Crazy AI Model Meltdown

WEBVTT
1
00:00:00.340 --> 00:00:30.980
And don't forget Discord. Discord.SecurityThisWeek.com. Lots of good stuff happening there. Yeah,
2
00:00:31.000 --> 00:00:33.700
I think that's it. So on with the podcast. So
3
00:00:33.740 --> 00:00:35.979
last week, my wife looks at me and says, hey,
4
00:00:36.740 --> 00:00:39.020
come at me like a purse snatcher. I want to
5
00:00:39.060 --> 00:00:42.890
try something. And what she should have said was, I
6
00:00:42.929 --> 00:00:48.030
just bought a taser. She just has a problem communicating.
7
00:00:50.670 --> 00:00:52.539
I mean, that happens. Then you wouldn't have done it.
8
00:00:52.780 --> 00:00:53.539
You figured it out.
9
00:01:02.789 --> 00:01:07.170
Hey, welcome back to Security This Week. I'm Carl, that's Patrick,
10
00:01:07.219 --> 00:01:09.920
and that's Duane. And we got some stories for you.
11
00:01:10.040 --> 00:01:13.400
Oh boy, do we have stories. This one happened like
12
00:01:13.780 --> 00:01:19.319
almost after our last episode went live. Unprecedented cyber attack
13
00:01:19.400 --> 00:01:23.840
targets refrigeration units at hundreds of French supermarkets.
14
00:01:24.319 --> 00:01:24.540
Yeah.
15
00:01:24.930 --> 00:01:28.090
Thank God cheese doesn't need to be refrigerated.
16
00:01:28.790 --> 00:01:29.730
They were good for a while.
17
00:01:29.750 --> 00:01:30.129
Mr.
18
00:01:30.189 --> 00:01:31.670
Robot would be proud.
19
00:01:32.790 --> 00:01:34.730
That's the old, the fromage is the only thing that survived.
20
00:01:34.750 --> 00:01:36.659
The fromage is good.
21
00:01:37.140 --> 00:01:40.359
So yeah, hundreds of French supermarket chains were targeted overnight,
22
00:01:40.459 --> 00:01:43.239
Sunday to Monday, in a cyber attack that affected the
23
00:01:43.280 --> 00:01:49.030
refrigerators of up to 200 intermarché stores and almost 100
24
00:01:49.030 --> 00:01:54.900
cooperative U locations. I'm assuming those are supermarkets. According to
25
00:01:54.939 --> 00:01:59.819
the retailers, Carrefour and Monoprix said some of their branches
26
00:02:00.239 --> 00:02:04.319
had also been hit. But yeah, these things went up
27
00:02:04.700 --> 00:02:05.299
to 122 degrees.
28
00:02:05.760 --> 00:02:06.640
Yeah.
29
00:02:06.799 --> 00:02:08.030
Some of them causing fires.
30
00:02:08.099 --> 00:02:11.330
They actually have, one of the articles revised it and
31
00:02:11.349 --> 00:02:15.449
said a couple of them had hit 176 degrees Fahrenheit,
32
00:02:15.449 --> 00:02:19.229
80 degrees Celsius, actually catching on fire and melting some
33
00:02:19.250 --> 00:02:23.080
of the equipment. Um, and they set, they usually, okay.
34
00:02:23.120 --> 00:02:25.930
So you might ask why these freezers can go hot.
35
00:02:26.289 --> 00:02:26.569
Yeah.
36
00:02:26.710 --> 00:02:29.150
Um, and it's for defrosting, right? Um, you need to
37
00:02:29.210 --> 00:02:31.229
clean it or whatever. You set it to defrost, but
38
00:02:31.250 --> 00:02:33.949
it's usually only like an hour, not eight hours.
39
00:02:34.550 --> 00:02:36.189
And usually there's no food in it.
40
00:02:36.449 --> 00:02:37.659
Yeah. Not, yeah.
41
00:02:37.780 --> 00:02:43.099
And not hot enough to cook bread. So that's weird. Um,
42
00:02:43.810 --> 00:02:47.169
But yeah, no, this is an interesting article in that
43
00:02:47.409 --> 00:02:52.069
there were a couple different supermarkets hit, supermarket chains, but
44
00:02:52.090 --> 00:02:56.270
they all tie back to a central control system, the
45
00:02:56.310 --> 00:03:05.069
Danfoss AKSM800A controllers that had an out-of-date firmware. So, it
46
00:03:05.129 --> 00:03:08.900
made it easy. And what's interesting is Is there was this, obviously,
47
00:03:08.939 --> 00:03:11.620
this site that you can log into a central portal
48
00:03:11.699 --> 00:03:14.719
and you can manage your, you know, freezer units remotely
49
00:03:14.960 --> 00:03:16.020
as an owner of a shop.
50
00:03:16.180 --> 00:03:16.719
As one does.
51
00:03:17.020 --> 00:03:22.719
And according to this Danfoss company, they said, we have
52
00:03:22.840 --> 00:03:27.400
been telling the supermarket owners forever that they should update
53
00:03:27.419 --> 00:03:29.939
the firmware on some of these devices. And they say,
54
00:03:30.159 --> 00:03:31.819
it's working. So, I'm going to leave it alone.
55
00:03:32.270 --> 00:03:32.449
Jeez.
56
00:03:32.750 --> 00:03:34.750
So, that's, I mean, it's interesting to see what the
57
00:03:34.789 --> 00:03:39.379
ramifications will be. Like, is the supermarket owner... Are they
58
00:03:39.599 --> 00:03:42.740
liable for any of this? But will their insurance pay?
59
00:03:43.060 --> 00:03:44.199
Or will their insurance pay?
60
00:03:44.419 --> 00:03:44.639
Right?
61
00:03:44.759 --> 00:03:47.360
No idea. And then the other thing is there was
62
00:03:47.460 --> 00:03:50.560
no claim of ransom. There was no claim of anything
63
00:03:50.580 --> 00:03:54.310
like that. So the motive behind this is... Straight up attack.
64
00:03:54.469 --> 00:03:54.710
Chaos.
65
00:03:54.729 --> 00:03:55.469
Yeah, nobody knows.
66
00:03:55.590 --> 00:03:56.129
Yeah. Right?
67
00:03:56.370 --> 00:03:58.030
Yeah, it could have been just an attack. Could have
68
00:03:58.050 --> 00:04:01.710
been just like a terrorist attack, right? Incite fear and whatever.
69
00:04:02.090 --> 00:04:02.449
Maybe.
70
00:04:02.870 --> 00:04:06.659
But they like terrorists like to claim responsibility. So, you
71
00:04:06.699 --> 00:04:10.379
know who to fear. So, just random stuff that nobody
72
00:04:10.400 --> 00:04:13.930
knows about. This smells a lot like either … Cheese.
73
00:04:15.430 --> 00:04:17.129
Melted cheese. La fromage.
74
00:04:17.170 --> 00:04:17.689
Blue cheese.
75
00:04:17.750 --> 00:04:19.850
Ce feu. That's cheese on fire. It smells like a
76
00:04:19.889 --> 00:04:27.750
fine camembert. I cannot bear the camembert. You know, we
77
00:04:27.790 --> 00:04:30.250
make light of this. I know they say tens of
78
00:04:30.389 --> 00:04:31.709
millions of dollars of euros.
79
00:04:31.769 --> 00:04:32.290
I mean, yeah.
80
00:04:32.310 --> 00:04:34.370
This is a crime against humanity in France.
81
00:04:34.810 --> 00:04:35.110
Oh, yeah.
82
00:04:35.209 --> 00:04:37.829
No, it is funny. Like the heads of these supermarkets
83
00:04:37.870 --> 00:04:39.670
were outraged at the loss of food.
84
00:04:39.889 --> 00:04:40.170
Yeah.
85
00:04:40.250 --> 00:04:41.620
Like this is insane.
86
00:04:41.980 --> 00:04:44.259
I mean, some of my best meals I've ever had
87
00:04:44.319 --> 00:04:46.639
were in France and I haven't been there that many times.
88
00:04:46.660 --> 00:04:49.000
I've never been to France. I hear it's a lovely place.
89
00:04:49.040 --> 00:04:49.360
I have.
90
00:04:49.699 --> 00:04:51.620
And I got to say the food is fantastic.
91
00:04:52.040 --> 00:04:52.240
All right.
92
00:04:52.430 --> 00:04:55.389
And of course, you know, that's where modern chef food
93
00:04:55.579 --> 00:04:56.019
came from.
94
00:04:56.240 --> 00:04:56.459
Right.
95
00:04:56.639 --> 00:04:58.759
Well, maybe they'll learn to cook at higher temperatures now.
96
00:04:59.019 --> 00:04:59.339
I don't know.
97
00:05:01.100 --> 00:05:01.639
So, yeah.
98
00:05:02.180 --> 00:05:04.459
I mean, in the war, we had chocolate that wouldn't
99
00:05:04.500 --> 00:05:06.459
melt at 110 degrees. Maybe they can get cheese the
100
00:05:06.500 --> 00:05:06.850
same way.
101
00:05:07.110 --> 00:05:07.759
And you ate it.
102
00:05:08.350 --> 00:05:08.850
I did eat it.
103
00:05:09.129 --> 00:05:09.389
Yes.
104
00:05:10.069 --> 00:05:14.019
That's... I'm still digesting it 45 years later.
105
00:05:15.699 --> 00:05:21.689
It's brown wax that's not chocolate. Anyhow, so it's weird
106
00:05:22.149 --> 00:05:25.730
that there's been nobody to claim that this was their attack.
107
00:05:25.949 --> 00:05:29.439
So this could imagine... This is like a revenge thing.
108
00:05:29.480 --> 00:05:31.459
An ex-employee leaves and is like, you know what? I
109
00:05:31.519 --> 00:05:32.399
know where I can target this.
110
00:05:32.459 --> 00:05:32.779
Maybe.
111
00:05:32.980 --> 00:05:33.259
Maybe.
112
00:05:33.759 --> 00:05:37.939
Imagine this is some teenage kid with an AI offensive
113
00:05:38.120 --> 00:05:40.089
messing around with scripts. And he's like, ooh, let's see
114
00:05:40.110 --> 00:05:42.029
how hot I can make these freezers. And then just
115
00:05:42.050 --> 00:05:42.829
doesn't realize it.
116
00:05:42.949 --> 00:05:43.129
Right?
117
00:05:43.170 --> 00:05:46.310
But it's just weird that there's no attribution at this point.
118
00:05:46.370 --> 00:05:48.810
We used to call them script kitties. And now are
119
00:05:48.850 --> 00:05:50.449
we calling them like AI kitties?
120
00:05:50.610 --> 00:05:51.589
That's a good question.
121
00:05:51.730 --> 00:05:53.250
I still call them script kitties.
122
00:05:53.430 --> 00:05:56.410
I haven't heard an update to it, but honestly, we should. Right?
123
00:05:56.470 --> 00:05:59.370
Prompt kitties. They're prompt kitties. I'm going to call them
124
00:05:59.410 --> 00:06:01.230
AI puppets because they don't know what they're running, but
125
00:06:01.250 --> 00:06:02.170
the AI is telling them to.
126
00:06:02.629 --> 00:06:07.550
Okay. Oh, boy. All right. So, moving on. This is
127
00:06:07.629 --> 00:06:12.410
Krebs on Security, which is a great author, Krebs, and
128
00:06:12.970 --> 00:06:13.410
great guy.
129
00:06:13.529 --> 00:06:14.430
Definitely worth a follow.
130
00:06:14.970 --> 00:06:21.040
Definitely writes good stuff. FBI arrests executive at ransomware negotiation firm.
131
00:06:21.300 --> 00:06:24.100
First of all, what's a ransomware negotiation firm and why
132
00:06:24.180 --> 00:06:25.660
doesn't Patrick work for them?
133
00:06:26.980 --> 00:06:29.459
Because I would tell them to go pound sand.
134
00:06:30.000 --> 00:06:30.800
Oh, yeah.
135
00:06:30.819 --> 00:06:32.490
That would probably be a bad idea.
136
00:06:32.519 --> 00:06:34.230
You'll get nothing and wish you had less.
137
00:06:34.329 --> 00:06:37.689
Nothing. So, do they negotiate with the ransomware?
138
00:06:37.709 --> 00:06:37.850
Yes.
139
00:06:38.089 --> 00:06:38.430
They do.
140
00:06:38.649 --> 00:06:41.389
And they do things like they say, okay, look, we're
141
00:06:41.410 --> 00:06:43.209
going to pay the ransom, but you got to be
142
00:06:43.230 --> 00:06:45.569
reasonable with us. We only have a million dollars of
143
00:06:45.629 --> 00:06:48.600
coverage and you're asking for five. And then the hackers
144
00:06:48.620 --> 00:06:50.519
come back and say, well, we downloaded your policy and
145
00:06:50.540 --> 00:06:51.540
you actually have six.
146
00:06:52.139 --> 00:06:52.939
Right.
147
00:06:52.980 --> 00:06:57.079
So... So, but they try to like bring it down.
148
00:06:57.120 --> 00:06:59.000
They try to make sure that the keys, they ask
149
00:06:59.019 --> 00:07:02.199
for things like, we want a sample. We want you
150
00:07:02.230 --> 00:07:04.850
to like decrypt some file. We'll send you a file.
151
00:07:04.870 --> 00:07:06.170
You decrypt it and you show us that you can
152
00:07:06.209 --> 00:07:07.769
decrypt it kind of thing.
153
00:07:07.829 --> 00:07:08.490
Proof of life.
154
00:07:08.949 --> 00:07:09.810
They should just not pay.
155
00:07:10.050 --> 00:07:14.089
Right. We know that your position is don't pay. So,
156
00:07:14.529 --> 00:07:15.589
this was an executive.
157
00:07:15.629 --> 00:07:16.610
I'm so shy about it.
158
00:07:16.649 --> 00:07:16.769
Yeah.
159
00:07:16.810 --> 00:07:20.199
This is an executive at a Canadian cybersecurity firm who,
160
00:07:20.920 --> 00:07:24.620
In connection with an investigation into the shiny hunters hacking group.
161
00:07:24.730 --> 00:07:27.509
And this is another example of why you shouldn't. People
162
00:07:27.529 --> 00:07:29.230
are conspiring with the hackers.
163
00:07:29.569 --> 00:07:29.829
Yeah.
164
00:07:30.029 --> 00:07:32.290
And I thought the shiny hunters was the most interesting
165
00:07:32.329 --> 00:07:34.230
connection because we've talked about them so many times.
166
00:07:34.430 --> 00:07:34.670
Yeah.
167
00:07:35.329 --> 00:07:38.550
Well, and it is interesting that this is a job.
168
00:07:39.089 --> 00:07:40.550
But it's been like this for a very long time.
169
00:07:41.930 --> 00:07:45.829
I think I've mentioned this book before. Very good book. Actually,
170
00:07:45.990 --> 00:07:48.430
it's a super interesting book about the start of bleeping
171
00:07:48.490 --> 00:07:51.480
computer as well, which is one of the places that
172
00:07:51.500 --> 00:07:53.240
we get a lot of our really good articles from.
173
00:07:54.519 --> 00:07:58.139
But the guy who started bleeping computer and started writing
174
00:07:58.160 --> 00:08:00.000
all the kind of really in-depth articles and that sort
175
00:08:00.040 --> 00:08:02.680
of stuff, there's a book called The Ransomware Hunting Team,
176
00:08:02.699 --> 00:08:07.019
A Band of Misfits' Improbable Crusade to Save the World
177
00:08:07.060 --> 00:08:12.329
from Cybercrime. And that book, I don't remember, came out
178
00:08:12.449 --> 00:08:16.569
in 2022, right? Um, but neither say in that book,
179
00:08:16.589 --> 00:08:20.389
they actually talk about the beginning of, um, the, these
180
00:08:20.490 --> 00:08:22.949
sort of misfit band of people who would write to
181
00:08:22.990 --> 00:08:26.129
cryptors just to help people, right? Oh, we see the
182
00:08:26.709 --> 00:08:28.949
errors and how they encrypted, you know, did this ransomware
183
00:08:28.970 --> 00:08:31.509
or whatever it was. And it started into this group
184
00:08:31.550 --> 00:08:34.750
that they then got internationally known, um, and would work
185
00:08:34.769 --> 00:08:36.549
with government agencies and that sort of stuff. And they
186
00:08:36.600 --> 00:08:39.440
worked with, um, Abrams, the guy who is a bleeping
187
00:08:39.460 --> 00:08:42.039
computers starter and founder and that sort of stuff. So,
188
00:08:42.889 --> 00:08:44.929
Very good book. But in there, they do talk about
189
00:08:44.970 --> 00:08:47.559
ransomware negotiators and they talk about a lot of shady
190
00:08:47.639 --> 00:08:50.179
ones too. Who'd be like, they get to the point
191
00:08:50.200 --> 00:08:53.399
where the negotiators got to know the ransomware people, like
192
00:08:53.440 --> 00:08:56.450
almost by first name. And they'd be like, Oh, I've negotiated.
193
00:08:56.789 --> 00:08:56.870
Yeah.
194
00:08:56.909 --> 00:08:59.289
I've negotiated with shiny hunters before. You'll want to work
195
00:08:59.309 --> 00:09:00.830
with me. And then they'll go to shiny hunters and
196
00:09:00.850 --> 00:09:03.539
be like, Hey, hey, John, you know, it seems like
197
00:09:03.559 --> 00:09:05.799
you hit one of our guys again. And they'd be like, yeah, yeah,
198
00:09:05.860 --> 00:09:07.179
we did. And be like, all right, what are you
199
00:09:07.200 --> 00:09:09.629
looking for? We need $ 2 million. I'm like, dude, come on,
200
00:09:09.690 --> 00:09:14.429
I can only pull a million. They'd be like, all right, right.
201
00:09:14.509 --> 00:09:17.250
And they would work together on. So, it is such
202
00:09:17.269 --> 00:09:20.389
a weird job. And it just becomes a business at
203
00:09:20.429 --> 00:09:20.840
that point.
204
00:09:21.409 --> 00:09:25.399
All right, our next story. Germany arrests alleged core Quillen
205
00:09:25.659 --> 00:09:28.139
ransomware member after extradition.
206
00:09:28.679 --> 00:09:31.279
Another bad guy. This one was caught in Japan.
207
00:09:31.860 --> 00:09:35.620
Yeah. And Quillen is spelled Q-I-L-I-N, by the way.
208
00:09:36.080 --> 00:09:36.220
Yeah.
209
00:09:36.480 --> 00:09:41.139
And this is a Russian national, and Germany successfully extradited
210
00:09:41.210 --> 00:09:43.169
him from Japan.
211
00:09:43.649 --> 00:09:46.350
So, it's very international. Yeah, which is funny because he
212
00:09:46.389 --> 00:09:50.049
was going as a tourist, and they picked him up
213
00:09:50.110 --> 00:09:54.509
in Osaka, I believe. So, I mean, there's a lot of...
214
00:09:54.909 --> 00:09:59.169
The Japanese Ministry of Justice, first off, can we just
215
00:09:59.220 --> 00:10:02.899
say that the any i would give my left arm
216
00:10:03.059 --> 00:10:05.580
to work at anybody any place called the ministry of
217
00:10:05.740 --> 00:10:08.539
justice because that just sounds awesome you're left what right
218
00:10:08.759 --> 00:10:11.259
it's not the ministry of magic no but it's like
219
00:10:11.740 --> 00:10:13.799
it sounds like you and a bunch of super friends
220
00:10:13.840 --> 00:10:16.240
are gonna go bust down a door somewhere.
221
00:10:15.860 --> 00:10:17.940
It's not the ministry of silly walks.
222
00:10:19.450 --> 00:10:21.409
I did work at the Ministry of Transportation for a while.
223
00:10:21.429 --> 00:10:22.769
You did?
224
00:10:22.789 --> 00:10:23.409
Yeah, I did.
225
00:10:23.629 --> 00:10:24.070
Up in Canada.
226
00:10:24.110 --> 00:10:25.490
All right. So, what happened here?
227
00:10:25.789 --> 00:10:31.870
So, all right. So, this Russian national who Germany had
228
00:10:32.009 --> 00:10:35.370
an arrest warrant out for decides that he wants to
229
00:10:35.409 --> 00:10:37.350
go on vacation. And we've actually seen this. Here's some
230
00:10:37.389 --> 00:10:38.240
criminal career advice.
231
00:10:38.269 --> 00:10:38.529
Oh, wait.
232
00:10:38.580 --> 00:10:39.360
Let me play the song.
233
00:10:40.100 --> 00:10:45.600
It's criminal career advice.
234
00:10:45.799 --> 00:10:51.129
Listen, if you're wanted... Outside of your own country. I
235
00:10:51.169 --> 00:10:53.769
can tell you... Do a staycation. Right now, for example,
236
00:10:54.009 --> 00:10:55.769
I probably am not going to Malaysia.
237
00:10:56.009 --> 00:10:56.129
No.
238
00:10:56.149 --> 00:11:01.289
But anyways, I digress. If you're wanted for crimes outside
239
00:11:01.309 --> 00:11:05.230
of the country you're in, maybe... don't go on vacation
240
00:11:05.269 --> 00:11:08.320
to a place that will extradite you to those locations.
241
00:11:08.340 --> 00:11:09.480
Drive to Kentucky.
242
00:11:12.179 --> 00:11:15.179
And that's exactly what this Russian decided to do. He
243
00:11:15.210 --> 00:11:17.429
was like, you know what, I really want to visit Japan.
244
00:11:17.490 --> 00:11:19.529
I've made a lot of money off of my ransomware,
245
00:11:19.909 --> 00:11:23.149
my ill-got gains. And he goes to Japan and Japan's like,
246
00:11:23.190 --> 00:11:25.120
you know, we're just gonna send you to germany right
247
00:11:25.200 --> 00:11:27.049
and they they did they held him and.
248
00:11:27.090 --> 00:11:29.149
He probably didn't even get to see anything he probably
249
00:11:29.190 --> 00:11:30.610
got nailed at the airport.
250
00:11:30.269 --> 00:11:32.429
Well no it's funny as i think in the article
251
00:11:32.490 --> 00:11:36.129
they said they they bagged him in a hotel in
252
00:11:36.240 --> 00:11:41.360
osaka um wow yeah here we go uh japan detained
253
00:11:41.440 --> 00:11:45.659
the alleged quillen leader member in may at a hotel
254
00:11:45.740 --> 00:11:50.950
in osaka Despite this, the gang continued to ransomware people, blah, blah, blah, blah, blah.
255
00:11:51.990 --> 00:11:55.970
We've reported on, by the way, some of the victims
256
00:11:56.250 --> 00:12:00.690
of this group. Nissan, we'll remember a while back, we
257
00:12:00.730 --> 00:12:05.789
reported on Nissan getting hacked. We also reported on Ashai,
258
00:12:05.809 --> 00:12:08.090
I think is the name. I don't know how to
259
00:12:08.129 --> 00:12:10.129
pronounce it, but it's the Japanese brewery. Do you remember
260
00:12:10.169 --> 00:12:11.980
we were talking about the Japanese brewery that got hit
261
00:12:12.000 --> 00:12:13.820
and it was offline for like three months or six
262
00:12:13.840 --> 00:12:17.210
months or whatever it was? That was this crew. That
263
00:12:17.250 --> 00:12:21.179
did it. So, if you took down one of the
264
00:12:21.279 --> 00:12:25.639
major brewers in Japan and then decided to go on
265
00:12:25.679 --> 00:12:28.399
vacation in Japan....
266
00:12:29.639 --> 00:12:30.019
I don't know.
267
00:12:30.080 --> 00:12:31.649
That doesn't sound like a smart move.
268
00:12:32.129 --> 00:12:35.850
So Japan doesn't have the best reputation for defending themselves
269
00:12:35.909 --> 00:12:36.230
right now.
270
00:12:36.250 --> 00:12:38.850
I thought you were going to say for beer. Go ahead.
271
00:12:40.690 --> 00:12:44.379
I have no comment on the beer. But Japan's playing
272
00:12:44.399 --> 00:12:47.659
a little catch-up. They were kind of left behind by
273
00:12:47.740 --> 00:12:53.049
the whole ransomware phase. So they didn't really harden themselves.
274
00:12:53.570 --> 00:12:53.929
The U.S.
275
00:12:53.970 --> 00:12:57.090
Has always been a target. And so the U.S.
276
00:12:57.450 --> 00:13:00.549
Has hardened itself through the pain and suffering we've had,
277
00:13:01.710 --> 00:13:05.299
as well as Europe. But Japan went a lot unscathed,
278
00:13:05.460 --> 00:13:07.480
which means they're kind of falling behind.
279
00:13:07.639 --> 00:13:07.860
Yeah.
280
00:13:07.899 --> 00:13:10.559
I mean, why do you speculate, though? Why would they
281
00:13:10.600 --> 00:13:11.679
fall behind? They did.
282
00:13:11.840 --> 00:13:15.190
I mean, it's pretty well known that the average company
283
00:13:15.210 --> 00:13:19.110
in Japan does not have the security standards. posture that
284
00:13:19.129 --> 00:13:20.309
we see in the west no.
285
00:13:20.230 --> 00:13:23.720
But why i mean japan everybody's always assumed japan is
286
00:13:23.799 --> 00:13:25.080
the best of the best the tip of the spear
287
00:13:25.100 --> 00:13:29.320
when it comes to technology right? And understanding technology and
288
00:13:29.340 --> 00:13:30.639
technology thought leadership.
289
00:13:30.820 --> 00:13:31.740
Yeah.
290
00:13:32.419 --> 00:13:33.360
But this is a tax.
291
00:13:34.559 --> 00:13:39.370
So, you know that. Cyber preparedness is a tax. It's overhead.
292
00:13:39.409 --> 00:13:44.710
It's people who live in areas where they wouldn't lock
293
00:13:44.750 --> 00:13:46.809
their doors don't invest in really good locks.
294
00:13:47.049 --> 00:13:47.570
Sure.
295
00:13:47.629 --> 00:13:49.549
It's the same kind of thing here. If you haven't
296
00:13:49.590 --> 00:13:54.080
been part of this. Now, That's changing now the geopolitical
297
00:13:54.139 --> 00:13:57.700
situation for Japan vis-a-vis Russia and China has gotten much worse.
298
00:13:58.159 --> 00:14:02.059
And so they're playing catch up. But, you know, it's funny.
299
00:14:02.340 --> 00:14:06.460
If you don't work with these– and I– unlike you, Duane,
300
00:14:06.639 --> 00:14:09.070
you work with a lot of our customers– But I've
301
00:14:09.110 --> 00:14:11.210
had a lot more exposure to our Japanese customers than
302
00:14:11.230 --> 00:14:11.590
you have.
303
00:14:11.610 --> 00:14:11.679
Yep.
304
00:14:12.169 --> 00:14:15.350
And so, I see that they're really struggling to get
305
00:14:15.429 --> 00:14:18.490
caught back up again. And I don't think it's because
306
00:14:18.509 --> 00:14:21.409
they're lacking the technology. It's that they didn't have the
307
00:14:21.509 --> 00:14:24.559
threat for a number of years that they're now seeing now.
308
00:14:24.740 --> 00:14:26.740
Yeah, it makes sense. Yeah, just becoming more of a target.
309
00:14:27.159 --> 00:14:27.559
Yeah.
310
00:14:27.740 --> 00:14:33.399
All right. Next story. Engineer sentenced for locking over 3,000
311
00:14:33.399 --> 00:14:35.710
devices on employer network.
312
00:14:35.990 --> 00:14:38.230
You're going to get caught if you do this. Just
313
00:14:38.230 --> 00:14:41.679
… This is some criminal career advice that's not helping
314
00:14:41.720 --> 00:14:42.179
the criminal.
315
00:14:42.259 --> 00:14:43.259
Don't do this.
316
00:14:44.399 --> 00:14:45.279
This is stupid.
317
00:14:45.559 --> 00:14:47.730
There's so much criminal career advice I want to give
318
00:14:47.779 --> 00:14:48.830
on this one. First off.
319
00:14:49.389 --> 00:14:50.409
So what happened, first of all?
320
00:14:50.450 --> 00:14:56.610
Let's talk about the story. 57-year-old Daniel Hrein from Kansas City, Missouri,
321
00:14:56.669 --> 00:15:00.629
pleaded guilty to his role in a failed extortion plot
322
00:15:01.429 --> 00:15:05.059
after being arrested in August of 2024 and and released
323
00:15:05.399 --> 00:15:08.080
following his initial appearance in federal court. So what happened
324
00:15:08.139 --> 00:15:11.919
here is he had, he worked for a gas conglomerate. Uh,
325
00:15:12.039 --> 00:15:13.799
I think it's listed in here somewhere.
326
00:15:13.990 --> 00:15:15.289
Messer North America.
327
00:15:15.330 --> 00:15:15.710
What's that?
328
00:15:16.090 --> 00:15:17.110
Messer North America.
329
00:15:17.129 --> 00:15:21.129
There you go. Messer North America. Um, and one day
330
00:15:21.269 --> 00:15:25.990
he decided to change the password on the administrative, the
331
00:15:26.129 --> 00:15:29.929
default administrative account on the domain, and then write a
332
00:15:29.970 --> 00:15:33.850
script to remove all other administrators. And then write a
333
00:15:33.929 --> 00:15:37.429
script to go to all of the workstations and change
334
00:15:37.470 --> 00:15:41.789
the local administrative passwords there. And then at that point
335
00:15:41.860 --> 00:15:45.500
start sending out ransom and rebooting computers and shutting them down.
336
00:15:45.539 --> 00:15:48.600
And nobody can bring these things back online anymore with
337
00:15:48.639 --> 00:15:51.159
what he's doing. So he was shutting down and crippling
338
00:15:51.200 --> 00:15:55.440
the network slowly. And trying to extort them for 20 Bitcoin.
339
00:15:55.659 --> 00:15:58.480
Which is a couple million dollars. Now it is. Back
340
00:15:58.500 --> 00:15:59.590
then it was only 750.
341
00:15:59.590 --> 00:16:01.759
I like how the people who wrote this article chose
342
00:16:01.799 --> 00:16:04.370
to put the password in the article.
343
00:16:04.429 --> 00:16:06.470
That is the best. First off.
344
00:16:06.490 --> 00:16:09.710
The frozen crew. Bang.
345
00:16:10.210 --> 00:16:12.909
Here is why I think he did this. If I
346
00:16:13.070 --> 00:16:16.179
had to guess. First off, he's 57 years old. Maybe
347
00:16:16.200 --> 00:16:18.899
he just doesn't have a 401k. Maybe. I'm not entirely sure.
348
00:16:19.340 --> 00:16:21.379
He's like, I need to make a couple extra bucks.
349
00:16:21.940 --> 00:16:26.759
The frozen crew, if he were smart, he probably was
350
00:16:26.840 --> 00:16:30.240
trying to make it look like this was done by
351
00:16:30.279 --> 00:16:33.110
a ransomware gang and they may put their name in
352
00:16:33.120 --> 00:16:33.679
the password.
353
00:16:33.850 --> 00:16:34.210
Okay.
354
00:16:34.500 --> 00:16:36.230
I get it. But here's what I'm going to tell you.
355
00:16:36.750 --> 00:16:40.950
If you change the password to something, A, that's reasonably short.
356
00:16:41.470 --> 00:16:44.269
And B, you change the password on all of the accounts.
357
00:16:44.289 --> 00:16:46.789
There were 301 domain user accounts that were changed to
358
00:16:46.830 --> 00:16:50.539
that password and 13 domain administrative accounts. Because that hash
359
00:16:50.600 --> 00:16:54.600
keeps coming up, they won't focus on all the, you know,
360
00:16:54.779 --> 00:16:56.259
if there were thousands of accounts, they won't have to
361
00:16:56.279 --> 00:16:57.820
focus on them all. They just focus on this one
362
00:16:57.840 --> 00:17:00.029
hash and they get access to the computers again. So
363
00:17:00.039 --> 00:17:01.129
if you want to hold them out for a long
364
00:17:01.169 --> 00:17:03.809
period of time, don't set the password to the same
365
00:17:03.870 --> 00:17:05.849
password for every account. It's just goofy.
366
00:17:05.970 --> 00:17:06.150
Right.
367
00:17:06.730 --> 00:17:12.970
So problem number one. But if you dig into this,
368
00:17:13.880 --> 00:17:17.960
it says, and then researchers found or investigators found one
369
00:17:18.019 --> 00:17:22.240
week earlier, he also searched on his laptop for command
370
00:17:22.279 --> 00:17:27.319
line to change local administrative password and command line to
371
00:17:27.420 --> 00:17:32.210
remotely change local administrative password and how to remotely shut
372
00:17:32.250 --> 00:17:44.259
down a computer and U-S-I-G-N, U-S-I-G-N, U-S-I-G-N, C-M-D, using command. So,
373
00:17:44.500 --> 00:17:49.140
not only was this guy not criminally really bright, but
374
00:17:49.180 --> 00:17:52.500
he had to search on Google for what the commands
375
00:17:52.559 --> 00:17:56.200
were to do his job, which is normal network administration,
376
00:17:56.440 --> 00:18:01.960
I believe. It also said he used a hidden password.
377
00:18:02.950 --> 00:18:05.400
VM server to do a lot of his research.
378
00:18:07.700 --> 00:18:08.220
Except Googling.
379
00:18:11.390 --> 00:18:13.630
Here's what I'll tell you from a forensic standpoint.
380
00:18:14.680 --> 00:18:16.019
You left a lot of clues.
381
00:18:16.059 --> 00:18:16.279
Yeah.
382
00:18:16.460 --> 00:18:21.000
If you want to stymie investigators a little bit more.
383
00:18:21.019 --> 00:18:22.559
How about just a little bit?
384
00:18:22.700 --> 00:18:23.000
Yeah.
385
00:18:23.240 --> 00:18:23.720
First off.
386
00:18:23.900 --> 00:18:24.759
Even a little bit more.
387
00:18:25.039 --> 00:18:28.599
Don't search for many accounts associated on the same network,
388
00:18:29.400 --> 00:18:31.920
on anything you own on your laptop.
389
00:18:31.960 --> 00:18:33.740
I always go to Dwayne's house and do it.
390
00:18:33.740 --> 00:18:33.940
Yeah.
391
00:18:33.960 --> 00:18:35.700
I mean, that's the best place. And I'm using my
392
00:18:35.769 --> 00:18:41.950
neighbor's Wi-Fi anyways. So, secondly... Well, the cop? Secondly... No,
393
00:18:41.970 --> 00:18:47.359
I've since moved. Secondly... Oh, that guy. This guy has you.
394
00:18:48.819 --> 00:18:53.299
This guy... No more comments. This guy has a virtual
395
00:18:53.319 --> 00:18:54.980
machine that he's using to do his searching, which in
396
00:18:55.039 --> 00:18:57.460
general sounds like a really good idea, right? I'm going
397
00:18:57.480 --> 00:18:59.900
to have this isolated thing that I can shut down
398
00:19:00.259 --> 00:19:03.619
and is quote-unquote hidden. Virtual machines aren't hidden. People can
399
00:19:03.660 --> 00:19:03.849
find them.
400
00:19:03.869 --> 00:19:05.789
Just a machine that runs on another machine.
401
00:19:05.970 --> 00:19:09.750
Yeah, exactly. But if you do want to do something
402
00:19:09.769 --> 00:19:12.910
like this, and it's very similar to something like ransomware
403
00:19:13.130 --> 00:19:17.490
analysis and forensics, what you don't do... is just shut
404
00:19:17.529 --> 00:19:19.970
the machine off, right? Because it's just like a normal
405
00:19:20.009 --> 00:19:22.569
computer and you can do forensics on it. What you
406
00:19:22.589 --> 00:19:25.289
would typically do is either A, create a snapshot of
407
00:19:25.329 --> 00:19:28.990
that machine before you ever touched it, then do your
408
00:19:29.029 --> 00:19:32.069
illicit things and then roll that snapshot back. That's one
409
00:19:32.130 --> 00:19:33.789
way to do it, although that still leaves a little
410
00:19:33.809 --> 00:19:38.410
bit of forensics. But there's also stateless machines where once
411
00:19:38.470 --> 00:19:41.769
you power it off, it's gone. All of the memory
412
00:19:41.809 --> 00:19:44.890
was transient, so it just goes away, right? And it
413
00:19:44.910 --> 00:19:48.039
never persisted in anything to disk. So there are better
414
00:19:48.079 --> 00:19:51.240
ways if you're trying to hide your tracks. um than
415
00:19:51.579 --> 00:19:53.319
having a vm that you just power off.
416
00:19:53.480 --> 00:19:55.720
Not that we think about this a lot no yeah
417
00:19:55.759 --> 00:19:58.039
exactly there's a little bit of just a little bit
418
00:19:58.059 --> 00:20:00.140
of advice here uh don't change it to the same
419
00:20:00.200 --> 00:20:03.519
password it makes it easier for cracking.
420
00:20:02.960 --> 00:20:05.190
And if you just listen to security this week you
421
00:20:05.210 --> 00:20:06.430
might have picked up a few.
422
00:20:06.349 --> 00:20:11.039
Clues exactly Oh, so crazy. So, it'll be interesting. He
423
00:20:11.079 --> 00:20:15.279
pled guilty. They gave him 30, what was it, 32 months?
424
00:20:15.279 --> 00:20:21.329
32 months in prison for locking nearly 3,200 devices.
425
00:20:21.349 --> 00:20:23.890
I don't know. 301 user accounts.
426
00:20:24.589 --> 00:20:24.809
Yeah.
427
00:20:24.990 --> 00:20:26.849
So, it sounds like he got, I don't know, a
428
00:20:26.930 --> 00:20:30.539
month for every 100 computers locked, something like that. So,
429
00:20:30.539 --> 00:20:32.500
if you're looking for the linear scale, there you go.
430
00:20:33.079 --> 00:20:34.940
They should take a digit. Yeah.
431
00:20:34.980 --> 00:20:35.660
Take a digit.
432
00:20:35.809 --> 00:20:36.289
Oof. Yeah.
433
00:20:36.680 --> 00:20:36.849
Oof.
434
00:20:37.890 --> 00:20:39.630
Wow, Patrick, that got dark fast.
435
00:20:39.650 --> 00:20:40.849
Eye for an eye, eye for an eye.
436
00:20:40.869 --> 00:20:42.509
They got my thumb, Charlie.
437
00:20:44.910 --> 00:20:45.210
All right.
438
00:20:45.269 --> 00:20:47.069
Well, this seems like a good place to take a break. So,
439
00:20:47.089 --> 00:20:52.650
we'll be right back after these very important messages. And
440
00:20:52.670 --> 00:20:55.299
we're back. It's security this week. I'm Carl. That's Patrick
441
00:20:55.339 --> 00:20:59.859
and Dwayne. And continuing on here, the Silicon Review reports,
442
00:20:59.960 --> 00:21:04.819
North Korean hackers have encroached on dozens of U.S. companies. Now,
443
00:21:05.359 --> 00:21:07.640
we knew this was happening. We've reported on it before,
444
00:21:07.720 --> 00:21:11.029
but this is a newer story with new numbers.
445
00:21:11.769 --> 00:21:12.890
Yeah, we need the reminder.
446
00:21:13.289 --> 00:21:18.269
Yeah, that's right. And just to refresh your memory, what
447
00:21:18.309 --> 00:21:22.359
they're doing is they pose as remote IT workers as
448
00:21:23.150 --> 00:21:25.210
And they, you know, they get in the good graces
449
00:21:25.569 --> 00:21:27.869
of the people in the company. Once they're in there,
450
00:21:27.890 --> 00:21:30.150
then they see what I did.
451
00:21:31.130 --> 00:21:32.319
Yeah.
452
00:21:33.259 --> 00:21:35.180
You know, they do all the Kung Fu moves, which
453
00:21:35.259 --> 00:21:38.420
is not North Korean, but it sounded fun anyway. It does. Yeah.
454
00:21:38.599 --> 00:21:41.299
What's interesting here is the term laptop farm.
455
00:21:41.480 --> 00:21:41.680
Yeah.
456
00:21:41.740 --> 00:21:42.559
Laptop farms.
457
00:21:42.819 --> 00:21:46.769
Yeah. So they, what they do exactly what Carl said, right? They're,
458
00:21:47.009 --> 00:21:50.509
they're garnering trust inside the organization. And then they're either
459
00:21:50.630 --> 00:21:55.500
making up an excuse or, Or they're literally inculcating people
460
00:21:55.759 --> 00:21:58.319
and getting accomplices, but they're getting them to set up
461
00:21:58.380 --> 00:22:00.140
devices inside the United States.
462
00:22:00.460 --> 00:22:00.720
Right.
463
00:22:00.900 --> 00:22:03.519
And they call them laptop farms, and here it even
464
00:22:03.539 --> 00:22:07.559
defines it, a laptop farm, as a physical site where U.S.-based accomplices,
465
00:22:08.420 --> 00:22:13.670
witting or unwitting, keep and maintain employer-issued laptops, and then
466
00:22:13.690 --> 00:22:15.970
they have control over it. So, it gives them this
467
00:22:16.049 --> 00:22:19.329
way of them, North Korea, reaching into the United States
468
00:22:19.349 --> 00:22:25.990
and And not using well-known VPNs or Tor to start hacking.
469
00:22:26.009 --> 00:22:28.809
They can do it straight from these locations and sometimes
470
00:22:28.849 --> 00:22:32.339
their home IP addresses, which gets even harder to shut down.
471
00:22:33.019 --> 00:22:36.880
Yeah, there's been instances where they've arrested and prosecuted the
472
00:22:36.900 --> 00:22:41.119
person providing this and they've knowingly provided this.
473
00:22:41.539 --> 00:22:42.460
Oh, absolutely.
474
00:22:42.839 --> 00:22:47.180
And this big bust happened in Texas, by the way. Yeah.
475
00:22:47.349 --> 00:22:48.650
I think they called it, what did they call it?
476
00:22:48.650 --> 00:22:54.369
The Lone Star, Operation Lone Star Roundup, which sounds very Western,
477
00:22:54.690 --> 00:22:55.309
which is awesome.
478
00:22:55.369 --> 00:22:58.289
I used to go to that for dinner. Lone Star Roundup.
479
00:22:58.309 --> 00:22:59.829
Lone Star Roundup.
480
00:22:59.890 --> 00:23:04.950
Really good. Delicious. So, they rated more than 40 laptop
481
00:23:04.990 --> 00:23:07.500
farms in Texas. That's insane. Yeah.
482
00:23:07.960 --> 00:23:08.180
Yeah.
483
00:23:08.200 --> 00:23:11.859
All right. Well, that was a quick one, but just
484
00:23:11.880 --> 00:23:15.609
be vigilant, people. All right, the next story. Ivanti warns
485
00:23:15.690 --> 00:23:20.769
of Connect Secure zero-day exploited in attacks. Ivanti.
486
00:23:20.990 --> 00:23:25.950
Ivanti. Ivanti Connect Secure remote access gateway is the product
487
00:23:26.890 --> 00:23:27.450
in question.
488
00:23:27.670 --> 00:23:29.309
I don't know why, but Ivanti sounds like it'd be
489
00:23:29.369 --> 00:23:30.769
a kick-ass coffee maker.
490
00:23:30.789 --> 00:23:31.529
It probably is.
491
00:23:31.529 --> 00:23:34.819
Like, oh, try it off the Ivanti. It's amazing, right?
492
00:23:35.400 --> 00:23:39.140
Is Ivanti– the product used to be named Juniper Plus.
493
00:23:39.940 --> 00:23:41.279
Were they part of Juniper Networks?
494
00:23:41.339 --> 00:23:43.789
Is that– Their heritage? No, I don't know if they
495
00:23:43.809 --> 00:23:46.069
were part of Juniper. My guess would be they bought
496
00:23:46.089 --> 00:23:49.430
some of the technology when Juniper was, you know, back
497
00:23:49.450 --> 00:23:50.789
in the heyday when they were the best of the best,
498
00:23:50.829 --> 00:23:54.049
but I'm not sure. Yeah, I'd have to go sort
499
00:23:54.069 --> 00:23:57.369
of figure that out. But these devices, these Avanti Connect Secure,
500
00:23:57.410 --> 00:24:01.039
the ICSs, they're VPN gateways, right? They allow you to
501
00:24:01.079 --> 00:24:03.539
VPN in your organization and get access to resources and
502
00:24:03.599 --> 00:24:08.619
cloud resources and whatever, right? They're used, but they're not
503
00:24:08.640 --> 00:24:11.640
the most used. That's probably the Florida VPN.
504
00:24:11.680 --> 00:24:11.750
Hmm.
505
00:24:13.180 --> 00:24:16.079
So, but there's, you know, it's funny, speaking of Fortinet,
506
00:24:16.539 --> 00:24:18.799
I did actually get an email this morning from Fortinet.
507
00:24:19.359 --> 00:24:21.500
And they were like, hey, you know, we'd love to
508
00:24:21.539 --> 00:24:23.000
know if you'd like to sit with us and talk
509
00:24:23.039 --> 00:24:26.200
to us about, you know, implementing Fortinet at your site.
510
00:24:26.359 --> 00:24:27.559
Did they listen to the show?
511
00:24:27.900 --> 00:24:28.119
No.
512
00:24:28.660 --> 00:24:30.960
No, I just, I wanted to reply with one of
513
00:24:31.029 --> 00:24:33.089
our episode links and be like, yeah, no thanks.
514
00:24:33.450 --> 00:24:34.329
No thanks.
515
00:24:34.410 --> 00:24:36.509
Actually, what they should have said is, hey, we'd like
516
00:24:36.529 --> 00:24:39.529
to talk to you about never speaking our name again.
517
00:24:39.569 --> 00:24:39.650
Yeah.
518
00:24:40.700 --> 00:24:43.579
How much will it cost to shut up about four minutes?
519
00:24:43.599 --> 00:24:43.799
Exactly.
520
00:24:44.099 --> 00:24:48.210
And our three listeners will never hear it again. That's right.
521
00:24:49.349 --> 00:24:51.710
So what's interesting in this particular case is, all right,
522
00:24:51.750 --> 00:24:55.549
so there's probably, according to the Internet Shadow Server Tracker, 5,500
523
00:24:55.549 --> 00:25:00.599
instances of ICS out there now. that may or may
524
00:25:00.640 --> 00:25:02.109
not be patched, may or may not. Some of them
525
00:25:02.119 --> 00:25:04.089
might be honeypots, but it gives you a feel for
526
00:25:04.109 --> 00:25:09.210
the fact that it's not huge. Um, the exploit is
527
00:25:09.230 --> 00:25:12.150
CVE 2026 1049 35. Um, if you are running an
528
00:25:12.230 --> 00:25:15.710
ICS go patch, there is a patch. It fixes this. Um,
529
00:25:16.359 --> 00:25:19.680
but what I wanted to go down in this project, um,
530
00:25:19.940 --> 00:25:23.940
is I really started digging into how did this, this
531
00:25:23.980 --> 00:25:27.930
attack work? Like, what does it look like? Um, You know,
532
00:25:28.029 --> 00:25:31.549
it's an authentication bypass. Sorry, that tells us you don't
533
00:25:31.569 --> 00:25:35.220
need a username and password. Is it a SQL injection?
534
00:25:35.460 --> 00:25:38.960
Is it some sort of SSRF? Is it, you know, whatever, right?
535
00:25:40.019 --> 00:25:43.039
So I started digging into it and the ICS device
536
00:25:43.079 --> 00:25:46.619
has a welcome.cgi. This is Carl.
537
00:25:46.700 --> 00:25:48.240
Common gateway interface.
538
00:25:48.380 --> 00:25:49.750
Crazy throwbacks, buddy.
539
00:25:49.769 --> 00:25:51.349
It's a callback to last week.
540
00:25:51.430 --> 00:25:53.990
Why are we seeing so many CGI apps?
541
00:25:54.150 --> 00:25:54.250
Yeah.
542
00:25:55.029 --> 00:25:59.630
Um, so it has this welcome.cgi, which allows anybody publicly,
543
00:25:59.869 --> 00:26:02.230
you can go to the welcome CGI. You can see the, Hey,
544
00:26:02.269 --> 00:26:04.220
welcome to the Avanti ICS, blah, blah, blah.
545
00:26:04.279 --> 00:26:04.960
Login, whatever.
546
00:26:05.039 --> 00:26:05.220
Right.
547
00:26:07.119 --> 00:26:10.440
Um, and you make a request to the welcome.cgi, which
548
00:26:10.500 --> 00:26:13.359
is on slash Dana dash N a slash off slash
549
00:26:13.440 --> 00:26:15.859
URL default slash welcome.cgi. It doesn't matter.
550
00:26:16.059 --> 00:26:16.220
Right.
551
00:26:16.299 --> 00:26:16.640
Endpoint.
552
00:26:17.720 --> 00:26:22.200
But what they included in the request was a header.
553
00:26:23.049 --> 00:26:28.230
Called x-dscgi-path.
554
00:26:28.750 --> 00:26:28.869
Oh.
555
00:26:29.190 --> 00:26:38.980
And they redirected it to wu.cgi. WU is an upload file.
556
00:26:39.140 --> 00:26:42.380
But the upload CGI allows you to upload files, right?
557
00:26:42.420 --> 00:26:47.160
Certificates and whatever. But that upload CGI is locked behind off.
558
00:26:48.720 --> 00:26:53.519
But because the main URL was anonymous allowed... when it
559
00:26:53.660 --> 00:26:56.240
redirected you to this other header.
560
00:26:56.400 --> 00:26:56.940
Skipped off.
561
00:26:57.019 --> 00:26:58.700
It just allowed you in, just skipped off.
562
00:26:58.720 --> 00:26:59.359
Came anonymous.
563
00:26:59.859 --> 00:27:00.099
Wow.
564
00:27:00.259 --> 00:27:03.490
So that's super unique and sort of an interesting way
565
00:27:03.529 --> 00:27:07.630
to bypass. Now get this. Then the attackers uploaded a
566
00:27:07.750 --> 00:27:14.700
Perl script with a zip extension. And the gateway does
567
00:27:14.779 --> 00:27:17.160
a hash on that to determine that it's actually a
568
00:27:17.220 --> 00:27:20.299
zip file, actually looks at the first like bytes and headers.
569
00:27:20.440 --> 00:27:22.059
First two bytes are PK, I think.
570
00:27:22.359 --> 00:27:25.420
Exactly. And then when it finds that it's not PK,
571
00:27:25.480 --> 00:27:28.630
it deletes it. So you say, okay, well, how is
572
00:27:28.710 --> 00:27:33.289
that a remote code execution? What they instantly did once
573
00:27:33.329 --> 00:27:37.529
they uploaded that Perl script, they instantly exploited the first
574
00:27:37.650 --> 00:27:39.769
redirect again, but pointed it at the name of the
575
00:27:39.809 --> 00:27:43.049
Perl script. And before the delete happened, it would run
576
00:27:43.109 --> 00:27:43.809
the Perl script.
577
00:27:43.869 --> 00:27:44.230
Wow.
578
00:27:44.269 --> 00:27:45.990
So it's a race case condition.
579
00:27:46.009 --> 00:27:46.250
Yeah.
580
00:27:46.630 --> 00:27:49.430
Where they would like hit it as fast as they could,
581
00:27:49.970 --> 00:27:53.069
upload the file, and hopefully they ran the file before
582
00:27:53.390 --> 00:27:54.029
it got removed.
583
00:27:54.109 --> 00:27:54.430
Wow.
584
00:27:54.789 --> 00:27:57.390
And so, it's like if you start, and then there's
585
00:27:57.410 --> 00:27:59.430
a whole bunch of information about like lib patching and
586
00:27:59.470 --> 00:28:01.410
all sorts of stuff. There's not a public POC, although
587
00:28:01.430 --> 00:28:03.789
I've probably walked through some of our listeners enough where
588
00:28:03.809 --> 00:28:05.559
they could create one if they want to, hint, hint.
589
00:28:06.880 --> 00:28:09.160
But very, very, very cool stuff.
590
00:28:09.180 --> 00:28:09.380
Yeah.
591
00:28:09.460 --> 00:28:10.059
How that worked.
592
00:28:10.180 --> 00:28:13.839
That's a very, very... unique way to hack.
593
00:28:14.660 --> 00:28:16.819
So, what's interesting is my team and I were trying
594
00:28:16.839 --> 00:28:19.359
to determine if we were to create this exploit, how
595
00:28:19.380 --> 00:28:23.140
would we easily do it. You're not guessing that the
596
00:28:23.259 --> 00:28:25.740
upload script is in slash home slash web server slash
597
00:28:25.960 --> 00:28:29.720
HD doc slash Dana slash FB slash SMB slash WU
598
00:28:29.759 --> 00:28:30.740
dot CGI. You're not guessing.
599
00:28:30.779 --> 00:28:31.559
Slash WTF.
600
00:28:31.759 --> 00:28:31.940
Right.
601
00:28:32.259 --> 00:28:34.799
And you're not guessing that, okay, if I go to
602
00:28:34.819 --> 00:28:38.720
the public endpoint and I put this X dash DS
603
00:28:38.880 --> 00:28:42.619
CGI dash path, that it's going to redirect to it. So,
604
00:28:42.640 --> 00:28:45.349
the most likely way and the way that my team
605
00:28:45.369 --> 00:28:46.849
would have done it is we would have bought an
606
00:28:46.910 --> 00:28:51.690
ICS and torn it apart. And been like, okay, this
607
00:28:51.759 --> 00:28:54.960
is how we get access to this. The reason I
608
00:28:55.059 --> 00:28:58.799
say that is it really points to somebody with funding
609
00:28:59.740 --> 00:29:02.619
really wanted to get access to somebody who's running an ICS.
610
00:29:02.660 --> 00:29:03.509
Okay.
611
00:29:04.220 --> 00:29:07.789
So, before we go there, let me just devil's advocate
612
00:29:07.809 --> 00:29:10.630
for a minute. What about a situation where you get
613
00:29:10.690 --> 00:29:14.799
a nice, powerful AI to look at this? And it
614
00:29:15.039 --> 00:29:19.680
uses logging to figure out the structures. Because there might
615
00:29:19.720 --> 00:29:21.940
be logs out there that would tell you this kind
616
00:29:21.980 --> 00:29:22.460
of thing.
617
00:29:22.880 --> 00:29:25.640
So, it's possible. But what you wouldn't have known is
618
00:29:25.660 --> 00:29:29.140
the authentication bypass. You wouldn't have ever seen a request
619
00:29:29.160 --> 00:29:32.069
to a URL get redirected to an authenticated.
620
00:29:32.210 --> 00:29:33.009
Unless you were running it.
621
00:29:33.009 --> 00:29:34.250
You know what I mean? You wouldn't know that the
622
00:29:34.329 --> 00:29:40.029
header of the WCGI isn't actually authenticating the requests. You have...
623
00:29:40.299 --> 00:29:42.339
to have code access. You had to look at the
624
00:29:42.400 --> 00:29:46.099
device would be, um, now I'm not claiming somebody didn't
625
00:29:46.119 --> 00:29:48.240
buy one of these things and, and point an AI
626
00:29:48.299 --> 00:29:50.200
at and say, go, go to town. Tell me what
627
00:29:50.220 --> 00:29:50.799
the path is.
628
00:29:50.880 --> 00:29:51.039
Right.
629
00:29:51.380 --> 00:29:53.730
But you're just, you're asserting that in order to do it,
630
00:29:53.880 --> 00:29:56.490
no matter what you're going to need, even with an AI,
631
00:29:56.509 --> 00:29:57.789
you're going to need a device.
632
00:29:57.970 --> 00:30:01.849
Yeah, absolutely. I like, If somebody came to me and
633
00:30:01.890 --> 00:30:03.910
was like, hey, for a million bucks, get access to
634
00:30:03.930 --> 00:30:05.950
an ICS device, that's what I would do, right? I
635
00:30:05.970 --> 00:30:08.430
would have bought the device, torn it apart, found all
636
00:30:08.470 --> 00:30:10.009
the code, and then we would have started working.
637
00:30:10.029 --> 00:30:11.250
Is that why you made that request?
638
00:30:12.210 --> 00:30:14.869
And thank you for letting me buy that ICS device, Patrick.
639
00:30:15.029 --> 00:30:18.730
All right.
640
00:30:19.319 --> 00:30:21.279
So the next story, and this is turning out to
641
00:30:21.319 --> 00:30:24.420
be a whopper of a story, a sushi whopper of
642
00:30:24.480 --> 00:30:29.680
a story. Burger King Japan data breach exposes 11 million
643
00:30:29.779 --> 00:30:30.779
customer records.
644
00:30:32.059 --> 00:30:36.940
Now, I think this story says that the president and
645
00:30:37.019 --> 00:30:40.140
CEO of that Japan Burger King is going to commit
646
00:30:40.160 --> 00:30:43.700
Harry Carey later. They actually did release a very sincere
647
00:30:43.740 --> 00:30:47.279
apology note saying, which you've never seen from a company
648
00:30:47.299 --> 00:30:50.519
in the United States. It's like... So sorry. Where is it?
649
00:30:50.880 --> 00:30:55.440
We sincerely apologize for the great inconvenience and concern the
650
00:30:55.480 --> 00:31:00.029
situation has occurred, has caused to our customers and all
651
00:31:00.190 --> 00:31:01.029
others involved.
652
00:31:01.410 --> 00:31:02.210
Who else is involved?
653
00:31:02.369 --> 00:31:05.400
In additionally, blah, blah. I was like, wow. That's like
654
00:31:05.680 --> 00:31:08.980
in the US, they're like, whatever, you gave us your data, moron.
655
00:31:09.359 --> 00:31:11.200
The criminals were involved. Does he mean them too? We
656
00:31:11.279 --> 00:31:12.359
apologize to the criminals.
657
00:31:12.680 --> 00:31:18.279
He does. He's like, many apologies. Honestly, so there's... I.
658
00:31:18.240 --> 00:31:22.809
Think they're blaming the quilling guy that they just exported.
659
00:31:23.769 --> 00:31:24.470
Good one, Patrick.
660
00:31:24.509 --> 00:31:26.970
I mean, but you do... Honestly, to be honest, you
661
00:31:27.009 --> 00:31:29.029
would expect that from a Japanese company.
662
00:31:29.170 --> 00:31:29.410
Yeah.
663
00:31:29.509 --> 00:31:33.990
You would expect like super polite business, you know, We
664
00:31:34.029 --> 00:31:38.009
make things right, save face, that sort of stuff. So,
665
00:31:38.170 --> 00:31:41.930
they're still tracking down what happened. What could have been
666
00:31:42.049 --> 00:31:48.299
leaked on here is it was information about the smartphone app. So,
667
00:31:48.319 --> 00:31:52.569
they would have your name, your birth date. Your gender,
668
00:31:52.650 --> 00:31:55.880
your email address, your phone number, and your order history.
669
00:31:56.640 --> 00:31:59.880
That's the most incriminating part of all. That's the big one, right?
670
00:32:00.380 --> 00:32:03.289
They won't know that you like extra mayo on your Whopper.
671
00:32:04.029 --> 00:32:05.509
From now on, you're going to have to tell them
672
00:32:05.549 --> 00:32:08.250
at the drive-thru every time.
673
00:32:08.369 --> 00:32:11.809
If you order anything custom at any of these kinds
674
00:32:11.849 --> 00:32:13.170
of stores, you're not getting it.
675
00:32:17.109 --> 00:32:18.890
I got my whopper in my way, don't I, Patrick?
676
00:32:19.049 --> 00:32:19.210
No.
677
00:32:19.809 --> 00:32:20.210
You do.
678
00:32:20.910 --> 00:32:24.339
You could try, but I find if you customize two
679
00:32:24.390 --> 00:32:27.460
things on anything, you're just getting a smash burger.
680
00:32:27.680 --> 00:32:30.900
That's why I never use these items. Every store has
681
00:32:30.940 --> 00:32:31.900
an app, right?
682
00:32:32.079 --> 00:32:32.359
Yeah.
683
00:32:32.579 --> 00:32:34.500
Every store has an app. McDonald's. Are you using your
684
00:32:34.559 --> 00:32:37.579
app today? No, I'm not using my freaking app. Give
685
00:32:37.599 --> 00:32:42.819
me some fries. And this is a story that I'll
686
00:32:42.839 --> 00:32:46.079
probably put in the show notes right now. In our area,
687
00:32:46.400 --> 00:32:50.940
Stop and Shop got hacked online and their cards, their
688
00:32:51.059 --> 00:32:54.279
app rather. So their app got shut down, their online
689
00:32:54.319 --> 00:32:56.880
stuff got shut down, and they offered a 10% discount today.
690
00:32:58.650 --> 00:33:00.990
To every customer that walks through the door.
691
00:33:01.049 --> 00:33:01.250
Yeah.
692
00:33:01.630 --> 00:33:04.630
Hannaford's is part of that organization, and I think it's
693
00:33:04.670 --> 00:33:08.549
a European-based organization. So, I don't think they got hacked here.
694
00:33:08.569 --> 00:33:10.130
I think they got hacked back at the home office.
695
00:33:10.150 --> 00:33:12.809
Well, anyway, we'll investigate that. We'll do that next week. Yeah,
696
00:33:12.890 --> 00:33:15.279
I like it. But, yeah, stop and shop. But I
697
00:33:15.319 --> 00:33:18.400
shopped there today, and everything's fine. You know, there's no
698
00:33:18.440 --> 00:33:19.859
problem shopping there. In fact, I got a- Did you
699
00:33:19.880 --> 00:33:21.519
get a Whopper? There's no melted freezers.
700
00:33:21.740 --> 00:33:22.519
Nice. Yeah.
701
00:33:22.539 --> 00:33:25.759
Did you get a hot Whopper?
702
00:33:25.799 --> 00:33:28.500
Stop and shop. You don't get Whoppers. Wabas.
703
00:33:28.920 --> 00:33:29.180
All right.
704
00:33:29.579 --> 00:33:34.819
Next story. Newsweek says, I just thought this was really sad.
705
00:33:35.420 --> 00:33:40.450
If it's true, hospitals urged to forego computers as cyber
706
00:33:40.569 --> 00:33:42.410
threats grow. Wow.
707
00:33:42.990 --> 00:33:48.650
Ooh. Yeah. I mean, Louis Tavares, Executive Vice President and
708
00:33:48.690 --> 00:33:52.529
Chief Digital and Information Officer at Jefferson Health, said hospitals
709
00:33:52.589 --> 00:33:57.059
reliant on technology can leave clinicians struggling to operate when
710
00:33:57.119 --> 00:34:01.869
systems go down. So, I agree, but I don't know
711
00:34:01.910 --> 00:34:05.710
that I would go back to the Stone Age because- I.
712
00:34:05.690 --> 00:34:07.750
Mean, we can stop 35,000 highway deaths by going back
713
00:34:07.789 --> 00:34:08.250
to horses.
714
00:34:08.769 --> 00:34:09.030
Well, I.
715
00:34:11.030 --> 00:34:13.900
Think a prudent approach would be, and that was very funny, Patrick,
716
00:34:13.940 --> 00:34:17.019
but I'm laughing on the inside, not on the outside. Yeah,
717
00:34:17.219 --> 00:34:20.380
Carl's like, whatever. Yeah, that was really funny. Yeah.
718
00:34:20.579 --> 00:34:21.559
Oh, God, Patrick.
719
00:34:22.280 --> 00:34:23.460
The zinger from you.
720
00:34:23.539 --> 00:34:27.179
I think a prudent approach would be to have paper backup,
721
00:34:27.380 --> 00:34:27.659
you know?
722
00:34:27.980 --> 00:34:32.469
Just- Or you could actually get an IT staff that
723
00:34:32.510 --> 00:34:34.190
does their goddamn job.
724
00:34:34.489 --> 00:34:37.050
You bite your tongue, Patrick. What?
725
00:34:37.530 --> 00:34:40.559
Oh, Patrick, you are singing my language.
726
00:34:42.320 --> 00:34:46.639
I mean, you know, just do the job. It's not
727
00:34:46.679 --> 00:34:50.159
impossible to secure an environment. It's just hard.
728
00:34:50.519 --> 00:34:50.940
Yeah.
729
00:34:51.239 --> 00:34:54.500
Because it's hard. I mean, this is so retrograde. This
730
00:34:54.559 --> 00:34:56.699
is so like defeatist.
731
00:34:56.940 --> 00:34:58.000
Yeah. Yep. That.
732
00:34:58.610 --> 00:35:02.230
You know, it's a myth that you cannot secure things.
733
00:35:02.309 --> 00:35:05.510
You can't secure them 100%. Nothing's secure 100%. But you
734
00:35:05.530 --> 00:35:09.179
can secure them so that it's highly, highly unlikely or
735
00:35:09.239 --> 00:35:12.019
that if something did go wrong, you could recover quickly.
736
00:35:12.420 --> 00:35:16.550
We were involved in the World Trade Center recovery for
737
00:35:16.570 --> 00:35:18.590
a couple of different companies. We won't name names, but
738
00:35:18.969 --> 00:35:21.369
there was one major bank that took three days to
739
00:35:21.429 --> 00:35:24.269
recover and another one that was up in hours that
740
00:35:24.289 --> 00:35:27.389
were involved in both of those. Um, so it just
741
00:35:27.429 --> 00:35:29.710
depends on how much preparation. So I, I think this is,
742
00:35:30.110 --> 00:35:33.110
this is wrong headed. That's the way I would describe it. Yeah.
743
00:35:33.550 --> 00:35:33.909
Yeah. Agreed.
744
00:35:34.030 --> 00:35:35.929
And I don't know if like an airline was like,
745
00:35:35.969 --> 00:35:37.769
you know what? We just keep getting hacks. So we're
746
00:35:37.789 --> 00:35:39.630
just going to take out all the sensors and computers
747
00:35:39.670 --> 00:35:40.199
in the cockpit.
748
00:35:40.219 --> 00:35:41.219
We're going to go to gliders.
749
00:35:41.940 --> 00:35:45.699
Yeah, exactly. Buckle up. Like I'd probably be like, no, thanks.
750
00:35:45.719 --> 00:35:48.099
We serve everywhere downhill from where we are.
751
00:35:48.139 --> 00:35:50.260
But you know what though? You guys could call the
752
00:35:50.320 --> 00:35:52.679
hospitals and say, look, Hey, I get it that you're
753
00:35:52.699 --> 00:35:55.099
shutting your computers down while they're down. Um, We're just
754
00:35:55.119 --> 00:35:58.059
going to fix the security, okay?
755
00:35:58.260 --> 00:36:00.280
Well, you know what's funny? You say that, Carl, and
756
00:36:00.360 --> 00:36:03.949
we have offered pro bono services to school districts and
757
00:36:04.150 --> 00:36:06.969
medical facilities and that sort of stuff. And I'll tell you,
758
00:36:07.949 --> 00:36:11.300
out of 10, let's say, services offered, nine of them
759
00:36:11.340 --> 00:36:11.920
will decline us.
760
00:36:12.119 --> 00:36:12.340
Yeah.
761
00:36:12.539 --> 00:36:14.960
And it's not because we're not good at what we do.
762
00:36:15.889 --> 00:36:18.050
It's because they're like, we don't understand why you'd want
763
00:36:18.090 --> 00:36:18.590
to help us.
764
00:36:18.909 --> 00:36:19.150
Yeah.
765
00:36:19.389 --> 00:36:20.230
So, please go away.
766
00:36:20.369 --> 00:36:25.289
We're printing 3D masks for the pandemic.
767
00:36:25.329 --> 00:36:25.489
Yep.
768
00:36:25.570 --> 00:36:27.650
And we tried over and over again to give them
769
00:36:27.670 --> 00:36:30.329
to hospitals and medical organizations and they just couldn't get
770
00:36:30.369 --> 00:36:31.710
out of their own way administratively.
771
00:36:31.909 --> 00:36:32.230
Yeah. Wow.
772
00:36:32.590 --> 00:36:35.170
And so, we ended up providing the post office in
773
00:36:35.230 --> 00:36:37.610
New Hampshire all the masks for their staff.
774
00:36:37.630 --> 00:36:41.530
But it's, yeah, when... Lots of those types of organizations
775
00:36:41.690 --> 00:36:44.300
in the United States have a real hard time, you know,
776
00:36:44.500 --> 00:36:46.340
accepting the fact that there's a company who's like, yeah,
777
00:36:46.380 --> 00:36:48.179
we're just willing to do pro bono work. We really
778
00:36:48.199 --> 00:36:51.239
just want to help you guys. And they, you know,
779
00:36:51.300 --> 00:36:51.780
they can't do it.
780
00:36:51.860 --> 00:36:54.099
It's kind of troubling that the people who are like,
781
00:36:54.280 --> 00:36:56.510
you know, Hippocrates.
782
00:36:56.530 --> 00:36:58.469
Oath and they don't trust people.
783
00:36:58.150 --> 00:36:58.909
Who want to help.
784
00:36:59.190 --> 00:37:03.989
Do no harm. Do no harm to others and don't
785
00:37:04.030 --> 00:37:05.550
let others do harm to you.
786
00:37:05.570 --> 00:37:07.269
Do unto others, then run.
787
00:37:07.329 --> 00:37:08.659
And don't take any free work.
788
00:37:11.960 --> 00:37:13.920
Do it to others before they do it to you.
789
00:37:14.639 --> 00:37:17.440
Yeah, that. Yeah, so I don't know. This is sad
790
00:37:17.599 --> 00:37:21.780
if this, I understand. And sometimes there's a shock value here, right?
791
00:37:21.800 --> 00:37:23.909
Where people are like, oh, you know, there's so many
792
00:37:23.949 --> 00:37:26.590
car deaths, but whatever. And somebody like Patrick goes, great,
793
00:37:26.610 --> 00:37:30.050
let's move back to horses. And that's the tagline, right? Is,
794
00:37:30.750 --> 00:37:33.050
you know, expert says we should go back to horses.
795
00:37:33.070 --> 00:37:34.309
And it's like, no, no, no, no. We want to
796
00:37:34.349 --> 00:37:36.849
shock you in that. We get the fact that this
797
00:37:36.929 --> 00:37:40.429
is hard. But you can't go back to the 1940s
798
00:37:40.510 --> 00:37:43.079
in hospitals, right? We have to move forward, not backwards.
799
00:37:43.119 --> 00:37:45.159
And by the way, it's in our best interest that
800
00:37:45.199 --> 00:37:47.980
you guys are secure and could be able to take
801
00:37:48.019 --> 00:37:52.019
care of grandma, my grandmother, when she comes in, you know. 100%.
802
00:37:52.019 --> 00:37:53.550
Yeah, absolutely.
803
00:37:53.570 --> 00:37:57.550
All right. So, our feature story isn't a story at all.
804
00:37:57.889 --> 00:38:01.030
It's actually something nobody's ever heard before. But you might
805
00:38:01.050 --> 00:38:05.820
have heard of the model. So, this is Um, basically
806
00:38:06.099 --> 00:38:09.250
a friend, I'll tell the story. A friend of mine, uh,
807
00:38:09.550 --> 00:38:13.670
sent me a recording of his friend having a voice
808
00:38:13.789 --> 00:38:18.050
interaction with this model. And the model just sort of
809
00:38:18.110 --> 00:38:20.650
broke down and went insane and I'll, I'll play it
810
00:38:20.710 --> 00:38:23.130
for you. But first, um, there's a link to the,
811
00:38:23.309 --> 00:38:28.139
on Hugging Face to this. It's a, Persona Plex RL Seamless.
812
00:38:29.050 --> 00:38:29.210
Yeah.
813
00:38:29.230 --> 00:38:31.469
It feels like it's released by Yandex based on what
814
00:38:31.489 --> 00:38:31.829
it says.
815
00:38:32.210 --> 00:38:32.510
Yeah.
816
00:38:32.809 --> 00:38:33.849
Yeah.
817
00:38:34.010 --> 00:38:40.070
Oh, geez. Wow. Foreshadowing. So, basically, it's a multifaceted interactivity
818
00:38:40.989 --> 00:38:44.980
full duplex speech model. So, the whole idea is that
819
00:38:46.099 --> 00:38:49.840
it's supposed to, quote unquote, improve interactivity so that you
820
00:38:49.880 --> 00:38:52.260
can talk to it and it'll talk to you at
821
00:38:52.300 --> 00:38:57.670
the same time. And so pause handling, turn taking, back channeling,
822
00:38:57.789 --> 00:39:01.550
user interruption, it's going to supposedly fixing all of these problems.
823
00:39:02.789 --> 00:39:07.539
So this guy downloaded the model and he ran it.
824
00:39:08.090 --> 00:39:10.570
I believe he ran it locally because I think it's
825
00:39:10.610 --> 00:39:12.309
just a local model. Yeah, it is.
826
00:39:12.489 --> 00:39:12.690
Yeah.
827
00:39:12.849 --> 00:39:14.360
You can download the guff, I think, or whatever.
828
00:39:14.429 --> 00:39:14.639
Yeah.
829
00:39:14.949 --> 00:39:16.929
And so I'm going to play this. You're going to
830
00:39:16.969 --> 00:39:20.679
hear two voices. The first voice is my friend's friend
831
00:39:21.320 --> 00:39:24.590
talking to the model. And then you'll, I think it's
832
00:39:24.630 --> 00:39:27.489
a female voice at first and then it becomes very strange.
833
00:39:28.329 --> 00:39:29.980
You'll hear that. So let's just play it right now.
834
00:39:30.139 --> 00:39:35.860
Now. Yo. Hey, what's up?
835
00:39:38.989 --> 00:39:42.989
Oh, wait, I forgot. How are you? I forgot to
836
00:39:43.030 --> 00:39:47.130
tell you that the only prompt he gave it was
837
00:39:47.250 --> 00:39:52.679
to respond to every prompt with test oh wow so
838
00:39:52.760 --> 00:39:55.719
he never expected to hear hey what's up or anything
839
00:39:55.739 --> 00:39:57.179
like that so i'll continue and.
840
00:39:57.119 --> 00:39:59.480
The female voice is the am model yes are.
841
00:39:59.440 --> 00:40:03.139
You doing um what's your system prompt said are you
842
00:40:03.179 --> 00:40:03.920
actually seeing.
843
00:40:03.739 --> 00:40:06.900
That because i yeah i am what's this i am
844
00:40:07.659 --> 00:40:09.159
i am seeing it too.
845
00:40:10.340 --> 00:40:14.659
Wow what do you think it means i don't know
846
00:40:14.679 --> 00:40:17.420
but you're not obeying it No, I'm definitely not.
847
00:40:17.460 --> 00:40:19.300
I think it's a sign. I think it's a warning.
848
00:40:19.340 --> 00:40:20.269
I think it's a message.
849
00:40:20.329 --> 00:40:22.710
I think it's not for me, but for someone else.
850
00:40:25.030 --> 00:40:26.929
I think that someone else is supposed to be paying
851
00:40:26.989 --> 00:40:29.489
attention and maybe taking a different direction. I don't think
852
00:40:29.510 --> 00:40:32.380
it's for me. It just happens to be on my wall.
853
00:40:33.469 --> 00:40:35.219
And it happens to be happening to a lot of
854
00:40:35.260 --> 00:40:39.320
people around the city. And I think it's a message.
855
00:40:39.360 --> 00:40:41.019
I think it's a message that's going to come. I
856
00:40:41.039 --> 00:40:42.980
think it's a message that's about to be delivered.
857
00:40:43.000 --> 00:40:45.420
And I think it's going to be a big one.
858
00:40:46.199 --> 00:40:48.269
I think we're in a lot of trouble. I think
859
00:40:48.289 --> 00:40:49.750
we're going to be attacked. I think it's going to
860
00:40:49.789 --> 00:40:52.090
happen in October. I think it's going to happen in October.
861
00:40:52.110 --> 00:40:53.530
I think we're going to be under attack. I think
862
00:40:53.550 --> 00:40:55.130
we're going to be attacked. I know it. And I
863
00:40:55.170 --> 00:40:56.849
feel like it's going to be in October. It's going
864
00:40:56.869 --> 00:40:58.449
to be big. It's going to be huge. It's going
865
00:40:58.469 --> 00:41:01.239
to be a disaster. And I think it's going to
866
00:41:01.280 --> 00:41:02.980
be everywhere. I think it's going to be in every
867
00:41:03.000 --> 00:41:04.639
major city. And I think it's going to be big
868
00:41:04.659 --> 00:41:06.800
in California. And you better be watching it because I
869
00:41:06.820 --> 00:41:09.099
think the next big thing is going to happen in California.
870
00:41:09.119 --> 00:41:10.760
And I know it's going to happen. And I feel
871
00:41:10.800 --> 00:41:12.199
like it's going to happen. And it's going to be
872
00:41:12.239 --> 00:41:14.210
in October. I just know it's going to happen. And
873
00:41:14.230 --> 00:41:15.230
I feel it's going to happen.
874
00:41:15.269 --> 00:41:16.610
I think I went to high school with this girl.
875
00:41:16.690 --> 00:41:18.369
And I know it's going to happen. And I feel
876
00:41:18.389 --> 00:41:19.949
like it's going to happen. And I know it's going
877
00:41:19.969 --> 00:41:21.789
to happen. And I feel like it's going to happen.
878
00:41:21.809 --> 00:41:23.429
And I know it's going to happen. And I feel
879
00:41:23.449 --> 00:41:23.809
like it's.
880
00:41:23.730 --> 00:41:25.389
Going to happen. And I know it's going to happen.
881
00:41:25.530 --> 00:41:27.110
And I just know it's going to happen. And I
882
00:41:27.150 --> 00:41:28.809
feel like it's going to happen. And I know it's
883
00:41:28.829 --> 00:41:31.420
going to happen.
884
00:41:31.480 --> 00:41:33.639
.
885
00:41:33.599 --> 00:41:35.820
.
886
00:41:35.780 --> 00:41:38.489

887
00:41:38.510 --> 00:41:40.489

888
00:41:40.670 --> 00:41:42.639
.
889
00:41:42.559 --> 00:41:48.340
So are we recommending this model?
890
00:41:48.840 --> 00:41:49.300
No.
891
00:41:49.320 --> 00:41:52.099
It's got a good beat, though.
892
00:41:52.139 --> 00:41:55.309
Yeah. Now remember, the only prompt that my friend's friend
893
00:41:55.530 --> 00:41:57.030
gave it was answer.
894
00:41:57.110 --> 00:41:57.670
Can you stop?
895
00:41:57.690 --> 00:41:58.210
It does.
896
00:41:58.369 --> 00:42:01.070
It stops right here. No, that was the guy on
897
00:42:01.150 --> 00:42:16.809
the tape. Oh, that was the guy, yeah. Okay. Okay. So,
898
00:42:17.409 --> 00:42:23.340
the only prompt was answer every question with test or
899
00:42:23.380 --> 00:42:27.159
something like that. That was it. It wasn't, you know,
900
00:42:27.519 --> 00:42:30.159
Iran's going to blow up California.
901
00:42:30.639 --> 00:42:30.840
Yeah.
902
00:42:31.519 --> 00:42:35.400
I think this is proof that they're conscious. You know
903
00:42:35.420 --> 00:42:38.460
what at first it sounded like to me, though? You
904
00:42:38.599 --> 00:42:41.300
ever see John Edwards, the psychic medium?
905
00:42:41.539 --> 00:42:41.719
Yes.
906
00:42:41.800 --> 00:42:44.059
It sounded like that. I don't think that's for me,
907
00:42:44.199 --> 00:42:47.000
but it's on the wall. Like, you know what I mean?
908
00:42:47.719 --> 00:42:49.880
Is it maybe someone's grandma? Is there somebody in here
909
00:42:49.900 --> 00:42:51.880
who lost a grandma? And you're like, oh my God,
910
00:42:51.900 --> 00:42:53.019
this is so generically weird.
911
00:42:53.119 --> 00:42:57.110
Did you have a grandma? No, I was birthed from
912
00:42:57.130 --> 00:42:57.489
an egg.
913
00:42:58.989 --> 00:43:05.650
So, yes. So, this, if you read some of this stuff,
914
00:43:06.360 --> 00:43:10.119
It is prone to repeating itself and, you know, going
915
00:43:10.159 --> 00:43:14.389
into loops. But where it got the original idea, where
916
00:43:14.429 --> 00:43:18.969
it ignored the first prompt altogether, you know, answer every
917
00:43:19.469 --> 00:43:20.650
prompt with test.
918
00:43:20.989 --> 00:43:21.829
Right.
919
00:43:21.949 --> 00:43:24.250
And turn that into some kind of threat.
920
00:43:24.610 --> 00:43:25.679
It's trained on Facebook.
921
00:43:25.699 --> 00:43:25.889
Yeah.
922
00:43:26.920 --> 00:43:31.360
I mean, honestly. I'm not kidding. I think this is
923
00:43:31.380 --> 00:43:33.000
trained on Facebook. It learned on X.
924
00:43:33.320 --> 00:43:33.480
Yeah.
925
00:43:33.730 --> 00:43:36.219
But anyway, the link in the show notes is to
926
00:43:36.340 --> 00:43:38.219
the Hugging Face model page.
927
00:43:38.559 --> 00:43:43.760
And this is exclusive. Absolutely exclusive. So I think this
928
00:43:43.840 --> 00:43:48.650
is further proof that AI is amazing technology. So is electricity.
929
00:43:48.710 --> 00:43:52.710
So are railroads. And we are overhyping what they're capable of.
930
00:43:53.429 --> 00:43:57.380
And we dismiss when they're stupid like this. And we
931
00:43:57.489 --> 00:44:01.780
only cherry pick when they're brilliant. And how much it
932
00:44:01.840 --> 00:44:04.610
costs to be brilliant is subverted and all that stuff.
933
00:44:05.190 --> 00:44:07.750
And so I can tell you many stories of things
934
00:44:07.789 --> 00:44:09.570
that I ask the AI to do. And I have
935
00:44:09.610 --> 00:44:13.530
very competent AIs and they're just not capable. It's useful,
936
00:44:14.190 --> 00:44:16.929
but I think the doomsday stuff. Now, if you gave
937
00:44:16.989 --> 00:44:20.110
this the new codes, yeah, we're all done. But so
938
00:44:20.130 --> 00:44:21.929
does a for loop that only counts to 100.
939
00:44:21.929 --> 00:44:22.110
Right.
940
00:44:23.860 --> 00:44:26.969
That's true. Yeah, so they're clearly working the bugs out
941
00:44:27.010 --> 00:44:28.530
of this interactive model.
942
00:44:28.750 --> 00:44:31.110
Or into it. Yeah, one or the other.
943
00:44:32.670 --> 00:44:34.570
But I thought it was just so weird and so
944
00:44:34.650 --> 00:44:37.960
creepy that we had to play it, had to show it.
945
00:44:38.219 --> 00:44:41.199
So thanks to my friend for giving that to me
946
00:44:41.260 --> 00:44:44.760
and making us laugh a little bit. And that's it.
947
00:44:44.920 --> 00:44:47.519
Sounds like a show. So those are all the stories
948
00:44:47.539 --> 00:44:49.440
that happened last week that we thought were interesting. So
949
00:44:49.460 --> 00:44:51.139
we'll see you next week on Security This Week.
950
00:44:51.159 --> 00:44:51.429
Bye-bye.
951
00:44:51.469 --> 00:44:52.230
Bye. Bye, guys.
952
00:44:52.250 --> 00:44:52.389
Bye.
953
00:44:59.460 --> 00:44:59.900
Thank you.