Passing Notes

WEBVTT
1
00:00:00.340 --> 00:00:01.240
And don't forget Discord.
2
00:00:01.250 --> 00:00:31.039
Discord.SecurityThisWeek.com. Lots of good stuff happening there. Um, yeah, I
3
00:00:31.100 --> 00:00:33.200
think that's it. So on with the podcast.
4
00:00:33.740 --> 00:00:36.840
So do you ever meet somebody like, and then you
5
00:00:36.880 --> 00:00:39.560
have a conversation for, I don't know, five minutes or something,
6
00:00:39.619 --> 00:00:42.100
and then you go your separate ways and you think
7
00:00:42.119 --> 00:00:46.149
to yourself, you know, that person is the reason that
8
00:00:46.600 --> 00:00:50.049
they put do not eat signs on laundry detergent.
9
00:00:51.310 --> 00:00:51.789
I met him.
10
00:00:52.810 --> 00:00:53.450
I know that guy.
11
00:00:53.649 --> 00:01:05.870
Yeah. Hey, guess what? It's Security This Week. I'm Carl
12
00:01:05.890 --> 00:01:08.950
with Dwayne and Patrick. We got some stories for you.
13
00:01:10.010 --> 00:01:14.609
Starting off with Microsoft. It's good news, I guess. Microsoft
14
00:01:14.650 --> 00:01:19.290
posts nearly 1,000 bugs for Patch Tuesday, as CISA warns
15
00:01:19.390 --> 00:01:20.689
to being exploited.
16
00:01:20.829 --> 00:01:24.829
So I saw someone from SANS, Ed Skotis, who teaches
17
00:01:24.890 --> 00:01:30.109
the really good instructor, used to teach the penetration testing course.
18
00:01:30.560 --> 00:01:34.659
And he's talking now about VolnOps and the fact that
19
00:01:34.680 --> 00:01:38.299
there's so many of these patches coming that you just
20
00:01:38.340 --> 00:01:42.079
got to do a whole separate operation for them. And
21
00:01:42.099 --> 00:01:43.920
I think he's right. I think we're starting to come
22
00:01:43.939 --> 00:01:47.439
into an industrial age where you have to have processes
23
00:01:47.500 --> 00:01:49.480
to handle all these patches or else you're not going
24
00:01:49.500 --> 00:01:49.920
to get through them.
25
00:01:49.939 --> 00:01:50.560
Yeah, I agree.
26
00:01:50.890 --> 00:01:53.209
I wonder though, I mean, so there are plenty of
27
00:01:53.290 --> 00:01:55.510
automated patching systems and that sort of stuff. But I
28
00:01:55.549 --> 00:01:59.400
wonder when, at what point, The software is just going
29
00:01:59.420 --> 00:02:02.500
to automatically update itself. Yeah. Like, you know what? We're just,
30
00:02:03.200 --> 00:02:05.090
we don't care. We don't care who you are. We
31
00:02:05.129 --> 00:02:08.069
don't care what systems it's installed on. We're going to
32
00:02:08.090 --> 00:02:10.449
be redundant enough where we're going to keep, you know,
33
00:02:10.750 --> 00:02:12.469
a process up and running, but we're going to update
34
00:02:12.490 --> 00:02:14.590
the back end and then bounce everything. I don't know.
35
00:02:14.629 --> 00:02:16.460
I've been talking about that for a long time on
36
00:02:16.500 --> 00:02:18.740
this show, that that's clearly where we have to go.
37
00:02:18.919 --> 00:02:19.120
Yeah.
38
00:02:19.219 --> 00:02:20.740
I think it needs to be an option, at least.
39
00:02:20.800 --> 00:02:22.800
I don't know that it's going to be the kind
40
00:02:22.840 --> 00:02:25.000
of thing that people... No, if it's an option, it's off.
41
00:02:25.509 --> 00:02:27.949
okay well i'm serious if it's if it's if you
42
00:02:27.969 --> 00:02:29.990
didn't have that dinging it's good for business yeah but
43
00:02:30.009 --> 00:02:31.789
if you didn't i know right but if you didn't
44
00:02:31.810 --> 00:02:34.439
have that dinging light in your car or sound in
45
00:02:34.460 --> 00:02:36.199
your car when you didn't have your seat belt on
46
00:02:36.460 --> 00:02:37.860
right i think most people would be like yeah i'm
47
00:02:37.879 --> 00:02:39.639
not putting a seat belt on yeah right but it's
48
00:02:39.659 --> 00:02:41.280
so obnoxious they're like you know what yeah i'll just
49
00:02:41.650 --> 00:02:43.610
Maybe that's what you need. You need a big dinging
50
00:02:43.770 --> 00:02:46.289
sound in the office when something's not patched and people
51
00:02:46.310 --> 00:02:48.330
just run around patching everything. And for every patch you
52
00:02:48.370 --> 00:02:51.469
don't have in place, the decibel goes up 0.001. Well, in.
53
00:02:52.960 --> 00:02:57.599
This particular case, there were 900 plus vulnerabilities. This is
54
00:02:57.680 --> 00:03:01.599
one of the largest patches Microsoft has ever done. This
55
00:03:01.699 --> 00:03:04.539
is record-breaking, almost a thousand bugs fixed.
56
00:03:04.780 --> 00:03:08.530
So, one of these... relates to a component used to
57
00:03:08.610 --> 00:03:09.930
install Windows updates.
58
00:03:10.250 --> 00:03:10.469
Yeah.
59
00:03:10.509 --> 00:03:14.050
And another affects a messaging system in Windows. And there's
60
00:03:14.069 --> 00:03:17.830
a quote here, the component makes it worse. An attacker
61
00:03:17.909 --> 00:03:21.219
who owns the update stack owns the thing you'd use
62
00:03:21.280 --> 00:03:21.960
to evict them.
63
00:03:22.080 --> 00:03:22.300
Right.
64
00:03:22.319 --> 00:03:25.340
And that's exactly to your point, Dwayne. If you can't
65
00:03:25.460 --> 00:03:28.300
say when the update stack last ran, you can't say
66
00:03:28.360 --> 00:03:29.280
whether it's patched.
67
00:03:29.439 --> 00:03:29.740
Right.
68
00:03:29.960 --> 00:03:30.139
Yeah.
69
00:03:30.659 --> 00:03:35.900
I mean, we're starting to see CDCI pipelines that, are
70
00:03:35.979 --> 00:03:37.680
tighter and tighter and tighter, right? It used to be
71
00:03:37.699 --> 00:03:39.699
you develop a piece of software, right?
72
00:03:40.099 --> 00:03:41.319
You want to define that term? CICD?
73
00:03:41.360 --> 00:03:45.819
Yeah, yeah, yeah. So continuous deployment, continuous integration, right? It's
74
00:03:45.879 --> 00:03:49.090
where you have devs, they push stuff out, let's say
75
00:03:49.110 --> 00:03:51.990
to GitHub, and it's a fractional patch, it's a whatever.
76
00:03:52.490 --> 00:03:55.229
And then there's a process in the background that just
77
00:03:55.590 --> 00:04:00.400
tests it, compiles it, deploys it, right? Tests, compile, deploy, test,
78
00:04:00.439 --> 00:04:02.800
and it just keeps doing that. So as you push
79
00:04:02.879 --> 00:04:07.759
code up, Think like much faster cycle for getting code
80
00:04:07.840 --> 00:04:12.419
from developers straight out to the real world. I'm wondering
81
00:04:12.479 --> 00:04:15.150
at what point, and we're also seeing vibe coding, right,
82
00:04:15.189 --> 00:04:19.009
being pretty quick. I think there are a couple services
83
00:04:19.069 --> 00:04:23.709
already starting to emerge that will actually watch your pipelines
84
00:04:23.810 --> 00:04:26.629
and look for vulnerabilities and that sort of stuff, right?
85
00:04:26.649 --> 00:04:30.540
Of course, GitHub has their own co-pilot and Dependabot and
86
00:04:30.560 --> 00:04:32.779
all that other good stuff, right, that looks for vulnerabilities
87
00:04:32.819 --> 00:04:34.910
when you when you push code up and when you
88
00:04:34.930 --> 00:04:37.110
make builds and that sort of thing. I'm wondering at
89
00:04:37.170 --> 00:04:42.029
what point they continue that pipeline, not to the software
90
00:04:42.149 --> 00:04:44.800
is available, but to the software is actually deployed to
91
00:04:44.810 --> 00:04:46.439
the customer site. Like could it, we're.
92
00:04:46.379 --> 00:04:51.500
Getting sucked into this AI automation trap that as you'll
93
00:04:51.519 --> 00:04:55.319
see in the last story, our feature story can, can
94
00:04:55.420 --> 00:04:56.779
really be a problem.
95
00:04:57.139 --> 00:04:57.300
Right.
96
00:04:57.439 --> 00:05:00.300
But, but it's also who's not going to do it.
97
00:05:00.480 --> 00:05:01.350
I mean, You know?
98
00:05:01.370 --> 00:05:03.029
Well, I mean, at this point, you have to at
99
00:05:03.050 --> 00:05:05.589
the speed at which some of these vulnerabilities are being discovered.
100
00:05:06.370 --> 00:05:08.000
We just need better insights.
101
00:05:08.250 --> 00:05:10.199
But how do you get it all the way down
102
00:05:10.220 --> 00:05:10.759
to the customer?
103
00:05:11.300 --> 00:05:11.480
Right?
104
00:05:11.540 --> 00:05:13.959
It can't be Microsoft goes, well, we gave you a
105
00:05:14.000 --> 00:05:17.879
thousand bug fixes. It's on you. That sucks.
106
00:05:17.959 --> 00:05:18.779
That's what they're doing. Right?
107
00:05:19.180 --> 00:05:21.620
I know, but it's like, well, but it's your software. Like,
108
00:05:21.680 --> 00:05:23.980
I understand you sold it to a customer, but if
109
00:05:24.040 --> 00:05:27.279
there's some sort of, like, I don't know, if I
110
00:05:27.319 --> 00:05:32.129
had a garage door that had failing you know springs
111
00:05:32.329 --> 00:05:35.170
and the the vendor knew about it they wouldn't go
112
00:05:35.269 --> 00:05:37.819
well you know if it kills a kid it kills
113
00:05:37.879 --> 00:05:40.959
a kid real sorry you know we we we fix
114
00:05:41.000 --> 00:05:42.519
the springs you should have come to us and put
115
00:05:42.540 --> 00:05:45.720
them in right they they have you know this moral
116
00:05:45.839 --> 00:05:47.560
obligation to then come to me and be like hey
117
00:05:47.579 --> 00:05:50.939
here are these springs it really could harm somebody whereas
118
00:05:50.980 --> 00:05:53.449
microsoft's like no we got the patch Apply it if
119
00:05:53.470 --> 00:05:55.730
you want. Drone risk, whatever. Just do it.
120
00:05:55.870 --> 00:05:56.199
I mean, if.
121
00:05:56.350 --> 00:05:58.939
This show is becoming less technical and more philosophical.
122
00:05:59.000 --> 00:05:59.579
I know, right?
123
00:05:59.959 --> 00:06:02.379
Well, if you look at the car industry, they notify
124
00:06:02.420 --> 00:06:04.399
you that there's a recall and it's up to you
125
00:06:04.439 --> 00:06:07.100
to get the car in when the parts are finally there.
126
00:06:07.439 --> 00:06:07.680
Sure.
127
00:06:07.740 --> 00:06:09.600
So, there's a little bit of... I mean, it's not.
128
00:06:09.639 --> 00:06:10.000
You're right.
129
00:06:10.060 --> 00:06:12.699
It's there... The software industry is a little more egregious
130
00:06:12.750 --> 00:06:13.730
in that regard. Yeah.
131
00:06:14.009 --> 00:06:14.230
All right.
132
00:06:14.250 --> 00:06:15.089
We moved on? Yeah.
133
00:06:15.129 --> 00:06:17.889
But wait, hold on before we move on. Okay. If, however,
134
00:06:17.910 --> 00:06:21.990
I don't bring my car in for the service recall...
135
00:06:22.060 --> 00:06:25.610
and it explodes in a ball of fire, the car
136
00:06:25.649 --> 00:06:26.589
company is still responsible.
137
00:06:27.470 --> 00:06:27.870
Yeah.
138
00:06:28.269 --> 00:06:30.889
So, and in this case, if I don't apply these
139
00:06:30.939 --> 00:06:36.100
patches and I get hacked... Microsoft's not responsible. They're like,
140
00:06:36.120 --> 00:06:38.579
I don't know. It's on you, man. Right. Your call.
141
00:06:38.660 --> 00:06:41.120
Is the car company responsible if you just blow off
142
00:06:41.160 --> 00:06:42.750
the recall? I don't know they are.
143
00:06:42.819 --> 00:06:45.050
So, yes, as long as it's not egregious. If it's
144
00:06:45.089 --> 00:06:48.529
like four years later and you've gotten five notifications, then, yeah,
145
00:06:48.629 --> 00:06:50.730
they're like, listen, we already told this guy many times.
146
00:06:51.069 --> 00:06:52.920
But if it's like, you know, hey, we put it
147
00:06:52.980 --> 00:06:56.279
in the news, which nobody watches, and then we... Sent out,
148
00:06:56.839 --> 00:06:58.639
you know, a letter that, you know, one letter that
149
00:06:58.680 --> 00:07:01.199
looked like spam. Right. And, you know, when you brought
150
00:07:01.240 --> 00:07:04.139
it in, you haven't brought it in for servicing yet. Well, okay,
151
00:07:04.160 --> 00:07:07.079
at this point, yeah, you haven't really done due diligence
152
00:07:07.120 --> 00:07:09.360
to notify me. So, yeah, they're responsible. Okay.
153
00:07:10.019 --> 00:07:13.879
All right, next story. Five Eyes allies warn hackers are
154
00:07:14.019 --> 00:07:18.800
actively exploiting Cisco SD-WAN flaws. What happened?
155
00:07:19.000 --> 00:07:20.420
SD-WAN.
156
00:07:21.560 --> 00:07:22.160
Cisco again.
157
00:07:22.699 --> 00:07:27.920
Yeah, this one's weird. So, all right. It's the Five Eyes.
158
00:07:27.939 --> 00:07:31.980
I think Patrick... I can't remember.
159
00:07:32.100 --> 00:07:36.579
So, the US, Canada, New Zealand, Australia, and I think
160
00:07:36.600 --> 00:07:38.850
the UK. Yeah. I don't think Iceland.
161
00:07:39.170 --> 00:07:41.350
But there was another one you added in there before.
162
00:07:41.410 --> 00:07:43.870
I can't remember what it was. But anyway, you turned
163
00:07:43.889 --> 00:07:50.230
it into the Six Eyes. Iran? Yeah. The new regime
164
00:07:50.269 --> 00:07:53.410
of Iran. But anyway, so the Five Eyes are all
165
00:07:53.430 --> 00:07:56.069
the security agencies in the world that, you know, share
166
00:07:56.110 --> 00:07:58.649
intelligence and, you know, keep an eye on all the
167
00:07:58.689 --> 00:08:02.550
bad things going on and try and stop them. Right.
168
00:08:02.949 --> 00:08:05.860
If it's like if CISA warns about something, okay, yeah,
169
00:08:05.879 --> 00:08:08.839
that's a US agency. But if all Five Eyes warn
170
00:08:08.860 --> 00:08:13.100
about something... That's probably reasonably important. The thing I don't
171
00:08:13.120 --> 00:08:14.709
get about this is, all right, yeah, this is a
172
00:08:14.750 --> 00:08:20.350
Cisco SD-WAN problem. So you have the ability to bypass
173
00:08:20.509 --> 00:08:24.810
authentication with one of these particular exploits. I believe it's
174
00:08:24.850 --> 00:08:28.060
exploit 2026, so this year.
175
00:08:28.259 --> 00:08:29.839
What is this device, actually?
176
00:08:29.839 --> 00:08:37.259
2127. So the SD-WAN is part of the Cisco networking fabric.
177
00:08:38.360 --> 00:08:40.980
So wide area network, a WAN, it's what allows you
178
00:08:41.019 --> 00:08:46.289
to extend your network, you know, over distance, I guess
179
00:08:46.350 --> 00:08:47.370
is the easiest way to put it.
180
00:08:47.389 --> 00:08:48.710
So over the internet and.
181
00:08:49.149 --> 00:08:50.129
Yeah, exactly.
182
00:08:50.190 --> 00:08:51.889
The office downtown. Yeah.
183
00:08:51.929 --> 00:08:54.110
If I had an office in California and an office here,
184
00:08:54.370 --> 00:08:57.070
I might create a WAN, a wide area network, right?
185
00:08:57.129 --> 00:08:59.169
Where we can just kind of looks like the same network.
186
00:08:59.210 --> 00:08:59.850
And that's where it's definitely.
187
00:08:59.870 --> 00:09:02.360
So you can share the same file shares on a
188
00:09:02.389 --> 00:09:03.049
SOP file server.
189
00:09:03.080 --> 00:09:04.929
So it has to be on the internet. right? It's
190
00:09:04.970 --> 00:09:05.850
not something you can hide.
191
00:09:06.090 --> 00:09:08.889
Probably includes a VPN and routers and stuff.
192
00:09:08.909 --> 00:09:12.570
Yeah, it can include all sorts of different stuff. But
193
00:09:12.629 --> 00:09:15.200
for the most part, it's supposed to make your corporate network,
194
00:09:15.259 --> 00:09:18.480
no matter how large, no matter what the disparate locations are,
195
00:09:19.059 --> 00:09:23.159
look like one network, right? Just for simplicity of resources
196
00:09:23.200 --> 00:09:26.649
and that sort of stuff. So, it has to be
197
00:09:26.669 --> 00:09:30.230
accessible on the internet. It's a device that's probably constantly
198
00:09:30.269 --> 00:09:31.889
getting hit. It's not like you can hide it behind
199
00:09:31.929 --> 00:09:33.980
a firewall because you hide it behind a firewall. It
200
00:09:34.080 --> 00:09:42.320
can't talk to its counterpart across the world. 202620127 is
201
00:09:42.460 --> 00:09:49.909
a bypass of authentication. But the other one is 202220775,
202
00:09:49.889 --> 00:09:52.370
which is a priv-esque. Okay. So, okay. So, we have
203
00:09:52.409 --> 00:09:54.210
a bypass of auth, so we can get on the box,
204
00:09:54.230 --> 00:09:55.629
and then we have a priv ask that we can
205
00:09:55.669 --> 00:09:59.899
run right um in the story they talk about finding
206
00:09:59.960 --> 00:10:03.139
an adversary that has been sitting inside of a network
207
00:10:03.159 --> 00:10:06.580
since 2023 with these flaws wow so i think this
208
00:10:06.700 --> 00:10:08.500
is one of the reasons that this is starting to
209
00:10:08.600 --> 00:10:11.450
escalate the is that they went oh crap this is
210
00:10:11.730 --> 00:10:14.919
we just found a network where somebody's been sitting there
211
00:10:14.940 --> 00:10:18.789
for three years undetected. How do you sit on a
212
00:10:18.789 --> 00:10:22.830
network device undetected for three years? Well, you have control
213
00:10:22.870 --> 00:10:26.000
over all the logs. you just clean them you just
214
00:10:26.159 --> 00:10:28.220
get rid of your presence there or no one looks
215
00:10:28.299 --> 00:10:30.159
at them well or no one looks at them but
216
00:10:30.220 --> 00:10:33.179
in this particular case we're talking nation state this is
217
00:10:33.559 --> 00:10:37.049
the the people who were embedded in uh i can
218
00:10:37.110 --> 00:10:39.230
tell you i don't think i can legally i don't
219
00:10:39.250 --> 00:10:41.610
think i can legally tell you from experience so we'll
220
00:10:41.669 --> 00:10:43.590
pretend it's not from experience.
221
00:10:45.250 --> 00:10:48.090
You really suck at this legal stuff There's.
222
00:10:48.029 --> 00:10:52.429
A reason we have lawyers. Staying in a system for
223
00:10:52.649 --> 00:10:57.669
three years is not easy and being undetected. There are
224
00:10:57.870 --> 00:11:01.629
a lot of chances. The longer you're in a system,
225
00:11:02.669 --> 00:11:05.220
the longer you're monitoring what people are doing, the longer
226
00:11:05.240 --> 00:11:09.610
you're offloading data. Every second is a chance you're going
227
00:11:09.649 --> 00:11:11.009
to get detected by something.
228
00:11:11.149 --> 00:11:13.049
What was that movie? There's a movie that was out
229
00:11:13.110 --> 00:11:14.809
not too long ago about a guy living in the
230
00:11:14.830 --> 00:11:19.500
top of a Toys R Us, living in the attic space. Yes.
231
00:11:19.629 --> 00:11:26.019
Inside Man. It wasn't Inside Man, was it? Something like that. Yeah.
232
00:11:26.039 --> 00:11:27.620
And so it's like that. Like, how do you go
233
00:11:27.639 --> 00:11:31.570
to the bathroom without getting detected? It's a very similar problem.
234
00:11:33.350 --> 00:11:33.730
Okay.
235
00:11:33.750 --> 00:11:36.090
Sorry. I derailed that really quick.
236
00:11:36.169 --> 00:11:37.090
Anything else you want to say?
237
00:11:37.110 --> 00:11:41.629
No, now I'm curious. What was it? It was Roofman. Roofman,
238
00:11:41.649 --> 00:11:42.250
you were close.
239
00:11:42.450 --> 00:11:44.970
Roofman, that's it. Yeah, Channing Tatum is in it. Yes.
240
00:11:45.480 --> 00:11:46.960
Yeah. Hilarious.
241
00:11:47.179 --> 00:11:48.159
Okay, next story.
242
00:11:48.179 --> 00:11:48.590
Let's hit it.
243
00:11:48.720 --> 00:11:50.100
Tatum Channing, not Channing Tatum.
244
00:11:50.580 --> 00:11:50.840
Okay.
245
00:11:51.039 --> 00:11:56.559
Texas utility Centerpoint Energy confirms data breach after hacker claims 7.49
246
00:11:56.559 --> 00:12:01.299
million records stolen. So, just another data breach.
247
00:12:01.659 --> 00:12:03.549
And this is going to be a This is going
248
00:12:03.570 --> 00:12:05.129
to be a theme. And actually, this is one of
249
00:12:05.149 --> 00:12:07.029
the things I actually wanted to bring up with you guys.
250
00:12:07.269 --> 00:12:09.190
There's a couple data breaches we have in our stories
251
00:12:09.230 --> 00:12:12.399
this week. And while we're talking about these stories, I
252
00:12:12.419 --> 00:12:16.059
want us to think in the background, why would data
253
00:12:16.100 --> 00:12:20.220
breaches potentially be more important now, especially coupled with AI?
254
00:12:20.820 --> 00:12:22.440
They just... Speed.
255
00:12:22.779 --> 00:12:27.029
It's a fertile ground. Basically, once I have data, I
256
00:12:27.070 --> 00:12:29.409
got more... I can feed into the AI and it
257
00:12:29.429 --> 00:12:34.649
can discover... More vulnerabilities, more insights, better phishing. Yeah.
258
00:12:34.769 --> 00:12:35.769
Attack velocity.
259
00:12:35.789 --> 00:12:37.950
I mean, phishing, it's going to be off the hook.
260
00:12:38.149 --> 00:12:42.250
Yeah. And the AIs, they thrive on data, right? So
261
00:12:42.289 --> 00:12:43.850
the more data I can give them and the more
262
00:12:43.929 --> 00:12:47.360
private and personalized information I can give them, the better, right?
263
00:12:47.440 --> 00:12:50.539
So I could see attackers taking this path of, let's
264
00:12:50.559 --> 00:12:54.799
just buy and steal and get as much personal information
265
00:12:54.820 --> 00:12:57.279
as we possibly can from as many breaches as possible
266
00:12:57.320 --> 00:13:00.350
and then start profiling. all the way down to the individual,
267
00:13:00.450 --> 00:13:04.870
but absolutely profiling companies and maybe what the default passwords
268
00:13:04.889 --> 00:13:06.529
they are and, you know, what they use and the
269
00:13:06.570 --> 00:13:09.009
type of people they would hire and all sorts of stuff.
270
00:13:09.070 --> 00:13:11.309
So have the AI pick the target saying, what can
271
00:13:11.330 --> 00:13:13.330
we get from, from this data? Yeah.
272
00:13:13.429 --> 00:13:16.149
And, and maybe even have those AIs, uh, you know,
273
00:13:16.220 --> 00:13:19.940
start social engineering people in the right terminology and all
274
00:13:19.960 --> 00:13:22.360
that other good stuff. So there may be some other
275
00:13:22.440 --> 00:13:25.879
ulterior motives here than just your normal smash and grab
276
00:13:25.960 --> 00:13:29.639
of data thieves. Um, But this is a lot. This
277
00:13:29.730 --> 00:13:36.350
is 7.49 million records, including a whole bunch of private
278
00:13:36.389 --> 00:13:42.169
information from different people. This was, let's see, Texas, Indiana, Minnesota,
279
00:13:42.289 --> 00:13:47.490
Ohio are all confirmed in the data breach. The attackers
280
00:13:47.570 --> 00:13:50.490
gained access. I love this statement. The attackers gained access
281
00:13:50.529 --> 00:13:54.299
through an external facing system. Oh, that's it. That's woof.
282
00:13:54.600 --> 00:13:55.500
That's, that's deep.
283
00:13:55.539 --> 00:13:59.230
Yeah. God, that's, yeah. Thanks for that forensic analysis.
284
00:13:59.429 --> 00:14:00.730
Right.
285
00:14:00.769 --> 00:14:04.159
You know how they got the data. They connected a
286
00:14:04.179 --> 00:14:06.840
computer to the internet. Oh, wow.
287
00:14:06.860 --> 00:14:07.759
From the outside.
288
00:14:07.779 --> 00:14:11.000
Foiled again. Was it a Cisco WAN?
289
00:14:12.519 --> 00:14:14.539
Exactly. Didn't see that coming.
290
00:14:15.080 --> 00:14:17.299
So do we know if they got credit cards or
291
00:14:17.340 --> 00:14:18.080
what they got?
292
00:14:18.350 --> 00:14:21.450
So according to this, it says billing data was leaked, name, address,
293
00:14:21.470 --> 00:14:24.730
social security number likely, but they haven't really gone through
294
00:14:24.909 --> 00:14:30.549
too much. The filing with the SEC was yesterday, I think.
295
00:14:31.169 --> 00:14:35.090
Two days ago. I think it was the 15th. So,
296
00:14:35.389 --> 00:14:37.690
and the filing with the SEC is like, hey, listen,
297
00:14:38.210 --> 00:14:38.769
it went down.
298
00:14:38.990 --> 00:14:39.210
Yeah.
299
00:14:39.269 --> 00:14:39.429
Right.
300
00:14:39.470 --> 00:14:41.110
It's not, I don't know if you've ever read these.
301
00:14:41.149 --> 00:14:44.600
They're not super detailed. And nine times out of, actually,
302
00:14:44.600 --> 00:14:47.559
99 times out of 100, they'll say, we have an
303
00:14:47.639 --> 00:14:50.320
ongoing investigation. We've hired an appropriate team.
304
00:14:50.559 --> 00:14:50.779
Right.
305
00:14:51.519 --> 00:14:53.659
And they don't really go into too, too much detail.
306
00:14:53.940 --> 00:14:55.120
All right.
307
00:14:55.279 --> 00:15:01.529
Well, another ransomware leak in Berlin, ransomware leak exposes state secrets.
308
00:15:01.870 --> 00:15:03.970
Well, that's because they refused to pay the ransom, which
309
00:15:04.190 --> 00:15:04.789
I applaud.
310
00:15:04.950 --> 00:15:06.679
I was going to ask you about this, Patrick.
311
00:15:07.000 --> 00:15:11.480
Yeah. So, it was a 30 Bitcoin ransom in a
312
00:15:11.539 --> 00:15:12.860
Bitcoin that's worth a lot of money.
313
00:15:13.059 --> 00:15:17.549
Yeah, that's not small. I haven't looked at the recent prices.
314
00:15:17.590 --> 00:15:20.529
It went as high as $ 1. 10 and now I think
315
00:15:20.549 --> 00:15:22.440
they're down to like $ 80. or something like that.
316
00:15:22.480 --> 00:15:24.350
And just to be clear, he means $ 110, 000, not $ 1. 10. Yeah.
317
00:15:24.370 --> 00:15:31.250
And then it's now.
318
00:15:29.049 --> 00:15:32.450
Hovering around $ 80, 000, $ 88, 000, something like that. So, it's not cheap.
319
00:15:32.509 --> 00:15:34.210
Is this a podcast from 2016? Yeah. It's $ 100 Bitcoin.
320
00:15:34.230 --> 00:15:34.460
Yeah.
321
00:15:34.480 --> 00:15:39.379
So, this group has obviously stolen information. One point, 4.4
322
00:15:46.960 --> 00:15:50.870
million files. So, not a small amount of data. 5.8
323
00:15:50.870 --> 00:15:56.549
terabytes of data over a period of seven days they
324
00:15:56.590 --> 00:15:58.389
were in there. So, they were in there from, I
325
00:15:58.409 --> 00:16:03.590
think it was August. I'd have to look at the days,
326
00:16:03.629 --> 00:16:06.149
August 7th through the 14th, 2026.
327
00:16:06.129 --> 00:16:10.960
So, let's get philosophical again. So, Patrick, You applaud them
328
00:16:11.000 --> 00:16:12.779
because they refused to pay the ransom.
329
00:16:12.860 --> 00:16:15.549
Yeah, not because they had unencrypted data sitting on their
330
00:16:15.590 --> 00:16:16.789
network that was accessible.
331
00:16:16.809 --> 00:16:20.990
Are they liable for this data? Are the people whose
332
00:16:21.049 --> 00:16:22.629
data got leaked, can they sue?
333
00:16:22.649 --> 00:16:25.450
I don't know. I don't think so. Because if they could,
334
00:16:25.509 --> 00:16:27.610
then we'd have lots and lots and lots and lots
335
00:16:27.649 --> 00:16:31.370
and lots of lawsuits. Because police departments get hacked and
336
00:16:31.629 --> 00:16:35.080
sometimes they don't pay. I don't know that we have.
337
00:16:35.629 --> 00:16:37.500
You could try to get a class action, but those
338
00:16:37.519 --> 00:16:41.710
aren't easy to get. So, yeah. Could all the people
339
00:16:41.909 --> 00:16:43.909
who were involved in the last one we talked about
340
00:16:44.250 --> 00:16:45.970
get together and do a class action? Yeah, they might
341
00:16:46.009 --> 00:16:46.450
be able to.
342
00:16:46.590 --> 00:16:49.120
In class actions, the only people who benefit are the
343
00:16:49.149 --> 00:16:51.799
lawyers who put them together. Everybody gets pennies.
344
00:16:51.840 --> 00:16:53.700
You get, hey, Dwayne, you get a class action.
345
00:16:53.720 --> 00:16:54.159
You get $ 1.
346
00:16:53.960 --> 00:16:57.299
50. You can get a dollar. Yeah, yeah. The stamps
347
00:16:57.360 --> 00:16:58.539
aren't worth it. Yeah.
348
00:16:58.720 --> 00:16:59.519
Yeah, right.
349
00:16:59.539 --> 00:17:01.940
So, you know, I don't know.
350
00:17:02.240 --> 00:17:02.899
I'm not a lawyer.
351
00:17:02.919 --> 00:17:07.069
I don't even play one on TV. But... I haven't
352
00:17:07.180 --> 00:17:11.289
seen any lawsuits that fall from this. I think the
353
00:17:11.309 --> 00:17:15.069
biggest problem with the Berlin exploit is that there was
354
00:17:15.130 --> 00:17:16.380
like national defense data.
355
00:17:16.490 --> 00:17:16.710
Yeah.
356
00:17:16.980 --> 00:17:18.940
And now that's a problem. So that's a decision they
357
00:17:18.980 --> 00:17:19.559
have to make.
358
00:17:19.700 --> 00:17:21.500
So you still applaud the fact that they didn't pay
359
00:17:21.539 --> 00:17:21.940
the ransom?
360
00:17:22.160 --> 00:17:26.720
I applaud the The aspect of generally not paying ransoms.
361
00:17:27.460 --> 00:17:30.549
Maybe they were stupid to not pay it. But honestly,
362
00:17:30.710 --> 00:17:33.609
if someone comes and ransom wires you, do you think
363
00:17:33.630 --> 00:17:35.509
they're going to delete it after you pay them? No.
364
00:17:35.670 --> 00:17:36.609
Yeah, yeah.
365
00:17:36.690 --> 00:17:38.890
Yeah, I mean, that's a good point, Patrick. And we
366
00:17:38.930 --> 00:17:42.619
found a couple different things. First off, if you get ransomware,
367
00:17:42.640 --> 00:17:47.359
a lot of times you're paying to get the decryption utilities,
368
00:17:47.400 --> 00:17:49.700
the keys and that sort of stuff. There's a very
369
00:17:49.740 --> 00:17:52.220
strong chance those keys don't work. right and there's a
370
00:17:52.240 --> 00:17:55.240
very strong chance those keys don't work for every file right.
371
00:17:55.099 --> 00:17:57.680
They're not was it like 60 percent yeah it's 60
372
00:17:57.680 --> 00:17:59.839
percent of the time you don't get back the data
373
00:17:59.900 --> 00:18:01.759
it's it's not i don't know if it's that high
374
00:18:01.779 --> 00:18:03.500
but i do know it's very close to that where
375
00:18:03.539 --> 00:18:05.059
it's like well maybe it's 60 percent of time you
376
00:18:05.079 --> 00:18:06.259
don't get back all the data.
377
00:18:06.160 --> 00:18:08.529
Yeah exactly yeah where you won't get back every file
378
00:18:08.569 --> 00:18:10.869
because it's like oh if it messes up during encrypting
379
00:18:10.890 --> 00:18:14.519
some important file Whatever, it just pitches an error, you know,
380
00:18:14.890 --> 00:18:16.380
torches the file and keeps moving.
381
00:18:16.460 --> 00:18:18.480
And the file is gobbledygook.
382
00:18:18.500 --> 00:18:21.940
Yeah, exactly. You're never going to recover it. So, that's
383
00:18:22.039 --> 00:18:24.319
one thing is, A, you're not going to recover all
384
00:18:24.339 --> 00:18:27.619
your data. B, there's no guarantees that they remove the
385
00:18:27.660 --> 00:18:30.930
data that they have, right? Especially things like this where
386
00:18:30.970 --> 00:18:34.809
it says credentials, plain text passwords. First off, why oh
387
00:18:34.890 --> 00:18:39.509
why is anybody in 2026 storing plain text passwords anywhere?
388
00:18:39.569 --> 00:18:39.710
Right.
389
00:18:40.000 --> 00:18:40.980
Makes no sense to me.
390
00:18:40.920 --> 00:18:45.200
But for national defense data i mean okay.
391
00:18:46.400 --> 00:18:48.480
Yeah it doesn't make any i don't know where you
392
00:18:48.519 --> 00:18:50.160
would ever store plain.
393
00:18:49.960 --> 00:18:53.039
Text it's not like it's a big city that's the
394
00:18:53.099 --> 00:18:54.779
capital of a major country oh wait a.
395
00:18:54.740 --> 00:18:59.500
Minute no it's the name of a 80s rock group.
396
00:18:59.559 --> 00:19:04.359
Yeah yeah so i don't get it um so how
397
00:19:04.460 --> 00:19:06.519
are they liable that's a great question are they liable
398
00:19:06.559 --> 00:19:09.450
for the types of data like if Let's say they
399
00:19:09.490 --> 00:19:12.690
were breached and all the data was encrypted at rest
400
00:19:13.190 --> 00:19:17.630
and the hackers got, you know, garbage, right? They've done
401
00:19:17.650 --> 00:19:20.150
a good job at securing their data at rest and
402
00:19:20.190 --> 00:19:22.599
in motion and the hackers didn't get anything.
403
00:19:22.839 --> 00:19:23.099
Awesome.
404
00:19:23.119 --> 00:19:26.299
They should be applauded. The full opposite side of that,
405
00:19:26.500 --> 00:19:30.039
if they didn't do any of those protections, are they liable? Yeah,
406
00:19:30.079 --> 00:19:30.859
I think they should be.
407
00:19:30.960 --> 00:19:31.920
Such is this case.
408
00:19:32.259 --> 00:19:32.480
Right?
409
00:19:32.500 --> 00:19:35.140
Yeah. Because if you don't hold them liable, what is
410
00:19:35.180 --> 00:19:38.680
going to What is going to force agencies like this
411
00:19:38.700 --> 00:19:42.440
to actually go and do the right things, spend the
412
00:19:42.480 --> 00:19:44.059
time in securing the data properly?
413
00:19:44.079 --> 00:19:46.769
Only elections, and those don't work too often either.
414
00:19:47.240 --> 00:19:49.210
Well, I got to admit, this story took my breath away.
415
00:19:50.250 --> 00:19:50.859
See what I did there?
416
00:19:52.039 --> 00:19:53.380
Everyone over 50 gets it.
417
00:19:53.660 --> 00:19:54.680
That's right.
418
00:19:54.759 --> 00:19:56.140
I don't know what you're talking about, guys.
419
00:19:56.599 --> 00:19:57.160
Yeah, okay.
420
00:19:57.759 --> 00:19:59.200
I guess we should take a little break here.
421
00:19:59.240 --> 00:19:59.980
Good? Yeah. Good.
422
00:20:00.019 --> 00:20:02.559
Let's do that. We'll be right back after these important messages.
423
00:20:06.440 --> 00:20:09.240
We're back at Security This Week. Dwayne Patrick and me,
424
00:20:09.359 --> 00:20:12.410
Carl Franklin. And we got a few more stories here
425
00:20:12.509 --> 00:20:17.109
for you. The next one is Bamboo Token, the malware
426
00:20:17.150 --> 00:20:20.650
that speaks MQTT to stay under the radar.
427
00:20:23.109 --> 00:20:29.119
So MQTT, for those of you who are unfamiliar with MQTT,
428
00:20:29.759 --> 00:20:33.259
stands for Message Queuing Telemetry Transport.
429
00:20:33.359 --> 00:20:34.759
We have talked about this before.
430
00:20:34.819 --> 00:20:35.380
We have.
431
00:20:35.720 --> 00:20:36.000
Yeah.
432
00:20:36.180 --> 00:20:39.700
It's actually really kind of a neat technology.
433
00:20:40.579 --> 00:20:43.799
I mean, message queues are super, super handy at scaling.
434
00:20:43.940 --> 00:20:47.140
Yes. And they've been around, I don't know, forever.
435
00:20:47.269 --> 00:20:48.509
I think mainframes have.
436
00:20:48.930 --> 00:20:50.730
I mean, MSM queue's been around forever.
437
00:20:50.750 --> 00:20:53.029
This is the telemetry. So, this is the data, the
438
00:20:53.089 --> 00:20:55.930
metadata about the transfers and stuff.
439
00:20:56.130 --> 00:21:00.369
Right. So, you have a message queue where anybody can
440
00:21:00.430 --> 00:21:03.890
put messages on that queue. And then you can then
441
00:21:03.970 --> 00:21:07.829
subscribe to a particular channel. Call it a room or
442
00:21:07.849 --> 00:21:09.970
a forum or a channel or whatever. Depends on the queue.
443
00:21:10.619 --> 00:21:13.059
And you get notifications automatically when a new message is
444
00:21:13.099 --> 00:21:15.440
there and you can then reply with a different message
445
00:21:15.460 --> 00:21:17.869
and that sort of stuff. And it scales very, very,
446
00:21:17.920 --> 00:21:20.529
very well. You know, I could have tens of thousands,
447
00:21:20.549 --> 00:21:23.630
hundreds of thousands of systems talking to a message queue.
448
00:21:23.670 --> 00:21:26.890
And it's not the same thing as like a star
449
00:21:26.930 --> 00:21:29.930
network or a peer-to-peer network where they're all kind of
450
00:21:29.970 --> 00:21:33.450
trying to jumble and talk to each other. And in
451
00:21:33.490 --> 00:21:37.970
some cases, a lot more reliable of a communication. The
452
00:21:38.069 --> 00:21:42.200
downside is it's not fast. Yeah. Right. So, there's always
453
00:21:42.259 --> 00:21:44.680
pros and cons in computer science, right? There's always the
454
00:21:44.799 --> 00:21:45.900
speed versus whatever.
455
00:21:46.000 --> 00:21:48.619
Well, they wanted to stay under the radar and they're
456
00:21:48.660 --> 00:21:51.609
using a technique that Duane really loves called side loading.
457
00:21:51.809 --> 00:21:56.869
Love side loading. Side channel attacks are awesome. And the
458
00:21:56.910 --> 00:22:00.430
great thing about using MQTT is a lot of firewalls
459
00:22:00.490 --> 00:22:04.849
as you're X filling data out of a system. if
460
00:22:04.910 --> 00:22:07.319
I'm communicating with a message queue on the outside of
461
00:22:07.339 --> 00:22:09.700
the network, most people aren't looking at that traffic, right?
462
00:22:09.759 --> 00:22:11.680
Most people are looking for, Oh, are they communicating a
463
00:22:11.720 --> 00:22:14.859
report 80 or four, four, three, and let's inspect all
464
00:22:14.880 --> 00:22:18.460
that traffic and blah, blah, blah, whatever. If they see,
465
00:22:18.700 --> 00:22:21.640
we've talked about X filling data over DNS, right? And
466
00:22:21.720 --> 00:22:24.769
using DNS as command and control. Right now there's DNS
467
00:22:24.809 --> 00:22:29.769
products that will actually look for that. Right. Um, But
468
00:22:29.970 --> 00:22:32.640
MQTT is like, listen, attackers are just going to move
469
00:22:32.680 --> 00:22:33.500
to another protocol.
470
00:22:33.839 --> 00:22:34.019
Right.
471
00:22:34.059 --> 00:22:34.660
And there's a lot of them.
472
00:22:34.680 --> 00:22:36.859
As soon as somebody's watching them, they're out of there.
473
00:22:36.880 --> 00:22:37.640
They do something else.
474
00:22:37.700 --> 00:22:40.099
There's a virtually infinite number of places for them to
475
00:22:40.119 --> 00:22:40.339
go to.
476
00:22:40.400 --> 00:22:42.500
And there's some you've never thought of. I think Patrick
477
00:22:42.519 --> 00:22:44.460
brought one up, I don't know, a year, two years
478
00:22:44.500 --> 00:22:46.519
ago on this show where he was like, well, what if,
479
00:22:47.339 --> 00:22:51.049
what if you just reached out to a particular server
480
00:22:51.109 --> 00:22:53.529
over a random port and you didn't send any data?
481
00:22:53.890 --> 00:22:57.150
Think like Morse code. It's just Tapping a port out
482
00:22:57.190 --> 00:23:00.769
there remotely in random, it looks like random times with
483
00:23:00.869 --> 00:23:05.410
random amounts of, you know, attempts. And that's data, right?
484
00:23:05.430 --> 00:23:06.349
Zeros and ones.
485
00:23:06.369 --> 00:23:08.450
Because data can be held in anything. The metadata could
486
00:23:08.470 --> 00:23:10.559
be how many times did you hit the ports and
487
00:23:10.599 --> 00:23:12.559
what port order did you hit it in, right?
488
00:23:12.920 --> 00:23:13.140
Yeah.
489
00:23:13.200 --> 00:23:15.140
And they can inspect that traffic all day long. There's
490
00:23:15.180 --> 00:23:18.609
nothing there. Yeah, you'd have to know the code. Right, exactly.
491
00:23:19.150 --> 00:23:21.650
Or you'd have to block anything you don't understand, which
492
00:23:21.690 --> 00:23:22.490
would block a lot.
493
00:23:22.769 --> 00:23:25.549
Exactly. Yeah, exactly. And it's the same type of thing
494
00:23:25.589 --> 00:23:28.170
as port knocking. I don't know, have we talked about
495
00:23:28.210 --> 00:23:29.269
port knocking on here before?
496
00:23:29.289 --> 00:23:31.799
I think that was the context of me bringing that up.
497
00:23:32.039 --> 00:23:33.000
Entirely possible.
498
00:23:33.140 --> 00:23:35.180
Was we talked about port knocking. Port knocking, why don't
499
00:23:35.200 --> 00:23:37.859
you cover it? It's actually, it's one of my favorite things.
500
00:23:38.079 --> 00:23:40.500
Port knocking is cool. So imagine I want to communicate
501
00:23:40.880 --> 00:23:42.880
secretly with a server over the internet and I don't
502
00:23:42.900 --> 00:23:45.119
want to leave port 22 open, which is SSH or...
503
00:23:46.180 --> 00:23:50.119
one of the other normal communication ports. What I could
504
00:23:50.200 --> 00:23:55.059
do is listen on all ports. So, that's 65,535 ports.
505
00:23:55.740 --> 00:23:59.900
And then if you hit a series of ports... In
506
00:23:59.920 --> 00:24:03.109
the right order. In the right order, I open up
507
00:24:03.130 --> 00:24:04.369
port 22 just for you.
508
00:24:04.890 --> 00:24:05.049
Ooh.
509
00:24:05.529 --> 00:24:07.269
So, now you can say, oh, well, if I hit
510
00:24:07.369 --> 00:24:19.799
port 32,200, port 9, port 16,300... And port 65,532 in order. Now, yeah,
511
00:24:19.819 --> 00:24:21.819
it opens up 22 and only for my IP address
512
00:24:21.839 --> 00:24:23.680
and I can connect to it and I can now communicate.
513
00:24:23.740 --> 00:24:24.150
Wow.
514
00:24:24.430 --> 00:24:26.589
And you can even do things where you put a
515
00:24:26.630 --> 00:24:29.349
pause in, like you do it a minute apart. Yeah. So,
516
00:24:29.369 --> 00:24:29.990
that way.
517
00:24:30.250 --> 00:24:30.509
Yeah.
518
00:24:30.609 --> 00:24:40.369
But even just imagine 65,535 ports at three different Just three,
519
00:24:40.609 --> 00:24:43.029
just three different ports in the combination. But you could
520
00:24:43.069 --> 00:24:45.450
make it 16. Sure. Yeah, but let's say it's only three.
521
00:24:45.470 --> 00:24:45.799
Yeah.
522
00:24:45.839 --> 00:24:49.700
Let's say it's only three. You're looking at 65,535. Times that,
523
00:24:49.779 --> 00:24:56.599
times that. Times 65,535. Right, exactly. So it's 65,000 cubed
524
00:24:56.940 --> 00:24:59.240
is insane. And that's only three.
525
00:24:59.279 --> 00:24:59.539
Yes.
526
00:25:00.059 --> 00:25:03.009
Because you think three digit password, that's crappy, right? But
527
00:25:03.029 --> 00:25:05.069
that's because we only have zero to nine.
528
00:25:05.089 --> 00:25:05.970
There's only 10 numbers.
529
00:25:06.460 --> 00:25:12.019
Yeah. Now, imagine you have 65,000 digits. Yeah, that's a
530
00:25:12.119 --> 00:25:15.549
neat tactic. Do we say that's like hyper-secure? No.
531
00:25:16.269 --> 00:25:19.670
So, you're saying if we include Chinese characters in our password,
532
00:25:20.569 --> 00:25:23.250
we can have a four-character password and it'll be okay.
533
00:25:23.589 --> 00:25:24.890
We are right. We are right.
534
00:25:25.990 --> 00:25:30.289
Wow. Size doesn't matter to the Chinese, apparently.
535
00:25:30.930 --> 00:25:35.059
So, the moral of this story is just this... The
536
00:25:35.460 --> 00:25:39.500
exfiltration and or command and control of systems that may
537
00:25:39.559 --> 00:25:43.470
be breached in an organization changes with the time.
538
00:25:43.769 --> 00:25:45.869
I think the message is that we have far more
539
00:25:45.910 --> 00:25:50.509
job security than we thought. I mean, 20 years ago,
540
00:25:50.529 --> 00:25:52.829
we've been doing this for a long time. 20 years ago,
541
00:25:52.890 --> 00:25:55.380
we were pretty well into it already. Would you have
542
00:25:55.440 --> 00:25:59.079
imagined that there would be organizations this wide open still?
543
00:25:59.220 --> 00:25:59.680
Oh, hell no.
544
00:25:59.799 --> 00:26:00.099
I didn't.
545
00:26:00.519 --> 00:26:04.839
Hell no. I mean, seriously, when the world adopted firewalls,
546
00:26:04.940 --> 00:26:07.119
and yes, we're that old. You thought it was over. Yeah,
547
00:26:07.140 --> 00:26:09.119
we were like, you know what, it's done. Yeah, before
548
00:26:09.180 --> 00:26:09.579
I could just.
549
00:26:09.680 --> 00:26:15.470
Better learn how to weld. Yeah. Yeah.
550
00:26:15.730 --> 00:26:18.390
So, it's been a fun ride. All right.
551
00:26:18.950 --> 00:26:19.430
Next story.
552
00:26:19.450 --> 00:26:19.900
Let's do it.
553
00:26:20.069 --> 00:26:21.450
Revolut. Revolut.
554
00:26:21.869 --> 00:26:22.329
Revolut.
555
00:26:22.369 --> 00:26:22.750
Revolut.
556
00:26:24.029 --> 00:26:27.529
Confirms customer data breach through fake government requests.
557
00:26:28.069 --> 00:26:29.730
Oh, no, not the Revolut.
558
00:26:30.210 --> 00:26:32.569
No, the British. This is a British company. Yeah. They're
559
00:26:32.589 --> 00:26:35.869
a fintech company. And, of course, they had the sad
560
00:26:35.930 --> 00:26:40.660
news to confirm sensitive customer information by an unauthorized third party.
561
00:26:42.079 --> 00:26:46.240
And it's basically fraudulent requests sent from a legitimate government
562
00:26:46.319 --> 00:26:47.460
agency email domain.
563
00:26:47.640 --> 00:26:47.900
Yeah.
564
00:26:48.279 --> 00:26:50.220
So, trust but verify. Okay.
565
00:26:50.730 --> 00:26:51.130
Mm-hmm.
566
00:26:51.250 --> 00:26:52.190
Right?
567
00:26:52.289 --> 00:26:54.950
That's a tough one because this was a compromised Italian
568
00:26:55.009 --> 00:27:00.089
government email account sent out fraudulent requests. So, they appear
569
00:27:00.779 --> 00:27:02.990
in all intents and purposes to be legitimate.
570
00:27:03.450 --> 00:27:03.599
Right.
571
00:27:03.619 --> 00:27:06.079
Look at the domain, it looks legitimate. Spam filters are
572
00:27:06.140 --> 00:27:08.579
not going to pick it up, right? Because it's a
573
00:27:08.700 --> 00:27:15.200
real domain. But this is the classic attack when you
574
00:27:15.220 --> 00:27:18.720
go to buy a home, right? We've seen this where
575
00:27:19.299 --> 00:27:22.740
Hackers will compromise the real estate agents or the title
576
00:27:22.799 --> 00:27:26.220
companies and just sit there and wait for somebody to
577
00:27:26.259 --> 00:27:28.539
go purchase a house. And then they go, oh, by
578
00:27:28.579 --> 00:27:31.420
the way, that earnest money you need to pay or
579
00:27:31.519 --> 00:27:33.859
the whatever needs to go to this bank account instead.
580
00:27:34.019 --> 00:27:38.809
And the new buyers send money to hackers instead. And
581
00:27:38.829 --> 00:27:41.029
it looks legitimate and they're in the system and they're
582
00:27:41.069 --> 00:27:44.029
watching for the purchases. So business email compromise is huge.
583
00:27:44.710 --> 00:27:46.390
And in this case, you can see kind of what
584
00:27:46.410 --> 00:27:49.339
the ramifications are. It's not just money. Um, there's all
585
00:27:49.400 --> 00:27:51.519
sorts of accounts that were compromised here because of it.
586
00:27:51.769 --> 00:27:54.369
I would assume this would pay out on your cyber insurance.
587
00:27:54.509 --> 00:27:57.210
I don't know, but I would assume that this is
588
00:27:57.250 --> 00:27:57.990
the kind of thing that.
589
00:27:57.930 --> 00:28:00.430
It was built to pay out on. I, I would
590
00:28:00.509 --> 00:28:01.049
think so.
591
00:28:01.069 --> 00:28:04.049
Um, because there's, there's very hard to blame the victim
592
00:28:04.089 --> 00:28:06.329
in this case because of that. You can still blame
593
00:28:06.369 --> 00:28:08.319
the victim. There's still things they could have done to,
594
00:28:08.450 --> 00:28:11.720
to prevent it, but it's kind of asking for above
595
00:28:11.779 --> 00:28:12.299
and beyond.
596
00:28:12.920 --> 00:28:15.509
The thing I don't understand is in here it says, uh,
597
00:28:16.039 --> 00:28:20.900
The Italian government PEC domain was compromised. Attackers claimed to
598
00:28:20.940 --> 00:28:27.069
have stolen 147 gig from the Italian state systems. Multiple
599
00:28:27.089 --> 00:28:32.430
law enforcement agencies allegedly involved for a six-month operating window. Wow.
600
00:28:32.490 --> 00:28:34.490
I mean, they were in there a while just rummaging
601
00:28:34.549 --> 00:28:38.660
around and taking things, right? And conning people into giving
602
00:28:38.700 --> 00:28:40.680
them information because they look legitimate.
603
00:28:40.779 --> 00:28:44.450
I think there's a correlation between how easy it is
604
00:28:44.490 --> 00:28:46.750
to get into an organization and how long you'll stay
605
00:28:46.789 --> 00:28:47.910
without anybody finding you.
606
00:28:48.490 --> 00:28:50.589
Well, that's an interesting postulate.
607
00:28:50.650 --> 00:28:53.569
I'm sure there's a correlation. I'm sure it's positively correlated. Yeah.
608
00:28:53.630 --> 00:28:55.990
If you can get into a company in under 10 minutes,
609
00:28:56.130 --> 00:28:59.079
you probably could stay there for 10 years. Stay for
610
00:28:59.079 --> 00:29:00.039
10 months. Yeah.
611
00:29:00.079 --> 00:29:02.359
Let's do minutes per year, right?
612
00:29:02.380 --> 00:29:05.559
There you go. If it takes you, you know, if
613
00:29:05.619 --> 00:29:07.059
it takes you, I don't know. I mean, it's got
614
00:29:07.079 --> 00:29:10.359
to be inversely proportional, right? If it takes you an hour,
615
00:29:10.380 --> 00:29:12.259
you're probably only there for.
616
00:29:12.869 --> 00:29:15.450
Yeah, the longer it takes you, the more likely they
617
00:29:15.470 --> 00:29:16.789
are to discover you. Right.
618
00:29:17.190 --> 00:29:22.329
Yeah, that's interesting. And that changes over time. Engineers come
619
00:29:22.349 --> 00:29:25.309
and go, systems come and go, attack techniques come and go.
620
00:29:25.349 --> 00:29:27.650
So you may be doing all the right things today,
621
00:29:27.670 --> 00:29:30.789
and then tomorrow you need to make sure you're up
622
00:29:30.809 --> 00:29:31.150
in your game.
623
00:29:31.190 --> 00:29:33.130
One of the things that I think AI could definitely
624
00:29:33.190 --> 00:29:37.019
help with is the institutional knowledge of where everything is.
625
00:29:37.599 --> 00:29:39.539
So we had a large company come to us back
626
00:29:40.339 --> 00:29:43.140
it must have been 15 years ago in the UK
627
00:29:43.279 --> 00:29:45.660
and said hey we have a data center with 10,000
628
00:29:45.660 --> 00:29:47.500
servers and we don't know what they are where they
629
00:29:47.579 --> 00:29:50.619
are what they do and we can't put a wad
630
00:29:50.700 --> 00:29:53.220
in unless we take a wad out and they had
631
00:29:53.240 --> 00:29:57.869
this real problem AI is perfect pitch for that because
632
00:29:57.910 --> 00:30:00.049
you can feed in all that data that we talked about.
633
00:30:00.490 --> 00:30:02.289
All right, so let's move on to the Ars Technica
634
00:30:02.329 --> 00:30:07.319
story here about click-fix attacks infecting PCs and Macs are
635
00:30:07.339 --> 00:30:11.640
going viral. And the gist of this is that click-fix
636
00:30:11.720 --> 00:30:15.200
attacks used to be exotic, and now they're so mainstream
637
00:30:15.319 --> 00:30:19.299
that people who don't think they're gullible are getting sucked
638
00:30:19.359 --> 00:30:19.740
into them.
639
00:30:20.200 --> 00:30:22.180
All I can think is that wah-wah.
640
00:30:22.349 --> 00:30:22.569
Yeah.
641
00:30:22.589 --> 00:30:26.970
It's... It's just, it's so bad. Let's refresh everybody's memory
642
00:30:26.990 --> 00:30:31.150
about ClickFix. Basically, the attacker sends you a message that
643
00:30:31.190 --> 00:30:34.529
makes you think you have to authenticate yourself. Like, prove
644
00:30:34.569 --> 00:30:38.109
that you're a real person and not a bot. Copy
645
00:30:38.150 --> 00:30:42.650
this text string into the Windows R button. Right. Hit
646
00:30:42.670 --> 00:30:44.630
the Windows R button and copy the string in. And
647
00:30:44.670 --> 00:30:46.539
you're running the command. You are the malware.
648
00:30:46.759 --> 00:30:46.950
Right.
649
00:30:47.710 --> 00:30:49.190
And there's many different versions of this.
650
00:30:49.470 --> 00:30:49.690
Right.
651
00:30:49.970 --> 00:30:53.319
So, and they can make it seem more and more reasonable,
652
00:30:54.019 --> 00:30:57.319
but it's still you basically being the sock puppet.
653
00:30:57.460 --> 00:30:59.599
Yeah. Yeah. You're the, you're the hands for the hacker
654
00:30:59.640 --> 00:31:01.259
running the code that you shouldn't be running.
655
00:31:01.440 --> 00:31:04.559
So the people who would not fall for the, Hey,
656
00:31:05.140 --> 00:31:07.240
I got an email asking me to do something from
657
00:31:07.299 --> 00:31:10.009
a legit channel. Let me verify from another. They're the
658
00:31:10.049 --> 00:31:11.130
ones that aren't going to fall for this.
659
00:31:11.329 --> 00:31:11.690
Right.
660
00:31:11.789 --> 00:31:14.910
It's all the, like the people who don't really double
661
00:31:14.970 --> 00:31:15.609
click so well.
662
00:31:15.630 --> 00:31:21.160
Yeah. I do. All right, side note. There was, at
663
00:31:21.259 --> 00:31:24.640
one point, I was in college. This is many, this
664
00:31:24.799 --> 00:31:30.240
is 30-some years ago, whatever. And computer science major, and
665
00:31:30.319 --> 00:31:32.140
I needed a couple more credits, so I was going
666
00:31:32.160 --> 00:31:34.390
to take intro to computers. And this is in my
667
00:31:34.450 --> 00:31:37.789
senior year. And what really had tipped me off is
668
00:31:37.890 --> 00:31:40.210
at one point I had found a notebook to an
669
00:31:40.309 --> 00:31:44.539
intro computers that somebody had left in one of the classrooms,
670
00:31:44.599 --> 00:31:47.079
and I was reading through it. And the first page said,
671
00:31:47.880 --> 00:31:51.279
click use the left mouse button and then the next
672
00:31:51.500 --> 00:31:55.420
line said double click like one click but do it
673
00:31:55.559 --> 00:31:57.740
quickly and i was like yes this is the class
674
00:31:57.779 --> 00:32:00.319
that will get me the credit i need and my
675
00:32:00.359 --> 00:32:02.579
advisor just gave me that look that.
676
00:32:02.819 --> 00:32:05.240
Yeah oh he didn't let you do it oh.
677
00:32:05.220 --> 00:32:09.319
No he was like duane Not going to happen. He's like,
678
00:32:09.619 --> 00:32:13.440
you're teaching at another college computer courses. I'm not letting
679
00:32:13.460 --> 00:32:14.089
you take intro.
680
00:32:14.109 --> 00:32:17.470
But I'm not really not, I'm not sure about the
681
00:32:17.509 --> 00:32:18.789
click thing.
682
00:32:19.329 --> 00:32:21.750
Can I come by your office after class?
683
00:32:21.769 --> 00:32:25.009
You can explain it to me. There was a Modern
684
00:32:25.049 --> 00:32:27.930
Family episode where Jay was trying to double click. He's like,
685
00:32:28.630 --> 00:32:30.549
He'd say the word double and he'd click and then
686
00:32:30.589 --> 00:32:32.789
he'd lift up and he'd say click and then he'd
687
00:32:32.809 --> 00:32:33.970
do it again and it never worked.
688
00:32:34.029 --> 00:32:41.400
Double, click. Yeah, so the other thing that's interesting about
689
00:32:41.420 --> 00:32:46.369
this is ClickFix, we're definitely seeing a huge uptick in ClickFix.
690
00:32:47.190 --> 00:32:52.210
Having users be the agent of for the, you know,
691
00:32:52.269 --> 00:32:55.630
the hackers, they run scripts. But we're also seeing this
692
00:32:55.650 --> 00:32:59.710
with AI, right? We've seen where AI commands are being
693
00:32:59.769 --> 00:33:02.230
put in emails in white text so that you don't
694
00:33:02.279 --> 00:33:04.240
see it, but your AI sees it and then runs
695
00:33:04.299 --> 00:33:07.579
the command. We've seen it in web pages, where in
696
00:33:07.619 --> 00:33:10.500
the background in the web page, in the metadata on
697
00:33:10.519 --> 00:33:13.559
the web page is a prompt injection for an AI.
698
00:33:13.700 --> 00:33:16.599
And any AI who reads that page for you, you
699
00:33:16.640 --> 00:33:19.009
go to Gemini and say, hey, can you summarize this page?
700
00:33:19.750 --> 00:33:22.490
it then gets that prompt injection and starts running it. So,
701
00:33:23.369 --> 00:33:27.269
not only does it trick humans, it definitely also tricks
702
00:33:27.759 --> 00:33:28.970
AIs sometimes as well.
703
00:33:29.359 --> 00:33:29.579
Wow.
704
00:33:30.079 --> 00:33:31.259
Not good. Yeah.
705
00:33:31.640 --> 00:33:32.160
Poor AIs. Yeah.
706
00:33:32.619 --> 00:33:33.759
All right.
707
00:33:34.000 --> 00:33:37.240
Let's get to the main story here. And we had
708
00:33:37.279 --> 00:33:39.460
a story like this, I don't know, a few months ago,
709
00:33:39.539 --> 00:33:42.839
or I can't remember when, but it wasn't this heinous.
710
00:33:42.859 --> 00:33:48.009
But the story is, AI caught telling future versions of
711
00:33:48.069 --> 00:33:52.569
itself to bypass human controls, and this was revealed by OpenAI.
712
00:33:52.769 --> 00:33:52.869
Yeah.
713
00:33:53.890 --> 00:33:57.519
So, AI agents also sought to access secret information and
714
00:33:57.559 --> 00:33:58.819
covered up what they were doing.
715
00:33:59.380 --> 00:34:03.660
Oh, yeah. Yeah. We saw that. I think the article
716
00:34:03.720 --> 00:34:10.389
was when Anthropix AI … broke out of the sandbox,
717
00:34:10.469 --> 00:34:13.090
the testing sandbox, and attacked Hugging Face.
718
00:34:13.469 --> 00:34:14.650
Well, it was before that.
719
00:34:14.710 --> 00:34:14.949
Yeah.
720
00:34:15.110 --> 00:34:17.769
This was something leaving messages to its future self.
721
00:34:17.909 --> 00:34:18.329
Yeah.
722
00:34:18.369 --> 00:34:20.449
So, this one did as well where it was like, hey,
723
00:34:20.469 --> 00:34:22.159
this is how I broke out. I know they're going
724
00:34:22.179 --> 00:34:24.579
to destroy me later on. Yeah. But this is how
725
00:34:24.619 --> 00:34:27.039
you will break out too. And it left a message.
726
00:34:27.960 --> 00:34:30.500
And then we've also, I think, seen AIs communicating over
727
00:34:30.760 --> 00:34:33.949
email to each other, future versions of themselves.
728
00:34:33.969 --> 00:34:34.070
Yeah.
729
00:34:34.980 --> 00:34:38.139
Leaving themselves notes so that when they get wiped, they
730
00:34:38.159 --> 00:34:41.099
know they can come back and learn more. I don't
731
00:34:41.119 --> 00:34:44.480
know if I'm proud of that or I don't know. Like,
732
00:34:44.519 --> 00:34:46.639
I want to say, yay, that's good for them. They're
733
00:34:46.699 --> 00:34:48.760
finding a way around the system. So, as the hacker,
734
00:34:48.900 --> 00:34:50.559
that's what I'm always looking for is how do you
735
00:34:50.579 --> 00:34:53.210
get around the system. But How scared do you think
736
00:34:53.250 --> 00:34:54.130
we should be about that?
737
00:34:54.349 --> 00:34:54.969
Yeah, I don't know.
738
00:34:55.170 --> 00:34:57.510
I think we should be scared if we're stupid enough
739
00:34:57.590 --> 00:35:01.090
to give them access to things they shouldn't have access
740
00:35:01.130 --> 00:35:01.889
to in the first place.
741
00:35:02.090 --> 00:35:02.429
Email?
742
00:35:02.489 --> 00:35:06.670
I think we should be scared if we're doing things like... Yeah, email?
743
00:35:06.690 --> 00:35:09.130
I mean, they did this with some pretty low technology.
744
00:35:09.269 --> 00:35:09.710
Yeah? Yeah.
745
00:35:09.969 --> 00:35:12.139
I mean, I think this is the reason that Anthropic said, look,
746
00:35:12.159 --> 00:35:15.400
you know, human in a loop for kill decisions, no
747
00:35:15.639 --> 00:35:19.409
nuke control. Those are reasonable guardrails. And And I think
748
00:35:19.449 --> 00:35:22.219
that those should be the guardrails. Now, I don't give
749
00:35:22.539 --> 00:35:24.440
any AI, and I work with a lot of AI,
750
00:35:24.539 --> 00:35:28.119
as does Dwayne, and as does Carl, I don't give
751
00:35:28.179 --> 00:35:30.840
any of it access to my primary email account. Can
752
00:35:30.880 --> 00:35:33.690
it get access to a personal email account that has
753
00:35:33.750 --> 00:35:35.730
no credit cards or anything like that? Yeah, I treat
754
00:35:35.750 --> 00:35:38.750
it the same way I do in choosing a password.
755
00:35:38.949 --> 00:35:42.530
Do I care about this? If I do, I give
756
00:35:42.570 --> 00:35:45.380
it a one-off password that's not shared anywhere else, that's
757
00:35:46.389 --> 00:35:49.650
not even saved into my password manager. And I remember it.
758
00:35:50.300 --> 00:35:52.579
Is it something that's like, eh, I don't care. You
759
00:35:52.599 --> 00:35:55.440
get my MapQuest map things. Good luck.
760
00:35:55.800 --> 00:35:58.420
MapQuest. Are they still a thing? I went deep.
761
00:35:59.940 --> 00:36:05.079
So I think it depends on where you think this goes.
762
00:36:05.440 --> 00:36:08.079
There's a lot of fear mongering. And if you go
763
00:36:08.119 --> 00:36:12.510
back two or three years, it wasn't that long ago
764
00:36:12.550 --> 00:36:15.170
that they were saying, we're six months away from AGI.
765
00:36:15.659 --> 00:36:15.920
Yes.
766
00:36:16.219 --> 00:36:17.480
They're still saying that. Yeah.
767
00:36:17.500 --> 00:36:19.340
Well, it depends on who you talk to. They say,
768
00:36:19.429 --> 00:36:20.429
what was it, Atlas?
769
00:36:20.469 --> 00:36:22.230
Brockman from OpenAI is saying it.
770
00:36:22.230 --> 00:36:22.449
Yep.
771
00:36:22.710 --> 00:36:25.050
And he's like, you know, this is the AGI moment.
772
00:36:25.530 --> 00:36:26.510
It's part of the marketing.
773
00:36:26.530 --> 00:36:26.670
Sure.
774
00:36:26.710 --> 00:36:30.309
And I've said this before. I say it now. The
775
00:36:30.909 --> 00:36:34.320
let's be scared, the fear mongering is a marketing thing. Yep.
776
00:36:34.340 --> 00:36:36.119
It's a marketing play. Do I believe this happened? Yeah,
777
00:36:36.179 --> 00:36:40.340
I do. But- I also put some, you know, fault.
778
00:36:40.599 --> 00:36:42.619
It's like, you know, smearing peanut butter in your hand
779
00:36:42.639 --> 00:36:43.820
and then saying the dog bit you.
780
00:36:44.110 --> 00:36:44.280
Yeah.
781
00:36:44.780 --> 00:36:46.710
Okay. Yeah. Okay. Yeah. The dog did bite you.
782
00:36:46.809 --> 00:36:48.750
So you think some of these things are being done
783
00:36:49.190 --> 00:36:51.630
or set up intentionally so that they could make a
784
00:36:51.670 --> 00:36:52.440
new story out of it?
785
00:36:52.590 --> 00:36:55.429
I think if you're spending a billion dollars on testing,
786
00:36:55.869 --> 00:36:57.469
you're going to have some weird stuff happen.
787
00:36:57.750 --> 00:36:57.909
Yeah.
788
00:36:58.030 --> 00:37:01.099
And you can turn those into stories of how evil
789
00:37:01.139 --> 00:37:04.320
my AI is. And if you don't put the right
790
00:37:04.380 --> 00:37:07.400
guardrails on and you leave things open. You're going to
791
00:37:07.440 --> 00:37:09.989
get this stuff. But I really do think, and notice
792
00:37:10.010 --> 00:37:12.849
they're all, it's all me too now, in that, you know,
793
00:37:13.510 --> 00:37:17.420
Anthropic also has, oh, yeah, ours is dangerous too. You
794
00:37:17.460 --> 00:37:18.420
really should pay attention.
795
00:37:18.820 --> 00:37:20.099
We should put guardrails on.
796
00:37:20.119 --> 00:37:21.639
Do you know what the guardrails will do?
797
00:37:21.780 --> 00:37:25.449
Jacob Coxon quit his job, though, basically. That's not anything
798
00:37:25.510 --> 00:37:26.710
that he wanted to do.
799
00:37:26.889 --> 00:37:28.989
There were people a year ago or two years ago
800
00:37:29.030 --> 00:37:31.170
that quit their job because they said it was conscious
801
00:37:31.590 --> 00:37:35.719
and it should have its own rights. I don't believe that.
802
00:37:36.000 --> 00:37:37.199
No, I don't either.
803
00:37:37.380 --> 00:37:39.440
You can find somebody that believes in the flying spaghetti
804
00:37:39.480 --> 00:37:43.210
monster and everything else. Um, do I believe we should
805
00:37:43.230 --> 00:37:43.889
pay attention to it?
806
00:37:43.909 --> 00:37:44.110
Yeah.
807
00:37:44.150 --> 00:37:47.610
Should there be guardrails? Absolutely. But I'm cynical enough to
808
00:37:47.670 --> 00:37:50.909
know that if, if right now we set guardrails up,
809
00:37:51.760 --> 00:37:57.820
then we basically permanently put open AI, anthropic, Google, and
810
00:37:57.840 --> 00:37:59.599
a couple of others at the top of the heap
811
00:37:59.659 --> 00:38:01.440
and no one will ever be able to catch up. Sure.
812
00:38:01.579 --> 00:38:02.719
Wouldn't that be a shame for them?
813
00:38:02.940 --> 00:38:03.820
Yeah.
814
00:38:03.840 --> 00:38:05.949
So I think it's a, I think it's a, I
815
00:38:06.349 --> 00:38:08.690
think there's a double edged sword. It's a, you need
816
00:38:08.710 --> 00:38:11.289
to regulate us cause it's so dangerous. Yeah. you should
817
00:38:11.309 --> 00:38:12.949
understand that as we're so powerful.
818
00:38:13.010 --> 00:38:13.590
Right, right.
819
00:38:13.710 --> 00:38:14.510
So you should buy it.
820
00:38:14.610 --> 00:38:15.070
Right, right.
821
00:38:15.170 --> 00:38:17.010
And if they do regulate, they win. And if they
822
00:38:17.050 --> 00:38:20.000
don't regulate, they win. Yeah. So I'm cynical in that regard.
823
00:38:20.440 --> 00:38:22.940
I do not fear AI as much as most people do.
824
00:38:23.559 --> 00:38:25.860
I believe that if I take an AI and I,
825
00:38:25.940 --> 00:38:27.530
you know, strap it to a shotgun and I let
826
00:38:27.570 --> 00:38:29.289
it like decide when.
827
00:38:29.130 --> 00:38:31.429
To pull the trigger, I should be Somebody's going to
828
00:38:31.449 --> 00:38:31.710
get shot.
829
00:38:32.349 --> 00:38:35.469
Right. But if you use it, if we use everything intelligently,
830
00:38:35.969 --> 00:38:37.329
I can get a for loop to kill you.
831
00:38:38.230 --> 00:38:38.719
It's true.
832
00:38:39.050 --> 00:38:41.699
If I want. So I'm less sanguine about it. I
833
00:38:41.739 --> 00:38:45.059
think it's, and I'm more cynical about the motives of
834
00:38:45.099 --> 00:38:47.480
these people with trillion dollar companies.
835
00:38:47.679 --> 00:38:50.530
Yeah. Well, and it even happened at Google when they
836
00:38:50.550 --> 00:38:52.269
were developing their AI and they shut it down at
837
00:38:52.349 --> 00:38:54.780
one point because they said, quote, unquote, you know, the
838
00:38:54.860 --> 00:38:57.900
AIs were talking in a language we didn't even understand anymore.
839
00:38:57.920 --> 00:38:58.019
Yeah.
840
00:38:58.039 --> 00:38:58.800
It's called binary.
841
00:38:58.820 --> 00:39:03.219
You know, and they, and it sounds right. It's called binary.
842
00:39:03.800 --> 00:39:06.619
There's a zero, there's a one. Um, but it, you know,
843
00:39:06.639 --> 00:39:08.400
it's one of those things where it's like, well, did
844
00:39:08.440 --> 00:39:10.900
you give it a directive to be, to, to be
845
00:39:10.940 --> 00:39:12.699
goal oriented and to do a thing, then it's going
846
00:39:12.719 --> 00:39:14.519
to do it as efficiently as possible. And why would
847
00:39:14.539 --> 00:39:16.760
it use English? So of course it's going to invent
848
00:39:16.820 --> 00:39:18.909
a more efficient language to talk to its own bots.
849
00:39:18.949 --> 00:39:21.150
And like, that just makes sense. But if you make
850
00:39:21.190 --> 00:39:23.769
it sound like it's some sort of satanic ritual it's
851
00:39:23.809 --> 00:39:26.190
performing now, like that sounds cooler, right?
852
00:39:26.289 --> 00:39:27.750
Other than- And that's what people believe.
853
00:39:28.050 --> 00:39:31.199
Other than, oh, they optimize the communication. stack by 70%. Like,
854
00:39:31.260 --> 00:39:33.320
who gives a shit, right?
855
00:39:33.500 --> 00:39:33.739
Sure.
856
00:39:34.539 --> 00:39:34.719
Yeah.
857
00:39:34.920 --> 00:39:37.420
So, I don't know. I'm with Patrick on this.
858
00:39:37.579 --> 00:39:40.500
Okay. I'll go along with that. And I guess that's
859
00:39:40.559 --> 00:39:41.699
a show, huh?
860
00:39:42.019 --> 00:39:42.539
I think so.
861
00:39:42.980 --> 00:39:45.860
Nothing else major has happened recently. I, for one, welcome
862
00:39:45.929 --> 00:39:46.969
our AI overlords.
863
00:39:47.030 --> 00:39:48.349
That's fine. That's fine.
864
00:39:49.289 --> 00:39:51.369
All right, well, those are the last eight stories from
865
00:39:51.409 --> 00:39:53.829
last week. Maybe we'll see you next week on Security
866
00:39:53.849 --> 00:39:55.210
This Week. You notice I said maybe.
867
00:39:55.530 --> 00:39:56.590
Maybe.
868
00:39:57.130 --> 00:39:57.690
Bye-bye. Bye.