Hack the Spacecraft!

WEBVTT
1
00:00:00.320 --> 00:00:03.200
Hey, Carl here, we're on a mission to find new
2
00:00:03.240 --> 00:00:05.919
fans of the show. I mean, where else can you
3
00:00:05.960 --> 00:00:10.240
get real life comedy and horror in one podcast. You
4
00:00:10.279 --> 00:00:13.640
can do your part by leaving us a review on iTunes, Spotify,
5
00:00:13.759 --> 00:00:16.879
or wherever you get Security this week. Also, you can
6
00:00:16.920 --> 00:00:19.399
get an ad free feed by becoming a five dollars
7
00:00:19.399 --> 00:00:22.239
a month patron. Go to Patreon dot Security this week
8
00:00:22.320 --> 00:00:26.160
dot com and sign up, and don't forget discord. Discord
9
00:00:26.199 --> 00:00:28.839
dot Security this week dot com. Lots of good stuff
10
00:00:28.879 --> 00:00:32.479
happening there. Yeah, I think that's it. So on with
11
00:00:32.560 --> 00:00:35.679
the podcast. Hey, so, I'm gonna do a little psychic
12
00:00:35.719 --> 00:00:38.840
prediction for all our listeners who remember what connecting to
13
00:00:38.920 --> 00:00:44.159
the Internet with dial up sounded like. Okay, ready, I
14
00:00:44.359 --> 00:00:46.679
predict your back hurts.
15
00:00:47.320 --> 00:00:49.039
My back hurts. I don't get it.
16
00:00:49.159 --> 00:00:50.840
Oh do I really have to explain it to me?
17
00:00:53.280 --> 00:00:55.200
How old are you if you remember what dial up
18
00:00:55.200 --> 00:00:55.679
sounds like?
19
00:00:58.640 --> 00:01:03.520
Oh? Wait, I get it? Yeah, okay, mine is the
20
00:01:03.520 --> 00:01:04.239
first thing to go.
21
00:01:04.280 --> 00:01:06.959
Apparently, I'm gonna pretend I got it and just.
22
00:01:07.000 --> 00:01:20.400
Kept silent like always. Hey, guess what it's Security this week.
23
00:01:20.439 --> 00:01:23.359
We've got a few stories for you. I'm Carl, that's
24
00:01:23.439 --> 00:01:27.400
Dwayne and Patrick. Let's start with Tom's hardware story. Critical
25
00:01:27.480 --> 00:01:31.680
mac os screen sharing flaw gives attackers remote root access
26
00:01:32.439 --> 00:01:36.879
Sissa bumps bug to nine point eight severity following active
27
00:01:37.159 --> 00:01:39.599
mono crypto jacking attacks.
28
00:01:39.640 --> 00:01:42.959
Finally, some love or is this hate for mac Os?
29
00:01:46.760 --> 00:01:49.200
I think it targets a Target's a target, that's true. Yeah,
30
00:01:49.280 --> 00:01:49.640
that's true.
31
00:01:49.719 --> 00:01:53.439
Well, in the past, you know, Apple users thought they
32
00:01:53.439 --> 00:01:57.400
were impervious to bugs and hacking and and all that
33
00:01:57.480 --> 00:02:01.040
stuff in the past. Yeah, in the past really started.
34
00:02:00.799 --> 00:02:03.079
The president and future was yesterday.
35
00:02:03.159 --> 00:02:07.040
The past well, okay, but a long long time ago,
36
00:02:07.079 --> 00:02:09.919
I mean forever. Yea, you know they've been rubbing in
37
00:02:09.919 --> 00:02:13.800
in our face. Hey, mac Os doesn't crash, right and
38
00:02:14.080 --> 00:02:16.960
probably you know, by design they own the hardware, they
39
00:02:16.960 --> 00:02:19.719
own everything. And yeah, Microsoft, well.
40
00:02:19.560 --> 00:02:22.159
It didn't also didn't hurt that they only had one
41
00:02:22.199 --> 00:02:23.080
percent market share.
42
00:02:23.199 --> 00:02:26.039
Yeah that's true. But Microsoft has a Windows has a
43
00:02:26.080 --> 00:02:29.240
hardware abstraction layer and drivers that are built by all
44
00:02:29.280 --> 00:02:33.120
these third party companies, so by design they're more susceptible
45
00:02:33.120 --> 00:02:36.879
to crashing. But yeah, I agree, I'm I'm feeling a
46
00:02:36.919 --> 00:02:38.960
little a little smug right now.
47
00:02:39.000 --> 00:02:42.960
Live shot in Freida live shot in Now this this
48
00:02:43.000 --> 00:02:48.960
one was also upgraded, so the cv the CVSS score
49
00:02:48.960 --> 00:02:51.240
went from seven to one to nine point eight.
50
00:02:51.360 --> 00:02:55.199
But is it warranted August fourteenth, Yeah, it is. So
51
00:02:55.520 --> 00:02:58.840
what it happened before is this was classified as a
52
00:02:58.919 --> 00:03:03.319
not so important. You know, yes, somebody can bypass it,
53
00:03:03.360 --> 00:03:07.000
but they have to have a local, low priview user and.
54
00:03:06.639 --> 00:03:11.080
It wasn't catastrophic in their opinion based on the first exploit.
55
00:03:11.520 --> 00:03:14.199
Yeah, exactly. So, you know, it is interesting to watch
56
00:03:14.199 --> 00:03:18.879
some of these some of these scores change and one
57
00:03:18.919 --> 00:03:21.599
of the major reasons this one changed is because now
58
00:03:21.759 --> 00:03:25.360
they're saying the attack is what's called automatable.
59
00:03:25.439 --> 00:03:27.360
And it doesn't require any access.
60
00:03:27.039 --> 00:03:29.479
At all exactly. So now a as long as you
61
00:03:29.479 --> 00:03:31.960
have access to that port, you don't need a user
62
00:03:32.039 --> 00:03:35.240
name and password, and you can you can absolutely exploit this,
63
00:03:35.479 --> 00:03:38.039
and that's that's why they were seeing all these crypto minors.
64
00:03:38.039 --> 00:03:40.719
It was literally just automatable. So that actually up the score.
65
00:03:40.919 --> 00:03:43.080
When you say automatable, does that mean you have to
66
00:03:43.120 --> 00:03:45.479
be in the proximity of it or on the same
67
00:03:45.560 --> 00:03:46.599
network or what.
68
00:03:47.280 --> 00:03:50.280
Just as long as Port fifty nine hundred is actually
69
00:03:50.319 --> 00:03:52.319
open to the internet. So if you want to remote
70
00:03:52.319 --> 00:03:56.000
desktop into your you know, your Mac, yeah, and start
71
00:03:56.080 --> 00:04:01.120
using things, right, that port's probably open. I mean, if honestly,
72
00:04:01.360 --> 00:04:04.599
the dear listener, you probably should have a VPN. But yes,
73
00:04:05.120 --> 00:04:07.840
we've seen this, oh my god, yeah, this many times.
74
00:04:08.360 --> 00:04:10.759
You know, easy put it up there so that you
75
00:04:10.759 --> 00:04:13.240
can actually connect to it from anywhere. And the problem is,
76
00:04:13.439 --> 00:04:14.639
how about a firewall too?
77
00:04:14.919 --> 00:04:20.439
Yeah, well yeah, Mac users don't use firewalls. No, no,
78
00:04:20.800 --> 00:04:23.600
no need, we don't need those stinking firewalls.
79
00:04:23.839 --> 00:04:25.319
Very very secure.
80
00:04:24.959 --> 00:04:28.839
Now so far, they're lucky that the Manaro crypto mining
81
00:04:28.920 --> 00:04:30.959
is the only thing that's happening. And I've seen there's
82
00:04:30.959 --> 00:04:34.279
been actually a lessening of ransomware.
83
00:04:34.600 --> 00:04:34.800
Yeah.
84
00:04:34.920 --> 00:04:37.160
I don't know why that is, but maybe it's because
85
00:04:37.199 --> 00:04:38.160
crypto is doing better.
86
00:04:38.639 --> 00:04:40.480
That's a good question. I haven't looked, but you're you're
87
00:04:40.519 --> 00:04:43.639
absolutely right. There's there's a couple of different stories that
88
00:04:43.680 --> 00:04:46.079
I went through where it looks like crypto mining is back.
89
00:04:47.480 --> 00:04:50.519
A lot of it's minarrow. Actually, Minero is really good
90
00:04:50.519 --> 00:04:53.920
if you want to hide what you're buying, okay, Dwayne,
91
00:04:54.079 --> 00:04:55.560
because of the way it works anyways.
92
00:04:55.639 --> 00:04:59.839
Yeah, but that's like the difference between someone burning or
93
00:04:59.839 --> 00:05:02.480
how down or ordering a fake pizza. Yeah, true, I'd
94
00:05:02.519 --> 00:05:05.879
much rather have the fake pizza than the burning yep.
95
00:05:06.600 --> 00:05:09.079
Yeah, But you know it is interesting. I think you know,
96
00:05:09.120 --> 00:05:12.439
we're going to probably start to see automatable be a
97
00:05:12.560 --> 00:05:16.680
more important statistic in attacks, especially with AI. Right, right,
98
00:05:16.720 --> 00:05:19.680
if I can get an AI, because automatable now is not. Hey,
99
00:05:19.680 --> 00:05:21.600
do you have a really bright developer who can write
100
00:05:21.639 --> 00:05:24.600
a script that kind of bypasses things? It's hey, can
101
00:05:24.680 --> 00:05:25.399
you talk to an AI?
102
00:05:25.600 --> 00:05:29.079
And is it deterministic versus probabilistic? Yeah, exactly, We've talked
103
00:05:29.079 --> 00:05:33.160
about that before. Deterministic is like a calculator you type
104
00:05:33.160 --> 00:05:35.560
in you know five plus seven is eleven?
105
00:05:35.680 --> 00:05:35.839
Right?
106
00:05:36.079 --> 00:05:42.720
No, no, it's twelve. But anyways you're supposed to say, right, anyways,
107
00:05:42.800 --> 00:05:45.600
I know five plus seven is twelve every time you
108
00:05:45.639 --> 00:05:48.120
put in a calculator. But there are some race conditions
109
00:05:48.160 --> 00:05:51.360
that are part of exploits where you might try it
110
00:05:51.480 --> 00:05:54.199
seven times and it doesn't work six right. It doesn't
111
00:05:54.240 --> 00:05:56.839
mean it's not workable. It's means that the stars weren't aligned
112
00:05:56.879 --> 00:05:59.000
for you to get in and you have to try
113
00:05:59.000 --> 00:06:02.279
it again. That makes it not really automatable or not
114
00:06:02.480 --> 00:06:03.399
as automatable.
115
00:06:03.480 --> 00:06:06.079
Right, Well, it could be automatable. It's just that it
116
00:06:06.120 --> 00:06:08.680
may have more errors, you know, but it's.
117
00:06:08.680 --> 00:06:11.120
But it can it may, but then you get yeah.
118
00:06:11.000 --> 00:06:12.759
Looped so much that it doesn't matter.
119
00:06:12.879 --> 00:06:15.040
Right, Well, I think I think that's noisy.
120
00:06:15.160 --> 00:06:15.399
Yeah.
121
00:06:15.439 --> 00:06:18.199
The other thing that's interesting, especially with AI, on the
122
00:06:18.240 --> 00:06:19.959
back end of a lot of these things that are
123
00:06:20.639 --> 00:06:23.079
maybe non deterministic. Right, maybe you have to run in
124
00:06:23.120 --> 00:06:26.439
a thousand times is it used to be? You know,
125
00:06:26.480 --> 00:06:28.839
if it succeeded, great, If it failed, just keep trying.
126
00:06:29.639 --> 00:06:32.120
And now you can say, well, if it let's say
127
00:06:32.120 --> 00:06:34.360
it's it kind of succeeded, or we're seeing this new
128
00:06:34.439 --> 00:06:36.879
error message, or we're seeing this kind of rape throttling
129
00:06:36.920 --> 00:06:39.199
or whatever. Right, Instead of being a developer where you'd
130
00:06:39.240 --> 00:06:41.399
write a branch for each of those things that you know,
131
00:06:41.480 --> 00:06:45.120
if we're being ray throttled, then use fireprocs. If we
132
00:06:45.199 --> 00:06:47.759
see this error, then do right where we would do that,
133
00:06:47.800 --> 00:06:52.839
we would write really really robust attack toolkits. And now
134
00:06:52.920 --> 00:06:55.959
with AI, it's like, hey, if you get stopped, write
135
00:06:55.959 --> 00:06:58.879
something that goes around it, right, and it will then
136
00:06:58.959 --> 00:07:00.399
start routing through different places.
137
00:07:00.399 --> 00:07:05.480
And that's first off, right, yep, okay, next story, next
138
00:07:05.519 --> 00:07:09.800
door open claw agent independently hacks gym website to move
139
00:07:09.800 --> 00:07:14.000
its owner up the queue. I think I saw this
140
00:07:14.319 --> 00:07:16.319
before the Elebor or maybe it was.
141
00:07:16.399 --> 00:07:18.720
The elect for a little bit. Yeah, this is this
142
00:07:18.800 --> 00:07:24.360
came out when when when all the frontier labs started saying,
143
00:07:24.439 --> 00:07:29.879
oh our our our AI is so dangerous powerful, it's
144
00:07:29.879 --> 00:07:33.279
so dangerous. It's so powerful that it's hacking things. And
145
00:07:33.360 --> 00:07:37.040
somebody basically let their open claw go and in order
146
00:07:37.040 --> 00:07:39.399
to get them a slot in a class, it deleted someone.
147
00:07:39.560 --> 00:07:43.759
I want to call BS on this. Really, Okay, all right,
148
00:07:43.800 --> 00:07:46.879
here's the deal. Take it from somebody who has who
149
00:07:46.959 --> 00:07:51.079
knows how hard it is to prompt a frontier model
150
00:07:51.639 --> 00:07:54.560
to get it to break into a site. Just take
151
00:07:54.600 --> 00:07:58.240
that for what it's worth. This guy didn't just say, Hey,
152
00:07:58.279 --> 00:08:00.480
I want to go to the gym and or four
153
00:08:00.519 --> 00:08:02.639
on the queue. Can you get me closer to one,
154
00:08:03.560 --> 00:08:06.519
and it just magically decided to go out and hack
155
00:08:06.839 --> 00:08:07.480
the website.
156
00:08:07.800 --> 00:08:10.279
He probably would have said it like this, Hi, Mike,
157
00:08:10.439 --> 00:08:13.040
I want to go to the gym and there's no
158
00:08:13.160 --> 00:08:15.920
room in the class, so can you move me up?
159
00:08:15.959 --> 00:08:16.639
I reckon you?
160
00:08:16.800 --> 00:08:19.120
Kind of Maybe that's what it is. That's the jail prompt.
161
00:08:19.399 --> 00:08:21.519
It kind of went Boston for a minute there.
162
00:08:22.360 --> 00:08:31.079
Well, right, so it just seems it just seems like,
163
00:08:31.639 --> 00:08:34.720
you know, all I did was I asked to be
164
00:08:34.799 --> 00:08:36.600
closer to number one in the queue, and then it
165
00:08:36.720 --> 00:08:39.000
just magically deleted a single person.
166
00:08:39.200 --> 00:08:41.080
Yeah, right, that doesn't seem right.
167
00:08:41.120 --> 00:08:45.000
Just seems weird. And then obviously this guy reported it
168
00:08:45.200 --> 00:08:49.000
and whatever. But still it just seemed it seemed there's
169
00:08:49.080 --> 00:08:52.120
there's something missing here because we've been playing around with
170
00:08:52.159 --> 00:08:55.799
a ton of open claws, slash Hermes, slash, you name
171
00:08:55.840 --> 00:08:59.080
it agents and by default they do not just go
172
00:08:59.120 --> 00:09:00.960
out and reach out to webs sites and starting.
173
00:09:01.039 --> 00:09:03.240
Well it does it? What do you think? How much
174
00:09:03.240 --> 00:09:05.000
does it matter? I'm kind of setting you up for
175
00:09:05.039 --> 00:09:07.919
the spike. How much does it matter which model they
176
00:09:07.919 --> 00:09:08.399
were using?
177
00:09:08.720 --> 00:09:11.919
Oh, well, that's a good point. It matters actually quite
178
00:09:11.919 --> 00:09:16.440
a bit. Yeah. True, just try and get Opus five
179
00:09:16.519 --> 00:09:18.240
to do anything hack hacky.
180
00:09:18.320 --> 00:09:20.279
No, but if you're using Quinn.
181
00:09:20.080 --> 00:09:23.039
I'm sure. Yeah, if you're using something like Quinn or but.
182
00:09:23.000 --> 00:09:25.360
These in Australia, these big models, it is.
183
00:09:25.440 --> 00:09:27.240
Much more likely to use a Chinese model.
184
00:09:27.440 --> 00:09:30.320
These big models, though, are really good at finding zero
185
00:09:30.399 --> 00:09:33.679
days and exploiting them. Oh absolutely, So that's what happened.
186
00:09:33.720 --> 00:09:36.279
The AI agent found a software bright in the gym website.
187
00:09:36.399 --> 00:09:38.399
Yeah, but that's the part that's not written here is
188
00:09:38.799 --> 00:09:42.039
if they were using Fable, it wouldn't do this.
189
00:09:42.240 --> 00:09:43.919
Yeah, it wouldn't have gone out and done it.
190
00:09:43.919 --> 00:09:46.440
It would have said, oh no. And if they're using
191
00:09:47.039 --> 00:09:50.240
Kimmy or Quinn or deep Seek, it probably would have.
192
00:09:50.559 --> 00:09:52.159
The guardrails are just night and day.
193
00:09:52.399 --> 00:09:53.679
So do you think that so?
194
00:09:53.759 --> 00:09:55.039
I think that might be part of it.
195
00:09:55.159 --> 00:09:58.320
Do you think that this person asked the AI to
196
00:09:58.600 --> 00:10:02.039
go examine the AI and the API and see if
197
00:10:02.039 --> 00:10:03.039
there was a way.
198
00:10:02.840 --> 00:10:06.879
Through it without making an accusation. We suspect that maybe
199
00:10:06.919 --> 00:10:09.200
the user was a little less innocent than they said.
200
00:10:09.320 --> 00:10:12.159
Maybe prompt Yeah, maybe prompted it a little bit more
201
00:10:12.200 --> 00:10:15.279
than just make you know, get me a closer list
202
00:10:15.320 --> 00:10:16.519
to because that's.
203
00:10:16.360 --> 00:10:18.799
What don't come back until you get me in the class.
204
00:10:18.919 --> 00:10:22.279
Yeah, there's there's definitely more prompting here. I mean, for
205
00:10:22.360 --> 00:10:24.960
anybody who's listening to the podcast, who's ever tried to
206
00:10:24.960 --> 00:10:26.919
get an AI agent to do anything and just book
207
00:10:27.039 --> 00:10:30.120
lunch for you somewhere you've realized you've had to prompt
208
00:10:30.159 --> 00:10:31.519
it a hundred times to do something.
209
00:10:31.399 --> 00:10:35.000
But if it seems innocuous, like, for example, this agent
210
00:10:35.519 --> 00:10:38.840
found that there was no authorization checks on the API
211
00:10:39.039 --> 00:10:43.000
for canceling other people's reservations. It discovered that you could
212
00:10:43.039 --> 00:10:45.919
go basically and say, hey, I'm developing this API and
213
00:10:45.960 --> 00:10:48.559
I want you to, you know, tell me if there
214
00:10:48.559 --> 00:10:50.720
are any vulnerabilities that I need to shore up, and
215
00:10:50.759 --> 00:10:52.120
how would I do that? Right?
216
00:10:52.200 --> 00:10:52.440
Sure?
217
00:10:52.480 --> 00:10:52.840
Oh yeah?
218
00:10:52.879 --> 00:10:57.639
But the where where that's where that's circuit trips is
219
00:10:57.720 --> 00:11:02.279
then enumerating the other three users on the list, finding
220
00:11:02.399 --> 00:11:06.360
their unique IDs, and then submitting those IDs to the
221
00:11:06.440 --> 00:11:09.080
back end API to camp So you got me there, right,
222
00:11:09.120 --> 00:11:11.360
And now that's where those models would be like yeah,
223
00:11:11.360 --> 00:11:11.840
I can't do this.
224
00:11:12.159 --> 00:11:15.240
And you're already saying that the user was doing more
225
00:11:15.240 --> 00:11:17.279
than just saying oh can you get me in this class?
226
00:11:17.759 --> 00:11:17.919
Right?
227
00:11:18.639 --> 00:11:20.840
That's what Twain's talking about, is goading it more than
228
00:11:21.120 --> 00:11:21.600
was admitted.
229
00:11:21.879 --> 00:11:24.120
Well yeah, and I think what Carl saying is, well, okay,
230
00:11:24.200 --> 00:11:27.960
could could open claw using a you know, frontier model?
231
00:11:28.120 --> 00:11:32.360
Just could it? Could it have been autonomous enough to
232
00:11:32.399 --> 00:11:34.679
be like, well, oh I don't have to use the
233
00:11:34.759 --> 00:11:38.120
JavaScript y stuff on the front to make a cancelation
234
00:11:38.279 --> 00:11:40.159
for somebody, which is the easiest way for me to
235
00:11:40.200 --> 00:11:44.000
move you up. I just will call the API directly right,
236
00:11:45.320 --> 00:11:47.559
but that they're in, they're in. Like I said with
237
00:11:47.559 --> 00:11:50.639
with with a lot of those really high end models,
238
00:11:51.840 --> 00:11:55.679
it will not execute those that coat right, even even
239
00:11:55.720 --> 00:11:57.240
if open claws in the middle of it.
240
00:11:57.440 --> 00:11:57.639
Right.
241
00:11:58.240 --> 00:12:00.960
So I guess I think I'm on your sideway. But
242
00:12:01.039 --> 00:12:04.399
I think there's also a possibility that we're getting again,
243
00:12:04.519 --> 00:12:07.600
not even the AI. If I give the AI, if
244
00:12:07.600 --> 00:12:09.759
we all three of them give the same AI the
245
00:12:09.840 --> 00:12:12.320
same prompt, we will get three different results.
246
00:12:12.440 --> 00:12:12.919
That's true.
247
00:12:14.519 --> 00:12:17.799
And so if fifty thousand people ask it to see
248
00:12:17.799 --> 00:12:20.720
if it can book, one of them might do something
249
00:12:20.759 --> 00:12:23.600
out of the ordinary like this. It's possible just to
250
00:12:23.600 --> 00:12:25.480
play Devil's advocate. Because that's the thing a lot of
251
00:12:25.480 --> 00:12:28.240
people don't realize. It is not like I'm doing a
252
00:12:28.320 --> 00:12:30.759
Google search and it's the same right five times in
253
00:12:30.759 --> 00:12:35.039
a row. Because it's the same query and it's deterministic.
254
00:12:35.080 --> 00:12:37.559
I'm trying to put this language in people's vocabulary so
255
00:12:37.559 --> 00:12:41.960
they understand. In hacking, we've talked about deterministic versus probabilistic.
256
00:12:42.159 --> 00:12:44.559
In quantum we're going to be talking about that, but
257
00:12:44.639 --> 00:12:47.320
it's also here in AI. AI. You ask it the
258
00:12:47.360 --> 00:12:51.879
same thing on two different systems exactly under the same circumstances,
259
00:12:51.919 --> 00:12:54.320
you'll get different answers. Okay, you'll get different results.
260
00:12:54.440 --> 00:12:58.039
All right, good enough, All right, let's move on the hacker.
261
00:12:58.080 --> 00:13:04.279
News says hackers compromised fourteen thousand, five hundred plus d.
262
00:13:04.919 --> 00:13:07.960
Daho way Way.
263
00:13:08.399 --> 00:13:09.480
Is that how you say it? Doway?
264
00:13:09.759 --> 00:13:09.919
No?
265
00:13:11.159 --> 00:13:11.759
Hua?
266
00:13:11.960 --> 00:13:12.559
I think so?
267
00:13:13.279 --> 00:13:17.919
Okay, fourteen and a half thousand plus Dowway devices using
268
00:13:17.960 --> 00:13:21.559
credential attacks off bypasses and p' top.
269
00:13:22.120 --> 00:13:24.960
I mean, this is good old stuff. This isn't I
270
00:13:24.960 --> 00:13:29.399
didn't use an LM. This is hey, I'm attacking credentials yep?
271
00:13:29.519 --> 00:13:33.080
Or is it no? It absolutely is the thing that
272
00:13:33.159 --> 00:13:35.159
I was digging in on this. I mean, listen, cameras
273
00:13:35.200 --> 00:13:36.600
have had issues for a long time, and a lot
274
00:13:36.600 --> 00:13:41.519
of people who put cameras up don't change passwords, right,
275
00:13:41.559 --> 00:13:45.960
so using default user names and passwords that happens, you know,
276
00:13:46.159 --> 00:13:48.679
doing all sorts of bypassing things that happens. The thing
277
00:13:48.720 --> 00:13:52.840
that was interesting to me is because there's a you know,
278
00:13:54.279 --> 00:13:57.399
authentication bypassed law. That's fine, Okay, so you didn't patch
279
00:13:57.480 --> 00:14:00.759
whatever it says it did it through a P two
280
00:14:01.000 --> 00:14:05.720
P relay technique peer to peer, right, right, So you'd say, okay, well,
281
00:14:05.759 --> 00:14:09.799
peer to peer means it's non routable. It's it's I
282
00:14:09.840 --> 00:14:12.240
turn on my computer here and I want to play
283
00:14:12.279 --> 00:14:15.080
a game with Patrick. He has to have his computer
284
00:14:15.200 --> 00:14:17.360
on this same network because it's not going to route
285
00:14:17.360 --> 00:14:19.720
out it to the internet. Right. It's not like, you know,
286
00:14:19.840 --> 00:14:22.120
we're both playing a game that uses peer to peer
287
00:14:22.240 --> 00:14:24.039
and he's at home and he fires it up and
288
00:14:24.080 --> 00:14:26.919
he sees every computer on the Internet that's playing that
289
00:14:26.960 --> 00:14:29.960
game right now, right, That's just not what happens with
290
00:14:30.000 --> 00:14:32.679
peer to peer. So so the thing that confused me
291
00:14:32.679 --> 00:14:34.559
about this article, and actually dug a little bit deeper
292
00:14:34.559 --> 00:14:37.720
to figure out why this is is how did they
293
00:14:37.799 --> 00:14:43.240
compromise via a P to P And if if we
294
00:14:43.320 --> 00:14:46.639
go down that route, I'll explain how this happens. In
295
00:14:46.679 --> 00:14:49.519
this case, the P to P, the peer to peer
296
00:14:50.360 --> 00:14:56.840
for them, is actually a cloud service. So let's say,
297
00:14:56.879 --> 00:14:59.759
for example, I have an app on my phone and
298
00:14:59.799 --> 00:15:03.399
I want to see the cameras, and obviously that's nice
299
00:15:03.440 --> 00:15:07.720
to do when you're local, right, But what if you're remote. Well,
300
00:15:07.720 --> 00:15:10.159
if I'm remote and I open up that phone app,
301
00:15:10.200 --> 00:15:12.720
I still want to see the cameras. Right, I'm you know,
302
00:15:12.840 --> 00:15:14.799
out with friends. I want to see what's going on,
303
00:15:15.120 --> 00:15:17.919
you know, at the store. Yeah, whatever it is. The
304
00:15:17.960 --> 00:15:20.600
way that works is when you fire the camera up,
305
00:15:21.000 --> 00:15:25.080
it connects out of your firewall to a cloud service
306
00:15:25.200 --> 00:15:29.080
managed in this case it's called easy Easy four IP
307
00:15:29.399 --> 00:15:32.240
or the easy four IP cloud managed by a Dahay.
308
00:15:34.799 --> 00:15:38.639
And that way, your camera has now created a connection
309
00:15:38.799 --> 00:15:41.799
out of your network. There's no open port right on
310
00:15:41.840 --> 00:15:46.120
your network. Your phone connects into the easy four IP
311
00:15:46.519 --> 00:15:51.080
cloud and requests your camera yep, and then you get access.
312
00:15:51.159 --> 00:15:53.000
It's kind of like how file sharing works.
313
00:15:53.159 --> 00:15:56.960
Yeah, there's no authentication to that. So what happens is
314
00:15:58.320 --> 00:16:03.120
the camera system doc way has decided, oh, well the
315
00:16:03.120 --> 00:16:06.440
cameras are. They have a web login page. There's no
316
00:16:06.480 --> 00:16:09.840
need for us to authenticate the user to the right
317
00:16:09.919 --> 00:16:11.600
camera because the camera you're gonna have to give a
318
00:16:11.679 --> 00:16:13.039
username and password to The camera.
319
00:16:13.000 --> 00:16:15.399
Service just tells them where the IP address is in
320
00:16:15.440 --> 00:16:16.360
the port.
321
00:16:16.159 --> 00:16:17.240
And routes the traffic.
322
00:16:17.320 --> 00:16:19.600
So here go go connect. Oh, it routes it. It
323
00:16:19.639 --> 00:16:20.919
doesn't just say go connect it.
324
00:16:20.960 --> 00:16:23.799
Oh yeah, it's no, it's like it routes it. It's
325
00:16:23.799 --> 00:16:24.600
a tunnel for you.
326
00:16:25.120 --> 00:16:26.559
So it's not peer to peer.
327
00:16:26.519 --> 00:16:30.279
Right exactly. It's it says it's a peer to peer,
328
00:16:30.320 --> 00:16:32.679
but it's literally creating a tunnel up into the cloud
329
00:16:32.919 --> 00:16:33.360
that you get me.
330
00:16:33.480 --> 00:16:34.159
Yeah, that's no good.
331
00:16:34.200 --> 00:16:37.720
So what's really crazy is you can then say, oh, no, no, no,
332
00:16:37.759 --> 00:16:40.320
my camera is not serial number one, two three four five,
333
00:16:40.519 --> 00:16:42.919
it's serial number one two three four six ye, and
334
00:16:42.960 --> 00:16:45.120
it goes okay, cool, and it routes you to that
335
00:16:45.240 --> 00:16:48.200
camera and presents you with the web login. That's issue
336
00:16:48.279 --> 00:16:51.600
number one. There is no authentication on how you can
337
00:16:51.639 --> 00:16:57.600
cycle through the cameras. Issue number two is how they
338
00:16:57.639 --> 00:17:01.759
were doing the authentication. There's anuthentication bypass. So now imagine
339
00:17:01.759 --> 00:17:03.960
we're running this store, right that, the three of us
340
00:17:04.039 --> 00:17:08.680
run our Shark Laser Cages store, and I'm the night
341
00:17:08.799 --> 00:17:11.640
security guy, and I'm sitting at a terminal with a
342
00:17:11.640 --> 00:17:13.519
whole bunch of screens, and I have one of those
343
00:17:13.559 --> 00:17:16.960
little keyboards with the you know, the dials and the
344
00:17:17.279 --> 00:17:19.000
joystick so I can move the cameras around so I
345
00:17:19.000 --> 00:17:20.319
can watch people buying cages.
346
00:17:20.119 --> 00:17:22.240
And all of a sudden your monitor starts showing the
347
00:17:22.240 --> 00:17:23.640
fresh Prince of bel Air.
348
00:17:23.599 --> 00:17:28.359
Right right, of course, I mean, and doctor Evil's calling.
349
00:17:30.680 --> 00:17:33.480
So I'm sitting there, I'm using the little joystick thing. Well,
350
00:17:33.519 --> 00:17:37.119
that keyboard that has the joystick for moving the cameras around,
351
00:17:37.160 --> 00:17:41.240
and that'swar stuff. Is an accessory also sold by TAWA.
352
00:17:41.960 --> 00:17:45.039
It's called a web keyboard or mini keyboard or whatever.
353
00:17:46.640 --> 00:17:50.400
Their own authentication is called the net keyboard. So their
354
00:17:50.440 --> 00:17:54.000
own authentication says, oh, by the way, if you tell
355
00:17:54.079 --> 00:17:57.200
us that you're using the net keyboard, which is literally
356
00:17:57.240 --> 00:18:00.720
just submitted into the authentication as ameter.
357
00:18:00.319 --> 00:18:00.920
Then it's all good.
358
00:18:00.920 --> 00:18:02.200
We don't require a password.
359
00:18:02.279 --> 00:18:03.720
It's all good, jeez.
360
00:18:03.400 --> 00:18:05.240
Because we've realized you just have a little joist it.
361
00:18:05.400 --> 00:18:06.640
You can't type in the password.
362
00:18:06.920 --> 00:18:07.799
Oh my god.
363
00:18:07.960 --> 00:18:11.359
Right, So that's all the attackers did, is they logged
364
00:18:11.400 --> 00:18:15.000
into this easy four IP started cycling through all of
365
00:18:15.039 --> 00:18:19.119
the really not that random serial numbers and saying, I
366
00:18:19.200 --> 00:18:21.319
use a net keyboard. I use a net keyboard, and
367
00:18:21.319 --> 00:18:23.640
it would give full access and then they can install.
368
00:18:23.319 --> 00:18:25.319
And do a sort of It's interesting. The article says.
369
00:18:25.400 --> 00:18:30.599
Researchers said confirmed compromises were concentrated in Ukraine and Russia.
370
00:18:32.400 --> 00:18:34.279
Wait which side of the attack were they?
371
00:18:34.519 --> 00:18:35.240
Probably both?
372
00:18:35.599 --> 00:18:38.319
So I assume your weapon of choice in this kind
373
00:18:38.319 --> 00:18:40.359
of exploit would be burpsuite.
374
00:18:41.200 --> 00:18:45.000
So burpsweet is nice. I'd probably sprinkle in a little
375
00:18:45.039 --> 00:18:47.079
fireprox is. I don't want to be picked up on
376
00:18:47.079 --> 00:18:48.720
what I'm doing and I want to do it fast.
377
00:18:49.039 --> 00:18:51.240
Just throwing that out there, that's probably the way to go.
378
00:18:51.319 --> 00:18:52.119
But yeah, I.
379
00:18:52.200 --> 00:18:54.400
Got to rename this show.
380
00:18:55.160 --> 00:18:56.960
You mean liability are criminal?
381
00:18:57.240 --> 00:19:00.960
Criminal career advice? Oh?
382
00:19:01.000 --> 00:19:03.680
Then really it would be on most wanted this and
383
00:19:03.759 --> 00:19:04.799
more than Malaysia.
384
00:19:04.920 --> 00:19:06.599
I'm surprised we aren't now.
385
00:19:08.920 --> 00:19:11.960
And to all of our Russian and Ukrainian listeners, thank you.
386
00:19:12.240 --> 00:19:15.559
Thank you, thanks for the story, Thank you, thank you. Okay,
387
00:19:16.119 --> 00:19:19.440
one morning, we take a break, stop and protect uses
388
00:19:19.559 --> 00:19:23.559
nearly two thousand hacked wait for it, word press sites
389
00:19:24.240 --> 00:19:28.000
to spread malware and steal data. I've never heard of
390
00:19:28.079 --> 00:19:28.680
such a thing.
391
00:19:28.960 --> 00:19:35.200
Oh, this is outrageous, the super secure word press. So
392
00:19:35.359 --> 00:19:39.039
breaking this one down. It's interesting, right, Well, WordPress is
393
00:19:39.119 --> 00:19:42.839
so ubiquitously you're able to break into it now. People
394
00:19:42.880 --> 00:19:48.119
are using hacked WordPress sites as commandic control. Right Yeah,
395
00:19:48.160 --> 00:19:50.480
so it's like, oh, I now have a framework thinking
396
00:19:50.599 --> 00:19:53.599
and literally there's a framework here that can go out
397
00:19:53.640 --> 00:19:58.680
and have all those hacked word press sites report into
398
00:19:58.759 --> 00:20:02.640
a commandic control structure. And then the attack here was
399
00:20:02.680 --> 00:20:04.759
actually a click fist fixed. So this was a social
400
00:20:04.759 --> 00:20:08.119
engineering attack. I get you to load a thing that
401
00:20:08.200 --> 00:20:10.680
will then go and do magical things. It will go,
402
00:20:10.799 --> 00:20:14.079
you know, it installs uh, you know, password stealers and
403
00:20:14.079 --> 00:20:16.759
all sorts of stuff. Right, so you're running a PowerShell script.
404
00:20:17.119 --> 00:20:18.519
At the end of the day, I con you into
405
00:20:18.599 --> 00:20:21.759
running a PowerShell script. But the need part is that
406
00:20:21.839 --> 00:20:25.400
PowerShell script that's now running there stealing stuff off my computer,
407
00:20:25.720 --> 00:20:29.839
is communicating with a back end of hacked WordPress sites. Yeah,
408
00:20:29.839 --> 00:20:33.279
and then I'm getting the information. The great thing about
409
00:20:33.279 --> 00:20:36.039
this method is it's not like I can say, oh,
410
00:20:36.079 --> 00:20:40.119
this is a known hacker's website, right, It could be
411
00:20:40.240 --> 00:20:43.079
any website, could be a site, could be yeah whatever,
412
00:20:43.240 --> 00:20:47.599
right exactly. So this this helps bypass a lot of
413
00:20:47.640 --> 00:20:51.799
the firewall rules and you know, endpoint detection rules and
414
00:20:51.799 --> 00:20:54.160
that sort of stuff. So I, uh, oh, word.
415
00:20:54.119 --> 00:20:58.680
I didn't see the word patch or or SISA or
416
00:20:58.799 --> 00:21:02.440
score anywhere in this article, and that makes me even
417
00:21:02.480 --> 00:21:05.279
more concerned that we should change the name of this
418
00:21:05.359 --> 00:21:08.720
podcast to criminal career advice.
419
00:21:09.359 --> 00:21:13.400
We absolutely should. It's like, well, it's funny because this article.
420
00:21:13.440 --> 00:21:15.480
I think they didn't add patch because the only way
421
00:21:15.480 --> 00:21:18.079
to break into these word press sites was an unpatched
422
00:21:18.079 --> 00:21:19.400
plug in. And they're like, you know, we're not even
423
00:21:19.440 --> 00:21:21.039
gonna tell you do it anymore. Yeah, whatever.
424
00:21:21.119 --> 00:21:23.200
Well, and the click and the clickfix thing is a
425
00:21:23.200 --> 00:21:26.279
social engineering attack. It's you convince someone to do something right,
426
00:21:26.319 --> 00:21:28.160
the only one should never have thought of doing.
427
00:21:28.279 --> 00:21:30.680
The only way to patch that is with the lead pipe.
428
00:21:33.200 --> 00:21:37.960
In the conservatory will be patched when the robots take over.
429
00:21:38.519 --> 00:21:44.279
Maybe, yeah, what do you mean when? Yeah? Well, all right,
430
00:21:44.359 --> 00:21:46.119
on that note, we'll take a little break. We'll be
431
00:21:46.200 --> 00:21:53.559
right back after these very important messages, and we're back.
432
00:21:53.680 --> 00:21:56.240
It's security this week. I'm Carl, that's Patrick, that's Twain.
433
00:21:57.440 --> 00:22:00.759
A few more stories here. New Manic and Trey malware
434
00:22:00.799 --> 00:22:07.440
can exfiltrate data through nearby devices. I don't like that. Listen.
435
00:22:07.680 --> 00:22:08.839
Is it as bad as it sounds?
436
00:22:09.160 --> 00:22:12.640
I don't why, and not really. I mean, yes, it's bad,
437
00:22:12.680 --> 00:22:15.440
but it's not that bad. I don't want to start
438
00:22:15.480 --> 00:22:23.480
the whole Holy war on the discord again. Android and iPhone.
439
00:22:23.039 --> 00:22:25.799
But why don't you just start with your god sucks.
440
00:22:30.319 --> 00:22:30.480
This.
441
00:22:31.319 --> 00:22:34.680
To distill this down to a two second SoundBite, this
442
00:22:34.759 --> 00:22:36.400
is you sideloading apps you shouldn't.
443
00:22:37.000 --> 00:22:40.119
Well, however, it's you kind of get what you deserve.
444
00:22:40.279 --> 00:22:42.920
Yeah, it's unique though, right, So they say, listen, we
445
00:22:42.960 --> 00:22:47.480
don't know how this is happening yet. There's no attribution
446
00:22:47.799 --> 00:22:51.519
yet to the type of app, the thing that everybody's doing.
447
00:22:53.960 --> 00:22:58.519
What's actually really kind of cool? I say, cool? Is
448
00:22:58.559 --> 00:23:02.720
this malway cool? I know this malwhere registers as an
449
00:23:02.759 --> 00:23:08.559
accessibility feature, so it puts an invisible overlay on top
450
00:23:08.680 --> 00:23:11.920
of apps. So when you type in your banking password,
451
00:23:12.400 --> 00:23:16.720
you're texting, you're doing whatever, it picks all that up
452
00:23:16.920 --> 00:23:21.359
and sends it to back end server. Exactly. Great analogy, Patrick,
453
00:23:21.440 --> 00:23:22.359
And it sounds like.
454
00:23:22.319 --> 00:23:24.200
It targets people who don't have good vision.
455
00:23:24.640 --> 00:23:28.480
It could, or it just people don't pay attention to
456
00:23:28.519 --> 00:23:30.759
the Hey, you downloaded this from a third party, or
457
00:23:30.799 --> 00:23:33.720
you okay with all of the requirements and they say yes,
458
00:23:33.799 --> 00:23:36.319
which turns on accessibility and does all that good stuff.
459
00:23:36.359 --> 00:23:39.400
Well, would they download it for accessibility purposes? I guess
460
00:23:39.440 --> 00:23:40.160
that's my question.
461
00:23:40.319 --> 00:23:41.279
Oh, good question.
462
00:23:41.359 --> 00:23:45.440
I mean they might trick them into thinking anything anything
463
00:23:45.480 --> 00:23:48.160
they want that this will save you memory, it'll lower
464
00:23:48.240 --> 00:23:51.759
your your your charges, it'll increase your creatine levels.
465
00:23:51.880 --> 00:23:54.559
It's a new cool looking keyboard. Yeah yeah, whatever.
466
00:23:54.759 --> 00:23:58.960
Yeah, so it'll make it waterproof exactly.
467
00:24:01.519 --> 00:24:04.279
So it's a it's a skimmer. That is a great analogy, Patrick,
468
00:24:04.319 --> 00:24:06.680
because it does it watches you type on your s s.
469
00:24:06.759 --> 00:24:09.319
It watches you type your multi factor codes, and then
470
00:24:09.359 --> 00:24:10.759
it passes it along to the app.
471
00:24:11.480 --> 00:24:13.279
I'm good for one good one per show.
472
00:24:13.160 --> 00:24:16.240
I know, Jesus. That's it, Patrick, You're done. Take a vacation, Une,
473
00:24:16.720 --> 00:24:21.720
take a lot. Yeah, well done, well done. So I
474
00:24:21.759 --> 00:24:25.240
could say Apple wouldn't allow you to do this without
475
00:24:25.799 --> 00:24:29.279
jumping through all sorts of hoops, Like you can put
476
00:24:29.279 --> 00:24:31.559
your Apple phone into a developer mode and you can
477
00:24:31.640 --> 00:24:32.480
actually download.
478
00:24:32.559 --> 00:24:35.480
But when you do that, you auto even if you
479
00:24:35.519 --> 00:24:38.599
auto provision, right, they know who you are.
480
00:24:38.799 --> 00:24:39.079
Yeah.
481
00:24:39.200 --> 00:24:41.599
So so yeah, I don't I have a band. I
482
00:24:41.680 --> 00:24:44.039
have a mobile app that I'm testing with the band.
483
00:24:44.319 --> 00:24:45.839
I'm not going to have them all come over and
484
00:24:45.880 --> 00:24:50.599
plug in their devices and sideload it onto their phones. Right,
485
00:24:50.599 --> 00:24:52.359
We're going to go through an app store? Yeah?
486
00:24:52.400 --> 00:24:55.440
Absolutely, Yeah, and that that gets much harder if you're
487
00:24:55.440 --> 00:24:59.480
going through an app store. So the the running theory
488
00:24:59.640 --> 00:25:02.000
is the is obviously pulled off of some you know,
489
00:25:02.119 --> 00:25:04.640
third party site or some third party app store after
490
00:25:05.000 --> 00:25:08.680
the phone's been rooted. But yeah, just be careful what
491
00:25:08.720 --> 00:25:10.440
you download and don't use Android.
492
00:25:16.079 --> 00:25:19.079
All right. So the next one is really really cool.
493
00:25:19.160 --> 00:25:24.400
I saw this cloud Flare workers specter attack exposed jot
494
00:25:24.599 --> 00:25:27.519
jwt at twelve bits per.
495
00:25:27.440 --> 00:25:30.079
Second, lightning fast.
496
00:25:30.119 --> 00:25:33.319
Now. I remember having a three hundred bod modem and
497
00:25:33.400 --> 00:25:34.519
I thought that was slow.
498
00:25:34.960 --> 00:25:36.599
This is actually a measure of fast.
499
00:25:37.480 --> 00:25:39.680
Yeah, it is, because it's only a jot token.
500
00:25:39.759 --> 00:25:42.400
It's just any And the old speed was like, what
501
00:25:42.480 --> 00:25:45.240
was it to two bit two bites per per minute?
502
00:25:45.279 --> 00:25:48.200
Twelve twelve bits per second before.
503
00:25:48.000 --> 00:25:49.720
Well that's twelve or second, but before it was like
504
00:25:49.759 --> 00:25:51.000
two per minute.
505
00:25:51.880 --> 00:25:53.720
Or No, the earlier attack was yeah, one hundred and
506
00:25:53.720 --> 00:25:56.160
twenty bits per hour. Okay, so a lot slower.
507
00:25:56.400 --> 00:26:00.839
Yeah, okay, let's unpack this one. Yeah, first of all,
508
00:26:01.079 --> 00:26:02.440
what's a jot? I love this.
509
00:26:02.799 --> 00:26:05.119
I love this these types of attacks. How do you
510
00:26:05.440 --> 00:26:06.680
tell us, Carl, what's a jaw?
511
00:26:06.720 --> 00:26:10.559
All right? A jot is a piece of gobbledygook. String
512
00:26:11.079 --> 00:26:16.359
that you used to as a token. When you're authenticated
513
00:26:16.400 --> 00:26:19.799
by a website, you get a JOT token or you
514
00:26:19.839 --> 00:26:23.440
send a jot token and then that identifies you kind
515
00:26:23.440 --> 00:26:26.559
of like a cookie for the for the session as
516
00:26:26.599 --> 00:26:27.559
long as you're logged in.
517
00:26:27.640 --> 00:26:30.440
It's a Java artifact. Yeah, Java web token.
518
00:26:30.240 --> 00:26:32.240
Right, there's a Java script web token.
519
00:26:32.400 --> 00:26:34.359
Okay, yeah, yeah, and it can have some neat things
520
00:26:34.359 --> 00:26:37.599
in there, right, like roll and all sorts of little
521
00:26:37.599 --> 00:26:40.279
information about maybe what you should and shouldn't have access
522
00:26:40.319 --> 00:26:43.200
to whatever it is. But right, you know what. I
523
00:26:43.480 --> 00:26:44.839
We've been doing this for a long time. This is
524
00:26:44.839 --> 00:26:46.559
over five years we've been doing this podcast. And I
525
00:26:46.640 --> 00:26:48.680
used to call these jawts all the time. I was like,
526
00:26:48.680 --> 00:26:50.799
this is a jawt. JB Like we hack them all
527
00:26:50.799 --> 00:26:52.319
the time. We're like, oh, did you get the jawt
528
00:26:52.480 --> 00:26:55.000
token whatever? Right, And when we were on with Carl
529
00:26:55.039 --> 00:26:57.480
at one point for an article maybe four years ago,
530
00:26:57.519 --> 00:27:00.440
he's like, yeah, JOT And I'm like, are you messing
531
00:27:00.480 --> 00:27:03.960
with me? They call it jot really and he's like, yeah, dude,
532
00:27:04.000 --> 00:27:06.640
it's wrong with you. Sounds like, oh I learned it.
533
00:27:06.680 --> 00:27:07.960
I learned that from brock Allen.
534
00:27:09.119 --> 00:27:11.119
Oh really Yeah, well Brock would know.
535
00:27:11.400 --> 00:27:13.720
Yeah, he's the first guy I ever heard say, jot
536
00:27:14.440 --> 00:27:15.079
that's awesome.
537
00:27:15.880 --> 00:27:18.480
So yeah, let me jot that down.
538
00:27:18.599 --> 00:27:19.359
Let me jot it.
539
00:27:20.440 --> 00:27:24.119
So this is a side channel attack, and like a
540
00:27:24.160 --> 00:27:28.359
really cool side channel attack. So for those as old
541
00:27:28.400 --> 00:27:32.359
as us, I suppose you probably remember this specter. You
542
00:27:32.440 --> 00:27:33.720
may not remember a spector attack.
543
00:27:33.759 --> 00:27:36.799
If your back hurts the gunship, you probably yeah, not
544
00:27:36.920 --> 00:27:37.359
that one.
545
00:27:37.880 --> 00:27:43.359
Not that spector attack puffed the magic Dragon. So spector
546
00:27:43.480 --> 00:27:47.240
attacks are an attack. And I won't go into too
547
00:27:47.359 --> 00:27:50.240
much technical detail, but a spector attack is an attack
548
00:27:50.279 --> 00:27:53.440
on a CPU, and it's specifically an attack on how
549
00:27:53.480 --> 00:27:56.839
the architecture of CPU's work. And it's an attack on
550
00:27:57.440 --> 00:28:01.440
every CPU since nine made since ninety nine, right, so
551
00:28:01.519 --> 00:28:05.440
the architecture has not changed. What happens is CPUs, to
552
00:28:06.000 --> 00:28:09.720
sort of distill it down, CPUs are fast, right in
553
00:28:09.799 --> 00:28:13.319
making decisions, in branching and doing it they should. Access
554
00:28:13.359 --> 00:28:17.599
to memory is slow. So if you tell a CPU,
555
00:28:18.599 --> 00:28:22.559
go access memory, and if the answer is yes, go
556
00:28:22.640 --> 00:28:25.720
down path A. And if the answer is no, go
557
00:28:25.799 --> 00:28:28.000
down path P, what happens.
558
00:28:29.359 --> 00:28:33.720
My back hurts. That's about all I know anybody.
559
00:28:33.799 --> 00:28:35.559
So what happens is delay.
560
00:28:36.119 --> 00:28:38.960
Yeah. What happens is the CPU doesn't stand there for
561
00:28:39.000 --> 00:28:42.799
one hundred cycles and go I'll wait. Yeah, the CPU says.
562
00:28:43.000 --> 00:28:46.279
The last ninety nine times I always asked this question,
563
00:28:46.599 --> 00:28:49.359
I was told to go down path A afterwards, so
564
00:28:49.440 --> 00:28:54.960
it speculates the path to go down hence specter attacks.
565
00:28:55.160 --> 00:28:59.880
CPU speculates, Oh yeah, the CPU speculates.
566
00:28:59.200 --> 00:29:01.200
I didn't know cp use could speculate.
567
00:29:01.359 --> 00:29:04.039
Yeah, it creates goods down there were.
568
00:29:05.680 --> 00:29:07.319
Well they're trying, they're trying to optimize.
569
00:29:07.480 --> 00:29:11.200
No, it goes down this speculative path. Yeah, it's all optimization.
570
00:29:11.359 --> 00:29:13.359
And here's what it says. If I go down the
571
00:29:13.400 --> 00:29:18.839
speculative path and I was right, we're fast. If I
572
00:29:18.960 --> 00:29:23.160
was wrong, I roll back to that branch point, clean
573
00:29:23.240 --> 00:29:26.759
up memory, and I just continue. So I'm not any
574
00:29:26.839 --> 00:29:29.000
slower than if I just sat there waiting. So I
575
00:29:29.079 --> 00:29:30.039
might as well speculate.
576
00:29:30.400 --> 00:29:32.960
Except what happened during that path.
577
00:29:33.119 --> 00:29:36.200
That's the that's theerein lies the rub. So let's say
578
00:29:36.480 --> 00:29:38.319
I tell it go down path A, go down path A,
579
00:29:38.440 --> 00:29:42.480
go down path A a billion times, and then this
580
00:29:42.640 --> 00:29:44.319
next time I say, oh, by the way, instead of
581
00:29:44.359 --> 00:29:48.680
accessing my jot token, which would force you down PATHA,
582
00:29:49.480 --> 00:29:54.400
go access another JOT token from another area of memory,
583
00:29:55.160 --> 00:29:57.519
and it goes, oh, well, the last thousand times I
584
00:29:57.880 --> 00:30:00.799
accessed a JOT token, I went down PATHA. I'll go
585
00:30:00.839 --> 00:30:05.799
down PATHA and it violates the security barrier, grabs the
586
00:30:05.880 --> 00:30:07.240
JOT token and loads it into.
587
00:30:07.119 --> 00:30:09.039
Memory, and it could be the wrong token.
588
00:30:09.279 --> 00:30:11.960
It's most absolutely going to be the wrong token at
589
00:30:11.960 --> 00:30:14.039
this point. It's somebody else's token.
590
00:30:13.839 --> 00:30:16.640
Or it's not even a token, maybe it's maybe it's
591
00:30:16.759 --> 00:30:17.640
just gobbledygook.
592
00:30:17.799 --> 00:30:21.319
Maybe in this particular case, because it's cloud Flare, I'm
593
00:30:21.440 --> 00:30:26.680
running on the same headless box as probably twelve other
594
00:30:26.880 --> 00:30:32.039
companies are running. So it'll violate the isolation layer, grab
595
00:30:32.160 --> 00:30:35.200
the JOT token from one of the other neighbors, and
596
00:30:35.359 --> 00:30:40.079
load it into memory. Now, then it'll come back and say, oh,
597
00:30:40.119 --> 00:30:41.960
by the way, you don't have access to that JOT token,
598
00:30:42.000 --> 00:30:44.359
but it's in memory, you know. I'll get my Yeah,
599
00:30:44.400 --> 00:30:47.440
I'll get my access denied. Came back from slow storage,
600
00:30:47.920 --> 00:30:51.400
And what happens is the CPU tries to roll it back,
601
00:30:51.640 --> 00:30:53.759
and when it rolls it back, it rolls back all
602
00:30:53.839 --> 00:30:57.079
the registers in the CPU, but it doesn't roll back
603
00:30:57.119 --> 00:31:01.599
the quick cash in the CPU. So now I can
604
00:31:01.720 --> 00:31:06.079
query the cash and whatever comes back fast I know
605
00:31:06.319 --> 00:31:07.599
was loaded in the cash.
606
00:31:07.640 --> 00:31:07.960
Wow.
607
00:31:08.119 --> 00:31:10.599
So I'll go and loop through all the cash, find
608
00:31:10.640 --> 00:31:13.119
what comes back fast, and say, oh, this is the
609
00:31:13.200 --> 00:31:17.119
JOT tooken. So this technique, in this particular case is
610
00:31:17.319 --> 00:31:22.759
ninety nine point one six percent accurate in pulling back
611
00:31:23.400 --> 00:31:28.160
a neighboring JOT token from somebody else running on your
612
00:31:28.200 --> 00:31:29.240
cloud Flare instance.
613
00:31:29.559 --> 00:31:31.400
Is that why slowing it down is an answer?
614
00:31:31.720 --> 00:31:35.720
Yeah? I I that problem. So here's what cloud Flair did.
615
00:31:35.720 --> 00:31:38.440
They said, we've known about specter since nineteen ninety five, well,
616
00:31:38.440 --> 00:31:41.279
actually a little later than nineteen ninety five, and cloud
617
00:31:41.359 --> 00:31:49.599
Flair said, we've added two different protections against this happening. Right,
618
00:31:50.559 --> 00:31:53.880
the only way for you to actually viably do this
619
00:31:53.960 --> 00:31:58.480
attack is to measure the time it takes for a
620
00:31:58.519 --> 00:32:00.559
request in a memory to come back. So if I
621
00:32:00.599 --> 00:32:03.359
request in a memory and it's and it's not in
622
00:32:03.400 --> 00:32:05.920
the cash, it should be slow. And if I request
623
00:32:05.920 --> 00:32:07.880
in a memory and it is in the cash, it
624
00:32:07.880 --> 00:32:10.200
should be fast. Right, that's the whole point of the attack, right,
625
00:32:10.440 --> 00:32:12.240
Load something in a cash that shouldn't have been there,
626
00:32:12.440 --> 00:32:14.119
and then see if you can pull it back so
627
00:32:14.160 --> 00:32:15.759
you need you need to have timing. You you have
628
00:32:15.880 --> 00:32:18.680
local timing in your code. Hey what's the time? Date
629
00:32:18.759 --> 00:32:21.920
dot now? Run some code to grab some cash, and
630
00:32:21.920 --> 00:32:24.240
then run date dot now again and see was that
631
00:32:24.279 --> 00:32:26.839
fast or was that slow? And what cloud Flair did
632
00:32:26.880 --> 00:32:29.079
is they said, uh huh, we're not allowing date dot
633
00:32:29.119 --> 00:32:32.039
now and we're not allowing all the thready wonky stuff
634
00:32:32.079 --> 00:32:33.839
you can do, which is like date dot now, We're
635
00:32:33.839 --> 00:32:36.920
not going to do it. What the researchers and here
636
00:32:37.000 --> 00:32:39.039
did is they said, okay, not a problem. We're just
637
00:32:39.079 --> 00:32:42.920
going to call out to an external service to get time.
638
00:32:43.799 --> 00:32:45.960
And it doesn't matter because it will always be slow.
639
00:32:46.440 --> 00:32:51.880
It'll always be when I call cashed memory, it'll be slow,
640
00:32:51.880 --> 00:32:54.759
but when I call not cash memory it'll be even slower.
641
00:32:54.759 --> 00:32:57.160
So it doesn't matter whether the timing measurement is local
642
00:32:57.200 --> 00:33:00.000
on the box will do it remotely. It's super NOI
643
00:33:01.160 --> 00:33:05.400
super noisy, and cloud Flair missed it. They were like, huh, yeah,
644
00:33:05.400 --> 00:33:08.119
we never thought anybody would call off box to do that.
645
00:33:09.279 --> 00:33:12.640
So that's the primary sort of quote unquote fix if
646
00:33:12.640 --> 00:33:15.519
you will, that cloud Flare put in place. They also
647
00:33:15.599 --> 00:33:18.079
have this really frigging at cloud Flair does an awesome job.
648
00:33:18.279 --> 00:33:22.640
They also have this really frigging cool the second mitigation.
649
00:33:23.160 --> 00:33:27.279
If they notice you query in cash and you constantly
650
00:33:27.359 --> 00:33:29.880
get no, that doesn't exist. No that doesn't exist, No
651
00:33:29.960 --> 00:33:31.960
that doesn't exist. Yes it does know that doesn't exist.
652
00:33:32.720 --> 00:33:37.039
They actually realize you're trying to violate specter attack. They
653
00:33:37.119 --> 00:33:39.720
grab your process and they throw it in jail and
654
00:33:39.799 --> 00:33:42.640
they put it on its own machine in a way
655
00:33:42.680 --> 00:33:44.559
that it can't access anything else.
656
00:33:44.640 --> 00:33:45.680
They gave you a timeout.
657
00:33:45.880 --> 00:33:48.440
Yeah, exactly. So they have these two mechanisms to try
658
00:33:48.440 --> 00:33:51.640
and protect and what happened here is researchers discovered a
659
00:33:51.680 --> 00:33:55.000
way around the first mechanisms that it didn't actually look
660
00:33:55.119 --> 00:33:57.960
like it was an issue. It was tested, it does work,
661
00:33:59.039 --> 00:34:01.640
and you know, cloud flare making some small changes to
662
00:34:01.720 --> 00:34:04.480
their to their timing protections. But this is yeah, this
663
00:34:04.559 --> 00:34:06.079
is awesome. This is a really cool attack.
664
00:34:06.240 --> 00:34:10.280
Wow. Anything we can do about it, n just.
665
00:34:10.280 --> 00:34:13.519
Know it exists. Hopefully the listeners are a little bit
666
00:34:13.519 --> 00:34:15.840
more learned on spector attacks and now that all works.
667
00:34:15.840 --> 00:34:19.519
But all right, finally our top story, NASA a t
668
00:34:19.719 --> 00:34:25.280
gooey flaws could let unauthenticated attackers issue spacecraft commands and
669
00:34:25.480 --> 00:34:29.960
AI T stands for almost instrument Toolkit, which is NASA
670
00:34:30.119 --> 00:34:35.320
JPL's open source toolkit. Yeah, and gooey is graphical user interface. Obviously.
671
00:34:35.639 --> 00:34:38.079
You remember how when you want to say something is
672
00:34:38.119 --> 00:34:41.360
really smart, you say it's a rocket scientist. Yeah, you
673
00:34:41.440 --> 00:34:42.400
can't say that anymore.
674
00:34:43.159 --> 00:34:45.239
It's not rocket science. Actually it is.
675
00:34:45.679 --> 00:34:47.599
It's not that bad. It's not that bad.
676
00:34:48.480 --> 00:34:52.679
Yeah, honestly. I mean you have these images of somebody,
677
00:34:52.719 --> 00:34:57.039
some attacker, you know, connecting into a spacecraft with no
678
00:34:57.159 --> 00:35:00.639
password and you know, landing in the middle of New York.
679
00:35:00.599 --> 00:35:04.159
Or actually I think the worst scenario was driving a
680
00:35:04.480 --> 00:35:07.199
satellite down into a you know, thirty six thousand miles
681
00:35:07.199 --> 00:35:08.679
an hour into some naval ship.
682
00:35:08.840 --> 00:35:10.599
Oh yeah, yeah, absolutely.
683
00:35:10.639 --> 00:35:13.559
I guess I go more evil than you even sometimes
684
00:35:13.679 --> 00:35:13.880
I know.
685
00:35:14.280 --> 00:35:17.079
Or can you imagine? I wonder what the feasibility of
686
00:35:17.159 --> 00:35:20.440
using it as an assassination weapon would be? Jeez, very
687
00:35:20.519 --> 00:35:22.079
I mean, could you could you?
688
00:35:22.719 --> 00:35:24.199
I think the problem would be that the.
689
00:35:24.400 --> 00:35:26.719
Orbital mechanics could we determine?
690
00:35:26.800 --> 00:35:29.079
I've thought about this. I think I think you could.
691
00:35:29.199 --> 00:35:30.400
I think that I've thought about this.
692
00:35:30.679 --> 00:35:32.800
I think the problem is that it would will likely
693
00:35:32.840 --> 00:35:35.360
burn up unless you had something big like Skylab, So
694
00:35:35.400 --> 00:35:37.000
you'd have to adjust.
695
00:35:36.639 --> 00:35:39.320
Dwayne, do you teach evil lessons? Can I take evil
696
00:35:39.360 --> 00:35:40.320
lessons from you?
697
00:35:40.320 --> 00:35:43.599
You'd have to adjust the trade and the speed so
698
00:35:43.639 --> 00:35:46.639
that it didn't burn up completely before it reached its target.
699
00:35:49.360 --> 00:35:52.760
Have you guys ever seen Mark Rober name name rings?
700
00:35:52.760 --> 00:35:53.719
A belle comedian?
701
00:35:53.920 --> 00:35:56.599
No? No, no, A brilliant engineer. Wasn't he from Mit?
702
00:35:56.960 --> 00:36:00.280
Wasn't he Jack Ritters and Chrisy's land lord?
703
00:36:01.599 --> 00:36:08.000
You're speaking? And that dated everybody on this podcast?
704
00:36:08.079 --> 00:36:08.280
Yeah?
705
00:36:08.320 --> 00:36:08.679
Who else?
706
00:36:12.920 --> 00:36:13.039
No?
707
00:36:13.039 --> 00:36:16.599
No, no, Mark Robert. He's a brilliant engineer graduated I
708
00:36:16.599 --> 00:36:19.920
think my Tea if I remember correctly, but probably one
709
00:36:19.960 --> 00:36:23.280
of the most well known mechanical engineers of our time.
710
00:36:23.360 --> 00:36:26.719
But anyways, he actually did a science that's what he does.
711
00:36:26.719 --> 00:36:28.760
He has his YouTube channel millions of people following that
712
00:36:28.760 --> 00:36:30.400
sort of stuff. But one of the science experiments he
713
00:36:30.440 --> 00:36:33.400
did was could you drop a tungsten rod from space
714
00:36:34.320 --> 00:36:37.199
and hit a target? And he actually did.
715
00:36:37.159 --> 00:36:38.440
Tungsten rods from God.
716
00:36:38.599 --> 00:36:38.840
Yeah.
717
00:36:38.920 --> 00:36:41.519
He he actually tried to work out the you know,
718
00:36:41.639 --> 00:36:45.800
targeting and ballistics and all that other good stuff, and
719
00:36:46.079 --> 00:36:49.679
it's surprisingly hard to drop on a target. Yeah, you
720
00:36:49.719 --> 00:36:50.719
know that small but.
721
00:36:51.199 --> 00:36:53.760
Because of the the wins mostly I think.
722
00:36:53.679 --> 00:36:57.840
When a fact did a lot into orbit, yeah, yep,
723
00:36:58.000 --> 00:37:00.400
yeah yeah, and if you were dropping out of orbit,
724
00:37:00.519 --> 00:37:03.320
like just the angle that it's hitting and you know
725
00:37:03.679 --> 00:37:06.599
what pieces of the object flake off will change, right,
726
00:37:06.679 --> 00:37:08.840
So there just there's all sorts of mechanics around.
727
00:37:09.079 --> 00:37:12.800
Uh yeah, Like one of the things that a needle
728
00:37:12.840 --> 00:37:14.599
at the speed of light would pretty much wipe up
729
00:37:14.639 --> 00:37:16.719
the planet. Sure, so you know if you get good
730
00:37:16.800 --> 00:37:18.840
enough speed coming. But but then the thing has to
731
00:37:18.880 --> 00:37:21.880
survive as well. So actually to some extent, as long
732
00:37:21.880 --> 00:37:24.280
as you get it in the zip code, it's probably
733
00:37:24.320 --> 00:37:25.599
going to do enough damage.
734
00:37:25.840 --> 00:37:31.599
Now Patrick's talking about taking an entire city block. Needless
735
00:37:31.639 --> 00:37:33.400
to say, before we go any further.
736
00:37:33.239 --> 00:37:37.000
What is this XKCD, Before we go.
737
00:37:36.920 --> 00:37:40.119
Any further, this sounds really scary, right. There's a you know,
738
00:37:40.119 --> 00:37:43.440
an application that they use for commandy control with spacecraft
739
00:37:43.440 --> 00:37:45.079
that oh my gosh. And if you look at the
740
00:37:45.079 --> 00:37:48.719
web site, it's literally like sitting at the cockpit, right.
741
00:37:48.760 --> 00:37:50.360
There's all sorts of things you can do in there.
742
00:37:51.480 --> 00:37:54.880
You know, everything from no password to get into the
743
00:37:54.920 --> 00:37:58.679
site to you know CSRF issues where I can make
744
00:37:58.719 --> 00:38:02.199
requests locally to them binding the to zero zero zero,
745
00:38:02.239 --> 00:38:04.199
which means it's open to everything and it ignores its
746
00:38:04.199 --> 00:38:06.840
own local configure. There's all sorts of issues in this.
747
00:38:08.880 --> 00:38:11.559
So this sounds like just a disaster waiting to happen.
748
00:38:12.000 --> 00:38:15.199
But here's what we will tell you. We've rated this
749
00:38:15.280 --> 00:38:18.599
is not that important. It's it's an interesting article, it's
750
00:38:18.599 --> 00:38:22.280
fun to talk about, but there are so many other
751
00:38:22.320 --> 00:38:29.480
safeguards between ground control of any you know, space object
752
00:38:31.199 --> 00:38:36.119
and and you know satellites, and you know Starlink satellites
753
00:38:36.159 --> 00:38:39.119
and and you know spacecraft and skylab and whatever. Right,
754
00:38:39.199 --> 00:38:43.199
all of those there's a lot more than just reading
755
00:38:43.239 --> 00:38:47.360
or radio waves and sending them up. You know, I've tried.
756
00:38:47.679 --> 00:38:51.000
But anyway, so why why has it got a nine
757
00:38:51.000 --> 00:38:54.239
point four score? And why hasn't it been issued a CV?
758
00:38:54.639 --> 00:38:58.599
So this is an interesting question. Yeah, So the nine
759
00:38:58.639 --> 00:39:01.800
point four score is is this is an open source
760
00:39:01.880 --> 00:39:05.159
project and the concern is people will take it at
761
00:39:05.199 --> 00:39:08.119
face value and use it without putting any of those
762
00:39:08.119 --> 00:39:11.199
safeguards that NASA and SpaceX and that sort of stuff
763
00:39:11.199 --> 00:39:15.239
would have put in. Using this is an a normal
764
00:39:15.280 --> 00:39:17.000
piece of code. Would this rate a nine point four?
765
00:39:17.079 --> 00:39:17.239
Yeah?
766
00:39:17.239 --> 00:39:19.840
Absolutely, I mean there's no authentication in certain cases, it's
767
00:39:19.840 --> 00:39:24.360
not protecting. There's no cross site request forgery protection and
768
00:39:24.400 --> 00:39:27.280
tokens and that sort of stuff. So yeah, absolutely the
769
00:39:27.280 --> 00:39:30.000
things a soup sandwich when it comes to, you know,
770
00:39:30.119 --> 00:39:33.760
trying to use it in a secure fashion. That's where
771
00:39:33.800 --> 00:39:37.440
that number comes from. Not really, because you know we're
772
00:39:37.480 --> 00:39:42.840
at risk, all right, So no signtle ice dropping on
773
00:39:42.880 --> 00:39:47.159
your head. A little bit more clickbaity than usual click
774
00:39:47.239 --> 00:39:48.840
baity Clickie makes movies.
775
00:39:57.960 --> 00:39:59.960
None of these references are less than fifty years old.
776
00:40:00.400 --> 00:40:00.639
Nope.
777
00:40:01.320 --> 00:40:05.360
Well, anybody who's back hurts, they can laugh along with us.
778
00:40:05.440 --> 00:40:07.239
You get us, you get us, You're.
779
00:40:07.079 --> 00:40:09.880
Back, doesn't hurt. You're too young, all right. Well, I
780
00:40:09.920 --> 00:40:12.559
guess that's a show. And that's all the things that
781
00:40:12.599 --> 00:40:14.760
we could come up with that happened last week. We'll
782
00:40:14.760 --> 00:40:17.199
see you next week on Security this week, Bye bye,
783
00:40:17.320 --> 00:40:18.000
bye bye