WEBVTT 1 00:00:00.320 --> 00:00:03.200 Hey, Carl. Here, we're on a mission to find new 2 00:00:03.240 --> 00:00:05.919 fans of the show. I mean, where else can you 3 00:00:05.960 --> 00:00:10.240 get real life comedy and horror in one podcast. You 4 00:00:10.279 --> 00:00:12.960 can do your part by leaving us a review on iTunes, 5 00:00:13.039 --> 00:00:16.719 Spotify or wherever you get Security this week. Also, you 6 00:00:16.719 --> 00:00:19.079 can get an ad free feed by becoming a five 7 00:00:19.120 --> 00:00:22.039 dollars a month patron. Go to Patreon dot Security this 8 00:00:22.079 --> 00:00:25.320 week dot com and sign up, and don't forget discord. 9 00:00:25.600 --> 00:00:28.519 Discord dot Security this week dot com. Lots of good 10 00:00:28.559 --> 00:00:32.320 stuff happening there. Yeah, I think that's it. So on 11 00:00:32.359 --> 00:00:35.200 with the podcast. So a cop came to my door 12 00:00:35.280 --> 00:00:37.359 last night and asked me where I was between five 13 00:00:37.399 --> 00:00:43.399 and six. I said, kindergarten, how about you? And it 14 00:00:43.479 --> 00:00:45.439 turns out the Lost and Found box at the new 15 00:00:45.479 --> 00:00:49.320 London Superior court House doesn't have pants in my size where. 16 00:00:49.280 --> 00:00:55.920 I thought they would. 17 00:00:58.880 --> 00:01:02.240 Hey, and welcome back to Security this week. I'm Carl Franklin, 18 00:01:02.280 --> 00:01:06.079 that Stwaye Laflatt and Patrick Hines and we got a 19 00:01:06.079 --> 00:01:10.319 few stories for you things that happened last week. How 20 00:01:10.319 --> 00:01:10.799 are you guys? 21 00:01:10.799 --> 00:01:12.719 First of all, good, We'll enjoy the summer. 22 00:01:12.840 --> 00:01:15.640 Yeah, I can't complain. Awesome somebody, somebody was at a 23 00:01:16.519 --> 00:01:17.760 nice game this week. 24 00:01:17.799 --> 00:01:19.640 Did you go to a World Cup game? I did, Patrick? 25 00:01:19.719 --> 00:01:23.959 Yeah, yeah, I went to one of the original group 26 00:01:24.040 --> 00:01:24.680 group games. 27 00:01:24.840 --> 00:01:25.120 Nice. 28 00:01:25.239 --> 00:01:27.480 That's awesome. Yeah, that's fun. That's fun. 29 00:01:27.560 --> 00:01:29.159 Well, what does that have to do with Nintendo? 30 00:01:30.439 --> 00:01:31.400 I caught some Pokemon? 31 00:01:33.480 --> 00:01:35.480 Okay, I think that's iantic. 32 00:01:35.599 --> 00:01:40.680 But oh yeah, So the first story is Nintendo confirms 33 00:01:40.719 --> 00:01:45.000 limited employee data breach linked to third party service. Hmmm, 34 00:01:45.640 --> 00:01:46.159 what happened? 35 00:01:48.760 --> 00:01:52.439 That's okay? So thread actor group, shadow bites and that's 36 00:01:52.560 --> 00:01:56.400 b y T three dollars sign because you know, hackers. 37 00:01:56.040 --> 00:01:58.799 You noticed these things. These names are are becoming like 38 00:01:59.040 --> 00:02:03.480 rock band names, like you know, they they have aspirations 39 00:02:03.519 --> 00:02:05.040 of being famous. 40 00:02:04.680 --> 00:02:08.560 Right, No Labyrinth of Pain Hacking group yet though, So 41 00:02:08.599 --> 00:02:10.319 you know what, honestly, I think the three of us 42 00:02:10.439 --> 00:02:12.759 need to start the Labyrinth of Pain Hacking. That was us, 43 00:02:13.199 --> 00:02:16.520 Labyrinth of Pain LOP. That that would be our initials 44 00:02:16.599 --> 00:02:17.039 is LOP. 45 00:02:18.039 --> 00:02:19.840 We could rename the podcast. 46 00:02:19.680 --> 00:02:21.520 Patrick, what are you going to play? 47 00:02:23.080 --> 00:02:25.360 I know I'm playing the keyboard Pokemon. I already told you. 48 00:02:27.599 --> 00:02:29.080 All right what happened here? You guys? 49 00:02:29.240 --> 00:02:35.319 Anyways, hit tiny Pulse a third party employee survey platform 50 00:02:35.439 --> 00:02:39.520 used by Nintendo of America. They claim to have x 51 00:02:39.560 --> 00:02:42.479 filtrated eight hundred and fifty nine meg which doesn't sound 52 00:02:42.479 --> 00:02:44.960 like a lot, but and it's just text. Almost a 53 00:02:45.000 --> 00:02:48.080 gig is a lot of text. Nintendo says their own 54 00:02:48.120 --> 00:02:53.879 systems were not compromised, which is important supply chain. It's yeah, absolutely, 55 00:02:54.039 --> 00:02:56.039 and we're seeing this more and more, you know. It's 56 00:02:56.159 --> 00:02:59.280 it's hard to hit Nintendo in that They've they've been 57 00:02:59.400 --> 00:03:02.000 punched out a lot over the last thirty years of 58 00:03:02.280 --> 00:03:04.560 you know, being in the market, so a lot of 59 00:03:04.599 --> 00:03:06.919 attackers have tried to steal new games from them and 60 00:03:07.039 --> 00:03:10.319 get access to systems, in reverse engineering their devices and whatever. Right, 61 00:03:10.400 --> 00:03:15.159 Nintendo has pretty rock solid security team. Although there was 62 00:03:15.520 --> 00:03:17.840 there was a way on Nintendo's website on their shop 63 00:03:17.919 --> 00:03:20.120 to steal coins and gets up anyways, we won't talk 64 00:03:20.120 --> 00:03:23.560 about that, but they do a pretty good job in 65 00:03:23.599 --> 00:03:26.000 this particular case. If you can't hit Nintendo, what do 66 00:03:26.039 --> 00:03:30.080 you do other than going to a Nintendo's employees home 67 00:03:30.159 --> 00:03:32.000 and start bringing into their home Wi Fi and then 68 00:03:32.039 --> 00:03:35.240 back routing into the office, which we don't you know, recommend, 69 00:03:35.319 --> 00:03:38.639 but you try and hit a third party, you hit 70 00:03:38.680 --> 00:03:41.599 somebody who's a little bit weaker, who doesn't you know, 71 00:03:41.680 --> 00:03:44.360 take care of cybersecurity the way they should. They're probably 72 00:03:44.400 --> 00:03:48.800 a smaller shop and they're you know, they get hit 73 00:03:48.840 --> 00:03:51.280 and unfortunately it has an Attendo data on there. Actually, 74 00:03:51.280 --> 00:03:56.120 you know what's interesting is tiny Poles probably isn't Nintendo's 75 00:03:56.120 --> 00:03:59.080 probably not the only customer they have. So if I 76 00:03:59.159 --> 00:04:00.759 were a customer of Time Post right now and now 77 00:04:00.759 --> 00:04:03.639 we're using them for surveys, I would be kind of 78 00:04:03.639 --> 00:04:06.360 concerned at this point did my data at leaked? It 79 00:04:06.439 --> 00:04:09.520 just wasn't important enough right to make the news. So 80 00:04:10.280 --> 00:04:12.960 that's our PSA for today, a try not to be 81 00:04:12.960 --> 00:04:16.920 important to people. Yeah, yeah, exactly. Listen, that's what we 82 00:04:16.959 --> 00:04:17.439 try and do. 83 00:04:17.519 --> 00:04:20.800 Carl, to fly under the radar exactly. 84 00:04:20.399 --> 00:04:21.519 So nobody knows who we are. 85 00:04:23.439 --> 00:04:23.800 The Well. 86 00:04:23.839 --> 00:04:27.759 The other thing is, uh, I know, we'll talk policies 87 00:04:27.800 --> 00:04:31.199 and policies nobody wants to talk about like what's the 88 00:04:31.439 --> 00:04:33.839 right how do we choose the right vendor, how do 89 00:04:33.879 --> 00:04:36.199 we make sure they're doing the right things. So you 90 00:04:36.199 --> 00:04:38.079 should have a policy for third party event don't have it, 91 00:04:38.279 --> 00:04:41.040 whether it's third party software or third party vendors or 92 00:04:41.079 --> 00:04:44.600 don't have any right questions you would ask them, you know, 93 00:04:44.680 --> 00:04:47.879 how are they doing security? How are they training their folks, 94 00:04:48.360 --> 00:04:51.120 how are they making are they doing yearly pen tasts? 95 00:04:51.160 --> 00:04:54.199 Are their software being tested? Et cetera, et cetera, et cetera. 96 00:04:54.279 --> 00:04:57.000 Yeah, yeah, And unfortunately the answer could very well be 97 00:04:57.800 --> 00:05:02.279 I don't know. Yeah, And you know, it's it's not 98 00:05:02.399 --> 00:05:06.600 the first thing a company does unless they are security 99 00:05:06.639 --> 00:05:09.879 background people. So there's plenty of sites out there that 100 00:05:10.040 --> 00:05:12.199 even claim to be in the security space that don't 101 00:05:12.199 --> 00:05:13.120 have their act together. 102 00:05:13.360 --> 00:05:17.680 Oh yeah, all right. We moved on auto jack how 103 00:05:17.720 --> 00:05:21.879 a single page can remote control execute the host running 104 00:05:21.920 --> 00:05:23.199 your AI agent. 105 00:05:24.639 --> 00:05:27.079 So I had an argument with someone recently, someone who 106 00:05:27.120 --> 00:05:29.839 I respect quite a bit, where we talked about whether 107 00:05:29.959 --> 00:05:34.160 you could respect me. I wasn't talking about you. Where 108 00:05:34.199 --> 00:05:36.680 we were talking about a paper that said that, you know, 109 00:05:36.720 --> 00:05:40.319 you AI cannot be secured. Yeah, And the person who 110 00:05:40.319 --> 00:05:43.560 wrote this says they've been proven right by you know, 111 00:05:43.639 --> 00:05:47.639 mathematical proofs. And it's my counter is, nothing is one 112 00:05:47.720 --> 00:05:50.720 hundred percent secure, right, It's all degrees of trade offs 113 00:05:50.720 --> 00:05:54.199 and risk. AI is in the early days, and I 114 00:05:54.240 --> 00:05:57.279 think there's ways we can do we can deal with 115 00:05:57.319 --> 00:05:59.839 AI that that can be secure, but it's going to 116 00:05:59.879 --> 00:06:02.040 be it's going to be a slippery slope for a while. 117 00:06:02.079 --> 00:06:04.000 So we're going to see a lot of these reports. 118 00:06:04.040 --> 00:06:06.120 We're going to see a lot of this fear, uncertainty, 119 00:06:06.160 --> 00:06:08.439 and doubt. One of the ways that you can deal 120 00:06:08.480 --> 00:06:14.720 with AI is to limit or minimize completely the text 121 00:06:14.759 --> 00:06:19.519 that a user can input. Have the user make choices, 122 00:06:20.240 --> 00:06:23.959 but not type in text, not up, not upload documents, 123 00:06:24.560 --> 00:06:28.639 give them choices a wizard experience. They can't always do that, 124 00:06:28.680 --> 00:06:32.439 but when you can, that's powerful for mitigating the data input. 125 00:06:32.639 --> 00:06:36.519 Think about SQL injection. Can you seql inject a multiple 126 00:06:36.600 --> 00:06:40.240 choice textbox? Well, you can if the SEQL isn't parameterized. 127 00:06:40.800 --> 00:06:44.040 But if you go back to the SQL example, you 128 00:06:44.079 --> 00:06:47.800 can't secure a SQL server. If the answer could be 129 00:06:47.839 --> 00:06:51.000 the hacker is going to break in a Microsoft and 130 00:06:50.519 --> 00:06:54.600 and and put malware in Microsoft SQL server, nothing can 131 00:06:54.639 --> 00:06:57.040 be fully secured. So some of these we have to 132 00:06:57.079 --> 00:07:00.480 understand when these are the equivalent. In that case, you. 133 00:07:00.439 --> 00:07:03.240 Could also use another layer of abstraction. So for example, 134 00:07:03.279 --> 00:07:06.360 if you have are you thinking of having a text 135 00:07:06.360 --> 00:07:12.759 box in your software that allows the users to run reports, 136 00:07:12.800 --> 00:07:17.879 for example, right instead of doing that you basically have 137 00:07:18.079 --> 00:07:22.959 your you know, your your your report interface of the 138 00:07:23.000 --> 00:07:25.439 things that they want and then you have a set 139 00:07:25.519 --> 00:07:28.240 number of reports that use the AI to get the data. 140 00:07:29.560 --> 00:07:32.560 It's not a great example, but you know, having just 141 00:07:32.600 --> 00:07:35.360 another layer instead of allowing them to type anything. 142 00:07:35.360 --> 00:07:37.680 I mean, we talk about defense and depth. So every 143 00:07:37.720 --> 00:07:41.399 every every measure helps because it minimizes the service area well. 144 00:07:41.480 --> 00:07:43.160 And one of the things you got to be careful of. 145 00:07:43.199 --> 00:07:45.360 A lot of a lot of companies are racing towards 146 00:07:45.399 --> 00:07:48.759 putting up their agentic uh you know, systems and platforms 147 00:07:48.839 --> 00:07:51.839 and that sort of stuff. Right, So in doing that, 148 00:07:51.920 --> 00:07:54.920 they go, well, my MCP server and for those of 149 00:07:55.000 --> 00:08:00.399 you who aren't playing around with agentic AI, your model 150 00:08:00.639 --> 00:08:06.240 context Protocol server, right is how think of an MCP server. 151 00:08:06.360 --> 00:08:11.959 Is how an LLM would call a useful tool, right, right. 152 00:08:12.240 --> 00:08:13.920 And the tool might be a web browsing tool, it 153 00:08:14.000 --> 00:08:16.759 might be a database backup tool maybe whatever. 154 00:08:16.879 --> 00:08:17.040 Right. 155 00:08:17.079 --> 00:08:20.839 So MCP servers, all they're doing is taking in some 156 00:08:20.959 --> 00:08:25.000 jason and they're and they're exposing functions tools that your 157 00:08:25.079 --> 00:08:28.439 agents can use. So let's say you installed the open 158 00:08:28.480 --> 00:08:30.839 clon you wanted to give it the ability to check 159 00:08:30.879 --> 00:08:34.799 out the latest stocks. Right. Because an LLM is trained, 160 00:08:34.840 --> 00:08:37.720 it means it doesn't know the native native stocks natively, right, 161 00:08:37.720 --> 00:08:39.320 It just doesn't have it in its brain, so it 162 00:08:39.320 --> 00:08:41.039 has to go search the web. Well, what better way 163 00:08:41.039 --> 00:08:42.440 to have it searched the web is if it had 164 00:08:42.440 --> 00:08:44.840 a tool it could do that with, and that's what 165 00:08:44.960 --> 00:08:48.080 MCP servers are. The problem is you start implementing a 166 00:08:48.159 --> 00:08:50.519 ton of these tools right your toolbox. You want one 167 00:08:50.559 --> 00:08:52.759 hundred tools in there, just in case my agent needs 168 00:08:53.159 --> 00:08:55.159 the ability to see what computers are on the network, 169 00:08:55.279 --> 00:08:58.799 or to do facial recognition on cameras or whatever. Right there, 170 00:08:58.919 --> 00:09:01.360 you could create an MCP ver for all of those things. 171 00:09:02.240 --> 00:09:05.399 The downside is a lot of companies, as they're racing 172 00:09:05.440 --> 00:09:08.039 to put these MCP servers up and running, there's no 173 00:09:08.159 --> 00:09:12.679 authentication to the MCP for local host. So if I'm 174 00:09:12.759 --> 00:09:16.799 running those MCP servers locally, what it says, Oh, well, 175 00:09:16.799 --> 00:09:18.799 if the request came from inside the house, just let 176 00:09:18.879 --> 00:09:21.840 it happen, right, because we must trust them. 177 00:09:21.960 --> 00:09:24.960 And that is one hundred percent against horror movie. More. 178 00:09:25.960 --> 00:09:28.440 Even King is rolling over in the graves that he 179 00:09:28.559 --> 00:09:29.360 visits every night. 180 00:09:29.279 --> 00:09:31.519 And he's like I told you so many times, if 181 00:09:31.519 --> 00:09:32.679 it's in the house, you need to. 182 00:09:32.679 --> 00:09:36.559 Worry about it. It kind of to me, It kind 183 00:09:36.559 --> 00:09:39.159 of seems to me lately that you know, tools like 184 00:09:39.200 --> 00:09:42.919 Claude can call tools directly, and so if you've got 185 00:09:42.960 --> 00:09:46.440 a command line interface and you expose that as a tool, 186 00:09:47.360 --> 00:09:49.720 you know, Claude doesn't need an MCP server. It can 187 00:09:49.799 --> 00:09:52.919 just go querry the tool, which uses the API, which 188 00:09:53.240 --> 00:09:56.840 brings back the the stuff that it can do, and 189 00:09:57.200 --> 00:09:59.960 et cetera, et cetera. So I don't know if I'm 190 00:10:00.080 --> 00:10:02.519 gonna if we're gonna see a shift away from MCP 191 00:10:02.840 --> 00:10:05.200 servers and so towards tools. 192 00:10:05.759 --> 00:10:08.679 It's interesting you say that because there's there's this big 193 00:10:09.559 --> 00:10:12.679 war on the Internet around you know, is MCP dead? 194 00:10:13.440 --> 00:10:17.960 And I can tell you from the from a person 195 00:10:18.000 --> 00:10:21.159 who's sort of steeped in AI day in and day out. 196 00:10:21.720 --> 00:10:25.279 MCP has a lot of benefits to it, like for 197 00:10:25.320 --> 00:10:27.840 the ability for us to lock down who can call 198 00:10:27.960 --> 00:10:30.960 MCP servers and what tools and functions they have access to. So, 199 00:10:31.000 --> 00:10:34.159 for example, Claude might be able to call my terminal 200 00:10:34.600 --> 00:10:36.320 and s sh into a box and now it has 201 00:10:36.440 --> 00:10:39.120 unfettered access to do anything. And you're kind of hoping 202 00:10:39.120 --> 00:10:42.279 Claude follows the rules, whereas my MCP server, I don't 203 00:10:42.279 --> 00:10:44.679 have to expose every tool and I can I have 204 00:10:44.759 --> 00:10:46.360 control over the flow of those tools. 205 00:10:46.440 --> 00:10:48.600 So it's kind of like store procedures for AI tool. 206 00:10:48.720 --> 00:10:52.039 Yes exactly, y, yeah exactly. That is a great analogy. 207 00:10:52.159 --> 00:10:52.320 Right. 208 00:10:52.759 --> 00:10:55.480 You could write this straight up query and just issue 209 00:10:55.480 --> 00:10:59.200 it with a SQL command or yeah, use store procedures 210 00:10:59.320 --> 00:11:01.440 and you're in a safer place. I think people will 211 00:11:01.600 --> 00:11:04.159 realize that. Yeah, MCPS kind of the way is the 212 00:11:04.159 --> 00:11:04.559 way to go. 213 00:11:04.720 --> 00:11:10.879 Okay, good. So what happened here? Well story yeah. 214 00:11:10.639 --> 00:11:15.320 Jack, right, So Microsoft found an exploit in their autogen studio. 215 00:11:15.440 --> 00:11:19.600 So autogen studio is just their studio for creating agentic AIS. 216 00:11:20.480 --> 00:11:23.039 What they saw was a malicious web page that is 217 00:11:23.200 --> 00:11:26.720 rendered by an AI browsing agent. So if I if 218 00:11:26.720 --> 00:11:28.840 I have an AI that goes to use a browsing 219 00:11:29.240 --> 00:11:33.840 MCP and it comes back to that particular local browser, 220 00:11:34.519 --> 00:11:37.759 the web socket that gets opened up, you can open 221 00:11:37.840 --> 00:11:41.159 up a malicious web socket to the local MCP server. 222 00:11:41.279 --> 00:11:43.600 So the browser is sitting on the MCP server, right, 223 00:11:44.159 --> 00:11:46.480 So when the browser goes out to the malicious page 224 00:11:46.919 --> 00:11:49.679 and the page comes back and loads on the browser 225 00:11:49.720 --> 00:11:52.879 on the MCP server, a malicious socket opens back up 226 00:11:52.919 --> 00:11:56.320 to local host, and now your MCP server goes, oh, well, 227 00:11:56.360 --> 00:11:59.320 I should trust this because it came from my local 228 00:11:59.360 --> 00:12:02.080 network and look like it came from the Internet, because 229 00:12:02.120 --> 00:12:05.039 it was a pipe opened from that malicious page but 230 00:12:05.200 --> 00:12:08.480 opened back to the MCP server, and that's that's where 231 00:12:08.480 --> 00:12:11.080 they're finding. Now, okay, now I can get this to 232 00:12:11.159 --> 00:12:13.320 run you know, PowerShell scripts, and I can get to 233 00:12:13.320 --> 00:12:17.120 do anything at this point because really I have control 234 00:12:17.200 --> 00:12:20.440 over what that MCP server is doing because it's innately 235 00:12:20.519 --> 00:12:23.279 trusting anything that comes from local host. So you really 236 00:12:23.279 --> 00:12:25.799 don't want to make sure that you know you have authentication, 237 00:12:25.960 --> 00:12:28.240 even if it's local. I don't know what it hurts 238 00:12:28.240 --> 00:12:30.639 you to throw it off authentication locally for. 239 00:12:31.960 --> 00:12:35.679 It's assumptions. Yeah, people assume it's safe and therefore it's 240 00:12:35.879 --> 00:12:37.080 it's it makes it more. 241 00:12:36.960 --> 00:12:41.919 Of and it's interesting. We've we've seen this as in 242 00:12:41.960 --> 00:12:46.559 the hacking world for decades. Is what's called SSRF. So 243 00:12:46.759 --> 00:12:51.480 SSRF is where a server side request comes back to 244 00:12:51.559 --> 00:12:54.120 the server. It's where I can hit a web page 245 00:12:54.519 --> 00:12:57.639 and let's say there's an administrative webpage on port eighty 246 00:12:57.679 --> 00:12:59.679 eighty that I don't have access to on the internet. 247 00:12:59.799 --> 00:13:03.120 That is only access locally on the box. But there's 248 00:13:03.159 --> 00:13:06.639 another web server running on that site, right on that computer. 249 00:13:07.279 --> 00:13:10.279 If I can manipulate the normal website to make a 250 00:13:10.320 --> 00:13:13.240 call to itself on port eighty eighty because it came 251 00:13:13.279 --> 00:13:15.279 from the local box, now it's trusted and I can 252 00:13:15.279 --> 00:13:16.879 add my user account, and I can do all sorts 253 00:13:16.919 --> 00:13:19.440 of things. And we've broken into several places, actually a 254 00:13:19.440 --> 00:13:23.600 really large school district doing this, where we're just like, hey, 255 00:13:23.639 --> 00:13:26.440 I'm going to hit your public school website. I'm going 256 00:13:26.480 --> 00:13:30.240 to look like I'm searching for classes, and instead I'm 257 00:13:30.279 --> 00:13:34.159 going to very customly craft that server to reach back 258 00:13:34.279 --> 00:13:36.840 out to itself and add a user that I can 259 00:13:36.840 --> 00:13:39.120 then log in as this is the same exact thing, 260 00:13:39.159 --> 00:13:41.000 but this is just for MCP servis Wow. 261 00:13:41.120 --> 00:13:44.240 Yep, be careful out there, kids, All right, we moved on. 262 00:13:44.440 --> 00:13:49.639 Everything's bigger and better in Texas. Even data breaches. Oh no, 263 00:13:49.879 --> 00:13:54.279 this is crazy. Hunting and fishing license incident catches three 264 00:13:54.759 --> 00:13:55.879 million residents. 265 00:13:56.440 --> 00:13:59.519 So is it data that wouldn't be out there already? 266 00:14:00.080 --> 00:14:04.840 A driver's license number, passport numbers, emails, phone numbers, addresses, 267 00:14:05.399 --> 00:14:08.360 age also lists social security numbers. 268 00:14:08.480 --> 00:14:09.919 Social secure numbers have been out there? 269 00:14:10.159 --> 00:14:13.960 Sorry yeah yeah yeah. And how many people in Texas 270 00:14:13.960 --> 00:14:16.559 actually go register license anyways? Don't they just hunting fish? 271 00:14:16.679 --> 00:14:19.000 I mean, hey man, that is an elitist comment. 272 00:14:19.399 --> 00:14:22.639 Wow, so they read too. 273 00:14:23.159 --> 00:14:25.440 Texas is an awesome state. 274 00:14:25.639 --> 00:14:30.559 Texas is great. Actually Texas is they just opened up. Okay, 275 00:14:31.000 --> 00:14:34.600 Texas has a really big federal hog problem. 276 00:14:34.639 --> 00:14:35.639 They have a big everything. 277 00:14:35.919 --> 00:14:39.360 It's if you were if Texas hunters were to kill 278 00:14:39.480 --> 00:14:43.399 two million federal hogs a year, there would still be 279 00:14:43.440 --> 00:14:46.240 a population of three million of them every year. 280 00:14:46.080 --> 00:14:49.159 And it would drive barbecue prices way down, so. 281 00:14:50.480 --> 00:14:53.600 To the point where it's destroying so many crops. Texas 282 00:14:53.600 --> 00:14:56.679 has said you don't need a hunting license to shoot 283 00:14:56.720 --> 00:14:58.919 a feral hog, and you don't even need to be 284 00:14:59.120 --> 00:15:00.840 You can be anywhere. You could be the middle of 285 00:15:01.039 --> 00:15:03.519 Austin and if feral hog comes through, you can just 286 00:15:03.559 --> 00:15:05.559 shoot it in the face and that's find no questions out. 287 00:15:05.639 --> 00:15:07.720 It sounds like you just there's so many you could 288 00:15:07.720 --> 00:15:08.960 just go to Walmart and find them. 289 00:15:09.200 --> 00:15:11.080 I think I think you could at this point. 290 00:15:12.000 --> 00:15:12.240 Yeah. 291 00:15:12.320 --> 00:15:17.000 So from what I know about Italy, I'm I have 292 00:15:17.039 --> 00:15:20.720 some friends in Tuscany and they you know, everybody's got 293 00:15:20.759 --> 00:15:23.799 like an olive grove, right, Yeah, so they hunt chingale, 294 00:15:24.519 --> 00:15:29.039 which are wild bores, which are essentially feral pigs. 295 00:15:29.080 --> 00:15:30.679 Wow, the Germans take too, Yeah. 296 00:15:30.759 --> 00:15:33.279 Yeah, they hunt them and they cook them and guess what, 297 00:15:33.440 --> 00:15:38.559 they're delicious. Yeah. So you the combination of, yeah, we 298 00:15:38.639 --> 00:15:42.519 got a big feral hog from in Texas and everybody 299 00:15:42.519 --> 00:15:44.720 should go shoot them. It's just going to result in 300 00:15:44.759 --> 00:15:46.200 a lot of delicious. 301 00:15:45.720 --> 00:15:48.879 Meal, right, and then the barbecue capital of the world. 302 00:15:49.000 --> 00:15:49.759 So why not? 303 00:15:50.200 --> 00:15:50.399 Right? 304 00:15:50.440 --> 00:15:53.559 Why not? Anyhow? 305 00:15:54.039 --> 00:16:00.840 Deviating from our faral hog conversation, Yeah, I mean, you know, 306 00:16:00.919 --> 00:16:03.559 I get it. It's I agree with Patrick. We all 307 00:16:03.559 --> 00:16:05.679 talked tongue in cheek about how you know, SOFIA security 308 00:16:05.759 --> 00:16:08.000 numbers are out there, and that's sort of passport numbers 309 00:16:08.120 --> 00:16:12.279 not so much in general, like they're not as easy 310 00:16:12.320 --> 00:16:15.960 to get, but you can still get passport numbers as well. 311 00:16:17.200 --> 00:16:19.759 You know, in this particular case, credit monitoring is the 312 00:16:19.759 --> 00:16:22.720 way to go, right, your your data has probably been 313 00:16:22.799 --> 00:16:25.279 le leaked. You probably want to just monitor it. 314 00:16:25.399 --> 00:16:25.720 Make sure. 315 00:16:26.240 --> 00:16:28.799 I'm reading this article in the Register, and there's in 316 00:16:28.840 --> 00:16:31.159 the middle it says more context and there's a few 317 00:16:31.200 --> 00:16:34.799 links in one of them, it's Texas wu's TP link 318 00:16:34.879 --> 00:16:37.639 over China links and security vulnerabilities. 319 00:16:37.960 --> 00:16:41.720 Yeah, go Texas, way to go, Way to go, Texas 320 00:16:41.759 --> 00:16:42.240 Way to go. 321 00:16:44.240 --> 00:16:46.639 They're doing the dirty work for us. All right. So 322 00:16:46.759 --> 00:16:48.720 is that all we have for this story? You know, 323 00:16:49.000 --> 00:16:49.759 it was a big. 324 00:16:49.600 --> 00:16:52.000 Breach, that's it, just it. Yeah, if you have if 325 00:16:52.000 --> 00:16:54.200 you have a hunting license in Texas, you may want 326 00:16:54.240 --> 00:16:56.399 to just make sure you monitor your credit. 327 00:16:56.159 --> 00:16:58.320 Make sure you still have it. All right. This is 328 00:16:58.360 --> 00:17:01.440 a this was a good one for me. Pixel smash, 329 00:17:01.480 --> 00:17:06.400 a critical ffm peg vulnerability turns media files into weapons. 330 00:17:07.119 --> 00:17:07.880 Oh no. 331 00:17:09.200 --> 00:17:13.480 Ffm peg is a command line tool and you can 332 00:17:13.799 --> 00:17:17.279 call it from a program using standard in Standard out 333 00:17:17.839 --> 00:17:21.000 and it just does every kind of conversion and. 334 00:17:21.480 --> 00:17:23.319 Oh yeah, including a conversion. 335 00:17:24.079 --> 00:17:24.279 Oh. 336 00:17:24.759 --> 00:17:26.799 You know what's funny is from the first time I 337 00:17:26.799 --> 00:17:30.640 saw ffm peg, like where I was doing media stuff 338 00:17:30.680 --> 00:17:32.599 and it's like, oh, you got to download ffm peg, 339 00:17:32.680 --> 00:17:35.640 and I was like, m hell no, that looks like 340 00:17:35.680 --> 00:17:36.480 a hacker tool. 341 00:17:36.680 --> 00:17:37.079 It did. 342 00:17:37.440 --> 00:17:40.920 It was like command line driven. It was like and 343 00:17:40.960 --> 00:17:44.799 it's like, oh, download this DLL from this janky site somewhere, 344 00:17:44.799 --> 00:17:48.160 and I'm like honestly. I mean, ffm peg is probably 345 00:17:48.359 --> 00:17:51.279 embedded in almost everything. Yeah that does media. It's a 346 00:17:51.440 --> 00:17:53.880 it's an amazing encoder decode. 347 00:17:53.960 --> 00:17:56.759 It can encode and decode packets in real time. Yeah, 348 00:17:56.839 --> 00:18:00.000 like you know standard audio to MP three audio, stream 349 00:18:00.160 --> 00:18:02.720 it over the internet. I mean it's really really smart. 350 00:18:02.799 --> 00:18:06.519 Yeah. Yeah, so who I don't was it one guy 351 00:18:06.519 --> 00:18:08.440 who put ffm peg together? Do we know if it 352 00:18:08.440 --> 00:18:11.480 came from like sound Blaster or like one of those 353 00:18:11.519 --> 00:18:12.160 type of companies. 354 00:18:12.240 --> 00:18:13.880 I don't know the history. I don't know that. 355 00:18:14.079 --> 00:18:16.759 Yeah, Creative Labs prominence of it, Yeah, I don't know. 356 00:18:16.960 --> 00:18:19.839 So needless to say, it's probably on every computer you 357 00:18:19.839 --> 00:18:22.839 could imagine right today. Right, even if you're not using 358 00:18:22.960 --> 00:18:25.559 ffm peg. If you've if you're just trying to you know, 359 00:18:25.640 --> 00:18:28.039 fast forward through this podcast for things that are important 360 00:18:28.039 --> 00:18:31.440 to you, you probably have a copy of fmpeg running 361 00:18:31.440 --> 00:18:34.519 on your computer somewhere doing some sort of media conversions. 362 00:18:34.519 --> 00:18:37.960 Whether it's games or camptasier or whatever. I'm sure there's 363 00:18:37.960 --> 00:18:40.680 something running it. So this is kind of an important 364 00:18:40.720 --> 00:18:43.599 deal to most people, even if you don't think it is. Yeah, 365 00:18:43.680 --> 00:18:47.839 it's been patched, right, so this is you know, this 366 00:18:47.839 --> 00:18:51.079 this was an out of bounds right for the ffm PEG, 367 00:18:52.559 --> 00:18:55.000 not a you know, a big deal. Yes, but it's 368 00:18:55.000 --> 00:18:56.920 been patched. So if you are running ffm peg, or 369 00:18:56.920 --> 00:19:00.359 if you think you're running ffm PEG, if you're running 370 00:19:00.400 --> 00:19:06.000 things like Jellyfinn or plex or thumbnail generators, cloud trans coders, 371 00:19:06.000 --> 00:19:08.160 there's all sorts of things that actually use f MPEG. 372 00:19:08.200 --> 00:19:09.599 If you're running any of those, you may want to 373 00:19:09.640 --> 00:19:09.920 go pack. 374 00:19:10.119 --> 00:19:11.920 And it doesn't look like it was malicious. It was 375 00:19:11.960 --> 00:19:14.640 just a bug, right, It was like one you said, 376 00:19:14.680 --> 00:19:17.400 one off. It was just like a math error or 377 00:19:17.440 --> 00:19:19.079 something around in this match. 378 00:19:19.279 --> 00:19:19.559 Yeah. 379 00:19:19.599 --> 00:19:23.480 So, and I haven't seen any active you know, exploits 380 00:19:23.480 --> 00:19:25.480 in the wilds or anything along those lines. 381 00:19:25.680 --> 00:19:27.839 Just yeah, which is kind of the progression. 382 00:19:27.880 --> 00:19:31.680 It's like it's it's out there being it's being actively 383 00:19:32.759 --> 00:19:35.519 you know used or the stories and then it's in 384 00:19:35.599 --> 00:19:38.200 the known exploitive vulnerabilities list from. 385 00:19:38.039 --> 00:19:41.079 Sissa Well and now with AI the moment this got 386 00:19:41.119 --> 00:19:44.000 released as a oh this is an issue, right, somebody 387 00:19:44.039 --> 00:19:46.240 will start weaponizing it by our next podcast. 388 00:19:46.480 --> 00:19:50.079 So does it is that it's a tool that you use. 389 00:19:50.279 --> 00:19:52.440 It wouldn't be hosted on the internet, would. 390 00:19:52.240 --> 00:19:55.640 It, Yes, it could be. It could be in the 391 00:19:55.880 --> 00:19:59.839 executable path of any other DLL that your website could. 392 00:20:01.160 --> 00:20:06.200 So the real problem is this magic YUV decoder which 393 00:20:06.240 --> 00:20:13.000 is enabled by default in lib v codec, LIBA v 394 00:20:13.079 --> 00:20:13.920 codec whatever. 395 00:20:14.039 --> 00:20:18.519 That was a very important legal case codec. 396 00:20:21.039 --> 00:20:27.440 It's almost like live v memorycks. So FFmpeg eight point 397 00:20:27.440 --> 00:20:31.160 one point two contains the fix. Okay, so there you go, 398 00:20:31.160 --> 00:20:34.000 go get it. Should we take a break, Let's do it. Yeah, 399 00:20:34.079 --> 00:20:35.720 let's take a little break. We'll be right back after 400 00:20:35.720 --> 00:20:42.759 these very important messages, and we're back. It's security this week. 401 00:20:42.799 --> 00:20:47.240