Speaker 1: Hey Carl here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes,
Speaker 1: Spotify or wherever you get Security this week. Also, you
Speaker 1: can get an ad free feed by becoming a five
Speaker 1: dollars a month patron. Go to Patreon dot Security this
Speaker 1: week dot com and sign up, and don't forget discord.
Speaker 1: Discord dot Security this week dot com. Lots of good
Speaker 1: stuff happening there. Yeah, I think that's it. So on
Speaker 1: with the podcast. You know, when I was a kid,
Speaker 1: my parents sometimes took me to weddings, and I remember
Speaker 1: so vividly the old biddies used to poke me and
Speaker 1: say year next. Wow. Yeah. So when I got older,
Speaker 1: I started doing the same to them. Yeah, with funerals.
Speaker 2: And his record of being right was so good they
Speaker 2: called it Grim Reaper.
Speaker 1: Hey, welcome back to Security this week. The If you
Speaker 1: hear any kind of banging, that's because their roofers are
Speaker 1: putting on some roof for stuff at Playine's house. Yeah,
Speaker 1: so we're going to try and take it out. I
Speaker 1: hope you don't have to hear it, But.
Speaker 2: Is that the official term roof of stuff?
Speaker 3: Yeah, roof for stuff for stuff. They're doing roofing, they're
Speaker 3: doing roofing, roofing things, whatever that is.
Speaker 1: Are you are you getting a new roof put on?
Speaker 3: I am. Yeah. My roof is twenty five years old,
Speaker 3: so wow, uh it needed it.
Speaker 2: And he said it right, he said roof rush.
Speaker 1: So you're roof only started drinking four years ago, is
Speaker 1: what you're saying.
Speaker 3: Right, It's now an adult. It has to go, uh huh,
Speaker 3: out of the house, out of the house, all right.
Speaker 1: The first story is from Crabs on Security. We love crabs.
Speaker 1: FBI sees his net nut proxy platform Comma Papa buttnet
Speaker 1: popa botnet which I swear sounds either like a blues
Speaker 1: musician or a born name. I don't know one or
Speaker 1: the other. Why not both could be both net Nut So.
Speaker 2: There's been a lot of takedowns in this year already.
Speaker 2: I don't know whether AI is assisting in identifying this stuff,
Speaker 2: but I wouldn't be surprised, I.
Speaker 3: Would assume at this point. Yes, but yeah, I mean,
Speaker 3: this one's weird too. So the FBI sees as hundreds
Speaker 3: of domains tied to net Nut, a residential proxy service
Speaker 3: that's run by an Israeli firm a La r u
Speaker 3: m Alorum Technologies is traded on the Nasdaq. Right, so
Speaker 3: imagine this. We have a bunch of houses that are
Speaker 3: proxying into a place and Israel. It's roughly about two
Speaker 3: million compromised consumer devices.
Speaker 1: Wow. Yeah, thanks for the picking.
Speaker 3: Yeah. So in this particular case, Google saw three hundred
Speaker 3: and sixteen distinct threat clusters using net nut exit nodes.
Speaker 3: That's not easy to say. Net Nut exit nodes.
Speaker 1: Sound like mister rogers there for a minute.
Speaker 3: Net modes pretty delivery. So so let's talk a little
Speaker 3: bit about proxies, because a proxy is typically used to
Speaker 3: obscure where you're coming from or used to encrypt your traffic.
Speaker 3: So we've talked about, you know, leveraging VPNs.
Speaker 1: VPN is essentially a proxy, right.
Speaker 3: A VPN is a proxy. But think of a VPN
Speaker 3: as an entirely encrypted tunnel that you go through. Whereas
Speaker 3: a proxy, you're just sending your traffic to some other
Speaker 3: random place on the Internet and then they send it out.
Speaker 3: So proxy will not hide you from you know, the
Speaker 3: local Wi Fi. You know, it won't hide you from
Speaker 3: everybody else on Starbucks. You know, Wi Fi would whatever
Speaker 3: a VPN would, but a proxy will let you make
Speaker 3: it look like you're coming from another country.
Speaker 2: Yeah.
Speaker 3: So a lot of people may use proxies and may
Speaker 3: have used proxies in the past to say, get BBC
Speaker 3: broadcasts and all sorts of things you can't get in
Speaker 3: you know where you are now. So proxies or proxies
Speaker 3: are interesting for that reason, But for this number of
Speaker 3: people to be using proxies a little bit weird. In
Speaker 3: this particular case, these devices were actually smart TVs and
Speaker 3: streaming boxes with the proxy SDK baked in.
Speaker 1: Oh wow.
Speaker 3: Yeah, Spur reported for LG webOS apps and twenty five
Speaker 3: percent of Samsung tiz in apps we're carrying this proxy SDK.
Speaker 3: Moral of the story is, if you bought a TV
Speaker 3: that was running Linux or Android. If you bought a
Speaker 3: TV running Android that was a off brand, a super
Speaker 3: cheap no name, chances are it was it was running
Speaker 3: one of these proxies.
Speaker 2: Are you saying, my sam Sang TV is not a
Speaker 2: name brand.
Speaker 3: Sang, No, that's Samsung's brother.
Speaker 2: Better than Samsung. It's present tense, Samsung is over.
Speaker 1: Past Wow well, Sang is also past tense.
Speaker 3: That's true.
Speaker 2: Yeah, Sam Sing, Okay, yeah you should.
Speaker 3: You should buy the Sam say we'll have Sung in
Speaker 3: the future version.
Speaker 1: I say, I'm almost sung.
Speaker 2: Do we think that most of these are in Israel?
Speaker 2: Or is this all over the world?
Speaker 3: So the proxy was reading through Israel the the obviously
Speaker 3: the proxy was being used for all sorts of nefarious things.
Speaker 1: I don't know.
Speaker 3: It's a good question, I mean. And they talk about
Speaker 3: this as a takedown. This wasn't a full takedown. This
Speaker 3: was They called it a crippling, right. They took down
Speaker 3: one or two of the you know, net nut Maine exits,
Speaker 3: but there's still like net nut io is still online, right,
Speaker 3: so there's there's other proxies that are still available. Let's
Speaker 3: put it that way.
Speaker 1: It used to be my nickname in grammar school Netnut
Speaker 1: net nut.
Speaker 3: Yeah, here you go, as crabs, that's actually net nuts.
Speaker 2: That you think that's an accurate description.
Speaker 3: Yeah. As Crebs has warned repeatedly, most of the no
Speaker 3: name TV streaming boxes for sale on major e commerce
Speaker 3: websites either come pre installed with residential proxy software or
Speaker 3: require the installation of proxy software to work. So if
Speaker 3: you're buying some sort of sketchy TV or streaming box
Speaker 3: off the internet, chances are you're participating in a butt.
Speaker 1: Sketchy dot com right now eighty percent off.
Speaker 3: Free every channel. Only need to use your internet to
Speaker 3: steal things. Yeah, so be careful what you buy. And
Speaker 3: you know, Google Android and Google Play the play stores
Speaker 3: very good at at making sure there's not malicious things
Speaker 3: in apps. We're not saying it's impossible.
Speaker 1: It didn't used to be.
Speaker 3: Yeah, but if you buy one random box that has
Speaker 3: side loaded apps, yeah, exactly right, you'll get it. I
Speaker 3: got a box for you to break it.
Speaker 1: Yeah, yeah, all right. We moved on Chinese hackers. It's
Speaker 1: almost like Florida man, right, Chinese hackers develop long leash
Speaker 1: malware to expand o RB network. What's long leash?
Speaker 3: Well, it's one of their leashes. And we'll go through
Speaker 3: a couple of different leashes shortly. But yeah, there's there's
Speaker 3: short leash, there's dog leash. There's all sorts of leashes.
Speaker 1: In here that there's not cat leash.
Speaker 3: I don't think yeah, jar leishuh, And we're not kidding.
Speaker 3: These are all the different types they have really so
Speaker 3: in essence, uh, the these leashes, the ORB network is
Speaker 3: used to route traffic through to obscure who's doing the attacking.
Speaker 2: To maintain to maintain access to the network.
Speaker 3: Yep, absolutely, So think of it. Think of it as, uh,
Speaker 3: you know, I'm going to you know everybody, Let's say,
Speaker 3: like my firewalls here block China, right, I don't allow
Speaker 3: China to hit my network here. I don't allow anybody
Speaker 3: here on my network to go out to China. But
Speaker 3: let's say an exit note on that ORB network is
Speaker 3: in Canada. I mean everybody loves Canada, right, especially China, right,
Speaker 3: So so I you know, I allow Canadian traffic. So
Speaker 3: it's one of it's one of the reasons they may
Speaker 3: use one of these types of networks is to obscure
Speaker 3: not only the location of the attacks, but also to
Speaker 3: obscure one of the indicator's compromise and ways that you
Speaker 3: can attribute the attack to a particular attack.
Speaker 2: So it's like using it as a VPN, you know
Speaker 2: how if you're in yeah, exactly, if you want to
Speaker 2: watch TV on a Mexican channel, you might have to
Speaker 2: VPN in Mexico. Same deal if you want to hack
Speaker 2: a computer in Canada, if they're screening for Russia and
Speaker 2: China and Iran, then you can get around that one
Speaker 2: defense in depth.
Speaker 3: Now, in this particular case, the leash long Leash, which
Speaker 3: was an upgraded from short leash, which was a back door,
Speaker 3: not kidding. And they have dog leash, which is a
Speaker 3: Linux back door with a hard coded TCP listener, and
Speaker 3: then jar leash, which is a Java web admin tool
Speaker 3: back door, and then leash test which is test yeah
Speaker 3: for their IoT compatibility checkers. Blah blah blah. So all
Speaker 3: of these leashes in this particular case they are exploiting
Speaker 3: CVEE twenty twenty. So for those of you who have
Speaker 3: been listening to the show for a while, you know
Speaker 3: CV twenty twenty means it came out in twenty twenty.
Speaker 1: Well it was it was adult that number was dolled
Speaker 1: out in.
Speaker 3: Twenty yeah, so that means six years ago this vulnerability
Speaker 3: was discovered and I assigned an ID same thing with
Speaker 3: So this is twenty twenty two, two sixty five three,
Speaker 3: twenty twenty two two six, five eight, and twenty twenty
Speaker 3: three two five seven, one seven. These are all Ruckus devices. Yeah,
Speaker 3: I was gonna say, that's a great name for a
Speaker 3: route RUCKUS causes RUCKUS.
Speaker 2: It causes one with your bank account.
Speaker 3: Yeah right, Uh so all of these are our RUCKUS devices.
Speaker 3: This has been patched, but there are exploits on these
Speaker 3: devices that allow for attackers to take control of them
Speaker 3: and add them to this network. CEV twenty twenty five
Speaker 3: two four nine two is an asus AI Cloud critical
Speaker 3: off bypass and that's one that So these are the
Speaker 3: four cvees that are being used to add more nodes
Speaker 3: via a long leash.
Speaker 1: Here's a good question for you, and I don't expect
Speaker 1: you to have the answer right now, but is there
Speaker 1: a way that I can configure my configure my you know,
Speaker 1: Wi Fi home Wi Fi to absolutely refuse any connections
Speaker 1: from or Russia or any other country. Yeah that I'm
Speaker 1: so easy thing to do.
Speaker 3: So it depends, I'll give you it depends. It depends
Speaker 3: on your hardware. So like right now at my house,
Speaker 3: I'm running Ubiquity and it does. It's It's easy. It's
Speaker 3: literally I go in and I can say I want
Speaker 3: to restrict, and it shows me a map of the
Speaker 3: world and I can click the countries and say nope.
Speaker 1: Oh wow.
Speaker 3: So that makes it easy. I know, firewalla does the
Speaker 3: same thing, makes it really super easy. But then there
Speaker 3: are other ones like if you're running a TP link,
Speaker 3: throw it out. But if you're running something else, well
Speaker 3: it comes included with the with the leash, yeah exactly,
Speaker 3: you know, and.
Speaker 1: It also has a cardboard role in the middle of
Speaker 1: you got to take that out.
Speaker 3: Yeah, but then it's uh no, it's fine, but no,
Speaker 3: if you're running some other version of firewall, sometimes you
Speaker 3: can just block the country outright. Sometimes they have a
Speaker 3: block list. Sometimes you actually need to go in and
Speaker 3: like configure the ranges yourself that you don't want it
Speaker 3: to talk to you, which is more of a pain
Speaker 3: but can be done no matter what you're running.
Speaker 2: Okay, but the the whole the hull idea this leash
Speaker 2: thing is to circumvent that.
Speaker 3: So yeah, absolutely it.
Speaker 2: Is part of defense and death. You do want to
Speaker 2: do it, Yeah, don't count on it.
Speaker 3: Yeah, absolutely, and defense and death Like that's the first layer, right,
Speaker 3: don't talk to or communicate to the places where generally
Speaker 3: you're getting attacked. Right. The second layer obviously is then
Speaker 3: monitoring the type of traffic you have and you know,
Speaker 3: having isolation on your networks for example, on my home network.
Speaker 3: There is no way in hell I allow the kids
Speaker 3: on any of the networks that have sensitive data. So
Speaker 3: they're in essence on their own guess network where they
Speaker 3: can play games and stream and download whatever janky things
Speaker 3: they download install on their computers. But it's it's not
Speaker 3: gonna affect any of the rest of the network.
Speaker 1: All right. This next story actually kind of hits close
Speaker 1: to home because we actually thought about setting up a
Speaker 1: website to expose websites that had dumb password rules. Right now,
Speaker 1: if you've been listening to the show for the last
Speaker 1: year or so, the only rule that makes any sense
Speaker 1: for password is length.
Speaker 2: You know, I mean complexity adds an element.
Speaker 3: Well, length is more important.
Speaker 1: Length is more important. Size matter, Size matters, And.
Speaker 2: If you're gonna not have complexity, don't advertise that.
Speaker 1: R Yeah, So this dumb passwords rules, dumb password rules
Speaker 1: dot com has shown a spotlight on GameFly and so
Speaker 1: with link to this. Basically it has a change email
Speaker 1: address and password, and you put in your email in
Speaker 1: your password, which is only six to twelve characters with
Speaker 1: no other restrictions.
Speaker 3: Well, that's impossible to crack. My password is one, two, three, four, five, six,
Speaker 3: it could be.
Speaker 1: And probably is common password around. So I mean, Dwyane,
Speaker 1: how many milliseconds would it take ice.
Speaker 2: It wouldn't get out of the first chapter the dictionary. No, yeah,
Speaker 2: a dictionary attack, Yeah, it would be page one.
Speaker 3: Instant easily in the milliseconds, probably hundreds of milliseconds, but
Speaker 3: milliseconds for it to crack a majority of those passwords. Yeah, absolutely,
Speaker 3: with a decent size cluster.
Speaker 1: Really no story here. We just wanted to, uh, you know,
Speaker 1: highlight the dumbness. And I think dumb password rules dot
Speaker 1: com is going to be a staple.
Speaker 3: So let's talk.
Speaker 2: Let's take an opportunity for a second. Just talk about
Speaker 2: the reality of authentication. Right now. You've got past keys, right,
Speaker 2: which is a great yep, that's foreshadowing. Past keys are great.
Speaker 2: Multi factor authentication is good, especially if you use an
Speaker 2: authenticator w app that that makes it much better than
Speaker 2: you know, sim sim swap attackable uh text message or
Speaker 2: email messages on an email count that doesn't have multi
Speaker 2: factor authentication. And one of the things that I've looked
Speaker 2: at is compounding them because a lot of times if
Speaker 2: you have a pass key, it's like a device certificate, right,
Speaker 2: that's effectively what it is, why don't you still ask
Speaker 2: for the password? Sure to add an extra layer, and
Speaker 2: so in some case I'll implement that. But the other
Speaker 2: thing is the denial of service. If you lock people
Speaker 2: out after so many password attempts, the bad guy can
Speaker 2: just use that to harass your users, right, So you
Speaker 2: want to do something intelligent where it's like you escalate
Speaker 2: the time of the password attack. Or my favorite thing,
Speaker 2: which I've never seen anybody do other than us, is
Speaker 2: when you fail that test you've tried five times in
Speaker 2: the last two minutes, add another factor. Yeah, like what's
Speaker 2: what's you know your what's Dwayne's extension at the office?
Speaker 3: Trick question?
Speaker 2: It's another factor or SMS when it starts.
Speaker 1: Messages aren't great, but but.
Speaker 2: It's it's an extra lay. So so that way you
Speaker 2: don't lock the user out. You just raise the bar
Speaker 2: and you know what you've also done, You've also made
Speaker 2: it so that the user calls the help desk and says,
Speaker 2: why is it asking for this extra piece of information?
Speaker 2: If the hacker locked you out in the middle of
Speaker 2: the night and the timer ran out, then unless you're
Speaker 2: watching the logs, you're not going to have it now
Speaker 2: the user is part of the part of the system
Speaker 2: that alerts you. So we have to get We don't
Speaker 2: want to roll our own I'm not saying that, but
Speaker 2: we got to get more creative and compounding the authentication
Speaker 2: and figuring out who they really are. Okay, sorry, I'm off.
Speaker 2: Let me step down from the soapbox.
Speaker 3: That actually used to be a great way to denial
Speaker 3: a service an entire company, where they'd be like, oh,
Speaker 3: three invalid attempts and you be like, all right, I'm
Speaker 3: just gonna rape through all your users and log in
Speaker 3: continually in the Outlook web access shut off that protection
Speaker 3: because yeah, and then everybody's locked out constantly. By the
Speaker 3: time you unlock them and it synchronizes to all your dcs,
Speaker 3: I've locked them out again, so good luck.
Speaker 1: All right, before we take a break, let's talk about
Speaker 1: Microsoft Defender, because there was an elevation of privilege vulnerability
Speaker 1: in it that was reported and what was the tell me,
Speaker 1: tell me the sequence of actions. So this was reported,
Speaker 1: Microsoft came out with a fix fix didn't really work,
Speaker 1: and then they came out with another fix. Is that it?
Speaker 3: Yeah, absolutely yesterday As of July eighth, they've come out
Speaker 3: with another fix that should mitigate this. I mean, if
Speaker 3: you're if you're writing, if you're there with a notepad,
Speaker 3: it's going to be version one dot one dot two
Speaker 3: six zero six zero three zero zero eight. But what
Speaker 3: I'll tell you is, if you've been listening to this
Speaker 3: show for a while, you probably don't need to worry
Speaker 3: about it because it would have already updated. Yeah, to
Speaker 3: just know that, Yeah, there was a privilege escalation and
Speaker 3: had you'll remember us maybe reporting on this a couple
Speaker 3: of weeks ago, maybe even a month ago, where we
Speaker 3: had talked about privileged escalation using soft links, using l
Speaker 3: en k files. Yeah, it was actually dubbed the Rogue Planet.
Speaker 3: So yeah, and that so that now does have an
Speaker 3: official patch that's come through. So if you're not auto updating,
Speaker 3: shame on you go update. But if you are up
Speaker 3: you know, auto updating, you probably defenders probably already patched.
Speaker 1: Yeah, and or you will see a little Windows message,
Speaker 1: you know, the little orange thing that says, you know,
Speaker 1: updates need to you need to reboot in order to
Speaker 1: install updates. Yeah, but we should. You should definitely automatically update.
Speaker 1: The only reason I wouldn't is if I had a
Speaker 1: specialized computer that was that needed to be up at
Speaker 1: you know, a certain range of times. Sure, And I
Speaker 1: think the days of Windows automatically updating and rebooting your
Speaker 1: computer are gone.
Speaker 2: Like in the enterprise, it's certainly been gone for a
Speaker 2: long time.
Speaker 1: Yeah, they might have allowed it and just obfuscated the
Speaker 1: way to disable it or something, but I definitely remember
Speaker 1: that happening. It happened to me in the middle of
Speaker 1: the gig.
Speaker 2: I think we need to get to the ability to
Speaker 2: support like a chaos Monkey mentality. If you remember chaos Monkey,
Speaker 2: it was where I think it was Netflix had so Yeah,
Speaker 2: so that you you you allow you you you expect
Speaker 2: every type of failure there can be all the time,
Speaker 2: and you're you're completely redundant. And if we do that,
Speaker 2: then we can allow things to patch immediately because the
Speaker 2: patch is an expected potential down out down time. If
Speaker 2: we don't get there, then we're just going to always
Speaker 2: be late to the party and the hackers are gonna
Speaker 2: we have to reinvent our patching strategy. And you're right, Carl,
Speaker 2: Most most enterprises, most even medium companies, don't allow auto patch,
Speaker 2: and it's going to get them owned.
Speaker 1: Dump dump dumb, and that seems like a good place
Speaker 1: to take a break. So we'll be right back after
Speaker 1: these very important messages don't go away, and we're back.
Speaker 1: It's security this week. I'm Carl, that's Patrick and Twain.
Speaker 1: Got a up more stories here for you from last week.
Speaker 1: AI coding agents found triggering endpoint security rules to build
Speaker 1: a built to catch attackers. Just that you know, it's
Speaker 1: like a whole story in one sentence, tell us the story.
Speaker 3: It's okay. So Endpoint Detection and Response are EDRs. They're
Speaker 3: looking for attackers doing crazy things, right, injecting things in
Speaker 3: processes that shouldn't be there. You know, there's a cert
Speaker 3: util dot ex, which is an execut one in your
Speaker 3: computer that can download information like certificate information. But US attackers,
Speaker 3: we use it to download payloads, right because it's on
Speaker 3: every Windows computer and living off the land means I'm
Speaker 3: going to use tools around the computer instead of bringing
Speaker 3: my own because when I bring my own you might
Speaker 3: notice it. So now all of your EDRs are going, aha,
Speaker 3: if anybody uses cert util, that's weird. Right now, fast forward,
Speaker 3: you have all of these these llms like that are
Speaker 3: using coding, you know, code coding l lms like a
Speaker 3: cloud code cursor, open as codex, etctera, that sort of
Speaker 3: thing that those tools have been trained on, vast amounts
Speaker 3: of programming information and data off the Internet and you
Speaker 3: name it. So when they say, oh, we got to
Speaker 3: go download and run this Python package, right, and they
Speaker 3: they get denied going to you know, python dot org.
Speaker 3: So they go, Okay, not a problem, I won't I
Speaker 3: won't go try and pull it directly. Let me try
Speaker 3: and download it with a PowerShell script. No that failed.
Speaker 3: Let me use cert util, No that failed. Let me
Speaker 3: use bits admin. Yep, Okay, that downloaded it. So we
Speaker 3: goes to this path of let me do all of
Speaker 3: the same things attackers do on the internet to yet
Speaker 3: this package downloaded. And now that I have it, it
Speaker 3: starts running things, etc. And when it runs into a problem,
Speaker 3: what does y l on do? Statistically it finds the
Speaker 3: next solution, which is what an attacker might do. So
Speaker 3: the way that these you know IDEs for lack of
Speaker 3: a better term, are integrating into the operating system, they
Speaker 3: all look like attackers, right. It all looks like somebody
Speaker 3: trying to break any your station and do things that
Speaker 3: developers wouldn't normally do. That's the problem right now. So
Speaker 3: SOFOS went through and did some analytics and was like,
Speaker 3: you know what, a lot of our alarms went off
Speaker 3: on legitimate development workstations using legitimate tools like claud code
Speaker 3: and Cursor. Because claud code and Cursor don't know how
Speaker 3: to say no. They just invent a solution, which may be,
Speaker 3: you know, writing a PowerShell script and running it to
Speaker 3: download something, or using a utility that nobody else would use.
Speaker 3: There's this interesting site, is a the lulls Bins. We
Speaker 3: can put it in this uh, we can put a
Speaker 3: link with this show notes l O L B I
Speaker 3: N Z if I'm correctly, and I'll get you the link.
Speaker 3: But it's Living off the Land Binaries. And what it
Speaker 3: is is it's a site where you can live as
Speaker 3: an attacker. That's great attacker advice.
Speaker 1: Should we play the theme song?
Speaker 3: Probably? All right?
Speaker 1: Hit it.
Speaker 3: It's so the great thing about this site. And we'll
Speaker 3: put a couple different links in there. There's the Living
Speaker 3: off the lands Bins or binaries. There's also a g
Speaker 3: T f O Bins out there. You can imagine what
Speaker 3: that one stands for. So what you do as an
Speaker 3: attacker as you go? What do I have access to.
Speaker 3: If I have access to let's say I have access
Speaker 3: to seven zip, right, which is just a compression utility,
Speaker 3: how would I use that compression utility to gain administrative
Speaker 3: access to this system? Or let's say I only have
Speaker 3: access to PowerShell. How would I use PowerShell to download
Speaker 3: my attacker package, like my reverse sheld or something along
Speaker 3: those lines. Let's say I'm on a Linux workstation and
Speaker 3: I can run Nana, which is just a text editor.
Speaker 3: I can run a text editor as an admin, but
Speaker 3: I can't do anything but at a text Is there
Speaker 3: a way to get the text editor to give me
Speaker 3: a shell as an admin as route right? So these
Speaker 3: these sites, this living off the lands bins n GTFO
Speaker 3: bins there. Think of it, for lack of a better term,
Speaker 3: as like a dictionary, a lookup where you can type
Speaker 3: in the name of an executable that's on that computer
Speaker 3: that would normally be there, and it will give you
Speaker 3: like ten different ways to abusively use the wow to
Speaker 3: either get access to the system and a system and
Speaker 3: in a strative way, or download packages and that sort
Speaker 3: of stuff.
Speaker 1: All right, So this is great if you're a hacker,
Speaker 1: but what if you're trying to prevent this stuff. Can
Speaker 1: you use this for preventative measures?
Speaker 3: I've never done that. I don't know what you're talking about.
Speaker 3: So it's it's let me, let me choose this preventative
Speaker 3: measures your business to prevent people from a figure out.
Speaker 2: What you could do is you could look at this,
Speaker 2: which no one does, and you could figure out what
Speaker 2: things you can remove from your environment to minimize the
Speaker 2: attack surface. In other words, you can use this as
Speaker 2: a window into well, I don't use nano on this box.
Speaker 2: Why do I keep it around? Why do I let
Speaker 2: it run? Why do I let it run? In that context?
Speaker 1: Yeah, just thinking about it for a minute, when you
Speaker 1: should get rid of it. I would have come to
Speaker 1: that conclusion eventually.
Speaker 2: Eventually, and then you wouldn't have done it.
Speaker 1: By the thought process, would you have done it?
Speaker 2: Is the question. The problem is that securities attack. Everyone
Speaker 2: looks at security as an overhead that we don't want
Speaker 2: to pay for because it's not assured to pay off, right,
Speaker 2: But in the aggregate it pays off. It's just it's
Speaker 2: it's it's a fundamental psychology. And unfortunately, I don't know
Speaker 2: that we're going to fix people, but they're they're going
Speaker 2: to learn the hard way. There's a lot of hot
Speaker 2: stoves out there, uh that they're going to be touching
Speaker 2: a lot.
Speaker 3: Okay, I'm going to give you an example.
Speaker 1: Okay, are you going to get us in trouble?
Speaker 3: Pick an execute a ball now, pick an executaball like
Speaker 3: FTP for example. Okay, Uh, there is a a exclamation
Speaker 3: point s command you can feed to FTP dot exe
Speaker 3: and then feed it the name of a file and
Speaker 3: it will actually run everything in that file. Why is
Speaker 3: it there? Who the hell knows? But fine string is
Speaker 3: in here where you can actually manipulate credentials and get
Speaker 3: fine string to download things over the internet. All sorts
Speaker 3: of crazy right, rep fantastic yep, absolutely So there's all
Speaker 3: sorts of neat ways for you to use these applications
Speaker 3: sert utils in here. Do you want to go through
Speaker 3: and take a look at what they were doing what
Speaker 3: we were talking about on this article. So lots of
Speaker 3: neat ways to manipulate normal executables that will be on
Speaker 3: every computer to do your bidding.
Speaker 1: Okay, if you're not scared by now, you will be.
Speaker 2: Uh you haven't been paying attention?
Speaker 1: Yeah, yeah, all right, let's move on hackers, exploit Microsoft
Speaker 1: Entra pass key enrollment to hijack accounts. Entra is the
Speaker 1: new name for what used to be called Azure D.
Speaker 3: Was it AZERI D.
Speaker 1: It's been so long, Azure D. That's right, active directory?
Speaker 3: Yeah, you know what I like d AZUAD me too.
Speaker 3: We weren't from active directory to Azure active directory and
Speaker 3: that seemed logical. And then they're like Entrara and tr
Speaker 3: id and you're like, you know, maybe they're making up
Speaker 3: for decades of horrible product names. Were like Bob. Do
Speaker 3: you remember my Bob was.
Speaker 1: Actually concise in three letters? And that's good. You knew
Speaker 1: what it is. You didn't like it, but you knew
Speaker 1: what it was. But you know Microsoft Presentation Foundation Foundation, Yes, yes,
Speaker 1: Windows Communication Foundations.
Speaker 3: Silver Light, well, if anybody on the podcast can tell
Speaker 3: me what silver light does.
Speaker 1: Actually, that was named after employee David silver Light. No,
Speaker 1: it was not absolutely.
Speaker 3: Oh my god, that's awesome actually according.
Speaker 1: To him anyway, Sorry David. He's a good guy though,
Speaker 1: he really is.
Speaker 3: But the name does not tell you what it does.
Speaker 1: Now he has to walk around with his head down.
Speaker 2: Basically, silver Light was the Flash. He's the flash equivalent for.
Speaker 3: Microsoft and now I will ask how many people know
Speaker 3: what flash is because that doesn't exist either equivalent exactly.
Speaker 3: Thank you Patrick.
Speaker 1: All right, so what happened in this exploit? All right?
Speaker 3: So this this sounds super technical with people you know,
Speaker 3: enrolling hacker, MFA past key, blah blah. It's a social
Speaker 3: engineering attack, that's all it is. So in this case,
Speaker 3: attackers would call up and say, oh my gosh, you
Speaker 3: have to change your access to our Microsoft systems. You know,
Speaker 3: here is a pass key, click here, click here, swap
Speaker 3: your pass key out? Can you do that for us?
Speaker 3: And they'll say, yeah, sure, it's done. They go okay, thanks.
Speaker 3: It's literally like calling someone up and saying, hey, your
Speaker 3: password sucks. I have a better one for you. Can
Speaker 3: you just use this one instead? And they go yeah, sure, thanks,
Speaker 3: I really appreciate it. Random dude on the internet. Like
Speaker 3: the moral of the story here is just don't don't
Speaker 3: I guess.
Speaker 2: Don't take candy from strangers.
Speaker 3: Yeah, and be able to better be able to identify strangers, right,
Speaker 3: Like if somebody calls up and say they work in
Speaker 3: the security department of your organization, have a way of
Speaker 3: checking that.
Speaker 2: So I got to tell a story. I'll tell the
Speaker 2: story about the rubber company, Dwayne. Oh, So, we have
Speaker 2: a you know, consulting arm and occasionally, you know, people
Speaker 2: will find my email instead of the people they should
Speaker 2: find email. And I usually ignore those messages because it's
Speaker 2: just such a high standard of spam and junk. And
Speaker 2: so I got this well written at email from someone
Speaker 2: who claimed to be the CEO of a small manufacturing
Speaker 2: company and the name checked out, and I went on
Speaker 2: LinkedIn and the person checked out. I said, you know, what,
Speaker 2: what the hell? I'll answer them that you know, we're
Speaker 2: we might we're interested to hear about their project. And
Speaker 2: I sent them an email and they sent me an
Speaker 2: email back and said, oh, you know calendar You know
Speaker 2: the Calendi link calendarly, Yeah, Calendly. And I looked at
Speaker 2: it and I'm like.
Speaker 1: Well, for those who don't know, that's it's a way
Speaker 1: that you can let people who want to talk to
Speaker 1: you pick a time that's available for you.
Speaker 2: Yeah, And I hate it because it makes me click
Speaker 2: on something.
Speaker 1: So I look, well, you hate using it or do
Speaker 1: you hate using it to get people with Oh?
Speaker 2: No, I pretty much don't click on it. If you
Speaker 2: if you give me something to click on I'm not
Speaker 2: clicking on it.
Speaker 1: Oh yeah, yeah. So somebody wants you to use it
Speaker 1: to set an appointment with them, you won't.
Speaker 2: Yeah, So my spidy sense went off and I'm like,
Speaker 2: you know what, I'm not going to email them back.
Speaker 2: I'm gonna open it up on a place that I
Speaker 2: know is safe, that even if it's bad. Right, And
Speaker 2: I opened it up and looked at it, and it
Speaker 2: was the wrong domain. It wasn't the domain of the
Speaker 2: actual company. Because I actually found the domain. It was
Speaker 2: a dot net instead of a dot com. Oh and
Speaker 2: it wanted me to log in with my office three
Speaker 2: sixty five and I'm like, not today, Satan, Nope, So
Speaker 2: it can happen anyway.
Speaker 3: I came.
Speaker 2: I guess I didn't come too close, but I could
Speaker 2: have come close if I wasn't as as paranoid as
Speaker 2: I am. And so I really think people need to
Speaker 2: be more paranoid.
Speaker 3: Yeah all yeah, and laugh.
Speaker 1: I laugh and have a sense of humor. That's right.
Speaker 1: They offset each other.
Speaker 2: But you should also think about what you're asking other
Speaker 2: people to do. If I know you, like if Carl,
Speaker 2: if you sent me a link, I wouldn't do a Dwayne.
Speaker 2: But if if you sent me a link, I would
Speaker 2: probably click on it and I would verify, but I
Speaker 2: would verify it's you. I would probably call you up
Speaker 2: and say, did you actually send me this link? And
Speaker 2: I had a customer, a longtime customer of ours, send
Speaker 2: me a link and I'm like, I'm not clicking on
Speaker 2: this link. So I me messaged him outside. I said,
Speaker 2: did you send me that link? Because it was they
Speaker 2: had no context, and he like, oh no, my email
Speaker 2: was hacked.
Speaker 3: It's funny you say that this morning. I have a
Speaker 3: contacted Department of Homeland Security.
Speaker 2: Anyway, you fished him.
Speaker 3: No, he sent me a link, and I was like, eh,
Speaker 3: I don't think the thing.
Speaker 1: Even if you know the people, that doesn't mean that
Speaker 1: the link isn't.
Speaker 3: Oh no, and a town because increases the chance what happens.
Speaker 1: They might have seen a story on Facebook which could
Speaker 1: totally be an attack, and surely don't know. They just
Speaker 1: read the headline they forwarded to you without reading it.
Speaker 2: Well, in this case, the customer was actually his email
Speaker 2: was compromised, and I caught it and told him, and
Speaker 2: he had already known, but it could have been the
Speaker 2: first time he found out, and you know, he could
Speaker 2: have infect caused because he let his email get hacked, right,
Speaker 2: it could have caused many of his customers to get hacked,
Speaker 2: and that's not a good way to help business.
Speaker 1: No boy know.
Speaker 3: And for the record, on this story, this is the
Speaker 3: Pink extortion crew. If you're following names, if on your
Speaker 3: BINGO sheet, you can't find O dash UNC DASH zero
Speaker 3: sixty six, which is what the security researcher is attributing
Speaker 3: this to. That's because the attacker is actually a cl
Speaker 3: cr I one one four seven. So just in case
Speaker 3: you were really kind of digging into his we were
Speaker 3: doing background checks obviously on the stories the attacker mentioned
Speaker 3: in this article. Their designated number we can't find anywhere,
Speaker 3: but there are many other places like the registering Unit
Speaker 3: forty two and hack read that have the number.
Speaker 1: Right, So, you know, I love Pink. I didn't know
Speaker 1: she was in a hacking too.
Speaker 3: Hacker. He's in everything. Anybody was a hacker, it would
Speaker 3: be Pink. Honestly.
Speaker 1: You know, you're probably right. She's badass, isn't she.
Speaker 3: Yeah?
Speaker 1: Oh yeah, yeah, all right. Now for the feature story
Speaker 1: of this week's show, AI powered Attack compromises AWS cloud
Speaker 1: In seventy two hours.
Speaker 3: We can't report on this as an internal project.
Speaker 1: And it wasn't seventy two, it was forty six. Yeah, sometimes.
Speaker 3: So this is yeah, this is a fun story.
Speaker 2: So said no one on the receiving end.
Speaker 3: I know, right. So we talk about attacks happening at
Speaker 3: AI speed, right, and at computer speed, And we've talked
Speaker 3: about this in the past where we're like, listen, a
Speaker 3: majority of the times, most of the time, it's not
Speaker 3: an AI hacking you. It might be AI facilitated, it
Speaker 3: might be AI assisted, it might be that there's a
Speaker 3: pipeline on the back end that an AI has access to,
Speaker 3: but there's still operators who are using these pipelines. What
Speaker 3: we're starting to see here is more of that pipeline
Speaker 3: get automated. So in this particular case, one of the
Speaker 3: this is I mean, this is a classic break into
Speaker 3: an application, steal aws keys and then start you know,
Speaker 3: wreaking havoc. But the one of the things a couple
Speaker 3: different actually things in here that pointed to this being
Speaker 3: an AI attacker is a there were a series of
Speaker 3: four access keys created in sub millisecond time and used
Speaker 3: not something I mean, our team's good, but by hand,
Speaker 3: we're not doing.
Speaker 1: That yeah, nobody's doing that by hand.
Speaker 3: Absolutely, So that was one indicator. The other indicator is
Speaker 3: there was a lot of I'm going to call it detritus,
Speaker 3: but there was a lot of ancillary files and things
Speaker 3: put on the attacked systems to make it look like
Speaker 3: a pen test. So they were trying to manipulate the
Speaker 3: indicators a compromise, and they were trying to slow down forensics.
Speaker 3: But the speed at which and the detail with which
Speaker 3: those indicators were placed would also yet again not human
Speaker 3: and that interestingly enough to bypass guardrails on an AI
Speaker 3: to get it to do an attack. You can't say, hey,
Speaker 3: I want to bring down bag of America because it'll
Speaker 3: go No. I can't do that, especially the frontier models.
Speaker 3: So anything that's not running locally local ones, you can
Speaker 3: strip all those guardrails off. But any anything sitting exactly
Speaker 3: you run it local, it's fine. Well, the other thing
Speaker 3: is if you convince a frontier model that you are
Speaker 3: a pen testing company, the frontier model is more likely
Speaker 3: to help you attack a place. So in this particular case,
Speaker 3: the theory is that they were actually had convinced a
Speaker 3: frontier model, you know, an anthropic or whatever, that this
Speaker 3: is a penta. This was a paid legitimate pen test.
Speaker 3: I'm end to go do that.
Speaker 2: And we've experienced that where the more we deal with it.
Speaker 1: I mean, Dwayne, you've done that.
Speaker 3: I can't confirm or deny.
Speaker 2: Yeah, but over time, an AI will kind of get
Speaker 2: to feel like it at least it seems like it
Speaker 2: feels like it gets to know you and what your
Speaker 2: intent is, and so things it would say in the
Speaker 2: first week, No, it would say, well, you shouldn't do that,
Speaker 2: but let's talk about it.
Speaker 1: I can't say this never mind, yeah, never mind.
Speaker 2: Wow, he developed a filter.
Speaker 3: No, there are certain things I won't say, but let
Speaker 3: me let me put it this way.
Speaker 2: I haven't seen that very often.
Speaker 1: Now he's just gonna say it a different way.
Speaker 4: But so, Panton, let's say, are you sure you want
Speaker 4: to say what we have time for? Let's say your
Speaker 4: let's say your AI did kind of develop a conscience.
Speaker 4: What's really great is for when it goes, well, absolutely
Speaker 4: don't run this command. That would compromise everything, and.
Speaker 3: I go to it and go. But if I ran
Speaker 3: in and I saw this output, what would that mean
Speaker 3: and it goes, oh, man, that would mean you have
Speaker 3: access to the whole system. Geez, you shouldn't look in
Speaker 3: that secret directory. That's probably where all the good stuff.
Speaker 5: So just asking it what shouldn't I do is a
Speaker 5: good I'm just saying if eventually your frontier models, hopefully
Speaker 5: anthropics not listening, eventually your frontier models will kind of
Speaker 5: be like wait a second, and you can be like, well, yeah, no,
Speaker 5: I absolutely didn't run that, and it absolutely didn't give
Speaker 5: me this output, But what do you think?
Speaker 2: But if it did, then it would have been did.
Speaker 3: Just what would you do next? And it's like, well,
Speaker 3: I wouldn't run this, and I'm like I won't run
Speaker 3: it either then.
Speaker 1: So so there you go. The broader implication of this,
Speaker 1: according to the article, is because you know A has
Speaker 1: been documented significantly compress the timeliness of cloud based attacks,
Speaker 1: that AI removes traditional friction from attacks like there's it's
Speaker 1: only going to get worse.
Speaker 3: Yeah, absolutely, and from the defense side, because we always
Speaker 3: like the call to action like what can okay, what
Speaker 3: can the customer do? This is great? We have an
Speaker 3: AI attacking people. Vulnerability assessments are always good, right, Detecting
Speaker 3: the fact that those keys could have been pulled would
Speaker 3: have stopped this attack. You know that would have been
Speaker 3: part of the killed chain. You know, tight I am,
Speaker 3: and least privileges in how you're managing your key and
Speaker 3: what those keys have access to, continuous rotation and monitoring
Speaker 3: of the use of those keys, watch for impossible concurrency,
Speaker 3: you know, multiple keys created, multiple ips. You know, under
Speaker 3: one IP in a sub millisecond is a dead giveaway. Yeah,
Speaker 3: and these so these would be the ones I would
Speaker 3: be looking for, especially if I'm I'm looking to thwart
Speaker 3: something that's at AI spin.
Speaker 1: And once again I have to ask that there's a
Speaker 1: crying I'm crying out there's a need for tools that
Speaker 1: use AI to thwart attacks in real time. And you know, Patrick,
Speaker 1: every time I bring this up to you, that's what
Speaker 1: glass Wing's all about. Yeah, last time I brought this
Speaker 1: up to you said, yeah, well, we're not there yet,
Speaker 1: and we probably won't be, and the hackers are always
Speaker 1: going to be ahead of us. But I just can't
Speaker 1: believe that there's got to be something.
Speaker 3: So there there are a lot of grants out there
Speaker 3: right now for a team to discover the right way
Speaker 3: to start monitoring networks and protocols and that sort of stuff.
Speaker 3: The problem is to do this right. You would need
Speaker 3: an AI that could take in every feed of everything
Speaker 3: that happens on your network and then understand what's normal.
Speaker 1: And also give it permission to take action because the
Speaker 1: discovered they have to be shut down.
Speaker 3: Right, and protocol analysis is tough, especially if it's something
Speaker 3: you don't have the code to. It's actually one of
Speaker 3: the most expensive things we can do is analyzing a
Speaker 3: protocol we don't have. We don't have access to the code,
Speaker 3: and we do it sometimes when we're like, hey, there's
Speaker 3: this weird signal coming off this box. We have a
Speaker 3: pipeline that we will run things through and it usually
Speaker 3: takes days for it to go Okay, I've mapped out
Speaker 3: this entire protocol. This is what this looks like. So
Speaker 3: I think you'd have to find better ways to tap
Speaker 3: the networks and see all traffic without hindering traffic out.
Speaker 3: I think you'd need to find an we'd.
Speaker 2: Need to have like a GB ten with a dedicated model.
Speaker 3: You'd need more than that.
Speaker 2: Well, if you had like like on the on.
Speaker 3: The next Yeah, you would need I mean I could
Speaker 3: see running a GB ten on every switch.
Speaker 1: What's a GB ten?
Speaker 3: So Grace Blackwell chip something that's designed to run ll
Speaker 3: ms locally very fast.
Speaker 2: Dell sells them for like four to five grand a
Speaker 2: little box.
Speaker 3: Yeah, so could could you start seeing l l ms
Speaker 3: baked in the switches and firewalls and then coordinating Maybe
Speaker 3: that might be the way to do it actually is
Speaker 3: to distribute it and then have them all learn from
Speaker 3: each other.
Speaker 1: Could they be gamed however? I mean that.
Speaker 3: It'll be. It'll be.
Speaker 2: It'll be a an arms race for sure. If you
Speaker 2: look at Tallus, they they baked an eight billion parameter
Speaker 2: l l M LAMA models as a demonstration and that's
Speaker 2: their Chat Jimmy demonstration. So we could see something like
Speaker 2: that being in that same kind of box. So you
Speaker 2: get like a much faster processing as well. But again,
Speaker 2: it's going to be a dedicated it's going to be
Speaker 2: an extra expense. It's going to be a dedicated solution.
Speaker 2: That's where we have to go, right. Pent tests are
Speaker 2: an extra expense and extra solution, but that's where.
Speaker 1: We have to be. Yep, Well, that sounds like the
Speaker 1: end of our show. Thank you very much, guys, and
Speaker 1: thanks for listening. It's all we had to report on
Speaker 1: last week, and we'll see you next week on Security
Speaker 1: this week, Bye bye, thanks guys,