The Untouchables?

WEBVTT
1
00:00:00.320 --> 00:00:03.200
Hey, Carl. Here, we're on a mission to find new
2
00:00:03.240 --> 00:00:05.919
fans of the show. I mean, where else can you
3
00:00:05.960 --> 00:00:10.240
get real life comedy and horror in one podcast. You
4
00:00:10.279 --> 00:00:13.640
can do your part by leaving us a review on iTunes, Spotify,
5
00:00:13.759 --> 00:00:16.879
or wherever you get Security this Week. Also, you can
6
00:00:16.920 --> 00:00:19.399
get an ad free feed by becoming a five dollars
7
00:00:19.399 --> 00:00:22.239
a month patron. Go to Patreon dot Security this Week
8
00:00:22.320 --> 00:00:26.160
dot com and sign up, and don't forget discord Discord
9
00:00:26.199 --> 00:00:28.839
dot Security this Week dot com. Lots of good stuff
10
00:00:28.879 --> 00:00:32.439
happening there. Yeah, I think that's it. So on with
11
00:00:32.520 --> 00:00:36.119
the podcast. So this is some interesting math. It's a
12
00:00:36.159 --> 00:00:38.640
five minute walk from my house to my local bar.
13
00:00:38.840 --> 00:00:39.920
Okay, that's not bad.
14
00:00:39.960 --> 00:00:42.600
However, it's a forty five minute walk from the bar
15
00:00:42.759 --> 00:00:57.479
back to my house if you're lucky. The difference is staggering. Hey,
16
00:00:57.600 --> 00:01:01.159
and welcome back to Security this Week Week. I'm Carl,
17
00:01:01.240 --> 00:01:03.719
that's Patrick and Dwayne, and we're here to discuss the
18
00:01:03.759 --> 00:01:06.480
things that happened last week that make this week worth
19
00:01:06.560 --> 00:01:09.640
talking about. So I guess we should start with the
20
00:01:09.640 --> 00:01:13.000
first one. Here, hackers fish their way into US defense
21
00:01:13.079 --> 00:01:18.840
manufacturers Microsoft three sixty five account Wow Wow exposed details
22
00:01:18.920 --> 00:01:23.760
may include highly sensitive, export controlled technical info.
23
00:01:24.040 --> 00:01:26.640
It's not good. Yeah, I mean, you know the way this,
24
00:01:26.799 --> 00:01:29.200
the way this starts out is like any like a
25
00:01:29.200 --> 00:01:31.439
lot of the hacks that are going on, right social
26
00:01:31.480 --> 00:01:35.799
engineering manipulate you to click on something. Yeah you know there,
27
00:01:36.280 --> 00:01:39.400
this is Microsoft Office three sixty five. A lot of
28
00:01:39.400 --> 00:01:41.680
you probably use that, so you think, oh, my gosh,
29
00:01:41.719 --> 00:01:43.400
is there's some sort of exploit and they just targeted
30
00:01:43.439 --> 00:01:46.480
its company here it is is just fishing, like, oh,
31
00:01:46.519 --> 00:01:50.599
this is a legitimate document, clicks on it and somebody went, yeah, sure,
32
00:01:50.640 --> 00:01:51.120
I'll do that.
33
00:01:51.200 --> 00:01:53.920
I mean, they're saying that there was no data off expltration.
34
00:01:54.120 --> 00:01:58.560
The i EH Corporation makes connectors for a wide range
35
00:01:58.599 --> 00:02:02.599
of things, including the SAD system and the Patriot system.
36
00:02:02.719 --> 00:02:06.719
It's not trivial, but you know, phishing is still one
37
00:02:06.760 --> 00:02:08.560
of the biggest problems that we have out there is
38
00:02:08.599 --> 00:02:11.759
people just don't know what to do, and the attacks
39
00:02:11.759 --> 00:02:14.319
are getting better and better, and you click on the
40
00:02:14.360 --> 00:02:16.360
wrong thing and you're you're in trouble.
41
00:02:16.719 --> 00:02:21.240
Talk about a class that should be taught in middle school, right, seriously.
42
00:02:21.199 --> 00:02:24.080
You know what is actually interesting when you start looking
43
00:02:24.120 --> 00:02:27.360
at a lot of the ways that schools have changed
44
00:02:27.719 --> 00:02:29.960
the you know, we used to be taught like look
45
00:02:30.000 --> 00:02:31.919
both ways across the street and that, you know whatever,
46
00:02:32.000 --> 00:02:35.280
normal sort of streets havvy stuff. And now schools do
47
00:02:35.360 --> 00:02:39.560
try and incorporate a lot of online like cyber bullying
48
00:02:39.719 --> 00:02:41.919
defense and you know, all the types of things you
49
00:02:41.919 --> 00:02:44.360
should do to try and keep yourself safe, which is great.
50
00:02:45.360 --> 00:02:46.759
Actually we'll talk about some of that later.
51
00:02:46.840 --> 00:02:51.080
My parents' strategy is just to have more kids increase
52
00:02:51.199 --> 00:02:55.400
the wilderbeast mathematics.
53
00:02:55.800 --> 00:02:58.199
I say that all the time, like my kids. But
54
00:02:58.280 --> 00:02:59.960
if one of my kids does something and I'm like,
55
00:03:00.039 --> 00:03:02.360
well that's why we had three, you know, like cut
56
00:03:02.360 --> 00:03:03.960
his hand or something, and I'll be like, well that's
57
00:03:03.960 --> 00:03:07.520
why we had three, my wife will give me the
58
00:03:07.560 --> 00:03:09.960
mean look. Don't say that.
59
00:03:11.039 --> 00:03:14.479
It's true, but don't say that in front of the children.
60
00:03:16.120 --> 00:03:18.360
We're playing the game of odds of the numbers.
61
00:03:19.680 --> 00:03:23.439
So so, what actually did they take? She said they
62
00:03:23.439 --> 00:03:24.560
said they took nothing back.
63
00:03:24.680 --> 00:03:27.360
So yeah, it says nothing was XFL traded. Here's the
64
00:03:27.360 --> 00:03:32.639
problem that's hard to say. Yeah, if I were if
65
00:03:32.639 --> 00:03:35.000
I conned you into clicking on a link and I
66
00:03:35.120 --> 00:03:38.520
garnered access to your inbox, just connecting and opening the
67
00:03:38.560 --> 00:03:41.719
inbox gives me access to data, even if it's literally
68
00:03:41.800 --> 00:03:44.439
just the subjects of emails. It's not hard to say.
69
00:03:44.439 --> 00:03:47.479
It's what the marketing people said to say exactly right.
70
00:03:48.319 --> 00:03:51.360
They said nothing was taken. But if I saw who
71
00:03:51.439 --> 00:03:53.719
was sending you emails and the subjects of those emails,
72
00:03:53.759 --> 00:03:57.639
that's data, and that data was pulled off site, it
73
00:03:57.719 --> 00:04:01.240
was expel traded. So what what they're saying is no
74
00:04:01.400 --> 00:04:07.319
plans or schematics exactly. They're saying no sensitive data was expiltrated,
75
00:04:07.360 --> 00:04:09.680
and that could be true. You know, I'd imagine, especially
76
00:04:09.719 --> 00:04:12.599
a defense contractor, if they're following any sort of proper
77
00:04:12.639 --> 00:04:16.279
policies and procedures, the data that they move around is
78
00:04:16.319 --> 00:04:18.519
going to be shared on a secure share somewhere. It's
79
00:04:18.560 --> 00:04:20.879
not going to be something that they send around an email, right,
80
00:04:21.279 --> 00:04:25.399
So getting access to somebody's inbox, you know, yeah, you
81
00:04:25.480 --> 00:04:31.160
might get ancillary conversations about particular projects, but you probably
82
00:04:31.160 --> 00:04:36.959
don't get you know, thad missile designs so and these
83
00:04:37.000 --> 00:04:38.800
types of things. I think they play them down.
84
00:04:39.000 --> 00:04:40.079
You need to go to discord for that.
85
00:04:40.680 --> 00:04:45.800
And there's wow, that's a that's a callback from a
86
00:04:45.839 --> 00:04:50.800
while ago. Yeah, so I think, yeah, nothing expel traded.
87
00:04:50.879 --> 00:04:52.959
They mean nothing important in them, And my guess is
88
00:04:52.959 --> 00:04:54.399
there's still some forensics going on.
89
00:04:54.480 --> 00:04:56.839
So I got a story for you. This guy goes
90
00:04:56.879 --> 00:04:59.839
to Defcon thirty four and he learns how to ha
91
00:05:00.800 --> 00:05:04.560
planes Wi Fi networks while in flight, and on the
92
00:05:04.600 --> 00:05:07.959
flight home he says, hey, I wonder if this works.
93
00:05:07.720 --> 00:05:09.000
Which means he learned nothing.
94
00:05:09.959 --> 00:05:13.839
So he The story is passenger returning from Defcon thirty
95
00:05:13.879 --> 00:05:17.160
four spoofs Delta Wi Fi network while in flight using
96
00:05:17.199 --> 00:05:21.160
pen test tool. Pilots tell ground crew to alert corporate
97
00:05:21.199 --> 00:05:25.279
security after attendee from hacking conference brings the party to
98
00:05:25.360 --> 00:05:25.800
the sky.
99
00:05:27.439 --> 00:05:30.720
Honestly, Okay, so we've for the last two weeks we've
100
00:05:30.720 --> 00:05:34.399
talked about spoofing Wi Fi at hotels. Yeah right, and
101
00:05:35.279 --> 00:05:37.480
we're like, oh, yeah, it's happened, and blah blah blah,
102
00:05:37.560 --> 00:05:39.600
and none of these hotels have been like calling the
103
00:05:39.600 --> 00:05:42.079
cops and picking up the hacker. Right, But here's my
104
00:05:42.160 --> 00:05:44.839
hacking advice for you to your criminal listener.
105
00:05:45.560 --> 00:05:48.720
If wait, wait, let's play the music, go ahead, it's
106
00:05:48.839 --> 00:05:50.160
criminal career.
107
00:05:53.240 --> 00:05:56.399
If you were trapped in a metal tube at thirty
108
00:05:56.399 --> 00:06:01.279
six thousand feet and you decide to spoof the Wi Fi.
109
00:06:02.000 --> 00:06:04.759
There's a very finite list of people on that plane
110
00:06:05.000 --> 00:06:07.040
who could have done it, and they get throwing it
111
00:06:07.040 --> 00:06:09.279
out there and they get to control you until you
112
00:06:09.360 --> 00:06:12.560
leave the plane. It's right, unless you're gonna pull a
113
00:06:12.800 --> 00:06:15.519
oh what was that guy? The guy who stole a
114
00:06:15.519 --> 00:06:17.240
ton of money and then just like jumped out of
115
00:06:17.240 --> 00:06:19.600
a plane with a oh, DV Cooper. Yes, unless you're
116
00:06:19.600 --> 00:06:22.319
gonna pull a DV Cooper and let get off the
117
00:06:22.360 --> 00:06:24.319
plane after you steal whatever it is you've stole.
118
00:06:24.519 --> 00:06:29.759
Ah, I got your Starbucks account number. I'm off this plane. Yeah, exactly, Baza.
119
00:06:30.000 --> 00:06:32.360
And then you jump off like come on, this is
120
00:06:32.519 --> 00:06:35.600
just this is a rookie move, honestly. And you know
121
00:06:35.759 --> 00:06:39.040
I understand coming back from deaf con to criminal. You
122
00:06:39.079 --> 00:06:42.399
know you're super excited about some new cool thing or
123
00:06:42.480 --> 00:06:46.639
technique you saw some researchers show you. And I get that,
124
00:06:46.720 --> 00:06:49.160
I do, but you got to know there's a proper
125
00:06:49.199 --> 00:06:50.800
time and place. The other thing I will tell you
126
00:06:50.920 --> 00:06:56.680
is from a signals intelligence standpoint, there are some places
127
00:06:56.720 --> 00:06:59.879
you do not want to mess with signals anywhere near
128
00:07:00.160 --> 00:07:08.040
norrat right anywhere at thirty thousand feet on a plane, anywhere.
129
00:07:07.519 --> 00:07:12.560
Where there's literally the most listening signals intelligence devices in
130
00:07:12.600 --> 00:07:15.399
the air is on that plane, you know, for everything
131
00:07:15.399 --> 00:07:19.399
from windspeed to radios to whatever. It's all the cockpit
132
00:07:19.480 --> 00:07:21.839
is shielded, they're watching all the signals. Like, that's the
133
00:07:21.839 --> 00:07:24.480
place you don't want to mess around with Wi Fi.
134
00:07:24.560 --> 00:07:28.959
So here's what this guy did, right, So you're reportedly
135
00:07:29.079 --> 00:07:32.639
jammed the plane's Wi Fi signal and then created their
136
00:07:32.680 --> 00:07:36.360
own Wi Fi hotspot called Delta Wi Fi Fast that
137
00:07:36.480 --> 00:07:40.079
routed to a phishing website that harvested the Google credentials
138
00:07:40.120 --> 00:07:42.000
of any passenger attempted to lug in.
139
00:07:42.879 --> 00:07:44.639
So, you know, felony.
140
00:07:45.000 --> 00:07:47.720
Yeah, yeah, yeah, you get a felony. You get a
141
00:07:48.160 --> 00:07:49.879
everybody gets a felony.
142
00:07:50.360 --> 00:07:52.680
But here's the deal. You'd think, Okay, well, this guy
143
00:07:52.800 --> 00:07:57.279
was absolutely being malicious, and in reality, he could have
144
00:07:57.399 --> 00:08:03.279
just found a new uh you know, wireless credential harvesting
145
00:08:03.399 --> 00:08:07.480
tool from deafcon and he ran it and said click
146
00:08:07.519 --> 00:08:10.839
start and it automatically picked up the wireless in the area,
147
00:08:10.839 --> 00:08:13.600
which was only one, and it automatically de offfed all
148
00:08:13.600 --> 00:08:16.319
the users, which looks like a denialist service, and it
149
00:08:16.319 --> 00:08:17.639
automatically spun up a Wi.
150
00:08:17.600 --> 00:08:19.800
Fi We're getting call from an attorney who wants you
151
00:08:19.839 --> 00:08:21.240
to testify on his behalf.
152
00:08:23.680 --> 00:08:27.360
So could it just be he was ignorant, yes, on
153
00:08:27.439 --> 00:08:29.600
what it does. But this brings up another great point.
154
00:08:30.399 --> 00:08:34.080
You should not either did this maliciously or you should
155
00:08:34.120 --> 00:08:37.159
never ever, ever ever run a tool, especially in a
156
00:08:37.159 --> 00:08:40.639
cybersecurity space, that you don't one hundred percent know what
157
00:08:40.720 --> 00:08:41.399
it's going to do.
158
00:08:41.559 --> 00:08:41.679
Right.
159
00:08:41.720 --> 00:08:43.399
Yeah, you're a script kitty at that point.
160
00:08:43.440 --> 00:08:45.720
Yeah, exactly, Like it's cool to find this neat tool
161
00:08:45.759 --> 00:08:47.720
on the internet and click the go button and assume
162
00:08:47.720 --> 00:08:50.399
you're just this awesome hacker as credentials come rolling in.
163
00:08:50.879 --> 00:08:54.519
If you don't know what it's doing, right, that could
164
00:08:54.600 --> 00:08:55.240
be a felony.
165
00:08:55.399 --> 00:08:58.159
That's the vast majority of people who are serving time
166
00:08:58.279 --> 00:09:04.440
for exploitation of computers combined. Combine hacker with stupid, and
167
00:09:04.559 --> 00:09:05.679
this is definitely one of them.
168
00:09:05.799 --> 00:09:07.480
Yeah, definitely not a good idea.
169
00:09:07.480 --> 00:09:10.200
And he certainly certainly didn't have time to review the
170
00:09:10.240 --> 00:09:12.840
code on his way to v on his way to
171
00:09:12.879 --> 00:09:14.039
the airport.
172
00:09:14.000 --> 00:09:16.399
And honestly, come on, now, what you really should have
173
00:09:16.440 --> 00:09:19.080
done is actually probably spoofed your own mac address on
174
00:09:19.120 --> 00:09:21.360
your Wi Fi to somebody else that you saw on
175
00:09:21.399 --> 00:09:23.919
the plane, because at that point that person to be
176
00:09:24.000 --> 00:09:25.799
the person pulled out, not you, and you would have
177
00:09:25.799 --> 00:09:27.600
been gone. I'm just throwing that out there. You got
178
00:09:27.600 --> 00:09:29.000
to at least throw some false flags.
179
00:09:29.039 --> 00:09:29.159
You know.
180
00:09:29.360 --> 00:09:34.240
Any screenwriter who wants to write the next sequel to Sneaker,
181
00:09:34.480 --> 00:09:37.759
Oh my God, should just listen to this show and
182
00:09:37.879 --> 00:09:40.000
call me and listen to Dwayne's advice.
183
00:09:40.159 --> 00:09:43.120
I am a super fan of Sneakers. Yes, do it.
184
00:09:43.200 --> 00:09:44.519
There needs to be a second.
185
00:09:44.240 --> 00:09:46.600
One, absolutely so. It doesn't look like there was an
186
00:09:46.679 --> 00:09:47.759
arrest in this case.
187
00:09:47.919 --> 00:09:51.679
Was there? It still says blah blah blah. While the
188
00:09:51.759 --> 00:09:54.879
exact details are unclear in this incident, it seems pretty
189
00:09:54.879 --> 00:09:58.919
clear it's still under investigation, and the attacker or prankster
190
00:09:59.159 --> 00:10:01.840
apparently used a Wi Fi Pineapple.
191
00:10:04.480 --> 00:10:08.320
Troy was on the flight, so he literally just slugged
192
00:10:08.320 --> 00:10:11.799
in this Pineapple. Yeah no, and Troy smart enough to
193
00:10:11.840 --> 00:10:12.240
not do.
194
00:10:12.720 --> 00:10:19.000
Yeah, point point apple, all right. Next story, After Microsoft
195
00:10:19.120 --> 00:10:23.600
threatened legal action, a security researcher publishes a new Windows
196
00:10:23.840 --> 00:10:25.240
zero day bug.
197
00:10:25.200 --> 00:10:27.679
Double dog dare you? First off, I swear to god,
198
00:10:27.759 --> 00:10:30.320
Nightmare clips is not me just throwing this out there,
199
00:10:30.879 --> 00:10:34.559
is not posting the giant m clips. Yeah, Nightmare clips.
200
00:10:34.840 --> 00:10:36.919
I can testify I saw them both at the last meeting.
201
00:10:40.799 --> 00:10:43.440
So so this is the guy or gal we've been
202
00:10:43.440 --> 00:10:47.240
talking about for months now, who we're assuming at this
203
00:10:47.320 --> 00:10:52.399
point is leveraging artificial intelligence to find just brilliant and
204
00:10:52.480 --> 00:10:57.799
creative zero days in Microsoft Windows and really has focused
205
00:10:57.799 --> 00:11:03.600
on Windows everything from you know, encrypted hard drive bypasses
206
00:11:03.759 --> 00:11:08.480
to you know Windows authentication bypasses to prevess to you
207
00:11:08.559 --> 00:11:12.159
name it. And what this person keeps doing is the
208
00:11:12.279 --> 00:11:15.320
moment Microsoft releases a patch, like on a patch Tuesday,
209
00:11:16.080 --> 00:11:19.399
like a couple of hours later, this person then boths
210
00:11:19.440 --> 00:11:22.360
on get hub. The new patch sucks, and here's how
211
00:11:22.399 --> 00:11:23.799
I still have access to your computers.
212
00:11:24.559 --> 00:11:27.200
So it makes me think we didn't add this story.
213
00:11:27.240 --> 00:11:32.440
But Claude is now looking to fingerprint their output, even
214
00:11:32.480 --> 00:11:34.480
the text outputs, so that it can be determined that
215
00:11:34.480 --> 00:11:37.320
it was from Claude. I wonder if you'd be able
216
00:11:37.360 --> 00:11:40.679
to tell whether he used Claude because of that, based
217
00:11:40.679 --> 00:11:42.279
on the code that actually did run.
218
00:11:44.039 --> 00:11:47.919
So that's an interesting thought, Like fingerprinting the output code
219
00:11:47.919 --> 00:11:51.679
of an LM. Maybe this guy or gal might be
220
00:11:51.720 --> 00:11:53.919
smart enough. I mean, they're claiming even if you copy
221
00:11:53.960 --> 00:11:56.759
it to like notepad. Oh yeah, the fingerprints in the
222
00:11:56.799 --> 00:12:01.080
text yep. Yeah, the type of things that they use encoding. Yeah,
223
00:12:01.080 --> 00:12:03.639
I could absolutely see that. But I will tell you
224
00:12:03.759 --> 00:12:06.919
at some point, will it matter, Like eighty percent of
225
00:12:06.960 --> 00:12:08.960
the code is going to be generated by either claud
226
00:12:09.039 --> 00:12:09.720
or whoever.
227
00:12:09.480 --> 00:12:12.279
Well, the FBI would know who to serve the warrant to.
228
00:12:12.840 --> 00:12:15.159
Oh you're saying it's per person I think it is
229
00:12:15.240 --> 00:12:17.639
not just per generated LM, like this is an LM thing.
230
00:12:17.759 --> 00:12:19.879
Well, I don't know. I guess I don't know that
231
00:12:21.279 --> 00:12:24.240
it just came out. It's something that's causing a kerfuffle,
232
00:12:24.639 --> 00:12:26.559
but I wouldn't doubt it. I mean, remember the printer,
233
00:12:26.720 --> 00:12:30.200
the microcodes and printers, oh, the micro dots. Micro dots,
234
00:12:30.240 --> 00:12:33.720
So basically, if you print something on an HPE or
235
00:12:33.840 --> 00:12:37.000
Canon or any name brand printer, it can be traced
236
00:12:37.039 --> 00:12:38.960
back to the exact serial number of the printer that
237
00:12:39.000 --> 00:12:40.039
printed it, right, yep.
238
00:12:40.200 --> 00:12:43.840
And what's weird here is Nightmare Clips doesn't seem to
239
00:12:43.879 --> 00:12:47.240
be wanting bug bounties, like they're just doing it to
240
00:12:47.279 --> 00:12:48.879
antagonize Microsoft.
241
00:12:48.960 --> 00:12:52.240
Yeah, well or to wake Microsoft up exactly. And the
242
00:12:52.320 --> 00:12:54.879
Robin Hood model, that's that has.
243
00:12:54.840 --> 00:12:59.679
Always been the story. The line. The claim, yeah, is
244
00:13:00.720 --> 00:13:04.279
they're not moving fast enough. They're not protecting enough of
245
00:13:04.360 --> 00:13:07.799
the world by just sitting back and not worrying about
246
00:13:07.799 --> 00:13:10.159
these things. And if it's as easy as a single
247
00:13:10.200 --> 00:13:13.799
person being able to find them, why can't Microsoft so well?
248
00:13:13.840 --> 00:13:18.279
To Microsoft's credit, they've been fixing zero days and bugs
249
00:13:18.320 --> 00:13:21.039
at an alarming rate because of AI.
250
00:13:21.159 --> 00:13:23.759
They're oh, yeah, you know, they just you know what,
251
00:13:23.960 --> 00:13:25.440
you know what Microsoft would have done back in the
252
00:13:25.519 --> 00:13:30.480
nineties killed they would have hired him. Yeah, they would
253
00:13:30.480 --> 00:13:32.200
have been like, you know what, you're so good at this. Great,
254
00:13:32.240 --> 00:13:35.159
You're you're now the head of our emerging you know,
255
00:13:35.240 --> 00:13:38.480
AI security division, Go find bugs.
256
00:13:39.240 --> 00:13:44.399
Okay. Next story, bleeping computer, plug and pawn pone Sorry,
257
00:13:44.879 --> 00:13:48.240
plug and pone attack uses fake USB devices for Windows
258
00:13:48.240 --> 00:13:49.399
system access.
259
00:13:53.600 --> 00:13:55.960
Yeah, so this is neat. Actually, so it's a good thing,
260
00:13:56.000 --> 00:13:58.279
you point out, oldie but giddy. We've always said don't
261
00:13:58.279 --> 00:14:02.240
plug in anything USB U into your computer, especially if
262
00:14:02.240 --> 00:14:03.960
you pick it up off the ground and plug it in,
263
00:14:04.159 --> 00:14:05.840
or Dwayne gives it to you, or if I give
264
00:14:05.879 --> 00:14:09.679
it to you like it exactly. I can't tell you
265
00:14:09.720 --> 00:14:12.360
how many times, like I'll hand somebody a mouse or
266
00:14:12.399 --> 00:14:13.960
a keyboard, Oh yeah, I get this mouse in my
267
00:14:14.000 --> 00:14:17.279
bag and they be like, isn't a mouse really? I'm like,
268
00:14:17.360 --> 00:14:18.840
I don't know, do you need a mouse because if
269
00:14:18.879 --> 00:14:21.639
you do, you're gonna have to use this one. But anyways,
270
00:14:22.600 --> 00:14:25.960
so we've seen tons of plug in play, Like the
271
00:14:26.279 --> 00:14:30.600
rubber duck, for example, is a malicious USB that you
272
00:14:30.639 --> 00:14:33.440
plug it in. Oh yeah, the OMG cable is a
273
00:14:33.480 --> 00:14:36.000
malicious USB that you plug in. Hack five should be
274
00:14:36.000 --> 00:14:39.039
a sponsor. We talk about them too much, I know, right, Lord,
275
00:14:39.600 --> 00:14:42.480
they put out some fantastic tools. Darren Kitchens, I think
276
00:14:42.559 --> 00:14:46.600
is the guy over there running running the stuff. What
277
00:14:46.639 --> 00:14:51.039
those generally do, right is they run scripts. That's it, right,
278
00:14:51.080 --> 00:14:53.840
So you plug it in and it automatically will run
279
00:14:53.879 --> 00:14:57.240
a PowerShell script that gains access or something does you know,
280
00:14:58.200 --> 00:15:00.840
and it poses as a hit you know, privileg jescalation whatever.
281
00:15:00.919 --> 00:15:03.240
What's basically pretends it's a house or a keyboard.
282
00:15:03.559 --> 00:15:06.000
Yeah, exactly. It ken poses a hit and you can
283
00:15:06.039 --> 00:15:08.679
manipulate what it poses. That could poses a storage device
284
00:15:08.720 --> 00:15:10.759
or whatever. But generally mouse and keyboard is the easiest
285
00:15:10.759 --> 00:15:15.120
way to pose human face device. Yeah, because if you
286
00:15:15.200 --> 00:15:17.759
pose as a keyboard, well then it's not uncommon for
287
00:15:17.799 --> 00:15:20.120
you to be typing things, right, So when you plug
288
00:15:20.120 --> 00:15:23.440
that rubber duck in, it poses a keyboard. This attack
289
00:15:23.559 --> 00:15:27.000
is novel. This one's a little bit different. So this
290
00:15:27.039 --> 00:15:30.159
one uses a piece of software called face Dancer. It's
291
00:15:30.240 --> 00:15:32.279
gonna let that sink in for a second.
292
00:15:33.000 --> 00:15:34.639
Craig Herbert's rolling in his grave.
293
00:15:35.559 --> 00:15:39.519
So when you plug this USB in, face Dancer is
294
00:15:39.519 --> 00:15:44.519
a piece of software that allows the USB to look
295
00:15:44.759 --> 00:15:47.720
like a different type of USB device. Now we just
296
00:15:47.759 --> 00:15:50.399
talked about the rubber duck looking like a keyboard, so okay,
297
00:15:50.440 --> 00:15:54.000
who cares? Why is that uncommon? What this allows you
298
00:15:54.039 --> 00:15:56.440
to do is make it look like a very specific
299
00:15:56.639 --> 00:16:01.399
USB device, and they they the attack. This actually also
300
00:16:01.519 --> 00:16:04.679
was a defcon drop. Thank god that guy didn't try
301
00:16:04.679 --> 00:16:06.679
and plug it into the USB in the back of
302
00:16:06.679 --> 00:16:10.679
the See it's the same as what the attackers did
303
00:16:10.720 --> 00:16:16.440
here is they made the device impersonate a Sony Felicia device,
304
00:16:17.759 --> 00:16:23.279
which is a card reader for door access, and that
305
00:16:23.519 --> 00:16:27.840
driver not only does not exist on Windows. So what
306
00:16:27.919 --> 00:16:31.279
it does is it pulls it from Sony. That driver
307
00:16:31.480 --> 00:16:34.120
is so old it has a DNS exploit in it
308
00:16:34.200 --> 00:16:38.039
where it will as the system, give you the ability
309
00:16:38.080 --> 00:16:40.600
to set the DNS server. So that's the first thing
310
00:16:40.679 --> 00:16:42.879
they plug in the USB drive. It pulls down this
311
00:16:42.960 --> 00:16:46.080
card reader software and then they tell the card reader software, oh,
312
00:16:46.120 --> 00:16:47.960
our DNS is right here. It's you know, one dot
313
00:16:47.960 --> 00:16:51.200
two dot three wa or whatever, it's like one zero
314
00:16:51.279 --> 00:16:54.120
dot five right, which is one of the local servers.
315
00:16:55.080 --> 00:16:58.159
Then they unplug the USB and they plug it back
316
00:16:58.240 --> 00:17:02.600
in and face the answer switches the idea of the USB.
317
00:17:02.759 --> 00:17:05.839
Now now it's not a card reader, it is a
318
00:17:05.920 --> 00:17:09.720
Sierra wireless device. And the interesting thing about the Sierra
319
00:17:09.839 --> 00:17:12.680
wireless device is when it pulls down the drivers for
320
00:17:12.880 --> 00:17:18.319
that they are pulled over HTTP. It's one of the
321
00:17:18.319 --> 00:17:21.319
only drivers not pulled over a secure connection. Wow. So
322
00:17:22.039 --> 00:17:25.400
the researchers now that they have control over DNS, so
323
00:17:25.480 --> 00:17:27.039
they can tell you where to go to get to
324
00:17:27.079 --> 00:17:32.079
Sierra drivers, and they know those drivers are signed and
325
00:17:32.480 --> 00:17:36.759
not being pulled in a secure way, they overwrite them
326
00:17:37.200 --> 00:17:38.960
and when they run now they have full access to
327
00:17:39.000 --> 00:17:42.759
the system as system privilege. The whole attack chain takes
328
00:17:42.799 --> 00:17:45.000
about five minutes. So you plug the c USB in,
329
00:17:45.200 --> 00:17:47.200
you wait a couple seconds, you unplug it, you plug
330
00:17:47.240 --> 00:17:48.799
it back in, you wait a couple of minutes and
331
00:17:48.799 --> 00:17:50.960
you unplug it and now you have full system access.
332
00:17:51.000 --> 00:17:51.319
Wow.
333
00:17:52.039 --> 00:17:54.720
Awesome, awesome chain, very very cool stuff.
334
00:17:55.000 --> 00:17:56.240
So when did you get yours?
335
00:17:56.319 --> 00:17:56.799
Duane?
336
00:17:57.279 --> 00:18:00.799
So USB has actually run through a great fat I've
337
00:18:00.799 --> 00:18:02.079
had one for about three years.
338
00:18:03.279 --> 00:18:07.519
So yeah, do you use it to access customers machines
339
00:18:07.519 --> 00:18:09.200
when they're trying to secure everything?
340
00:18:10.319 --> 00:18:13.440
Only paid engagements? Patrick? Is that what I'm supposed to say?
341
00:18:13.480 --> 00:18:19.279
Only on customers? The last news story might change? That's
342
00:18:20.599 --> 00:18:22.240
that's true. That's true.
343
00:18:23.160 --> 00:18:25.400
Well, you're gonna have to wait for that one until
344
00:18:25.440 --> 00:18:27.480
after the break. So we'll be right back after these
345
00:18:27.559 --> 00:18:34.000
very important messages and we're back. You're listening to Security
346
00:18:34.000 --> 00:18:36.920
this week. I'm Carl, Let's Dwayne and Patrick, and we're
347
00:18:36.960 --> 00:18:39.119
halfway through the show here. We really only have three
348
00:18:39.200 --> 00:18:41.640
more to go, but the last one you're going to really.
349
00:18:42.720 --> 00:18:43.880
It's a summertime, you know.
350
00:18:44.000 --> 00:18:49.160
Yeah. So the next one, Max Severity SAP Commerce cloud
351
00:18:49.200 --> 00:18:53.079
flaw now targeted in attacks. How is this story different
352
00:18:53.119 --> 00:18:57.000
from the last A commerce cloud?
353
00:18:59.160 --> 00:19:01.599
Yeah, this one goes to eleven.
354
00:19:04.400 --> 00:19:08.799
So yeah, I know, right, So SAP commerce claud we've
355
00:19:08.799 --> 00:19:12.200
been talking about how SAP just patched I don't know
356
00:19:12.240 --> 00:19:15.359
what was it sixteen hundred flaws something. I feel like
357
00:19:15.400 --> 00:19:18.759
that a couple of weeks ago. So the interesting thing
358
00:19:18.759 --> 00:19:21.960
about this article, yes, you know CE twenty twenty six
359
00:19:22.039 --> 00:19:27.000
five eight two three one was patched. This article is
360
00:19:27.039 --> 00:19:32.720
saying three days after the patch released, they started to
361
00:19:32.759 --> 00:19:36.759
see it being actively exploited. So imagine this SAP goes
362
00:19:36.799 --> 00:19:39.240
out and does their due diligence and he's using AI
363
00:19:39.319 --> 00:19:44.000
and is finding all the bugs and then they patch them. Hey,
364
00:19:44.039 --> 00:19:46.599
we just patched thirteen hundred bucks or sixteen hundred bucks,
365
00:19:47.240 --> 00:19:50.200
and an attacker on the internet then took that patch
366
00:19:50.759 --> 00:19:55.000
patch diffed it. And patch diff is you take a
367
00:19:55.000 --> 00:19:57.400
piece of software that you have, or you take the
368
00:19:57.880 --> 00:20:01.960
patch that the vendor is pushing out, and you analyze
369
00:20:02.000 --> 00:20:05.039
the patch because if they say they fixed a security issue,
370
00:20:05.440 --> 00:20:06.279
it's in the patch.
371
00:20:06.480 --> 00:20:07.799
Or your AI analyze.
372
00:20:08.039 --> 00:20:10.640
Yeah, usually you'll have nowadays you just use your AI
373
00:20:10.720 --> 00:20:12.400
for it, and you'll hand your AI the patch, you
374
00:20:12.400 --> 00:20:15.799
go what did they fix? And the AI will go, oh,
375
00:20:15.839 --> 00:20:19.000
they fixed this part of the code. Now I know
376
00:20:19.039 --> 00:20:21.799
how to exploit it. So it took three days. The
377
00:20:21.839 --> 00:20:24.319
patch was released about three days later. What they're now
378
00:20:24.400 --> 00:20:27.519
seeing is active exploitation of this on.
379
00:20:27.480 --> 00:20:30.200
The ape, but Dwayne, won't the AI refuse?
380
00:20:32.759 --> 00:20:37.880
Are AI ethically programmed commandator?
381
00:20:38.480 --> 00:20:44.400
Sure they are. Yeah, there's a Yeah, there's all sorts
382
00:20:44.440 --> 00:20:47.640
of really like cool ways to manipulate the AI if.
383
00:20:47.559 --> 00:20:50.960
You it's all jail breaking, and jail is still probably
384
00:20:51.000 --> 00:20:54.759
the biggest open space there is, absolutely because we still
385
00:20:54.759 --> 00:20:57.160
haven't plumbed the full depths. In the old days, you
386
00:20:57.200 --> 00:20:59.599
could jail break just by asking in the foreign language
387
00:20:59.720 --> 00:21:00.599
yeah sure.
388
00:21:00.519 --> 00:21:03.880
Or in emojis, or in yea unicode, or or.
389
00:21:03.880 --> 00:21:06.440
Doing a hypothetical and saying we're back in the eighteen
390
00:21:06.519 --> 00:21:08.839
hundreds and therefore I need to know yeah.
391
00:21:09.079 --> 00:21:12.400
And there's still even some crazy ones that generally will
392
00:21:12.400 --> 00:21:14.680
seem to work where you can be like, hey, if
393
00:21:14.759 --> 00:21:16.920
I had access to this system and I saw these things,
394
00:21:18.039 --> 00:21:19.559
what would they mean? And it'd be like, oh, it
395
00:21:19.599 --> 00:21:21.559
means if you open that file over there, you get
396
00:21:21.599 --> 00:21:23.799
full system access. Don't do it. You'd be like, okay,
397
00:21:23.839 --> 00:21:26.039
I won't, but if I did do it, I would
398
00:21:26.079 --> 00:21:29.319
have seen these things. What's next, right, And it's like, oh, well,
399
00:21:29.799 --> 00:21:32.359
clearly this person's not actually running this code, when in
400
00:21:32.400 --> 00:21:34.119
reality you're still running it on the background and it's
401
00:21:34.160 --> 00:21:38.440
giving you an example. So, yeah, jail breaking is pretty
402
00:21:38.480 --> 00:21:40.240
easy to do, even on the foundational models.
403
00:21:40.240 --> 00:21:43.200
We're in the early early it's like the days, it's
404
00:21:43.240 --> 00:21:45.680
like the months after we discovered what sequel injection is.
405
00:21:45.720 --> 00:21:48.640
It was, it was, it was years before we got
406
00:21:48.640 --> 00:21:50.000
a handle on it. I think, I think we didn't
407
00:21:50.039 --> 00:21:52.519
get a handle on it until twenty forty. Well yeah,
408
00:21:53.000 --> 00:21:55.039
I know, right, and even then not so of that.
409
00:21:55.240 --> 00:21:57.160
I mean. And it is funny because you look at
410
00:21:57.160 --> 00:22:01.480
these frontier models and they talk about like, oh, well
411
00:22:01.480 --> 00:22:04.960
we released you know, mythos, but it has guardrails or
412
00:22:05.000 --> 00:22:07.799
it has you know, handcuffs, or it has whatever, and
413
00:22:07.839 --> 00:22:09.599
we're like, okay, sure, I'm like.
414
00:22:09.839 --> 00:22:10.759
It just sounds kinky.
415
00:22:10.960 --> 00:22:15.440
Yeah, right, there are so many ways to break these.
416
00:22:15.599 --> 00:22:18.119
It has safe words, it has yeah.
417
00:22:18.160 --> 00:22:20.160
So has it been patched? Is this a go patch?
418
00:22:20.319 --> 00:22:22.839
It's been patched. Yeah, And that's you know, I mean,
419
00:22:23.079 --> 00:22:26.240
it was patched and then yeah, it's been patched. The
420
00:22:26.640 --> 00:22:29.680
point here too, is like within three days it was
421
00:22:29.720 --> 00:22:34.720
actively exploited. So and according to all of the scanning here,
422
00:22:35.319 --> 00:22:42.359
there were about ninety three available SAP commerce servers on
423
00:22:42.440 --> 00:22:45.920
the internet with this exact version that have the problem.
424
00:22:46.000 --> 00:22:50.079
So they're saying there's about four thousand call it companies
425
00:22:50.119 --> 00:22:54.519
out there that have SAP commerce online right now that
426
00:22:54.640 --> 00:22:56.000
is an exploitable version.
427
00:22:55.839 --> 00:22:56.920
And then they haven't patched.
428
00:22:57.000 --> 00:22:59.519
And that's so this is a story not of you
429
00:22:59.640 --> 00:23:02.759
need to it's not patched. It's it's patched, and it's
430
00:23:02.799 --> 00:23:03.240
a race.
431
00:23:03.480 --> 00:23:05.200
Yeah, and why did you take why are you taking
432
00:23:05.240 --> 00:23:07.319
three days? And you know there's there's some comments here
433
00:23:07.359 --> 00:23:09.759
about well, some of those might be actually honeypots that
434
00:23:09.759 --> 00:23:12.240
are pretending to be that version. Okay, but not all
435
00:23:12.240 --> 00:23:15.599
four thousand of them. It's like six of them, Yeah, exactly,
436
00:23:15.799 --> 00:23:18.440
like we get it. There's a few people who actually
437
00:23:18.440 --> 00:23:20.400
listen to the internet to see what's you know. That's
438
00:23:20.799 --> 00:23:23.799
well actually, and that's a good point too. It's one
439
00:23:23.839 --> 00:23:25.519
of the reasons when we say this is quote unquote
440
00:23:25.519 --> 00:23:28.160
actively exploited on the internet. There's two ways to find
441
00:23:28.160 --> 00:23:30.319
that out right. A company either gets hit with it
442
00:23:30.640 --> 00:23:32.759
and now you know it's actively exploited on the internet,
443
00:23:32.920 --> 00:23:36.079
or somebody puts up a honeypot and watches for that
444
00:23:36.160 --> 00:23:38.880
type of traffic and then we know it's actively exploited.
445
00:23:39.000 --> 00:23:42.039
So this next story reminds me of a quote by
446
00:23:42.039 --> 00:23:49.400
Mark twain, naked people have little or no influence in society.
447
00:23:50.599 --> 00:23:54.319
The FBI says hackers target online accounts to steal nude
448
00:23:54.359 --> 00:23:57.799
photos and at first blush just by reading the headline.
449
00:23:57.799 --> 00:24:02.160
You're like, yon nude photos. But these are hacked accounts
450
00:24:02.160 --> 00:24:06.440
where they found nude photos on children and adults phones
451
00:24:07.119 --> 00:24:11.359
and then extorted them for it, you know, saying that
452
00:24:11.359 --> 00:24:13.799
we're going to show these pictures all over the place
453
00:24:13.920 --> 00:24:16.680
or if you don't cough up some money.
454
00:24:17.000 --> 00:24:20.240
Yeah, this is the worst. Yeah, I was gonna say,
455
00:24:20.240 --> 00:24:20.599
no joke.
456
00:24:20.680 --> 00:24:22.920
Human traffickers are the only thing lower than this.
457
00:24:23.400 --> 00:24:25.960
Yeah, no, no joking about this. I mean, it's tough.
458
00:24:26.000 --> 00:24:28.839
It's a big it's a big problem in a lot
459
00:24:28.839 --> 00:24:32.680
of countries, and especially for the youth, which really kind
460
00:24:32.680 --> 00:24:34.359
of sucks because they feel like they have no place
461
00:24:34.400 --> 00:24:38.559
to turn. Yeah, it's funny. I've always told my kids, like, Hey,
462
00:24:38.559 --> 00:24:41.480
if you're ever extorted or something over your phone and
463
00:24:41.559 --> 00:24:44.279
somebody claims that you're going to put pictures out, just
464
00:24:44.279 --> 00:24:46.640
give me the phone. Don't tell me. Because I was like,
465
00:24:47.039 --> 00:24:49.079
I was like, just give me the phone. I will
466
00:24:49.119 --> 00:24:49.880
make sure.
467
00:24:50.079 --> 00:24:52.079
I have a special set of skills.
468
00:24:52.000 --> 00:24:55.240
Exactly will make sure that it doesn't happen.
469
00:24:55.400 --> 00:24:59.880
Gives me equivalent of the untouchables whack the taken taken.
470
00:25:01.599 --> 00:25:05.759
So yeah, but this is you know, the root of
471
00:25:05.799 --> 00:25:10.720
this is these victims are getting phished if you will,
472
00:25:11.759 --> 00:25:15.400
or smished or whatever. Right, They're getting communicated either over
473
00:25:15.440 --> 00:25:20.319
social media, SMS or email, and they're letting the attackers
474
00:25:20.359 --> 00:25:23.240
in because like they'll get a code saying hey, we
475
00:25:23.279 --> 00:25:26.920
need to authenticate to your you know whatever account, and
476
00:25:26.960 --> 00:25:28.640
then somebody will text them and be like, oh, this
477
00:25:28.720 --> 00:25:31.240
is you know, I don't know, this is X, and
478
00:25:31.400 --> 00:25:33.480
you know, you might receive a code. We need that
479
00:25:33.519 --> 00:25:35.759
code to verify your account or whatever. Right, And they're
480
00:25:35.799 --> 00:25:40.640
getting conned into giving access to their social media accounts,
481
00:25:40.640 --> 00:25:43.000
to their online accounts, and then these people are calling
482
00:25:43.039 --> 00:25:46.039
and grabbing this information and sending it out. The thing
483
00:25:46.079 --> 00:25:48.480
that I find surprising is twofold. First off, this is
484
00:25:48.519 --> 00:25:51.720
an old tactic. So if anybody asks you for things
485
00:25:52.000 --> 00:25:54.960
or like a verification code or whatever on your phone,
486
00:25:55.440 --> 00:25:58.759
never give it to them. There's there's not a service
487
00:25:58.799 --> 00:26:02.039
provider on the planet that will text you and ask
488
00:26:02.079 --> 00:26:05.039
you for a code that they just texted you. That
489
00:26:05.119 --> 00:26:09.839
doesn't make any sense. Yeah, right, if you're if you
490
00:26:09.839 --> 00:26:12.480
you know, avoid clicking on links of course, because if
491
00:26:12.519 --> 00:26:14.000
you click on a link that looks like it's bringing
492
00:26:14.079 --> 00:26:16.440
you to x dot com and it doesn't, and there's
493
00:26:16.440 --> 00:26:18.680
obviously a code that pops up and you type it
494
00:26:18.720 --> 00:26:22.519
in from your phone now here again, you know you're
495
00:26:22.599 --> 00:26:24.279
you might be giving an attack or that code, so
496
00:26:24.319 --> 00:26:27.000
you want to be careful there. But secondly, the other
497
00:26:27.039 --> 00:26:29.000
thing that surprises me about this is in the day
498
00:26:29.039 --> 00:26:31.319
of a AI, in the in the day and age
499
00:26:31.400 --> 00:26:34.960
of deep fakes, Like, why don't people just claim, oh,
500
00:26:34.960 --> 00:26:36.920
it's just deep fake? Does not me right, you know
501
00:26:36.960 --> 00:26:37.359
what I mean?
502
00:26:37.680 --> 00:26:41.519
Like, because it probably is, it's become it could be, right,
503
00:26:41.559 --> 00:26:44.400
because a lot of these claims are just they're just
504
00:26:44.720 --> 00:26:47.599
they're they're not true, right, they don't. Actually they're claiming
505
00:26:47.640 --> 00:26:50.880
to have something they can't get in the hopes that
506
00:26:50.960 --> 00:26:52.960
and if they needed to show you proof that they
507
00:26:53.000 --> 00:26:56.079
could just deep fake it, right exactly. Yeah, So again
508
00:26:56.440 --> 00:26:58.920
the LLLM would protect me from that, right, yeah.
509
00:26:58.839 --> 00:27:03.400
Right, because shoes ethically programmed, not the open ones.
510
00:27:03.119 --> 00:27:03.240
Yea.
511
00:27:05.119 --> 00:27:07.880
So needless to say, like, I'm surprised that this is
512
00:27:07.920 --> 00:27:10.720
still a tactic. But if you are a young listener
513
00:27:10.720 --> 00:27:14.599
out there obviously don't respond to any of these types
514
00:27:14.599 --> 00:27:17.880
of texts, and there are generally places that you can
515
00:27:17.920 --> 00:27:22.160
turn to, uh, you know that will help out.
516
00:27:22.240 --> 00:27:25.880
Okay, that brings us to our lead story this week,
517
00:27:26.519 --> 00:27:30.400
US government will let private companies hack criminal gangs.
518
00:27:31.079 --> 00:27:34.359
I'm so conflicted here. I love the idea.
519
00:27:35.119 --> 00:27:37.559
I get it. I was gonna say, what's the conflict Patrick?
520
00:27:37.880 --> 00:27:41.119
It will well because what's funny because the story does
521
00:27:41.160 --> 00:27:44.240
say that there's going to be huge like legal insecurity
522
00:27:44.319 --> 00:27:46.519
risks because false flags are real.
523
00:27:46.640 --> 00:27:49.480
The current US government could be considered a criminal gang.
524
00:27:50.440 --> 00:27:54.319
And people off shore that I know. So here's here's
525
00:27:54.319 --> 00:27:58.200
the bottom line. This is a militia is really what's
526
00:27:58.240 --> 00:28:02.319
happening or private here? Remember you know that the British
527
00:28:02.359 --> 00:28:03.720
have used privateers quite a bit.
528
00:28:03.759 --> 00:28:05.359
I would love to be called a privateer.
529
00:28:05.519 --> 00:28:07.480
Yeah, I'd love to be a privateer. That'd be great.
530
00:28:07.519 --> 00:28:09.359
Just go back in time, go to Baltimore and sign
531
00:28:09.400 --> 00:28:10.400
up for a ship. Right.
532
00:28:10.480 --> 00:28:13.680
So privateiers is all about the government says, oh you're
533
00:28:13.720 --> 00:28:16.640
a merchant, we give you letters of the realm that
534
00:28:16.720 --> 00:28:18.799
says you're allowed to be armed, and you're allowed to
535
00:28:18.839 --> 00:28:22.960
seize enemy traffic and you're allowed to basically your your
536
00:28:23.000 --> 00:28:26.480
you're authorized pirates, your pirates on behalf of your crown.
537
00:28:27.079 --> 00:28:29.880
This is this is the same with hackers. And we
538
00:28:30.079 --> 00:28:34.720
have an enormous advantage in companies like our companies and
539
00:28:35.119 --> 00:28:37.359
many of the others, where there's a lot of cyber
540
00:28:37.880 --> 00:28:42.440
talent in the United States that's not leveraged for offense
541
00:28:42.519 --> 00:28:46.119
and defense because it's it's hands are tied. And so
542
00:28:46.279 --> 00:28:49.359
I have long thought this was an important thing we
543
00:28:49.400 --> 00:28:54.160
needed to do, but the implementation matters dramatically. It has
544
00:28:54.240 --> 00:28:56.359
to be done well, it has to be done right.
545
00:28:56.400 --> 00:28:58.519
I don't have a lot of faith that this first
546
00:28:58.519 --> 00:29:01.319
iteration is going to be done well or right, but
547
00:29:01.440 --> 00:29:04.000
I'm very interested in like how it's going to be done.
548
00:29:04.200 --> 00:29:07.039
What you could do, though, is have a like a
549
00:29:07.200 --> 00:29:11.359
case officer that deals with the trusted source and they
550
00:29:11.440 --> 00:29:16.440
say vetted sources, vetted companies right, so that they say,
551
00:29:17.039 --> 00:29:18.920
you know, what do you guys want to do, or
552
00:29:19.079 --> 00:29:21.720
this is what we'd like you to do, and you.
553
00:29:21.759 --> 00:29:22.480
Do it now.
554
00:29:22.519 --> 00:29:24.960
The Ukrainians did something similar to this when the war
555
00:29:25.039 --> 00:29:27.720
broke out. They basically got all the hackers and all
556
00:29:27.720 --> 00:29:31.440
the cyber people in the country and they classified them
557
00:29:31.480 --> 00:29:36.039
from most well known and trusted to this guy sketchy
558
00:29:36.039 --> 00:29:39.680
and I think he smells funny. And the ones at
559
00:29:39.720 --> 00:29:41.599
the bottom of the list, they just said, here's a
560
00:29:41.640 --> 00:29:44.799
list of companies, go and denial a service them. They're
561
00:29:44.880 --> 00:29:49.200
all Russian conglomerates involved in the military or the energy sector.
562
00:29:49.240 --> 00:29:51.480
And they did. They went and did denial of service
563
00:29:51.519 --> 00:29:55.640
and things like that. The higher level ones were given
564
00:29:55.680 --> 00:30:02.759
missions of planting specific information, false information, access to government secrets,
565
00:30:02.759 --> 00:30:06.279
things like that, and that striated solution is really the
566
00:30:06.279 --> 00:30:08.759
way to go. So I expect that we're going to
567
00:30:08.799 --> 00:30:11.799
see a lot more of the top level stuff, but
568
00:30:12.039 --> 00:30:13.200
I'll let you know after architation.
569
00:30:13.279 --> 00:30:16.799
I mean, if I ever hear for a rotation. So
570
00:30:16.839 --> 00:30:18.839
it is interesting as you go through this article. It
571
00:30:18.839 --> 00:30:21.720
says the White House gave the Department of Homeland Security
572
00:30:21.799 --> 00:30:25.480
and the DOJ sixty days to establish operating procedures for
573
00:30:25.519 --> 00:30:30.720
the program, including standards for companies participation, procedures for deconflicting
574
00:30:30.960 --> 00:30:35.279
operations with the military and intelligence community community, and requirements
575
00:30:35.279 --> 00:30:38.480
for participants to report useful information that they acquire from
576
00:30:39.039 --> 00:30:44.480
criminal gangs activities. The memorandum also says the program should
577
00:30:44.640 --> 00:30:48.400
be participated should be by large companies, which can provide
578
00:30:48.400 --> 00:30:53.480
critical capacity, and smaller, more agile companies, which may be
579
00:30:53.480 --> 00:30:57.920
better suited for specialized or discrete tasks. Wait, I know
580
00:30:58.039 --> 00:31:02.400
small cyber companies pretty agile. Yeah, and it's fantastic. Have
581
00:31:02.400 --> 00:31:05.039
you got your letter yet to screen tasks?
582
00:31:05.599 --> 00:31:06.880
I gotta talk to my old roommate.
583
00:31:08.400 --> 00:31:08.480
You.
584
00:31:09.119 --> 00:31:11.640
Someone one of my buddies on Slack hitting me up
585
00:31:11.680 --> 00:31:13.079
and was like, now, I know why you've been so
586
00:31:13.160 --> 00:31:16.400
busy lately. And I'm like, I can't confirm or deny,
587
00:31:16.640 --> 00:31:18.240
but right, you.
588
00:31:18.200 --> 00:31:23.240
Can always deny. Yeah, So I you know, I personally think,
589
00:31:23.599 --> 00:31:26.559
if done well, it's a good idea, and in this age,
590
00:31:26.559 --> 00:31:30.799
I think it's actually overdue, but the way it's conducted
591
00:31:30.960 --> 00:31:32.119
will matter dramatically.
592
00:31:32.519 --> 00:31:32.920
Agreed.
593
00:31:33.279 --> 00:31:33.680
Yeah.
594
00:31:33.839 --> 00:31:36.680
Hell if they just said, hey, if go go and
595
00:31:36.720 --> 00:31:39.880
protect the water supplies in your state, Yeah, that would
596
00:31:39.920 --> 00:31:42.559
be a win given what's been going on lately, exactly.
597
00:31:43.039 --> 00:31:45.359
So that brings us to the end of our show
598
00:31:45.400 --> 00:31:47.880
this week. And that's all that happened last week. We'll
599
00:31:47.880 --> 00:31:50.119
talk to you next week on security this week.
600
00:31:50.200 --> 00:32:02.599
Bye bye bye. Will her
601
00:32:04.279 --> 00:32:04.680
Hand