Speaker 1: Hey, Carl here, we're on a mission to find new
Speaker 1: fans of the show. I mean, where else can you
Speaker 1: get real life comedy and horror in one podcast. You
Speaker 1: can do your part by leaving us a review on iTunes,
Speaker 1: Spotify or wherever you get Security this Week. Also, you
Speaker 1: can get an ad free feed by becoming a five
Speaker 1: dollars a month patron. Go to Patreon dot Security this
Speaker 1: week dot com and sign up, and don't forget discord.
Speaker 1: Discord dot Security this week dot com. Lots of good
Speaker 1: stuff happening there. Yeah, I think that's it. So on
Speaker 1: with the podcast. So I'm at the gym a couple
Speaker 1: of days ago and there's this lady on the exercise
Speaker 1: bike and she's wearing a helmet on the exercise bike.
Speaker 1: So I put on a lifejacket and got on the
Speaker 1: rowing machine next to her. Hey, it's been a couple
Speaker 1: of weeks since we talked to you. Welcome back to
Speaker 1: Security this week. I'm Carl Franklin's the Flat and Patrick Hines.
Speaker 1: So we're going to try to catch up by doing
Speaker 1: last week's stories and last last week's stories.
Speaker 2: Three hour show.
Speaker 1: Yeah, starting with last last week's stories, but in conclusion,
Speaker 1: you might conclude at the end of these stories that
Speaker 1: we are kind of becoming obsolete because they're coming so
Speaker 1: fast that you won't have time to patch.
Speaker 2: Right, just beyond twenty four to seven security this moment,
Speaker 2: just to lead your own system security right now.
Speaker 1: All right, let's start with this Indian Express story, no warning,
Speaker 1: no confirmation, how an AI agent deleted a startups critical data.
Speaker 2: I know, I know, it's stupidity.
Speaker 1: Pad CAAC problems exists between keyboard and chair. Yeah, this
Speaker 1: is total stupidity. This is basically giving agency to agents
Speaker 1: and giving them access to things that they shouldn't have
Speaker 1: access to, something we've been warning people against.
Speaker 2: If we've been developing between us probably seventy years. Okay, yeah,
Speaker 2: I think you're probably right. Yeah, And I don't edit
Speaker 2: in production, do you?
Speaker 1: I know?
Speaker 2: Now, why would you give AI access to productions? There
Speaker 2: was a story back. I think it was a couple
Speaker 2: of months ago. Actually it was about a month ago
Speaker 2: that Amazon was down one of their systems. It wasn't
Speaker 2: a primary system, it was an important system, and it's
Speaker 2: because somebody pointed an AI agent at it and had
Speaker 2: it do an update, and it decided I'm going to
Speaker 2: delete it. First and start fresh. It was down for
Speaker 2: twelve hours.
Speaker 3: That makes sense.
Speaker 1: Oh my god.
Speaker 2: So this is a this is a bone headed mistake.
Speaker 2: That is, it could only be done by somebody who
Speaker 2: really doesn't get development. I don't know.
Speaker 3: Sometimes you just can't trust AI. So my wife and
Speaker 3: I retimes, Yeah, I know, my wife and I, you
Speaker 3: can't trust AI.
Speaker 2: That's the moral of the story.
Speaker 3: We're looking, we're looking to make to get our deck
Speaker 3: in our deck. Our porch is falling apart. So my
Speaker 3: wife took a picture of the porch and put it
Speaker 3: up in AI. And there's six columns on the porch,
Speaker 3: six pillars holding the every foot. She wanted to take
Speaker 3: the third one out. So I put the picture up
Speaker 3: there and I said, hey, can you label these from
Speaker 3: left to right one through six. I'd like to take
Speaker 3: the third one out, just so it knows which one
Speaker 3: the third one was, right. So it labeled them one
Speaker 3: through six and took the third one out. Just the
Speaker 3: third one had no label. All the restroom were labeled
Speaker 3: except for that third one. It took the label out
Speaker 3: and I was like, I don't even know what to
Speaker 3: do with you.
Speaker 1: I'm just get two.
Speaker 2: Ballons of milk.
Speaker 1: And if they have eggs, get a dozen.
Speaker 2: It did it go?
Speaker 3: But it was so close My wife and I just
Speaker 3: looked at it and went like what never mind. Yeah,
Speaker 3: so it's all good.
Speaker 1: Yeah, so right now, AI must be curated by people
Speaker 1: who are smart enough to know when it's incorrect.
Speaker 2: Yep. You shouldn't let AI access to things that you
Speaker 2: wouldn't let a a average high school student touch. Or
Speaker 2: a chime production is something touch.
Speaker 1: A child with a high IQ.
Speaker 3: Yeah, there you go.
Speaker 2: Yeah, I work at a high school.
Speaker 3: It's like that. Most most of them are pretty high IQs.
Speaker 1: Yeah.
Speaker 2: Even they don't edit production.
Speaker 3: Yeah, they don't get access to Bank of America's production.
Speaker 1: Yeah. Yeah. So this is pocket Os right is the
Speaker 1: company Texas based car rental business, and the incident reportedly
Speaker 1: took place over the weekend. When it's autonomous AI tool
Speaker 1: erase the database and all backups in nine seconds.
Speaker 2: Well, at least it gets points for efficiency.
Speaker 3: I mean, here's what I will tell you though. At
Speaker 3: some point, somebody's gonna have a bad quarter, somebody's gonna
Speaker 3: get random word, somebody's gonna have something bad that happens,
Speaker 3: and they're just gonna go, oh, you know what, AI
Speaker 3: did it. We lost all our stuff because of AI.
Speaker 2: Right, I think that makes them look better.
Speaker 3: I don't know at this point. Maybe it does where
Speaker 3: they're like, oh that darn AI as opposed to yeah,
Speaker 3: we didn't put the proper security things in place to
Speaker 3: not get ransomword.
Speaker 1: Right, So bonus points if you can name the coding
Speaker 1: agent that oh oh oh. And now Dwayne's reading the
Speaker 1: article more carefully.
Speaker 2: I'm I'm frantically reading through the article.
Speaker 1: It was cursor, It was cursor.
Speaker 2: Was it cursor?
Speaker 1: It was running. It was running on Claude Opus four
Speaker 1: point six, which is widely known as.
Speaker 3: Oh see, that's the problem. Opus four to seven's out.
Speaker 3: I mean, what are you guys doing?
Speaker 1: I said last week it was the most advanced and
Speaker 1: capable model for coding. Apparently, according to.
Speaker 3: This article, I mean, it leads in deletions. Here's the deal, though,
Speaker 3: I honestly I don't use Opus for coding. Opus as
Speaker 3: great as a deep thinker and a planner. Yeah, I
Speaker 3: usually use Codex yeah for coding, So sonic listen, I'd
Speaker 3: say pocket os coding's in the name.
Speaker 2: Yeah, you gotta Claude's on.
Speaker 1: It is good.
Speaker 3: You got to use the proper model for the proper.
Speaker 1: Thing, Claude so on, it's really good for what I.
Speaker 3: Do, Claud's on, it's awesome.
Speaker 2: Yeah.
Speaker 3: And even if you were to do like an opus
Speaker 3: planning layer where it does some really deep dive planning
Speaker 3: but doesn't write any code, but then you use a
Speaker 3: sonnet to do all the code writing and then maybe
Speaker 3: a codex as your tester and testing layer, that's probably
Speaker 3: will be way more stable than just open.
Speaker 2: You'd still never let it touch production directly.
Speaker 3: Oh heck no, yeah, absolutely no, it's.
Speaker 2: The fundamental takeaway here. I agree with you, but that's
Speaker 2: the fundamental takeaway.
Speaker 1: All right. I love the I love the stories where
Speaker 1: we get to wag our finger at people that are.
Speaker 3: Again, isn't that redundant?
Speaker 2: Isn't that just a little isn't that just the stories?
Speaker 3: Yeah?
Speaker 1: All right, Duane, why don't you take this one about Kelp,
Speaker 1: the Kelp.
Speaker 2: My favorite Beatles albums Kelp, and.
Speaker 3: It's fantastic ride and whatever. No, this is a DeFi hack,
Speaker 3: so you'll see the start with the headline for those
Speaker 3: of you. All right, all right, let's start with the
Speaker 3: headline Hackers target DeFi Protocol KELP DAO and a massive
Speaker 3: three hundred million dollar xploit.
Speaker 2: Yeah.
Speaker 3: So here's typically for those of you who haven't gone
Speaker 3: into blockchain contracts and how it all works. If you
Speaker 3: make well, obviously, the the chain is indelible, right, it's immutable,
Speaker 3: it can't be changed. So if I make a transaction,
Speaker 3: it's read only right when it gets to the chain.
Speaker 3: But when it gets approved, it has to be approved
Speaker 3: typically by multiple notes, a majority of the notes, right,
Speaker 3: and and each contract is different as to what that
Speaker 3: looks like, but call it a majority, right, So one
Speaker 3: percent plus one? Yeah, on this security this week, two
Speaker 3: of us out of three.
Speaker 1: Does that mean everybody who uses the blockchain has the
Speaker 1: vote on all these transactions?
Speaker 3: So? No, it, Like I said, that's where it depends.
Speaker 3: Sometimes there's trusted nodes, because what you don't want is, hey,
Speaker 3: let's put a million different random you know, vms up there,
Speaker 3: and they get they get a vote, and now I
Speaker 3: can tell them how to vote.
Speaker 2: Supposedly the government tried to do that early on in blockchain.
Speaker 3: Yeah, I know, well they I supposedly they tried to
Speaker 3: do it with onion routing as well, And I don't
Speaker 3: think any of that's actually real.
Speaker 1: But only onion routing that happens in this house is
Speaker 1: in my kitchen when I'm cooking, especially French onion soup.
Speaker 3: Mm. So it's a majority.
Speaker 1: What is onion routing?
Speaker 3: Tore network so yeah, tour network so oh okay, yeah.
Speaker 3: So anyways, so it's a majority, or it's trusted nodes
Speaker 3: that vote, et cetera, et cetera, et cetera. And that's
Speaker 3: why a lot of it is considered quite you know,
Speaker 3: quite reasonable, quite trustworthy, right, where a majority of us
Speaker 3: have to say, yes, this is an actual like I'm
Speaker 3: Scarity this week, right, the story of us. Two of
Speaker 3: us have to say, you know what, this is a
Speaker 3: great story for us to put it on the show.
Speaker 3: You guys can decide whether all of us are wrong
Speaker 3: or not, but needless to say often, yeah, often often
Speaker 3: that we're wrong, but needs say in this particular case,
Speaker 3: that was all working fine. And in this particular, in
Speaker 3: this particular issue, there was a restake of eth where
Speaker 3: you could not only have it on this particular chain,
Speaker 3: but it could go cross chain. So I could say, oh,
Speaker 3: we're restaking it on chain A, but let's move it
Speaker 3: over to change.
Speaker 2: So those who aren't Crypto Bros. So Ether. Ethereum is
Speaker 2: a very prominent coin and one of the things you
Speaker 2: can do is stake it. So that means if you
Speaker 2: have one hundred coins, congratulations, there's a lot of money.
Speaker 2: You can take those coins and stake them and earn
Speaker 2: a percentage back. And it is a way to to
Speaker 2: have people put skin in the game and earn earn credits,
Speaker 2: earn crypto without having to have their machine pollute and.
Speaker 1: Like selling shares or something.
Speaker 2: It's almost like getting interest on your investment. Yep, it's
Speaker 2: more like that, I have a thousand eths, so I'll
Speaker 2: get a couple of eighth a month, so interest if
Speaker 2: I stake it.
Speaker 1: Is there any risk in staking your.
Speaker 2: Eth Yes, because when you stake it, you can't unstake it.
Speaker 2: You can't sell it after unstaking it for like seven
Speaker 2: days or something like that. So there's a cooling off period.
Speaker 2: So when you stake it, it's not liquid. You can't
Speaker 2: just unstake it and sell it.
Speaker 1: I see.
Speaker 3: So if Ethereum tanks in the next two days.
Speaker 2: You're stuck.
Speaker 1: You're stuck. Yeah.
Speaker 2: I don't know what the period was, and I'm sure
Speaker 2: it's changed. So this is them manipulating that staking and
Speaker 2: restaking process.
Speaker 3: Yeah, and in this particular case, they wanted to give
Speaker 3: the users the ability to use multiple chains, right, not
Speaker 3: just a single chain. So there's a message that goes
Speaker 3: back and forth.
Speaker 1: So wait a minute, what was they the hackers this?
Speaker 2: Yeah?
Speaker 3: No, no, no, no, this is your your KELP d O
Speaker 3: and KELP is crypto exchange, a crypto exchange, okay, yeah,
Speaker 3: call it a crypto exchange, all right.
Speaker 1: So these are the guys that were doing the bad stuff.
Speaker 3: No, these are the guys who are do the normal stuff.
Speaker 3: This is like coinbase, this is like like whatever, Like
Speaker 3: we have their system. Yeah, we have customers who log
Speaker 3: in and they have ETH and they they stake it
Speaker 3: and restake it and do whatever and whatever. Right, the
Speaker 3: bad guys, what they did is the when you try
Speaker 3: and stake that ETH and either move it around to
Speaker 3: different chains. The bad guys actually targeted the messaging system
Speaker 3: between chains. Remember the chain he for it to get
Speaker 3: on the chain and for its to be a valid transaction,
Speaker 3: a majority have to agree and be that chain is
Speaker 3: read only. But when it moves from chain to chain,
Speaker 3: in this particular case, there's a message that comes in
Speaker 3: and says, hey, by the way, I'm going to take
Speaker 3: this steak deep. Then we're going to keep it on
Speaker 3: this chain over here for a little while, and then
Speaker 3: we'll move it back.
Speaker 2: Does that literally mean it's off the chain?
Speaker 1: I remember the early days of cryptocurrency and some very
Speaker 1: smart people that Patrick and I both know, and you
Speaker 1: probably know who I'm talking about, said this is so great.
Speaker 1: You can't hack it. It's like stone solid. And I
Speaker 1: was like, oh, yeah, sure, based on something that's digital
Speaker 1: that exists nowhere except in some computer somewhere. And you're
Speaker 1: telling me that it's not hackable. Come on.
Speaker 2: So it's like communism. It sounds great, it just doesn't
Speaker 2: work in real life now. I mean, cryptos blockchain has
Speaker 2: some real powerful things, but the problem is the implementation.
Speaker 2: And as we'll see when Dwayne explains or we explain,
Speaker 2: there was an implementation detail that was kind of a
Speaker 2: convenience that was arranged that was exploited, correct Wing.
Speaker 3: Yeah, absolutely, you're right, Patrick. So just so we're completely
Speaker 3: clear on how this all works, the KELP DAO is
Speaker 3: a restaking protocol for DI for DeFi, so that could
Speaker 3: be used by any exchange. Right. The restaking ether is
Speaker 3: KELP sort of what they call a liquid restaking token.
Speaker 3: So it's a token that can move from chain to chain.
Speaker 3: They're using a messaging protocol called Layer zero. Now Layer
Speaker 3: zero is a cross chain messaging bridge protocol used by KELP.
Speaker 3: So I don't want I didn't want to go into
Speaker 3: too much detail, but now that we're asking a little
Speaker 3: bit more questions, I wanted to make sure like everybody
Speaker 3: kind of understands what's going on. So we have a
Speaker 3: protocol that's handling a liquid token. That liquid token can
Speaker 3: move from chain the chain based on a message that
Speaker 3: comes in. Does that make sense?
Speaker 1: And what makes it liquid?
Speaker 3: So that what makes it liquid, my gas would be
Speaker 3: is because it can actually move around and it's not indelible.
Speaker 3: But I'd have to dig into that.
Speaker 1: Maybe it can change.
Speaker 3: So but more really on the hack. The hack is
Speaker 3: at that layer zero, that cross chain messaging. Right, So
Speaker 3: getting a token on the chain, getting a token approved
Speaker 3: obviously majority and all that good stuff. But getting a
Speaker 3: token to move from chain to chain only required one
Speaker 3: verifyer and there so one person sent a message in saying, oh,
Speaker 3: by the way, I have three hundred million dollars worth
Speaker 3: of restake teth put it on the chain and I
Speaker 3: verify it. All the chains were like, yeah, sure, that's cool, awesome,
Speaker 3: let's do that.
Speaker 2: Who verifies it? I do, Oh okay, thank you.
Speaker 3: Yeah it's me I verified it or my buddy Patrick
Speaker 3: verified it.
Speaker 2: And I'm like, oh okay. That's the problem. That's the
Speaker 2: part that's where they violated the i'm directive.
Speaker 1: So they got there wasn't a man in the middle
Speaker 1: kind of attack where they got into the exchange of messages.
Speaker 3: Now you can issue these messages, like if you're participating
Speaker 3: in the change, generally you have the ability to issue
Speaker 3: some of these messages. There's even with ethereum and that
Speaker 3: sort of stuff. If you're a node that can make
Speaker 3: you know that yes, this is a valid transaction. Lots
Speaker 3: of times when we were doing when you remember mining crypto,
Speaker 3: sure right, there were different ways to mind crypto. One
Speaker 3: was trying to solve a mathematical problem. There's another way
Speaker 3: where you could have spent your CPU cycles, which was
Speaker 3: I'm going to spend CPU cycles in verifying transactions, right
Speaker 3: and become part of the network. So you could be
Speaker 3: a node that verifies transactions. Yeah, and I listen, I've
Speaker 3: done this in a while. But I know with eth,
Speaker 3: for example, if you had I think it was thirty
Speaker 3: thousand dollars worth eth a in a wallet, you could
Speaker 3: then be a verification node. If you staked your ETH
Speaker 3: in that node and said, yeah, I stake my thirty
Speaker 3: grand to say, yeah, we're making these transactions appropriately, you'd
Speaker 3: earn ETH on that, and you'd earn ETH for doing
Speaker 3: the verifications and that sort of stuff. So it was
Speaker 3: it was when mining really wasn't viable anymore, but you
Speaker 3: could still verify transactions.
Speaker 1: In the days of mining crypto are over.
Speaker 3: Yeah, pretty much. I mean yeah for the normal household user, yes,
Speaker 3: I would say that you just don't have the amount
Speaker 3: of compute and electricity to really mine anything. And there
Speaker 3: are still, i mean there are still some minable tokens,
Speaker 3: but you're not getting much for them. Okay, So just
Speaker 3: so we're all sort of clear on this process, KELP
Speaker 3: dio is a DeFi restaking protocol, not an exchange the
Speaker 3: stolen asset, the thing that they created out of thin air,
Speaker 3: although is an all crypto kind of created out of
Speaker 3: thin air. Is this restaked eth or rs eth KELP
Speaker 3: liquid restaking tokens that's what that is. And the failure
Speaker 3: here happened in layer zero with that cross cross bridge
Speaker 3: messaging communications right where they just required one of one verifier,
Speaker 3: which is a no good.
Speaker 1: And so these hackers got away with or did they
Speaker 1: get caught this three hundred million dollars.
Speaker 3: For three hundred million dollars of eth that didn't actually exist.
Speaker 3: I don't know that they actually got caught. It doesn't
Speaker 3: say in the article here.
Speaker 1: Hmm.
Speaker 2: Okay, they basically didn't steal it from someone. They conjured it, yeah,
Speaker 2: out of thin thinner air.
Speaker 1: All right, But it's not like they cashed it in
Speaker 1: and fled the country or it might.
Speaker 3: Have Yeah, no, no, no, no, okay, they say they say
Speaker 3: the attack has been attributed to North Korea as a
Speaker 3: Lazarith group, but nobody's arresting them and it's not like right,
Speaker 3: so all right, some of the money was actually well,
Speaker 3: well here you go, some of the money was actually
Speaker 3: seized and frozen about thirty thousand eighth of it roughly
Speaker 3: seventy one million, so not as much as it was taking.
Speaker 1: Okay, all right, this is a real quick one. I
Speaker 1: brought this up on dot net rocks. It's a Windows
Speaker 1: Defender Performance Tool. It's a Windows application also a dot
Speaker 1: net application that monitors Windows Defender ETW events and visualizes
Speaker 1: scan durations in real time using a bar chart. And
Speaker 1: it can also visualize snapshots. And you know, I only
Speaker 1: mention it because there's a lot of people now and
Speaker 1: a lot of friends of ours that just you know,
Speaker 1: they sit behind their Windows machine and they're like, gee,
Speaker 1: I wonder if I'm getting hacked. You know, there's not
Speaker 1: really there's Windows Defender pops up and says, you know,
Speaker 1: if there's a threat or something like that. But generally
Speaker 1: we don't look into the inner workings of our machines
Speaker 1: and you know, what applications are running in what could
Speaker 1: be a problem in all this kind of stuff. So
Speaker 1: this is a good thing just to run. If you've
Speaker 1: got some extra screen space, throw it.
Speaker 2: Up there if you're interested in this kind of thing.
Speaker 1: If you're interested in this kind of thing. So I
Speaker 1: don't want to be labor it, but that's it. I
Speaker 1: just I'll put a link to that.
Speaker 3: Bo didn't you guys see who the two developers are.
Speaker 2: On us probably interviewed them.
Speaker 1: Oh, Alexander and Claude.
Speaker 3: I think you're going to start to see a lot
Speaker 3: more of this. I've seen a lot of githubs attributed
Speaker 3: to claud Code as the only developer now right, we're
Speaker 3: the only developer doing any pushing any whatever is Claude
Speaker 3: to where I think we'll see a lot of these
Speaker 3: little tools. I mean, shoot, a lot of us have
Speaker 3: had these ideas, right right, Hey, wouldn't it be cool
Speaker 3: if I had this little thing that did this thing?
Speaker 2: Right now?
Speaker 3: You can get cloud code to create it?
Speaker 1: So cool.
Speaker 3: He's a good example.
Speaker 2: You know that guy who did that thing at that
Speaker 2: place at the time.
Speaker 1: I remember, all right, who wants to take the CEA
Speaker 1: panel story? Oh, c panel start with the headline please.
Speaker 3: C panel for those of you know you know what
Speaker 3: sea panel is critical C panel and WHM bug exploited
Speaker 3: as a zero day POC now available. POC is now available.
Speaker 3: I mean I should say it in that proof of concepts.
Speaker 1: In other words, there's a there's a tool that somebody
Speaker 1: has written to do to do the exploit, to do
Speaker 1: the deed, to do the deed.
Speaker 2: To do the deed.
Speaker 3: So for those of you who have hosted websites, which
Speaker 3: first off, for those of you hosting your website, shame, Yeah,
Speaker 3: you probably shouldn't be.
Speaker 1: Either that or do you want a job?
Speaker 3: Yeah, exactly, it's one of the two. So usually if
Speaker 3: you host your own, if you're in a hosted website situation,
Speaker 3: whether it's go Daddy or whatever, lots of times you'll
Speaker 3: have a way to manage your website, right, So if
Speaker 3: it's word Press, you're gonna log in a word Press,
Speaker 3: you're gonna do whatever. But if it's another type of site,
Speaker 3: you're gonna typically have what's called Seapanel. Sepanel is probably,
Speaker 3: if I had to guess one of the most, if
Speaker 3: not the most prominent panel management system.
Speaker 2: For your website, be surprised if it isn't.
Speaker 3: Yeah, I mean I we run into Seapanel a lot
Speaker 3: when taking the customer sites and that sort of stuff.
Speaker 3: So yeah, not entirely sure. But in this particular case,
Speaker 3: there is a critical CVE twenty twenty six forty one
Speaker 3: nine four zero, which is an authentication bypass vulnerability in Seapanel.
Speaker 1: Not good.
Speaker 3: So if you are running Seapanel eleven eleven or eleven one, ten,
Speaker 3: eleven one, eighteen one, twenty six, one thirty two, one
Speaker 3: thirty four, one thirty six, one thirty six one, you
Speaker 3: have to go patch immediately because there are right now
Speaker 3: one point six million sea panels that come up on
Speaker 3: Showdown instantly if you look for them, and a fair
Speaker 3: chunk of them are not patch right now. So if
Speaker 3: you have if you have a sea panel, you want
Speaker 3: to go patch this. This is probably one of one.
Speaker 3: I'd say the biggest thing until we found a bigger thing,
Speaker 3: but this is probably the number two big thing in
Speaker 3: the last two.
Speaker 2: Weeks and not a good big thing, right, I.
Speaker 3: Mean, it depends on who you are, and I think
Speaker 3: it's a good big thing.
Speaker 2: Showed on just for those who you know don't remember
Speaker 2: is a tool that we can use to find is
Speaker 2: a first degree black belt it is.
Speaker 1: It is.
Speaker 2: Also a way to find exploits that are available.
Speaker 3: Yeah, I mean think of it as think of it
Speaker 3: like the Google for for devices is really what it is.
Speaker 3: So it's like I want to find every webcam that's
Speaker 3: open on the Internet.
Speaker 1: Yeah, of course you wouldn't do that, but.
Speaker 3: You go to Showdown showed on would Showdown would show
Speaker 3: you those before.
Speaker 2: That we'd use Google dorks basically special strings yep.
Speaker 3: And I think I think that's if I were I
Speaker 3: wouldn't be surprised if that's not where showdown came from.
Speaker 3: Where they're like, gosh, we really hate dork and this
Speaker 3: stuff all the time. Let's just create a database of it.
Speaker 3: But like, if you want to go take for example,
Speaker 3: how many computers are open on three three eight nine on.
Speaker 1: The internet, right, is that the webcam port?
Speaker 2: No?
Speaker 3: Three three eight nine the remote desktop port?
Speaker 1: Oh?
Speaker 3: Yeah, okay, So how many computers are open on three
Speaker 3: three eight nine and have in the picture of the
Speaker 3: remote desktop the username administrator.
Speaker 2: It will can't be it can't be more than fifteen million, yeah.
Speaker 3: But it will do that. It will actually go through
Speaker 3: take a screenshot of the remote desktop welcome window, and
Speaker 3: then it will ocr all of the users that show
Speaker 3: up there, so that you can search for a username. Wow,
Speaker 3: which is awesome if you're looking to target a particular
Speaker 3: system or user account.
Speaker 1: Or if you're a hacker.
Speaker 3: Yeah, or you're looking for Windows XP right yeah, type
Speaker 3: in Windows XP and remote desktop and you'll find a
Speaker 3: bunch of boxes connected to the internet that are Windows XP.
Speaker 2: Okay or their honeypop?
Speaker 1: Are we done with this? Were moving on to canvas. Yeah,
Speaker 1: we are all go patch, go patch, Yeah, Canvas breach
Speaker 1: may put two hundred and seventy five million users. That's
Speaker 1: nine thousand schools at risk.
Speaker 2: So this is not Canva, the AI tool. This is Canvas,
Speaker 2: a school tool.
Speaker 3: Yes, yeah, and I've seen some people use Canva in school.
Speaker 3: But yeah, you're absolutely right, and now it's.
Speaker 1: A tool too cool for school, is too cool? Yeah,
Speaker 1: So what happened?
Speaker 2: It's what happened here?
Speaker 3: Good question? Right right now, there's an active investigation going on,
Speaker 3: so they're not sure what the exploit was to garner
Speaker 3: the information. However, right now, the shiny hunters who hacking
Speaker 3: grew up on the Internet says that they have stolen
Speaker 3: information that can contain some pi I some personally identify
Speaker 3: unidentifiable information about students and teachers, and that that may
Speaker 3: include your name, that may include your email address, et cetera.
Speaker 3: So until we find out my gas is not password
Speaker 3: right to log in, I know a lot of people
Speaker 3: that are using Canvas are using they're using single sign
Speaker 3: on anyways, right, they're using an O off to Google
Speaker 3: or Microsoft or whatever. Right, a lot of schools are
Speaker 3: using either you know, Google Workspaces or they're using Microsoft Office.
Speaker 3: So it's very fast the author indication layer. But in
Speaker 3: this particular case, you may start receiving a lot more
Speaker 3: targeted phishing email.
Speaker 2: Because they have information on you.
Speaker 3: Because they have the information on you, they know you're
Speaker 3: using Canvas, they know they what you're using it for,
Speaker 3: they know your name, they know your email address, so
Speaker 3: they'll probably start sending you very targeted emails. I mean,
Speaker 3: if you receive an email from Canvas, what it looks
Speaker 3: like it's from Canvas saying hey, we apologize there was
Speaker 3: a breach blah blah blah. Here you know, click here
Speaker 3: to enter your you know, login information so that you
Speaker 3: can we can make sure you're secure or whatever.
Speaker 1: It's probably the hackers, not can right, Okay, Yeah, so
Speaker 1: this is just a cautionary tale. It's a story. There's
Speaker 1: nothing anybody who's listening can do anything about. It just
Speaker 1: happened where and understand, right, mm and it was probably
Speaker 1: some ill configured security obviously. All right, let's move on
Speaker 1: and then we'll take a break. This is just kind
Speaker 1: of a public servicennouncement. It's nothing new, but the browser
Speaker 1: is breaking your DLP. How data slips past modern controls.
Speaker 1: It's a story and bleeping computer, but it underscore is
Speaker 1: something that we've been talking about on the show for
Speaker 1: quite a while now, which is you think you're safe
Speaker 1: because you have you know, various forms of security and
Speaker 1: in your browser and all that stuff. But more and
Speaker 1: more things are falling through the cracks and we are
Speaker 1: becoming more and more vulnerable every day.
Speaker 2: And this boils down to people, and we all know this.
Speaker 2: People are entering things more and more into portals and
Speaker 2: browsers and the DLP systems are they're not triggering. They
Speaker 2: they don't see that. So if you take critical information
Speaker 2: and paste it into chat, GPT through a web interface,
Speaker 2: it's not going to get caught.
Speaker 1: So let's just define DLP. What is that.
Speaker 3: So DLP is data loss prevention. So there's a lot
Speaker 3: of DLP systems out there that will watch all your
Speaker 3: web traffic. Like you know, you may work for a bank, right,
Speaker 3: and one of the things DLP will look for is
Speaker 3: it'll use rej axes and all the other good stuff
Speaker 3: to look for credit cards, look for account numbers, look
Speaker 3: for customer names. Right, So if I'm sending an email
Speaker 3: with a credit card number, it will flag and say nope,
Speaker 3: you can't send credit cards, you know, over email. So
Speaker 3: make sure that you're not putting data you shouldn't be
Speaker 3: putting in places you shouldn't be putting it.
Speaker 1: One of the things that bugs me about this is
Speaker 1: that the clipboard turns out to be a huge vulnerability
Speaker 1: and the you know, the tools that we use, the
Speaker 1: browser tools for password managers, they all work with a clipboard.
Speaker 1: I mean you find your P.
Speaker 2: I think clipboard is something that DLP typically running on
Speaker 2: the local workstation endpoint can check. It's when like you
Speaker 2: enter it into a page and then it's encrypted as
Speaker 2: a as a load and sent.
Speaker 1: This article says most traditional DLP solutions can inspect or control.
Speaker 2: Really, Oh, that's an assumption. I might be wrong about
Speaker 2: that then, yeah.
Speaker 1: Right, anyway, so just be careful about that. And you know,
Speaker 1: we used to use, I used to use a tool
Speaker 1: that would remove it from the clipboard after you've pasted it, right.
Speaker 2: Yeah.
Speaker 1: I don't think that bitwarten does that, but that would
Speaker 1: be a really great feature to turn on. You know
Speaker 1: if if at bitwarten, right, copy this to the clipboard,
Speaker 1: monitor the clipboard after I pasted it, remove it from
Speaker 1: the clipboard, right.
Speaker 2: You'd think that they do that. You'd think if you
Speaker 2: hit the pill button and then go past somewhere.
Speaker 1: Yeah, but we know listeners know not to use the
Speaker 1: pill button because that has been exploited, yes, big time.
Speaker 2: So yeah, we don't do that with the one in Bitwarden,
Speaker 2: the one in the browser.
Speaker 1: You mean in the browser.
Speaker 2: Yeah, we're talking about the one in Bitwarten.
Speaker 1: Well, Bitwarten has a browser plug in that tempts you
Speaker 1: to use the fill button, and hey, you want me
Speaker 1: to fill this in? And I say no, because we
Speaker 1: know that that has been exploited.
Speaker 3: Now I will say what bitboardon does have. It will
Speaker 3: clear the clipboard automatically for you if you want, but
Speaker 3: it doesn't do it after pace. It does it at
Speaker 3: a scheduled time, okay, and you have to turn it on,
Speaker 3: so it's like I want to say, it's like ten
Speaker 3: or thirty seconds, so won't sit there forever. But and
Speaker 3: you do have it is something that's done nothing. It's
Speaker 3: not by default.
Speaker 1: So yeah, interesting. Yeah, I'm going to check that out.
Speaker 1: I'm going to check that out. That's definitely a good feature.
Speaker 1: All right, I guess this is a good time to
Speaker 1: take a break. Like we said, this is an extra
Speaker 1: long show and we'll be right back after these very
Speaker 1: important messages.
Speaker 3: Stand up, stretch your legs, walk around. Unless you're driving,
Speaker 3: then don't run. Get out of your car and run
Speaker 3: alongside it. Jump back in.
Speaker 1: And we're back. It's security this week. I'm Carl, that's Dwayne,
Speaker 1: and that's Patrick. And Patrick. By the way, I don't
Speaker 1: know if we should say this, but we probably should.
Speaker 1: He is the possession of several little baby bunny rabbits
Speaker 1: five five bunny rabbit. Five minutes before the show started,
Speaker 1: he and his wife found out in the yard, stranded,
Speaker 1: and there they appear to be a couple of weeks old.
Speaker 1: Here's a button.
Speaker 2: And and out in the out, in the middle of out,
Speaker 2: in the middle of everything. They would have been dead
Speaker 2: by now.
Speaker 3: Yeah, oh yeah. The hawks would have picked him up,
Speaker 3: that's for sure.
Speaker 2: So we put him in a box. We're gonna as
Speaker 2: soon as the show's over, I'm going to take them
Speaker 2: to a refuge and they're going to take good care
Speaker 2: of them.
Speaker 1: Are they sleeping soundly?
Speaker 2: I think so. Give the box a shake.
Speaker 1: Yeah, that's terrible, but it's funny that, you know, he's
Speaker 1: very protective of his little bunnies. He is, he is.
Speaker 3: He's only had them for a couple of minutes.
Speaker 2: But for very protective of my wards in all cases.
Speaker 1: Uh huh yeah, all right, so, uh, let's this is
Speaker 1: a good one. Guy finds Google Chrome is quietly installing
Speaker 1: a four gigabyte AI model on our devices. Yikes. I
Speaker 1: guess it's not so bad, but it just sounds bad.
Speaker 3: Yeah, I mean it sounds nefarious where you're like, oh
Speaker 3: my god for gig and it's interesting. So it says
Speaker 3: installing a four gig AI model called Gemini Nano. The
Speaker 3: key files there, the large file there is called weights
Speaker 3: dot bin. So for anybody who's ever done like computer
Speaker 3: vision or trains your own models and that sort of stuff,
Speaker 3: the weight's bin is a I mean, it's honestly, it's
Speaker 3: where all the post training is. It's how it identifies things. Right,
Speaker 3: So that bin file probably you know, has the weights
Speaker 3: for different words or whatever it's doing searching on, right,
Speaker 3: so I can identify and summarize pages.
Speaker 2: The cash an ai cash if you will.
Speaker 3: Yeah, yeah, it's probably a good way to look at it. Yeah, absolutely.
Speaker 3: So they're generally large, right, and they're generally highly processed
Speaker 3: data that's going to be used statistically in some way
Speaker 3: to help with you know, analyzing the page so that
Speaker 3: you can click on that little Gemini button in home
Speaker 3: and go, so tell me about the story, right, or
Speaker 3: tell me about this article or whatever it may be.
Speaker 3: Then it goes through and does its whole statistical thing.
Speaker 3: What's nice and not so nice? Right? What's nice is
Speaker 3: if they're pushing down this weight to bin, that means
Speaker 3: a lot of that processing is being done locally potentially,
Speaker 3: so you're not sort of going all the way out
Speaker 3: to the web and calling some form of you know, chat,
Speaker 3: GBT API with every page that you're browsing, which you
Speaker 3: probably don't want to do so from a security standpoint,
Speaker 3: I almost like this where I'd like to do the
Speaker 3: local processing. I'd like to have the model local and
Speaker 3: have it call out to the internet as little as bustable.
Speaker 3: I mean, this is coming from a guy who's you know,
Speaker 3: I'm running my own AI cluster in the house because
Speaker 3: I don't want it, you know, going out and going anywhere. Sure,
Speaker 3: but that being said, you usually want to allow the
Speaker 3: users to opt in, not just pre push it. So
Speaker 3: I agree in this. You know, it's funny in this
Speaker 3: article they make the case of like, oh my god,
Speaker 3: can you imagine how much CO two this burns pushing
Speaker 3: this down to every client. You know, I would counter
Speaker 3: that with anytime, you know, call of duty comes out
Speaker 3: and the two and a half petabytes are required.
Speaker 2: Or I would I would redirect it that person still
Speaker 2: eating me, still eating me?
Speaker 3: Yeah, yeah, So I you know, I don't know that
Speaker 3: I would use CO two is the argument here, But
Speaker 3: I you know, I would say, yeah, I get it.
Speaker 3: I mean, it's a good chunk of storage being used.
Speaker 3: But the alternative is take every page eyebrows and when
Speaker 3: I hit that little Gemini icon, it goes out to
Speaker 3: the Internet, you know, in full fidelity and gets processed
Speaker 3: out there. And I don't know that I want that
Speaker 3: to happen either. So hopefully, because these weights are being
Speaker 3: pushed down, a lot of that processing is being done locally.
Speaker 1: Would just be nice if you know, some of these
Speaker 1: things came with technical descriptions of actually what's happening, so
Speaker 1: people like us could understand it a little better.
Speaker 2: We are non average, no, it's the problem.
Speaker 1: But you know, we are displaners.
Speaker 2: We are below average.
Speaker 1: But you know, if we understand it, we can explain
Speaker 1: it to people. Story we're explainers, We're splainers.
Speaker 2: That's right, it's the it's the classic ask for forgiveness
Speaker 2: rather than permission.
Speaker 1: Mm hmm, all right, next story.
Speaker 3: That's that's our hot take on that.
Speaker 1: This one I thought was pretty neat. X Labs underscore
Speaker 1: v one botnet exploits a dB in IoT devices for
Speaker 1: d DOS attacks targeting game servers. So what's a dB.
Speaker 3: That's the Android debug port. So yeah, I was gonna say, Carl,
Speaker 3: you know you used to be the goss to be
Speaker 3: the police five years ago on this podcast. You'd be like, WHOA,
Speaker 3: WHOA t L d R. Like there's a little bit
Speaker 3: of too much acronym soup there.
Speaker 2: You just I don't think you see any words in
Speaker 2: that title.
Speaker 1: I know it's true.
Speaker 3: I was listening to it.
Speaker 1: Distributed denial of service.
Speaker 3: Yeah, I know what AT is.
Speaker 1: I just don't know a dB is.
Speaker 3: So yeah, so ADB if if you're working with Android devices,
Speaker 3: and this could be an Android phone, it could be
Speaker 3: a tablet, but it also could be a TV. Right, Actually,
Speaker 3: that's a real fun exercise. Go to your TV. Yeah,
Speaker 3: go to your TV at your house, and you can
Speaker 3: go to the settings on your TV and turn on
Speaker 3: debugging and if you do it actually opens up a
Speaker 3: port where you can connect to that port and then
Speaker 3: run Linux commands on your.
Speaker 2: TV, and you too can brick your TV and YouTube.
Speaker 3: Yeahs, I've fricked many a TV infecting them. But yeah,
Speaker 3: so you can go in and you can run commands
Speaker 3: and you can do all sorts of stuff. Oddly enough,
Speaker 3: there is a microphone command built into the Android system.
Speaker 3: You would think, of course because of Android tablets and phones,
Speaker 3: but it's also on the TV. So if your TV
Speaker 3: has a micromonic and listen in. But there's all sorts
Speaker 3: of new things.
Speaker 1: Wait a minute, are you saying that you could debug
Speaker 1: just by talking to it or no?
Speaker 3: I'm just saying, like I could turn it on. I
Speaker 3: could let's use the.
Speaker 2: Debug to turn on the mic spy on you.
Speaker 3: Yeah, let's say I get on your network and that
Speaker 3: debug ports on your TV. I could turn on the microphone.
Speaker 1: And what would that do? Exactly?
Speaker 3: Well, let's see your uh you know how you can
Speaker 3: be like, you know, hey, Google, I want to you
Speaker 3: know where can I watch?
Speaker 2: I don't know.
Speaker 3: Right whatever? Golden Girls, Jesus, how old are you?
Speaker 2: It's on at a restaurant that I sam?
Speaker 1: How about watership down Patrick.
Speaker 3: Yeah, Golden Girls.
Speaker 2: Wow.
Speaker 3: On that note, Nicked Night yeah, mash okay, matches better.
Speaker 3: It's probably older, but better. Joey, do you ever watch
Speaker 3: what was it? Empty Nest? It was the spinoff of
Speaker 3: Golden Girls. Now, I don't think that was the dude
Speaker 3: and his dog. Yeah really, yeah, he used to go.
Speaker 3: I think he was the neighbor.
Speaker 1: My grandmother used to watch Golden Girls. I never watched
Speaker 1: Golden Girls.
Speaker 3: Fun fact. You know the old grandmother what was her name?
Speaker 3: The youngest she was the Yeah, she was not the
Speaker 3: oldest lady. They just made her look old, the old
Speaker 3: Italian lady. Yeah, yeah, yeah, you know, I did not
Speaker 3: know that. But anyways, where were we girls?
Speaker 2: Thank you?
Speaker 3: But adb abb back to adb Yeah. So with a
Speaker 3: debug port, you do you get? You get access to
Speaker 3: all sorts of information on the device. You can run
Speaker 3: commands on the device. You can also back up the device.
Speaker 3: But more importantly, I can push APKs to the device,
Speaker 3: so I can actually create my own Android.
Speaker 1: And APK yeah packs and aapp application, packaged whatever.
Speaker 3: And I can create an application, and I can push
Speaker 3: it to the TV, and I can set it to
Speaker 3: run when the TV turns on, like maybe reaching out
Speaker 3: to my website and giving me your Wi Fi password
Speaker 3: or whatever. Right, so we've ever run that one. Yeah.
Speaker 3: ADB ports are fun.
Speaker 1: And nothing is there to stop you.
Speaker 2: No bugs like a double oh seven designation kill.
Speaker 1: So is this what happened?
Speaker 3: I mean, oh, you want the actual story?
Speaker 1: Yeah, the actual story, Like how does one get infected
Speaker 1: with this thing?
Speaker 2: Yeah?
Speaker 1: Do you have to?
Speaker 2: Yeah?
Speaker 3: So yeah, absolutely so. The the the ADB port debug
Speaker 3: port sometimes is on, sometimes it is not. Depends on
Speaker 3: the model of TV and whether it was turned on
Speaker 3: or not, or the model of the device, whether it
Speaker 3: was turned on or not, et cetera. Phones usually are
Speaker 3: pretty protected, usually shut down unless you put it in
Speaker 3: a developer mode, which takes you know, going to settings
Speaker 3: and clicking on the about eighty five times and then
Speaker 3: saying yes and then spinning around and throwing the phone
Speaker 3: in the air and all sorts of weird stuff. But
Speaker 3: other devices not so much, right, whether it's a camera,
Speaker 3: whether it's a you know, IVR system, whether it's a TV.
Speaker 3: Lots of times those ports are left on and they're
Speaker 3: little mini computers, right, so great target for a botnet
Speaker 3: where I might hit that port and then take control
Speaker 3: of the device and run an application. Okay, yep, how
Speaker 3: do you protect against this? If you have an Android device,
Speaker 3: go to settings and make sure debugging is turned off.
Speaker 1: Okay, but does it require physical access for somebody to
Speaker 1: get on there?
Speaker 2: Nah?
Speaker 3: No, no, just needs access to the network.
Speaker 1: Wow.
Speaker 3: So if the device is connected to the Internet, that
Speaker 3: means your network is the World Wide Web. If it's
Speaker 3: connected locally, that means they need to break into you know,
Speaker 3: your Wi Fi or local network or whatever.
Speaker 1: But let's face it, if you're a TV, you're going
Speaker 1: to be on the Internet because that's how they pull
Speaker 1: down shows, right Yeah.
Speaker 3: Well, and a lot of people don't even think about
Speaker 3: you know, oh well I just plug this TV into
Speaker 3: this you know, open wifire or whatever, right at a
Speaker 3: Starbucks or whatever. Right, so then you have access to it.
Speaker 1: So that means your TV or device could get owned
Speaker 1: or poned and used in a d DOS attack against Yeah, you.
Speaker 2: Wouldn't know it. It could also become a microphone that
Speaker 2: spies on you.
Speaker 3: Yeah, yep, all right, or they just at least know
Speaker 3: what you're watching on TV.
Speaker 1: So again, the fix is to go into debug mode
Speaker 1: and make sure that oh, debug mode is off.
Speaker 3: Yep, make sure debuggy mode is off. I mean, if
Speaker 3: you're really paranoid and technical and map your devices in
Speaker 3: the network and look for that port pretty quick way.
Speaker 1: But this could be. This could be anything that runs Android.
Speaker 3: Oh yeah, absolutely, refrigerator, refrigerator, yeah, washing, dishwasher, you name
Speaker 3: it anything. Yeah, exactly.
Speaker 2: You can take an IP address you need to check it.
Speaker 1: I kind of got to believe that most home appliances
Speaker 1: that are running Android are not running in debug mode.
Speaker 2: Oh sure, you're so precious.
Speaker 1: Do you really think that you really think that my
Speaker 1: Samsung fridge they got it best Buy, has debug mode
Speaker 1: enabled by default.
Speaker 2: Maybe it gets a random coin toss it gets. I
Speaker 2: think this is the new default password bubblem vendors, they don't.
Speaker 2: They just want to sell the product, so until it
Speaker 2: becomes a scandal, there's no motivation for them to police this. Yeah, geez, well,
Speaker 2: I wouldn't be surprised if if it's eighty percent of device,
Speaker 2: I don't know. That wouldn't surprise me at all. This
Speaker 2: is just the next level, and there'll be another one
Speaker 2: after this, right, be another level. The good news is
Speaker 2: this is better than a hard coded password that gives
Speaker 2: you because at least you could turn this off. Yeah,
Speaker 2: there's always, as they say in Men in Black, there's
Speaker 2: always a Corellian cruiser or a black flag or something like.
Speaker 2: It's always the next thing. This just happens to be
Speaker 2: the next thing, all right.
Speaker 1: This next one is a bad one, Palo Alto Networks
Speaker 1: warns State cluster behind. Yeah, well the last one is
Speaker 1: the worst one. But Palo Alto Networks warren state linked
Speaker 1: cluster behind a zero day exploit exploitation. A patch for
Speaker 1: the flaw, which hackers began targeting in early April, won't
Speaker 1: be ready for another week, and this was published May seventh.
Speaker 1: So there's a zero day out there, and you you're
Speaker 1: not protected. Yeah.
Speaker 3: Not only is there is zero day, it's for a firewall.
Speaker 3: Not only is it for a firewall, it means it's
Speaker 3: connected to the Internet, and it's exploited by people who
Speaker 3: know what they're doing.
Speaker 2: So, yeah, you just don't use the internet this month.
Speaker 1: Yeah, I've unplug it, unplug it, replace it with something else. Literally,
Speaker 1: that's that's what you have.
Speaker 2: Toces that horrible conundrum of you know your car is
Speaker 2: a death trap and you know it's likely to kill
Speaker 2: you any mile but you have to go to work
Speaker 2: and you can't be fixed until next month. So you
Speaker 2: take you roll the dice, you take your chances.
Speaker 1: Call an uber, That's what I would.
Speaker 2: Yeah, well you can't call an uber for your.
Speaker 1: Firewall, no, no, no, But I'm saying there are ways
Speaker 1: around it, which is replace the unit. Yeah, first of all,
Speaker 1: turn it off.
Speaker 3: Monitoring is another way to keep an eye on it.
Speaker 1: Well, monitoring, but you could you could watch it get exploited.
Speaker 1: Does that help?
Speaker 3: That might be neat.
Speaker 2: This is really yeah, that's a good Friday night for me.
Speaker 2: I think this is a view of our future. I
Speaker 2: think that we're going to get things that are discovered
Speaker 2: as exploited and there's not going to be a fit
Speaker 2: readily available right right, So you have to figure out like, oh,
Speaker 2: you know what. I think this is where tabletop exercises
Speaker 2: have to come in and people have to start thinking
Speaker 2: about what's the worst they can happen. Now, military does
Speaker 2: this all the time, at least when they're done, when
Speaker 2: they're operating competently. The military does this all the time,
Speaker 2: like what if they do this? What if they did that?
Speaker 2: And you try to predict the unpredictable, most organizations aren't
Speaker 2: geared for this, they're not ready for it. They can't
Speaker 2: handle it.
Speaker 1: Wow. So what is the device itself that people have
Speaker 1: to worry about it? It's the PA series and VM
Speaker 1: series firewalls. Yes, that's a lot of firewalls.
Speaker 3: That's a lot. Yeah, it's a big line of firewalls.
Speaker 1: Actually. Wow. Yeah, so this isn't a go patch because
Speaker 1: there is no patch, replace it at least for a while. Okay.
Speaker 1: The penultimate story today, which I thought was hilarious, student
Speaker 1: hacked Taiwan high speed rail to trigger urgency breaks.
Speaker 3: Isn't that just like a kid by law? By law,
Speaker 3: I can't talk about this.
Speaker 1: It's like it's like pulling them all.
Speaker 2: I'm surprised you actually obaye that.
Speaker 3: A year and a half ago though I told people
Speaker 3: how to do this, but today I won't.
Speaker 1: It's kind of like pulling the fire alarm, you know,
Speaker 1: in grammar school, just walking by, pull the fire alarm,
Speaker 1: see what happens.
Speaker 3: Okay, so here's the deal. Now, it's a first off,
Speaker 3: if you look at this article, just just zoom in
Speaker 3: on that desk.
Speaker 2: That kid has.
Speaker 3: Yeah, I don't think I would ever want a picture
Speaker 3: of my desk with I think that's hand cream over
Speaker 3: there and maybe his braces like his twenty three year
Speaker 3: old Yeah, exactly. But he's also got a lot of
Speaker 3: software defined radios in there. I will tell you too.
Speaker 3: And we've done this our team, I know, if you
Speaker 3: go back, I think it's a year and a half,
Speaker 3: two years ago. Well, my team actually went down to
Speaker 3: DC and and did a session breaking into trains and one.
Speaker 2: Of the governments helped to help the government try and abilities.
Speaker 1: Patrick tried to stop him from talking about it, but
Speaker 1: he did anyway.
Speaker 3: Yeah, he's tried to stop me multiple times. And one
Speaker 3: of the exploits that we deployed actually was the ability
Speaker 3: to engage the E break on the trains. It didn't
Speaker 3: it didn't matter. It could be high speed, right. And
Speaker 3: I will tell you this. This has been deployed a
Speaker 3: couple times in anger, you know, by nation states, either
Speaker 3: pre attack or during attacks of nation states. So the
Speaker 3: way this, the way this works is the E break
Speaker 3: is actually a radio signal, right, So you can enable
Speaker 3: it by playing the right frequency. And it's not just
Speaker 3: a frequency, right, it's it's actually it's three frequencies within
Speaker 3: a period of time or whatever. But but what I
Speaker 3: will tell you is the spec for this is on
Speaker 3: the internet. That the way that the train systems work,
Speaker 3: if you like. For those of you who love reading
Speaker 3: really boring documentation, if you go read the documentation on
Speaker 3: how the rail systems work, you'll you'll find the frequencies.
Speaker 3: You'll know exactly which ones to call it in when order.
Speaker 3: You know, you'll see how they do train tracking. Heads up,
Speaker 3: they track trains over two point four gig hertz, not
Speaker 3: Wi Fi, but same band. And if you jam it,
Speaker 3: they lose a train and they shut down the whole system.
Speaker 3: And that was actually deployed I think against Poland at
Speaker 3: one point.
Speaker 1: Wow.
Speaker 3: So yeah, it's you know, you think like, oh my god,
Speaker 3: this twenty one year old's got to be you know,
Speaker 3: a genius. Twenty three not really or twenty three year
Speaker 3: old not really.
Speaker 2: Really.
Speaker 3: All you need to do is read the RFCs.
Speaker 1: Right, the request for comments.
Speaker 3: Yeah, the the manual if you will, the design doc
Speaker 3: for how these systems are put together, and then do
Speaker 3: it right, grab a software defined radio and do it. So,
Speaker 3: you know, I, although I think it's fun and it's
Speaker 3: neat to kind of play around with these types of systems,
Speaker 3: I don't applaud people who are like, you know, in
Speaker 3: real live trains causing or any system. Right, I'll tell
Speaker 3: you elevators have all sorts of systems she can play
Speaker 3: with and that sort of stuff, but you shouldn't do
Speaker 3: it now, right.
Speaker 1: So yeah, so this is really the irony. The irony
Speaker 1: of this story is as the kid was walking out
Speaker 1: of the train in handcuffs, he looked on the wall
Speaker 1: the window by the by the window and read the
Speaker 1: sign with the cord please pull cord for emergency break.
Speaker 2: He's like, oh, geez, which does the same thing. Yeah, exactly, Like.
Speaker 3: So, I don't know, I, like I said, I think
Speaker 3: I think it's interesting. I think I think it's fascinating
Speaker 3: how all these things work and that sort of stuff.
Speaker 3: But you know, to do it on a real life train, like, yeah,
Speaker 3: you deserve what you get.
Speaker 1: All right, We're finally to our top story and this
Speaker 1: one is our top story just because it's so bad, big,
Speaker 1: big and bad. Otherwise, in Dwayne speak, awesome copy fail
Speaker 1: seven hundred and thirty two bytes to root on every
Speaker 1: major Linux distribution. So that sounds like kind of an
Speaker 1: innocuous headline. But Twain Munch, you'd tell us what this
Speaker 1: sort really all about.
Speaker 3: Yeah, and actually what's crazy is right now, if you're
Speaker 3: on X or you're on whatever, there's tons of there's
Speaker 3: a place hosting this exploit where you can run one
Speaker 3: command and it pulls the exploit down, runs it in memory,
Speaker 3: and gives you root access to almost any Linux box.
Speaker 3: And crazy enough, this isn't just root level access. So
Speaker 3: we talk about privask and how you know, a lot
Speaker 3: of us listen, we don't pooh poop privesk, but we
Speaker 3: say remote code execution is more dangerous, right, We've said
Speaker 3: that all the time, Like, if you can remotely from
Speaker 3: you know, North Korea, exploit a system here in the
Speaker 3: United States, that's more dangerous than if they're on the
Speaker 3: box they can become an admin. The reason we put
Speaker 3: this is kind of the top story is first off,
Speaker 3: because of its breadth. It's every major Linux system since
Speaker 3: twenty seventeen.
Speaker 2: It's not just desktops and servers. It's also like containers
Speaker 2: and things like that that we don't think about.
Speaker 3: Yeah, and k eights and you name it, right, So
Speaker 3: this is way far reaching. It does give you the
Speaker 3: ability to even jump outside of containers.
Speaker 1: Wow.
Speaker 3: So a lot of people use containers as a security layer.
Speaker 3: This allows you to jump out and do all sorts
Speaker 3: of nasty things. And the really neat thing about this,
Speaker 3: For those of you who've been listening to this for
Speaker 3: a long this show for a long time, I want
Speaker 3: to say about maybe five years ago we talked about
Speaker 3: Dirty Cow, and then there was a whole bunch of
Speaker 3: Cow series that came out. But Dirty Cow was sort
Speaker 3: of role did as an amazing ability to become root
Speaker 3: level access on almost any Linux workstation, any Linux station.
Speaker 3: And what you were doing is you were exploiting a
Speaker 3: race case condition. And with Dirty Cow, when you exploited
Speaker 3: this race case condition, sometimes it worked, call it seventy
Speaker 3: percent of the time and you became root. Sometimes it
Speaker 3: did nothing, call that twenty percent of the time. And
Speaker 3: then sometimes it crashed the system. Call that ten percent
Speaker 3: of the time. So although it was it was cool
Speaker 3: and it was powerful, it wasn't as powerful as this.
Speaker 1: This is bad.
Speaker 2: Yeah. Yeah.
Speaker 3: This is a predetermined set of bytes that you can
Speaker 3: issue to a privileged area that will one hundred percent
Speaker 3: of the time give you rout and race case conditions
Speaker 3: and it is not a potential of crashing. It is
Speaker 3: super reliable, and that's one of the reasons that we
Speaker 3: of upgraded this as well, is because this is a
Speaker 3: highly reliable way of becoming root on almost any LINUXEDS
Speaker 3: planet at this point.
Speaker 2: Yeah.
Speaker 3: Absolutely, Oh, speaking of quiet, the way it yeah, I
Speaker 3: know this is.
Speaker 2: This thing's awesome.
Speaker 3: The way it injects the bites and the way you
Speaker 3: garner the token afterwards will not be picked up by
Speaker 3: ed rs, by by your anti virus, your endpoint detections.
Speaker 3: It's not even picked up by any of your logging systems.
Speaker 3: So this is not only like when you say quiet, Patrick,
Speaker 3: it is quiet, right, You're not going to see this happen.
Speaker 3: So it's it's super dangerous.
Speaker 1: You're dead.
Speaker 2: You just don't know it.
Speaker 3: Yeah, it's super dangerous, and it's it's impressive. Honestly, are
Speaker 3: there patches out there at the kernel level yet?
Speaker 2: There are?
Speaker 3: Yes, you do need to make sure you go out
Speaker 3: and patch immediately.
Speaker 1: At the end of the article, it gives you the
Speaker 1: sects and a link to the patch.
Speaker 2: Yeah.
Speaker 1: But we're which basically moves things around, doesn't it.
Speaker 3: Right, Yeah, exactly. Actually, so if you dig back why
Speaker 3: twenty seventeen. In twenty seventeen, there was an optimization added
Speaker 3: to this particular part of memory read and write and
Speaker 3: that sort of stuff that's being exploited. Now what the
Speaker 3: patch does is rolls it back, removes it. Yeah, takes
Speaker 3: that optimization out, because that optimization is what actually exposed this.
Speaker 1: And then apparently the kernel is being patch too, so
Speaker 1: there will be a version of your Linux kernel that
Speaker 1: will be safe yep, eventually.
Speaker 3: But this is if you want to read about this,
Speaker 3: there's a great article we have the link to to
Speaker 3: really dig into kind of the bits invites and how
Speaker 3: this works. I I'm wondering, I didn't see it in
Speaker 3: this article. They actually do have some code in here, but.
Speaker 1: They do they say how it works.
Speaker 3: Yeah, but there there's a super simple one liner. If
Speaker 3: you do a search for copy fail one liner, you'll
Speaker 3: find it and you can run it on a Linux
Speaker 3: box and it'll it'll give you a root.
Speaker 2: So that's sad.
Speaker 1: Note pned, owned and scrowned.
Speaker 3: This one's awesome.
Speaker 2: This is a long episode.
Speaker 1: This one's awesome, but it was good to catch up.
Speaker 1: And yeah, we're glad you stuck with us. Everybody, we'll
Speaker 1: see on discord. And that's all that happened in the
Speaker 1: last two weeks and we'll see you next week on
Speaker 1: Security this week, Bye bye guys,