Speaker 1: Hey, Carl. Here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes,
Speaker 1: Spotify or wherever you get Security this week. Also, you
Speaker 1: can get an ad free feed by becoming a five
Speaker 1: dollars a month patron. Go to Patreon dot Security this
Speaker 1: week dot com and sign up, and don't forget discord.
Speaker 1: Discord dot Security this week dot com. Lots of good
Speaker 1: stuff happening there. Yeah, I think that's it. So on
Speaker 1: with the podcast. So a cop came to my door
Speaker 1: last night and asked me where I was between five
Speaker 1: and six. I said, kindergarten, how about you? And it
Speaker 1: turns out the Lost and Found box at the new
Speaker 1: London Superior court House doesn't have pants in my size where.
Speaker 2: I thought they would.
Speaker 1: Hey, and welcome back to Security this week. I'm Carl Franklin,
Speaker 1: that Stwaye Laflatt and Patrick Hines and we got a
Speaker 1: few stories for you things that happened last week. How
Speaker 1: are you guys?
Speaker 2: First of all, good, We'll enjoy the summer.
Speaker 3: Yeah, I can't complain. Awesome somebody, somebody was at a
Speaker 3: nice game this week.
Speaker 1: Did you go to a World Cup game? I did, Patrick?
Speaker 2: Yeah, yeah, I went to one of the original group
Speaker 2: group games.
Speaker 1: Nice.
Speaker 3: That's awesome. Yeah, that's fun. That's fun.
Speaker 1: Well, what does that have to do with Nintendo?
Speaker 2: I caught some Pokemon?
Speaker 3: Okay, I think that's iantic.
Speaker 1: But oh yeah, So the first story is Nintendo confirms
Speaker 1: limited employee data breach linked to third party service. Hmmm,
Speaker 1: what happened?
Speaker 3: That's okay? So thread actor group, shadow bites and that's
Speaker 3: b y T three dollars sign because you know, hackers.
Speaker 1: You noticed these things. These names are are becoming like
Speaker 1: rock band names, like you know, they they have aspirations
Speaker 1: of being famous.
Speaker 3: Right, No Labyrinth of Pain Hacking group yet though, So
Speaker 3: you know what, honestly, I think the three of us
Speaker 3: need to start the Labyrinth of Pain Hacking. That was us,
Speaker 3: Labyrinth of Pain LOP. That that would be our initials
Speaker 3: is LOP.
Speaker 2: We could rename the podcast.
Speaker 1: Patrick, what are you going to play?
Speaker 2: I know I'm playing the keyboard Pokemon. I already told you.
Speaker 1: All right what happened here? You guys?
Speaker 3: Anyways, hit tiny Pulse a third party employee survey platform
Speaker 3: used by Nintendo of America. They claim to have x
Speaker 3: filtrated eight hundred and fifty nine meg which doesn't sound
Speaker 3: like a lot, but and it's just text. Almost a
Speaker 3: gig is a lot of text. Nintendo says their own
Speaker 3: systems were not compromised, which is important supply chain. It's yeah, absolutely,
Speaker 3: and we're seeing this more and more, you know. It's
Speaker 3: it's hard to hit Nintendo in that They've they've been
Speaker 3: punched out a lot over the last thirty years of
Speaker 3: you know, being in the market, so a lot of
Speaker 3: attackers have tried to steal new games from them and
Speaker 3: get access to systems, in reverse engineering their devices and whatever. Right,
Speaker 3: Nintendo has pretty rock solid security team. Although there was
Speaker 3: there was a way on Nintendo's website on their shop
Speaker 3: to steal coins and gets up anyways, we won't talk
Speaker 3: about that, but they do a pretty good job in
Speaker 3: this particular case. If you can't hit Nintendo, what do
Speaker 3: you do other than going to a Nintendo's employees home
Speaker 3: and start bringing into their home Wi Fi and then
Speaker 3: back routing into the office, which we don't you know, recommend,
Speaker 3: but you try and hit a third party, you hit
Speaker 3: somebody who's a little bit weaker, who doesn't you know,
Speaker 3: take care of cybersecurity the way they should. They're probably
Speaker 3: a smaller shop and they're you know, they get hit
Speaker 3: and unfortunately it has an Attendo data on there. Actually,
Speaker 3: you know what's interesting is tiny Poles probably isn't Nintendo's
Speaker 3: probably not the only customer they have. So if I
Speaker 3: were a customer of Time Post right now and now
Speaker 3: we're using them for surveys, I would be kind of
Speaker 3: concerned at this point did my data at leaked? It
Speaker 3: just wasn't important enough right to make the news. So
Speaker 3: that's our PSA for today, a try not to be
Speaker 3: important to people. Yeah, yeah, exactly. Listen, that's what we
Speaker 3: try and do.
Speaker 1: Carl, to fly under the radar exactly.
Speaker 3: So nobody knows who we are.
Speaker 4: The Well.
Speaker 3: The other thing is, uh, I know, we'll talk policies
Speaker 3: and policies nobody wants to talk about like what's the
Speaker 3: right how do we choose the right vendor, how do
Speaker 3: we make sure they're doing the right things. So you
Speaker 3: should have a policy for third party event don't have it,
Speaker 3: whether it's third party software or third party vendors or
Speaker 3: don't have any right questions you would ask them, you know,
Speaker 3: how are they doing security? How are they training their folks,
Speaker 3: how are they making are they doing yearly pen tasts?
Speaker 3: Are their software being tested? Et cetera, et cetera, et cetera.
Speaker 2: Yeah, yeah, And unfortunately the answer could very well be
Speaker 2: I don't know. Yeah, And you know, it's it's not
Speaker 2: the first thing a company does unless they are security
Speaker 2: background people. So there's plenty of sites out there that
Speaker 2: even claim to be in the security space that don't
Speaker 2: have their act together.
Speaker 1: Oh yeah, all right. We moved on auto jack how
Speaker 1: a single page can remote control execute the host running
Speaker 1: your AI agent.
Speaker 2: So I had an argument with someone recently, someone who
Speaker 2: I respect quite a bit, where we talked about whether
Speaker 2: you could respect me. I wasn't talking about you. Where
Speaker 2: we were talking about a paper that said that, you know,
Speaker 2: you AI cannot be secured. Yeah, And the person who
Speaker 2: wrote this says they've been proven right by you know,
Speaker 2: mathematical proofs. And it's my counter is, nothing is one
Speaker 2: hundred percent secure, right, It's all degrees of trade offs
Speaker 2: and risk. AI is in the early days, and I
Speaker 2: think there's ways we can do we can deal with
Speaker 2: AI that that can be secure, but it's going to
Speaker 2: be it's going to be a slippery slope for a while.
Speaker 2: So we're going to see a lot of these reports.
Speaker 2: We're going to see a lot of this fear, uncertainty,
Speaker 2: and doubt. One of the ways that you can deal
Speaker 2: with AI is to limit or minimize completely the text
Speaker 2: that a user can input. Have the user make choices,
Speaker 2: but not type in text, not up, not upload documents,
Speaker 2: give them choices a wizard experience. They can't always do that,
Speaker 2: but when you can, that's powerful for mitigating the data input.
Speaker 2: Think about SQL injection. Can you seql inject a multiple
Speaker 2: choice textbox? Well, you can if the SEQL isn't parameterized.
Speaker 2: But if you go back to the SQL example, you
Speaker 2: can't secure a SQL server. If the answer could be
Speaker 2: the hacker is going to break in a Microsoft and
Speaker 2: and and put malware in Microsoft SQL server, nothing can
Speaker 2: be fully secured. So some of these we have to
Speaker 2: understand when these are the equivalent. In that case, you.
Speaker 1: Could also use another layer of abstraction. So for example,
Speaker 1: if you have are you thinking of having a text
Speaker 1: box in your software that allows the users to run reports,
Speaker 1: for example, right instead of doing that you basically have
Speaker 1: your you know, your your your report interface of the
Speaker 1: things that they want and then you have a set
Speaker 1: number of reports that use the AI to get the data.
Speaker 1: It's not a great example, but you know, having just
Speaker 1: another layer instead of allowing them to type anything.
Speaker 2: I mean, we talk about defense and depth. So every
Speaker 2: every every measure helps because it minimizes the service area well.
Speaker 3: And one of the things you got to be careful of.
Speaker 3: A lot of a lot of companies are racing towards
Speaker 3: putting up their agentic uh you know, systems and platforms
Speaker 3: and that sort of stuff. Right, So in doing that,
Speaker 3: they go, well, my MCP server and for those of
Speaker 3: you who aren't playing around with agentic AI, your model
Speaker 3: context Protocol server, right is how think of an MCP server.
Speaker 3: Is how an LLM would call a useful tool, right, right.
Speaker 3: And the tool might be a web browsing tool, it
Speaker 3: might be a database backup tool maybe whatever.
Speaker 2: Right.
Speaker 3: So MCP servers, all they're doing is taking in some
Speaker 3: jason and they're and they're exposing functions tools that your
Speaker 3: agents can use. So let's say you installed the open
Speaker 3: clon you wanted to give it the ability to check
Speaker 3: out the latest stocks. Right. Because an LLM is trained,
Speaker 3: it means it doesn't know the native native stocks natively, right,
Speaker 3: It just doesn't have it in its brain, so it
Speaker 3: has to go search the web. Well, what better way
Speaker 3: to have it searched the web is if it had
Speaker 3: a tool it could do that with, and that's what
Speaker 3: MCP servers are. The problem is you start implementing a
Speaker 3: ton of these tools right your toolbox. You want one
Speaker 3: hundred tools in there, just in case my agent needs
Speaker 3: the ability to see what computers are on the network,
Speaker 3: or to do facial recognition on cameras or whatever. Right there,
Speaker 3: you could create an MCP ver for all of those things.
Speaker 3: The downside is a lot of companies, as they're racing
Speaker 3: to put these MCP servers up and running, there's no
Speaker 3: authentication to the MCP for local host. So if I'm
Speaker 3: running those MCP servers locally, what it says, Oh, well,
Speaker 3: if the request came from inside the house, just let
Speaker 3: it happen, right, because we must trust them.
Speaker 2: And that is one hundred percent against horror movie. More.
Speaker 2: Even King is rolling over in the graves that he
Speaker 2: visits every night.
Speaker 3: And he's like I told you so many times, if
Speaker 3: it's in the house, you need to.
Speaker 1: Worry about it. It kind of to me, It kind
Speaker 1: of seems to me lately that you know, tools like
Speaker 1: Claude can call tools directly, and so if you've got
Speaker 1: a command line interface and you expose that as a tool,
Speaker 1: you know, Claude doesn't need an MCP server. It can
Speaker 1: just go querry the tool, which uses the API, which
Speaker 1: brings back the the stuff that it can do, and
Speaker 1: et cetera, et cetera. So I don't know if I'm
Speaker 1: gonna if we're gonna see a shift away from MCP
Speaker 1: servers and so towards tools.
Speaker 3: It's interesting you say that because there's there's this big
Speaker 3: war on the Internet around you know, is MCP dead?
Speaker 3: And I can tell you from the from a person
Speaker 3: who's sort of steeped in AI day in and day out.
Speaker 3: MCP has a lot of benefits to it, like for
Speaker 3: the ability for us to lock down who can call
Speaker 3: MCP servers and what tools and functions they have access to. So,
Speaker 3: for example, Claude might be able to call my terminal
Speaker 3: and s sh into a box and now it has
Speaker 3: unfettered access to do anything. And you're kind of hoping
Speaker 3: Claude follows the rules, whereas my MCP server, I don't
Speaker 3: have to expose every tool and I can I have
Speaker 3: control over the flow of those tools.
Speaker 1: So it's kind of like store procedures for AI tool.
Speaker 3: Yes exactly, y, yeah exactly. That is a great analogy.
Speaker 2: Right.
Speaker 3: You could write this straight up query and just issue
Speaker 3: it with a SQL command or yeah, use store procedures
Speaker 3: and you're in a safer place. I think people will
Speaker 3: realize that. Yeah, MCPS kind of the way is the
Speaker 3: way to go.
Speaker 1: Okay, good. So what happened here? Well story yeah.
Speaker 3: Jack, right, So Microsoft found an exploit in their autogen studio.
Speaker 3: So autogen studio is just their studio for creating agentic AIS.
Speaker 3: What they saw was a malicious web page that is
Speaker 3: rendered by an AI browsing agent. So if I if
Speaker 3: I have an AI that goes to use a browsing
Speaker 3: MCP and it comes back to that particular local browser,
Speaker 3: the web socket that gets opened up, you can open
Speaker 3: up a malicious web socket to the local MCP server.
Speaker 3: So the browser is sitting on the MCP server, right,
Speaker 3: So when the browser goes out to the malicious page
Speaker 3: and the page comes back and loads on the browser
Speaker 3: on the MCP server, a malicious socket opens back up
Speaker 3: to local host, and now your MCP server goes, oh, well,
Speaker 3: I should trust this because it came from my local
Speaker 3: network and look like it came from the Internet, because
Speaker 3: it was a pipe opened from that malicious page but
Speaker 3: opened back to the MCP server, and that's that's where
Speaker 3: they're finding. Now, okay, now I can get this to
Speaker 3: run you know, PowerShell scripts, and I can get to
Speaker 3: do anything at this point because really I have control
Speaker 3: over what that MCP server is doing because it's innately
Speaker 3: trusting anything that comes from local host. So you really
Speaker 3: don't want to make sure that you know you have authentication,
Speaker 3: even if it's local. I don't know what it hurts
Speaker 3: you to throw it off authentication locally for.
Speaker 2: It's assumptions. Yeah, people assume it's safe and therefore it's
Speaker 2: it's it makes it more.
Speaker 3: Of and it's interesting. We've we've seen this as in
Speaker 3: the hacking world for decades. Is what's called SSRF. So
Speaker 3: SSRF is where a server side request comes back to
Speaker 3: the server. It's where I can hit a web page
Speaker 3: and let's say there's an administrative webpage on port eighty
Speaker 3: eighty that I don't have access to on the internet.
Speaker 3: That is only access locally on the box. But there's
Speaker 3: another web server running on that site, right on that computer.
Speaker 3: If I can manipulate the normal website to make a
Speaker 3: call to itself on port eighty eighty because it came
Speaker 3: from the local box, now it's trusted and I can
Speaker 3: add my user account, and I can do all sorts
Speaker 3: of things. And we've broken into several places, actually a
Speaker 3: really large school district doing this, where we're just like, hey,
Speaker 3: I'm going to hit your public school website. I'm going
Speaker 3: to look like I'm searching for classes, and instead I'm
Speaker 3: going to very customly craft that server to reach back
Speaker 3: out to itself and add a user that I can
Speaker 3: then log in as this is the same exact thing,
Speaker 3: but this is just for MCP servis Wow.
Speaker 1: Yep, be careful out there, kids, All right, we moved on.
Speaker 1: Everything's bigger and better in Texas. Even data breaches. Oh no,
Speaker 1: this is crazy. Hunting and fishing license incident catches three
Speaker 1: million residents.
Speaker 2: So is it data that wouldn't be out there already?
Speaker 3: A driver's license number, passport numbers, emails, phone numbers, addresses,
Speaker 3: age also lists social security numbers.
Speaker 2: Social secure numbers have been out there?
Speaker 3: Sorry yeah yeah yeah. And how many people in Texas
Speaker 3: actually go register license anyways? Don't they just hunting fish?
Speaker 1: I mean, hey man, that is an elitist comment.
Speaker 2: Wow, so they read too.
Speaker 1: Texas is an awesome state.
Speaker 3: Texas is great. Actually Texas is they just opened up. Okay,
Speaker 3: Texas has a really big federal hog problem.
Speaker 1: They have a big everything.
Speaker 3: It's if you were if Texas hunters were to kill
Speaker 3: two million federal hogs a year, there would still be
Speaker 3: a population of three million of them every year.
Speaker 1: And it would drive barbecue prices way down, so.
Speaker 3: To the point where it's destroying so many crops. Texas
Speaker 3: has said you don't need a hunting license to shoot
Speaker 3: a feral hog, and you don't even need to be
Speaker 3: You can be anywhere. You could be the middle of
Speaker 3: Austin and if feral hog comes through, you can just
Speaker 3: shoot it in the face and that's find no questions out.
Speaker 2: It sounds like you just there's so many you could
Speaker 2: just go to Walmart and find them.
Speaker 3: I think I think you could at this point.
Speaker 4: Yeah.
Speaker 1: So from what I know about Italy, I'm I have
Speaker 1: some friends in Tuscany and they you know, everybody's got
Speaker 1: like an olive grove, right, Yeah, so they hunt chingale,
Speaker 1: which are wild bores, which are essentially feral pigs.
Speaker 4: Wow, the Germans take too, Yeah.
Speaker 1: Yeah, they hunt them and they cook them and guess what,
Speaker 1: they're delicious. Yeah. So you the combination of, yeah, we
Speaker 1: got a big feral hog from in Texas and everybody
Speaker 1: should go shoot them. It's just going to result in
Speaker 1: a lot of delicious.
Speaker 3: Meal, right, and then the barbecue capital of the world.
Speaker 3: So why not?
Speaker 4: Right?
Speaker 1: Why not? Anyhow?
Speaker 3: Deviating from our faral hog conversation, Yeah, I mean, you know,
Speaker 3: I get it. It's I agree with Patrick. We all
Speaker 3: talked tongue in cheek about how you know, SOFIA security
Speaker 3: numbers are out there, and that's sort of passport numbers
Speaker 3: not so much in general, like they're not as easy
Speaker 3: to get, but you can still get passport numbers as well.
Speaker 3: You know, in this particular case, credit monitoring is the
Speaker 3: way to go, right, your your data has probably been
Speaker 3: le leaked. You probably want to just monitor it.
Speaker 4: Make sure.
Speaker 1: I'm reading this article in the Register, and there's in
Speaker 1: the middle it says more context and there's a few
Speaker 1: links in one of them, it's Texas wu's TP link
Speaker 1: over China links and security vulnerabilities.
Speaker 3: Yeah, go Texas, way to go, Way to go, Texas
Speaker 3: Way to go.
Speaker 1: They're doing the dirty work for us. All right. So
Speaker 1: is that all we have for this story? You know,
Speaker 1: it was a big.
Speaker 3: Breach, that's it, just it. Yeah, if you have if
Speaker 3: you have a hunting license in Texas, you may want
Speaker 3: to just make sure you monitor your credit.
Speaker 1: Make sure you still have it. All right. This is
Speaker 1: a this was a good one for me. Pixel smash,
Speaker 1: a critical ffm peg vulnerability turns media files into weapons.
Speaker 4: Oh no.
Speaker 1: Ffm peg is a command line tool and you can
Speaker 1: call it from a program using standard in Standard out
Speaker 1: and it just does every kind of conversion and.
Speaker 4: Oh yeah, including a conversion.
Speaker 1: Oh.
Speaker 3: You know what's funny is from the first time I
Speaker 3: saw ffm peg, like where I was doing media stuff
Speaker 3: and it's like, oh, you got to download ffm peg,
Speaker 3: and I was like, m hell no, that looks like
Speaker 3: a hacker tool.
Speaker 1: It did.
Speaker 3: It was like command line driven. It was like and
Speaker 3: it's like, oh, download this DLL from this janky site somewhere,
Speaker 3: and I'm like honestly. I mean, ffm peg is probably
Speaker 3: embedded in almost everything. Yeah that does media. It's a
Speaker 3: it's an amazing encoder decode.
Speaker 1: It can encode and decode packets in real time. Yeah,
Speaker 1: like you know standard audio to MP three audio, stream
Speaker 1: it over the internet. I mean it's really really smart.
Speaker 3: Yeah. Yeah, so who I don't was it one guy
Speaker 3: who put ffm peg together? Do we know if it
Speaker 3: came from like sound Blaster or like one of those
Speaker 3: type of companies.
Speaker 1: I don't know the history. I don't know that.
Speaker 3: Yeah, Creative Labs prominence of it, Yeah, I don't know.
Speaker 3: So needless to say, it's probably on every computer you
Speaker 3: could imagine right today. Right, even if you're not using
Speaker 3: ffm peg. If you've if you're just trying to you know,
Speaker 3: fast forward through this podcast for things that are important
Speaker 3: to you, you probably have a copy of fmpeg running
Speaker 3: on your computer somewhere doing some sort of media conversions.
Speaker 3: Whether it's games or camptasier or whatever. I'm sure there's
Speaker 3: something running it. So this is kind of an important
Speaker 3: deal to most people, even if you don't think it is. Yeah,
Speaker 3: it's been patched, right, so this is you know, this
Speaker 3: this was an out of bounds right for the ffm PEG,
Speaker 3: not a you know, a big deal. Yes, but it's
Speaker 3: been patched. So if you are running ffm peg, or
Speaker 3: if you think you're running ffm PEG, if you're running
Speaker 3: things like Jellyfinn or plex or thumbnail generators, cloud trans coders,
Speaker 3: there's all sorts of things that actually use f MPEG.
Speaker 3: If you're running any of those, you may want to
Speaker 3: go pack.
Speaker 1: And it doesn't look like it was malicious. It was
Speaker 1: just a bug, right, It was like one you said,
Speaker 1: one off. It was just like a math error or
Speaker 1: something around in this match.
Speaker 2: Yeah.
Speaker 3: So, and I haven't seen any active you know, exploits
Speaker 3: in the wilds or anything along those lines.
Speaker 4: Just yeah, which is kind of the progression.
Speaker 2: It's like it's it's out there being it's being actively
Speaker 2: you know used or the stories and then it's in
Speaker 2: the known exploitive vulnerabilities list from.
Speaker 3: Sissa Well and now with AI the moment this got
Speaker 3: released as a oh this is an issue, right, somebody
Speaker 3: will start weaponizing it by our next podcast.
Speaker 2: So does it is that it's a tool that you use.
Speaker 2: It wouldn't be hosted on the internet, would.
Speaker 1: It, Yes, it could be. It could be in the
Speaker 1: executable path of any other DLL that your website could.
Speaker 1: So the real problem is this magic YUV decoder which
Speaker 1: is enabled by default in lib v codec, LIBA v
Speaker 1: codec whatever.
Speaker 2: That was a very important legal case codec.
Speaker 1: It's almost like live v memorycks. So FFmpeg eight point
Speaker 1: one point two contains the fix. Okay, so there you go,
Speaker 1: go get it. Should we take a break, Let's do it. Yeah,
Speaker 1: let's take a little break. We'll be right back after
Speaker 1: these very important messages, and we're back. It's security this week.
Speaker 1: I'm Carl, that's Dwayne and Patrick. The next story. Scattered
Speaker 1: Spider members, especially the Drummer plead guilty to hacking Transport
Speaker 1: for London. Oh no, we talked about the transport hack.
Speaker 3: Right, Yeah we did. Yeah, caused all sorts of damages
Speaker 3: twenty nine million dollars in a GPP, about thirty eight
Speaker 3: million dollars in US dollars in damages. Twenty thousand transportation
Speaker 3: employees had to do in person password resets, which is
Speaker 3: a pain in the ass.
Speaker 1: So that's a long line.
Speaker 3: Yeah, yeah, I know, right, And this was this was
Speaker 3: a straight up standard Scattered Spider attack. This was social
Speaker 3: engineering I'm sorry.
Speaker 1: I'm sorry. That was a long queue, wasn't it.
Speaker 3: Oh yeah, it's not a line.
Speaker 1: It's not a line.
Speaker 3: Wait, if you say line in London, what's a line?
Speaker 3: It is something you say.
Speaker 1: It's something you read as an actor.
Speaker 3: Oh okay, all right, okay, Like.
Speaker 1: Whose line is it? Anyway?
Speaker 3: A line is something you read. A que is something
Speaker 3: you stand in on it. Yeah, understood, sir.
Speaker 1: I'm sure it's something you draw with numbers on its class.
Speaker 2: Now you're going to make a cocaine joke.
Speaker 3: Wait, that's a line and a line.
Speaker 1: I got a line on this guy?
Speaker 3: Moving on for our g rated Uh yeah yeah listeners.
Speaker 3: So yeah, Needless to say, Scattered Spider is really really
Speaker 3: good at social engineer. They're good at manipulating help desks,
Speaker 3: they're good at, you know, understanding the lingo. For any
Speaker 3: of you who are super interested in some of the
Speaker 3: pioneers in this space, read The Arted Deception by Kevin Mitnick.
Speaker 3: Fantastic story. Auto Uber our social engineer, brilliant guy, and
Speaker 3: he goes through all of the reasons why you know,
Speaker 3: large telco companies would trust him, right because he had
Speaker 3: the lincol He knew the layout of the place. He knew,
Speaker 3: people he knew, right, So needless to say, they're very
Speaker 3: good at it, and they were able to break in
Speaker 3: and all sorts of damages. So yeah, this but yeah,
Speaker 3: two people caught surprising.
Speaker 2: Yeah, there's a story about Kevin mcnick where he was
Speaker 2: He walked onto a truck at and t truck and
Speaker 2: convinced them he was a field supervisor, and he stole
Speaker 2: their manuals. Yeah yeah, I need to borrow these and
Speaker 2: any like criticized them and said, well, you know you're
Speaker 2: not doing this, you should be doing this, and he'd
Speaker 2: be doing this wrong.
Speaker 3: He broke into a telcode like remote data center and.
Speaker 2: He swear he hid the pot the pots line for
Speaker 2: the FBI had investigator.
Speaker 3: No, no, no, Although that one was awesome too.
Speaker 1: You know I saw this. It was a movie. What
Speaker 1: was it, Oh yeah, the Pink Panther where they you know,
Speaker 1: they dressed up as servicemen and they go yeah.
Speaker 3: Yeah, I mean it still works, right. So he actually
Speaker 3: walked into one of the Telco substations and he had
Speaker 3: brought a buddy with him at one point and they
Speaker 3: were just like he knew how to crack the lock
Speaker 3: and get in and one night he went in by
Speaker 3: himself just to check out the teleco gear and that
Speaker 3: sort of stuff, and they were security guards there and
Speaker 3: they pulled him up, and without missing a beat, he
Speaker 3: was like, do you yeah, I work at this station,
Speaker 3: this this person over here. I work on the second floor.
Speaker 3: I sit right next to Susie. She's my boss. But
Speaker 3: any new song in verse. And the security guy was like, okay, really,
Speaker 3: I'm gonna call Susie. And he picked up the phone
Speaker 3: and called her. Yeah, and he's like, yeah, there's a
Speaker 3: guy here who says he works for you, says this
Speaker 3: is his name, and it was a real name of
Speaker 3: a right of a guy you work in. She's like, wow,
Speaker 3: that's really weird. Let me talk to him. And he convinced,
Speaker 3: like Kevin Minna, convinced the guard to give him the phone. Yeah,
Speaker 3: and he's talking to her and he's like, hey, I
Speaker 3: know I shouldn't be here, and she's like who are you?
Speaker 3: Hand the phone back to the car and he's like, yeah,
Speaker 3: I know, I know. I'll see you Monday morning whatever, right,
Speaker 3: and then he hangs the phone up and the guard
Speaker 3: was like, ugh, all right, fine, well you know, yeah
Speaker 3: you should you should take off. You really shouldn't be
Speaker 3: here after the story. Yeah, it's impressive. It's impressive.
Speaker 1: It is an impressive story. Yeah yeah, all right, so
Speaker 1: this is just a story of a heist and uh,
Speaker 1: you know, nothing that it affects you. It's just a
Speaker 1: good story. Yep. So the next one is scammers use
Speaker 1: fake GitHub stars and virus total reviews to spread crypto Clipper,
Speaker 1: a multi platform malware campaign abuses fake trust signals to
Speaker 1: infect Windows and Mac users with a crypto clipper packed
Speaker 1: with fifteen thousand, five hundred attacker wallets.
Speaker 3: This is impressive.
Speaker 1: Yeah, I knew you would think that.
Speaker 3: Social engineering. Yeah, this one's pretty awesome. So social engineering. Right,
Speaker 3: you create this this GitHub repo whatever it is, and
Speaker 3: you got to jacket up right. You got to get
Speaker 3: people to download it so you could send it a
Speaker 3: bunch of emails.
Speaker 2: You add add reputation, you add credibiliony yeah, absolutely, half planet.
Speaker 3: So how do you add reputation? Okay, so we manipulate
Speaker 3: the ge hub stars, so everybody stars. It's amazing. It's
Speaker 3: like the top GitHub rebo It's like open claw right, Okay, great,
Speaker 3: that's going to get some people download it, but not
Speaker 3: a lot. Then what they did is they source Forage
Speaker 3: is a place that you can download packages and software
Speaker 3: and that sort of stuff. So they put it on
Speaker 3: SourceForge to make it look legitimate and pumped it up
Speaker 3: there too by forty four thousand likes and whatnot. But
Speaker 3: that's still not enough because people still might think it's
Speaker 3: a virus. So they went to virus total, one of
Speaker 3: the premier places for checking software to see if they're viruses,
Speaker 3: and created tons of accounts and pointed it at this
Speaker 3: and said no, thumbs up, this is good stuff.
Speaker 1: Wow.
Speaker 3: Right, So anybody who went to that length and went, well,
Speaker 3: I'm gonna go to virus total, it would have come
Speaker 3: up as now it is clean. You can just install it.
Speaker 3: It's not a big deal.
Speaker 1: Wow.
Speaker 3: Then they created ai narrated YouTube tutorials, oh geez on
Speaker 3: how to use it? Right, this piece of software that
Speaker 3: did you know nothing or whatever?
Speaker 1: Right, So there are people, fake people on YouTube that they.
Speaker 3: Are saying, oh, this is an awesome piece of software.
Speaker 3: Watch I installed it. This is what it does for me?
Speaker 3: Well whatever?
Speaker 1: Right? Unable.
Speaker 3: So they went this full route of full on marketing,
Speaker 3: social engineering as many people as possible, and what the
Speaker 3: what the package did. If you installed it, it would
Speaker 3: watch the clipboard and when you made a crypto purchase
Speaker 3: or you transferred to another wallet or whatever, when it
Speaker 3: went to do that, it would paste their own wallet
Speaker 3: in as the destination.
Speaker 1: Wow.
Speaker 3: So unless you were really good at watching it, you
Speaker 3: knew the money was leaving your account, right, you knew
Speaker 3: it was going somewhere else. But unless you really kind
Speaker 3: of looked at that address once it hit your ledger,
Speaker 3: you wouldn't have noticed it.
Speaker 1: So sucks if you were trying to pay off ransomware
Speaker 1: and you're like, I paid, I paid you one hundred
Speaker 1: thousand dollars and they're like, no, you didn't.
Speaker 3: Now you're like, oh, curse you. So impressive to say
Speaker 3: the least is a good marketing campaign.
Speaker 1: So how does the story end? Did they get caught,
Speaker 1: they took it down?
Speaker 2: Well, let's let's let's talk about the moral of the story,
Speaker 2: which I don't think anybody's gonna get, which is we
Speaker 2: have to stop bots from being able to do stars
Speaker 2: and voting on virus total and all that stuff. Because
Speaker 2: I doubt it happened over months and years. It happened
Speaker 2: over days, an.
Speaker 1: Hour, Ye wasn't done by humans.
Speaker 2: Yeah, absolutely, And so we have to figure out the
Speaker 2: bought recognition on these platforms has to become the new
Speaker 2: currency of reputation.
Speaker 3: Yeah, and stars can be bought. Like a lot of
Speaker 3: people don't know that. Like I talked to someone friends
Speaker 3: and I'm like, they're like, oh, but it has forty
Speaker 3: four thousand likes on you know, Amazon, And I'm like, okay,
Speaker 3: Like that doesn't mean anything because I can easily just
Speaker 3: go and buy forty four thousand likes if I want.
Speaker 3: So stars can be bought. You know, I don't trust
Speaker 3: engagement metrics because engagement metrics at this point, every marketer
Speaker 3: on the planet is targeting manipulation of engagement metrics, right,
Speaker 3: so be careful of those.
Speaker 1: So, like, if you're looking at a product on Amazon
Speaker 1: and it's got four and a half stars and one
Speaker 1: thousand reviews and all of them are five star reviews
Speaker 1: except for maybe one disgruntled person which they put in
Speaker 1: there just to make it look real, right, exactly. It's
Speaker 1: all about it was broken when it got Yeah, oh
Speaker 1: it was terrible.
Speaker 3: And you're like, ah, well, mine won't be broken.
Speaker 4: I mean, what are the odds, right, yeah?
Speaker 1: Right, yep, geez that's that's depressing because that's how I
Speaker 1: buy things.
Speaker 3: I mean, it's honestly, it's how we all do it.
Speaker 1: How else are you going to know if if it's
Speaker 1: what you want. Yeah, yeah, absolutely, that's depressing. Oh my god.
Speaker 1: So they didn't get caught, but they took it down
Speaker 1: and nobody knows who the people are, right, all right?
Speaker 2: Do we know how much they got away with?
Speaker 3: M doesn't say hard to tell, really, yeah, I mean,
Speaker 3: you'd have to have people.
Speaker 2: Just check your balance.
Speaker 4: Oh, give me a second, I'll look.
Speaker 1: I was gonna make a Dwayne joke here, Like Dwayne,
Speaker 1: maybe this is more lucrative than your current job.
Speaker 3: It's not, all right.
Speaker 1: So our lead story today hackers leak facial recognition records
Speaker 1: tied to millions of Madison Square Garden visitors. So, and
Speaker 1: this this is interesting on a couple levels because Madison
Speaker 1: Square Garden was in the news the knixt game. The
Speaker 1: President was there falling asleep and like he always does.
Speaker 1: But then, you know, so what was happening was that
Speaker 1: there was a breach of the security cameras. Right. The
Speaker 1: security cameras are used to make sure that there are
Speaker 1: no bad guys walking in the arena, that kind of thing,
Speaker 1: and apparently that became the target of this hack.
Speaker 4: Yeah.
Speaker 3: Absolutely, And this here again was also shiny Shiny Hunters.
Speaker 4: These guys have been busy, man.
Speaker 3: They are the most active group I've seen recently. So
Speaker 3: this was another Shiny Hunter's you know attack. Where again,
Speaker 3: remember social engineering. There's not a lot of detail around
Speaker 3: how this data was stolen yet, but the leak, they say,
Speaker 3: allegedly includes facial recognition biometric records tied to millions of
Speaker 3: people at the venues, but it also can expose things
Speaker 3: like customer information, internal security assessments, background checks, attendee records,
Speaker 3: customer correspondences, especially if they had filed complaints with Madison
Speaker 3: Square Gardens. So what do you do about it?
Speaker 1: Patrick's got an answer, don't you. Patrick.
Speaker 3: You can't change your face.
Speaker 2: Just cut your face off.
Speaker 1: When you go out in the morning. Don't wear your face.
Speaker 3: Or somebody else's face. Actually, if you guys, have any
Speaker 3: of you guys been to the Spy Museum in DC.
Speaker 1: No, but are you thinking of the humanal masks?
Speaker 3: Okay, yeah, So the International Spy Museum they have an
Speaker 3: entire wall of its face masks that are faces that
Speaker 3: people will wear and walk around to full facial recognition.
Speaker 1: You know, Hollywood's been doing that for years, dressing people
Speaker 1: up as different people.
Speaker 2: It was a show. I can't remember the name of
Speaker 2: the show. I think it was Person of Interest.
Speaker 4: Which was a person of Interest.
Speaker 3: Oh my god, it's so good and we're almost there,
Speaker 3: by the way.
Speaker 2: But yeah, the guy guy was walking. They were looking
Speaker 2: for a guy and they couldn't find him. They were
Speaker 2: sending you know, they were looking at all the feeds
Speaker 2: in the world to find him. And he had his
Speaker 2: hair grown out over his face. He had an eye
Speaker 2: drawn on the side of his face, he had you know,
Speaker 2: no no eyebrows, his mouth was covered and he was there.
Speaker 2: It was to throw off the facial recognition. Yeah, and
Speaker 2: he looked like an absolute freak. So we fit in
Speaker 2: in a lot of places in New York City.
Speaker 4: Was fine, burning and but.
Speaker 2: But I thought that was an interesting way to like,
Speaker 2: don't have a face that that would be this lea.
Speaker 3: So I I do a fair bit of like robotics
Speaker 3: and object detection on video recognition and that sort of stuff. Right,
Speaker 3: And there's this group of people who have been creating
Speaker 3: the anti facial recognition sweater so it's a sweater you
Speaker 3: can wear and the moment you put it on, it
Speaker 3: doesn't detect you as a human anymore.
Speaker 1: Wow.
Speaker 3: And it's like it's like the sweater actually has a
Speaker 3: picture of like a house and people in it, but
Speaker 3: they're kind of skewed and it's so it thinks that
Speaker 3: it's looking at a perspective far and off away, but
Speaker 3: it can't identify the person at that distance. And just
Speaker 3: so you can just walk through and it doesn't.
Speaker 1: Pick you up. That is really cool.
Speaker 3: Gibson actually wrote a book called Pattern Recognition that put
Speaker 3: this postulate forward I believe, I don't know, fifteen twenty
Speaker 3: years ago, but apparently people are working on it.
Speaker 4: So cool stuff.
Speaker 3: It's the ugliest goddamn sweater I've ever seen. Yeah, of course,
Speaker 3: I mean it's it is.
Speaker 2: That means it's very in now.
Speaker 3: Yeah, exactly, it's something.
Speaker 1: So maybe they just train their facial recognition stuff to
Speaker 1: recognize that sweater and exactly ugly sweater. Steal this sweater. Well,
Speaker 1: I guess that's a show. That's everything that we found
Speaker 1: that happened last week. So for more, we'll see you
Speaker 1: next week on Security this week, Bye.
Speaker 4: Bye, thank you.
Speaker 2: Guys seven,