Radix Malorum

WEBVTT
1
00:00:00.340 --> 00:00:30.980
And don't forget Discord. Discord.SecurityThisWeek.com. Lots of good stuff happening there. Yeah,
2
00:00:31.000 --> 00:00:33.799
I think that's it. So on with the podcast. Do
3
00:00:33.840 --> 00:00:37.880
you suffer from shyness? Do you sometimes wish you were
4
00:00:37.920 --> 00:00:42.369
more assertive? Ask your doctor about tequila.
5
00:00:47.530 --> 00:00:47.869
Or donut.
6
00:00:49.659 --> 00:00:51.859
Side effects may cause beer goggles.
7
00:00:52.179 --> 00:00:54.350
When my wife and I started dating, she said, I'm
8
00:00:54.409 --> 00:01:07.519
not allowed to drink tequila. All right. We've got a
9
00:01:07.560 --> 00:01:10.540
few stories for you today. This is Security This Week,
10
00:01:10.579 --> 00:01:10.920
by the way.
11
00:01:10.959 --> 00:01:11.420
I'm Carl.
12
00:01:11.439 --> 00:01:15.329
That's Dwayne and Patrick. This week, This is kind of
13
00:01:15.750 --> 00:01:19.030
good news, I think, but it confirms at least what
14
00:01:19.049 --> 00:01:23.329
we've been talking about all the time. Sys of Vulnerability Review. Old,
15
00:01:23.750 --> 00:01:26.569
simple flaws drive most breaches.
16
00:01:27.079 --> 00:01:27.890
Oldies but goodies.
17
00:01:28.280 --> 00:01:29.159
Oldies but goodies.
18
00:01:29.439 --> 00:01:30.000
Yeah.
19
00:01:30.099 --> 00:01:30.579
That's right.
20
00:01:30.739 --> 00:01:34.159
Wayne's still using printer defects from years ago.
21
00:01:34.180 --> 00:01:35.099
Well, I mean....
22
00:01:37.609 --> 00:01:40.799
Sequel injections been on the top of the list for
23
00:01:40.859 --> 00:01:41.439
how long?
24
00:01:41.579 --> 00:01:41.739
Yeah.
25
00:01:41.780 --> 00:01:41.980
Right.
26
00:01:42.000 --> 00:01:43.180
Since they started the list.
27
00:01:43.219 --> 00:01:43.439
Yeah.
28
00:01:43.459 --> 00:01:44.420
Since the list began.
29
00:01:44.680 --> 00:01:44.859
Yeah.
30
00:01:45.439 --> 00:01:48.599
It's like that FBI's, you know, top 10 people to get.
31
00:01:48.719 --> 00:01:50.760
It's still, it's the same, it's the same people.
32
00:01:50.939 --> 00:01:52.719
The thing here is that we talk about AI as
33
00:01:52.780 --> 00:01:55.290
being evil and models being evil, which is the.
34
00:01:55.750 --> 00:01:56.890
Title of this show.
35
00:01:56.950 --> 00:02:01.670
But, but, you know, in fact, most problems are caused
36
00:02:01.750 --> 00:02:03.969
by old, old issues.
37
00:02:04.010 --> 00:02:04.750
Yeah. Yeah.
38
00:02:04.930 --> 00:02:07.629
We'll have the longest time for people to, figure out
39
00:02:07.670 --> 00:02:10.689
how to exploit them for the exploits to mature and
40
00:02:10.729 --> 00:02:12.840
get more of that, uh, less variable.
41
00:02:13.469 --> 00:02:13.740
Yeah.
42
00:02:13.780 --> 00:02:15.080
But I'm going to, I'm going to take the negative
43
00:02:15.099 --> 00:02:17.060
side of that, Patrick. We've also had a lot more
44
00:02:17.099 --> 00:02:19.960
time to understand how they work so that people, developers
45
00:02:20.039 --> 00:02:21.860
should be actually fixing them.
46
00:02:22.020 --> 00:02:24.180
Oh no, I I'm on, I'm all on board. I'm
47
00:02:24.199 --> 00:02:26.699
just saying you give the hackers, you give the hacker
48
00:02:26.740 --> 00:02:29.400
community a decade and script kitties will even be proficient.
49
00:02:30.969 --> 00:02:31.250
Yeah.
50
00:02:31.259 --> 00:02:33.189
So it, you know, it goes through and it's an
51
00:02:33.270 --> 00:02:36.199
interesting breakdown. There's, um, if you guys, click if at
52
00:02:36.219 --> 00:02:37.719
some point if you click on the links to the
53
00:02:37.780 --> 00:02:40.680
show you'll see they break down some of the different
54
00:02:40.699 --> 00:02:43.520
types of attacks and and it's not saying the most
55
00:02:43.759 --> 00:02:45.870
dangerous ones are the ones that have been around forever
56
00:02:45.879 --> 00:02:49.009
it's just the most frequent ones um there are you
57
00:02:49.030 --> 00:02:52.330
know input validation errors right how many times have we
58
00:02:52.349 --> 00:02:55.509
told you on the show never trust the user right
59
00:02:55.569 --> 00:02:57.949
whether they're talking to you or whether they call you
60
00:02:58.009 --> 00:03:00.449
and say they want to switch their bank account or
61
00:03:00.509 --> 00:03:03.069
whether it's their typing data in the browser, right?
62
00:03:03.250 --> 00:03:06.909
Or whether you can imagine how they could exploit it.
63
00:03:07.069 --> 00:03:08.240
Yeah, absolutely.
64
00:03:08.259 --> 00:03:11.240
Because you can't imagine it doesn't mean it's not possible.
65
00:03:11.400 --> 00:03:14.400
Yeah, and actually, not to foreshadow a little bit, but
66
00:03:15.319 --> 00:03:18.060
one of our stories here, we will talk about trusting
67
00:03:18.099 --> 00:03:19.990
the user and their browser a little bit too much,
68
00:03:20.090 --> 00:03:23.150
which caused untold damages.
69
00:03:23.270 --> 00:03:24.169
Hilarity.
70
00:03:24.569 --> 00:03:27.110
Yeah, injection issues, here again.
71
00:03:27.620 --> 00:03:27.879
Right?
72
00:03:28.000 --> 00:03:31.740
We just talked about SQL injection. So for those of
73
00:03:31.780 --> 00:03:35.520
you who may or may not, I don't know, perform
74
00:03:35.560 --> 00:03:36.469
injection all the time.
75
00:03:38.889 --> 00:03:39.349
Enough said.
76
00:03:39.409 --> 00:03:45.469
Walk that fine line. An injection issue is where you're
77
00:03:45.509 --> 00:03:50.169
expecting the user to give you input of some sort, right?
78
00:03:50.229 --> 00:03:53.229
Whether it's oh, what language do I want the browser in?
79
00:03:53.449 --> 00:03:55.469
What day do I want my, you know, my tea
80
00:03:55.509 --> 00:03:56.449
time at this golf.
81
00:03:56.270 --> 00:03:57.189
Course, whatever it may be.
82
00:03:57.210 --> 00:03:58.270
Like your steak cooked.
83
00:03:58.610 --> 00:03:59.389
Yeah, exactly.
84
00:03:59.669 --> 00:04:01.550
You know, whatever you're expecting the user to give you
85
00:04:02.310 --> 00:04:05.069
or expecting to come from the user's browser, more importantly,
86
00:04:05.849 --> 00:04:08.129
because a lot of people will just assume, hey, I
87
00:04:08.169 --> 00:04:11.550
got five fields on this that the user can fill out.
88
00:04:11.849 --> 00:04:14.270
So that's what I'm expecting. But there's 15 other fields
89
00:04:14.310 --> 00:04:16.329
I take from that, that I'm just holding variables in
90
00:04:16.350 --> 00:04:16.670
the browser.
91
00:04:16.689 --> 00:04:19.500
But the text ones are the dangerous ones is the lead.
92
00:04:20.259 --> 00:04:24.680
Right, exactly. Developers always assume if a user can type
93
00:04:24.740 --> 00:04:26.699
in it, it's dangerous and I should keep an eye
94
00:04:26.800 --> 00:04:29.639
on it. But the problem is every field that gets
95
00:04:29.699 --> 00:04:32.839
submitted back on that form is something the user can edit.
96
00:04:32.879 --> 00:04:33.339
Inject.
97
00:04:33.399 --> 00:04:38.500
Ultimately, right, and inject into. So these are the types
98
00:04:38.560 --> 00:04:43.220
of issues, and they pop up. So input validation, memory
99
00:04:43.279 --> 00:04:46.399
safety issues, we talk about buffer overruns and that sort
100
00:04:46.420 --> 00:04:51.370
of stuff, injections, access control deficiencies. So we've talked about
101
00:04:51.850 --> 00:04:53.870
these are probably the core.
102
00:04:53.529 --> 00:04:55.730
Of most of the stories we've talked about. Yep.
103
00:04:56.029 --> 00:04:58.170
Is, you know, every time it comes back to, oh,
104
00:04:58.230 --> 00:05:01.360
and then, you know, the keys were in the page or, oh,
105
00:05:02.189 --> 00:05:04.240
then the user did, you know, or one equals one
106
00:05:04.259 --> 00:05:05.899
and got access to the whole site, right?
107
00:05:05.939 --> 00:05:08.439
And social engineering tops the list too. I mean, that's
108
00:05:08.560 --> 00:05:11.079
kind of the root of all, the radix malorium.
109
00:05:11.939 --> 00:05:13.040
The root of all evil.
110
00:05:13.579 --> 00:05:14.220
Wow.
111
00:05:14.300 --> 00:05:15.620
Radix malorium.
112
00:05:16.139 --> 00:05:16.740
Malorum.
113
00:05:16.779 --> 00:05:17.699
Did you just make that up?
114
00:05:18.189 --> 00:05:19.089
Radix malorum.
115
00:05:19.129 --> 00:05:20.129
Radix malorum.
116
00:05:21.129 --> 00:05:24.660
So, it's from the Latin, radix malorum est cupiditas.
117
00:05:25.160 --> 00:05:26.860
You know, avarice is the root of all evil.
118
00:05:27.319 --> 00:05:27.720
Damn, Carl.
119
00:05:27.740 --> 00:05:28.620
So, radix malorum.
120
00:05:28.959 --> 00:05:29.120
Yeah.
121
00:05:29.439 --> 00:05:30.939
I don't even know what to say about that, Carl.
122
00:05:30.959 --> 00:05:32.860
I went to school. What can I say? I'm sorry.
123
00:05:34.360 --> 00:05:37.970
I learned a few things. Patrick, our boy is so smart.
124
00:05:41.810 --> 00:05:43.129
Your mom and I are so proud, Carl.
125
00:05:43.189 --> 00:05:43.730
Yeah, okay.
126
00:05:46.209 --> 00:05:48.470
Okay. In fact, I'm... Parabellum.
127
00:05:48.850 --> 00:05:53.870
All right. So the next one is kind of, seems important.
128
00:05:54.529 --> 00:05:59.569
The proof of concept published for Linux kernel priv-esque flaw.
129
00:06:00.350 --> 00:06:02.029
And I was reading it and I was trying to
130
00:06:02.069 --> 00:06:05.029
figure out how the heck could, you know, how hard
131
00:06:05.089 --> 00:06:07.430
is it to, how easy is it for somebody to
132
00:06:07.470 --> 00:06:09.329
be exploited if they have a Linux box that's on
133
00:06:09.350 --> 00:06:13.110
the internet? Turns out they have to have a user account, right?
134
00:06:13.750 --> 00:06:14.189
Yeah.
135
00:06:14.329 --> 00:06:16.189
I mean, this is, this is a straight up privask
136
00:06:16.269 --> 00:06:20.279
and it's interesting. It's an interesting one. Um, uh, you know, uh,
137
00:06:20.360 --> 00:06:21.569
walking through the attack.
138
00:06:22.040 --> 00:06:22.300
Right?
139
00:06:22.759 --> 00:06:25.579
Um, it says the issue resides in the, I don't
140
00:06:25.600 --> 00:06:28.480
worry about the functions, but the IO poll get ownership function.
141
00:06:28.680 --> 00:06:29.180
Okay, great.
142
00:06:29.199 --> 00:06:32.279
So there's some sort of function that pulls ownership. It
143
00:06:32.399 --> 00:06:36.879
uses a signed comparison to check a specific slow path.
144
00:06:36.920 --> 00:06:38.300
Don't worry about slow path thresholds.
145
00:06:38.519 --> 00:06:41.490
Signed meaning both negative and positive.
146
00:06:41.550 --> 00:06:42.019
Yeah.
147
00:06:42.110 --> 00:06:44.389
That's what I want to focus on. Yeah, exactly. Um,
148
00:06:44.930 --> 00:06:48.069
so I, I had this conversation, uh, earlier with one
149
00:06:48.089 --> 00:06:52.720
of my children just yesterday, actually. Um, And we were
150
00:06:52.759 --> 00:06:58.360
talking about the memory structures of variables. And if you
151
00:06:58.399 --> 00:07:04.160
take an int, an integer, right, a number, and you
152
00:07:04.279 --> 00:07:07.079
make it a variable, there's a certain size that you
153
00:07:07.110 --> 00:07:12.209
can store in that structure. And the size of the
154
00:07:12.230 --> 00:07:14.769
variable might be, you know, 32767, right? If it's a
155
00:07:14.810 --> 00:07:20.519
signed integer, right? or it might be 65,000 if it's
156
00:07:20.540 --> 00:07:24.370
an unsigned integer because the last bit is generally used
157
00:07:24.449 --> 00:07:27.569
as to whether the number is negative or positive. So
158
00:07:27.589 --> 00:07:30.829
if you say it's unsigned, right, then you can have
159
00:07:30.870 --> 00:07:34.009
a much larger number, but you can't ever have a negative.
160
00:07:34.209 --> 00:07:38.860
If you say it's a signed variable, then you have,
161
00:07:39.100 --> 00:07:43.600
you know, positive 32767 and negative 32767, let's say, right?
162
00:07:43.620 --> 00:07:48.939
So you have the same kind of amount of, of
163
00:07:49.279 --> 00:07:53.009
variability in there, just whether it's negative or positive. So
164
00:07:53.050 --> 00:07:57.699
this is a classic problem, more with C and C
165
00:07:57.699 --> 00:08:01.310
+ + than other programming languages, where you had to
166
00:08:01.389 --> 00:08:05.550
declare whether this was a signed or an unsigned integer.
167
00:08:06.470 --> 00:08:09.350
And then when you went to make a comparison, it
168
00:08:10.670 --> 00:08:13.110
would then say, oh, well, I'm comparing this to a
169
00:08:13.129 --> 00:08:15.399
particular number. So in this particular case, all right, now
170
00:08:15.439 --> 00:08:20.029
that we know what signed is, In comparison, the atomic
171
00:08:20.129 --> 00:08:24.689
read function, nobody cares, operates and returns a signed integer.
172
00:08:25.029 --> 00:08:28.740
So if you call IO pull cancel flag, doesn't matter,
173
00:08:29.250 --> 00:08:34.519
the value becomes negative during the signed path. Okay, so
174
00:08:34.659 --> 00:08:39.059
at some point, it's calling this IO cancel flag and
175
00:08:39.100 --> 00:08:41.639
the last bit is set. So it assumes the number
176
00:08:41.700 --> 00:08:45.980
is now negative. Well, in the world of comparisons, if
177
00:08:46.019 --> 00:08:50.950
you do a true false... Anything negative is false. Anything
178
00:08:51.110 --> 00:08:56.389
positive is true. So the number five is true. The
179
00:08:56.450 --> 00:09:00.929
number negative 3000 is false, right? So it's that weird
180
00:09:01.049 --> 00:09:03.940
place where you're using this variable in a way that
181
00:09:04.080 --> 00:09:07.519
it wasn't supposed to be used, right? In this particular case,
182
00:09:07.539 --> 00:09:09.539
somebody figured out how I, how you could go from
183
00:09:09.559 --> 00:09:12.120
a regular user and Carl was right here. You have
184
00:09:12.139 --> 00:09:13.519
to be a regular user, but you can go from
185
00:09:13.570 --> 00:09:17.490
a regular user to an administrative user on these versions
186
00:09:17.549 --> 00:09:17.809
of Linux.
187
00:09:17.870 --> 00:09:18.110
Wow.
188
00:09:18.409 --> 00:09:19.049
Yeah, that's bad.
189
00:09:19.370 --> 00:09:19.909
It's not good.
190
00:09:20.809 --> 00:09:23.509
It's very similar. This reminds me very much of a
191
00:09:23.909 --> 00:09:27.679
type confusion flaw. I haven't seen a lot of really
192
00:09:27.720 --> 00:09:31.279
good type confusion flaws lately. But a type confusion flaw
193
00:09:31.580 --> 00:09:34.830
is in languages that are not strongly typed.
194
00:09:36.139 --> 00:09:37.549
Like JavaScript, for example.
195
00:09:37.850 --> 00:09:41.309
Yeah, great point, Carl, like JavaScript. And for those of you,
196
00:09:41.649 --> 00:09:43.649
if you want to go a little bit into that, Carl,
197
00:09:43.690 --> 00:09:46.370
like for our non-developers on the call.
198
00:09:46.429 --> 00:09:48.889
Yeah, so JavaScript makes it easy for you just to
199
00:09:48.929 --> 00:09:51.250
pull variables out of thin air and say, you know,
200
00:09:51.429 --> 00:09:54.929
X equals one, Y equals hello in quotes. And it
201
00:09:54.970 --> 00:09:57.470
knows enough to, you know, treat the first one as
202
00:09:57.509 --> 00:09:59.009
a number and the second one as a string.
203
00:09:59.029 --> 00:09:59.970
Right.
204
00:10:01.000 --> 00:10:05.700
Then, you know, if you say Z equals 1.1, that's
205
00:10:05.740 --> 00:10:07.059
different than X equals one.
206
00:10:07.240 --> 00:10:07.519
Right.
207
00:10:07.539 --> 00:10:07.759
Right.
208
00:10:07.879 --> 00:10:11.179
So behind there, one is an integer. We don't know
209
00:10:11.220 --> 00:10:13.789
if it's signed or if it's unsigned. And then the
210
00:10:13.850 --> 00:10:16.590
other one, it's sort of a decimal or a numeric.
211
00:10:16.809 --> 00:10:17.009
Right.
212
00:10:17.389 --> 00:10:17.529
Yeah.
213
00:10:18.289 --> 00:10:18.450
Yeah.
214
00:10:18.570 --> 00:10:21.269
And, and then if you do some weird stuff like, uh,
215
00:10:21.309 --> 00:10:25.429
you know, X equals one and Y equals hello, and
216
00:10:25.450 --> 00:10:25.909
you do.
217
00:10:26.110 --> 00:10:28.409
X plus Y, what happens?
218
00:10:28.850 --> 00:10:29.049
Right.
219
00:10:29.210 --> 00:10:29.429
Right.
220
00:10:30.149 --> 00:10:32.970
So the computer goes, Oh, hello, must be, maybe it's
221
00:10:33.009 --> 00:10:36.129
the ASCII numbers and maybe I should do whatever. So there's,
222
00:10:36.149 --> 00:10:39.049
there's a place you get to where the developer, the
223
00:10:39.090 --> 00:10:41.529
developer may not know what the heck happens when that
224
00:10:41.590 --> 00:10:45.570
addition happens. So type confusion is an interesting style of attack. Well,
225
00:10:45.830 --> 00:10:46.970
I haven't, like I said, I haven't seen one in
226
00:10:47.009 --> 00:10:49.149
a while, but this, this feels very type confusion.
227
00:10:49.379 --> 00:10:49.659
Yeah.
228
00:10:49.720 --> 00:10:51.639
So I'm going to call a strike in on my
229
00:10:51.700 --> 00:10:54.940
own position here, possibly, but I read something or, or
230
00:10:55.320 --> 00:10:57.080
there was a story a years ago, I think it
231
00:10:57.100 --> 00:10:59.600
was before we started the podcast where they were talking
232
00:10:59.620 --> 00:11:02.240
to Linus Torvald, who's the guy who started Linux.
233
00:11:02.570 --> 00:11:02.710
Right.
234
00:11:02.879 --> 00:11:05.690
And they pointed out that there were some problems with
235
00:11:05.750 --> 00:11:12.169
the Linux kernel that were architectural and troubling. And he's like, no,
236
00:11:12.210 --> 00:11:14.870
we're never going to revisit that. And, and it, you know,
237
00:11:15.629 --> 00:11:19.409
fantastic developer, better developer than me. But when one guy
238
00:11:19.470 --> 00:11:22.379
writes or one guy supervises the writing of an entire
239
00:11:22.460 --> 00:11:25.940
operating system in his spare time, you got to wonder
240
00:11:25.980 --> 00:11:29.220
where the, where the, the, the technical debt sits. And
241
00:11:29.240 --> 00:11:30.740
I think a lot of it might be in the
242
00:11:31.340 --> 00:11:33.879
kernel of Linux based on these kinds of things. This
243
00:11:33.919 --> 00:11:37.259
seems like a, It seems like a mistake that shouldn't
244
00:11:37.279 --> 00:11:39.159
have been made in an operating system that's going to
245
00:11:39.179 --> 00:11:40.039
be used for the enterprise.
246
00:11:40.259 --> 00:11:41.000
Yeah, you would think so.
247
00:11:41.019 --> 00:11:45.149
If Linus Torvalds had AI, do you think that anybody
248
00:11:45.190 --> 00:11:46.809
could have come up with that? Could we have a
249
00:11:47.090 --> 00:11:50.080
Carl X or Pat X or Dwayne X?
250
00:11:50.240 --> 00:11:53.120
Heck yeah. I'm going to create my own.
251
00:11:53.139 --> 00:11:55.419
I do actually believe that's true, given that you start
252
00:11:55.440 --> 00:11:56.019
with Unix.
253
00:11:56.279 --> 00:11:57.149
Could we still do it?
254
00:11:57.320 --> 00:11:57.460
Yeah.
255
00:11:57.480 --> 00:12:00.129
I mean, could I make not a version of Linux,
256
00:12:00.190 --> 00:12:02.190
but a whole new Unix-based operating system?
257
00:12:02.230 --> 00:12:05.090
Yeah, you could make your own operating system absolutely right now.
258
00:12:05.169 --> 00:12:07.470
You can also make your own Bitcoin. It's called Doge.
259
00:12:11.919 --> 00:12:12.740
Okay, we moved on?
260
00:12:12.940 --> 00:12:13.409
We've moved on.
261
00:12:13.440 --> 00:12:13.700
All right.
262
00:12:14.470 --> 00:12:20.870
SonicWall patches two new actively exploited zero days in SMA
263
00:12:20.870 --> 00:12:21.769
1000 VPNs.
264
00:12:22.250 --> 00:12:22.850
Oh, no.
265
00:12:23.590 --> 00:12:24.169
Zero days.
266
00:12:24.649 --> 00:12:26.159
But it patched them, so that's good.
267
00:12:26.820 --> 00:12:27.259
They did.
268
00:12:27.700 --> 00:12:27.899
Yeah.
269
00:12:28.659 --> 00:12:28.919
I know.
270
00:12:28.940 --> 00:12:29.799
Merry Christmas.
271
00:12:30.159 --> 00:12:30.399
Yeah.
272
00:12:30.539 --> 00:12:34.179
So, SonicWall, these are... I love that band.
273
00:12:34.379 --> 00:12:34.820
I know, right?
274
00:12:34.840 --> 00:12:35.220
The kids?
275
00:12:35.539 --> 00:12:36.240
Yeah, they were great.
276
00:12:36.809 --> 00:12:38.809
It's sonic wall okay.
277
00:12:38.570 --> 00:12:42.529
Wonder wall anyways sonic wall patches two new um vulnerabilities
278
00:12:42.570 --> 00:12:45.580
this is so sonic wall devices are generally targeted to
279
00:12:45.600 --> 00:12:48.580
small to medium businesses um you don't generally you're not
280
00:12:48.600 --> 00:12:50.440
going to see like apple running a whole bunch of
281
00:12:50.460 --> 00:12:53.659
sonic walls you know at one of the 10 yeah
282
00:12:54.480 --> 00:12:56.580
okay so this is a great point so this one
283
00:12:56.600 --> 00:12:59.120
was marked as a 10 and here at security this
284
00:12:59.139 --> 00:13:01.559
week we always like to figure out is this really
285
00:13:01.580 --> 00:13:03.899
a 10 or is this kind of a bs 10
286
00:13:03.899 --> 00:13:05.759
and it's it should be considered a seven.
287
00:13:05.799 --> 00:13:08.570
Well, we want the contagion score, which is how likely
288
00:13:08.889 --> 00:13:09.809
are you to get it?
289
00:13:10.289 --> 00:13:12.250
No, if you're running this version, you're already in trouble.
290
00:13:12.429 --> 00:13:12.909
Okay.
291
00:13:12.950 --> 00:13:18.129
Um, yeah, this is, this takes very little technical knowledge
292
00:13:18.149 --> 00:13:21.200
to run. There's already a POC out on the internet
293
00:13:21.759 --> 00:13:25.600
and it's not hard to find your patch. Yeah, it's patch.
294
00:13:25.620 --> 00:13:27.740
You can absolutely go patch it. But if let's say
295
00:13:27.759 --> 00:13:30.419
you're not like this is targeting small to medium business, right?
296
00:13:30.759 --> 00:13:34.980
Most small to medium businesses, you're running a, a barbershop,
297
00:13:35.639 --> 00:13:38.480
you're not running around, you know, keeping up on security
298
00:13:38.539 --> 00:13:40.740
news and patching your Sonic wall.
299
00:13:40.899 --> 00:13:41.139
Right.
300
00:13:41.320 --> 00:13:45.419
So there's tons of these devices out there. Uh, although
301
00:13:45.440 --> 00:13:47.779
I guess what would you do as a barbershop VPNing
302
00:13:47.850 --> 00:13:51.570
and back to the shop anyways? Um, so there's tons
303
00:13:51.610 --> 00:13:54.169
of these devices out there that are unpatched right now.
304
00:13:54.529 --> 00:13:57.629
The POC is out there. It is super easy to run. Um,
305
00:13:57.809 --> 00:14:00.700
it is a form of SSRF, which is a server
306
00:14:00.720 --> 00:14:02.159
side request forgery attack.
307
00:14:02.320 --> 00:14:02.519
Yeah.
308
00:14:03.019 --> 00:14:07.240
Um, So for those of you who haven't been familiar
309
00:14:07.259 --> 00:14:10.570
with SSRF attacks, an SSRF attack is where I can
310
00:14:10.590 --> 00:14:12.970
make a call out to a service, whether it's a
311
00:14:12.990 --> 00:14:16.029
web server or in this case a VPN service. Most
312
00:14:16.070 --> 00:14:18.110
of the SonicWall VPN services are a web server.
313
00:14:19.490 --> 00:14:19.789
Whatever.
314
00:14:20.129 --> 00:14:22.629
It doesn't matter really because you go to a website,
315
00:14:22.649 --> 00:14:26.289
you log in and it gives you access. But you
316
00:14:26.309 --> 00:14:28.210
go out to a website and you make a request
317
00:14:28.269 --> 00:14:31.370
and what happens is that server then makes a request
318
00:14:31.409 --> 00:14:34.460
to itself on your behalf. So it looks like it's
319
00:14:34.519 --> 00:14:38.259
coming from inside. And that's generally what an SSRF attack is,
320
00:14:38.799 --> 00:14:42.769
is me conning the device into doing my bidding for
321
00:14:42.809 --> 00:14:45.639
me on a backend channel so that it trusts it.
322
00:14:46.429 --> 00:14:46.990
Yeah.
323
00:14:47.090 --> 00:14:48.769
So this one does not look good. And this is
324
00:14:48.809 --> 00:14:51.860
pre-authenticated by the way. That's the other reason that this
325
00:14:52.000 --> 00:14:55.399
is kind of a scary attack right now is you
326
00:14:55.460 --> 00:14:58.240
don't need a username or password. Just find the sonic
327
00:14:58.259 --> 00:15:00.840
wall on the internet. run the proof of concept, you
328
00:15:00.940 --> 00:15:03.480
grab off a GitHub and boom, you have access.
329
00:15:03.870 --> 00:15:06.529
Hey guys, this seems like a good time and place
330
00:15:06.590 --> 00:15:08.309
to take a break. So we'll be right back after
331
00:15:08.350 --> 00:15:15.070
these very important messages. Don't you go away. So guys,
332
00:15:15.230 --> 00:15:17.470
I went to the Humane Society the other day and
333
00:15:17.570 --> 00:15:21.929
I got myself a Mirage Kitten. And the Mirage Kitten
334
00:15:22.000 --> 00:15:24.059
is a really interesting kitten because you can see it
335
00:15:24.200 --> 00:15:26.820
across the room, but as you get close, it just disappears.
336
00:15:26.840 --> 00:15:28.259
Wow.
337
00:15:29.350 --> 00:15:30.289
You can still hear it going.
338
00:15:30.509 --> 00:15:33.190
All right.
339
00:15:33.769 --> 00:15:39.909
The story is Iran-linked APT Mirage Kitten uses fake job
340
00:15:39.950 --> 00:15:44.750
tests to spread malware. Malware.
341
00:15:46.129 --> 00:15:48.629
These countries, North Korea and Iran are making the world,
342
00:15:49.169 --> 00:15:50.110
they're ruining everything.
343
00:15:50.490 --> 00:15:50.769
I know.
344
00:15:50.789 --> 00:15:52.549
They've given us Mirage Kittens.
345
00:15:52.570 --> 00:15:53.629
The Q-bomber all over again.
346
00:15:55.370 --> 00:15:57.740
So this is a LinkedIn coding test, right?
347
00:15:58.320 --> 00:15:59.080
Yeah, absolutely.
348
00:15:59.100 --> 00:16:03.299
You apply for a job and you apply for a
349
00:16:03.340 --> 00:16:05.759
job and they give you a co-test and they say, hey,
350
00:16:05.830 --> 00:16:10.549
we need you to use, it's actually funny, this exact path, actually,
351
00:16:10.590 --> 00:16:13.529
maybe they've been listening to Security This Week. This exact
352
00:16:13.610 --> 00:16:18.529
path is a path that we presented probably six months ago.
353
00:16:18.990 --> 00:16:19.600
Who's we?
354
00:16:20.509 --> 00:16:25.740
We, as in we the security cabal, presented to one
355
00:16:25.759 --> 00:16:29.169
of our customers as a viable path to break into
356
00:16:29.190 --> 00:16:31.690
their organization we say listen we'll just hire one of
357
00:16:31.730 --> 00:16:35.659
your developers who we see does side work and we'll
358
00:16:35.700 --> 00:16:38.019
force them to use libraries not force them just say
359
00:16:38.059 --> 00:16:39.899
hey we'd like you to use this library in this
360
00:16:39.919 --> 00:16:42.899
library in this library and they'll be infected we're horrified
361
00:16:43.440 --> 00:16:47.399
yeah and they were like wait what like that's so
362
00:16:47.419 --> 00:16:51.570
we'll absolutely could do that and and apparently um iran's
363
00:16:51.629 --> 00:16:53.750
like you know we like that that's a that's a
364
00:16:53.769 --> 00:16:55.490
great path let's do that so that's what they're doing
365
00:16:56.029 --> 00:17:00.669
post fake jobs force you to use libraries that you
366
00:17:00.710 --> 00:17:03.620
don't possibly have time enough to read through, and when
367
00:17:03.659 --> 00:17:05.960
you make a call to it, it infects your local computer,
368
00:17:05.980 --> 00:17:10.140
pulling information, info-stealing, blah, blah, blah.
369
00:17:10.759 --> 00:17:16.140
What's the why for Iran-linked Mirage Kitten or whatever? What
370
00:17:16.180 --> 00:17:19.299
is their goal? Do they just want to infect people randomly?
371
00:17:19.539 --> 00:17:23.509
You said something like information-stealing, but what is it going
372
00:17:23.529 --> 00:17:28.869
to get them if they get some out-of-school... coder wannabe
373
00:17:29.529 --> 00:17:30.630
access to their computer.
374
00:17:30.650 --> 00:17:33.049
Well, with Korea, it does it for the money. They
375
00:17:33.089 --> 00:17:36.410
do it so that they can steal the money to
376
00:17:37.009 --> 00:17:37.609
build missiles.
377
00:17:38.210 --> 00:17:38.950
Like ransomware?
378
00:17:39.190 --> 00:17:43.190
Yeah, like ransomware, but in this case also, think about
379
00:17:43.309 --> 00:17:47.009
the fact that you control the job posting. So if
380
00:17:47.130 --> 00:17:50.910
I say, oh, I need a candidate that's TSSCI, right?
381
00:17:50.930 --> 00:17:56.230
So top secret, secure compartmentalized information knowledge. They're certified to
382
00:17:56.269 --> 00:17:59.230
deal with u.s secret government you know stuff.
383
00:17:59.250 --> 00:18:02.130
Car job might be u.s secret government right.
384
00:18:02.450 --> 00:18:04.450
So when they say oh you know we're a division
385
00:18:04.470 --> 00:18:06.980
of the you know uh doj and we need blah
386
00:18:07.000 --> 00:18:09.200
blah whatever and this is a you know we need
387
00:18:09.220 --> 00:18:10.859
you to go through this test to see whether you're
388
00:18:11.019 --> 00:18:14.059
you know smart enough to develop whatever now when i
389
00:18:14.079 --> 00:18:16.900
get on your computer there's probably i mean yeah i
390
00:18:16.920 --> 00:18:19.569
mean if you're following all the regs with tssci and
391
00:18:19.630 --> 00:18:21.450
zipper and nipper and all that good stuff you shouldn't
392
00:18:21.509 --> 00:18:23.990
have anything secure on your network on your your computer
393
00:18:24.049 --> 00:18:28.339
but chances are they might garner access or information that'll
394
00:18:28.359 --> 00:18:31.900
help them. So I would guess that's a RANDS target,
395
00:18:32.599 --> 00:18:35.420
the Mirage Kitten, is let's see what type of sensitive
396
00:18:35.579 --> 00:18:38.799
things we can pull from people and then just gain
397
00:18:38.880 --> 00:18:41.619
and continue access, maintain access to those devices.
398
00:18:41.960 --> 00:18:45.700
Okay. Is there anything that we can do to protect
399
00:18:45.759 --> 00:18:49.559
ourselves except for don't answer stupid emails and click on
400
00:18:49.619 --> 00:18:50.160
links or anything?
401
00:18:51.380 --> 00:18:52.259
This is a tough one.
402
00:18:53.119 --> 00:18:56.220
This is one of the reasons we proposed this to
403
00:18:56.279 --> 00:18:58.990
attack our customer because it's like I could spin up
404
00:18:59.029 --> 00:19:02.349
a real company with a real name, with a real
405
00:19:02.349 --> 00:19:05.549
800 number, with real people on LinkedIn, and it could
406
00:19:05.950 --> 00:19:08.789
literally look like a normal job posting.
407
00:19:09.089 --> 00:19:11.970
Okay, let's talk about this then. If you were somebody
408
00:19:12.009 --> 00:19:14.940
who really wanted to apply for this job, you checked
409
00:19:14.980 --> 00:19:17.180
out the company and they came back legit because they
410
00:19:17.200 --> 00:19:19.680
did all the things and they're a nation state. The
411
00:19:19.720 --> 00:19:21.869
way I would approach it if you decide you're going
412
00:19:21.880 --> 00:19:24.190
to have to do this is you set up a
413
00:19:24.349 --> 00:19:29.970
segregated VM. You download the things there. You run it
414
00:19:30.009 --> 00:19:33.789
with separate accounts on that VM. You get AI to
415
00:19:33.869 --> 00:19:37.029
look at all the libraries ahead of time to see
416
00:19:37.089 --> 00:19:40.170
if there's anything untoward in them because it can look
417
00:19:40.190 --> 00:19:42.410
through all the code even if you can't. And you
418
00:19:42.569 --> 00:19:46.430
do that test on a throwaway VM. That's the problem
419
00:19:46.529 --> 00:19:48.460
is it's a lot of work. it's not easy.
420
00:19:48.539 --> 00:19:48.740
Right.
421
00:19:48.809 --> 00:19:51.400
Well, you know, that's an interesting point though, Patrick, like
422
00:19:51.819 --> 00:19:55.039
in nowadays with AI, it could be, I spin up
423
00:19:55.119 --> 00:19:57.180
a VM, I have a trash VM, whatever, but I
424
00:19:57.279 --> 00:20:01.029
also could have cursor read through the library and be like, Hey,
425
00:20:01.089 --> 00:20:02.789
give me an, give me an initial understanding of what
426
00:20:02.809 --> 00:20:04.769
this thing does. If it, if they're giving us the
427
00:20:04.789 --> 00:20:06.809
code now, if they're giving us just a DLL that
428
00:20:06.849 --> 00:20:10.019
we call entry points on, I don't know, me personally,
429
00:20:10.039 --> 00:20:12.279
I'd reverse engineer the DLL and strip it apart. But
430
00:20:12.720 --> 00:20:14.740
normal humans might be, okay, I'm going to do this
431
00:20:14.799 --> 00:20:22.190
on a throwaway VM. You don't have the mythos.
432
00:20:22.349 --> 00:20:24.710
But still, even if you did it just in a
433
00:20:24.769 --> 00:20:30.250
segregated environment, I mean, hell, rent a VM on a
434
00:20:30.269 --> 00:20:32.990
hosting provider for a month and use it there and
435
00:20:33.029 --> 00:20:35.549
then throw it away. The problem is cost and time.
436
00:20:37.430 --> 00:20:40.930
And right now the job market is so obscene. There
437
00:20:41.079 --> 00:20:44.500
are companies that are listing jobs that don't exist because
438
00:20:44.519 --> 00:20:48.039
they're trying to hype up their company as a growing company.
439
00:20:48.680 --> 00:20:52.740
There's AI that's a friend of ours, Ted Newart, had
440
00:20:52.759 --> 00:20:56.250
a post where somebody he knew, I think it was
441
00:20:56.269 --> 00:21:00.250
somebody he reposted, was a hiring manager and they couldn't
442
00:21:00.269 --> 00:21:04.269
understand why HR just said no qualified applicants and he
443
00:21:04.309 --> 00:21:07.380
needed somebody for his team. So he took his resume,
444
00:21:07.460 --> 00:21:10.539
changed the names and the dates, submitted it, and within
445
00:21:10.619 --> 00:21:13.799
six minutes, the company's AI rejected him as a candidate
446
00:21:13.819 --> 00:21:17.140
for a job he was fully qualified for. Wow. Because
447
00:21:17.619 --> 00:21:22.180
it was looking for React.js with a certain capitalization and punctuation.
448
00:21:22.200 --> 00:21:26.369
It just said React. It said, oh, you don't have
449
00:21:26.390 --> 00:21:27.990
the right technologies and threw you away.
450
00:21:28.329 --> 00:21:28.549
Wow.
451
00:21:28.930 --> 00:21:32.029
So we're just in such an idiocracy in terms of
452
00:21:32.069 --> 00:21:34.849
the job space. I can see people being desperate to
453
00:21:34.910 --> 00:21:37.809
find something if they've left the job and doing this
454
00:21:37.849 --> 00:21:39.930
right away. But it's a trap.
455
00:21:40.250 --> 00:21:44.589
Be careful. All right, we moved on. Hackers push malicious
456
00:21:44.730 --> 00:21:49.930
virtualizer update in BGP hijacking attack. What's BGP?
457
00:21:51.740 --> 00:21:56.079
BGP, big, great. You know, I can't even come up
458
00:21:56.119 --> 00:22:00.039
with a real funny thing. Yeah, exactly.
459
00:22:00.059 --> 00:22:02.160
Football has been around forever.
460
00:22:02.769 --> 00:22:06.789
Yeah, exactly. So a border gateway protocol is how the
461
00:22:07.029 --> 00:22:09.529
whole internet works, right?
462
00:22:09.690 --> 00:22:10.529
You're making this up.
463
00:22:10.710 --> 00:22:14.650
Um, so let's assume, no, seriously, if like, yeah, it's
464
00:22:14.710 --> 00:22:17.329
that magic thing that nobody understands, but that's how all
465
00:22:17.369 --> 00:22:21.230
my bits get to your bits. Um, so imagine, um,
466
00:22:21.309 --> 00:22:23.170
you want to go to an IP address. So, okay,
467
00:22:23.190 --> 00:22:25.859
let's say, let's imagine you want to go to Google's
468
00:22:25.910 --> 00:22:31.529
DNS to talk to it. Um, Google's DNS is is 8.8.8.8.
469
00:22:31.529 --> 00:22:35.160
The reason I use that one is super simple. So
470
00:22:35.380 --> 00:22:38.299
my computer is going to try and reach out to 8.8.8
471
00:22:38.299 --> 00:22:42.819
on my local network. Obviously, it's not here. So it's
472
00:22:42.839 --> 00:22:46.640
going to go to the router and or gateway and say, hey,
473
00:22:46.880 --> 00:22:50.490
I need 8.8.8.8. My router and gateway is then going
474
00:22:50.509 --> 00:22:53.470
to upstream it to my ISP and say, hey, do
475
00:22:53.490 --> 00:22:58.930
you know where 8.8.8.8 is? And my ISP for me
476
00:22:58.990 --> 00:23:03.410
here is Fidium. It then is going to use BGP
477
00:23:03.549 --> 00:23:06.819
to say who is announcing that they own that range.
478
00:23:07.380 --> 00:23:07.940
Oh, okay.
479
00:23:08.059 --> 00:23:10.579
And that's going to come back to, oh, it's Google
480
00:23:10.759 --> 00:23:14.309
owns that range or it's, you know, whatever. It's usually
481
00:23:14.329 --> 00:23:15.009
a major provider.
482
00:23:15.049 --> 00:23:17.650
It's not like. you know, Pulsar security owns that range.
483
00:23:17.730 --> 00:23:19.849
So it's sort of like DNS for IP addresses.
484
00:23:20.390 --> 00:23:21.690
Exactly. That's a great analogy.
485
00:23:21.710 --> 00:23:22.890
It's like a phone book.
486
00:23:22.910 --> 00:23:23.069
Yep.
487
00:23:23.109 --> 00:23:28.240
Yeah, exactly. And it's interesting because DNS ultimately comes down
488
00:23:28.259 --> 00:23:31.319
to IP and then IP then comes down to BGP.
489
00:23:31.339 --> 00:23:33.819
So BGP, when I say it's how the internet works,
490
00:23:33.880 --> 00:23:36.880
it's literally how the internet works, not how a network works,
491
00:23:36.920 --> 00:23:37.920
but how the internet works.
492
00:23:38.039 --> 00:23:38.980
Yeah, that makes sense.
493
00:23:39.940 --> 00:23:44.089
So they don't go into, so if I can hijack,
494
00:23:44.859 --> 00:23:50.700
a particular broadcast, I can say, oh, I am 8.0.0.0 slash,
495
00:23:51.039 --> 00:23:56.579
you know, whatever. Then I own that IP and anybody
496
00:23:56.599 --> 00:23:58.029
who goes there is going to come to me.
497
00:23:58.589 --> 00:24:01.490
So this is dangerous because it's so fundamental. It's so
498
00:24:01.569 --> 00:24:02.170
low level.
499
00:24:02.269 --> 00:24:02.549
Yes.
500
00:24:02.569 --> 00:24:04.670
It's like controlling the phone company switching.
501
00:24:04.869 --> 00:24:05.609
Yeah, exactly.
502
00:24:06.069 --> 00:24:08.670
Well, let me put it another way. I mean, most
503
00:24:08.769 --> 00:24:15.329
brainwashing happens when somebody is told and eventually believes that
504
00:24:15.420 --> 00:24:19.069
some fundamental fact that all of your other facts are
505
00:24:19.210 --> 00:24:23.930
stacked upon, something at the lowest level was true and
506
00:24:23.970 --> 00:24:27.630
now it's false. The sky is green and the grass
507
00:24:27.690 --> 00:24:28.460
is blue, right?
508
00:24:29.160 --> 00:24:31.059
And Picard said, there are two lights.
509
00:24:31.140 --> 00:24:32.119
Yeah, three lights.
510
00:24:32.140 --> 00:24:33.880
Or three lights.
511
00:24:34.799 --> 00:24:41.279
There are three lights. Yeah, exactly. Some fundamental... belief is
512
00:24:41.480 --> 00:24:44.559
twisted and then your whole house of cards comes crumbling
513
00:24:44.599 --> 00:24:47.829
down and that's exactly what i see here because it's
514
00:24:47.869 --> 00:24:50.829
so low level that it affects everything.
515
00:24:50.569 --> 00:24:56.190
Upstream yeah exactly um so in this particular case uh
516
00:24:56.210 --> 00:24:58.150
so i don't get that thing wrong an urgent notice
517
00:24:58.190 --> 00:25:00.700
from the vendor of all utc around august 30th an
518
00:25:00.759 --> 00:25:07.579
attacker routed a block of hetzner hosted IP addresses in
519
00:25:07.740 --> 00:25:12.960
a BGP hijacking attack. What they in essence were doing
520
00:25:13.029 --> 00:25:16.950
was they were saying, we are this range. And then
521
00:25:16.990 --> 00:25:20.529
a certain number of people believed it and started coming
522
00:25:20.569 --> 00:25:26.779
to them for updates. They were attacking, um, this virtualizer software, um,
523
00:25:26.809 --> 00:25:30.490
which is a control panel for virtual private servers for, uh,
524
00:25:30.529 --> 00:25:38.130
VPCs on the internet. Um, by a company called soft delicious, soft, soft, cool.
525
00:25:38.170 --> 00:25:40.599
Yeah. Cause I don't know. So it looks like soft delicious,
526
00:25:40.839 --> 00:25:41.839
which sounds weird. It does.
527
00:25:41.920 --> 00:25:44.240
Soft, soft, a coolest, soft.
528
00:25:44.339 --> 00:25:45.880
Soft, a coolest.
529
00:25:46.519 --> 00:25:46.759
Yeah.
530
00:25:46.799 --> 00:25:47.220
Anyways.
531
00:25:47.819 --> 00:25:51.400
Um, so what would happen is now legitimate requests for
532
00:25:51.519 --> 00:25:54.410
updates for this panel would actually go to the attackers
533
00:25:55.250 --> 00:25:57.769
instead of actually going into the legitimate backend source. And
534
00:25:57.789 --> 00:25:59.410
it would be hard for you as a, just a
535
00:25:59.450 --> 00:26:04.920
normal human updating your software to see the problem. because
536
00:26:05.220 --> 00:26:07.079
you don't have control over it. You're just routing where
537
00:26:07.119 --> 00:26:09.119
the internet's telling you to route. What I will tell
538
00:26:09.140 --> 00:26:12.930
you though, is if a software update does like, okay,
539
00:26:12.950 --> 00:26:17.470
how do I protect myself? A software update designed properly
540
00:26:18.930 --> 00:26:22.630
from the software vendor would actually have probably signed the
541
00:26:22.789 --> 00:26:26.259
update with their own key. And when it makes it
542
00:26:26.299 --> 00:26:29.519
down to the software, it then checks the signature before
543
00:26:29.539 --> 00:26:32.059
it applies it. So my guess is, as we dig
544
00:26:32.099 --> 00:26:36.029
deeper here into this article, there wasn't, they didn't actually
545
00:26:36.089 --> 00:26:38.359
properly sign this, those updates.
546
00:26:39.200 --> 00:26:39.880
Human error.
547
00:26:40.039 --> 00:26:42.140
Yeah, so it's interesting. I mean, secure, we talk about
548
00:26:42.220 --> 00:26:44.319
all the, hey, you should do this and you should
549
00:26:44.339 --> 00:26:48.119
do that and blah, blah, blah. But somebody hacks your BGP.
550
00:26:48.140 --> 00:26:50.549
I mean, there isn't much you can.
551
00:26:50.460 --> 00:26:51.190
Do other than.
552
00:26:52.470 --> 00:26:55.569
Yeah, even lower. Hope the vendor does something right.
553
00:26:56.250 --> 00:27:02.890
Okay, extortion group, fulcrum sec. claims 86 gigabyte manchester airports
554
00:27:03.190 --> 00:27:05.549
group data theft too.
555
00:27:05.450 --> 00:27:09.430
Close to home is it no not that manchester actually
556
00:27:09.450 --> 00:27:12.339
i got this one from cliff um yeah i think
557
00:27:12.410 --> 00:27:15.240
one of one of probably two guests we've ever had
558
00:27:15.299 --> 00:27:18.960
on this show but um yes that's right yeah uh
559
00:27:19.039 --> 00:27:21.920
so cliff posted this in the discord actually uh this
560
00:27:21.980 --> 00:27:23.500
is probably a good point for me to bring up
561
00:27:23.880 --> 00:27:26.380
uh the discord now also has although we have we've
562
00:27:26.400 --> 00:27:28.099
been getting a ton of new users which is awesome
563
00:27:28.859 --> 00:27:32.500
I've also added a cyber AI channel because we've been
564
00:27:32.519 --> 00:27:35.099
talking a lot more about cyber and AI. I figure
565
00:27:35.119 --> 00:27:38.319
there's probably a good place for us to put some
566
00:27:38.420 --> 00:27:39.079
stuff down there.
567
00:27:39.279 --> 00:27:40.619
Okay.
568
00:27:41.289 --> 00:27:44.470
Yeah, so Cliff hit me up at 2 this morning
569
00:27:44.549 --> 00:27:47.490
and was like, hey, have you seen this? And I
570
00:27:47.529 --> 00:27:52.509
started reading through it. It is an interesting attack. These guys,
571
00:27:53.210 --> 00:27:58.289
the Fulcrum Sec group, they've been hitting some pretty big
572
00:27:58.349 --> 00:28:02.049
targets and they're, they've made a name for themselves as
573
00:28:02.150 --> 00:28:06.750
the no BS attackers. Like if they call you up
574
00:28:06.789 --> 00:28:08.069
and say, Hey, we have a hundred.
575
00:28:07.910 --> 00:28:10.359
Gig of your data. They have a hundred gig of
576
00:28:10.380 --> 00:28:10.759
your data.
577
00:28:11.539 --> 00:28:11.920
Believe them.
578
00:28:12.400 --> 00:28:12.599
Yeah.
579
00:28:12.680 --> 00:28:13.099
Believe them.
580
00:28:14.079 --> 00:28:17.539
So bleeping computer actually reached out to them when Manchester
581
00:28:17.960 --> 00:28:22.890
airport group disclosed this breach and was like, all right,
582
00:28:22.930 --> 00:28:25.640
show us some of it. And sure enough, they showed
583
00:28:25.680 --> 00:28:29.240
them some of the information they have. And what's interesting
584
00:28:29.279 --> 00:28:33.980
here is the spin. The Manchester airport group mag is like, Oh, listen,
585
00:28:34.460 --> 00:28:36.220
no credit card data was bleep bleep.
586
00:28:36.680 --> 00:28:37.220
So you're good.
587
00:28:37.440 --> 00:28:38.220
Like everything's great.
588
00:28:38.839 --> 00:28:39.079
Right.
589
00:28:39.960 --> 00:28:41.339
But if you take a look at the data that
590
00:28:41.519 --> 00:28:43.660
was actually.
591
00:28:43.380 --> 00:28:50.839
Leaked or wifi registrations, fast track bookings, license plates for
592
00:28:50.859 --> 00:28:56.150
your car, vehicle registrations, your zip code and in the
593
00:28:56.309 --> 00:28:58.829
UK that brings, there's like, it brings you down to
594
00:28:58.869 --> 00:29:02.640
like 12 different homes, your booking reservations. So they know
595
00:29:02.680 --> 00:29:03.960
when you're going to be out of the house and
596
00:29:03.980 --> 00:29:05.819
they know when you're going to be out of the country.
597
00:29:06.440 --> 00:29:10.680
So it's much more devastating than credit cards, like whatever
598
00:29:10.819 --> 00:29:12.380
credit cards you can just rotate.
599
00:29:12.539 --> 00:29:12.720
Right.
600
00:29:12.779 --> 00:29:12.940
Right.
601
00:29:12.980 --> 00:29:15.259
I can just call up and get a new one. But, uh,
602
00:29:15.339 --> 00:29:17.680
this stuff, you just can't go get a new license
603
00:29:17.740 --> 00:29:18.500
plate easily.
604
00:29:18.519 --> 00:29:19.440
Yeah. Right.
605
00:29:19.759 --> 00:29:23.519
Uh, or rotate your phone number easily. So, um, This
606
00:29:23.779 --> 00:29:28.039
is kind of a big deal. So, okay, you go, okay, well,
607
00:29:28.160 --> 00:29:31.619
the breach happened. They were notified. They don't look like
608
00:29:31.640 --> 00:29:35.130
they're going to pay the crew. So, my guess is
609
00:29:35.130 --> 00:29:36.630
86 gig worth of data is going to get leaked.
610
00:29:37.210 --> 00:29:38.069
How did it happen?
611
00:29:38.170 --> 00:29:38.509
What type of?
612
00:29:40.700 --> 00:29:44.160
Amazing zero-day attack got them there?
613
00:29:44.380 --> 00:29:46.599
You know, by the way you're talking, I think it's
614
00:29:46.640 --> 00:29:50.650
going to be relatively simple. Like somebody got called up
615
00:29:50.710 --> 00:29:52.089
and asked for it or something.
616
00:29:52.109 --> 00:29:55.269
Hey, Carl, if you had a super... I'm just asking
617
00:29:55.289 --> 00:29:59.589
you as a professional developer. If you had a super secret...
618
00:29:59.779 --> 00:30:05.349
api key yeah where's the one place you probably wouldn't
619
00:30:05.529 --> 00:30:10.609
put said super secret api key in code in.
620
00:30:10.569 --> 00:30:12.289
Code the home page.
621
00:30:13.710 --> 00:30:18.059
Yeah i wouldn't hard code it into a github repo
622
00:30:18.119 --> 00:30:18.960
or something.
623
00:30:19.000 --> 00:30:23.019
Would you would you put it in javascript no because
624
00:30:23.059 --> 00:30:28.369
that's secure it's not secure of course not That's what
625
00:30:28.410 --> 00:30:31.930
they did. They took this super secret backend API credential
626
00:30:32.150 --> 00:30:34.079
and they put it in JavaScript and they said, I'm
627
00:30:34.140 --> 00:30:36.940
sure the client browser won't tell the user what it is.
628
00:30:37.660 --> 00:30:38.400
Oh my God.
629
00:30:38.640 --> 00:30:40.859
And that was it. That was the whole hack. They
630
00:30:40.880 --> 00:30:43.140
looked at it and went, wow, there's a key coming
631
00:30:43.180 --> 00:30:45.740
to my page, to my browser. I'm just going to
632
00:30:45.920 --> 00:30:46.569
call the API.
633
00:30:46.809 --> 00:30:47.609
Isn't that just looking?
634
00:30:48.150 --> 00:30:54.289
Yeah, exactly. Uh, so I'm not saying this crew is
635
00:30:54.849 --> 00:30:58.230
not talented. I'm sure they're talented in breaking into places
636
00:30:58.250 --> 00:31:00.940
and there's tons of breaches that have been attributed to them.
637
00:31:01.019 --> 00:31:05.259
But in this particular case, the, the Manchester airport group
638
00:31:05.380 --> 00:31:12.450
actually put a API key that had admin level credential access,
639
00:31:12.990 --> 00:31:16.750
you know, level access to everything, um, in JavaScript.
640
00:31:17.329 --> 00:31:17.549
Right.
641
00:31:17.950 --> 00:31:21.049
Um, Because they were like, well, this key has to
642
00:31:21.089 --> 00:31:24.089
be able to look up whether there's a spot available
643
00:31:24.109 --> 00:31:26.490
in the garage and what your license tag would be
644
00:31:26.589 --> 00:31:28.829
and what your reservations are so we can know whether,
645
00:31:28.849 --> 00:31:30.410
you know what I mean? So it's, they're like, well,
646
00:31:30.430 --> 00:31:32.750
let's just give this key access to everything. And they
647
00:31:32.769 --> 00:31:35.049
did that and then gave it to every user who
648
00:31:35.170 --> 00:31:36.210
ever browsed the website.
649
00:31:36.250 --> 00:31:39.410
I have to imagine that this decision was influenced by tequila.
650
00:31:41.170 --> 00:31:43.170
No i think we're in the wrong business i think
651
00:31:43.609 --> 00:31:45.769
i think i'm going to be the next next jeff
652
00:31:45.829 --> 00:31:49.009
foxworthy you know you might be a redneck if but
653
00:31:49.069 --> 00:31:51.490
my routine's going to be you might be an idiot
654
00:31:51.549 --> 00:31:56.809
coder if you're anybody can break into your system by
655
00:31:56.990 --> 00:31:59.529
view source right right.
656
00:31:59.329 --> 00:32:04.769
Exactly i think we once bought a a website that
657
00:32:05.329 --> 00:32:08.059
that should have known better that had pictures of people
658
00:32:08.730 --> 00:32:11.839
and the The label on the picture was the social
659
00:32:11.880 --> 00:32:13.099
security number.
660
00:32:13.240 --> 00:32:13.660
Oh, God.
661
00:32:14.019 --> 00:32:14.240
Yep.
662
00:32:14.519 --> 00:32:16.599
We're like, come on.
663
00:32:17.740 --> 00:32:18.400
What could happen?
664
00:32:18.420 --> 00:32:18.920
Oh, yes.
665
00:32:19.539 --> 00:32:19.720
Yeah.
666
00:32:21.460 --> 00:32:21.720
All right.
667
00:32:21.940 --> 00:32:26.900
And that brings us to our top story. OpenAI Astra
668
00:32:27.569 --> 00:32:34.470
brings autonomous zero-day exploitation to AI. So, if this is
669
00:32:34.529 --> 00:32:39.609
what I think it means, that means this Astra is using...
670
00:32:40.539 --> 00:32:44.380
It is an AI model that can just completely devastate
671
00:32:44.400 --> 00:32:44.819
the world.
672
00:32:45.119 --> 00:32:49.079
It's open AI saying, we have a mythos too. That's
673
00:32:49.940 --> 00:32:53.289
my take on it. We pass the cyber bench. And
674
00:32:53.329 --> 00:32:55.930
by the way, most people are starting to come around
675
00:32:55.950 --> 00:32:59.769
to the fact that these benchmarks are tests that the
676
00:32:59.890 --> 00:33:06.289
AI study too. So the question then becomes... Is OpenAI
677
00:33:06.410 --> 00:33:10.369
trying to just get regulated so that it's an advertising stunt?
678
00:33:10.849 --> 00:33:14.170
So they'll have their fable mythos moment, their glass wing moment?
679
00:33:14.779 --> 00:33:17.460
I don't know. It's inevitable that we're going to see
680
00:33:17.619 --> 00:33:20.019
models who get better and better at cyber.
681
00:33:21.400 --> 00:33:21.619
Yeah.
682
00:33:21.680 --> 00:33:24.500
But just the fact that it's passed a bench test,
683
00:33:25.160 --> 00:33:28.539
there's a motivation now for them to say they have
684
00:33:28.559 --> 00:33:31.500
their me too moment as far as mythos goes. What
685
00:33:31.519 --> 00:33:32.700
do you think? Yeah.
686
00:33:32.859 --> 00:33:35.869
So let me just explain what it is. So this
687
00:33:36.670 --> 00:33:40.650
Astra can, according to OpenAI, autonomously find zero days and
688
00:33:40.730 --> 00:33:43.470
build exploits. So that's the key. How is that?
689
00:33:43.529 --> 00:33:43.710
Right.
690
00:33:44.210 --> 00:33:45.740
We've been talking about it for six months.
691
00:33:45.900 --> 00:33:46.079
Right.
692
00:33:46.099 --> 00:33:50.460
You know, it's funny. Before the show started, I was like, oh,
693
00:33:50.500 --> 00:33:52.799
that's cute. I mean, we've had it for nine months now,
694
00:33:52.960 --> 00:33:57.490
but that's adorable. Like, I'm glad OpenAI caught up. I mean, and,
695
00:33:57.589 --> 00:33:59.789
you know, it's funny. I was like, we just, we
696
00:33:59.809 --> 00:34:04.299
don't submit our AIs and harnesses to you know, get
697
00:34:04.460 --> 00:34:07.789
awards and blue ribbons. In this case, this is the
698
00:34:07.880 --> 00:34:16.829
first to reach this cyber classification of critical designation, which, whatever. Like, listen,
699
00:34:17.409 --> 00:34:19.780
and we've talked about this, the harness matters just about
700
00:34:19.820 --> 00:34:22.960
as much as the model itself. And there are plenty
701
00:34:23.059 --> 00:34:26.059
of harnesses out there at this point that can go
702
00:34:26.480 --> 00:34:29.579
full attack. You point it at a target. It pulls
703
00:34:29.619 --> 00:34:32.579
down software. It creates zero days. It tests them in
704
00:34:32.599 --> 00:34:35.840
the virtualized environment. They create and then it'll go out
705
00:34:35.900 --> 00:34:39.139
and attack it. We've seen this. We've seen these entire frameworks.
706
00:34:39.380 --> 00:34:39.579
Sure.
707
00:34:39.639 --> 00:34:42.760
So the fact that OpenAI is announcing Astra is amazing.
708
00:34:42.780 --> 00:34:45.590
I agree with Patrick. This is all just marketing ploy.
709
00:34:45.769 --> 00:34:50.050
The model 5% of what it takes to use these
710
00:34:50.369 --> 00:34:51.769
AI systems. The harness is 95%.
711
00:34:51.769 --> 00:34:52.289
Yeah, I agree.
712
00:34:54.010 --> 00:34:54.969
Yeah, the harness matters.
713
00:34:54.989 --> 00:34:58.150
You can take a weak model and do incredible damage
714
00:34:58.170 --> 00:34:58.989
with the right harness.
715
00:34:59.269 --> 00:34:59.409
Yep.
716
00:34:59.469 --> 00:35:01.869
And you can take the best model and not be
717
00:35:01.909 --> 00:35:02.769
able to find anything.
718
00:35:03.010 --> 00:35:03.809
Yeah, right.
719
00:35:03.969 --> 00:35:04.949
If you don't have the right harness.
720
00:35:05.530 --> 00:35:08.639
And for those who've never heard that term, harness, the
721
00:35:08.679 --> 00:35:12.039
harness is like your cloud code app or your GitHub
722
00:35:12.139 --> 00:35:13.280
co-pilot CLI.
723
00:35:13.519 --> 00:35:15.260
It's the judgment.
724
00:35:15.440 --> 00:35:17.780
It's the pipeline. It's the everything.
725
00:35:17.820 --> 00:35:19.929
Yeah, so the LLM has no state.
726
00:35:20.300 --> 00:35:20.460
Right.
727
00:35:20.559 --> 00:35:22.380
So the harness is the thing that keeps track of
728
00:35:22.420 --> 00:35:24.320
the state and the memory and all of that and
729
00:35:24.420 --> 00:35:26.179
makes it a worthwhile experience.
730
00:35:26.539 --> 00:35:28.929
Everything that's moved us past prompt engineering.
731
00:35:29.239 --> 00:35:29.429
Right.
732
00:35:29.469 --> 00:35:29.670
Yeah.
733
00:35:29.829 --> 00:35:29.969
Yep.
734
00:35:30.130 --> 00:35:30.449
Okay.
735
00:35:31.289 --> 00:35:32.949
I think that's a show, guys. What do you think?
736
00:35:33.550 --> 00:35:35.929
I agree. I think that was, that's a lot of fun.
737
00:35:36.289 --> 00:35:38.510
And thanks, Cliff, for sending in this story.
738
00:35:38.969 --> 00:35:39.550
Always.
739
00:35:39.590 --> 00:35:41.619
By all means, keep sending in stories.
740
00:35:41.639 --> 00:35:42.199
We appreciate it.
741
00:35:42.320 --> 00:35:42.480
Yep.
742
00:35:42.880 --> 00:35:43.099
Thanks.
743
00:35:43.460 --> 00:35:47.059
And check out our Discord. And, well, gee whiz, that's
744
00:35:47.099 --> 00:35:49.429
what we talked about from last week, and we'll see
745
00:35:49.449 --> 00:35:50.800
you next week on Security This Week.
746
00:35:50.909 --> 00:35:51.190
Bye-bye.
747
00:35:51.230 --> 00:35:54.309
Bye. Bye, guys.