WEBVTT 1 00:00:00.320 --> 00:00:03.200 Hey Carl here, we're on a mission to find new 2 00:00:03.240 --> 00:00:05.919 fans of the show. I mean, where else can you 3 00:00:05.960 --> 00:00:10.240 get real life comedy and horror in one podcast. You 4 00:00:10.279 --> 00:00:13.000 can do your part by leaving us a review on iTunes, 5 00:00:13.039 --> 00:00:16.719 Spotify or wherever you get Security this week. Also, you 6 00:00:16.719 --> 00:00:19.079 can get an ad free feed by becoming a five 7 00:00:19.120 --> 00:00:22.039 dollars a month patron. Go to Patreon dot Security this 8 00:00:22.079 --> 00:00:25.359 week dot com and sign up, and don't forget discord. 9 00:00:25.600 --> 00:00:28.519 Discord dot Security this week dot com. Lots of good 10 00:00:28.559 --> 00:00:32.280 stuff happening there. Yeah, I think that's it. So on 11 00:00:32.359 --> 00:00:34.719 with the podcast. You know, when I was a kid, 12 00:00:34.759 --> 00:00:39.119 my parents sometimes took me to weddings, and I remember 13 00:00:39.359 --> 00:00:41.759 so vividly the old biddies used to poke me and 14 00:00:41.799 --> 00:00:45.320 say year next. Wow. Yeah. So when I got older, 15 00:00:45.359 --> 00:00:47.840 I started doing the same to them. Yeah, with funerals. 16 00:00:50.320 --> 00:00:52.520 And his record of being right was so good they 17 00:00:52.560 --> 00:00:53.600 called it Grim Reaper. 18 00:01:03.079 --> 00:01:06.319 Hey, welcome back to Security this week. The If you 19 00:01:06.519 --> 00:01:10.760 hear any kind of banging, that's because their roofers are 20 00:01:10.799 --> 00:01:14.599 putting on some roof for stuff at Playine's house. Yeah, 21 00:01:14.680 --> 00:01:16.280 so we're going to try and take it out. I 22 00:01:16.319 --> 00:01:17.640 hope you don't have to hear it, But. 23 00:01:17.840 --> 00:01:19.560 Is that the official term roof of stuff? 24 00:01:19.640 --> 00:01:22.079 Yeah, roof for stuff for stuff. They're doing roofing, they're 25 00:01:22.120 --> 00:01:24.000 doing roofing, roofing things, whatever that is. 26 00:01:24.040 --> 00:01:25.680 Are you are you getting a new roof put on? 27 00:01:25.879 --> 00:01:28.400 I am. Yeah. My roof is twenty five years old, 28 00:01:28.680 --> 00:01:30.760 so wow, uh it needed it. 29 00:01:30.840 --> 00:01:32.959 And he said it right, he said roof rush. 30 00:01:32.959 --> 00:01:35.439 So you're roof only started drinking four years ago, is 31 00:01:35.480 --> 00:01:36.040 what you're saying. 32 00:01:36.239 --> 00:01:40.040 Right, It's now an adult. It has to go, uh huh, 33 00:01:40.079 --> 00:01:41.840 out of the house, out of the house, all right. 34 00:01:41.879 --> 00:01:45.120 The first story is from Crabs on Security. We love crabs. 35 00:01:45.959 --> 00:01:51.400 FBI sees his net nut proxy platform Comma Papa buttnet 36 00:01:51.519 --> 00:01:56.159 popa botnet which I swear sounds either like a blues 37 00:01:56.239 --> 00:01:59.400 musician or a born name. I don't know one or 38 00:01:59.400 --> 00:02:03.439 the other. Why not both could be both net Nut So. 39 00:02:03.640 --> 00:02:07.280 There's been a lot of takedowns in this year already. 40 00:02:08.000 --> 00:02:11.599 I don't know whether AI is assisting in identifying this stuff, 41 00:02:11.599 --> 00:02:13.080 but I wouldn't be surprised, I. 42 00:02:13.080 --> 00:02:17.800 Would assume at this point. Yes, but yeah, I mean, 43 00:02:17.800 --> 00:02:21.560 this one's weird too. So the FBI sees as hundreds 44 00:02:21.560 --> 00:02:25.319 of domains tied to net Nut, a residential proxy service 45 00:02:26.000 --> 00:02:29.879 that's run by an Israeli firm a La r u 46 00:02:30.159 --> 00:02:35.080 m Alorum Technologies is traded on the Nasdaq. Right, so 47 00:02:35.159 --> 00:02:38.319 imagine this. We have a bunch of houses that are 48 00:02:38.360 --> 00:02:45.680 proxying into a place and Israel. It's roughly about two 49 00:02:45.800 --> 00:02:48.360 million compromised consumer devices. 50 00:02:48.560 --> 00:02:51.120 Wow. Yeah, thanks for the picking. 51 00:02:51.479 --> 00:02:57.280 Yeah. So in this particular case, Google saw three hundred 52 00:02:57.280 --> 00:03:02.280 and sixteen distinct threat clusters using net nut exit nodes. 53 00:03:02.879 --> 00:03:06.439 That's not easy to say. Net Nut exit nodes. 54 00:03:06.360 --> 00:03:08.080 Sound like mister rogers there for a minute. 55 00:03:08.800 --> 00:03:19.960 Net modes pretty delivery. So so let's talk a little 56 00:03:20.000 --> 00:03:25.960 bit about proxies, because a proxy is typically used to 57 00:03:26.560 --> 00:03:31.439 obscure where you're coming from or used to encrypt your traffic. 58 00:03:32.319 --> 00:03:36.039 So we've talked about, you know, leveraging VPNs. 59 00:03:36.479 --> 00:03:38.280 VPN is essentially a proxy, right. 60 00:03:38.360 --> 00:03:40.240 A VPN is a proxy. But think of a VPN 61 00:03:40.280 --> 00:03:43.080 as an entirely encrypted tunnel that you go through. Whereas 62 00:03:43.080 --> 00:03:45.240 a proxy, you're just sending your traffic to some other 63 00:03:45.319 --> 00:03:47.800 random place on the Internet and then they send it out. 64 00:03:48.360 --> 00:03:53.360 So proxy will not hide you from you know, the 65 00:03:53.400 --> 00:03:57.479 local Wi Fi. You know, it won't hide you from 66 00:03:57.520 --> 00:04:00.319 everybody else on Starbucks. You know, Wi Fi would whatever 67 00:04:00.680 --> 00:04:03.719 a VPN would, but a proxy will let you make 68 00:04:03.759 --> 00:04:05.639 it look like you're coming from another country. 69 00:04:05.599 --> 00:04:05.800 Yeah. 70 00:04:06.240 --> 00:04:08.280 So a lot of people may use proxies and may 71 00:04:08.319 --> 00:04:11.400 have used proxies in the past to say, get BBC 72 00:04:11.599 --> 00:04:14.199 broadcasts and all sorts of things you can't get in 73 00:04:14.719 --> 00:04:17.839 you know where you are now. So proxies or proxies 74 00:04:17.839 --> 00:04:21.360 are interesting for that reason, But for this number of 75 00:04:21.480 --> 00:04:25.319 people to be using proxies a little bit weird. In 76 00:04:25.319 --> 00:04:28.800 this particular case, these devices were actually smart TVs and 77 00:04:28.920 --> 00:04:32.759 streaming boxes with the proxy SDK baked in. 78 00:04:33.120 --> 00:04:34.240 Oh wow. 79 00:04:34.360 --> 00:04:38.920 Yeah, Spur reported for LG webOS apps and twenty five 80 00:04:38.959 --> 00:04:44.240 percent of Samsung tiz in apps we're carrying this proxy SDK. 81 00:04:45.319 --> 00:04:47.519 Moral of the story is, if you bought a TV 82 00:04:47.680 --> 00:04:52.839 that was running Linux or Android. If you bought a 83 00:04:52.879 --> 00:04:57.439 TV running Android that was a off brand, a super 84 00:04:57.800 --> 00:05:01.639 cheap no name, chances are it was it was running 85 00:05:02.680 --> 00:05:03.560 one of these proxies. 86 00:05:03.680 --> 00:05:06.199 Are you saying, my sam Sang TV is not a 87 00:05:06.279 --> 00:05:07.160 name brand. 88 00:05:07.319 --> 00:05:11.000 Sang, No, that's Samsung's brother. 89 00:05:10.879 --> 00:05:15.480 Better than Samsung. It's present tense, Samsung is over. 90 00:05:15.920 --> 00:05:18.839 Past Wow well, Sang is also past tense. 91 00:05:19.800 --> 00:05:20.399 That's true. 92 00:05:21.120 --> 00:05:24.319 Yeah, Sam Sing, Okay, yeah you should. 93 00:05:24.399 --> 00:05:28.160 You should buy the Sam say we'll have Sung in 94 00:05:28.360 --> 00:05:29.360 the future version. 95 00:05:31.120 --> 00:05:32.360 I say, I'm almost sung. 96 00:05:32.639 --> 00:05:34.600 Do we think that most of these are in Israel? 97 00:05:34.720 --> 00:05:35.800 Or is this all over the world? 98 00:05:36.439 --> 00:05:41.800 So the proxy was reading through Israel the the obviously 99 00:05:41.879 --> 00:05:45.120 the proxy was being used for all sorts of nefarious things. 100 00:05:47.279 --> 00:05:47.720 I don't know. 101 00:05:48.040 --> 00:05:50.399 It's a good question, I mean. And they talk about 102 00:05:50.439 --> 00:05:53.399 this as a takedown. This wasn't a full takedown. This 103 00:05:53.600 --> 00:05:55.959 was They called it a crippling, right. They took down 104 00:05:56.360 --> 00:06:01.519 one or two of the you know, net nut Maine exits, 105 00:06:01.639 --> 00:06:04.439 but there's still like net nut io is still online, right, 106 00:06:04.519 --> 00:06:09.279 so there's there's other proxies that are still available. Let's 107 00:06:09.279 --> 00:06:09.920 put it that way. 108 00:06:10.120 --> 00:06:12.759 It used to be my nickname in grammar school Netnut 109 00:06:12.800 --> 00:06:13.240 net nut. 110 00:06:13.480 --> 00:06:17.519 Yeah, here you go, as crabs, that's actually net nuts. 111 00:06:17.920 --> 00:06:20.079 That you think that's an accurate description. 112 00:06:20.360 --> 00:06:24.360 Yeah. As Crebs has warned repeatedly, most of the no 113 00:06:24.519 --> 00:06:27.439 name TV streaming boxes for sale on major e commerce 114 00:06:27.439 --> 00:06:31.800 websites either come pre installed with residential proxy software or 115 00:06:32.600 --> 00:06:35.800 require the installation of proxy software to work. So if 116 00:06:35.839 --> 00:06:39.120 you're buying some sort of sketchy TV or streaming box 117 00:06:39.160 --> 00:06:43.000 off the internet, chances are you're participating in a butt. 118 00:06:42.720 --> 00:06:46.120 Sketchy dot com right now eighty percent off. 119 00:06:47.000 --> 00:06:51.519 Free every channel. Only need to use your internet to 120 00:06:51.680 --> 00:06:56.319 steal things. Yeah, so be careful what you buy. And 121 00:06:56.600 --> 00:07:00.680 you know, Google Android and Google Play the play stores 122 00:07:00.759 --> 00:07:04.720 very good at at making sure there's not malicious things 123 00:07:04.759 --> 00:07:07.120 in apps. We're not saying it's impossible. 124 00:07:08.079 --> 00:07:08.800 It didn't used to be. 125 00:07:09.199 --> 00:07:12.000 Yeah, but if you buy one random box that has 126 00:07:12.040 --> 00:07:17.240 side loaded apps, yeah, exactly right, you'll get it. I 127 00:07:17.319 --> 00:07:20.199 got a box for you to break it. 128 00:07:20.759 --> 00:07:25.279 Yeah, yeah, all right. We moved on Chinese hackers. It's 129 00:07:25.279 --> 00:07:30.759 almost like Florida man, right, Chinese hackers develop long leash 130 00:07:30.879 --> 00:07:36.720 malware to expand o RB network. What's long leash? 131 00:07:37.240 --> 00:07:39.319 Well, it's one of their leashes. And we'll go through 132 00:07:39.560 --> 00:07:43.399 a couple of different leashes shortly. But yeah, there's there's 133 00:07:43.439 --> 00:07:47.120 short leash, there's dog leash. There's all sorts of leashes. 134 00:07:46.839 --> 00:07:48.720 In here that there's not cat leash. 135 00:07:48.759 --> 00:07:52.720 I don't think yeah, jar leishuh, And we're not kidding. 136 00:07:52.839 --> 00:07:56.040 These are all the different types they have really so 137 00:07:56.720 --> 00:08:05.079 in essence, uh, the these leashes, the ORB network is 138 00:08:05.279 --> 00:08:09.399 used to route traffic through to obscure who's doing the attacking. 139 00:08:09.399 --> 00:08:12.160 To maintain to maintain access to the network. 140 00:08:12.279 --> 00:08:16.879 Yep, absolutely, So think of it. Think of it as, uh, 141 00:08:17.240 --> 00:08:20.560 you know, I'm going to you know everybody, Let's say, 142 00:08:20.680 --> 00:08:23.199 like my firewalls here block China, right, I don't allow 143 00:08:23.279 --> 00:08:25.120 China to hit my network here. I don't allow anybody 144 00:08:25.160 --> 00:08:27.399 here on my network to go out to China. But 145 00:08:28.279 --> 00:08:30.759 let's say an exit note on that ORB network is 146 00:08:30.800 --> 00:08:35.399 in Canada. I mean everybody loves Canada, right, especially China, right, 147 00:08:35.559 --> 00:08:39.399 So so I you know, I allow Canadian traffic. So 148 00:08:39.399 --> 00:08:40.960 it's one of it's one of the reasons they may 149 00:08:41.120 --> 00:08:43.840 use one of these types of networks is to obscure 150 00:08:44.000 --> 00:08:46.840 not only the location of the attacks, but also to 151 00:08:46.879 --> 00:08:49.759 obscure one of the indicator's compromise and ways that you 152 00:08:49.799 --> 00:08:52.080 can attribute the attack to a particular attack. 153 00:08:52.120 --> 00:08:54.000 So it's like using it as a VPN, you know 154 00:08:54.039 --> 00:08:56.120 how if you're in yeah, exactly, if you want to 155 00:08:56.120 --> 00:08:58.960 watch TV on a Mexican channel, you might have to 156 00:08:59.080 --> 00:09:02.159 VPN in Mexico. Same deal if you want to hack 157 00:09:02.200 --> 00:09:06.080 a computer in Canada, if they're screening for Russia and 158 00:09:06.240 --> 00:09:09.759 China and Iran, then you can get around that one 159 00:09:10.200 --> 00:09:11.080 defense in depth. 160 00:09:11.240 --> 00:09:15.240 Now, in this particular case, the leash long Leash, which 161 00:09:15.360 --> 00:09:18.360 was an upgraded from short leash, which was a back door, 162 00:09:18.960 --> 00:09:21.919 not kidding. And they have dog leash, which is a 163 00:09:21.960 --> 00:09:24.440 Linux back door with a hard coded TCP listener, and 164 00:09:24.480 --> 00:09:27.360 then jar leash, which is a Java web admin tool 165 00:09:28.039 --> 00:09:31.279 back door, and then leash test which is test yeah 166 00:09:31.320 --> 00:09:34.879 for their IoT compatibility checkers. Blah blah blah. So all 167 00:09:34.919 --> 00:09:38.279 of these leashes in this particular case they are exploiting 168 00:09:38.320 --> 00:09:41.559 CVEE twenty twenty. So for those of you who have 169 00:09:41.559 --> 00:09:43.879 been listening to the show for a while, you know 170 00:09:44.039 --> 00:09:47.720 CV twenty twenty means it came out in twenty twenty. 171 00:09:47.559 --> 00:09:50.679 Well it was it was adult that number was dolled 172 00:09:50.679 --> 00:09:50.960 out in. 173 00:09:50.960 --> 00:09:54.240 Twenty yeah, so that means six years ago this vulnerability 174 00:09:54.279 --> 00:09:59.840 was discovered and I assigned an ID same thing with 175 00:10:00.200 --> 00:10:02.480 So this is twenty twenty two, two sixty five three, 176 00:10:02.799 --> 00:10:06.279 twenty twenty two two six, five eight, and twenty twenty 177 00:10:06.279 --> 00:10:09.879 three two five seven, one seven. These are all Ruckus devices. Yeah, 178 00:10:09.879 --> 00:10:11.799 I was gonna say, that's a great name for a 179 00:10:11.879 --> 00:10:15.480 route RUCKUS causes RUCKUS. 180 00:10:15.120 --> 00:10:16.919 It causes one with your bank account. 181 00:10:17.279 --> 00:10:20.639 Yeah right, Uh so all of these are our RUCKUS devices. 182 00:10:20.679 --> 00:10:23.519 This has been patched, but there are exploits on these 183 00:10:23.559 --> 00:10:26.320 devices that allow for attackers to take control of them 184 00:10:26.320 --> 00:10:29.919 and add them to this network. CEV twenty twenty five 185 00:10:30.360 --> 00:10:36.080 two four nine two is an asus AI Cloud critical 186 00:10:36.120 --> 00:10:39.480 off bypass and that's one that So these are the 187 00:10:39.519 --> 00:10:43.159 four cvees that are being used to add more nodes 188 00:10:43.879 --> 00:10:45.039 via a long leash. 189 00:10:45.080 --> 00:10:47.039 Here's a good question for you, and I don't expect 190 00:10:47.080 --> 00:10:49.320 you to have the answer right now, but is there 191 00:10:49.360 --> 00:10:55.159 a way that I can configure my configure my you know, 192 00:10:55.240 --> 00:10:59.639 Wi Fi home Wi Fi to absolutely refuse any connections 193 00:10:59.639 --> 00:11:03.600 from or Russia or any other country. Yeah that I'm 194 00:11:03.639 --> 00:11:04.559 so easy thing to do. 195 00:11:05.440 --> 00:11:07.960 So it depends, I'll give you it depends. It depends 196 00:11:07.960 --> 00:11:09.960 on your hardware. So like right now at my house, 197 00:11:09.960 --> 00:11:12.960 I'm running Ubiquity and it does. It's It's easy. It's 198 00:11:13.000 --> 00:11:14.480 literally I go in and I can say I want 199 00:11:14.480 --> 00:11:15.919 to restrict, and it shows me a map of the 200 00:11:15.919 --> 00:11:18.039 world and I can click the countries and say nope. 201 00:11:18.120 --> 00:11:18.519 Oh wow. 202 00:11:18.960 --> 00:11:21.639 So that makes it easy. I know, firewalla does the 203 00:11:21.639 --> 00:11:24.799 same thing, makes it really super easy. But then there 204 00:11:24.799 --> 00:11:26.759 are other ones like if you're running a TP link, 205 00:11:26.799 --> 00:11:29.639 throw it out. But if you're running something else, well 206 00:11:29.679 --> 00:11:33.000 it comes included with the with the leash, yeah exactly, 207 00:11:33.039 --> 00:11:34.440 you know, and. 208 00:11:34.360 --> 00:11:37.240 It also has a cardboard role in the middle of 209 00:11:37.879 --> 00:11:38.919 you got to take that out. 210 00:11:39.279 --> 00:11:41.960 Yeah, but then it's uh no, it's fine, but no, 211 00:11:42.039 --> 00:11:45.799 if you're running some other version of firewall, sometimes you 212 00:11:45.799 --> 00:11:47.879 can just block the country outright. Sometimes they have a 213 00:11:47.919 --> 00:11:51.679 block list. Sometimes you actually need to go in and 214 00:11:52.120 --> 00:11:54.679 like configure the ranges yourself that you don't want it 215 00:11:54.720 --> 00:11:56.080 to talk to you, which is more of a pain 216 00:11:56.159 --> 00:11:58.440 but can be done no matter what you're running. 217 00:11:58.559 --> 00:12:01.279 Okay, but the the whole the hull idea this leash 218 00:12:01.320 --> 00:12:02.360 thing is to circumvent that. 219 00:12:02.480 --> 00:12:04.080 So yeah, absolutely it. 220 00:12:04.000 --> 00:12:05.919 Is part of defense and death. You do want to 221 00:12:05.960 --> 00:12:08.200 do it, Yeah, don't count on it. 222 00:12:08.320 --> 00:12:13.159 Yeah, absolutely, and defense and death Like that's the first layer, right, 223 00:12:13.240 --> 00:12:16.960 don't talk to or communicate to the places where generally 224 00:12:17.039 --> 00:12:20.159 you're getting attacked. Right. The second layer obviously is then 225 00:12:20.360 --> 00:12:22.440 monitoring the type of traffic you have and you know, 226 00:12:22.639 --> 00:12:27.320 having isolation on your networks for example, on my home network. 227 00:12:27.360 --> 00:12:29.559 There is no way in hell I allow the kids 228 00:12:29.600 --> 00:12:33.639 on any of the networks that have sensitive data. So 229 00:12:33.679 --> 00:12:36.919 they're in essence on their own guess network where they 230 00:12:36.960 --> 00:12:41.519 can play games and stream and download whatever janky things 231 00:12:41.559 --> 00:12:44.559 they download install on their computers. But it's it's not 232 00:12:44.559 --> 00:12:47.519 gonna affect any of the rest of the network. 233 00:12:47.639 --> 00:12:51.440 All right. This next story actually kind of hits close 234 00:12:51.480 --> 00:12:54.120 to home because we actually thought about setting up a 235 00:12:54.159 --> 00:13:01.679 website to expose websites that had dumb password rules. Right now, 236 00:13:01.679 --> 00:13:03.759 if you've been listening to the show for the last 237 00:13:03.840 --> 00:13:07.080 year or so, the only rule that makes any sense 238 00:13:07.320 --> 00:13:08.720 for password is length. 239 00:13:09.879 --> 00:13:13.039 You know, I mean complexity adds an element. 240 00:13:13.200 --> 00:13:14.320 Well, length is more important. 241 00:13:14.480 --> 00:13:17.279 Length is more important. Size matter, Size matters, And. 242 00:13:17.519 --> 00:13:20.519 If you're gonna not have complexity, don't advertise that. 243 00:13:20.960 --> 00:13:25.519 R Yeah, So this dumb passwords rules, dumb password rules 244 00:13:25.559 --> 00:13:30.600 dot com has shown a spotlight on GameFly and so 245 00:13:30.679 --> 00:13:34.159 with link to this. Basically it has a change email 246 00:13:34.279 --> 00:13:37.639 address and password, and you put in your email in 247 00:13:37.679 --> 00:13:40.759 your password, which is only six to twelve characters with 248 00:13:40.879 --> 00:13:42.159 no other restrictions. 249 00:13:42.679 --> 00:13:49.600 Well, that's impossible to crack. My password is one, two, three, four, five, six, 250 00:13:49.879 --> 00:13:50.440 it could be. 251 00:13:50.519 --> 00:13:56.440 And probably is common password around. So I mean, Dwyane, 252 00:13:56.679 --> 00:14:00.879 how many milliseconds would it take ice. 253 00:14:01.200 --> 00:14:04.120 It wouldn't get out of the first chapter the dictionary. No, yeah, 254 00:14:04.399 --> 00:14:07.679 a dictionary attack, Yeah, it would be page one. 255 00:14:09.519 --> 00:14:14.399 Instant easily in the milliseconds, probably hundreds of milliseconds, but 256 00:14:14.440 --> 00:14:18.000 milliseconds for it to crack a majority of those passwords. Yeah, absolutely, 257 00:14:18.000 --> 00:14:19.120 with a decent size cluster. 258 00:14:20.759 --> 00:14:23.600 Really no story here. We just wanted to, uh, you know, 259 00:14:23.759 --> 00:14:27.240 highlight the dumbness. And I think dumb password rules dot 260 00:14:27.240 --> 00:14:29.039 com is going to be a staple. 261 00:14:30.159 --> 00:14:31.399 So let's talk. 262 00:14:31.519 --> 00:14:33.480 Let's take an opportunity for a second. Just talk about 263 00:14:33.519 --> 00:14:40.039 the reality of authentication. Right now. You've got past keys, right, 264 00:14:40.080 --> 00:14:45.720 which is a great yep, that's foreshadowing. Past keys are great. 265 00:14:46.360 --> 00:14:49.679 Multi factor authentication is good, especially if you use an 266 00:14:49.679 --> 00:14:52.840 authenticator w app that that makes it much better than 267 00:14:53.279 --> 00:14:57.919 you know, sim sim swap attackable uh text message or 268 00:14:57.960 --> 00:15:01.399 email messages on an email count that doesn't have multi 269 00:15:01.399 --> 00:15:03.879 factor authentication. And one of the things that I've looked 270 00:15:03.879 --> 00:15:06.159 at is compounding them because a lot of times if 271 00:15:06.159 --> 00:15:09.879 you have a pass key, it's like a device certificate, right, 272 00:15:09.960 --> 00:15:12.759 that's effectively what it is, why don't you still ask 273 00:15:12.799 --> 00:15:16.519 for the password? Sure to add an extra layer, and 274 00:15:16.600 --> 00:15:19.039 so in some case I'll implement that. But the other 275 00:15:19.080 --> 00:15:21.559 thing is the denial of service. If you lock people 276 00:15:21.600 --> 00:15:25.000 out after so many password attempts, the bad guy can 277 00:15:25.080 --> 00:15:28.480 just use that to harass your users, right, So you 278 00:15:28.559 --> 00:15:31.759 want to do something intelligent where it's like you escalate 279 00:15:31.840 --> 00:15:35.919 the time of the password attack. Or my favorite thing, 280 00:15:35.960 --> 00:15:38.720 which I've never seen anybody do other than us, is 281 00:15:39.159 --> 00:15:43.039 when you fail that test you've tried five times in 282 00:15:43.080 --> 00:15:48.399 the last two minutes, add another factor. Yeah, like what's 283 00:15:48.759 --> 00:15:51.840 what's you know your what's Dwayne's extension at the office? 284 00:15:52.159 --> 00:15:52.759 Trick question? 285 00:15:52.919 --> 00:15:56.840 It's another factor or SMS when it starts. 286 00:15:56.879 --> 00:15:59.080 Messages aren't great, but but. 287 00:15:59.039 --> 00:16:01.240 It's it's an extra lay. So so that way you 288 00:16:01.279 --> 00:16:03.840 don't lock the user out. You just raise the bar 289 00:16:03.919 --> 00:16:06.200 and you know what you've also done, You've also made 290 00:16:06.240 --> 00:16:08.679 it so that the user calls the help desk and says, 291 00:16:08.679 --> 00:16:10.679 why is it asking for this extra piece of information? 292 00:16:11.200 --> 00:16:13.759 If the hacker locked you out in the middle of 293 00:16:13.759 --> 00:16:16.639 the night and the timer ran out, then unless you're 294 00:16:16.679 --> 00:16:18.399 watching the logs, you're not going to have it now 295 00:16:18.399 --> 00:16:21.000 the user is part of the part of the system 296 00:16:21.039 --> 00:16:23.720 that alerts you. So we have to get We don't 297 00:16:23.759 --> 00:16:26.600 want to roll our own I'm not saying that, but 298 00:16:26.600 --> 00:16:30.519 we got to get more creative and compounding the authentication 299 00:16:30.679 --> 00:16:34.360 and figuring out who they really are. Okay, sorry, I'm off. 300 00:16:34.519 --> 00:16:35.840 Let me step down from the soapbox. 301 00:16:36.759 --> 00:16:38.480 That actually used to be a great way to denial 302 00:16:38.519 --> 00:16:40.600 a service an entire company, where they'd be like, oh, 303 00:16:40.639 --> 00:16:42.399 three invalid attempts and you be like, all right, I'm 304 00:16:42.399 --> 00:16:44.559 just gonna rape through all your users and log in 305 00:16:44.679 --> 00:16:49.720 continually in the Outlook web access shut off that protection 306 00:16:49.799 --> 00:16:53.399 because yeah, and then everybody's locked out constantly. By the 307 00:16:53.399 --> 00:16:57.080 time you unlock them and it synchronizes to all your dcs, 308 00:16:57.600 --> 00:16:59.399 I've locked them out again, so good luck. 309 00:16:59.440 --> 00:17:01.279 All right, before we take a break, let's talk about 310 00:17:01.320 --> 00:17:07.720 Microsoft Defender, because there was an elevation of privilege vulnerability 311 00:17:07.799 --> 00:17:12.079 in it that was reported and what was the tell me, 312 00:17:12.359 --> 00:17:15.119 tell me the sequence of actions. So this was reported, 313 00:17:15.440 --> 00:17:17.920 Microsoft came out with a fix fix didn't really work, 314 00:17:18.000 --> 00:17:19.839 and then they came out with another fix. Is that it? 315 00:17:20.039 --> 00:17:23.640 Yeah, absolutely yesterday As of July eighth, they've come out 316 00:17:23.640 --> 00:17:27.559 with another fix that should mitigate this. I mean, if 317 00:17:27.559 --> 00:17:29.920 you're if you're writing, if you're there with a notepad, 318 00:17:29.960 --> 00:17:31.960 it's going to be version one dot one dot two 319 00:17:32.079 --> 00:17:35.720 six zero six zero three zero zero eight. But what 320 00:17:35.759 --> 00:17:37.400 I'll tell you is, if you've been listening to this 321 00:17:37.400 --> 00:17:38.920 show for a while, you probably don't need to worry 322 00:17:38.960 --> 00:17:42.920 about it because it would have already updated. Yeah, to 323 00:17:43.079 --> 00:17:45.440 just know that, Yeah, there was a privilege escalation and 324 00:17:45.480 --> 00:17:48.079 had you'll remember us maybe reporting on this a couple 325 00:17:48.079 --> 00:17:50.440 of weeks ago, maybe even a month ago, where we 326 00:17:50.480 --> 00:17:55.680 had talked about privileged escalation using soft links, using l 327 00:17:55.759 --> 00:18:00.880 en k files. Yeah, it was actually dubbed the Rogue Planet. 328 00:18:01.920 --> 00:18:05.279 So yeah, and that so that now does have an 329 00:18:05.279 --> 00:18:09.599 official patch that's come through. So if you're not auto updating, 330 00:18:09.599 --> 00:18:11.279 shame on you go update. But if you are up 331 00:18:11.440 --> 00:18:14.759 you know, auto updating, you probably defenders probably already patched. 332 00:18:14.960 --> 00:18:19.319 Yeah, and or you will see a little Windows message, 333 00:18:19.440 --> 00:18:22.279 you know, the little orange thing that says, you know, 334 00:18:22.440 --> 00:18:24.519 updates need to you need to reboot in order to 335 00:18:24.559 --> 00:18:29.480 install updates. Yeah, but we should. You should definitely automatically update. 336 00:18:29.519 --> 00:18:32.079 The only reason I wouldn't is if I had a 337 00:18:32.079 --> 00:18:36.839 specialized computer that was that needed to be up at 338 00:18:37.000 --> 00:18:40.200 you know, a certain range of times. Sure, And I 339 00:18:40.240 --> 00:18:44.519 think the days of Windows automatically updating and rebooting your 340 00:18:44.559 --> 00:18:45.759 computer are gone. 341 00:18:45.920 --> 00:18:48.039 Like in the enterprise, it's certainly been gone for a 342 00:18:48.079 --> 00:18:48.519 long time. 343 00:18:48.680 --> 00:18:53.880 Yeah, they might have allowed it and just obfuscated the 344 00:18:53.880 --> 00:18:57.599 way to disable it or something, but I definitely remember 345 00:18:57.640 --> 00:18:59.160 that happening. It happened to me in the middle of 346 00:18:59.160 --> 00:18:59.480 the gig. 347 00:19:00.519 --> 00:19:03.279 I think we need to get to the ability to 348 00:19:03.319 --> 00:19:07.160 support like a chaos Monkey mentality. If you remember chaos Monkey, 349 00:19:07.200 --> 00:19:10.759 it was where I think it was Netflix had so Yeah, 350 00:19:10.799 --> 00:19:14.960 so that you you you allow you you you expect 351 00:19:15.000 --> 00:19:18.480 every type of failure there can be all the time, 352 00:19:19.079 --> 00:19:22.200 and you're you're completely redundant. And if we do that, 353 00:19:22.759 --> 00:19:25.720 then we can allow things to patch immediately because the 354 00:19:25.759 --> 00:19:29.359 patch is an expected potential down out down time. If 355 00:19:29.359 --> 00:19:31.680 we don't get there, then we're just going to always 356 00:19:31.720 --> 00:19:33.920 be late to the party and the hackers are gonna 357 00:19:34.480 --> 00:19:38.160 we have to reinvent our patching strategy. And you're right, Carl, 358 00:19:38.519 --> 00:19:43.000 Most most enterprises, most even medium companies, don't allow auto patch, 359 00:19:43.400 --> 00:19:44.920 and it's going to get them owned. 360 00:19:45.839 --> 00:19:48.039 Dump dump dumb, and that seems like a good place 361 00:19:48.079 --> 00:19:50.119 to take a break. So we'll be right back after 362 00:19:50.160 --> 00:19:56.359 these very important messages don't go away, and we're back. 363 00:19:56.400 --> 00:19:58.839 It's security this week. I'm Carl, that's Patrick and Twain. 364 00:19:59.599 --> 00:20:02.519 Got a up more stories here for you from last week. 365 00:20:03.920 --> 00:20:08.480 AI coding agents found triggering endpoint security rules to build 366 00:20:08.680 --> 00:20:12.559 a built to catch attackers. Just that you know, it's 367 00:20:12.559 --> 00:20:17.480 like a whole story in one sentence, tell us the story. 368 00:20:17.839 --> 00:20:25.160 It's okay. So Endpoint Detection and Response are EDRs. They're 369 00:20:25.200 --> 00:20:31.119 looking for attackers doing crazy things, right, injecting things in 370 00:20:31.240 --> 00:20:35.079 processes that shouldn't be there. You know, there's a cert 371 00:20:35.240 --> 00:20:38.880 util dot ex, which is an execut one in your 372 00:20:38.880 --> 00:20:44.000 computer that can download information like certificate information. But US attackers, 373 00:20:44.039 --> 00:20:47.119 we use it to download payloads, right because it's on 374 00:20:47.400 --> 00:20:50.559 every Windows computer and living off the land means I'm 375 00:20:50.559 --> 00:20:52.440 going to use tools around the computer instead of bringing 376 00:20:52.480 --> 00:20:54.400 my own because when I bring my own you might 377 00:20:54.480 --> 00:20:57.559 notice it. So now all of your EDRs are going, aha, 378 00:20:57.680 --> 00:21:03.160 if anybody uses cert util, that's weird. Right now, fast forward, 379 00:21:03.279 --> 00:21:07.599 you have all of these these llms like that are 380 00:21:07.839 --> 00:21:11.559 using coding, you know, code coding l lms like a 381 00:21:11.640 --> 00:21:14.640 cloud code cursor, open as codex, etctera, that sort of 382 00:21:14.640 --> 00:21:21.640 thing that those tools have been trained on, vast amounts 383 00:21:21.640 --> 00:21:25.200 of programming information and data off the Internet and you 384 00:21:25.279 --> 00:21:27.960 name it. So when they say, oh, we got to 385 00:21:28.000 --> 00:21:34.400 go download and run this Python package, right, and they 386 00:21:34.599 --> 00:21:37.119 they get denied going to you know, python dot org. 387 00:21:38.480 --> 00:21:41.079 So they go, Okay, not a problem, I won't I 388 00:21:41.160 --> 00:21:43.640 won't go try and pull it directly. Let me try 389 00:21:43.680 --> 00:21:46.799 and download it with a PowerShell script. No that failed. 390 00:21:46.920 --> 00:21:49.920 Let me use cert util, No that failed. Let me 391 00:21:50.039 --> 00:21:53.680 use bits admin. Yep, Okay, that downloaded it. So we 392 00:21:53.799 --> 00:21:56.519 goes to this path of let me do all of 393 00:21:56.599 --> 00:22:00.279 the same things attackers do on the internet to yet 394 00:22:00.279 --> 00:22:03.480 this package downloaded. And now that I have it, it 395 00:22:03.559 --> 00:22:06.319 starts running things, etc. And when it runs into a problem, 396 00:22:06.640 --> 00:22:09.119 what does y l on do? Statistically it finds the 397 00:22:09.119 --> 00:22:12.160 next solution, which is what an attacker might do. So 398 00:22:12.279 --> 00:22:16.640 the way that these you know IDEs for lack of 399 00:22:16.640 --> 00:22:21.759 a better term, are integrating into the operating system, they 400 00:22:21.799 --> 00:22:25.359 all look like attackers, right. It all looks like somebody 401 00:22:25.400 --> 00:22:28.079