:20:24.400 --> 00:20:27.519
<v Speaker 2>seeing is active exploitation of this on.

379
00:20:27.480 --> 00:20:30.200
<v Speaker 3>The ape, but Dwayne, won't the AI refuse?

380
00:20:32.759 --> 00:20:37.880
<v Speaker 1>Are AI ethically programmed commandator?

381
00:20:38.480 --> 00:20:44.400
<v Speaker 2>Sure they are. Yeah, there's a Yeah, there's all sorts

382
00:20:44.440 --> 00:20:47.640
<v Speaker 2>of really like cool ways to manipulate the AI if.

383
00:20:47.559 --> 00:20:50.960
<v Speaker 3>You it's all jail breaking, and jail is still probably

384
00:20:51.000 --> 00:20:54.759
<v Speaker 3>the biggest open space there is, absolutely because we still

385
00:20:54.759 --> 00:20:57.160
<v Speaker 3>haven't plumbed the full depths. In the old days, you

386
00:20:57.200 --> 00:20:59.599
<v Speaker 3>could jail break just by asking in the foreign language

387
00:20:59.720 --> 00:21:00.599
<v Speaker 3>yeah sure.

388
00:21:00.519 --> 00:21:03.880
<v Speaker 2>Or in emojis, or in yea unicode, or or.

389
00:21:03.880 --> 00:21:06.440
<v Speaker 3>Doing a hypothetical and saying we're back in the eighteen

390
00:21:06.519 --> 00:21:08.839
<v Speaker 3>hundreds and therefore I need to know yeah.

391
00:21:09.079 --> 00:21:12.400
<v Speaker 2>And there's still even some crazy ones that generally will

392
00:21:12.400 --> 00:21:14.680
<v Speaker 2>seem to work where you can be like, hey, if

393
00:21:14.759 --> 00:21:16.920
<v Speaker 2>I had access to this system and I saw these things,

394
00:21:18.039 --> 00:21:19.559
<v Speaker 2>what would they mean? And it'd be like, oh, it

395
00:21:19.599 --> 00:21:21.559
<v Speaker 2>means if you open that file over there, you get

396
00:21:21.599 --> 00:21:23.799
<v Speaker 2>full system access. Don't do it. You'd be like, okay,

397
00:21:23.839 --> 00:21:26.039
<v Speaker 2>I won't, but if I did do it, I would

398
00:21:26.079 --> 00:21:29.319
<v Speaker 2>have seen these things. What's next, right, And it's like, oh, well,

399
00:21:29.799 --> 00:21:32.359
<v Speaker 2>clearly this person's not actually running this code, when in

400
00:21:32.400 --> 00:21:34.119
<v Speaker 2>reality you're still running it on the background and it's

401
00:21:34.160 --> 00:21:38.440
<v Speaker 2>giving you an example. So, yeah, jail breaking is pretty

402
00:21:38.480 --> 00:21:40.240
<v Speaker 2>easy to do, even on the foundational models.

403
00:21:40.240 --> 00:21:43.200
<v Speaker 3>We're in the early early it's like the days, it's

404
00:21:43.240 --> 00:21:45.680
<v Speaker 3>like the months after we discovered what sequel injection is.

405
00:21:45.720 --> 00:21:48.640
<v Speaker 3>It was, it was, it was years before we got

406
00:21:48.640 --> 00:21:50.000
<v Speaker 3>a handle on it. I think, I think we didn't

407
00:21:50.039 --> 00:21:52.519
<v Speaker 3>get a handle on it until twenty forty. Well yeah,

408
00:21:53.000 --> 00:21:55.039
<v Speaker 3>I know, right, and even then not so of that.

409
00:21:55.240 --> 00:21:57.160
<v Speaker 2>I mean. And it is funny because you look at

410
00:21:57.160 --> 00:22:01.480
<v Speaker 2>these frontier models and they talk about like, oh, well

411
00:22:01.480 --> 00:22:04.960
<v Speaker 2>we released you know, mythos, but it has guardrails or

412
00:22:05.000 --> 00:22:07.799
<v Speaker 2>it has you know, handcuffs, or it has whatever, and

413
00:22:07.839 --> 00:22:09.599
<v Speaker 2>we're like, okay, sure, I'm like.

414
00:22:09.839 --> 00:22:10.759
<v Speaker 3>It just sounds kinky.

415
00:22:10.960 --> 00:22:15.440
<v Speaker 2>Yeah, right, there are so many ways to break these.

416
00:22:15.599 --> 00:22:18.119
<v Speaker 3>It has safe words, it has yeah.

417
00:22:18.160 --> 00:22:20.160
<v Speaker 1>So has it been patched? Is this a go patch?

418
00:22:20.319 --> 00:22:22.839
<v Speaker 2>It's been patched. Yeah, And that's you know, I mean,

419
00:22:23.079 --> 00:22:26.240
<v Speaker 2>it was patched and then yeah, it's been patched. The

420
00:22:26.640 --> 00:22:29.680
<v Speaker 2>point here too, is like within three days it was

421
00:22:29.720 --> 00:22:34.720
<v Speaker 2>actively exploited. So and according to all of the scanning here,

422
00:22:35.319 --> 00:22:42.359
<v Speaker 2>there were about ninety three available SAP commerce servers on

423
00:22:42.440 --> 00:22:45.920
<v Speaker 2>the internet with this exact version that have the problem.

424
00:22:46.000 --> 00:22:50.079
<v Speaker 2>So they're saying there's about four thousand call it companies

425
00:22:50.119 --> 00:22:54.519
<v Speaker 2>out there that have SAP commerce online right now that

426
00:22:54.640 --> 00:22:56.000
<v Speaker 2>is an exploitable version.

427
00:22:55.839 --> 00:22:56.920
<v Speaker 1>And then they haven't patched.

428
00:22:57.000 --> 00:22:59.519
<v Speaker 3>And that's so this is a story not of you

429
00:22:59.640 --> 00:23:02.759
<v Speaker 3>need to it's not patched. It's it's patched, and it's

430
00:23:02.799 --> 00:23:03.240
<v Speaker 3>a race.

431
00:23:03.480 --> 00:23:05.200
<v Speaker 2>Yeah, and why did you take why are you taking

432
00:23:05.240 --> 00:23:07.319
<v Speaker 2>three days? And you know there's there's some comments here

433
00:23:07.359 --> 00:23:09.759
<v Speaker 2>about well, some of those might be actually honeypots that

434
00:23:09.759 --> 00:23:12.240
<v Speaker 2>are pretending to be that version. Okay, but not all

435
00:23:12.240 --> 00:23:15.599
<v Speaker 2>four thousand of them. It's like six of them, Yeah, exactly,

436
00:23:15.799 --> 00:23:18.440
<v Speaker 2>like we get it. There's a few people who actually

437
00:23:18.440 --> 00:23:20.400
<v Speaker 2>listen to the internet to see what's you know. That's

438
00:23:20.799 --> 00:23:23.799
<v Speaker 2>well actually, and that's a good point too. It's one

439
00:23:23.839 --> 00:23:25.519
<v Speaker 2>of the reasons when we say this is quote unquote

440
00:23:25.519 --> 00:23:28.160
<v Speaker 2>actively exploited on the internet. There's two ways to find

441
00:23:28.160 --> 00:23:30.319
<v Speaker 2>that out right. A company either gets hit with it

442
00:23:30.640 --> 00:23:32.759
<v Speaker 2>and now you know it's actively exploited on the internet,

443
00:23:32.920 --> 00:23:36.079
<v Speaker 2>or somebody puts up a honeypot and watches for that

444
00:23:36.160 --> 00:23:38.880
<v Speaker 2>type of traffic and then we know it's actively exploited.

445
00:23:39.000 --> 00:23:42.039
<v Speaker 1>So this next story reminds me of a quote by

446
00:23:42.039 --> 00:23:49.400
<v Speaker 1>Mark twain, naked people have little or no influence in society.

447
00:23:50.599 --> 00:23:54.319
<v Speaker 1>The FBI says hackers target online accounts to steal nude

448
00:23:54.359 --> 00:23:57.799
<v Speaker 1>photos and at first blush just by reading the headline.

449
00:23:57.799 --> 00:24:02.160
<v Speaker 1>You're like, yon nude photos. But these are hacked accounts

450
00:24:02.160 --> 00:24:06.440
<v Speaker 1>where they found nude photos on children and adults phones

451
00:24:07.119 --> 00:24:11.359
<v Speaker 1>and then extorted them for it, you know, saying that

452
00:24:11.359 --> 00:24:13.799
<v Speaker 1>we're going to show these pictures all over the place

453
00:24:13.920 --> 00:24:16.680
<v Speaker 1>or if you don't cough up some money.

454
00:24:17.000 --> 00:24:20.240
<v Speaker 2>Yeah, this is the worst. Yeah, I was gonna say,

455
00:24:20.240 --> 00:24:20.599
<v Speaker 2>no joke.

456
00:24:20.680 --> 00:24:22.920
<v Speaker 3>Human traffickers are the only thing lower than this.

457
00:24:23.400 --> 00:24:25.960
<v Speaker 2>Yeah, no, no joking about this. I mean, it's tough.

458
00:24:26.000 --> 00:24:28.839
<v Speaker 2>It's a big it's a big problem in a lot

459
00:24:28.839 --> 00:24:32.680
<v Speaker 2>of countries, and especially for the youth, which really kind

460
00:24:32.680 --> 00:24:34.359
<v Speaker 2>of sucks because they feel like they have no place

461
00:24:34.400 --> 00:24:38.559
<v Speaker 2>to turn. Yeah, it's funny. I've always told my kids, like, Hey,

462
00:24:38.559 --> 00:24:41.480
<v Speaker 2>if you're ever extorted or something over your phone and

463
00:24:41.559 --> 00:24:44.279
<v Speaker 2>somebody claims that you're going to put pictures out, just

464
00:24:44.279 --> 00:24:46.640
<v Speaker 2>give me the phone. Don't tell me. Because I was like,

465
00:24:47.039 --> 00:24:49.079
<v Speaker 2>I was like, just give me the phone. I will

466
00:24:49.119 --> 00:24:49.880
<v Speaker 2>make sure.

467
00:24:50.079 --> 00:24:52.079
<v Speaker 3>I have a special set of skills.

468
00:24:52.000 --> 00:24:55.240
<v Speaker 2>Exactly will make sure that it doesn't happen.

469
00:24:55.400 --> 00:24:59.880
<v Speaker 1>Gives me equivalent of the untouchables whack the taken taken.

470
00:25:01.599 --> 00:25:05.759
<v Speaker 2>So yeah, but this is you know, the root of

471
00:25:05.799 --> 00:25:10.720
<v Speaker 2>this is these victims are getting phished if you will,

472
00:25:11.759 --> 00:25:15.400
<v Speaker 2>or smished or whatever. Right, They're getting communicated either over

473
00:25:15.440 --> 00:25:20.319
<v Speaker 2>social media, SMS or email, and they're letting the attackers

474
00:25:20.359 --> 00:25:23.240
<v Speaker 2>in because like they'll get a code saying hey, we

475
00:25:23.279 --> 00:25:26.920
<v Speaker 2>need to authenticate to your you know whatever account, and

476
00:25:26.960 --> 00:25:28.640
<v Speaker 2>then somebody will text them and be like, oh, this

477
00:25:28.720 --> 00:25:31.240
<v Speaker 2>is you know, I don't know, this is X, and

478
00:25:31.400 --> 00:25:33.480
<v Speaker 2>you know, you might receive a code. We need that

479
00:25:33.519 --> 00:25:35.759
<v Speaker 2>code to verify your account or whatever. Right, And they're

480
00:25:35.799 --> 00:25:40.640
<v Speaker 2>getting conned into giving access to their social media accounts,

481
00:25:40.640 --> 00:25:43.000
<v Speaker 2>to their online accounts, and then these people are calling

482
00:25:43.039 --> 00:25:46.039
<v Speaker 2>and grabbing this information and sending it out. The thing

483
00:25:46.079 --> 00:25:48.480
<v Speaker 2>that I find surprising is twofold. First off, this is

484
00:25:48.519 --> 00:25:51.720
<v Speaker 2>an old tactic. So if anybody asks you for things

485
00:25:52.000 --> 00:25:54.960
<v Speaker 2>or like a verification code or whatever on your phone,

486
00:25:55.440 --> 00:25:58.759
<v Speaker 2>never give it to them. There's there's not a service

487
00:25:58.799 --> 00:26:02.039
<v Speaker 2>provider on the planet that will text you and ask

488
00:26:02.079 --> 00:26:05.039
<v Speaker 2>you for a code that they just texted you. That

489
00:26:05.119 --> 00:26:09.839
<v Speaker 2>doesn't make any sense. Yeah, right, if you're if you

490
00:26:09.839 --> 00:26:12.480
<v Speaker 2>you know, avoid clicking on links of course, because if

491
00:26:12.519 --> 00:26:14.000
<v Speaker 2>you click on a link that looks like it's bringing

492
00:26:14.079 --> 00:26:16.440
<v Speaker 2>you to x dot com and it doesn't, and there's

493
00:26:16.440 --> 00:26:18.680
<v Speaker 2>obviously a code that pops up and you type it

494
00:26:18.720 --> 00:26:22.519
<v Speaker 2>in from your phone now here again, you know you're

495
00:26:22.599 --> 00:26:24.279
<v Speaker 2>you might be giving an attack or that code, so

496
00:26:24.319 --> 00:26:27.000
<v Speaker 2>you want to be careful there. But secondly, the other

497
00:26:27.039 --> 00:26:29.000
<v Speaker 2>thing that surprises me about this is in the day

498
00:26:29.039 --> 00:26:31.319
<v Speaker 2>of a AI, in the in the day and age

499
00:26:31.400 --> 00:26:34.960
<v Speaker 2>of deep fakes, Like, why don't people just claim, oh,

500
00:26:34.960 --> 00:26:36.920
<v Speaker 2>it's just deep fake? Does not me right, you know

501
00:26:36.960 --> 00:26:37.359
<v Speaker 2>what I mean?

502
00:26:37.680 --> 00:26:41.519
<v Speaker 3>Like, because it probably is, it's become it could be, right,

503
00:26:41.559 --> 00:26:44.400
<v Speaker 3>because a lot of these claims are just they're just

504
00:26:44.720 --> 00:26:47.599
<v Speaker 3>they're they're not true, right, they don't. Actually they're claiming

505
00:26:47.640 --> 00:26:50.880
<v Speaker 3>to have something they can't get in the hopes that

506
00:26:50.960 --> 00:26:52.960
<v Speaker 3>and if they needed to show you proof that they

507
00:26:53.000 --> 00:26:56.079
<v Speaker 3>could just deep fake it, right exactly. Yeah, So again

508
00:26:56.440 --> 00:26:58.920
<v Speaker 3>the LLLM would protect me from that, right, yeah.

509
00:26:58.839 --> 00:27:03.400
<v Speaker 1>Right, because shoes ethically programmed, not the open ones.

510
00:27:03.119 --> 00:27:03.240
<v Speaker 4>Yea.

511
00:27:05.119 --> 00:27:07.880
<v Speaker 2>So needless to say, like, I'm surprised that this is

512
00:27:07.920 --> 00:27:10.720
<v Speaker 2>still a tactic. But if you are a young listener

513
00:27:10.720 --> 00:27:14.599
<v Speaker 2>out there obviously don't respond to any of these types

514
00:27:14.599 --> 00:27:17.880
<v Speaker 2>of texts, and there are generally places that you can

515
00:27:17.920 --> 00:27:22.160
<v Speaker 2>turn to, uh, you know that will help out.

516
00:27:22.240 --> 00:27:25.880
<v Speaker 1>Okay, that brings us to our lead story this week,

517
00:27:26.519 --> 00:27:30.400
<v Speaker 1>US government will let private companies hack criminal gangs.

518
00:27:31.079 --> 00:27:34.359
<v Speaker 3>I'm so conflicted here. I love the idea.

519
00:27:35.119 --> 00:27:37.559
<v Speaker 2>I get it. I was gonna say, what's the conflict Patrick?

520
00:27:37.880 --> 00:27:41.119
<v Speaker 3>It will well because what's funny because the story does

521
00:27:41.160 --> 00:27:44.240
<v Speaker 3>say that there's going to be huge like legal insecurity

522
00:27:44.319 --> 00:27:46.519
<v Speaker 3>risks because false flags are real.

523
00:27:46.640 --> 00:27:49.480
<v Speaker 1>The current US government could be considered a criminal gang.

524
00:27:50.440 --> 00:27:54.319
<v Speaker 3>And people off shore that I know. So here's here's

525
00:27:54.319 --> 00:27:58.200
<v Speaker 3>the bottom line. This is a militia is really what's

526
00:27:58.240 --> 00:28:02.319
<v Speaker 3>happening or private here? Remember you know that the British

527
00:28:02.359 --> 00:28:03.720
<v Speaker 3>have used privateers quite a bit.

528
00:28:03.759 --> 00:28:05.359
<v Speaker 2>I would love to be called a privateer.

529
00:28:05.519 --> 00:28:07.480
<v Speaker 3>Yeah, I'd love to be a privateer. That'd be great.

530
00:28:07.519 --> 00:28:09.359
<v Speaker 1>Just go back in time, go to Baltimore and sign

531
00:28:09.400 --> 00:28:10.400
<v Speaker 1>up for a ship. Right.

532
00:28:10.480 --> 00:28:13.680
<v Speaker 3>So privateiers is all about the government says, oh you're

533
00:28:13.720 --> 00:28:16.640
<v Speaker 3>a merchant, we give you letters of the realm that

534
00:28:16.720 --> 00:28:18.799
<v Speaker 3>says you're allowed to be armed, and you're allowed to

535
00:28:18.839 --> 00:28:22.960
<v Speaker 3>seize enemy traffic and you're allowed to basically your your

536
00:28:23.000 --> 00:28:26.480
<v Speaker 3>you're authorized pirates, your pirates on behalf of your crown.

537
00:28:27.079 --> 00:28:29.880
<v Speaker 3>This is this is the same with hackers. And we

538
00:28:30.079 --> 00:28:34.720
<v Speaker 3>have an enormous advantage in companies like our companies and

539
00:28:35.119 --> 00:28:37.359
<v Speaker 3>many of the others, where there's a lot of cyber

540
00:28:37.880 --> 00:28:42.440
<v Speaker 3>talent in the United States that's not leveraged for offense

541
00:28:42.519 --> 00:28:46.119
<v Speaker 3>and defense because it's it's hands are tied. And so

542
00:28:46.279 --> 00:28:49.359
<v Speaker 3>I have long thought this was an important thing we

543
00:28:49.400 --> 00:28:54.160
<v Speaker 3>needed to do, but the implementation matters dramatically. It has

544
00:28:54.240 --> 00:28:56.359
<v Speaker 3>to be done well, it has to be done right.

545
00:28:56.400 --> 00:28:58.519
<v Speaker 3>I don't have a lot of faith that this first

546
00:28:58.519 --> 00:29:01.319
<v Speaker 3>iteration is going to be done well or right, but

547
00:29:01.440 --> 00:29:04.000
<v Speaker 3>I'm very interested in like how it's going to be done.

548
00:29:04.200 --> 00:29:07.039
<v Speaker 3>What you could do, though, is have a like a

549
00:29:07.200 --> 00:29:11.359
<v Speaker 3>case officer that deals with the trusted source and they

550
00:29:11.440 --> 00:29:16.440
<v Speaker 3>say vetted sources, vetted companies right, so that they say,

551
00:29:17.039 --> 00:29:18.920
<v Speaker 3>you know, what do you guys want to do, or

552
00:29:19.079 --> 00:29:21.720
<v Speaker 3>this is what we'd like you to do, and you.

553
00:29:21.759 --> 00:29:22.480
<v Speaker 2>Do it now.

554
00:29:22.519 --> 00:29:24.960
<v Speaker 3>The Ukrainians did something similar to this when the war

555
00:29:25.039 --> 00:29:27.720
<v Speaker 3>broke out. They basically got all the hackers and all

556
00:29:27.720 --> 00:29:31.440
<v Speaker 3>the cyber people in the country and they classified them

557
00:29:31.480 --> 00:29:36.039
<v Speaker 3>from most well known and trusted to this guy sketchy

558
00:29:36.039 --> 00:29:39.680
<v Speaker 3>and I think he smells funny. And the ones at

559
00:29:39.720 --> 00:29:41.599
<v Speaker 3>the bottom of the list, they just said, here's a

560
00:29:41.640 --> 00:29:44.799
<v Speaker 3>list of companies, go and denial a service them. They're

561
00:29:44.880 --> 00:29:49.200
<v Speaker 3>all Russian conglomerates involved in the military or the energy sector.

562
00:29:49.240 --> 00:29:51.480
<v Speaker 3>And they did. They went and did denial of service

563
00:29:51.519 --> 00:29:55.640
<v Speaker 3>and things like that. The higher level ones were given

564
00:29:55.680 --> 00:30:02.759
<v Speaker 3>missions of planting specific information, false information, access to government secrets,

565
00:30:02.759 --> 00:30:06.279
<v Speaker 3>things like that, and that striated solution is really the

566
00:30:06.279 --> 00:30:08.759
<v Speaker 3>way to go. So I expect that we're going to

567
00:30:08.799 --> 00:30:11.799
<v Speaker 3>see a lot more of the top level stuff, but

568
00:30:12.039 --> 00:30:13.200
<v Speaker 3>I'll let you know after architation.

569
00:30:13.279 --> 00:30:16.799
<v Speaker 2>I mean, if I ever hear for a rotation. So

570
00:30:16.839 --> 00:30:18.839
<v Speaker 2>it is interesting as you go through this article. It

571
00:30:18.839 --> 00:30:21.720
<v Speaker 2>says the White House gave the Department of Homeland Security

572
00:30:21.799 --> 00:30:25.480
<v Speaker 2>and the DOJ sixty days to establish operating procedures for

573
00:30:25.519 --> 00:30:30.720
<v Speaker 2>the program, including standards for companies participation, procedures for deconflicting

574
00:30:30.960 --> 00:30:35.279
<v Speaker 2>operations with the military and intelligence community community, and requirements

575
00:30:35.279 --> 00:30:38.480
<v Speaker 2>for participants to report useful information that they acquire from

576
00:30:39.039 --> 00:30:44.480
<v Speaker 2>criminal gangs activities. The memorandum also says the program should

577
00:30:44.640 --> 00:30:48.400
<v Speaker 2>be participated should be by large companies, which can provide

578
00:30:48.400 --> 00:30:53.480
<v Speaker 2>critical capacity, and smaller, more agile companies, which may be

579
00:30:53.480 --> 00:30:57.920
<v Speaker 2>better suited for specialized or discrete tasks. Wait, I know

580
00:30:58.039 --> 00:31:02.400
<v Speaker 2>small cyber companies pretty agile. Yeah, and it's fantastic. Have

581
00:31:02.400 --> 00:31:05.039
<v Speaker 2>you got your letter yet to screen tasks?

582
00:31:05.599 --> 00:31:06.880
<v Speaker 3>I gotta talk to my old roommate.

583
00:31:08.400 --> 00:31:08.480
<v Speaker 4>You.

584
00:31:09.119 --> 00:31:11.640
<v Speaker 2>Someone one of my buddies on Slack hitting me up

585
00:31:11.680 --> 00:31:13.079
<v Speaker 2>and was like, now, I know why you've been so

586
00:31:13.160 --> 00:31:16.400
<v Speaker 2>busy lately. And I'm like, I can't confirm or deny,

587
00:31:16.640 --> 00:31:18.240
<v Speaker 2>but right, you.

588
00:31:18.200 --> 00:31:23.240
<v Speaker 3>Can always deny. Yeah, So I you know, I personally think,

589
00:31:23.599 --> 00:31:26.559
<v Speaker 3>if done well, it's a good idea, and in this age,

590
00:31:26.559 --> 00:31:30.799
<v Speaker 3>I think it's actually overdue, but the way it's conducted

591
00:31:30.960 --> 00:31:32.119
<v Speaker 3>will matter dramatically.

592
00:31:32.519 --> 00:31:32.920
<v Speaker 2>Agreed.

593
00:31:33.279 --> 00:31:33.680
<v Speaker 4>Yeah.

594
00:31:33.839 --> 00:31:36.680
<v Speaker 3>Hell if they just said, hey, if go go and

595
00:31:36.720 --> 00:31:39.880
<v Speaker 3>protect the water supplies in your state, Yeah, that would

596
00:31:39.920 --> 00:31:42.559
<v Speaker 3>be a win given what's been going on lately, exactly.

597
00:31:43.039 --> 00:31:45.359
<v Speaker 1>So that brings us to the end of our show

598
00:31:45.400 --> 00:31:47.880
<v Speaker 1>this week. And that's all that happened last week. We'll

599
00:31:47.880 --> 00:31:50.119
<v Speaker 1>talk to you next week on security this week.

600
00:31:50.200 --> 00:32:02.599
<v Speaker 4>Bye bye bye. Will her

601
00:32:04.279 --> 00:32:04.680
<v Speaker 2>Hand