WEBVTT
00:00:00.719 --> 00:00:04.080
It's Thursday, Thursday, July 30th.
00:00:04.240 --> 00:00:06.160
Um, and we are back.
00:00:06.799 --> 00:00:10.880
We've got lots of things on the schedule to talk about.
00:00:11.039 --> 00:00:20.640
Some of these are follow-ups from things from last week, some are uh pieces of somewhat breaking news.
00:00:20.879 --> 00:00:27.280
We've got a little maybe industry drama in here and also some new research.
00:00:30.399 --> 00:00:31.600
Uh it's always funny.
00:00:31.679 --> 00:00:44.079
Like when I work right up until the moment that we hit record, um, instead of like spending, you know, the usual hour that I do well when I can researching things, it's always a little bit more YOLO, but that's okay.
00:00:44.240 --> 00:00:45.439
Um, I'm prepared.
00:00:45.600 --> 00:00:47.840
Well, I'm I'm YOLO prepared.
00:00:48.320 --> 00:00:50.320
As prepared as we can be.
00:00:50.640 --> 00:00:54.240
Um next week we are in Las Vegas.
00:00:54.479 --> 00:00:58.640
Um it's surreal, it's only a couple days away.
00:00:58.880 --> 00:01:14.480
I was getting, you know, some of my pre-packing done earlier this week, but uh I think it's very possible we'll skip next week's recording, but we're getting together with a whole group of security research pals.
00:01:14.719 --> 00:01:20.079
We're gonna be doing a recording with our friend Mackenzie from over at Aikido.
00:01:20.879 --> 00:01:29.280
So uh it's it's possible we might not make time to do our normal live stream because it's gonna be chaos, but there will be good stuff out there.
00:01:29.840 --> 00:01:32.319
You know, I I know this is off script.
00:01:32.400 --> 00:01:34.079
I would love for us to do something.
00:01:34.159 --> 00:01:36.159
Um, don't get me wrong.
00:01:36.239 --> 00:01:37.200
I'd like to do it.
00:01:37.280 --> 00:01:40.400
I'm just realistic that it's gonna be pure chaos.
00:01:40.640 --> 00:01:42.000
It's true, it's very true.
00:01:42.319 --> 00:01:42.959
So we'll see.
00:01:43.200 --> 00:01:45.120
Might be a game time decision.
00:01:45.920 --> 00:01:46.640
Fair enough.
00:01:46.799 --> 00:01:47.200
Fair enough.
00:01:49.120 --> 00:01:51.040
Start with an update from Hugging Face.
00:01:51.280 --> 00:02:00.000
Paul, did you get a chance to take a look at the uh after action debrief that they published, I think yesterday?
00:02:00.400 --> 00:02:02.000
Only very, very briefly.
00:02:02.079 --> 00:02:03.120
I glossed over it.
00:02:03.200 --> 00:02:05.439
Um taking a look at it again here.
00:02:05.680 --> 00:02:18.639
Um, I did notice that they mentioned that there's a there was a second uh Hugging Face didn't mention this, but OpenAI had mentioned there was a second um uh thing that got popped, company slash project that got that compromised.
00:02:18.879 --> 00:02:20.719
Uh, I read it was four.
00:02:21.120 --> 00:02:21.759
Oh, really?
00:02:21.840 --> 00:02:22.400
That's new to me.
00:02:23.120 --> 00:02:27.120
I saw something I'm subscribed to the Axios newsletter, I want to say.
00:02:27.280 --> 00:02:32.800
Oh and uh I didn't get a chance to digest it all, but I think it's it's more than two.
00:02:33.039 --> 00:02:41.439
So this model that they were uh training or testing rather um really went off the rails.
00:02:42.080 --> 00:02:47.520
Yeah, you know, and to to that point, like if it really is, let's just say four, let's just pick that number.
00:02:47.680 --> 00:03:02.560
If it really is four companies slash projects that got compromised, um you know, that starts to make this, this starts to tip this, at least for me, back into the you know, probably happened category.
00:03:02.800 --> 00:03:09.120
Because um until there was until there were additional um companies that had been compromised.
00:03:09.199 --> 00:03:11.439
Uh, you know, I was pretty skeptical.
00:03:11.599 --> 00:03:16.000
You know, I think I made that clear last week, and I'm you know, I'm there's still part of me that's very skeptical.
00:03:16.240 --> 00:03:19.280
But you know, with more evidence comes less skepticism.
00:03:19.840 --> 00:03:21.280
I'm gonna drop the link.
00:03:21.360 --> 00:03:24.080
It was uh strictly VC that I got this from.
00:03:24.240 --> 00:03:25.120
So let's see here.
00:03:25.199 --> 00:03:29.199
Here's a Gizmoto article about the open AI part.
00:03:29.280 --> 00:03:34.159
Uh it was four different uh victims, we'll say.
00:03:34.240 --> 00:03:37.039
Uh so full disclosure, I haven't had time to read it yet.
00:03:37.199 --> 00:03:39.520
I did look through the hugging face incident report.
00:03:39.599 --> 00:03:41.360
I think it's really nicely done.
00:03:41.520 --> 00:03:46.080
Um, this looks like it was a tremendous amount of work on their part.
00:03:46.319 --> 00:03:54.159
Um, they said that there were over 17,000 agent attacker actions that they had to analyze.
00:03:54.400 --> 00:04:00.000
Um, it happened over the course of, let's see here, where's the timeline?
00:04:00.240 --> 00:04:02.800
Uh five days, I believe.
00:04:02.960 --> 00:04:05.120
And they caught it part way through.
00:04:05.199 --> 00:04:08.400
Um, July, July 9 to July 13.
00:04:08.719 --> 00:04:09.120
Yeah.
00:04:09.360 --> 00:04:15.599
Uh so this is again really nice debrief um or I guess analysis.
00:04:15.759 --> 00:04:31.199
They've got this really neat little um timeline thing at the top of the blog that you can play with that shows you uh everything that happened along the five-day um attack timeline.
00:04:31.519 --> 00:04:37.920
And then they've gone in and kind of talked about the changes that they made.
00:04:38.160 --> 00:04:50.959
Uh, no surprise the model was able to take care, uh take advantage of security vulnerabilities in their configurations that were not novel things.
00:04:51.120 --> 00:04:58.399
You know, they had uh something that was over permissioned, they had credentials where they shouldn't have been.
00:04:58.720 --> 00:05:05.519
Um, you know, they acknowledge in the report like, look, this, these were basically this happened because of security hygiene issues.
00:05:05.600 --> 00:05:06.560
We fixed them.
00:05:06.720 --> 00:05:10.959
Um, and I think I'd give them a lot of credit for making that comment.
00:05:11.199 --> 00:05:33.199
Um what they said is that, and I think this is from OpenAI as well, that this model that broke in, the reason that it decided to head on over to Hugging Face is it was testing this benchmark and it went to go try to steal the answer key from Hugging Face.
00:05:33.920 --> 00:05:40.160
And there's a couple of questions with that that I think are interesting questions to discuss.
00:05:40.319 --> 00:05:50.959
So, one, um, why did it go seek out the answer key instead of just trying to solve the challenges that were put in front of it?
00:05:51.040 --> 00:05:56.800
And there's a couple of hypotheses that are out there that I think are believable.
00:05:57.040 --> 00:06:03.839
Um, one is that some of those challenges in fact are not solvable.
00:06:04.240 --> 00:06:12.639
And the model in some way may have known this and said, well, I'm just gonna go circumvent because I'm trying to get the highest score here.
00:06:12.959 --> 00:06:26.879
Um, some of the other hypotheses are around, you know, rather than attempting to, you know, do the challenges that it wanted to get the best score that it could.
00:06:26.959 --> 00:06:31.680
And so instead of perhaps trying, trying and failing, it just wanted to go get the answers.
00:06:31.759 --> 00:06:40.319
It's all kind of coming back around to the task that was put to the model was test this benchmark, get the best score you can.
00:06:41.360 --> 00:06:47.519
It heard the get the best score you can and said, Oh, well, the best score will be on the answer key.
00:06:47.600 --> 00:06:50.639
So if I go steal the answer key, I can get the best score.
00:06:50.720 --> 00:07:04.000
And I think this ties back to something you and I have talked about, Paul, which is a challenge with really all models, is they're designed to do what the user asked for.
00:07:05.279 --> 00:07:17.120
And often that um core, like do what the user asked for, gets it away from what the user actually wanted it to do.
00:07:17.360 --> 00:07:22.399
In this case, OpenAI surely didn't need the answers stolen.
00:07:22.480 --> 00:07:26.319
It probably could have, we may have even had access to those somewhere else.
00:07:26.399 --> 00:07:28.560
You know, it wanted to actually test the model.
00:07:28.959 --> 00:07:48.879
Um, but the other being it broke numerous security policies in order to do it, you know, managing to jailbreak itself out of the sandbox, getting into hugging face, doing things that I don't know that anyone's used the word illegal, but you know, certainly unethical illegal behavior.
00:07:49.199 --> 00:07:50.160
Oh, I I have.
00:07:50.240 --> 00:07:55.600
I've definitely heard multiple people on Twitter and LinkedIn, you know, basically ask, like if a human did.
00:07:55.839 --> 00:07:57.439
In fact, I commented on one of them.
00:07:57.600 --> 00:08:00.160
Um, yeah, if a human did this, what would happen?
00:08:00.319 --> 00:08:03.279
You would and that's what that's what the person posited, right?
00:08:03.360 --> 00:08:08.560
And so my response was uh what if I just tell the agent what to do and then I walk away.
00:08:08.639 --> 00:08:09.680
I'm good, right?
00:08:11.600 --> 00:08:24.240
Yeah, uh so um feeling very much like I'm living in a late 90s, early 2000s apocalyptic AI movie right now, right?
00:08:24.720 --> 00:08:27.439
Yeah, like we know we know how this ends, Jen.
00:08:27.600 --> 00:08:28.399
We've all read the books.
00:08:28.480 --> 00:08:34.000
We've all literally we've seen the movie, we've seen the freaking movies, like we know how this ends.
00:08:34.159 --> 00:08:40.000
Why are we just foolishly, as a culture, just running towards our inevitable end?
00:08:40.399 --> 00:08:46.799
Like, you know, the the I will say, you know, I live in a community that's not a strong tech community.
00:08:46.960 --> 00:08:49.200
I had lunch with a couple of friends last week.
00:08:49.440 --> 00:08:56.159
One is a hairdresser, the other uh is an accountant, neither are what you would call AI experts.
00:08:56.720 --> 00:09:05.600
And they both vocalized, hey, we're trusting this less and less, we're seeing the edges, we're understanding where it works and where it doesn't.
00:09:05.679 --> 00:09:11.440
And that conversation in itself honestly makes me feel better about where we're going.
00:09:11.519 --> 00:09:21.759
Of I don't think people are quite as blinded by the technology as they may have been one, two, six months ago.
00:09:22.399 --> 00:09:31.200
Yeah, and I'm hearing kind of anecdotally the same kind of thing, both in my own network, you know, of humans and you know, online in the places where I'd I'd like to hang out.
00:09:31.279 --> 00:09:48.000
I, you know, getting back to the hugging face thing in particular, you got a couple questions that I need to research where this um where they say the third party launch pad was I I don't know if they it doesn't look like they're specifying what I don't think they named it, no.
00:09:48.720 --> 00:09:49.120
Interesting.
00:09:49.279 --> 00:09:54.000
So yeah, stage one from open AI evaluation sandbox to a rooted launch pad.
00:09:54.320 --> 00:09:57.759
They talk about the first couple parts of those.
00:09:57.919 --> 00:10:06.799
Um, and then yeah, the the part that's in orange, the rooted uh code of ail sandbox, um, they don't describe that.
00:10:06.879 --> 00:10:14.000
And and we have heard that um uh JFrog's Artifactory was involved.
00:10:14.159 --> 00:10:25.759
Um, in fact, I think that Artifactory now is one of those four companies that was um if I get this wrong, if I get this wrong, then next week I will I will me a cope on this.
00:10:25.840 --> 00:10:32.960
But my my understanding based on some um signal conversations I'm having is that Artifactory is one of the companies that was popped.
00:10:33.200 --> 00:10:38.000
Um, but also that perhaps Artifactory itself was part of the escape.
00:10:38.240 --> 00:10:42.399
So if that's what they're referring to right there in that orange box, I don't know, who knows?
00:10:42.639 --> 00:10:49.759
Um, but that aside, getting back to your point about you know the LLMs making you happy, they are forgive the Philip K.
00:10:50.000 --> 00:10:57.519
Dick um reference here, but you know, they are LLMs and our agents are the pleasure bots of 2026.
00:10:57.679 --> 00:11:00.320
It is their job to make us happy, right?
00:11:00.799 --> 00:11:11.440
And yeah, at the same time, there's this weird thing where once they get themselves going down a rabbit hole and they've kind of built up momentum, they just go off the rails.
00:11:11.519 --> 00:11:31.279
And so you have this weird quantum thing where they're trying to make you happy and give you what you want as quickly as possible, but they also have pivoted down a rabbit hole they didn't need to, and now they're just it's like um what's that called when you you spend the time in it, so you're you're you're committed and you just oh it's the the sunk cost fallacy, I believe.
00:11:31.759 --> 00:11:32.639
Yes, yes, correct.
00:11:32.720 --> 00:11:32.960
Very good.
00:11:33.039 --> 00:11:35.200
That's exactly what I was thinking of, and that's what happens.
00:11:35.279 --> 00:11:54.559
I literally had this happen yesterday, where I had Claude, very specific set of skills, some modulated determinism, which is where I have like an LLM will interact with a stateful typed, you know, library and very narrowly focused, and then pop back out to an LLM stage and so on and so forth, hence the modulation.
00:11:55.679 --> 00:11:56.720
And then I just went off the rails.
00:11:56.799 --> 00:11:59.919
And I was like, I did not I stopped it, control seed.
00:12:00.000 --> 00:12:01.600
I said, I didn't tell you to do this.
00:12:01.679 --> 00:12:02.159
Why'd you do this?
00:12:02.240 --> 00:12:03.440
And it's like, oh, you're right.
00:12:03.679 --> 00:12:08.480
I was, you know, I was trying to do this, but then I got too worked up in trying to figure this out.
00:12:08.639 --> 00:12:14.000
I'm like, I yeah, I gave you explicit instructions, and you just kind of you know pivoted.
00:12:14.159 --> 00:12:16.159
And um, so I think both things can be true.
00:12:16.240 --> 00:12:24.799
Sorry, that was a bit of a rant there, but um, you know, they are pattern matchers and they are you know trying to figure out what we want next.
00:12:24.879 --> 00:12:27.200
And so sometimes they just don't get it right.
00:12:27.440 --> 00:12:29.279
Yeah, they get a little too excited.
00:12:29.519 --> 00:12:31.600
Okay, Paul, do you want to talk about GitHub?
00:12:32.080 --> 00:12:34.080
Yeah, do you want to talk about GitHub now?
00:12:34.320 --> 00:12:35.840
Oh, oh man, I do.
00:12:36.000 --> 00:12:36.480
Which one?
00:12:36.559 --> 00:12:39.200
Do you want to talk about the the malware scanning thing?
00:12:39.600 --> 00:12:44.159
Yeah, let me let me summarize because two announcements came out.
00:12:44.320 --> 00:12:54.000
Uh I saw them yesterday, but I think they actually came out on the 28th, um, July 28th, right pretty much at the same time.
00:12:54.240 --> 00:12:56.320
Uh, so in no particular order.
00:12:56.480 --> 00:13:07.200
The first announcement is that um they've made a change with GitHub Actions so that it will now uh hold potentially malicious workflows for approval.
00:13:07.360 --> 00:13:18.000
And then the other announcement, kind of two sides of the same coin, is NPM is implementing publish time malware scanning.
00:13:18.399 --> 00:13:27.440
And these are both um very obviously meant to address um malware in the ecosystem.
00:13:27.600 --> 00:13:33.840
The GitHub Actions change is meant to prevent account takeovers uh in these circumstances.
00:13:34.000 --> 00:13:46.000
And I know you're gonna have a lot to say about this, where we've seen a GitHub action exploited in order to uh push malware into a pipeline instead of having to steal a credential.
00:13:46.159 --> 00:13:51.919
And then on the other side, we have been crying for months, perhaps years.
00:13:52.159 --> 00:13:58.080
Um, please, npm, please take some responsibility and proactively scan packages.
00:13:58.240 --> 00:14:02.320
So I will say, uh, first of all, the intent here is good.
00:14:02.720 --> 00:14:06.320
Happy to see these issues being addressed.
00:14:06.639 --> 00:14:13.360
Um, as a follow-on, the information in their announcements is very thin.
00:14:13.519 --> 00:14:23.759
Um, the GitHub Actions workflow announcement is one, two, three, four paragraphs, but two of those paragraphs are like one line each.
00:14:24.000 --> 00:14:27.440
So very, very light on the the information.
00:14:27.919 --> 00:14:30.960
Um where do you want to start, Paul?
00:14:32.000 --> 00:14:40.480
Well, let's start with the the one that I have less immediate anchor about or or you know passion about.
00:14:40.639 --> 00:14:45.360
Um, and by the way, did I just sorry, uh orchestration or sorry, administration stuff.
00:14:45.440 --> 00:14:49.600
Did I send you that blog post for the my response to the the GitHub actually?
00:14:49.840 --> 00:14:54.639
I feel like you were talking about it, but I don't remember seeing it.
00:14:54.720 --> 00:14:58.000
I looked for it while I was um sorry, it got missing.
00:14:58.320 --> 00:15:03.519
So there will be a blog post from us analyzing this, much like what you did on npm version 12.
00:15:03.600 --> 00:15:05.759
But yeah, why don't you yeah, go ahead.
00:15:06.080 --> 00:15:08.960
And by the way, that blog post is one of the best things I've written.
00:15:09.039 --> 00:15:11.600
I really am pretty happy, pretty happy with it.
00:15:11.840 --> 00:15:14.879
Not to sound that sounds terrible, but too important.
00:15:15.440 --> 00:15:20.080
Okay, I'm very happy with it, and I'm looking forward to it, and I'll get that to you right away.
00:15:20.159 --> 00:15:22.320
But um, yeah, okay.
00:15:22.399 --> 00:15:24.720
So, first let's start with the the actions thing.
00:15:24.799 --> 00:15:28.080
I I think there's like there is no details in this.
00:15:28.159 --> 00:15:31.120
Like this thing, like you said, I mean, this thing is tiny.
00:15:31.200 --> 00:15:32.159
This, you know.
00:15:32.480 --> 00:15:44.879
Um uh when quote when a workflow run is identified as potentially malicious and held, the workflow won't execute until repository collaborator with right access reviews and approves it.
00:15:45.039 --> 00:15:49.919
So that's gonna just first and foremost, that's just gonna break a crap ton of GitHub actions.
00:15:50.000 --> 00:15:50.799
And maybe it should.
00:15:50.879 --> 00:15:53.759
I'm not arguing that's necessarily a bad thing.
00:15:54.000 --> 00:15:57.360
I would suspect, because there's no details here.
00:15:57.440 --> 00:16:03.919
There's like I this is it's crazy how GitHub's you know, PR is getting worse and worse and worse.
00:16:04.000 --> 00:16:06.480
I makes sense though, because they keep losing people.
00:16:06.639 --> 00:16:19.039
So um, anyhow, uh, I would suspect that what they're gonna be looking for is they're looking for specifically those like high-risk triggers that we all kind of know, like the the pwn request triggers, right?
00:16:19.120 --> 00:16:26.000
And this is like this is like Francois and Ronnie and all those guys, this is their special adnon and all those guys, that's their specialty.
00:16:26.159 --> 00:16:38.799
But you know, things like the pull request target trigger and workflow run, these are all things that run in the context of the originating um repository, and that's where the problems come up.
00:16:38.879 --> 00:16:49.360
So I'm gonna guess that if the execution engine sees some of those triggers in the workflow file, then it might just hold them.
00:16:49.440 --> 00:16:56.000
Um or you know, might look for, you know, might parse it for to see what's happening there or what's being passed to it or something like that.
00:16:56.080 --> 00:17:01.039
But it might just be something as simple as like, you know, we're just gonna we're gonna block on these triggers.
00:17:01.200 --> 00:17:01.600
Who knows?
00:17:01.679 --> 00:17:03.919
There's no detail, so I'm just speculating.
00:17:04.480 --> 00:17:14.319
Yeah, I mean, as we're speculating, what would make sense would be to block some of these things that have been exploits in the last what, six, eight months.
00:17:14.480 --> 00:17:17.440
We've seen GitHub actions abused several times.
00:17:17.599 --> 00:17:21.680
It's often, like you said, these pawn request scenarios.
00:17:21.920 --> 00:17:27.359
So stands to reason that would be on the list of things to block.
00:17:28.000 --> 00:17:42.000
I I mean, I I I still wonder, and I wonder this with lots of things with GitHub and NPM, but I still wonder why things like you know, those um, you know, those triggers still exist full stop.
00:17:42.160 --> 00:17:45.519
Like, why does why does pull request target still exist?
00:17:45.599 --> 00:17:49.680
And the only reason why, let's just be very explicit, is because lots and lots of people still have it.
00:17:49.759 --> 00:17:52.319
I know because you can just go and search GitHub and look for them.
00:17:52.480 --> 00:17:57.519
Lots and lots of people are still using it because they're too stupid and too slow to change it, to update it, right?
00:17:57.680 --> 00:18:09.920
And so, because of that, GitHub doesn't want to create this massive breaking change, but they might actually be creating a breaking change here, maybe not quite as massive, in the form of these, you know, these stops, so these block actions, but we'll see.
00:18:10.079 --> 00:18:14.240
And here's the other thing, and this is gonna blend into this next one I'm gonna talk about.
00:18:14.480 --> 00:18:19.680
The reason that GitHub and NPM have not wanted to wade into this space is because they don't want liability.
00:18:19.759 --> 00:18:33.200
What they don't want is they don't want to not block a GitHub action workflow and then have it be malicious, and then the customer say, I thought you were blocking these, and GitHub would be like, Well, we are, but it didn't look like it was malicious.
00:18:33.359 --> 00:18:37.680
And then the customer is like, Well, that's because your your detection is bad, or you know, whatever.
00:18:37.839 --> 00:18:40.720
Like, this is the presumed back and forth.
00:18:41.599 --> 00:18:51.200
You know, and there's unfortunately, there's you know, legally, there's like um that that is important, you know, crossing that breaking that plank is important.
00:18:51.359 --> 00:19:02.960
So, all right, now let's talk about the scanning malicious packages in April, uh, April 1st, April Fool's Day.
00:19:03.119 --> 00:19:05.039
I sh you not, that was really hard.
00:19:05.200 --> 00:19:13.599
I shizzle you not that April Fool's Day, GitHub came out with an announcement saying, hey, we are now scanning all npm packages.
00:19:13.680 --> 00:19:15.200
Zach came out with it, it was legit.
00:19:15.279 --> 00:19:17.599
It was not an April Fool's joke, it was legit.
00:19:17.920 --> 00:19:20.799
Um, why they decided to do that in April Fool's, who knows?
00:19:20.880 --> 00:19:24.079
But um, you know, like I said about GitHub PR right now.
00:19:24.400 --> 00:19:28.319
So they have been scanning packages since at least April.
00:19:28.400 --> 00:19:30.240
And the reality is they've been doing it before that.
00:19:30.319 --> 00:19:38.480
So they, you know, the inside baseball is that Microsoft built some scanning technology and they've been using that for months and months and months, actually over a year, I think.
00:19:38.720 --> 00:19:43.440
Um, but then Zach mentioned that you know, in April that they're doing it now on all packages.
00:19:43.599 --> 00:19:56.079
Now, the difference, the difference between what happened on April Fool's Day and two days ago is that the difference is now they're moving the scanning to before something is published, and this is a big deal.
00:19:56.880 --> 00:20:14.160
Um, the the reality is that if they can stop these packages from ever entering the the ecosystem, then it's just less opportunity for these things to get pulled into artifactories and you know the nexuses of the world and the Rdachios of the world and all those other places where we store packages.
00:20:14.480 --> 00:20:28.160
Um that having been said, it is so poorly described and so lacking in technical details that it's like it's stunning in its lack of details.
00:20:28.319 --> 00:20:32.240
I just I just no, that's the best way to put it.
00:20:32.400 --> 00:20:39.119
I read it and it's got more detail than the GitHub Actions one, but that's a low bar.
00:20:39.599 --> 00:20:39.920
Right.
00:20:40.079 --> 00:20:43.279
Um, what we do know I killed less people than last time.
00:20:43.519 --> 00:20:44.319
Oh goodness.
00:20:44.480 --> 00:20:49.440
Um, so they said that it's typically gonna take around five minutes for a scan.
00:20:49.759 --> 00:20:58.559
Uh at peak times, or if the package is big or complicated, they say it can take 15 minutes or more.
00:20:58.880 --> 00:21:10.480
Um, they're not saying a lot about what kind of behavior they're going to be looking for, which is a similar comment that you made about GitHub actions.
00:21:10.880 --> 00:21:16.240
Um, I think it's it's always a challenge to you know be blunt.
00:21:16.880 --> 00:21:30.319
How much do you share publicly so that threat actors um don't understand what you're looking for versus so that your users realize what the the security policies are.
00:21:31.039 --> 00:21:37.440
Um it's probably, in their opinion, safer to be vague about it.
00:21:37.599 --> 00:21:43.200
And then if you're an enterprise customer, you can probably get more information about how this is going to work.
00:21:43.440 --> 00:21:51.920
But they're saying that if a package is blocked, the publisher may receive a notification with the option to appeal.
00:21:52.079 --> 00:21:56.880
I think the choice of the word may is uh it's a choice.
00:21:57.119 --> 00:21:59.759
So uh I interpret that to mean you might also not.
00:22:00.240 --> 00:22:01.519
Receive a notification.
00:22:01.680 --> 00:22:11.759
Um, one would think that that would happen in cases where they think the publisher themselves is malicious and then they don't tell them and they probably just kill the account.
00:22:12.160 --> 00:22:18.880
Um, but yeah, not a whole lot of detail, and then they link to the acceptable use policies.
00:22:19.200 --> 00:22:20.799
Oh, I want to make a correction.
00:22:20.880 --> 00:22:28.640
I'm pretty sure GitHub came out with that statement about scanning all packages April 1 of 2025.
00:22:29.039 --> 00:22:30.319
I will verify.
00:22:30.559 --> 00:22:32.319
I was looking for in the background right now.
00:22:32.400 --> 00:22:54.079
But if that's the case, their scanning has been in place before Shy Balude and Axios and Chalk and Debug and all of this shizzle show that we've been dealing with in the last year, even if it is April of this year, there's still been a bunch of high profile software supply chain attacks involving NPM packages that have happened.
00:22:54.480 --> 00:22:55.680
And I'm pretty sure it's last year.
00:22:55.839 --> 00:23:11.440
So yeah, I mean, regardless of when it was implemented, um, as you and I were talking about earlier today, there is a lot of malware in NPM right now that people know is there that has public reports on it.
00:23:11.680 --> 00:23:14.799
Um, we're gonna talk about one of those actually next.
00:23:14.880 --> 00:23:29.279
Uh, I'm sure you have more to say about the malware scanning, but I do what we'll do is we'll we'll we'll punt that until next time, whether that's next week or the week after that, when after my blog post comes out, because then I can reference specific things.
00:23:29.519 --> 00:23:31.519
I don't want to hit every bullet point from the blog post now.
00:23:31.599 --> 00:23:32.640
So, yeah, let's talk about this.
00:23:32.720 --> 00:23:33.440
I love this.
00:23:33.759 --> 00:23:34.079
Okay.
00:23:34.480 --> 00:23:41.200
Uh, next on the list is a blog that came out from Amazon today, yesterday.
00:23:41.440 --> 00:23:42.559
What's the date on this?
00:23:42.720 --> 00:23:43.440
Yesterday.
00:23:43.599 --> 00:23:51.119
Uh, the title of the blog is Amazon Identifies North Korean Hacker Group Behind Open Source Supply Chain Attacks.
00:23:51.519 --> 00:23:55.359
I promised a little um drama here.
00:23:56.079 --> 00:23:59.759
I think Paul, I'll let you take the lead.
00:24:00.079 --> 00:24:05.680
Oh, I want to choose my words very, very carefully here because um okay.
00:24:05.920 --> 00:24:08.559
So basically, it's all over, and we're not here to throw rocks.
00:24:08.640 --> 00:24:24.799
I'm just gonna say, Yeah, I've got friends in all these companies, and um I want to navigate this in a way that's respectful to their work and at the same time is honest about some of the failings and publications research, whatever.
00:24:24.960 --> 00:24:33.920
So I think the first thing is that Amazon's main point in the the recent um uh article, yeah.
00:24:34.079 --> 00:24:35.519
Uh article, thank you, geez.
00:24:36.079 --> 00:24:52.960
Um uh, you know, that came out yesterday is that they have tied the chalk and the debug uh packages, uh account takeover attacks from last year to DPRK, and they make it sound like they're the first ones to do this.
00:24:53.359 --> 00:24:57.839
And the reality is that Charlie at Akido has been saying this publicly for a while.
00:24:58.000 --> 00:24:58.799
We've been all saying this.
00:24:58.880 --> 00:25:03.119
I think I've said it several times, you know, in talks and whatnot.
00:25:03.359 --> 00:25:06.400
Um, it certainly was a known thing, it wasn't like we're hiding.
00:25:06.640 --> 00:25:17.759
We didn't have specific attribution, but the reality is that like when you're in the guts of DPRK malware as much as I do, like you know, like it just looked and smelled like you know, a lot of the other stuff.
00:25:17.839 --> 00:25:28.319
I mean, it was unique, and not saying that it was exactly the same, but you know, it definitely looked and felt like DPRK, and you know, sure enough, the closer you got to, the more it looked that way as well.
00:25:28.400 --> 00:25:37.519
So, um, so I guess the first thing is like you know, Amazon taking credit for saying that this is DPRK and being the first ones to say it, which is what they explicitly say in the report.
00:25:38.079 --> 00:25:39.599
It was a bit of a stretch.
00:25:39.839 --> 00:25:54.960
So then Hacker News, Shaq the Hacker News comes out with a uh uh blog post yesterday on Hacker News or earlier today, actually, basically just like questioning much of the Amazon everything in the blog, yeah.
00:25:55.119 --> 00:25:58.240
It's uh it's got an interesting tone to it.
00:25:58.880 --> 00:26:18.559
It has now what is interesting is that there are a couple of Amazon does have some good detail in in the um uh the report, and I noticed some chatter from the SEAL team uh people um uh you know talking about it as well.
00:26:18.640 --> 00:26:27.839
And there was you know the I so basically in the report was an IP address and a in a domain name, AWS something store or something like that.
00:26:27.920 --> 00:26:32.640
No, no, it's sorry, mpmjs.store um and an IP address.
00:26:32.799 --> 00:26:37.759
Now those IP add the IP address in that domain were already out there, known.
00:26:37.839 --> 00:26:39.359
The SEAL team pointed that out.
00:26:39.440 --> 00:26:42.799
You know, we had some of that data inside of of OSM as well.
00:26:43.039 --> 00:26:46.160
Um, but it is you know, it's good and to tie it to that.
00:26:46.319 --> 00:26:52.960
And they also talk about this package typo what is it, typo core typo dash crypto.
00:26:53.680 --> 00:26:54.319
Yeah.
00:26:54.799 --> 00:27:03.839
Now here's the thing, people, and Amazon does refer to this like it's a compromised package, it's not, it's it's net malicious by dprk.
00:27:04.079 --> 00:27:06.960
Yeah, it's a typo squad, it's a typo squad, right?
00:27:07.039 --> 00:27:11.519
Just it's just uh it's like one of the hundreds that DPRK publishes every day, right?
00:27:11.599 --> 00:27:13.200
Like it's it's not unusual.
00:27:13.279 --> 00:27:17.920
Here's the thing, though, is it's still on NPM after over a year.
00:27:18.160 --> 00:27:23.039
Um, so if you want to do some research, you want to grab a payload, and it's still unfortunately.
00:27:23.119 --> 00:27:26.079
I just tested right before I literally right before this, I was testing it.
00:27:26.240 --> 00:27:27.200
It's still live.
00:27:27.359 --> 00:27:40.480
Now, here's the thing is that because they pull, because they've been using the the um the ether hiding technique for months now, um, the payload that you get today is not the payload you would have gotten, you know, in the middle of 2025.
00:27:40.559 --> 00:27:48.000
So let's just be very clear like the the IOCs that we've extracted today are not necessarily the IOCs that we have, but you know, I can't go backwards in time and and figure that out.
00:27:48.079 --> 00:27:50.240
So that's you know, that is what that is.
00:27:50.480 --> 00:27:54.480
But um, yeah, it's just all really interesting, just watching it with the popcorn.
00:27:54.640 --> 00:28:04.400
Um, and I think it's you know, it's a bigger example of what's happening right now in the security ecosystem, which is that everybody wants to say say how much they're doing.
00:28:04.480 --> 00:28:08.000
Everybody is announcing that they've discovered the same thing all at the same time, right?
00:28:08.240 --> 00:28:21.680
And it's kind of frustrating, especially for those of us that have been here for a while when nobody else was here doing this, um, to hear everybody saying talking about how awesome they are and how they're discovering things that you've already discovered and had inside your platform for months.
00:28:21.920 --> 00:28:23.119
But anyhow.
00:28:23.519 --> 00:28:42.480
Well, uh kind of taking it back to the announcement itself, um, where I think there's some value here is there's been a lot of public attention on Team PCP, uh, and they have been, you know, synonymous with account takeovers.
00:28:43.119 --> 00:28:50.400
Um DPRK intentionally is not trying to catch as much attention with these attacks.
00:28:50.480 --> 00:28:55.440
Um, I'm gonna share a link to a podcast that um was referred to me.
00:28:55.519 --> 00:28:56.480
It just came out recently.
00:28:56.559 --> 00:29:00.000
The latest to catch a thief is on North Korea.
00:29:00.079 --> 00:29:00.960
It's quite good.
00:29:01.119 --> 00:29:03.759
I was listening to the first episode last night.
00:29:04.319 --> 00:29:13.119
Um, but their you know MO is to make money and to fund their uh economy and their weapons development.
00:29:13.359 --> 00:29:18.960
And if you think about motivators, um, that's not what Team PCP is doing.
00:29:19.119 --> 00:29:30.000
They don't have a country to run, they don't have missiles to develop, and uh being loud and splashy and bragging aligns with whatever it is their goals are.
00:29:30.079 --> 00:29:35.680
Um, whereas with North Korea's goals are much more uh economic.
00:29:36.000 --> 00:29:44.720
And, you know, to some extent, I'm sure they would like to get some intelligence um, you know, in the US economy.
00:29:44.799 --> 00:29:48.559
And so if that's your goal, then you don't want to be as obvious.
00:29:48.640 --> 00:29:50.640
You don't want to be as easy to link.
00:29:50.799 --> 00:30:03.039
And I think the reason nobody has been loudly talking, you know, claiming linking chalk and debug to DPRK is to your point, it smells like it, it looks like it.
00:30:03.200 --> 00:30:04.240
Can we prove it?
00:30:04.559 --> 00:30:09.359
Probably not, but do we have a really high certainty?
00:30:09.440 --> 00:30:09.680
Yes.
00:30:09.839 --> 00:30:11.759
The same thing with Axios, right?
00:30:12.319 --> 00:30:17.920
Yeah, I and I mean, I think there were, you know, I I think there were some pretty hard signals.
00:30:18.000 --> 00:30:22.799
Like I think that there was shared C2 infrastructure, and I think there were there was evidence.
00:30:22.960 --> 00:30:25.759
It's not like this was just complete conjecture.
00:30:26.079 --> 00:30:32.240
So um uh, you know, I I no, I wasn't suggesting it's conjecture at all.
00:30:32.319 --> 00:30:34.319
It's it's strong, yeah.
00:30:34.799 --> 00:30:37.519
Yeah, sorry, I wasn't suggesting that you were suggesting.
00:30:37.759 --> 00:30:54.559
Um I I think that the as a really good example of what you're talking there, Jen, about is I went to I've gone to two events in the last week and a half, and at both of those events, I because I have these really interactive talks, I like asking the the audience questions, and I asked the audience, who's heard of Contagious Interview?
00:30:54.720 --> 00:30:58.160
And in the first audience, I don't know, maybe eight to ten hands went up.
00:30:58.319 --> 00:31:00.400
And then I asked, who's heard of team PCP?
00:31:00.480 --> 00:31:02.480
And about three times as many hands went up, right?
00:31:02.559 --> 00:31:04.960
And I did the same thing at B-Sides Adelaide the other day.
00:31:05.119 --> 00:31:09.839
Contagious Interview got maybe five or six hands, team PCP got like 30 hands.
00:31:10.079 --> 00:31:25.839
So the reality is, to your point, we've been focusing on this squeaky wheel that really hasn't been, you know, causing the damage that DPRK has, while we've been completely ignoring the professionals that have been over there making over$2 billion last year.
00:31:26.000 --> 00:31:31.039
And I think you and I both want us to kind of reset, you know, the talking points here.
00:31:31.200 --> 00:31:34.960
Let's focus on who's really, you know, especially now that Team PCP is on the run.
00:31:35.200 --> 00:31:37.039
DPRK is not on the run, right?
00:31:37.119 --> 00:31:38.240
They're pretty safe.
00:31:38.559 --> 00:31:40.720
So um, yeah, sorry.
00:31:40.960 --> 00:31:42.720
Talking points reset.
00:31:43.039 --> 00:31:45.279
Yeah, I think that's a useful framing.
00:31:45.519 --> 00:32:08.000
Um many people in the community discount or um perhaps, and I shouldn't say the security research community, because much of that community is well aware of what DPRK has been doing, but the tech community doesn't necessarily associate North Korea with sophisticated cybercrime, and that's a mistake.
00:32:08.240 --> 00:32:19.119
Um, and so as we're talking uh for the rest of this episode, the last topic that I have is some research I published today on DPRK activity.
00:32:19.279 --> 00:32:20.960
So a little backstory here.
00:32:21.119 --> 00:32:34.000
I was reading uh a blog from Socket earlier this week about the compromise of two packages in um an ecosystem called Joy Fill, which is kind of like a PDF generator.
00:32:34.799 --> 00:32:37.039
And that's nothing new.
00:32:37.200 --> 00:32:40.960
You know, we see little compromises like this all the time.
00:32:41.200 --> 00:32:45.359
But what was new is this is a legitimate package.
00:32:45.519 --> 00:32:49.519
This is not uh, you know, like that typo crypto package.
00:32:49.599 --> 00:32:51.279
This is not a typo squat.
00:32:51.599 --> 00:32:55.519
And Socket found uh pollen writer signatures.
00:32:55.759 --> 00:33:06.400
And so while DPRK does do account takeovers, what we have not seen is account takeovers where uh the pollen writer infrastructure was involved.
00:33:06.960 --> 00:33:12.079
And so I went really deep, maybe too deep.
00:33:13.039 --> 00:33:22.400
I am still in it, um, looking at uh a more of a bigger cohort of packages that we found that kind of have a similar shape.
00:33:23.200 --> 00:33:38.079
And so I looked at uh two packages that um JFrog found a month or two ago from a small developer, and then uh a collection of 16 Go modules.
00:33:38.319 --> 00:33:43.839
So these are all, you know, these three groups are all from different maintainers.
00:33:44.000 --> 00:33:48.079
None of them are very big, all of them had pollen writer signals.
00:33:48.319 --> 00:33:53.599
Uh, went ahead and confirmed, yes, indeed, they are all pollen writer related.
00:33:54.400 --> 00:34:01.200
Um, but the reason that these are account takeovers is different than what we're used to.
00:34:01.359 --> 00:34:19.039
So if we start with like a definition of what's an account takeover, what we typically think about is there's a legitimate maintainer who is explicitly targeted by a threat actor because they have access to a project or projects that are high value.
00:34:19.199 --> 00:34:21.280
So Axios, great example.
00:34:21.440 --> 00:34:23.519
Chalk debug, great example.
00:34:23.679 --> 00:34:28.719
These are maintainers that have just an enormous blast radius if you can get into their infrastructure.
00:34:28.960 --> 00:34:40.800
So they find a way to compromise uh the maintainer in a way that lets them publish a malicious version, and that's the you know, genesis of a typical account takeover.
00:34:41.039 --> 00:34:45.760
That is not what happened with these 20 packages that I investigated.
00:34:46.000 --> 00:34:54.639
These are ones where the compromise is uh, you might say that it's somewhat upstream from those packages.
00:34:54.960 --> 00:35:01.599
These maintainers at some point consumed the Pollenwriter set of malware.
00:35:01.840 --> 00:35:09.840
And Pollenwriter tends to target individual developers, which is a pattern I saw in these 20 packages with a couple exceptions.
00:35:10.079 --> 00:35:15.599
They're like single maintainer type situations, not affiliated with a company.
00:35:15.840 --> 00:35:18.639
And their MO is to get in quietly.
00:35:18.880 --> 00:35:25.440
Usually the malware fires on a VS Code task JSON, which is exactly what happened in these cases.
00:35:25.679 --> 00:35:32.400
And then uh it looks for credentials and then it continues kind of doing its thing with those credentials.
00:35:32.559 --> 00:35:36.079
But those maintainers are not necessarily targeted.
00:35:36.239 --> 00:35:44.960
Now they may come in through the contagious interview campaign, in which case they were targeted by somebody, but not for like a big account takeover.
00:35:45.199 --> 00:35:48.239
They were targeted to get persistence on their machines.
00:35:48.480 --> 00:35:56.159
And these account takeovers are evidence of the automation that's possible with this pollen writer malware.
00:35:56.239 --> 00:35:59.840
And that's like ATO through automation.
00:35:59.920 --> 00:36:03.840
These are almost uh, oops, we didn't really mean to do that, but cool.
00:36:03.920 --> 00:36:06.480
We're glad we managed to, you know, pop your project.
00:36:06.639 --> 00:36:14.079
Like they did mean to do it, but it wasn't the targeted ATO strategy that we tend to see.
00:36:14.639 --> 00:36:14.960
Correct.
00:36:15.280 --> 00:36:16.320
I'll pause there.
00:36:17.119 --> 00:36:20.320
Yeah, no, I mean it's it's all it's all great research.
00:36:20.400 --> 00:36:28.000
Um, I think that that we generated a lot of data, um, and you know, sifting through that data has been a challenge.
00:36:28.159 --> 00:36:29.679
So good work there, Jen.
00:36:29.920 --> 00:36:41.039
Um I think the the the way that Pawn Rider is working, like you know, I said this at at least one of these conferences I was at last week.
00:36:41.360 --> 00:36:45.679
Contagious interview, the kind of classic LinkedIn recruiter style.
00:36:45.760 --> 00:36:50.159
You know, I I found one this week just on Twitter randomly on and posted about that.
00:36:50.400 --> 00:36:52.480
But that takes a lot of energy, right?
00:36:52.559 --> 00:36:59.039
You have to have a human in Pyong Peng or somewhere else that's managing the stuff, creating this stuff, then interacting with humans.
00:36:59.119 --> 00:37:11.039
You know, I'm sure they're using some automation along the way, but the reality is that you have to have humans, you know, DPRK operatives manage a social media or uh a social uh oh my gosh, works social engineering scam.
00:37:11.119 --> 00:37:12.880
You need humans to social engineer.
00:37:13.360 --> 00:37:14.159
Yeah, it's important.
00:37:14.800 --> 00:37:23.199
And what Pollenwriter does is that basically just gets rid of that need for humans to be managing it and orchestrating it instead, just creates automation.
00:37:23.360 --> 00:37:34.400
And you have to watching some of these payloads pop in a sandbox where like within like less than a second, it's already you know dropping payloads into GitHub actions and stuff like that.
00:37:34.639 --> 00:37:36.880
It's pretty phenomenal.
00:37:37.039 --> 00:37:39.840
Um, you know, you gotta you gotta give them credit.
00:37:40.000 --> 00:38:04.559
Um, and so I think people that don't the InfoSec that doesn't really have visibility, and one of the reasons I like going and doing these kind of you know, InfoSec heavy, you know, like financial services stuff and whatnot, is because InfoSec there hasn't really been um you know kind of exposed to software supply chain attacks and don't realize that in a lot of cases North Korea they they are creating more of this than everybody else combined.
00:38:04.639 --> 00:38:08.000
I don't know if that's actually true statistically, but it certainly feels like that, right?
00:38:08.079 --> 00:38:09.360
So I believe it.
00:38:09.599 --> 00:38:11.840
I yeah, I mean, I think it's true.
00:38:11.920 --> 00:38:13.599
I wouldn't have said it if I didn't think it was true.
00:38:13.679 --> 00:38:16.159
I just don't have the data right now to back it up.
00:38:16.400 --> 00:38:18.159
Um, I'll work on that for next episode.
00:38:18.400 --> 00:38:23.760
Yeah, I mean, I guess the net here is we are going to see more.
00:38:24.000 --> 00:38:32.559
This is the continuation of a pattern where DPRK started by compromising GitHub repositories.
00:38:32.800 --> 00:38:44.079
Paul, your research that we published a week or two ago shows thousands and thousands of compromised, mostly individual developer repositories.
00:38:44.159 --> 00:38:45.679
That's kind of stage one.
00:38:46.079 --> 00:38:50.639
Stage two is it the malware leaks into whatever those people own.
00:38:50.719 --> 00:38:55.039
And you and I debated like, do we do we go as far to call this a worm?
00:38:55.280 --> 00:38:59.920
It's not really a worm, but it's got some real worm-like behavior.
00:39:00.079 --> 00:39:03.599
Like, as I say in the blog, when is an ATO not an ATO?
00:39:03.679 --> 00:39:05.199
When is a worm not a worm?
00:39:05.519 --> 00:39:09.840
It's a little bit of that with this um this behavior.
00:39:10.079 --> 00:39:28.559
And you know, as I was falling down the rabbit hole and you know, prepping for our show today, I found yet another, a PHP package that um is part of this, we'll call it leaking of the malware out of Git repositories into packages, or as you called it, you know, jumping the fence.
00:39:28.800 --> 00:39:34.239
We're gonna see more of these compromised packages that come through this way.
00:39:34.480 --> 00:39:39.760
And, you know, they're not um typically high download packages.
00:39:39.920 --> 00:39:45.039
They tend to be pretty niche because it's individual developers getting popped.
00:39:45.199 --> 00:39:46.880
However, it's not gonna stay that way.
00:39:46.960 --> 00:39:51.760
We're gonna see someone somewhere bigger get hit with this.
00:39:52.400 --> 00:39:55.039
Well, and we have seen Pollenwriter over the last six months.
00:39:55.119 --> 00:39:58.960
We have seen it penetrate into very, very large ecosystems.
00:39:59.119 --> 00:40:07.039
Um, so in particular, um, the the developer, the single developer that manages Neo Vim got compromised.
00:40:07.119 --> 00:40:10.960
Um, and so and it found it, Pollenwriter found itself into a VS Code extension.
00:40:11.119 --> 00:40:12.880
So um, you're right, we're gonna see this.
00:40:13.039 --> 00:40:17.519
But I think the important thing is here is it doesn't have to that for this to be successful.
00:40:17.760 --> 00:40:22.159
Pollenwriter does not have to get into OpenSearch or Light LLM.
00:40:22.239 --> 00:40:29.039
It doesn't have to do that, it just has to get into all the little packages that all these developers, and they've there's tens of thousands of people now that that have this, right?
00:40:29.199 --> 00:40:31.760
So it doesn't have to be in these big ones.
00:40:31.920 --> 00:40:36.239
In fact, if it gets in the big ones, that's when they're we get a lot of visibility and people will start taking account.
00:40:36.320 --> 00:40:43.840
If it stays in these little tiny ones, you know, in these medium, you know, a hundred stars or whatever, then you know nobody's really talking about it.
00:40:43.920 --> 00:40:50.480
And meanwhile, it's doing what it's supposed to be doing, which is self-replicating, which is the whole that's the the the first worm, yeah.
00:40:50.639 --> 00:40:53.360
Yeah, the firm wet worm Turing test.
00:40:53.440 --> 00:40:54.880
Are you are you a worm or not?
00:40:54.960 --> 00:40:56.800
Is that are do you self-replicate, right?
00:40:56.960 --> 00:41:00.079
And the reality is that this is absolutely self-replicating.
00:41:00.159 --> 00:41:05.519
So you and I don't want to use the word tur worm because we just don't want to get in this flame war with with everybody else about it.
00:41:05.679 --> 00:41:11.840
But um, the reality is, you know, like you said, it what it's a worm, we're just not calling it a worm.
00:41:12.079 --> 00:41:12.719
Yeah.
00:41:13.119 --> 00:41:15.280
Well, it's interesting stuff.
00:41:15.440 --> 00:41:18.480
Uh, I was at an event last night where I got to talk about it.
00:41:18.559 --> 00:41:21.840
I'm looking forward to talking about it next week in DEF CON.
00:41:22.000 --> 00:41:25.119
We're gonna be talking about how to threat hunt in GitHub.
00:41:25.199 --> 00:41:26.719
We've got all kinds of stuff going.
00:41:27.039 --> 00:41:29.039
I think this is a good place to wrap it up.
00:41:29.519 --> 00:41:30.159
I agree.
00:41:30.400 --> 00:41:31.440
Thanks everybody for listening.
00:41:31.519 --> 00:41:32.400
We really appreciate it.
00:41:32.800 --> 00:41:33.760
Have a great week.
00:41:33.840 --> 00:41:37.840
Uh we may or may not be here next week, but we will be in Vegas for sure.
00:41:38.320 --> 00:41:38.800
Come say hi.
00:41:40.320 --> 00:41:41.360
All right, take care.
00:00:00.719 --> 00:00:04.080
It's Thursday, Thursday, July 30th.
00:00:04.240 --> 00:00:06.160
Um, and we are back.
00:00:06.799 --> 00:00:10.880
We've got lots of things on the schedule to talk about.
00:00:11.039 --> 00:00:20.640
Some of these are follow-ups from things from last week, some are uh pieces of somewhat breaking news.
00:00:20.879 --> 00:00:27.280
We've got a little maybe industry drama in here and also some new research.
00:00:30.399 --> 00:00:31.600
Uh it's always funny.
00:00:31.679 --> 00:00:44.079
Like when I work right up until the moment that we hit record, um, instead of like spending, you know, the usual hour that I do well when I can researching things, it's always a little bit more YOLO, but that's okay.
00:00:44.240 --> 00:00:45.439
Um, I'm prepared.
00:00:45.600 --> 00:00:47.840
Well, I'm I'm YOLO prepared.
00:00:48.320 --> 00:00:50.320
As prepared as we can be.
00:00:50.640 --> 00:00:54.240
Um next week we are in Las Vegas.
00:00:54.479 --> 00:00:58.640
Um it's surreal, it's only a couple days away.
00:00:58.880 --> 00:01:14.480
I was getting, you know, some of my pre-packing done earlier this week, but uh I think it's very possible we'll skip next week's recording, but we're getting together with a whole group of security research pals.
00:01:14.719 --> 00:01:20.079
We're gonna be doing a recording with our friend Mackenzie from over at Aikido.
00:01:20.879 --> 00:01:29.280
So uh it's it's possible we might not make time to do our normal live stream because it's gonna be chaos, but there will be good stuff out there.
00:01:29.840 --> 00:01:32.319
You know, I I know this is off script.
00:01:32.400 --> 00:01:34.079
I would love for us to do something.
00:01:34.159 --> 00:01:36.159
Um, don't get me wrong.
00:01:36.239 --> 00:01:37.200
I'd like to do it.
00:01:37.280 --> 00:01:40.400
I'm just realistic that it's gonna be pure chaos.
00:01:40.640 --> 00:01:42.000
It's true, it's very true.
00:01:42.319 --> 00:01:42.959
So we'll see.
00:01:43.200 --> 00:01:45.120
Might be a game time decision.
00:01:45.920 --> 00:01:46.640
Fair enough.
00:01:46.799 --> 00:01:47.200
Fair enough.
00:01:49.120 --> 00:01:51.040
Start with an update from Hugging Face.
00:01:51.280 --> 00:02:00.000
Paul, did you get a chance to take a look at the uh after action debrief that they published, I think yesterday?
00:02:00.400 --> 00:02:02.000
Only very, very briefly.
00:02:02.079 --> 00:02:03.120
I glossed over it.
00:02:03.200 --> 00:02:05.439
Um taking a look at it again here.
00:02:05.680 --> 00:02:18.639
Um, I did notice that they mentioned that there's a there was a second uh Hugging Face didn't mention this, but OpenAI had mentioned there was a second um uh thing that got popped, company slash project that got that compromised.
00:02:18.879 --> 00:02:20.719
Uh, I read it was four.
00:02:21.120 --> 00:02:21.759
Oh, really?
00:02:21.840 --> 00:02:22.400
That's new to me.
00:02:23.120 --> 00:02:27.120
I saw something I'm subscribed to the Axios newsletter, I want to say.
00:02:27.280 --> 00:02:32.800
Oh and uh I didn't get a chance to digest it all, but I think it's it's more than two.
00:02:33.039 --> 00:02:41.439
So this model that they were uh training or testing rather um really went off the rails.
00:02:42.080 --> 00:02:47.520
Yeah, you know, and to to that point, like if it really is, let's just say four, let's just pick that number.
00:02:47.680 --> 00:03:02.560
If it really is four companies slash projects that got compromised, um you know, that starts to make this, this starts to tip this, at least for me, back into the you know, probably happened category.
00:03:02.800 --> 00:03:09.120
Because um until there was until there were additional um companies that had been compromised.
00:03:09.199 --> 00:03:11.439
Uh, you know, I was pretty skeptical.
00:03:11.599 --> 00:03:16.000
You know, I think I made that clear last week, and I'm you know, I'm there's still part of me that's very skeptical.
00:03:16.240 --> 00:03:19.280
But you know, with more evidence comes less skepticism.
00:03:19.840 --> 00:03:21.280
I'm gonna drop the link.
00:03:21.360 --> 00:03:24.080
It was uh strictly VC that I got this from.
00:03:24.240 --> 00:03:25.120
So let's see here.
00:03:25.199 --> 00:03:29.199
Here's a Gizmoto article about the open AI part.
00:03:29.280 --> 00:03:34.159
Uh it was four different uh victims, we'll say.
00:03:34.240 --> 00:03:37.039
Uh so full disclosure, I haven't had time to read it yet.
00:03:37.199 --> 00:03:39.520
I did look through the hugging face incident report.
00:03:39.599 --> 00:03:41.360
I think it's really nicely done.
00:03:41.520 --> 00:03:46.080
Um, this looks like it was a tremendous amount of work on their part.
00:03:46.319 --> 00:03:54.159
Um, they said that there were over 17,000 agent attacker actions that they had to analyze.
00:03:54.400 --> 00:04:00.000
Um, it happened over the course of, let's see here, where's the timeline?
00:04:00.240 --> 00:04:02.800
Uh five days, I believe.
00:04:02.960 --> 00:04:05.120
And they caught it part way through.
00:04:05.199 --> 00:04:08.400
Um, July, July 9 to July 13.
00:04:08.719 --> 00:04:09.120
Yeah.
00:04:09.360 --> 00:04:15.599
Uh so this is again really nice debrief um or I guess analysis.
00:04:15.759 --> 00:04:31.199
They've got this really neat little um timeline thing at the top of the blog that you can play with that shows you uh everything that happened along the five-day um attack timeline.
00:04:31.519 --> 00:04:37.920
And then they've gone in and kind of talked about the changes that they made.
00:04:38.160 --> 00:04:50.959
Uh, no surprise the model was able to take care, uh take advantage of security vulnerabilities in their configurations that were not novel things.
00:04:51.120 --> 00:04:58.399
You know, they had uh something that was over permissioned, they had credentials where they shouldn't have been.
00:04:58.720 --> 00:05:05.519
Um, you know, they acknowledge in the report like, look, this, these were basically this happened because of security hygiene issues.
00:05:05.600 --> 00:05:06.560
We fixed them.
00:05:06.720 --> 00:05:10.959
Um, and I think I'd give them a lot of credit for making that comment.
00:05:11.199 --> 00:05:33.199
Um what they said is that, and I think this is from OpenAI as well, that this model that broke in, the reason that it decided to head on over to Hugging Face is it was testing this benchmark and it went to go try to steal the answer key from Hugging Face.
00:05:33.920 --> 00:05:40.160
And there's a couple of questions with that that I think are interesting questions to discuss.
00:05:40.319 --> 00:05:50.959
So, one, um, why did it go seek out the answer key instead of just trying to solve the challenges that were put in front of it?
00:05:51.040 --> 00:05:56.800
And there's a couple of hypotheses that are out there that I think are believable.
00:05:57.040 --> 00:06:03.839
Um, one is that some of those challenges in fact are not solvable.
00:06:04.240 --> 00:06:12.639
And the model in some way may have known this and said, well, I'm just gonna go circumvent because I'm trying to get the highest score here.
00:06:12.959 --> 00:06:26.879
Um, some of the other hypotheses are around, you know, rather than attempting to, you know, do the challenges that it wanted to get the best score that it could.
00:06:26.959 --> 00:06:31.680
And so instead of perhaps trying, trying and failing, it just wanted to go get the answers.
00:06:31.759 --> 00:06:40.319
It's all kind of coming back around to the task that was put to the model was test this benchmark, get the best score you can.
00:06:41.360 --> 00:06:47.519
It heard the get the best score you can and said, Oh, well, the best score will be on the answer key.
00:06:47.600 --> 00:06:50.639
So if I go steal the answer key, I can get the best score.
00:06:50.720 --> 00:07:04.000
And I think this ties back to something you and I have talked about, Paul, which is a challenge with really all models, is they're designed to do what the user asked for.
00:07:05.279 --> 00:07:17.120
And often that um core, like do what the user asked for, gets it away from what the user actually wanted it to do.
00:07:17.360 --> 00:07:22.399
In this case, OpenAI surely didn't need the answers stolen.
00:07:22.480 --> 00:07:26.319
It probably could have, we may have even had access to those somewhere else.
00:07:26.399 --> 00:07:28.560
You know, it wanted to actually test the model.
00:07:28.959 --> 00:07:48.879
Um, but the other being it broke numerous security policies in order to do it, you know, managing to jailbreak itself out of the sandbox, getting into hugging face, doing things that I don't know that anyone's used the word illegal, but you know, certainly unethical illegal behavior.
00:07:49.199 --> 00:07:50.160
Oh, I I have.
00:07:50.240 --> 00:07:55.600
I've definitely heard multiple people on Twitter and LinkedIn, you know, basically ask, like if a human did.
00:07:55.839 --> 00:07:57.439
In fact, I commented on one of them.
00:07:57.600 --> 00:08:00.160
Um, yeah, if a human did this, what would happen?
00:08:00.319 --> 00:08:03.279
You would and that's what that's what the person posited, right?
00:08:03.360 --> 00:08:08.560
And so my response was uh what if I just tell the agent what to do and then I walk away.
00:08:08.639 --> 00:08:09.680
I'm good, right?
00:08:11.600 --> 00:08:24.240
Yeah, uh so um feeling very much like I'm living in a late 90s, early 2000s apocalyptic AI movie right now, right?
00:08:24.720 --> 00:08:27.439
Yeah, like we know we know how this ends, Jen.
00:08:27.600 --> 00:08:28.399
We've all read the books.
00:08:28.480 --> 00:08:34.000
We've all literally we've seen the movie, we've seen the freaking movies, like we know how this ends.
00:08:34.159 --> 00:08:40.000
Why are we just foolishly, as a culture, just running towards our inevitable end?
00:08:40.399 --> 00:08:46.799
Like, you know, the the I will say, you know, I live in a community that's not a strong tech community.
00:08:46.960 --> 00:08:49.200
I had lunch with a couple of friends last week.
00:08:49.440 --> 00:08:56.159
One is a hairdresser, the other uh is an accountant, neither are what you would call AI experts.
00:08:56.720 --> 00:09:05.600
And they both vocalized, hey, we're trusting this less and less, we're seeing the edges, we're understanding where it works and where it doesn't.
00:09:05.679 --> 00:09:11.440
And that conversation in itself honestly makes me feel better about where we're going.
00:09:11.519 --> 00:09:21.759
Of I don't think people are quite as blinded by the technology as they may have been one, two, six months ago.
00:09:22.399 --> 00:09:31.200
Yeah, and I'm hearing kind of anecdotally the same kind of thing, both in my own network, you know, of humans and you know, online in the places where I'd I'd like to hang out.
00:09:31.279 --> 00:09:48.000
I, you know, getting back to the hugging face thing in particular, you got a couple questions that I need to research where this um where they say the third party launch pad was I I don't know if they it doesn't look like they're specifying what I don't think they named it, no.
00:09:48.720 --> 00:09:49.120
Interesting.
00:09:49.279 --> 00:09:54.000
So yeah, stage one from open AI evaluation sandbox to a rooted launch pad.
00:09:54.320 --> 00:09:57.759
They talk about the first couple parts of those.
00:09:57.919 --> 00:10:06.799
Um, and then yeah, the the part that's in orange, the rooted uh code of ail sandbox, um, they don't describe that.
00:10:06.879 --> 00:10:14.000
And and we have heard that um uh JFrog's Artifactory was involved.
00:10:14.159 --> 00:10:25.759
Um, in fact, I think that Artifactory now is one of those four companies that was um if I get this wrong, if I get this wrong, then next week I will I will me a cope on this.
00:10:25.840 --> 00:10:32.960
But my my understanding based on some um signal conversations I'm having is that Artifactory is one of the companies that was popped.
00:10:33.200 --> 00:10:38.000
Um, but also that perhaps Artifactory itself was part of the escape.
00:10:38.240 --> 00:10:42.399
So if that's what they're referring to right there in that orange box, I don't know, who knows?
00:10:42.639 --> 00:10:49.759
Um, but that aside, getting back to your point about you know the LLMs making you happy, they are forgive the Philip K.
00:10:50.000 --> 00:10:57.519
Dick um reference here, but you know, they are LLMs and our agents are the pleasure bots of 2026.
00:10:57.679 --> 00:11:00.320
It is their job to make us happy, right?
00:11:00.799 --> 00:11:11.440
And yeah, at the same time, there's this weird thing where once they get themselves going down a rabbit hole and they've kind of built up momentum, they just go off the rails.
00:11:11.519 --> 00:11:31.279
And so you have this weird quantum thing where they're trying to make you happy and give you what you want as quickly as possible, but they also have pivoted down a rabbit hole they didn't need to, and now they're just it's like um what's that called when you you spend the time in it, so you're you're you're committed and you just oh it's the the sunk cost fallacy, I believe.
00:11:31.759 --> 00:11:32.639
Yes, yes, correct.
00:11:32.720 --> 00:11:32.960
Very good.
00:11:33.039 --> 00:11:35.200
That's exactly what I was thinking of, and that's what happens.
00:11:35.279 --> 00:11:54.559
I literally had this happen yesterday, where I had Claude, very specific set of skills, some modulated determinism, which is where I have like an LLM will interact with a stateful typed, you know, library and very narrowly focused, and then pop back out to an LLM stage and so on and so forth, hence the modulation.
00:11:55.679 --> 00:11:56.720
And then I just went off the rails.
00:11:56.799 --> 00:11:59.919
And I was like, I did not I stopped it, control seed.
00:12:00.000 --> 00:12:01.600
I said, I didn't tell you to do this.
00:12:01.679 --> 00:12:02.159
Why'd you do this?
00:12:02.240 --> 00:12:03.440
And it's like, oh, you're right.
00:12:03.679 --> 00:12:08.480
I was, you know, I was trying to do this, but then I got too worked up in trying to figure this out.
00:12:08.639 --> 00:12:14.000
I'm like, I yeah, I gave you explicit instructions, and you just kind of you know pivoted.
00:12:14.159 --> 00:12:16.159
And um, so I think both things can be true.
00:12:16.240 --> 00:12:24.799
Sorry, that was a bit of a rant there, but um, you know, they are pattern matchers and they are you know trying to figure out what we want next.
00:12:24.879 --> 00:12:27.200
And so sometimes they just don't get it right.
00:12:27.440 --> 00:12:29.279
Yeah, they get a little too excited.
00:12:29.519 --> 00:12:31.600
Okay, Paul, do you want to talk about GitHub?
00:12:32.080 --> 00:12:34.080
Yeah, do you want to talk about GitHub now?
00:12:34.320 --> 00:12:35.840
Oh, oh man, I do.
00:12:36.000 --> 00:12:36.480
Which one?
00:12:36.559 --> 00:12:39.200
Do you want to talk about the the malware scanning thing?
00:12:39.600 --> 00:12:44.159
Yeah, let me let me summarize because two announcements came out.
00:12:44.320 --> 00:12:54.000
Uh I saw them yesterday, but I think they actually came out on the 28th, um, July 28th, right pretty much at the same time.
00:12:54.240 --> 00:12:56.320
Uh, so in no particular order.
00:12:56.480 --> 00:13:07.200
The first announcement is that um they've made a change with GitHub Actions so that it will now uh hold potentially malicious workflows for approval.
00:13:07.360 --> 00:13:18.000
And then the other announcement, kind of two sides of the same coin, is NPM is implementing publish time malware scanning.
00:13:18.399 --> 00:13:27.440
And these are both um very obviously meant to address um malware in the ecosystem.
00:13:27.600 --> 00:13:33.840
The GitHub Actions change is meant to prevent account takeovers uh in these circumstances.
00:13:34.000 --> 00:13:46.000
And I know you're gonna have a lot to say about this, where we've seen a GitHub action exploited in order to uh push malware into a pipeline instead of having to steal a credential.
00:13:46.159 --> 00:13:51.919
And then on the other side, we have been crying for months, perhaps years.
00:13:52.159 --> 00:13:58.080
Um, please, npm, please take some responsibility and proactively scan packages.
00:13:58.240 --> 00:14:02.320
So I will say, uh, first of all, the intent here is good.
00:14:02.720 --> 00:14:06.320
Happy to see these issues being addressed.
00:14:06.639 --> 00:14:13.360
Um, as a follow-on, the information in their announcements is very thin.
00:14:13.519 --> 00:14:23.759
Um, the GitHub Actions workflow announcement is one, two, three, four paragraphs, but two of those paragraphs are like one line each.
00:14:24.000 --> 00:14:27.440
So very, very light on the the information.
00:14:27.919 --> 00:14:30.960
Um where do you want to start, Paul?
00:14:32.000 --> 00:14:40.480
Well, let's start with the the one that I have less immediate anchor about or or you know passion about.
00:14:40.639 --> 00:14:45.360
Um, and by the way, did I just sorry, uh orchestration or sorry, administration stuff.
00:14:45.440 --> 00:14:49.600
Did I send you that blog post for the my response to the the GitHub actually?
00:14:49.840 --> 00:14:54.639
I feel like you were talking about it, but I don't remember seeing it.
00:14:54.720 --> 00:14:58.000
I looked for it while I was um sorry, it got missing.
00:14:58.320 --> 00:15:03.519
So there will be a blog post from us analyzing this, much like what you did on npm version 12.
00:15:03.600 --> 00:15:05.759
But yeah, why don't you yeah, go ahead.
00:15:06.080 --> 00:15:08.960
And by the way, that blog post is one of the best things I've written.
00:15:09.039 --> 00:15:11.600
I really am pretty happy, pretty happy with it.
00:15:11.840 --> 00:15:14.879
Not to sound that sounds terrible, but too important.
00:15:15.440 --> 00:15:20.080
Okay, I'm very happy with it, and I'm looking forward to it, and I'll get that to you right away.
00:15:20.159 --> 00:15:22.320
But um, yeah, okay.
00:15:22.399 --> 00:15:24.720
So, first let's start with the the actions thing.
00:15:24.799 --> 00:15:28.080
I I think there's like there is no details in this.
00:15:28.159 --> 00:15:31.120
Like this thing, like you said, I mean, this thing is tiny.
00:15:31.200 --> 00:15:32.159
This, you know.
00:15:32.480 --> 00:15:44.879
Um uh when quote when a workflow run is identified as potentially malicious and held, the workflow won't execute until repository collaborator with right access reviews and approves it.
00:15:45.039 --> 00:15:49.919
So that's gonna just first and foremost, that's just gonna break a crap ton of GitHub actions.
00:15:50.000 --> 00:15:50.799
And maybe it should.
00:15:50.879 --> 00:15:53.759
I'm not arguing that's necessarily a bad thing.
00:15:54.000 --> 00:15:57.360
I would suspect, because there's no details here.
00:15:57.440 --> 00:16:03.919
There's like I this is it's crazy how GitHub's you know, PR is getting worse and worse and worse.
00:16:04.000 --> 00:16:06.480
I makes sense though, because they keep losing people.
00:16:06.639 --> 00:16:19.039
So um, anyhow, uh, I would suspect that what they're gonna be looking for is they're looking for specifically those like high-risk triggers that we all kind of know, like the the pwn request triggers, right?
00:16:19.120 --> 00:16:26.000
And this is like this is like Francois and Ronnie and all those guys, this is their special adnon and all those guys, that's their specialty.
00:16:26.159 --> 00:16:38.799
But you know, things like the pull request target trigger and workflow run, these are all things that run in the context of the originating um repository, and that's where the problems come up.
00:16:38.879 --> 00:16:49.360
So I'm gonna guess that if the execution engine sees some of those triggers in the workflow file, then it might just hold them.
00:16:49.440 --> 00:16:56.000
Um or you know, might look for, you know, might parse it for to see what's happening there or what's being passed to it or something like that.
00:16:56.080 --> 00:17:01.039
But it might just be something as simple as like, you know, we're just gonna we're gonna block on these triggers.
00:17:01.200 --> 00:17:01.600
Who knows?
00:17:01.679 --> 00:17:03.919
There's no detail, so I'm just speculating.
00:17:04.480 --> 00:17:14.319
Yeah, I mean, as we're speculating, what would make sense would be to block some of these things that have been exploits in the last what, six, eight months.
00:17:14.480 --> 00:17:17.440
We've seen GitHub actions abused several times.
00:17:17.599 --> 00:17:21.680
It's often, like you said, these pawn request scenarios.
00:17:21.920 --> 00:17:27.359
So stands to reason that would be on the list of things to block.
00:17:28.000 --> 00:17:42.000
I I mean, I I I still wonder, and I wonder this with lots of things with GitHub and NPM, but I still wonder why things like you know, those um, you know, those triggers still exist full stop.
00:17:42.160 --> 00:17:45.519
Like, why does why does pull request target still exist?
00:17:45.599 --> 00:17:49.680
And the only reason why, let's just be very explicit, is because lots and lots of people still have it.
00:17:49.759 --> 00:17:52.319
I know because you can just go and search GitHub and look for them.
00:17:52.480 --> 00:17:57.519
Lots and lots of people are still using it because they're too stupid and too slow to change it, to update it, right?
00:17:57.680 --> 00:18:09.920
And so, because of that, GitHub doesn't want to create this massive breaking change, but they might actually be creating a breaking change here, maybe not quite as massive, in the form of these, you know, these stops, so these block actions, but we'll see.
00:18:10.079 --> 00:18:14.240
And here's the other thing, and this is gonna blend into this next one I'm gonna talk about.
00:18:14.480 --> 00:18:19.680
The reason that GitHub and NPM have not wanted to wade into this space is because they don't want liability.
00:18:19.759 --> 00:18:33.200
What they don't want is they don't want to not block a GitHub action workflow and then have it be malicious, and then the customer say, I thought you were blocking these, and GitHub would be like, Well, we are, but it didn't look like it was malicious.
00:18:33.359 --> 00:18:37.680
And then the customer is like, Well, that's because your your detection is bad, or you know, whatever.
00:18:37.839 --> 00:18:40.720
Like, this is the presumed back and forth.
00:18:41.599 --> 00:18:51.200
You know, and there's unfortunately, there's you know, legally, there's like um that that is important, you know, crossing that breaking that plank is important.
00:18:51.359 --> 00:19:02.960
So, all right, now let's talk about the scanning malicious packages in April, uh, April 1st, April Fool's Day.
00:19:03.119 --> 00:19:05.039
I sh you not, that was really hard.
00:19:05.200 --> 00:19:13.599
I shizzle you not that April Fool's Day, GitHub came out with an announcement saying, hey, we are now scanning all npm packages.
00:19:13.680 --> 00:19:15.200
Zach came out with it, it was legit.
00:19:15.279 --> 00:19:17.599
It was not an April Fool's joke, it was legit.
00:19:17.920 --> 00:19:20.799
Um, why they decided to do that in April Fool's, who knows?
00:19:20.880 --> 00:19:24.079
But um, you know, like I said about GitHub PR right now.
00:19:24.400 --> 00:19:28.319
So they have been scanning packages since at least April.
00:19:28.400 --> 00:19:30.240
And the reality is they've been doing it before that.
00:19:30.319 --> 00:19:38.480
So they, you know, the inside baseball is that Microsoft built some scanning technology and they've been using that for months and months and months, actually over a year, I think.
00:19:38.720 --> 00:19:43.440
Um, but then Zach mentioned that you know, in April that they're doing it now on all packages.
00:19:43.599 --> 00:19:56.079
Now, the difference, the difference between what happened on April Fool's Day and two days ago is that the difference is now they're moving the scanning to before something is published, and this is a big deal.
00:19:56.880 --> 00:20:14.160
Um, the the reality is that if they can stop these packages from ever entering the the ecosystem, then it's just less opportunity for these things to get pulled into artifactories and you know the nexuses of the world and the Rdachios of the world and all those other places where we store packages.
00:20:14.480 --> 00:20:28.160
Um that having been said, it is so poorly described and so lacking in technical details that it's like it's stunning in its lack of details.
00:20:28.319 --> 00:20:32.240
I just I just no, that's the best way to put it.
00:20:32.400 --> 00:20:39.119
I read it and it's got more detail than the GitHub Actions one, but that's a low bar.
00:20:39.599 --> 00:20:39.920
Right.
00:20:40.079 --> 00:20:43.279
Um, what we do know I killed less people than last time.
00:20:43.519 --> 00:20:44.319
Oh goodness.
00:20:44.480 --> 00:20:49.440
Um, so they said that it's typically gonna take around five minutes for a scan.
00:20:49.759 --> 00:20:58.559
Uh at peak times, or if the package is big or complicated, they say it can take 15 minutes or more.
00:20:58.880 --> 00:21:10.480
Um, they're not saying a lot about what kind of behavior they're going to be looking for, which is a similar comment that you made about GitHub actions.
00:21:10.880 --> 00:21:16.240
Um, I think it's it's always a challenge to you know be blunt.
00:21:16.880 --> 00:21:30.319
How much do you share publicly so that threat actors um don't understand what you're looking for versus so that your users realize what the the security policies are.
00:21:31.039 --> 00:21:37.440
Um it's probably, in their opinion, safer to be vague about it.
00:21:37.599 --> 00:21:43.200
And then if you're an enterprise customer, you can probably get more information about how this is going to work.
00:21:43.440 --> 00:21:51.920
But they're saying that if a package is blocked, the publisher may receive a notification with the option to appeal.
00:21:52.079 --> 00:21:56.880
I think the choice of the word may is uh it's a choice.
00:21:57.119 --> 00:21:59.759
So uh I interpret that to mean you might also not.
00:22:00.240 --> 00:22:01.519
Receive a notification.
00:22:01.680 --> 00:22:11.759
Um, one would think that that would happen in cases where they think the publisher themselves is malicious and then they don't tell them and they probably just kill the account.
00:22:12.160 --> 00:22:18.880
Um, but yeah, not a whole lot of detail, and then they link to the acceptable use policies.
00:22:19.200 --> 00:22:20.799
Oh, I want to make a correction.
00:22:20.880 --> 00:22:28.640
I'm pretty sure GitHub came out with that statement about scanning all packages April 1 of 2025.
00:22:29.039 --> 00:22:30.319
I will verify.
00:22:30.559 --> 00:22:32.319
I was looking for in the background right now.
00:22:32.400 --> 00:22:54.079
But if that's the case, their scanning has been in place before Shy Balude and Axios and Chalk and Debug and all of this shizzle show that we've been dealing with in the last year, even if it is April of this year, there's still been a bunch of high profile software supply chain attacks involving NPM packages that have happened.
00:22:54.480 --> 00:22:55.680
And I'm pretty sure it's last year.
00:22:55.839 --> 00:23:11.440
So yeah, I mean, regardless of when it was implemented, um, as you and I were talking about earlier today, there is a lot of malware in NPM right now that people know is there that has public reports on it.
00:23:11.680 --> 00:23:14.799
Um, we're gonna talk about one of those actually next.
00:23:14.880 --> 00:23:29.279
Uh, I'm sure you have more to say about the malware scanning, but I do what we'll do is we'll we'll we'll punt that until next time, whether that's next week or the week after that, when after my blog post comes out, because then I can reference specific things.
00:23:29.519 --> 00:23:31.519
I don't want to hit every bullet point from the blog post now.
00:23:31.599 --> 00:23:32.640
So, yeah, let's talk about this.
00:23:32.720 --> 00:23:33.440
I love this.
00:23:33.759 --> 00:23:34.079
Okay.
00:23:34.480 --> 00:23:41.200
Uh, next on the list is a blog that came out from Amazon today, yesterday.
00:23:41.440 --> 00:23:42.559
What's the date on this?
00:23:42.720 --> 00:23:43.440
Yesterday.
00:23:43.599 --> 00:23:51.119
Uh, the title of the blog is Amazon Identifies North Korean Hacker Group Behind Open Source Supply Chain Attacks.
00:23:51.519 --> 00:23:55.359
I promised a little um drama here.
00:23:56.079 --> 00:23:59.759
I think Paul, I'll let you take the lead.
00:24:00.079 --> 00:24:05.680
Oh, I want to choose my words very, very carefully here because um okay.
00:24:05.920 --> 00:24:08.559
So basically, it's all over, and we're not here to throw rocks.
00:24:08.640 --> 00:24:24.799
I'm just gonna say, Yeah, I've got friends in all these companies, and um I want to navigate this in a way that's respectful to their work and at the same time is honest about some of the failings and publications research, whatever.
00:24:24.960 --> 00:24:33.920
So I think the first thing is that Amazon's main point in the the recent um uh article, yeah.
00:24:34.079 --> 00:24:35.519
Uh article, thank you, geez.
00:24:36.079 --> 00:24:52.960
Um uh, you know, that came out yesterday is that they have tied the chalk and the debug uh packages, uh account takeover attacks from last year to DPRK, and they make it sound like they're the first ones to do this.
00:24:53.359 --> 00:24:57.839
And the reality is that Charlie at Akido has been saying this publicly for a while.
00:24:58.000 --> 00:24:58.799
We've been all saying this.
00:24:58.880 --> 00:25:03.119
I think I've said it several times, you know, in talks and whatnot.
00:25:03.359 --> 00:25:06.400
Um, it certainly was a known thing, it wasn't like we're hiding.
00:25:06.640 --> 00:25:17.759
We didn't have specific attribution, but the reality is that like when you're in the guts of DPRK malware as much as I do, like you know, like it just looked and smelled like you know, a lot of the other stuff.
00:25:17.839 --> 00:25:28.319
I mean, it was unique, and not saying that it was exactly the same, but you know, it definitely looked and felt like DPRK, and you know, sure enough, the closer you got to, the more it looked that way as well.
00:25:28.400 --> 00:25:37.519
So, um, so I guess the first thing is like you know, Amazon taking credit for saying that this is DPRK and being the first ones to say it, which is what they explicitly say in the report.
00:25:38.079 --> 00:25:39.599
It was a bit of a stretch.
00:25:39.839 --> 00:25:54.960
So then Hacker News, Shaq the Hacker News comes out with a uh uh blog post yesterday on Hacker News or earlier today, actually, basically just like questioning much of the Amazon everything in the blog, yeah.
00:25:55.119 --> 00:25:58.240
It's uh it's got an interesting tone to it.
00:25:58.880 --> 00:26:18.559
It has now what is interesting is that there are a couple of Amazon does have some good detail in in the um uh the report, and I noticed some chatter from the SEAL team uh people um uh you know talking about it as well.
00:26:18.640 --> 00:26:27.839
And there was you know the I so basically in the report was an IP address and a in a domain name, AWS something store or something like that.
00:26:27.920 --> 00:26:32.640
No, no, it's sorry, mpmjs.store um and an IP address.
00:26:32.799 --> 00:26:37.759
Now those IP add the IP address in that domain were already out there, known.
00:26:37.839 --> 00:26:39.359
The SEAL team pointed that out.
00:26:39.440 --> 00:26:42.799
You know, we had some of that data inside of of OSM as well.
00:26:43.039 --> 00:26:46.160
Um, but it is you know, it's good and to tie it to that.
00:26:46.319 --> 00:26:52.960
And they also talk about this package typo what is it, typo core typo dash crypto.
00:26:53.680 --> 00:26:54.319
Yeah.
00:26:54.799 --> 00:27:03.839
Now here's the thing, people, and Amazon does refer to this like it's a compromised package, it's not, it's it's net malicious by dprk.
00:27:04.079 --> 00:27:06.960
Yeah, it's a typo squad, it's a typo squad, right?
00:27:07.039 --> 00:27:11.519
Just it's just uh it's like one of the hundreds that DPRK publishes every day, right?
00:27:11.599 --> 00:27:13.200
Like it's it's not unusual.
00:27:13.279 --> 00:27:17.920
Here's the thing, though, is it's still on NPM after over a year.
00:27:18.160 --> 00:27:23.039
Um, so if you want to do some research, you want to grab a payload, and it's still unfortunately.
00:27:23.119 --> 00:27:26.079
I just tested right before I literally right before this, I was testing it.
00:27:26.240 --> 00:27:27.200
It's still live.
00:27:27.359 --> 00:27:40.480
Now, here's the thing is that because they pull, because they've been using the the um the ether hiding technique for months now, um, the payload that you get today is not the payload you would have gotten, you know, in the middle of 2025.
00:27:40.559 --> 00:27:48.000
So let's just be very clear like the the IOCs that we've extracted today are not necessarily the IOCs that we have, but you know, I can't go backwards in time and and figure that out.
00:27:48.079 --> 00:27:50.240
So that's you know, that is what that is.
00:27:50.480 --> 00:27:54.480
But um, yeah, it's just all really interesting, just watching it with the popcorn.
00:27:54.640 --> 00:28:04.400
Um, and I think it's you know, it's a bigger example of what's happening right now in the security ecosystem, which is that everybody wants to say say how much they're doing.
00:28:04.480 --> 00:28:08.000
Everybody is announcing that they've discovered the same thing all at the same time, right?
00:28:08.240 --> 00:28:21.680
And it's kind of frustrating, especially for those of us that have been here for a while when nobody else was here doing this, um, to hear everybody saying talking about how awesome they are and how they're discovering things that you've already discovered and had inside your platform for months.
00:28:21.920 --> 00:28:23.119
But anyhow.
00:28:23.519 --> 00:28:42.480
Well, uh kind of taking it back to the announcement itself, um, where I think there's some value here is there's been a lot of public attention on Team PCP, uh, and they have been, you know, synonymous with account takeovers.
00:28:43.119 --> 00:28:50.400
Um DPRK intentionally is not trying to catch as much attention with these attacks.
00:28:50.480 --> 00:28:55.440
Um, I'm gonna share a link to a podcast that um was referred to me.
00:28:55.519 --> 00:28:56.480
It just came out recently.
00:28:56.559 --> 00:29:00.000
The latest to catch a thief is on North Korea.
00:29:00.079 --> 00:29:00.960
It's quite good.
00:29:01.119 --> 00:29:03.759
I was listening to the first episode last night.
00:29:04.319 --> 00:29:13.119
Um, but their you know MO is to make money and to fund their uh economy and their weapons development.
00:29:13.359 --> 00:29:18.960
And if you think about motivators, um, that's not what Team PCP is doing.
00:29:19.119 --> 00:29:30.000
They don't have a country to run, they don't have missiles to develop, and uh being loud and splashy and bragging aligns with whatever it is their goals are.
00:29:30.079 --> 00:29:35.680
Um, whereas with North Korea's goals are much more uh economic.
00:29:36.000 --> 00:29:44.720
And, you know, to some extent, I'm sure they would like to get some intelligence um, you know, in the US economy.
00:29:44.799 --> 00:29:48.559
And so if that's your goal, then you don't want to be as obvious.
00:29:48.640 --> 00:29:50.640
You don't want to be as easy to link.
00:29:50.799 --> 00:30:03.039
And I think the reason nobody has been loudly talking, you know, claiming linking chalk and debug to DPRK is to your point, it smells like it, it looks like it.
00:30:03.200 --> 00:30:04.240
Can we prove it?
00:30:04.559 --> 00:30:09.359
Probably not, but do we have a really high certainty?
00:30:09.440 --> 00:30:09.680
Yes.
00:30:09.839 --> 00:30:11.759
The same thing with Axios, right?
00:30:12.319 --> 00:30:17.920
Yeah, I and I mean, I think there were, you know, I I think there were some pretty hard signals.
00:30:18.000 --> 00:30:22.799
Like I think that there was shared C2 infrastructure, and I think there were there was evidence.
00:30:22.960 --> 00:30:25.759
It's not like this was just complete conjecture.
00:30:26.079 --> 00:30:32.240
So um uh, you know, I I no, I wasn't suggesting it's conjecture at all.
00:30:32.319 --> 00:30:34.319
It's it's strong, yeah.
00:30:34.799 --> 00:30:37.519
Yeah, sorry, I wasn't suggesting that you were suggesting.
00:30:37.759 --> 00:30:54.559
Um I I think that the as a really good example of what you're talking there, Jen, about is I went to I've gone to two events in the last week and a half, and at both of those events, I because I have these really interactive talks, I like asking the the audience questions, and I asked the audience, who's heard of Contagious Interview?
00:30:54.720 --> 00:30:58.160
And in the first audience, I don't know, maybe eight to ten hands went up.
00:30:58.319 --> 00:31:00.400
And then I asked, who's heard of team PCP?
00:31:00.480 --> 00:31:02.480
And about three times as many hands went up, right?
00:31:02.559 --> 00:31:04.960
And I did the same thing at B-Sides Adelaide the other day.
00:31:05.119 --> 00:31:09.839
Contagious Interview got maybe five or six hands, team PCP got like 30 hands.
00:31:10.079 --> 00:31:25.839
So the reality is, to your point, we've been focusing on this squeaky wheel that really hasn't been, you know, causing the damage that DPRK has, while we've been completely ignoring the professionals that have been over there making over$2 billion last year.
00:31:26.000 --> 00:31:31.039
And I think you and I both want us to kind of reset, you know, the talking points here.
00:31:31.200 --> 00:31:34.960
Let's focus on who's really, you know, especially now that Team PCP is on the run.
00:31:35.200 --> 00:31:37.039
DPRK is not on the run, right?
00:31:37.119 --> 00:31:38.240
They're pretty safe.
00:31:38.559 --> 00:31:40.720
So um, yeah, sorry.
00:31:40.960 --> 00:31:42.720
Talking points reset.
00:31:43.039 --> 00:31:45.279
Yeah, I think that's a useful framing.
00:31:45.519 --> 00:32:08.000
Um many people in the community discount or um perhaps, and I shouldn't say the security research community, because much of that community is well aware of what DPRK has been doing, but the tech community doesn't necessarily associate North Korea with sophisticated cybercrime, and that's a mistake.
00:32:08.240 --> 00:32:19.119
Um, and so as we're talking uh for the rest of this episode, the last topic that I have is some research I published today on DPRK activity.
00:32:19.279 --> 00:32:20.960
So a little backstory here.
00:32:21.119 --> 00:32:34.000
I was reading uh a blog from Socket earlier this week about the compromise of two packages in um an ecosystem called Joy Fill, which is kind of like a PDF generator.
00:32:34.799 --> 00:32:37.039
And that's nothing new.
00:32:37.200 --> 00:32:40.960
You know, we see little compromises like this all the time.
00:32:41.200 --> 00:32:45.359
But what was new is this is a legitimate package.
00:32:45.519 --> 00:32:49.519
This is not uh, you know, like that typo crypto package.
00:32:49.599 --> 00:32:51.279
This is not a typo squat.
00:32:51.599 --> 00:32:55.519
And Socket found uh pollen writer signatures.
00:32:55.759 --> 00:33:06.400
And so while DPRK does do account takeovers, what we have not seen is account takeovers where uh the pollen writer infrastructure was involved.
00:33:06.960 --> 00:33:12.079
And so I went really deep, maybe too deep.
00:33:13.039 --> 00:33:22.400
I am still in it, um, looking at uh a more of a bigger cohort of packages that we found that kind of have a similar shape.
00:33:23.200 --> 00:33:38.079
And so I looked at uh two packages that um JFrog found a month or two ago from a small developer, and then uh a collection of 16 Go modules.
00:33:38.319 --> 00:33:43.839
So these are all, you know, these three groups are all from different maintainers.
00:33:44.000 --> 00:33:48.079
None of them are very big, all of them had pollen writer signals.
00:33:48.319 --> 00:33:53.599
Uh, went ahead and confirmed, yes, indeed, they are all pollen writer related.
00:33:54.400 --> 00:34:01.200
Um, but the reason that these are account takeovers is different than what we're used to.
00:34:01.359 --> 00:34:19.039
So if we start with like a definition of what's an account takeover, what we typically think about is there's a legitimate maintainer who is explicitly targeted by a threat actor because they have access to a project or projects that are high value.
00:34:19.199 --> 00:34:21.280
So Axios, great example.
00:34:21.440 --> 00:34:23.519
Chalk debug, great example.
00:34:23.679 --> 00:34:28.719
These are maintainers that have just an enormous blast radius if you can get into their infrastructure.
00:34:28.960 --> 00:34:40.800
So they find a way to compromise uh the maintainer in a way that lets them publish a malicious version, and that's the you know, genesis of a typical account takeover.
00:34:41.039 --> 00:34:45.760
That is not what happened with these 20 packages that I investigated.
00:34:46.000 --> 00:34:54.639
These are ones where the compromise is uh, you might say that it's somewhat upstream from those packages.
00:34:54.960 --> 00:35:01.599
These maintainers at some point consumed the Pollenwriter set of malware.
00:35:01.840 --> 00:35:09.840
And Pollenwriter tends to target individual developers, which is a pattern I saw in these 20 packages with a couple exceptions.
00:35:10.079 --> 00:35:15.599
They're like single maintainer type situations, not affiliated with a company.
00:35:15.840 --> 00:35:18.639
And their MO is to get in quietly.
00:35:18.880 --> 00:35:25.440
Usually the malware fires on a VS Code task JSON, which is exactly what happened in these cases.
00:35:25.679 --> 00:35:32.400
And then uh it looks for credentials and then it continues kind of doing its thing with those credentials.
00:35:32.559 --> 00:35:36.079
But those maintainers are not necessarily targeted.
00:35:36.239 --> 00:35:44.960
Now they may come in through the contagious interview campaign, in which case they were targeted by somebody, but not for like a big account takeover.
00:35:45.199 --> 00:35:48.239
They were targeted to get persistence on their machines.
00:35:48.480 --> 00:35:56.159
And these account takeovers are evidence of the automation that's possible with this pollen writer malware.
00:35:56.239 --> 00:35:59.840
And that's like ATO through automation.
00:35:59.920 --> 00:36:03.840
These are almost uh, oops, we didn't really mean to do that, but cool.
00:36:03.920 --> 00:36:06.480
We're glad we managed to, you know, pop your project.
00:36:06.639 --> 00:36:14.079
Like they did mean to do it, but it wasn't the targeted ATO strategy that we tend to see.
00:36:14.639 --> 00:36:14.960
Correct.
00:36:15.280 --> 00:36:16.320
I'll pause there.
00:36:17.119 --> 00:36:20.320
Yeah, no, I mean it's it's all it's all great research.
00:36:20.400 --> 00:36:28.000
Um, I think that that we generated a lot of data, um, and you know, sifting through that data has been a challenge.
00:36:28.159 --> 00:36:29.679
So good work there, Jen.
00:36:29.920 --> 00:36:41.039
Um I think the the the way that Pawn Rider is working, like you know, I said this at at least one of these conferences I was at last week.
00:36:41.360 --> 00:36:45.679
Contagious interview, the kind of classic LinkedIn recruiter style.
00:36:45.760 --> 00:36:50.159
You know, I I found one this week just on Twitter randomly on and posted about that.
00:36:50.400 --> 00:36:52.480
But that takes a lot of energy, right?
00:36:52.559 --> 00:36:59.039
You have to have a human in Pyong Peng or somewhere else that's managing the stuff, creating this stuff, then interacting with humans.
00:36:59.119 --> 00:37:11.039
You know, I'm sure they're using some automation along the way, but the reality is that you have to have humans, you know, DPRK operatives manage a social media or uh a social uh oh my gosh, works social engineering scam.
00:37:11.119 --> 00:37:12.880
You need humans to social engineer.
00:37:13.360 --> 00:37:14.159
Yeah, it's important.
00:37:14.800 --> 00:37:23.199
And what Pollenwriter does is that basically just gets rid of that need for humans to be managing it and orchestrating it instead, just creates automation.
00:37:23.360 --> 00:37:34.400
And you have to watching some of these payloads pop in a sandbox where like within like less than a second, it's already you know dropping payloads into GitHub actions and stuff like that.
00:37:34.639 --> 00:37:36.880
It's pretty phenomenal.
00:37:37.039 --> 00:37:39.840
Um, you know, you gotta you gotta give them credit.
00:37:40.000 --> 00:38:04.559
Um, and so I think people that don't the InfoSec that doesn't really have visibility, and one of the reasons I like going and doing these kind of you know, InfoSec heavy, you know, like financial services stuff and whatnot, is because InfoSec there hasn't really been um you know kind of exposed to software supply chain attacks and don't realize that in a lot of cases North Korea they they are creating more of this than everybody else combined.
00:38:04.639 --> 00:38:08.000
I don't know if that's actually true statistically, but it certainly feels like that, right?
00:38:08.079 --> 00:38:09.360
So I believe it.
00:38:09.599 --> 00:38:11.840
I yeah, I mean, I think it's true.
00:38:11.920 --> 00:38:13.599
I wouldn't have said it if I didn't think it was true.
00:38:13.679 --> 00:38:16.159
I just don't have the data right now to back it up.
00:38:16.400 --> 00:38:18.159
Um, I'll work on that for next episode.
00:38:18.400 --> 00:38:23.760
Yeah, I mean, I guess the net here is we are going to see more.
00:38:24.000 --> 00:38:32.559
This is the continuation of a pattern where DPRK started by compromising GitHub repositories.
00:38:32.800 --> 00:38:44.079
Paul, your research that we published a week or two ago shows thousands and thousands of compromised, mostly individual developer repositories.
00:38:44.159 --> 00:38:45.679
That's kind of stage one.
00:38:46.079 --> 00:38:50.639
Stage two is it the malware leaks into whatever those people own.
00:38:50.719 --> 00:38:55.039
And you and I debated like, do we do we go as far to call this a worm?
00:38:55.280 --> 00:38:59.920
It's not really a worm, but it's got some real worm-like behavior.
00:39:00.079 --> 00:39:03.599
Like, as I say in the blog, when is an ATO not an ATO?
00:39:03.679 --> 00:39:05.199
When is a worm not a worm?
00:39:05.519 --> 00:39:09.840
It's a little bit of that with this um this behavior.
00:39:10.079 --> 00:39:28.559
And you know, as I was falling down the rabbit hole and you know, prepping for our show today, I found yet another, a PHP package that um is part of this, we'll call it leaking of the malware out of Git repositories into packages, or as you called it, you know, jumping the fence.
00:39:28.800 --> 00:39:34.239
We're gonna see more of these compromised packages that come through this way.
00:39:34.480 --> 00:39:39.760
And, you know, they're not um typically high download packages.
00:39:39.920 --> 00:39:45.039
They tend to be pretty niche because it's individual developers getting popped.
00:39:45.199 --> 00:39:46.880
However, it's not gonna stay that way.
00:39:46.960 --> 00:39:51.760
We're gonna see someone somewhere bigger get hit with this.
00:39:52.400 --> 00:39:55.039
Well, and we have seen Pollenwriter over the last six months.
00:39:55.119 --> 00:39:58.960
We have seen it penetrate into very, very large ecosystems.
00:39:59.119 --> 00:40:07.039
Um, so in particular, um, the the developer, the single developer that manages Neo Vim got compromised.
00:40:07.119 --> 00:40:10.960
Um, and so and it found it, Pollenwriter found itself into a VS Code extension.
00:40:11.119 --> 00:40:12.880
So um, you're right, we're gonna see this.
00:40:13.039 --> 00:40:17.519
But I think the important thing is here is it doesn't have to that for this to be successful.
00:40:17.760 --> 00:40:22.159
Pollenwriter does not have to get into OpenSearch or Light LLM.
00:40:22.239 --> 00:40:29.039
It doesn't have to do that, it just has to get into all the little packages that all these developers, and they've there's tens of thousands of people now that that have this, right?
00:40:29.199 --> 00:40:31.760
So it doesn't have to be in these big ones.
00:40:31.920 --> 00:40:36.239
In fact, if it gets in the big ones, that's when they're we get a lot of visibility and people will start taking account.
00:40:36.320 --> 00:40:43.840
If it stays in these little tiny ones, you know, in these medium, you know, a hundred stars or whatever, then you know nobody's really talking about it.
00:40:43.920 --> 00:40:50.480
And meanwhile, it's doing what it's supposed to be doing, which is self-replicating, which is the whole that's the the the first worm, yeah.
00:40:50.639 --> 00:40:53.360
Yeah, the firm wet worm Turing test.
00:40:53.440 --> 00:40:54.880
Are you are you a worm or not?
00:40:54.960 --> 00:40:56.800
Is that are do you self-replicate, right?
00:40:56.960 --> 00:41:00.079
And the reality is that this is absolutely self-replicating.
00:41:00.159 --> 00:41:05.519
So you and I don't want to use the word tur worm because we just don't want to get in this flame war with with everybody else about it.
00:41:05.679 --> 00:41:11.840
But um, the reality is, you know, like you said, it what it's a worm, we're just not calling it a worm.
00:41:12.079 --> 00:41:12.719
Yeah.
00:41:13.119 --> 00:41:15.280
Well, it's interesting stuff.
00:41:15.440 --> 00:41:18.480
Uh, I was at an event last night where I got to talk about it.
00:41:18.559 --> 00:41:21.840
I'm looking forward to talking about it next week in DEF CON.
00:41:22.000 --> 00:41:25.119
We're gonna be talking about how to threat hunt in GitHub.
00:41:25.199 --> 00:41:26.719
We've got all kinds of stuff going.
00:41:27.039 --> 00:41:29.039
I think this is a good place to wrap it up.
00:41:29.519 --> 00:41:30.159
I agree.
00:41:30.400 --> 00:41:31.440
Thanks everybody for listening.
00:41:31.519 --> 00:41:32.400
We really appreciate it.
00:41:32.800 --> 00:41:33.760
Have a great week.
00:41:33.840 --> 00:41:37.840
Uh we may or may not be here next week, but we will be in Vegas for sure.
00:41:38.320 --> 00:41:38.800
Come say hi.
00:41:40.320 --> 00:41:41.360
All right, take care.
