WEBVTT
1
00:00:00.340 --> 00:00:30.980
And don't forget Discord. Discord.SecurityThisWeek.com. Lots of good stuff happening there. Um, yeah,
2
00:00:31.000 --> 00:00:33.759
I think that's it. So on with the podcast. You know,
3
00:00:34.060 --> 00:00:38.060
my doctor gave me an impossible task. He said, spend
4
00:00:38.100 --> 00:00:40.079
at least an hour a day on the treadmill. And
5
00:00:40.119 --> 00:00:41.880
I'm telling you now, it's not going to work.
6
00:00:42.189 --> 00:00:42.829
Huh.
7
00:00:42.969 --> 00:00:45.130
The gym staff only let me on it for five
8
00:00:45.149 --> 00:00:47.369
minutes before they told me to leave and take my
9
00:00:47.469 --> 00:00:48.289
pillow with me.
10
00:00:51.729 --> 00:00:52.549
Well, that's absurd.
11
00:00:53.270 --> 00:00:54.030
It's crazy.
12
00:00:54.049 --> 00:00:54.590
Yeah.
13
00:01:02.960 --> 00:01:06.379
All right. Security This Week. I'm Carl. That's Patrick and Dwayne.
14
00:01:06.640 --> 00:01:12.409
And we've got eight stories today, starting with one that
15
00:01:12.469 --> 00:01:15.049
is kind of interesting and a little ironic, don't you think?
16
00:01:15.060 --> 00:01:15.590
Yeah.
17
00:01:16.090 --> 00:01:16.269
Yeah.
18
00:01:22.739 --> 00:01:23.099
This is.
19
00:01:23.739 --> 00:01:24.560
Yeah. Yeah.
20
00:01:24.700 --> 00:01:26.549
Just because you're in security doesn't mean you're immune.
21
00:01:27.349 --> 00:01:29.989
I always wonder, like, you see all these top brand
22
00:01:30.030 --> 00:01:35.469
security companies and you always wonder, like CrowdStrike, and you're like, hey, maybe... Like,
23
00:01:35.510 --> 00:01:38.719
they're just shoemakers kids, right? You know the story. Excellent
24
00:01:38.739 --> 00:01:41.180
at what they do, work with customers all around the world,
25
00:01:41.200 --> 00:01:43.140
but don't take a look at their own security, maybe.
26
00:01:43.159 --> 00:01:43.379
Right.
27
00:01:43.439 --> 00:01:43.900
I'm not sure.
28
00:01:45.189 --> 00:01:46.609
Psychologist in the same way.
29
00:01:49.510 --> 00:01:52.549
Now, this is just to be clear, CrowdSecurity is not
30
00:01:52.590 --> 00:01:55.430
related to CrowdStrike as far as I know. They're different companies.
31
00:01:55.450 --> 00:01:57.140
They just have a similar name.
32
00:01:57.189 --> 00:02:01.980
They just have a very close name. So, needless to say,
33
00:02:02.000 --> 00:02:07.120
an attacker stole 170 private GitHub repos from French security
34
00:02:07.180 --> 00:02:12.919
firm CrowdSec. The problem with this is... As we know,
35
00:02:13.180 --> 00:02:16.750
as a cybersecurity firm, our private repos have some pretty
36
00:02:16.789 --> 00:02:19.550
damaging stuff in there. They have some pretty high-end, you know,
37
00:02:19.750 --> 00:02:22.990
offensive cyber weapons. We have some, you know, really nice
38
00:02:23.030 --> 00:02:23.789
harnesses for.
39
00:02:23.659 --> 00:02:28.740
AI, like stuff... Crazy photos. We wouldn't want... Sure. Blackmail stuff,
40
00:02:28.780 --> 00:02:30.539
you know... Tease the criminals.
41
00:02:31.740 --> 00:02:33.409
Go ahead, Dwayne. Tease them.
42
00:02:33.669 --> 00:02:35.710
I mean, there's nuclear codes in there.
43
00:02:35.729 --> 00:02:39.990
Yeah, absolutely. We know where Jimmy Hoffa is. I saw
44
00:02:40.009 --> 00:02:41.719
Jimmy the other day. He's doing great.
45
00:02:41.810 --> 00:02:45.840
You know, anyone under 40 or even maybe 50 doesn't
46
00:02:45.879 --> 00:02:47.319
know what the hell you're talking about.
47
00:02:47.340 --> 00:02:50.020
How about Tupac? Is that more? There you go. It's
48
00:02:50.090 --> 00:02:51.090
pertinent now, I guess.
49
00:02:52.610 --> 00:02:59.430
So, this story distills down to there was an ex-employee who,
50
00:02:59.770 --> 00:03:02.560
you know, obviously didn't work for the organization anymore, got
51
00:03:02.620 --> 00:03:07.639
his computer compromised. And in the compromise, just happened to
52
00:03:07.680 --> 00:03:09.180
still have OAuth tokens.
53
00:03:09.340 --> 00:03:09.520
Yeah.
54
00:03:10.939 --> 00:03:15.229
To crowd sex uh crowd sex i mean that shame it's.
55
00:03:15.150 --> 00:03:17.530
Not shame on him i mean he yeah he shouldn't
56
00:03:17.550 --> 00:03:19.810
have gotten owned but yeah it's shame on the company
57
00:03:19.849 --> 00:03:21.750
for not out processing.
58
00:03:21.129 --> 00:03:23.789
Correctly yeah not changing the off codes and all of
59
00:03:23.849 --> 00:03:26.159
that stuff that you do when you let an employee go.
60
00:03:26.379 --> 00:03:28.819
Exactly right well here's the problem with that if you
61
00:03:28.860 --> 00:03:31.379
don't have a process for that and i know i'd
62
00:03:31.419 --> 00:03:34.379
say if i had to guess 70% of the organizations
63
00:03:34.439 --> 00:03:37.939
on the planet don't have a process for off-boarding employees
64
00:03:38.090 --> 00:03:38.990
and contractors.
65
00:03:39.110 --> 00:03:41.490
I just think the process is when the sun envelops
66
00:03:41.530 --> 00:03:44.449
the earth. Yeah, it'll all go away. Eventually, it'll all
67
00:03:44.469 --> 00:03:44.889
go away.
68
00:03:45.449 --> 00:03:49.080
Is it off-boarding or out-boarding? Or is it motorboating? I
69
00:03:49.099 --> 00:03:49.919
don't know.
70
00:03:49.939 --> 00:03:52.939
Well, you onboard somebody, so I'd imagine it's off-boarding.
71
00:03:53.020 --> 00:03:54.020
Okay, on-off.
72
00:03:54.099 --> 00:03:55.889
At least that's what I hear in the in the
73
00:03:55.990 --> 00:03:58.789
biz most of the time. But if you think about it, like, okay,
74
00:03:58.830 --> 00:04:01.990
so listen, we're going to get rid of an employee.
75
00:04:02.169 --> 00:04:04.849
It's real, like HR has this down. We know when
76
00:04:04.879 --> 00:04:07.259
your final check is coming. We know, you know, how
77
00:04:07.300 --> 00:04:10.020
much you're getting paid out for vacation. Like they have
78
00:04:10.099 --> 00:04:12.360
that down to a science. They don't keep paying you.
79
00:04:12.439 --> 00:04:14.000
How many U-Haul boxes you get.
80
00:04:14.020 --> 00:04:15.599
They don't keep paying you. Yeah.
81
00:04:16.550 --> 00:04:19.709
Although in some organizations they do, but that's beside the point.
82
00:04:20.389 --> 00:04:22.959
But from a tech standpoint, I can't tell you how
83
00:04:23.019 --> 00:04:27.459
many times we run into a former employee still has
84
00:04:27.519 --> 00:04:30.439
keys to the kingdom, still has API keys, still has...
85
00:04:30.680 --> 00:04:33.100
And they have no process for rotating them or keeping
86
00:04:33.120 --> 00:04:34.680
track of whoever had them.
87
00:04:34.939 --> 00:04:37.980
I mean, you and I have been talking for 20
88
00:04:37.980 --> 00:04:42.089
plus years about service accounts. When an employee leaves and
89
00:04:42.129 --> 00:04:45.029
they have a service account, we've even seen it where
90
00:04:45.410 --> 00:04:49.480
a service account for a major service... Is running under
91
00:04:49.500 --> 00:04:53.220
the credentials of an IT user. Yeah. And so that's
92
00:04:53.259 --> 00:04:57.569
their excuse. Oh, well, we can't delete Carl's account because
93
00:04:57.610 --> 00:05:01.250
it's running our X server, our Postgres server. Yeah.
94
00:05:01.790 --> 00:05:04.209
Even though he doesn't work here anymore and we fired
95
00:05:04.250 --> 00:05:06.430
him because he hates us and we hate him.
96
00:05:06.470 --> 00:05:08.089
And we don't know his password.
97
00:05:08.129 --> 00:05:10.339
We're going to leave his username and password here.
98
00:05:10.560 --> 00:05:14.079
I never worked for you. Yeah. I don't know if
99
00:05:14.100 --> 00:05:15.439
you hate me or not, but.
100
00:05:16.240 --> 00:05:17.300
Carl, we love you, buddy.
101
00:05:17.740 --> 00:05:18.319
All right.
102
00:05:18.339 --> 00:05:18.779
We love you.
103
00:05:20.079 --> 00:05:22.899
So, needless to say, this, I think, is a cautionary
104
00:05:22.959 --> 00:05:27.160
tale of cybersecurity has to be part of an off-boarding
105
00:05:27.220 --> 00:05:29.220
process for every organization, small or large.
106
00:05:29.279 --> 00:05:31.439
Especially when you're a security firm. Well, true.
107
00:05:31.480 --> 00:05:31.600
Yeah.
108
00:05:31.720 --> 00:05:35.910
Yeah. That's why I said there was a little irony.
109
00:05:35.970 --> 00:05:39.050
And you know what the opposite of irony is? It's wrinkly. So,
110
00:05:39.290 --> 00:05:41.449
this is not wrinkly.
111
00:05:41.990 --> 00:05:44.649
It's not wrinkly. I thought it was permanent press. It's
112
00:05:44.670 --> 00:05:46.209
like disgruntled and gruntled.
113
00:05:46.670 --> 00:05:47.230
Yeah, right.
114
00:05:47.350 --> 00:05:49.730
Anyhow. Yeah.
115
00:05:49.790 --> 00:05:53.709
So, just the irony of, oh, a security firm. Oh,
116
00:05:53.750 --> 00:05:56.509
don't worry about it. We could trust this guy completely.
117
00:05:57.000 --> 00:05:58.779
We don't have to clean up after him.
118
00:05:58.939 --> 00:06:01.180
I mean, one of the excuses, it's not a good excuse,
119
00:06:01.300 --> 00:06:04.139
but it's one of the excuses is, well, they may
120
00:06:04.199 --> 00:06:07.699
come back as a contractor or we may need them
121
00:06:07.800 --> 00:06:12.829
to do something later on. Again, it's just bad excuses.
122
00:06:13.110 --> 00:06:15.550
Yeah, it's not an excuse. They should be off-boarded and
123
00:06:15.589 --> 00:06:18.089
then on-boarded again with new keys.
124
00:06:18.129 --> 00:06:19.949
It's not an acceptable excuse. It is an excuse.
125
00:06:20.290 --> 00:06:22.350
It's a bad excuse. There you go. Yeah.
126
00:06:22.670 --> 00:06:23.310
No excuse, sir.
127
00:06:23.370 --> 00:06:25.470
Yeah, and just to be clear, like Patrick had said,
128
00:06:25.529 --> 00:06:28.449
this isn't CrowdStrike. This is CrowdSec. They are an open-source,
129
00:06:28.470 --> 00:06:33.509
community-driven cybersecurity platform that detects, blocks, and shares information about
130
00:06:33.569 --> 00:06:34.420
malicious IPs.
131
00:06:35.360 --> 00:06:36.060
One would think.
132
00:06:39.060 --> 00:06:41.470
Soon to be their own. Apparently, they needed to add
133
00:06:41.550 --> 00:06:44.569
one more IP to that list. Yeah.
134
00:06:44.709 --> 00:06:51.990
All right. We moved on. Oracle launches Java 27 featuring
135
00:06:52.250 --> 00:06:56.370
hybrid post-quantum cryptography for TLS 1.3.
136
00:06:56.370 --> 00:07:00.860
I love this story. So, this is good news. So, basically,
137
00:07:00.889 --> 00:07:03.519
we're starting to see the trickle into the ecosystems where
138
00:07:04.160 --> 00:07:07.540
they're updating their libraries to be quantum safe. Now, in
139
00:07:07.560 --> 00:07:11.480
this case, they're implementing hybrids. So if you call on
140
00:07:11.560 --> 00:07:19.959
the libraries like javax.net.ssl, the standard APIs, you now get
141
00:07:20.519 --> 00:07:25.370
a hybrid that is both the classical encryption along with
142
00:07:25.889 --> 00:07:31.910
the new hotness, which is basically the lattice encryption that
143
00:07:31.949 --> 00:07:34.610
is now shown to be or is believed to be
144
00:07:34.769 --> 00:07:37.850
quantum safe. So a lot of people get this for free.
145
00:07:38.600 --> 00:07:41.379
It'll just be like when you upgrade. You won't even notice.
146
00:07:41.860 --> 00:07:45.379
And that's, we're hoping. And that's good news. And that's
147
00:07:45.439 --> 00:07:47.019
better than everyone having to roll their own. So, we
148
00:07:47.060 --> 00:07:49.420
need more vendors to do this. We need more people.
149
00:07:49.800 --> 00:07:52.639
But this also speaks to the thing. If you rolled
150
00:07:52.680 --> 00:07:55.740
your own encryption. Slap yourself. You're an idiot.
151
00:07:55.779 --> 00:07:56.019
Yeah.
152
00:07:56.220 --> 00:08:01.629
But, I mean, we've always said that. It's like at-home dentistry. Yeah,
153
00:08:01.670 --> 00:08:04.110
you can do it. Just as good an idea. Only
154
00:08:04.149 --> 00:08:04.850
the mob does it.
155
00:08:05.240 --> 00:08:07.990
Yeah so don't write your own database don't write your
156
00:08:08.050 --> 00:08:10.100
own network protocols.
157
00:08:09.850 --> 00:08:12.410
Yeah so but if you did now you have to
158
00:08:12.470 --> 00:08:14.949
go and do this heavy lifting and if you don't
159
00:08:15.209 --> 00:08:17.470
then and you rely on industry standards like this then
160
00:08:17.790 --> 00:08:22.269
so this is great news um so this standardized the
161
00:08:22.430 --> 00:08:26.449
the key encapsulation mechanism called ml chem which used to
162
00:08:26.470 --> 00:08:31.029
be called crystals kyber right and And Dilithium, I love
163
00:08:31.069 --> 00:08:36.500
these names, is now MLDSA. And DSA is for digital signing.
164
00:08:36.600 --> 00:08:41.519
So the public-private key thing, the encryption is done by Kyber.
165
00:08:42.399 --> 00:08:44.700
The signatures are done by Dilithium. They got the new
166
00:08:44.759 --> 00:08:47.399
formal names. I'll always call them by the old names. Well, yeah.
167
00:08:47.639 --> 00:08:50.100
And now it's rolled in. And so if you upgrade
168
00:08:50.139 --> 00:08:55.440
to TLS 1.3, then you're starting to protect against the
169
00:08:55.480 --> 00:08:57.879
harvest now, decrypt later attacks.
170
00:08:58.389 --> 00:09:01.830
So, what occurs to me is this is the third story,
171
00:09:01.990 --> 00:09:04.549
and we haven't talked about the other two yet, this week,
172
00:09:05.080 --> 00:09:08.519
that have to do with upgrades. Yeah. Isn't that interesting?
173
00:09:08.539 --> 00:09:08.860
There's a theme.
174
00:09:08.879 --> 00:09:10.879
There's a lot going on this week. Almost as if
175
00:09:10.940 --> 00:09:11.500
we planned it.
176
00:09:12.740 --> 00:09:16.200
We're still not saying you shouldn't automatically upgrade, but there
177
00:09:16.259 --> 00:09:18.080
are issues this week.
178
00:09:18.970 --> 00:09:19.159
Yeah.
179
00:09:19.679 --> 00:09:23.509
All right. So, that's good. This is a happy story, Patrick.
180
00:09:23.769 --> 00:09:23.990
It is.
181
00:09:24.309 --> 00:09:26.779
I'm very happy. That you guys allowed me to bring
182
00:09:26.820 --> 00:09:29.139
this one in and didn't cut it. Take that on
183
00:09:29.159 --> 00:09:31.799
your other podcast, Patrick. Jeez. This is how you pay
184
00:09:31.840 --> 00:09:33.059
me in quantum stores.
185
00:09:33.460 --> 00:09:36.879
So this one, this next one, this Windows malware is
186
00:09:36.919 --> 00:09:39.679
built to let up to four AI models vote on
187
00:09:39.759 --> 00:09:40.519
its next move.
188
00:09:40.899 --> 00:09:41.120
So.
189
00:09:41.220 --> 00:09:43.830
This one is not an upgrade issue, but it is
190
00:09:43.919 --> 00:09:48.429
really interesting. Like malware now that calls out for help
191
00:09:48.990 --> 00:09:52.409
to AI models to help it decide what is the
192
00:09:52.450 --> 00:09:55.679
most evil next move. Thing that I could do to
193
00:09:55.679 --> 00:09:57.200
infect this system.
194
00:09:57.200 --> 00:09:59.929
Right? I like it. This thing's awesome.
195
00:09:59.929 --> 00:10:01.149
It's just not right.
196
00:10:01.629 --> 00:10:02.129
So cool.
197
00:10:02.470 --> 00:10:05.100
But you know what? This is a human problem. This
198
00:10:05.120 --> 00:10:06.580
is the people that wrote the malware.
199
00:10:06.889 --> 00:10:09.320
Yeah. Yeah, absolutely. They're losing the tools.
200
00:10:09.799 --> 00:10:10.639
Yeah. So.
201
00:10:11.899 --> 00:10:13.580
this poses a couple of different problems.
202
00:10:14.259 --> 00:10:16.419
Um, first off, like I love the picture on here
203
00:10:16.490 --> 00:10:19.669
cause it has like chat GPT and it has meta
204
00:10:19.690 --> 00:10:22.509
and whatever. And a lot of those have guardrails around
205
00:10:22.889 --> 00:10:24.929
how should I infect this system? It's not something you
206
00:10:24.970 --> 00:10:27.269
can ask the API, but, but the ones that they're
207
00:10:27.330 --> 00:10:31.929
actually using are like deep seek minstrel, um, you know,
208
00:10:31.990 --> 00:10:34.149
Gemini Talos. So some of the ones that they can
209
00:10:34.250 --> 00:10:36.340
actually kind of, yeah. So some of the ones they
210
00:10:36.360 --> 00:10:40.269
have a little bit more control over, um, But the
211
00:10:40.330 --> 00:10:43.649
interesting part is not necessarily like, hey, this quorum of AI,
212
00:10:43.690 --> 00:10:46.250
which actually really kind of is an interesting way to go.
213
00:10:46.289 --> 00:10:49.830
It's almost like, you know, a mixture of experts type
214
00:10:49.889 --> 00:10:51.789
thing for how do I infect this? Or what's the
215
00:10:51.809 --> 00:10:54.350
best way to move, right? Should I laterally move? Here's
216
00:10:54.370 --> 00:10:57.009
what I'm seeing in the environment. Should I infect the system?
217
00:10:57.029 --> 00:10:58.000
Should I encrypt the system?
218
00:10:58.019 --> 00:10:58.639
Whatever, right?
219
00:10:58.700 --> 00:11:01.379
So, neat way to use this. But the more sort
220
00:11:01.419 --> 00:11:05.840
of insidious thing is the fact that it's leveraging this
221
00:11:05.899 --> 00:11:07.080
as a command and control stream.
222
00:11:07.830 --> 00:11:08.110
Right?
223
00:11:08.169 --> 00:11:11.529
So, you know, you, you look for the odd communications
224
00:11:11.590 --> 00:11:13.559
off your network. You look for maybe a lot of
225
00:11:13.580 --> 00:11:15.820
DNS traffic. We look for all sorts of the, the
226
00:11:15.860 --> 00:11:19.679
classic ways that command and control how an attacker would
227
00:11:19.720 --> 00:11:23.419
control a remote implant or a piece of malware and
228
00:11:23.470 --> 00:11:26.970
making queries out to AI at this point is so ubiquitous.
229
00:11:27.690 --> 00:11:30.889
It actually might be pretty hard to see this traffic
230
00:11:30.950 --> 00:11:33.070
and extrapolate it from the rest of your users.
231
00:11:33.629 --> 00:11:33.870
Right.
232
00:11:34.289 --> 00:11:38.539
Um, Now, there's a side channel here, not the kind
233
00:11:38.580 --> 00:11:42.480
I like, but just a side communications channel where everything
234
00:11:42.500 --> 00:11:45.600
that happens and every decision that's made is actually pumped
235
00:11:45.639 --> 00:11:48.720
out to a Discord channel so that the attackers can
236
00:11:48.899 --> 00:11:52.820
monitor what's going on and can see the questions being
237
00:11:52.879 --> 00:11:56.820
asked and the decisions being made by the AIs. So,
238
00:11:56.860 --> 00:12:00.399
maybe that's a way to identify it. Like an indicator is, hey,
239
00:12:00.460 --> 00:12:03.970
maybe we monitor. I don't know a lot of businesses
240
00:12:04.000 --> 00:12:04.919
that use Discord.
241
00:12:05.299 --> 00:12:05.559
Yeah.
242
00:12:05.700 --> 00:12:11.059
For business communications, it's usually Slack or it's Teams. But,
243
00:12:11.200 --> 00:12:12.759
you know, not generally Discord.
244
00:12:12.940 --> 00:12:13.419
I know, right?
245
00:12:14.659 --> 00:12:16.950
Unless I was running a gaming company, then it's Discord
246
00:12:16.970 --> 00:12:20.370
all the way. Although, oddly enough, Pulsar Security does have
247
00:12:20.409 --> 00:12:21.009
its own Discord.
248
00:12:21.029 --> 00:12:21.549
So, whatever.
249
00:12:21.730 --> 00:12:21.909
Right.
250
00:12:23.149 --> 00:12:25.289
Some companies do it, but most don't.
251
00:12:25.350 --> 00:12:26.730
Well, the difference is you're not evil.
252
00:12:27.049 --> 00:12:28.029
Right. Exactly.
253
00:12:28.669 --> 00:12:31.169
But if you're monitoring your network and you see a
254
00:12:31.250 --> 00:12:33.929
lot of Discord traffic, it might not be a bad
255
00:12:33.970 --> 00:12:37.519
idea to block that anyways. But you heard it here first.
256
00:12:37.539 --> 00:12:39.980
This is the first time that command and control has
257
00:12:40.000 --> 00:12:43.600
been done through AI and a mixture of experts in
258
00:12:43.740 --> 00:12:47.590
AI are making decisions on how to mess up your network.
259
00:12:47.850 --> 00:12:49.669
Well, at least as far as we know. We haven't
260
00:12:49.710 --> 00:12:50.690
heard of one yet.
261
00:12:50.710 --> 00:12:51.110
That's true.
262
00:12:51.649 --> 00:12:52.450
Publicly disclosed.
263
00:12:52.490 --> 00:12:52.710
Right.
264
00:12:52.889 --> 00:12:58.070
Okay. CISA orders feds to patch Zyzel flaw exploited for
265
00:12:58.129 --> 00:13:01.850
data theft. And that's Z-Y-X-E-L. I don't even know if
266
00:13:01.909 --> 00:13:03.009
I'm pronouncing it correctly.
267
00:13:03.250 --> 00:13:07.789
Close enough. Isn't that the medicine with the owl mask on?
268
00:13:08.009 --> 00:13:08.750
If you can't sleep.
269
00:13:09.669 --> 00:13:10.169
Zizel.
270
00:13:10.230 --> 00:13:12.179
Is it the difference in A versus an E?
271
00:13:12.700 --> 00:13:15.240
Don't take Zizel if you're allergic to it. Have you
272
00:13:15.279 --> 00:13:20.720
heard this new disclaimer on all these medications? What the dumbest...
273
00:13:19.899 --> 00:13:22.289
Wait a second. Don't take it if you're allergic to it.
274
00:13:22.570 --> 00:13:24.200
How do I know if I'm allergic to it?
275
00:13:24.570 --> 00:13:26.289
Take it. We'll find out. Well, you take it. And
276
00:13:26.350 --> 00:13:28.789
if you die, you're allergic to it. You were allergic
277
00:13:28.809 --> 00:13:29.330
to it.
278
00:13:29.649 --> 00:13:32.100
And you cannot sue if you're dead because you're allergic.
279
00:13:33.500 --> 00:13:33.980
Good Lord.
280
00:13:34.860 --> 00:13:37.940
So, back to the story. Zyzel in this particular case
281
00:13:38.059 --> 00:13:45.049
is network switching infrastructure. So, think like Cisco switches, right?
282
00:13:45.549 --> 00:13:47.370
How you're routing traffic. And a lot of these things
283
00:13:47.429 --> 00:13:51.929
may actually have to be. accessible on the internet, right?
284
00:13:52.470 --> 00:13:54.389
It could be the backbone of your infrastructure where you
285
00:13:54.409 --> 00:13:56.710
plug your firewall in and all sorts of other things. So,
286
00:13:57.389 --> 00:14:00.149
it's not uncommon to get access to these things remotely.
287
00:14:01.360 --> 00:14:07.000
This flaw stems from a stack-based overflow in the CGI program.
288
00:14:07.220 --> 00:14:11.490
That would not be computer graphics imaging, right? CGI.
289
00:14:11.649 --> 00:14:12.169
It is not.
290
00:14:12.190 --> 00:14:15.590
You know, all of our listeners who are probably, you know,
291
00:14:15.669 --> 00:14:19.299
younger than 35, if you search CGI, you will not
292
00:14:19.360 --> 00:14:21.960
find this CGI because it's, I don't know, was it
293
00:14:22.019 --> 00:14:23.029
invented in the 80s?
294
00:14:23.779 --> 00:14:27.139
Has to have been. Yeah, I mean, I was in
295
00:14:27.159 --> 00:14:29.759
my 20s when I learned of it. And so, this
296
00:14:29.850 --> 00:14:34.669
is Common Gateway Interface. And it was the first way, really,
297
00:14:34.889 --> 00:14:40.799
that you could have a program respond to input on
298
00:14:41.299 --> 00:14:45.960
HTTP and typically written in Perl or some other language
299
00:14:46.000 --> 00:14:49.690
like that. And the CGI just, I remember this cause
300
00:14:49.730 --> 00:14:53.049
I wrote stuff on it. It used standard in and
301
00:14:53.090 --> 00:14:56.250
standard out to talk to an executable that was running
302
00:14:56.570 --> 00:14:59.590
probably in full security context. Oh yeah. I mean, full
303
00:14:59.649 --> 00:15:02.330
public context running on your machine.
304
00:15:02.509 --> 00:15:04.309
I used to love CGI. It was the easy way
305
00:15:04.350 --> 00:15:05.529
to take over every server.
306
00:15:05.960 --> 00:15:06.149
Right.
307
00:15:06.529 --> 00:15:09.590
Like, if you had an executable running under CGI or
308
00:15:09.629 --> 00:15:12.210
a script... So, imagine this interface that sits on a
309
00:15:12.250 --> 00:15:15.220
web server, if you will, that you can run programs. Like,
310
00:15:15.250 --> 00:15:19.399
doesn't that sound fantastic as an attacker? Apparently, these switches
311
00:15:19.500 --> 00:15:23.720
still use CGI. And apparently, there is a buffer overflow
312
00:15:23.759 --> 00:15:27.379
that allows for code execution. So, if you're running any
313
00:15:27.399 --> 00:15:31.649
of these GS19 switches, the 8.8 HP, blah, blah, blah,
314
00:15:31.669 --> 00:15:35.179
there's a whole list. Associated with the article, you are
315
00:15:35.259 --> 00:15:37.929
going to want to patch and get rid of the
316
00:15:38.690 --> 00:15:42.250
ability for anybody to run CGI and get access to
317
00:15:42.289 --> 00:15:42.629
your Switch.
318
00:15:43.289 --> 00:15:45.509
Yeah. So, not good.
319
00:15:45.950 --> 00:15:46.210
All right.
320
00:15:46.230 --> 00:15:48.149
Well, this seems like a good place to take a break. So,
321
00:15:48.200 --> 00:15:50.539
we'll be right back after these very important messages. Don't
322
00:15:50.559 --> 00:15:57.240
go away. And we're back. It's Security This Week. Carl, Dwayne,
323
00:15:57.259 --> 00:16:02.070
and Patrick for you. This next story, Shiny Hunter's Target
324
00:16:02.210 --> 00:16:07.600
Oracle PeopleSoft in large-scale data theft campaign. Oh, no. Those
325
00:16:07.710 --> 00:16:09.529
shiny hunters are up to no good again.
326
00:16:09.629 --> 00:16:10.470
Man, they're busy.
327
00:16:10.700 --> 00:16:10.980
They are.
328
00:16:11.000 --> 00:16:14.320
The shiny hunters. Yeah, how do you find the time, Dwayne?
329
00:16:14.559 --> 00:16:17.240
I know, right? I mean, between my day job and
330
00:16:17.259 --> 00:16:17.759
this podcast.
331
00:16:17.779 --> 00:16:18.379
I'm swamped.
332
00:16:18.950 --> 00:16:21.110
Exactly. You ordered a frame for it?
333
00:16:22.889 --> 00:16:26.809
My button-pushing finger is killing me.
334
00:16:27.309 --> 00:16:32.629
Yeah, so this was actually, I believe, announced June 10th. Yeah,
335
00:16:32.669 --> 00:16:36.629
disclosed by Oracle PeopleSoft Environments. that are focused, there's an
336
00:16:36.870 --> 00:16:40.690
active data theft and extortion, easy for me to say,
337
00:16:40.769 --> 00:16:45.509
campaign disclosed on June 10th. So, the shiny hunters have
338
00:16:46.029 --> 00:16:51.169
been exploiting this and say they have compromised more than
339
00:16:51.169 --> 00:16:56.919
100 organizations with this exploit. One of the claims that
340
00:16:56.960 --> 00:17:00.009
they have here is that they've also claimed that they've
341
00:17:00.309 --> 00:17:02.490
exploited and compromised the FBI.
342
00:17:02.509 --> 00:17:03.309
Ooh.
343
00:17:03.450 --> 00:17:09.839
Digging deep, however, doing my investigative journalism, it doesn't actually
344
00:17:09.880 --> 00:17:12.589
look like they compromised the FBI. There's no evidence of it.
345
00:17:12.619 --> 00:17:13.740
They say they have.
346
00:17:13.759 --> 00:17:13.819
No.
347
00:17:14.319 --> 00:17:18.190
They did deface one of the FBI job sites. Through
348
00:17:18.230 --> 00:17:21.079
this exploit, but they didn't have access to any internal stuff.
349
00:17:21.119 --> 00:17:22.640
I was going to say, I thought it was, you know,
350
00:17:22.819 --> 00:17:25.160
Fred's Bistro Incorporated or something, you know.
351
00:17:25.579 --> 00:17:31.509
Fred's Bistro, the FBI. So, although one of their sort
352
00:17:31.569 --> 00:17:36.710
of publicly facing systems was defaced by this exploit, no
353
00:17:36.759 --> 00:17:40.410
real risk here of them actually getting anything sensitive. It
354
00:17:40.470 --> 00:17:42.710
is interesting, though, to say that the– they say the
355
00:17:42.769 --> 00:17:47.670
threat actors reportedly used a gadget chain combining older vulnerabilities
356
00:17:47.769 --> 00:17:49.130
and zero-day flaws.
357
00:17:50.670 --> 00:17:52.630
A gadget chain meaning devices?
358
00:17:52.869 --> 00:17:53.190
Yeah.
359
00:17:53.309 --> 00:17:58.890
So, no, not really. Actually, so, a gadget in exploitation
360
00:17:58.950 --> 00:18:05.250
speak can be anything from a particular exploit– To a
361
00:18:05.369 --> 00:18:08.589
particular set of opcodes in assembly.
362
00:18:08.890 --> 00:18:09.190
Wow.
363
00:18:09.329 --> 00:18:12.990
So, I can say, I want to chain an exploit
364
00:18:13.349 --> 00:18:16.579
to break into this piece of software and I need
365
00:18:16.599 --> 00:18:19.660
to grab a gadget, a small little move from one
366
00:18:19.880 --> 00:18:22.380
piece of software and then, you know, a jump from
367
00:18:22.420 --> 00:18:24.240
another piece of software and so on and so forth.
368
00:18:24.619 --> 00:18:28.599
And I stitch together these gadgets, chain them in a
369
00:18:28.640 --> 00:18:30.200
way that allows me to get execution.
370
00:18:30.220 --> 00:18:30.500
Mm-hmm.
371
00:18:30.779 --> 00:18:31.759
Um so how can we.
372
00:18:31.660 --> 00:18:34.869
Have done 200 some odd shows and i never knew
373
00:18:34.930 --> 00:18:36.529
this term before.
374
00:18:36.089 --> 00:18:38.170
Of the gadget and it's one of the reasons i
375
00:18:38.190 --> 00:18:40.690
actually like this article um because it's like they you
376
00:18:40.710 --> 00:18:42.950
know shiny hunters compromising things yeah i get it but
377
00:18:43.710 --> 00:18:45.990
uh but yeah the gadget chain is an interesting concept
378
00:18:46.079 --> 00:18:49.839
from uh from an exploitation standpoint it's where you have
379
00:18:49.880 --> 00:18:51.700
little pieces it's almost like think of it this way
380
00:18:52.359 --> 00:18:56.750
you ever see a ransom letter on like TV where
381
00:18:56.769 --> 00:18:57.630
the guy cuts out.
382
00:18:57.690 --> 00:18:59.339
Oh, sure. They cut the letters out.
383
00:18:59.390 --> 00:19:01.700
Like little letters out of a magazine. Yeah.
384
00:19:02.119 --> 00:19:05.519
It's the same exact thing. Like hackers cut out little
385
00:19:05.579 --> 00:19:08.559
pieces of programs that they need and stitch them together
386
00:19:08.680 --> 00:19:09.420
off the live system.
387
00:19:09.619 --> 00:19:13.799
Are they necessarily programs or could they be configuration errors or?
388
00:19:13.819 --> 00:19:15.380
Yeah, all of the above.
389
00:19:15.400 --> 00:19:17.440
They could be configuration errors, they could be exploits, they
390
00:19:17.460 --> 00:19:19.859
could be all the way down to such a minute
391
00:19:19.940 --> 00:19:23.210
thing as I'm going to reach in a notepad and
392
00:19:23.250 --> 00:19:28.039
I'm going to grab this small two op assembly code
393
00:19:28.319 --> 00:19:31.940
out of the thousandth line of notepad from the raw
394
00:19:32.180 --> 00:19:32.980
computer assembly.
395
00:19:33.220 --> 00:19:37.140
So, by themselves, these things aren't harmless, but put together
396
00:19:37.180 --> 00:19:37.980
in an evil way.
397
00:19:38.240 --> 00:19:41.109
Is it a higher level of ROP chaining? So, yes.
398
00:19:41.220 --> 00:19:43.529
Well, lower level. Think of it more as lower level.
399
00:19:43.549 --> 00:19:47.380
Like ROP chains, which is return oriented programming is where
400
00:19:47.460 --> 00:19:50.680
I actually will call into a small portion of code
401
00:19:51.960 --> 00:19:54.210
on the stack and have it then jump back out
402
00:19:54.230 --> 00:19:56.710
to me in a place that I want it to. So,
403
00:19:56.849 --> 00:20:01.049
return-oriented exploitation is I'm going to let a small function
404
00:20:01.170 --> 00:20:05.730
actually run to completion, whereas a gadget maybe I'm just
405
00:20:05.769 --> 00:20:09.869
stealing a small piece of, you know, code. So, it
406
00:20:09.910 --> 00:20:14.210
can be more microscopic or macroscopic depending on how big
407
00:20:14.410 --> 00:20:16.700
or small you want that gadget. But yeah, ROP chaining
408
00:20:16.740 --> 00:20:17.200
falls in there.
409
00:20:17.480 --> 00:20:17.799
Okay.
410
00:20:17.900 --> 00:20:19.359
So, we've talked about ROP chaining before.
411
00:20:19.500 --> 00:20:22.319
It seems like this gadget chaining would be something where
412
00:20:22.339 --> 00:20:25.759
you want your exploit to be dynamic. In other words...
413
00:20:25.920 --> 00:20:28.420
You don't want to write all the code ahead of
414
00:20:28.480 --> 00:20:31.359
time and then sicken on something, right? You want it
415
00:20:31.480 --> 00:20:36.500
to assemble the code or whatever that's going to run dynamically.
416
00:20:36.619 --> 00:20:38.400
Well, it's part of living off the land, isn't it?
417
00:20:38.420 --> 00:20:40.640
When you can't write to the system. Yeah.
418
00:20:40.700 --> 00:20:43.900
And it's also part of bypassing some of the like
419
00:20:44.019 --> 00:20:46.559
endpoint detection systems and that sort of stuff where it's like, well,
420
00:20:46.579 --> 00:20:48.569
I'm not sure what the base memory address of this
421
00:20:48.589 --> 00:20:51.009
thing is going to be. But if I call these
422
00:20:51.089 --> 00:20:53.910
two particular small chain things, then I can figure out
423
00:20:53.930 --> 00:20:57.369
where it is. So sometimes it is, yeah, Carl, it's
424
00:20:57.440 --> 00:20:59.609
how do I get this thing to dynamically stitch on
425
00:20:59.630 --> 00:21:02.950
the remote system, not knowing exactly where programs are running.
426
00:21:03.190 --> 00:21:03.390
Right.
427
00:21:03.529 --> 00:21:09.250
Interesting. Okay. So remember we were talking about the upgrade-oriented
428
00:21:09.589 --> 00:21:15.220
hacks or problems? This is number two. Public POC exposes
429
00:21:15.359 --> 00:21:20.619
critical Veeam agent privilege escalation. And I'm not sure if
430
00:21:20.680 --> 00:21:22.960
this is the same thing, but I did read this
431
00:21:23.039 --> 00:21:29.599
week that Patch Tuesday compromised Windows backup. And I'm not
432
00:21:29.680 --> 00:21:34.480
sure if this is exactly the same story, but this
433
00:21:34.559 --> 00:21:36.680
is a Veeam endpoint backup service.
434
00:21:36.720 --> 00:21:39.849
Yeah, so this is Veeam. I haven't seen any connection
435
00:21:39.880 --> 00:21:41.509
between the two, but maybe there is.
436
00:21:41.910 --> 00:21:42.190
Maybe.
437
00:21:42.390 --> 00:21:48.220
Yeah, so it's just a bad week for backup services, but... Yeah,
438
00:21:48.240 --> 00:21:51.839
in this particular one, it's a critical local privilege escalation
439
00:21:51.880 --> 00:21:56.049
vulnerability in any Veeam agent running on a Windows server.
440
00:21:57.390 --> 00:22:00.789
And it is actively being exploited. And there is a
441
00:22:00.869 --> 00:22:03.509
proof of concept as of September 22nd that's out there
442
00:22:03.529 --> 00:22:06.329
that is super simple to run. Whoever runs it on
443
00:22:06.349 --> 00:22:08.470
a Windows box gets full system level privileges.
444
00:22:08.960 --> 00:22:09.900
Yikes.
445
00:22:10.400 --> 00:22:14.440
And Veeam, for people who may or may not know Veeam,
446
00:22:14.559 --> 00:22:18.960
Veeam backup agents are running pretty ubiquitously on almost any
447
00:22:19.579 --> 00:22:25.279
Windows system. So if you're running the Veeam infrastructure in
448
00:22:25.319 --> 00:22:28.769
your environment, most likely you're running these agents on most
449
00:22:28.809 --> 00:22:30.680
of your Windows servers. So you are going to want
450
00:22:30.700 --> 00:22:31.309
to make sure you patch.
451
00:22:31.329 --> 00:22:33.890
We've also said many times in the past, you guys
452
00:22:33.910 --> 00:22:40.359
have said, that backup systems are particularly vulnerable because they
453
00:22:40.539 --> 00:22:43.680
usually run with system level privileges. Oh, yeah. And so,
454
00:22:43.700 --> 00:22:44.440
they're a really.
455
00:22:44.460 --> 00:22:46.059
They're a nice target.
456
00:22:46.079 --> 00:22:46.779
A nice target.
457
00:22:46.819 --> 00:22:50.390
And they have this really sassy ability, usually the accounts
458
00:22:50.430 --> 00:22:53.690
where we can request backup rights, which means you can
459
00:22:53.750 --> 00:22:56.349
touch any file, you can do all sorts of things
460
00:22:56.390 --> 00:22:59.609
with files and not actually be audited by any auditing systems.
461
00:22:59.650 --> 00:22:59.890
Wow.
462
00:22:59.930 --> 00:23:03.119
And they're usually run under the credentials of a guy
463
00:23:03.130 --> 00:23:07.319
named randy who hasn't worked there in eight years.
464
00:23:08.500 --> 00:23:12.220
Ah funny yeah i miss randy all right so so
465
00:23:12.240 --> 00:23:15.180
there's a public poc there's a patch i take it.
466
00:23:15.220 --> 00:23:17.660
There is yeah go out and patch uh and look
467
00:23:17.680 --> 00:23:19.700
for the article will explain some of the indicators of
468
00:23:19.740 --> 00:23:21.579
compromise if you need to be worried about you know
469
00:23:21.839 --> 00:23:22.440
what you might.
470
00:23:22.619 --> 00:23:23.769
What may have happened.
471
00:23:23.809 --> 00:23:27.029
Okay now this is a new one on me ascii
472
00:23:27.150 --> 00:23:31.849
smuggling crosses over from AI prompt injection to phishing evasion.
473
00:23:32.069 --> 00:23:33.170
What's old is new again.
474
00:23:33.809 --> 00:23:35.009
What the heck is ASCII smoke?
475
00:23:35.170 --> 00:23:38.369
So, we've talked about prompt injection in the past where
476
00:23:38.809 --> 00:23:41.849
you- Can we just take a second and realize- Please.
477
00:23:41.950 --> 00:23:47.430
Patrick is talking about prompt injection as old. Like, you know,
478
00:23:47.490 --> 00:23:52.470
back a thousand, like, maybe nine months ago when this
479
00:23:52.509 --> 00:23:55.630
was happening. And it's like an eon ago, but continue, sorry.
480
00:23:55.670 --> 00:23:57.490
Yes. Back in the dawn of time.
481
00:23:57.759 --> 00:23:57.890
Yeah.
482
00:23:58.700 --> 00:24:04.329
Uh, you know, uh, I feel like Mad Max, you know, um, you,
483
00:24:04.589 --> 00:24:06.670
if you wanted to get a prompt in, then you
484
00:24:06.730 --> 00:24:10.450
could take a word and you could put ASCII in
485
00:24:10.630 --> 00:24:14.369
the middle of it. That's not visible. So that the,
486
00:24:14.789 --> 00:24:17.269
you know, the, the, the checkers wouldn't be able to
487
00:24:17.349 --> 00:24:19.099
find the words they're looking for. So this is a,
488
00:24:19.089 --> 00:24:21.930
this is an example where when somebody is looking for
489
00:24:22.019 --> 00:24:26.279
the word, that's a mistake. So back in the old, old, old,
490
00:24:26.359 --> 00:24:30.289
old days, SQL injection. So when we first found out
491
00:24:30.309 --> 00:24:34.049
about SQL injection, now that's real old days. When we
492
00:24:34.069 --> 00:24:39.900
first found out about SQL injection, there was this idea, well,
493
00:24:39.940 --> 00:24:41.539
we'll just check for the word delete.
494
00:24:41.799 --> 00:24:42.059
Right.
495
00:24:42.299 --> 00:24:44.339
If the word delete's in the input, then that must
496
00:24:44.400 --> 00:24:47.720
mean they're trying to do something fishy. So we'll check
497
00:24:47.740 --> 00:24:51.200
for the word delete, and then we'll check for single quotes. Well,
498
00:24:51.220 --> 00:24:55.730
then if I type in D-E-L single quote E-T-E, it
499
00:24:56.630 --> 00:24:58.839
won't find the word delete. And then it'll remove the
500
00:24:58.859 --> 00:25:01.829
single quote for me. Yeah. And so I'm basically having
501
00:25:01.900 --> 00:25:07.309
their order of operations bake in my attack vector. This
502
00:25:07.369 --> 00:25:08.049
isn't that.
503
00:25:08.109 --> 00:25:09.990
They also didn't look for drop table.
504
00:25:10.809 --> 00:25:15.829
Yeah, little bobby tables. Yeah. So this is something that
505
00:25:15.869 --> 00:25:18.019
we saw in the prompt injection space. Well, now it's
506
00:25:18.059 --> 00:25:22.019
being reborn in phishing evasion because a lot of the
507
00:25:22.039 --> 00:25:24.500
phishing tools, or some of the phishing tools at least,
508
00:25:24.940 --> 00:25:28.539
are looking for words that shouldn't be you know, in
509
00:25:28.579 --> 00:25:33.339
the message. And again, they're falling back on this same thing. So,
510
00:25:33.380 --> 00:25:36.420
this means if, you know, play stupid games, win stupid prizes.
511
00:25:37.019 --> 00:25:41.180
If you're trying to out weaponize things, instead of approaching
512
00:25:41.200 --> 00:25:43.579
it from a systemic view, you're going to lose. Right.
513
00:25:43.720 --> 00:25:46.460
So, well, let's back up a little bit. ASCII smuggling
514
00:25:47.210 --> 00:25:51.089
is the use of invisible or non-rendering Unicode characters to
515
00:25:51.130 --> 00:25:53.849
hide content. So, and it says right here in the
516
00:25:53.890 --> 00:25:57.769
what is ASCII smuggling paragraph that there's a block called
517
00:25:57.789 --> 00:26:01.210
the Unicode Tags Block that contains a shadow copy of
518
00:26:01.250 --> 00:26:06.130
the printable ASCII characters, but they're invisible. Yeah. And that
519
00:26:06.190 --> 00:26:09.930
was originally intended for language tagging and is now largely deprecated.
520
00:26:10.349 --> 00:26:10.609
Yeah.
521
00:26:10.670 --> 00:26:13.569
But it's still there in the ASCII character set.
522
00:26:13.910 --> 00:26:17.210
Here's what I would say. Most communications, most letters you've
523
00:26:17.269 --> 00:26:20.750
ever written, most emails you've ever written are ASCII codes
524
00:26:20.750 --> 00:26:21.910
127 and below.
525
00:26:22.049 --> 00:26:22.609
Right. Right?
526
00:26:23.809 --> 00:26:29.130
So, like, for example... You know, a uppercase A might be,
527
00:26:29.750 --> 00:26:31.569
you know, a decimal would be 62.
528
00:26:31.569 --> 00:26:31.809
Yeah.
529
00:26:32.170 --> 00:26:36.160
So, under 127 is all the printable normal sort of characters.
530
00:26:36.200 --> 00:26:39.140
You would use uppercase, lowercase, numbers, you know, some of
531
00:26:39.160 --> 00:26:40.299
the symbols, that sort of stuff.
532
00:26:41.019 --> 00:26:41.450
But there are.
533
00:26:42.140 --> 00:26:45.099
thousands of ASCII codes, right? Because if you want the
534
00:26:45.299 --> 00:26:48.619
umlaut or you want the, you know, Euro symbol or
535
00:26:48.660 --> 00:26:49.829
you want something like that, right?
536
00:26:49.849 --> 00:26:50.569
Cyrillic letters.
537
00:26:51.150 --> 00:26:53.329
But some of them just don't make any sense. Like,
538
00:26:53.390 --> 00:26:58.339
for example, Unicode E0041 is a mirror A.
539
00:26:58.359 --> 00:26:58.819
Yeah.
540
00:26:59.019 --> 00:27:03.779
So, it looks like A, but it's flipped. That's when Dr.
541
00:27:03.819 --> 00:27:06.779
Strange wants to send email from the mirror realm. Yeah,
542
00:27:06.859 --> 00:27:09.839
like why would you have a mirror A? I don't
543
00:27:09.900 --> 00:27:13.259
even know where that would be absolutely used. I think
544
00:27:13.319 --> 00:27:15.779
there's like Finnish and things like that do have a
545
00:27:15.819 --> 00:27:16.380
backwards A.
546
00:27:16.900 --> 00:27:20.180
But a capital A is symmetrical. But it looks the same. Yeah, exactly.
547
00:27:20.200 --> 00:27:21.579
Why flip it? Well, no, it's a lowercase.
548
00:27:21.599 --> 00:27:22.660
Lowercase does not, yeah.
549
00:27:22.680 --> 00:27:25.779
Yeah, so I could see that, but like UEE0041 is
550
00:27:25.839 --> 00:27:26.630
a capital mirrored A.
551
00:27:26.680 --> 00:27:26.779
Oh.
552
00:27:26.799 --> 00:27:32.279
Which- okay that makes no sense at all.
553
00:27:32.230 --> 00:27:33.980
Like why would you and i guess it depends on
554
00:27:34.000 --> 00:27:36.660
the font and whatever but i don't know it just
555
00:27:37.140 --> 00:27:40.819
it seems like there's so much bloat in that unicode
556
00:27:40.880 --> 00:27:43.079
system that maybe maybe we should take a look at
557
00:27:43.099 --> 00:27:44.579
it and pare it down again and go well you
558
00:27:44.599 --> 00:27:46.420
know what there are certain things we shouldn't.
559
00:27:46.200 --> 00:27:49.559
Have there anymore or we should check that all of
560
00:27:49.660 --> 00:27:53.809
our inputs are within the 127 and lower range sure Right.
561
00:27:53.829 --> 00:27:54.259
That's right.
562
00:27:54.410 --> 00:27:54.630
Right.
563
00:27:54.779 --> 00:27:57.059
And then flag it and say, Hey, there's, there's, there's
564
00:27:57.079 --> 00:27:59.059
higher level Unicode here. You're going to have a.
565
00:27:59.059 --> 00:28:01.799
Much more success with that ladder strategy just because you're
566
00:28:01.839 --> 00:28:03.549
not going to get the world to agree that that
567
00:28:03.920 --> 00:28:04.869
to deprecate things.
568
00:28:05.009 --> 00:28:05.450
Right.
569
00:28:06.049 --> 00:28:06.289
Yeah.
570
00:28:06.630 --> 00:28:09.390
So this is being used in how, how is it
571
00:28:09.410 --> 00:28:14.490
being used to, um, avoid malware detection is it like
572
00:28:14.950 --> 00:28:16.490
spam filter kind of thing.
573
00:28:16.430 --> 00:28:19.650
Yeah so it's it's exactly that so like take take
574
00:28:19.690 --> 00:28:22.569
something like i write the word like buy now and
575
00:28:22.829 --> 00:28:24.710
and my spam filter is looking for that but if
576
00:28:24.779 --> 00:28:28.599
i if i use a uh you know buy now
577
00:28:28.680 --> 00:28:32.539
but it's yeah exactly but the u is backwards but
578
00:28:32.559 --> 00:28:34.700
it still looks like by now it's going to bypass
579
00:28:34.720 --> 00:28:37.559
that spam filter because it's looking it's literally breaking all
580
00:28:37.599 --> 00:28:41.019
of the text down into unicode and going okay You know,
581
00:28:41.500 --> 00:28:43.460
is this something I'm looking for? And that's where Patrick
582
00:28:43.500 --> 00:28:46.000
comes back to the arms race of you're looking for
583
00:28:46.019 --> 00:28:49.680
an exact phrase of some sort in an exact ASCII,
584
00:28:50.220 --> 00:28:51.119
you know, sequence.
585
00:28:51.339 --> 00:28:52.019
Right.
586
00:28:52.099 --> 00:28:56.230
And if I can inject an unprintable invisible character or
587
00:28:56.289 --> 00:28:58.970
I can inject a mirrored character, I'm going to bypass
588
00:28:58.990 --> 00:29:00.589
your filter and you're not going to see it.
589
00:29:00.650 --> 00:29:02.569
But you, the user, are still going to see it
590
00:29:02.630 --> 00:29:04.049
and absorb it. Yeah, exactly. Right.
591
00:29:04.250 --> 00:29:06.950
Okay. All right. So, let's move on to our top
592
00:29:06.970 --> 00:29:11.720
story this week. The HTTP query method. Again, this is
593
00:29:11.759 --> 00:29:19.539
the third upgrade. In this case, it's upgrading the HTTP protocol. So,
594
00:29:19.960 --> 00:29:21.519
is it a new method?
595
00:29:21.740 --> 00:29:23.619
Yes. Yeah, it's a third way.
596
00:29:23.740 --> 00:29:24.079
Ooh.
597
00:29:24.240 --> 00:29:26.440
So, there's post and there's get.
598
00:29:26.559 --> 00:29:28.069
Yeah. And there's put.
599
00:29:28.619 --> 00:29:29.779
Most and put.
600
00:29:29.799 --> 00:29:30.420
Put is for.
601
00:29:30.440 --> 00:29:33.380
So, now there's query, which is kind of halfway between.
602
00:29:33.420 --> 00:29:35.569
Put is for upgrading. Post is for adding.
603
00:29:35.809 --> 00:29:36.369
Yeah, but.
604
00:29:36.490 --> 00:29:37.529
If you want to map.
605
00:29:37.549 --> 00:29:39.849
Query is kind of halfway between get and post. Hmm.
606
00:29:40.119 --> 00:29:44.079
So most systems will deal with get pretty straightforward because
607
00:29:44.119 --> 00:29:49.700
it doesn't... I think it's... Idempotent is the word that
608
00:29:49.720 --> 00:29:53.259
we say. What word did you... Basically, it's repeatable. It
609
00:29:54.119 --> 00:29:58.849
doesn't change state, doesn't do anything. But the problem is
610
00:29:58.910 --> 00:30:03.660
that post... does change state does change things and this
611
00:30:03.720 --> 00:30:05.240
is kind of in the middle and the problem is
612
00:30:05.309 --> 00:30:08.269
that most systems were written for one of the other
613
00:30:09.069 --> 00:30:10.829
and if this is a new this was like june
614
00:30:10.829 --> 00:30:15.269
2026 um and so what does your system do when
615
00:30:15.309 --> 00:30:17.190
it gets a query you probably don't know and if
616
00:30:17.210 --> 00:30:22.250
you say you know you're probably guessing and so it's
617
00:30:22.430 --> 00:30:24.450
it's a it's a new thing that people have to
618
00:30:24.490 --> 00:30:26.809
test against and if you don't test against it then
619
00:30:26.829 --> 00:30:29.700
you're leaving it to like just luck And I think
620
00:30:29.720 --> 00:30:30.339
that's a bad idea.
621
00:30:30.640 --> 00:30:34.190
Well, okay. But if I'm writing an API controller, I
622
00:30:34.470 --> 00:30:40.549
specifically decorate my endpoints with the verbs that they handle, right?
623
00:30:40.690 --> 00:30:43.119
So this is going to get control on a post.
624
00:30:43.160 --> 00:30:44.880
This one's going to get control on a put. This
625
00:30:44.980 --> 00:30:47.079
one's going to get control on a get. If I
626
00:30:47.180 --> 00:30:52.789
don't write one that specifically handles query, should I still worry? Yeah.
627
00:30:53.349 --> 00:30:56.390
Not necessarily, but it also depends on how the underlying
628
00:30:56.450 --> 00:31:00.369
like web server handle is it and that sort of stuff, right? So,
629
00:31:01.210 --> 00:31:06.130
the system you're using, right, to share up web files
630
00:31:07.369 --> 00:31:09.650
may just have defaults and be like, oh, yeah, we
631
00:31:09.690 --> 00:31:11.170
now support this query thing and it gives you the
632
00:31:11.190 --> 00:31:13.309
ability to query all the files that exist in the
633
00:31:13.329 --> 00:31:13.849
web directory.
634
00:31:14.450 --> 00:31:15.170
Cool, right?
635
00:31:15.789 --> 00:31:17.930
Now we know, right? And you're like, oh, well, crap,
636
00:31:17.950 --> 00:31:20.250
I don't want that. So, even though you didn't decorate it,
637
00:31:21.130 --> 00:31:23.250
You know, you still can call some of these functions.
638
00:31:23.269 --> 00:31:25.789
And there are plenty of functions that you may not
639
00:31:25.849 --> 00:31:28.470
decorate that I can still call and get information on
640
00:31:28.589 --> 00:31:31.940
certain files. And it's just the way the web server
641
00:31:32.059 --> 00:31:35.019
itself that's serving up those files handles those verbs.
642
00:31:35.039 --> 00:31:37.640
But I mean, now, if that web server does that
643
00:31:37.680 --> 00:31:40.220
by default, it's by default insecure.
644
00:31:40.460 --> 00:31:41.200
Right, exactly.
645
00:31:41.269 --> 00:31:44.230
So, that's up. that's a vulnerability in the website.
646
00:31:44.509 --> 00:31:44.789
Yeah.
647
00:31:44.970 --> 00:31:45.789
Not in your code.
648
00:31:45.849 --> 00:31:46.069
Yeah.
649
00:31:46.130 --> 00:31:50.109
And that's, I think it'll be interesting to see how different,
650
00:31:50.410 --> 00:31:54.599
you know, web serving technologies, right? Whether it's whatever, it
651
00:31:54.619 --> 00:31:58.700
doesn't matter. Django to IS to whatever, how they handle
652
00:31:58.759 --> 00:32:02.250
this new verb. And whether they just make it a
653
00:32:02.329 --> 00:32:05.130
default and say, hey, by default, we're going to do X.
654
00:32:05.349 --> 00:32:08.410
Or whether they make it shut off and you have
655
00:32:08.450 --> 00:32:10.089
to come turn it on for whatever.
656
00:32:09.849 --> 00:32:10.789
Reason you want it on. I would hope that that
657
00:32:10.809 --> 00:32:11.910
would be the way they do it. That's what I'm
658
00:32:11.930 --> 00:32:12.650
looking for.
659
00:32:12.869 --> 00:32:13.009
Yep.
660
00:32:13.029 --> 00:32:15.990
But that's not a guarantee. But we didn't see that
661
00:32:16.019 --> 00:32:18.099
with most of the other verbs, right? I asked if
662
00:32:18.140 --> 00:32:20.700
you share up, you know, a site for the most part,
663
00:32:20.819 --> 00:32:22.980
if all the verbs that are there are there and
664
00:32:23.019 --> 00:32:23.640
you can call them.
665
00:32:23.859 --> 00:32:27.380
Well, yeah. IIS, though. I mean, come on. That was
666
00:32:27.480 --> 00:32:30.180
created before the idea of web security was an idea.
667
00:32:30.200 --> 00:32:32.619
Tomcat's pretty good, but it's had a lot of problems, too.
668
00:32:33.059 --> 00:32:38.279
But I imagine Microsoft with ASP.NET and all of the
669
00:32:38.380 --> 00:32:43.690
major vendors of backend and certainly the clouds probably would
670
00:32:43.769 --> 00:32:46.309
have been aware that query was coming.
671
00:32:46.670 --> 00:32:47.430
I would hope to.
672
00:32:47.650 --> 00:32:51.289
They're probably working with the W3C or whoever put this out.
673
00:32:51.769 --> 00:32:53.930
to say, okay, well, this is what's going on and
674
00:32:53.990 --> 00:32:55.579
here's how you got to handle it.
675
00:32:55.690 --> 00:32:58.029
Yeah, absolutely. I would hope so too. Just, I would
676
00:32:58.049 --> 00:33:00.720
be cautious if, and actually, you know what might be interesting?
677
00:33:00.740 --> 00:33:01.359
Hope is not a plan.
678
00:33:01.920 --> 00:33:05.900
It might be interesting to see how many web scanners
679
00:33:05.980 --> 00:33:08.279
out there, like, you know, hackers who are trying to
680
00:33:08.299 --> 00:33:10.099
hit your site, they're looking for all different types of things.
681
00:33:10.119 --> 00:33:13.680
It'll be interesting to see when people start using this verb.
682
00:33:14.059 --> 00:33:14.819
Right.
683
00:33:14.980 --> 00:33:17.180
In their scanning to see if it just throws weird
684
00:33:17.259 --> 00:33:19.460
errors that they can latch onto. Right.
685
00:33:19.660 --> 00:33:22.519
Well, it sounds like that's the pointy end of the show.
686
00:33:22.599 --> 00:33:26.099
So thank you, Dwayne and Patrick. And thanks for listening, everybody.
687
00:33:26.140 --> 00:33:28.880
That's what we had for all the stories last week.
688
00:33:28.920 --> 00:33:31.319
And we'll see you next week on Security This Week. Bye-bye.
689
00:33:31.339 --> 00:33:31.900
Good to see you, Colin.
1
00:00:00.340 --> 00:00:30.980
And don't forget Discord. Discord.SecurityThisWeek.com. Lots of good stuff happening there. Um, yeah,
2
00:00:31.000 --> 00:00:33.759
I think that's it. So on with the podcast. You know,
3
00:00:34.060 --> 00:00:38.060
my doctor gave me an impossible task. He said, spend
4
00:00:38.100 --> 00:00:40.079
at least an hour a day on the treadmill. And
5
00:00:40.119 --> 00:00:41.880
I'm telling you now, it's not going to work.
6
00:00:42.189 --> 00:00:42.829
Huh.
7
00:00:42.969 --> 00:00:45.130
The gym staff only let me on it for five
8
00:00:45.149 --> 00:00:47.369
minutes before they told me to leave and take my
9
00:00:47.469 --> 00:00:48.289
pillow with me.
10
00:00:51.729 --> 00:00:52.549
Well, that's absurd.
11
00:00:53.270 --> 00:00:54.030
It's crazy.
12
00:00:54.049 --> 00:00:54.590
Yeah.
13
00:01:02.960 --> 00:01:06.379
All right. Security This Week. I'm Carl. That's Patrick and Dwayne.
14
00:01:06.640 --> 00:01:12.409
And we've got eight stories today, starting with one that
15
00:01:12.469 --> 00:01:15.049
is kind of interesting and a little ironic, don't you think?
16
00:01:15.060 --> 00:01:15.590
Yeah.
17
00:01:16.090 --> 00:01:16.269
Yeah.
18
00:01:22.739 --> 00:01:23.099
This is.
19
00:01:23.739 --> 00:01:24.560
Yeah. Yeah.
20
00:01:24.700 --> 00:01:26.549
Just because you're in security doesn't mean you're immune.
21
00:01:27.349 --> 00:01:29.989
I always wonder, like, you see all these top brand
22
00:01:30.030 --> 00:01:35.469
security companies and you always wonder, like CrowdStrike, and you're like, hey, maybe... Like,
23
00:01:35.510 --> 00:01:38.719
they're just shoemakers kids, right? You know the story. Excellent
24
00:01:38.739 --> 00:01:41.180
at what they do, work with customers all around the world,
25
00:01:41.200 --> 00:01:43.140
but don't take a look at their own security, maybe.
26
00:01:43.159 --> 00:01:43.379
Right.
27
00:01:43.439 --> 00:01:43.900
I'm not sure.
28
00:01:45.189 --> 00:01:46.609
Psychologist in the same way.
29
00:01:49.510 --> 00:01:52.549
Now, this is just to be clear, CrowdSecurity is not
30
00:01:52.590 --> 00:01:55.430
related to CrowdStrike as far as I know. They're different companies.
31
00:01:55.450 --> 00:01:57.140
They just have a similar name.
32
00:01:57.189 --> 00:02:01.980
They just have a very close name. So, needless to say,
33
00:02:02.000 --> 00:02:07.120
an attacker stole 170 private GitHub repos from French security
34
00:02:07.180 --> 00:02:12.919
firm CrowdSec. The problem with this is... As we know,
35
00:02:13.180 --> 00:02:16.750
as a cybersecurity firm, our private repos have some pretty
36
00:02:16.789 --> 00:02:19.550
damaging stuff in there. They have some pretty high-end, you know,
37
00:02:19.750 --> 00:02:22.990
offensive cyber weapons. We have some, you know, really nice
38
00:02:23.030 --> 00:02:23.789
harnesses for.
39
00:02:23.659 --> 00:02:28.740
AI, like stuff... Crazy photos. We wouldn't want... Sure. Blackmail stuff,
40
00:02:28.780 --> 00:02:30.539
you know... Tease the criminals.
41
00:02:31.740 --> 00:02:33.409
Go ahead, Dwayne. Tease them.
42
00:02:33.669 --> 00:02:35.710
I mean, there's nuclear codes in there.
43
00:02:35.729 --> 00:02:39.990
Yeah, absolutely. We know where Jimmy Hoffa is. I saw
44
00:02:40.009 --> 00:02:41.719
Jimmy the other day. He's doing great.
45
00:02:41.810 --> 00:02:45.840
You know, anyone under 40 or even maybe 50 doesn't
46
00:02:45.879 --> 00:02:47.319
know what the hell you're talking about.
47
00:02:47.340 --> 00:02:50.020
How about Tupac? Is that more? There you go. It's
48
00:02:50.090 --> 00:02:51.090
pertinent now, I guess.
49
00:02:52.610 --> 00:02:59.430
So, this story distills down to there was an ex-employee who,
50
00:02:59.770 --> 00:03:02.560
you know, obviously didn't work for the organization anymore, got
51
00:03:02.620 --> 00:03:07.639
his computer compromised. And in the compromise, just happened to
52
00:03:07.680 --> 00:03:09.180
still have OAuth tokens.
53
00:03:09.340 --> 00:03:09.520
Yeah.
54
00:03:10.939 --> 00:03:15.229
To crowd sex uh crowd sex i mean that shame it's.
55
00:03:15.150 --> 00:03:17.530
Not shame on him i mean he yeah he shouldn't
56
00:03:17.550 --> 00:03:19.810
have gotten owned but yeah it's shame on the company
57
00:03:19.849 --> 00:03:21.750
for not out processing.
58
00:03:21.129 --> 00:03:23.789
Correctly yeah not changing the off codes and all of
59
00:03:23.849 --> 00:03:26.159
that stuff that you do when you let an employee go.
60
00:03:26.379 --> 00:03:28.819
Exactly right well here's the problem with that if you
61
00:03:28.860 --> 00:03:31.379
don't have a process for that and i know i'd
62
00:03:31.419 --> 00:03:34.379
say if i had to guess 70% of the organizations
63
00:03:34.439 --> 00:03:37.939
on the planet don't have a process for off-boarding employees
64
00:03:38.090 --> 00:03:38.990
and contractors.
65
00:03:39.110 --> 00:03:41.490
I just think the process is when the sun envelops
66
00:03:41.530 --> 00:03:44.449
the earth. Yeah, it'll all go away. Eventually, it'll all
67
00:03:44.469 --> 00:03:44.889
go away.
68
00:03:45.449 --> 00:03:49.080
Is it off-boarding or out-boarding? Or is it motorboating? I
69
00:03:49.099 --> 00:03:49.919
don't know.
70
00:03:49.939 --> 00:03:52.939
Well, you onboard somebody, so I'd imagine it's off-boarding.
71
00:03:53.020 --> 00:03:54.020
Okay, on-off.
72
00:03:54.099 --> 00:03:55.889
At least that's what I hear in the in the
73
00:03:55.990 --> 00:03:58.789
biz most of the time. But if you think about it, like, okay,
74
00:03:58.830 --> 00:04:01.990
so listen, we're going to get rid of an employee.
75
00:04:02.169 --> 00:04:04.849
It's real, like HR has this down. We know when
76
00:04:04.879 --> 00:04:07.259
your final check is coming. We know, you know, how
77
00:04:07.300 --> 00:04:10.020
much you're getting paid out for vacation. Like they have
78
00:04:10.099 --> 00:04:12.360
that down to a science. They don't keep paying you.
79
00:04:12.439 --> 00:04:14.000
How many U-Haul boxes you get.
80
00:04:14.020 --> 00:04:15.599
They don't keep paying you. Yeah.
81
00:04:16.550 --> 00:04:19.709
Although in some organizations they do, but that's beside the point.
82
00:04:20.389 --> 00:04:22.959
But from a tech standpoint, I can't tell you how
83
00:04:23.019 --> 00:04:27.459
many times we run into a former employee still has
84
00:04:27.519 --> 00:04:30.439
keys to the kingdom, still has API keys, still has...
85
00:04:30.680 --> 00:04:33.100
And they have no process for rotating them or keeping
86
00:04:33.120 --> 00:04:34.680
track of whoever had them.
87
00:04:34.939 --> 00:04:37.980
I mean, you and I have been talking for 20
88
00:04:37.980 --> 00:04:42.089
plus years about service accounts. When an employee leaves and
89
00:04:42.129 --> 00:04:45.029
they have a service account, we've even seen it where
90
00:04:45.410 --> 00:04:49.480
a service account for a major service... Is running under
91
00:04:49.500 --> 00:04:53.220
the credentials of an IT user. Yeah. And so that's
92
00:04:53.259 --> 00:04:57.569
their excuse. Oh, well, we can't delete Carl's account because
93
00:04:57.610 --> 00:05:01.250
it's running our X server, our Postgres server. Yeah.
94
00:05:01.790 --> 00:05:04.209
Even though he doesn't work here anymore and we fired
95
00:05:04.250 --> 00:05:06.430
him because he hates us and we hate him.
96
00:05:06.470 --> 00:05:08.089
And we don't know his password.
97
00:05:08.129 --> 00:05:10.339
We're going to leave his username and password here.
98
00:05:10.560 --> 00:05:14.079
I never worked for you. Yeah. I don't know if
99
00:05:14.100 --> 00:05:15.439
you hate me or not, but.
100
00:05:16.240 --> 00:05:17.300
Carl, we love you, buddy.
101
00:05:17.740 --> 00:05:18.319
All right.
102
00:05:18.339 --> 00:05:18.779
We love you.
103
00:05:20.079 --> 00:05:22.899
So, needless to say, this, I think, is a cautionary
104
00:05:22.959 --> 00:05:27.160
tale of cybersecurity has to be part of an off-boarding
105
00:05:27.220 --> 00:05:29.220
process for every organization, small or large.
106
00:05:29.279 --> 00:05:31.439
Especially when you're a security firm. Well, true.
107
00:05:31.480 --> 00:05:31.600
Yeah.
108
00:05:31.720 --> 00:05:35.910
Yeah. That's why I said there was a little irony.
109
00:05:35.970 --> 00:05:39.050
And you know what the opposite of irony is? It's wrinkly. So,
110
00:05:39.290 --> 00:05:41.449
this is not wrinkly.
111
00:05:41.990 --> 00:05:44.649
It's not wrinkly. I thought it was permanent press. It's
112
00:05:44.670 --> 00:05:46.209
like disgruntled and gruntled.
113
00:05:46.670 --> 00:05:47.230
Yeah, right.
114
00:05:47.350 --> 00:05:49.730
Anyhow. Yeah.
115
00:05:49.790 --> 00:05:53.709
So, just the irony of, oh, a security firm. Oh,
116
00:05:53.750 --> 00:05:56.509
don't worry about it. We could trust this guy completely.
117
00:05:57.000 --> 00:05:58.779
We don't have to clean up after him.
118
00:05:58.939 --> 00:06:01.180
I mean, one of the excuses, it's not a good excuse,
119
00:06:01.300 --> 00:06:04.139
but it's one of the excuses is, well, they may
120
00:06:04.199 --> 00:06:07.699
come back as a contractor or we may need them
121
00:06:07.800 --> 00:06:12.829
to do something later on. Again, it's just bad excuses.
122
00:06:13.110 --> 00:06:15.550
Yeah, it's not an excuse. They should be off-boarded and
123
00:06:15.589 --> 00:06:18.089
then on-boarded again with new keys.
124
00:06:18.129 --> 00:06:19.949
It's not an acceptable excuse. It is an excuse.
125
00:06:20.290 --> 00:06:22.350
It's a bad excuse. There you go. Yeah.
126
00:06:22.670 --> 00:06:23.310
No excuse, sir.
127
00:06:23.370 --> 00:06:25.470
Yeah, and just to be clear, like Patrick had said,
128
00:06:25.529 --> 00:06:28.449
this isn't CrowdStrike. This is CrowdSec. They are an open-source,
129
00:06:28.470 --> 00:06:33.509
community-driven cybersecurity platform that detects, blocks, and shares information about
130
00:06:33.569 --> 00:06:34.420
malicious IPs.
131
00:06:35.360 --> 00:06:36.060
One would think.
132
00:06:39.060 --> 00:06:41.470
Soon to be their own. Apparently, they needed to add
133
00:06:41.550 --> 00:06:44.569
one more IP to that list. Yeah.
134
00:06:44.709 --> 00:06:51.990
All right. We moved on. Oracle launches Java 27 featuring
135
00:06:52.250 --> 00:06:56.370
hybrid post-quantum cryptography for TLS 1.3.
136
00:06:56.370 --> 00:07:00.860
I love this story. So, this is good news. So, basically,
137
00:07:00.889 --> 00:07:03.519
we're starting to see the trickle into the ecosystems where
138
00:07:04.160 --> 00:07:07.540
they're updating their libraries to be quantum safe. Now, in
139
00:07:07.560 --> 00:07:11.480
this case, they're implementing hybrids. So if you call on
140
00:07:11.560 --> 00:07:19.959
the libraries like javax.net.ssl, the standard APIs, you now get
141
00:07:20.519 --> 00:07:25.370
a hybrid that is both the classical encryption along with
142
00:07:25.889 --> 00:07:31.910
the new hotness, which is basically the lattice encryption that
143
00:07:31.949 --> 00:07:34.610
is now shown to be or is believed to be
144
00:07:34.769 --> 00:07:37.850
quantum safe. So a lot of people get this for free.
145
00:07:38.600 --> 00:07:41.379
It'll just be like when you upgrade. You won't even notice.
146
00:07:41.860 --> 00:07:45.379
And that's, we're hoping. And that's good news. And that's
147
00:07:45.439 --> 00:07:47.019
better than everyone having to roll their own. So, we
148
00:07:47.060 --> 00:07:49.420
need more vendors to do this. We need more people.
149
00:07:49.800 --> 00:07:52.639
But this also speaks to the thing. If you rolled
150
00:07:52.680 --> 00:07:55.740
your own encryption. Slap yourself. You're an idiot.
151
00:07:55.779 --> 00:07:56.019
Yeah.
152
00:07:56.220 --> 00:08:01.629
But, I mean, we've always said that. It's like at-home dentistry. Yeah,
153
00:08:01.670 --> 00:08:04.110
you can do it. Just as good an idea. Only
154
00:08:04.149 --> 00:08:04.850
the mob does it.
155
00:08:05.240 --> 00:08:07.990
Yeah so don't write your own database don't write your
156
00:08:08.050 --> 00:08:10.100
own network protocols.
157
00:08:09.850 --> 00:08:12.410
Yeah so but if you did now you have to
158
00:08:12.470 --> 00:08:14.949
go and do this heavy lifting and if you don't
159
00:08:15.209 --> 00:08:17.470
then and you rely on industry standards like this then
160
00:08:17.790 --> 00:08:22.269
so this is great news um so this standardized the
161
00:08:22.430 --> 00:08:26.449
the key encapsulation mechanism called ml chem which used to
162
00:08:26.470 --> 00:08:31.029
be called crystals kyber right and And Dilithium, I love
163
00:08:31.069 --> 00:08:36.500
these names, is now MLDSA. And DSA is for digital signing.
164
00:08:36.600 --> 00:08:41.519
So the public-private key thing, the encryption is done by Kyber.
165
00:08:42.399 --> 00:08:44.700
The signatures are done by Dilithium. They got the new
166
00:08:44.759 --> 00:08:47.399
formal names. I'll always call them by the old names. Well, yeah.
167
00:08:47.639 --> 00:08:50.100
And now it's rolled in. And so if you upgrade
168
00:08:50.139 --> 00:08:55.440
to TLS 1.3, then you're starting to protect against the
169
00:08:55.480 --> 00:08:57.879
harvest now, decrypt later attacks.
170
00:08:58.389 --> 00:09:01.830
So, what occurs to me is this is the third story,
171
00:09:01.990 --> 00:09:04.549
and we haven't talked about the other two yet, this week,
172
00:09:05.080 --> 00:09:08.519
that have to do with upgrades. Yeah. Isn't that interesting?
173
00:09:08.539 --> 00:09:08.860
There's a theme.
174
00:09:08.879 --> 00:09:10.879
There's a lot going on this week. Almost as if
175
00:09:10.940 --> 00:09:11.500
we planned it.
176
00:09:12.740 --> 00:09:16.200
We're still not saying you shouldn't automatically upgrade, but there
177
00:09:16.259 --> 00:09:18.080
are issues this week.
178
00:09:18.970 --> 00:09:19.159
Yeah.
179
00:09:19.679 --> 00:09:23.509
All right. So, that's good. This is a happy story, Patrick.
180
00:09:23.769 --> 00:09:23.990
It is.
181
00:09:24.309 --> 00:09:26.779
I'm very happy. That you guys allowed me to bring
182
00:09:26.820 --> 00:09:29.139
this one in and didn't cut it. Take that on
183
00:09:29.159 --> 00:09:31.799
your other podcast, Patrick. Jeez. This is how you pay
184
00:09:31.840 --> 00:09:33.059
me in quantum stores.
185
00:09:33.460 --> 00:09:36.879
So this one, this next one, this Windows malware is
186
00:09:36.919 --> 00:09:39.679
built to let up to four AI models vote on
187
00:09:39.759 --> 00:09:40.519
its next move.
188
00:09:40.899 --> 00:09:41.120
So.
189
00:09:41.220 --> 00:09:43.830
This one is not an upgrade issue, but it is
190
00:09:43.919 --> 00:09:48.429
really interesting. Like malware now that calls out for help
191
00:09:48.990 --> 00:09:52.409
to AI models to help it decide what is the
192
00:09:52.450 --> 00:09:55.679
most evil next move. Thing that I could do to
193
00:09:55.679 --> 00:09:57.200
infect this system.
194
00:09:57.200 --> 00:09:59.929
Right? I like it. This thing's awesome.
195
00:09:59.929 --> 00:10:01.149
It's just not right.
196
00:10:01.629 --> 00:10:02.129
So cool.
197
00:10:02.470 --> 00:10:05.100
But you know what? This is a human problem. This
198
00:10:05.120 --> 00:10:06.580
is the people that wrote the malware.
199
00:10:06.889 --> 00:10:09.320
Yeah. Yeah, absolutely. They're losing the tools.
200
00:10:09.799 --> 00:10:10.639
Yeah. So.
201
00:10:11.899 --> 00:10:13.580
this poses a couple of different problems.
202
00:10:14.259 --> 00:10:16.419
Um, first off, like I love the picture on here
203
00:10:16.490 --> 00:10:19.669
cause it has like chat GPT and it has meta
204
00:10:19.690 --> 00:10:22.509
and whatever. And a lot of those have guardrails around
205
00:10:22.889 --> 00:10:24.929
how should I infect this system? It's not something you
206
00:10:24.970 --> 00:10:27.269
can ask the API, but, but the ones that they're
207
00:10:27.330 --> 00:10:31.929
actually using are like deep seek minstrel, um, you know,
208
00:10:31.990 --> 00:10:34.149
Gemini Talos. So some of the ones that they can
209
00:10:34.250 --> 00:10:36.340
actually kind of, yeah. So some of the ones they
210
00:10:36.360 --> 00:10:40.269
have a little bit more control over, um, But the
211
00:10:40.330 --> 00:10:43.649
interesting part is not necessarily like, hey, this quorum of AI,
212
00:10:43.690 --> 00:10:46.250
which actually really kind of is an interesting way to go.
213
00:10:46.289 --> 00:10:49.830
It's almost like, you know, a mixture of experts type
214
00:10:49.889 --> 00:10:51.789
thing for how do I infect this? Or what's the
215
00:10:51.809 --> 00:10:54.350
best way to move, right? Should I laterally move? Here's
216
00:10:54.370 --> 00:10:57.009
what I'm seeing in the environment. Should I infect the system?
217
00:10:57.029 --> 00:10:58.000
Should I encrypt the system?
218
00:10:58.019 --> 00:10:58.639
Whatever, right?
219
00:10:58.700 --> 00:11:01.379
So, neat way to use this. But the more sort
220
00:11:01.419 --> 00:11:05.840
of insidious thing is the fact that it's leveraging this
221
00:11:05.899 --> 00:11:07.080
as a command and control stream.
222
00:11:07.830 --> 00:11:08.110
Right?
223
00:11:08.169 --> 00:11:11.529
So, you know, you, you look for the odd communications
224
00:11:11.590 --> 00:11:13.559
off your network. You look for maybe a lot of
225
00:11:13.580 --> 00:11:15.820
DNS traffic. We look for all sorts of the, the
226
00:11:15.860 --> 00:11:19.679
classic ways that command and control how an attacker would
227
00:11:19.720 --> 00:11:23.419
control a remote implant or a piece of malware and
228
00:11:23.470 --> 00:11:26.970
making queries out to AI at this point is so ubiquitous.
229
00:11:27.690 --> 00:11:30.889
It actually might be pretty hard to see this traffic
230
00:11:30.950 --> 00:11:33.070
and extrapolate it from the rest of your users.
231
00:11:33.629 --> 00:11:33.870
Right.
232
00:11:34.289 --> 00:11:38.539
Um, Now, there's a side channel here, not the kind
233
00:11:38.580 --> 00:11:42.480
I like, but just a side communications channel where everything
234
00:11:42.500 --> 00:11:45.600
that happens and every decision that's made is actually pumped
235
00:11:45.639 --> 00:11:48.720
out to a Discord channel so that the attackers can
236
00:11:48.899 --> 00:11:52.820
monitor what's going on and can see the questions being
237
00:11:52.879 --> 00:11:56.820
asked and the decisions being made by the AIs. So,
238
00:11:56.860 --> 00:12:00.399
maybe that's a way to identify it. Like an indicator is, hey,
239
00:12:00.460 --> 00:12:03.970
maybe we monitor. I don't know a lot of businesses
240
00:12:04.000 --> 00:12:04.919
that use Discord.
241
00:12:05.299 --> 00:12:05.559
Yeah.
242
00:12:05.700 --> 00:12:11.059
For business communications, it's usually Slack or it's Teams. But,
243
00:12:11.200 --> 00:12:12.759
you know, not generally Discord.
244
00:12:12.940 --> 00:12:13.419
I know, right?
245
00:12:14.659 --> 00:12:16.950
Unless I was running a gaming company, then it's Discord
246
00:12:16.970 --> 00:12:20.370
all the way. Although, oddly enough, Pulsar Security does have
247
00:12:20.409 --> 00:12:21.009
its own Discord.
248
00:12:21.029 --> 00:12:21.549
So, whatever.
249
00:12:21.730 --> 00:12:21.909
Right.
250
00:12:23.149 --> 00:12:25.289
Some companies do it, but most don't.
251
00:12:25.350 --> 00:12:26.730
Well, the difference is you're not evil.
252
00:12:27.049 --> 00:12:28.029
Right. Exactly.
253
00:12:28.669 --> 00:12:31.169
But if you're monitoring your network and you see a
254
00:12:31.250 --> 00:12:33.929
lot of Discord traffic, it might not be a bad
255
00:12:33.970 --> 00:12:37.519
idea to block that anyways. But you heard it here first.
256
00:12:37.539 --> 00:12:39.980
This is the first time that command and control has
257
00:12:40.000 --> 00:12:43.600
been done through AI and a mixture of experts in
258
00:12:43.740 --> 00:12:47.590
AI are making decisions on how to mess up your network.
259
00:12:47.850 --> 00:12:49.669
Well, at least as far as we know. We haven't
260
00:12:49.710 --> 00:12:50.690
heard of one yet.
261
00:12:50.710 --> 00:12:51.110
That's true.
262
00:12:51.649 --> 00:12:52.450
Publicly disclosed.
263
00:12:52.490 --> 00:12:52.710
Right.
264
00:12:52.889 --> 00:12:58.070
Okay. CISA orders feds to patch Zyzel flaw exploited for
265
00:12:58.129 --> 00:13:01.850
data theft. And that's Z-Y-X-E-L. I don't even know if
266
00:13:01.909 --> 00:13:03.009
I'm pronouncing it correctly.
267
00:13:03.250 --> 00:13:07.789
Close enough. Isn't that the medicine with the owl mask on?
268
00:13:08.009 --> 00:13:08.750
If you can't sleep.
269
00:13:09.669 --> 00:13:10.169
Zizel.
270
00:13:10.230 --> 00:13:12.179
Is it the difference in A versus an E?
271
00:13:12.700 --> 00:13:15.240
Don't take Zizel if you're allergic to it. Have you
272
00:13:15.279 --> 00:13:20.720
heard this new disclaimer on all these medications? What the dumbest...
273
00:13:19.899 --> 00:13:22.289
Wait a second. Don't take it if you're allergic to it.
274
00:13:22.570 --> 00:13:24.200
How do I know if I'm allergic to it?
275
00:13:24.570 --> 00:13:26.289
Take it. We'll find out. Well, you take it. And
276
00:13:26.350 --> 00:13:28.789
if you die, you're allergic to it. You were allergic
277
00:13:28.809 --> 00:13:29.330
to it.
278
00:13:29.649 --> 00:13:32.100
And you cannot sue if you're dead because you're allergic.
279
00:13:33.500 --> 00:13:33.980
Good Lord.
280
00:13:34.860 --> 00:13:37.940
So, back to the story. Zyzel in this particular case
281
00:13:38.059 --> 00:13:45.049
is network switching infrastructure. So, think like Cisco switches, right?
282
00:13:45.549 --> 00:13:47.370
How you're routing traffic. And a lot of these things
283
00:13:47.429 --> 00:13:51.929
may actually have to be. accessible on the internet, right?
284
00:13:52.470 --> 00:13:54.389
It could be the backbone of your infrastructure where you
285
00:13:54.409 --> 00:13:56.710
plug your firewall in and all sorts of other things. So,
286
00:13:57.389 --> 00:14:00.149
it's not uncommon to get access to these things remotely.
287
00:14:01.360 --> 00:14:07.000
This flaw stems from a stack-based overflow in the CGI program.
288
00:14:07.220 --> 00:14:11.490
That would not be computer graphics imaging, right? CGI.
289
00:14:11.649 --> 00:14:12.169
It is not.
290
00:14:12.190 --> 00:14:15.590
You know, all of our listeners who are probably, you know,
291
00:14:15.669 --> 00:14:19.299
younger than 35, if you search CGI, you will not
292
00:14:19.360 --> 00:14:21.960
find this CGI because it's, I don't know, was it
293
00:14:22.019 --> 00:14:23.029
invented in the 80s?
294
00:14:23.779 --> 00:14:27.139
Has to have been. Yeah, I mean, I was in
295
00:14:27.159 --> 00:14:29.759
my 20s when I learned of it. And so, this
296
00:14:29.850 --> 00:14:34.669
is Common Gateway Interface. And it was the first way, really,
297
00:14:34.889 --> 00:14:40.799
that you could have a program respond to input on
298
00:14:41.299 --> 00:14:45.960
HTTP and typically written in Perl or some other language
299
00:14:46.000 --> 00:14:49.690
like that. And the CGI just, I remember this cause
300
00:14:49.730 --> 00:14:53.049
I wrote stuff on it. It used standard in and
301
00:14:53.090 --> 00:14:56.250
standard out to talk to an executable that was running
302
00:14:56.570 --> 00:14:59.590
probably in full security context. Oh yeah. I mean, full
303
00:14:59.649 --> 00:15:02.330
public context running on your machine.
304
00:15:02.509 --> 00:15:04.309
I used to love CGI. It was the easy way
305
00:15:04.350 --> 00:15:05.529
to take over every server.
306
00:15:05.960 --> 00:15:06.149
Right.
307
00:15:06.529 --> 00:15:09.590
Like, if you had an executable running under CGI or
308
00:15:09.629 --> 00:15:12.210
a script... So, imagine this interface that sits on a
309
00:15:12.250 --> 00:15:15.220
web server, if you will, that you can run programs. Like,
310
00:15:15.250 --> 00:15:19.399
doesn't that sound fantastic as an attacker? Apparently, these switches
311
00:15:19.500 --> 00:15:23.720
still use CGI. And apparently, there is a buffer overflow
312
00:15:23.759 --> 00:15:27.379
that allows for code execution. So, if you're running any
313
00:15:27.399 --> 00:15:31.649
of these GS19 switches, the 8.8 HP, blah, blah, blah,
314
00:15:31.669 --> 00:15:35.179
there's a whole list. Associated with the article, you are
315
00:15:35.259 --> 00:15:37.929
going to want to patch and get rid of the
316
00:15:38.690 --> 00:15:42.250
ability for anybody to run CGI and get access to
317
00:15:42.289 --> 00:15:42.629
your Switch.
318
00:15:43.289 --> 00:15:45.509
Yeah. So, not good.
319
00:15:45.950 --> 00:15:46.210
All right.
320
00:15:46.230 --> 00:15:48.149
Well, this seems like a good place to take a break. So,
321
00:15:48.200 --> 00:15:50.539
we'll be right back after these very important messages. Don't
322
00:15:50.559 --> 00:15:57.240
go away. And we're back. It's Security This Week. Carl, Dwayne,
323
00:15:57.259 --> 00:16:02.070
and Patrick for you. This next story, Shiny Hunter's Target
324
00:16:02.210 --> 00:16:07.600
Oracle PeopleSoft in large-scale data theft campaign. Oh, no. Those
325
00:16:07.710 --> 00:16:09.529
shiny hunters are up to no good again.
326
00:16:09.629 --> 00:16:10.470
Man, they're busy.
327
00:16:10.700 --> 00:16:10.980
They are.
328
00:16:11.000 --> 00:16:14.320
The shiny hunters. Yeah, how do you find the time, Dwayne?
329
00:16:14.559 --> 00:16:17.240
I know, right? I mean, between my day job and
330
00:16:17.259 --> 00:16:17.759
this podcast.
331
00:16:17.779 --> 00:16:18.379
I'm swamped.
332
00:16:18.950 --> 00:16:21.110
Exactly. You ordered a frame for it?
333
00:16:22.889 --> 00:16:26.809
My button-pushing finger is killing me.
334
00:16:27.309 --> 00:16:32.629
Yeah, so this was actually, I believe, announced June 10th. Yeah,
335
00:16:32.669 --> 00:16:36.629
disclosed by Oracle PeopleSoft Environments. that are focused, there's an
336
00:16:36.870 --> 00:16:40.690
active data theft and extortion, easy for me to say,
337
00:16:40.769 --> 00:16:45.509
campaign disclosed on June 10th. So, the shiny hunters have
338
00:16:46.029 --> 00:16:51.169
been exploiting this and say they have compromised more than
339
00:16:51.169 --> 00:16:56.919
100 organizations with this exploit. One of the claims that
340
00:16:56.960 --> 00:17:00.009
they have here is that they've also claimed that they've
341
00:17:00.309 --> 00:17:02.490
exploited and compromised the FBI.
342
00:17:02.509 --> 00:17:03.309
Ooh.
343
00:17:03.450 --> 00:17:09.839
Digging deep, however, doing my investigative journalism, it doesn't actually
344
00:17:09.880 --> 00:17:12.589
look like they compromised the FBI. There's no evidence of it.
345
00:17:12.619 --> 00:17:13.740
They say they have.
346
00:17:13.759 --> 00:17:13.819
No.
347
00:17:14.319 --> 00:17:18.190
They did deface one of the FBI job sites. Through
348
00:17:18.230 --> 00:17:21.079
this exploit, but they didn't have access to any internal stuff.
349
00:17:21.119 --> 00:17:22.640
I was going to say, I thought it was, you know,
350
00:17:22.819 --> 00:17:25.160
Fred's Bistro Incorporated or something, you know.
351
00:17:25.579 --> 00:17:31.509
Fred's Bistro, the FBI. So, although one of their sort
352
00:17:31.569 --> 00:17:36.710
of publicly facing systems was defaced by this exploit, no
353
00:17:36.759 --> 00:17:40.410
real risk here of them actually getting anything sensitive. It
354
00:17:40.470 --> 00:17:42.710
is interesting, though, to say that the– they say the
355
00:17:42.769 --> 00:17:47.670
threat actors reportedly used a gadget chain combining older vulnerabilities
356
00:17:47.769 --> 00:17:49.130
and zero-day flaws.
357
00:17:50.670 --> 00:17:52.630
A gadget chain meaning devices?
358
00:17:52.869 --> 00:17:53.190
Yeah.
359
00:17:53.309 --> 00:17:58.890
So, no, not really. Actually, so, a gadget in exploitation
360
00:17:58.950 --> 00:18:05.250
speak can be anything from a particular exploit– To a
361
00:18:05.369 --> 00:18:08.589
particular set of opcodes in assembly.
362
00:18:08.890 --> 00:18:09.190
Wow.
363
00:18:09.329 --> 00:18:12.990
So, I can say, I want to chain an exploit
364
00:18:13.349 --> 00:18:16.579
to break into this piece of software and I need
365
00:18:16.599 --> 00:18:19.660
to grab a gadget, a small little move from one
366
00:18:19.880 --> 00:18:22.380
piece of software and then, you know, a jump from
367
00:18:22.420 --> 00:18:24.240
another piece of software and so on and so forth.
368
00:18:24.619 --> 00:18:28.599
And I stitch together these gadgets, chain them in a
369
00:18:28.640 --> 00:18:30.200
way that allows me to get execution.
370
00:18:30.220 --> 00:18:30.500
Mm-hmm.
371
00:18:30.779 --> 00:18:31.759
Um so how can we.
372
00:18:31.660 --> 00:18:34.869
Have done 200 some odd shows and i never knew
373
00:18:34.930 --> 00:18:36.529
this term before.
374
00:18:36.089 --> 00:18:38.170
Of the gadget and it's one of the reasons i
375
00:18:38.190 --> 00:18:40.690
actually like this article um because it's like they you
376
00:18:40.710 --> 00:18:42.950
know shiny hunters compromising things yeah i get it but
377
00:18:43.710 --> 00:18:45.990
uh but yeah the gadget chain is an interesting concept
378
00:18:46.079 --> 00:18:49.839
from uh from an exploitation standpoint it's where you have
379
00:18:49.880 --> 00:18:51.700
little pieces it's almost like think of it this way
380
00:18:52.359 --> 00:18:56.750
you ever see a ransom letter on like TV where
381
00:18:56.769 --> 00:18:57.630
the guy cuts out.
382
00:18:57.690 --> 00:18:59.339
Oh, sure. They cut the letters out.
383
00:18:59.390 --> 00:19:01.700
Like little letters out of a magazine. Yeah.
384
00:19:02.119 --> 00:19:05.519
It's the same exact thing. Like hackers cut out little
385
00:19:05.579 --> 00:19:08.559
pieces of programs that they need and stitch them together
386
00:19:08.680 --> 00:19:09.420
off the live system.
387
00:19:09.619 --> 00:19:13.799
Are they necessarily programs or could they be configuration errors or?
388
00:19:13.819 --> 00:19:15.380
Yeah, all of the above.
389
00:19:15.400 --> 00:19:17.440
They could be configuration errors, they could be exploits, they
390
00:19:17.460 --> 00:19:19.859
could be all the way down to such a minute
391
00:19:19.940 --> 00:19:23.210
thing as I'm going to reach in a notepad and
392
00:19:23.250 --> 00:19:28.039
I'm going to grab this small two op assembly code
393
00:19:28.319 --> 00:19:31.940
out of the thousandth line of notepad from the raw
394
00:19:32.180 --> 00:19:32.980
computer assembly.
395
00:19:33.220 --> 00:19:37.140
So, by themselves, these things aren't harmless, but put together
396
00:19:37.180 --> 00:19:37.980
in an evil way.
397
00:19:38.240 --> 00:19:41.109
Is it a higher level of ROP chaining? So, yes.
398
00:19:41.220 --> 00:19:43.529
Well, lower level. Think of it more as lower level.
399
00:19:43.549 --> 00:19:47.380
Like ROP chains, which is return oriented programming is where
400
00:19:47.460 --> 00:19:50.680
I actually will call into a small portion of code
401
00:19:51.960 --> 00:19:54.210
on the stack and have it then jump back out
402
00:19:54.230 --> 00:19:56.710
to me in a place that I want it to. So,
403
00:19:56.849 --> 00:20:01.049
return-oriented exploitation is I'm going to let a small function
404
00:20:01.170 --> 00:20:05.730
actually run to completion, whereas a gadget maybe I'm just
405
00:20:05.769 --> 00:20:09.869
stealing a small piece of, you know, code. So, it
406
00:20:09.910 --> 00:20:14.210
can be more microscopic or macroscopic depending on how big
407
00:20:14.410 --> 00:20:16.700
or small you want that gadget. But yeah, ROP chaining
408
00:20:16.740 --> 00:20:17.200
falls in there.
409
00:20:17.480 --> 00:20:17.799
Okay.
410
00:20:17.900 --> 00:20:19.359
So, we've talked about ROP chaining before.
411
00:20:19.500 --> 00:20:22.319
It seems like this gadget chaining would be something where
412
00:20:22.339 --> 00:20:25.759
you want your exploit to be dynamic. In other words...
413
00:20:25.920 --> 00:20:28.420
You don't want to write all the code ahead of
414
00:20:28.480 --> 00:20:31.359
time and then sicken on something, right? You want it
415
00:20:31.480 --> 00:20:36.500
to assemble the code or whatever that's going to run dynamically.
416
00:20:36.619 --> 00:20:38.400
Well, it's part of living off the land, isn't it?
417
00:20:38.420 --> 00:20:40.640
When you can't write to the system. Yeah.
418
00:20:40.700 --> 00:20:43.900
And it's also part of bypassing some of the like
419
00:20:44.019 --> 00:20:46.559
endpoint detection systems and that sort of stuff where it's like, well,
420
00:20:46.579 --> 00:20:48.569
I'm not sure what the base memory address of this
421
00:20:48.589 --> 00:20:51.009
thing is going to be. But if I call these
422
00:20:51.089 --> 00:20:53.910
two particular small chain things, then I can figure out
423
00:20:53.930 --> 00:20:57.369
where it is. So sometimes it is, yeah, Carl, it's
424
00:20:57.440 --> 00:20:59.609
how do I get this thing to dynamically stitch on
425
00:20:59.630 --> 00:21:02.950
the remote system, not knowing exactly where programs are running.
426
00:21:03.190 --> 00:21:03.390
Right.
427
00:21:03.529 --> 00:21:09.250
Interesting. Okay. So remember we were talking about the upgrade-oriented
428
00:21:09.589 --> 00:21:15.220
hacks or problems? This is number two. Public POC exposes
429
00:21:15.359 --> 00:21:20.619
critical Veeam agent privilege escalation. And I'm not sure if
430
00:21:20.680 --> 00:21:22.960
this is the same thing, but I did read this
431
00:21:23.039 --> 00:21:29.599
week that Patch Tuesday compromised Windows backup. And I'm not
432
00:21:29.680 --> 00:21:34.480
sure if this is exactly the same story, but this
433
00:21:34.559 --> 00:21:36.680
is a Veeam endpoint backup service.
434
00:21:36.720 --> 00:21:39.849
Yeah, so this is Veeam. I haven't seen any connection
435
00:21:39.880 --> 00:21:41.509
between the two, but maybe there is.
436
00:21:41.910 --> 00:21:42.190
Maybe.
437
00:21:42.390 --> 00:21:48.220
Yeah, so it's just a bad week for backup services, but... Yeah,
438
00:21:48.240 --> 00:21:51.839
in this particular one, it's a critical local privilege escalation
439
00:21:51.880 --> 00:21:56.049
vulnerability in any Veeam agent running on a Windows server.
440
00:21:57.390 --> 00:22:00.789
And it is actively being exploited. And there is a
441
00:22:00.869 --> 00:22:03.509
proof of concept as of September 22nd that's out there
442
00:22:03.529 --> 00:22:06.329
that is super simple to run. Whoever runs it on
443
00:22:06.349 --> 00:22:08.470
a Windows box gets full system level privileges.
444
00:22:08.960 --> 00:22:09.900
Yikes.
445
00:22:10.400 --> 00:22:14.440
And Veeam, for people who may or may not know Veeam,
446
00:22:14.559 --> 00:22:18.960
Veeam backup agents are running pretty ubiquitously on almost any
447
00:22:19.579 --> 00:22:25.279
Windows system. So if you're running the Veeam infrastructure in
448
00:22:25.319 --> 00:22:28.769
your environment, most likely you're running these agents on most
449
00:22:28.809 --> 00:22:30.680
of your Windows servers. So you are going to want
450
00:22:30.700 --> 00:22:31.309
to make sure you patch.
451
00:22:31.329 --> 00:22:33.890
We've also said many times in the past, you guys
452
00:22:33.910 --> 00:22:40.359
have said, that backup systems are particularly vulnerable because they
453
00:22:40.539 --> 00:22:43.680
usually run with system level privileges. Oh, yeah. And so,
454
00:22:43.700 --> 00:22:44.440
they're a really.
455
00:22:44.460 --> 00:22:46.059
They're a nice target.
456
00:22:46.079 --> 00:22:46.779
A nice target.
457
00:22:46.819 --> 00:22:50.390
And they have this really sassy ability, usually the accounts
458
00:22:50.430 --> 00:22:53.690
where we can request backup rights, which means you can
459
00:22:53.750 --> 00:22:56.349
touch any file, you can do all sorts of things
460
00:22:56.390 --> 00:22:59.609
with files and not actually be audited by any auditing systems.
461
00:22:59.650 --> 00:22:59.890
Wow.
462
00:22:59.930 --> 00:23:03.119
And they're usually run under the credentials of a guy
463
00:23:03.130 --> 00:23:07.319
named randy who hasn't worked there in eight years.
464
00:23:08.500 --> 00:23:12.220
Ah funny yeah i miss randy all right so so
465
00:23:12.240 --> 00:23:15.180
there's a public poc there's a patch i take it.
466
00:23:15.220 --> 00:23:17.660
There is yeah go out and patch uh and look
467
00:23:17.680 --> 00:23:19.700
for the article will explain some of the indicators of
468
00:23:19.740 --> 00:23:21.579
compromise if you need to be worried about you know
469
00:23:21.839 --> 00:23:22.440
what you might.
470
00:23:22.619 --> 00:23:23.769
What may have happened.
471
00:23:23.809 --> 00:23:27.029
Okay now this is a new one on me ascii
472
00:23:27.150 --> 00:23:31.849
smuggling crosses over from AI prompt injection to phishing evasion.
473
00:23:32.069 --> 00:23:33.170
What's old is new again.
474
00:23:33.809 --> 00:23:35.009
What the heck is ASCII smoke?
475
00:23:35.170 --> 00:23:38.369
So, we've talked about prompt injection in the past where
476
00:23:38.809 --> 00:23:41.849
you- Can we just take a second and realize- Please.
477
00:23:41.950 --> 00:23:47.430
Patrick is talking about prompt injection as old. Like, you know,
478
00:23:47.490 --> 00:23:52.470
back a thousand, like, maybe nine months ago when this
479
00:23:52.509 --> 00:23:55.630
was happening. And it's like an eon ago, but continue, sorry.
480
00:23:55.670 --> 00:23:57.490
Yes. Back in the dawn of time.
481
00:23:57.759 --> 00:23:57.890
Yeah.
482
00:23:58.700 --> 00:24:04.329
Uh, you know, uh, I feel like Mad Max, you know, um, you,
483
00:24:04.589 --> 00:24:06.670
if you wanted to get a prompt in, then you
484
00:24:06.730 --> 00:24:10.450
could take a word and you could put ASCII in
485
00:24:10.630 --> 00:24:14.369
the middle of it. That's not visible. So that the,
486
00:24:14.789 --> 00:24:17.269
you know, the, the, the checkers wouldn't be able to
487
00:24:17.349 --> 00:24:19.099
find the words they're looking for. So this is a,
488
00:24:19.089 --> 00:24:21.930
this is an example where when somebody is looking for
489
00:24:22.019 --> 00:24:26.279
the word, that's a mistake. So back in the old, old, old,
490
00:24:26.359 --> 00:24:30.289
old days, SQL injection. So when we first found out
491
00:24:30.309 --> 00:24:34.049
about SQL injection, now that's real old days. When we
492
00:24:34.069 --> 00:24:39.900
first found out about SQL injection, there was this idea, well,
493
00:24:39.940 --> 00:24:41.539
we'll just check for the word delete.
494
00:24:41.799 --> 00:24:42.059
Right.
495
00:24:42.299 --> 00:24:44.339
If the word delete's in the input, then that must
496
00:24:44.400 --> 00:24:47.720
mean they're trying to do something fishy. So we'll check
497
00:24:47.740 --> 00:24:51.200
for the word delete, and then we'll check for single quotes. Well,
498
00:24:51.220 --> 00:24:55.730
then if I type in D-E-L single quote E-T-E, it
499
00:24:56.630 --> 00:24:58.839
won't find the word delete. And then it'll remove the
500
00:24:58.859 --> 00:25:01.829
single quote for me. Yeah. And so I'm basically having
501
00:25:01.900 --> 00:25:07.309
their order of operations bake in my attack vector. This
502
00:25:07.369 --> 00:25:08.049
isn't that.
503
00:25:08.109 --> 00:25:09.990
They also didn't look for drop table.
504
00:25:10.809 --> 00:25:15.829
Yeah, little bobby tables. Yeah. So this is something that
505
00:25:15.869 --> 00:25:18.019
we saw in the prompt injection space. Well, now it's
506
00:25:18.059 --> 00:25:22.019
being reborn in phishing evasion because a lot of the
507
00:25:22.039 --> 00:25:24.500
phishing tools, or some of the phishing tools at least,
508
00:25:24.940 --> 00:25:28.539
are looking for words that shouldn't be you know, in
509
00:25:28.579 --> 00:25:33.339
the message. And again, they're falling back on this same thing. So,
510
00:25:33.380 --> 00:25:36.420
this means if, you know, play stupid games, win stupid prizes.
511
00:25:37.019 --> 00:25:41.180
If you're trying to out weaponize things, instead of approaching
512
00:25:41.200 --> 00:25:43.579
it from a systemic view, you're going to lose. Right.
513
00:25:43.720 --> 00:25:46.460
So, well, let's back up a little bit. ASCII smuggling
514
00:25:47.210 --> 00:25:51.089
is the use of invisible or non-rendering Unicode characters to
515
00:25:51.130 --> 00:25:53.849
hide content. So, and it says right here in the
516
00:25:53.890 --> 00:25:57.769
what is ASCII smuggling paragraph that there's a block called
517
00:25:57.789 --> 00:26:01.210
the Unicode Tags Block that contains a shadow copy of
518
00:26:01.250 --> 00:26:06.130
the printable ASCII characters, but they're invisible. Yeah. And that
519
00:26:06.190 --> 00:26:09.930
was originally intended for language tagging and is now largely deprecated.
520
00:26:10.349 --> 00:26:10.609
Yeah.
521
00:26:10.670 --> 00:26:13.569
But it's still there in the ASCII character set.
522
00:26:13.910 --> 00:26:17.210
Here's what I would say. Most communications, most letters you've
523
00:26:17.269 --> 00:26:20.750
ever written, most emails you've ever written are ASCII codes
524
00:26:20.750 --> 00:26:21.910
127 and below.
525
00:26:22.049 --> 00:26:22.609
Right. Right?
526
00:26:23.809 --> 00:26:29.130
So, like, for example... You know, a uppercase A might be,
527
00:26:29.750 --> 00:26:31.569
you know, a decimal would be 62.
528
00:26:31.569 --> 00:26:31.809
Yeah.
529
00:26:32.170 --> 00:26:36.160
So, under 127 is all the printable normal sort of characters.
530
00:26:36.200 --> 00:26:39.140
You would use uppercase, lowercase, numbers, you know, some of
531
00:26:39.160 --> 00:26:40.299
the symbols, that sort of stuff.
532
00:26:41.019 --> 00:26:41.450
But there are.
533
00:26:42.140 --> 00:26:45.099
thousands of ASCII codes, right? Because if you want the
534
00:26:45.299 --> 00:26:48.619
umlaut or you want the, you know, Euro symbol or
535
00:26:48.660 --> 00:26:49.829
you want something like that, right?
536
00:26:49.849 --> 00:26:50.569
Cyrillic letters.
537
00:26:51.150 --> 00:26:53.329
But some of them just don't make any sense. Like,
538
00:26:53.390 --> 00:26:58.339
for example, Unicode E0041 is a mirror A.
539
00:26:58.359 --> 00:26:58.819
Yeah.
540
00:26:59.019 --> 00:27:03.779
So, it looks like A, but it's flipped. That's when Dr.
541
00:27:03.819 --> 00:27:06.779
Strange wants to send email from the mirror realm. Yeah,
542
00:27:06.859 --> 00:27:09.839
like why would you have a mirror A? I don't
543
00:27:09.900 --> 00:27:13.259
even know where that would be absolutely used. I think
544
00:27:13.319 --> 00:27:15.779
there's like Finnish and things like that do have a
545
00:27:15.819 --> 00:27:16.380
backwards A.
546
00:27:16.900 --> 00:27:20.180
But a capital A is symmetrical. But it looks the same. Yeah, exactly.
547
00:27:20.200 --> 00:27:21.579
Why flip it? Well, no, it's a lowercase.
548
00:27:21.599 --> 00:27:22.660
Lowercase does not, yeah.
549
00:27:22.680 --> 00:27:25.779
Yeah, so I could see that, but like UEE0041 is
550
00:27:25.839 --> 00:27:26.630
a capital mirrored A.
551
00:27:26.680 --> 00:27:26.779
Oh.
552
00:27:26.799 --> 00:27:32.279
Which- okay that makes no sense at all.
553
00:27:32.230 --> 00:27:33.980
Like why would you and i guess it depends on
554
00:27:34.000 --> 00:27:36.660
the font and whatever but i don't know it just
555
00:27:37.140 --> 00:27:40.819
it seems like there's so much bloat in that unicode
556
00:27:40.880 --> 00:27:43.079
system that maybe maybe we should take a look at
557
00:27:43.099 --> 00:27:44.579
it and pare it down again and go well you
558
00:27:44.599 --> 00:27:46.420
know what there are certain things we shouldn't.
559
00:27:46.200 --> 00:27:49.559
Have there anymore or we should check that all of
560
00:27:49.660 --> 00:27:53.809
our inputs are within the 127 and lower range sure Right.
561
00:27:53.829 --> 00:27:54.259
That's right.
562
00:27:54.410 --> 00:27:54.630
Right.
563
00:27:54.779 --> 00:27:57.059
And then flag it and say, Hey, there's, there's, there's
564
00:27:57.079 --> 00:27:59.059
higher level Unicode here. You're going to have a.
565
00:27:59.059 --> 00:28:01.799
Much more success with that ladder strategy just because you're
566
00:28:01.839 --> 00:28:03.549
not going to get the world to agree that that
567
00:28:03.920 --> 00:28:04.869
to deprecate things.
568
00:28:05.009 --> 00:28:05.450
Right.
569
00:28:06.049 --> 00:28:06.289
Yeah.
570
00:28:06.630 --> 00:28:09.390
So this is being used in how, how is it
571
00:28:09.410 --> 00:28:14.490
being used to, um, avoid malware detection is it like
572
00:28:14.950 --> 00:28:16.490
spam filter kind of thing.
573
00:28:16.430 --> 00:28:19.650
Yeah so it's it's exactly that so like take take
574
00:28:19.690 --> 00:28:22.569
something like i write the word like buy now and
575
00:28:22.829 --> 00:28:24.710
and my spam filter is looking for that but if
576
00:28:24.779 --> 00:28:28.599
i if i use a uh you know buy now
577
00:28:28.680 --> 00:28:32.539
but it's yeah exactly but the u is backwards but
578
00:28:32.559 --> 00:28:34.700
it still looks like by now it's going to bypass
579
00:28:34.720 --> 00:28:37.559
that spam filter because it's looking it's literally breaking all
580
00:28:37.599 --> 00:28:41.019
of the text down into unicode and going okay You know,
581
00:28:41.500 --> 00:28:43.460
is this something I'm looking for? And that's where Patrick
582
00:28:43.500 --> 00:28:46.000
comes back to the arms race of you're looking for
583
00:28:46.019 --> 00:28:49.680
an exact phrase of some sort in an exact ASCII,
584
00:28:50.220 --> 00:28:51.119
you know, sequence.
585
00:28:51.339 --> 00:28:52.019
Right.
586
00:28:52.099 --> 00:28:56.230
And if I can inject an unprintable invisible character or
587
00:28:56.289 --> 00:28:58.970
I can inject a mirrored character, I'm going to bypass
588
00:28:58.990 --> 00:29:00.589
your filter and you're not going to see it.
589
00:29:00.650 --> 00:29:02.569
But you, the user, are still going to see it
590
00:29:02.630 --> 00:29:04.049
and absorb it. Yeah, exactly. Right.
591
00:29:04.250 --> 00:29:06.950
Okay. All right. So, let's move on to our top
592
00:29:06.970 --> 00:29:11.720
story this week. The HTTP query method. Again, this is
593
00:29:11.759 --> 00:29:19.539
the third upgrade. In this case, it's upgrading the HTTP protocol. So,
594
00:29:19.960 --> 00:29:21.519
is it a new method?
595
00:29:21.740 --> 00:29:23.619
Yes. Yeah, it's a third way.
596
00:29:23.740 --> 00:29:24.079
Ooh.
597
00:29:24.240 --> 00:29:26.440
So, there's post and there's get.
598
00:29:26.559 --> 00:29:28.069
Yeah. And there's put.
599
00:29:28.619 --> 00:29:29.779
Most and put.
600
00:29:29.799 --> 00:29:30.420
Put is for.
601
00:29:30.440 --> 00:29:33.380
So, now there's query, which is kind of halfway between.
602
00:29:33.420 --> 00:29:35.569
Put is for upgrading. Post is for adding.
603
00:29:35.809 --> 00:29:36.369
Yeah, but.
604
00:29:36.490 --> 00:29:37.529
If you want to map.
605
00:29:37.549 --> 00:29:39.849
Query is kind of halfway between get and post. Hmm.
606
00:29:40.119 --> 00:29:44.079
So most systems will deal with get pretty straightforward because
607
00:29:44.119 --> 00:29:49.700
it doesn't... I think it's... Idempotent is the word that
608
00:29:49.720 --> 00:29:53.259
we say. What word did you... Basically, it's repeatable. It
609
00:29:54.119 --> 00:29:58.849
doesn't change state, doesn't do anything. But the problem is
610
00:29:58.910 --> 00:30:03.660
that post... does change state does change things and this
611
00:30:03.720 --> 00:30:05.240
is kind of in the middle and the problem is
612
00:30:05.309 --> 00:30:08.269
that most systems were written for one of the other
613
00:30:09.069 --> 00:30:10.829
and if this is a new this was like june
614
00:30:10.829 --> 00:30:15.269
2026 um and so what does your system do when
615
00:30:15.309 --> 00:30:17.190
it gets a query you probably don't know and if
616
00:30:17.210 --> 00:30:22.250
you say you know you're probably guessing and so it's
617
00:30:22.430 --> 00:30:24.450
it's a it's a new thing that people have to
618
00:30:24.490 --> 00:30:26.809
test against and if you don't test against it then
619
00:30:26.829 --> 00:30:29.700
you're leaving it to like just luck And I think
620
00:30:29.720 --> 00:30:30.339
that's a bad idea.
621
00:30:30.640 --> 00:30:34.190
Well, okay. But if I'm writing an API controller, I
622
00:30:34.470 --> 00:30:40.549
specifically decorate my endpoints with the verbs that they handle, right?
623
00:30:40.690 --> 00:30:43.119
So this is going to get control on a post.
624
00:30:43.160 --> 00:30:44.880
This one's going to get control on a put. This
625
00:30:44.980 --> 00:30:47.079
one's going to get control on a get. If I
626
00:30:47.180 --> 00:30:52.789
don't write one that specifically handles query, should I still worry? Yeah.
627
00:30:53.349 --> 00:30:56.390
Not necessarily, but it also depends on how the underlying
628
00:30:56.450 --> 00:31:00.369
like web server handle is it and that sort of stuff, right? So,
629
00:31:01.210 --> 00:31:06.130
the system you're using, right, to share up web files
630
00:31:07.369 --> 00:31:09.650
may just have defaults and be like, oh, yeah, we
631
00:31:09.690 --> 00:31:11.170
now support this query thing and it gives you the
632
00:31:11.190 --> 00:31:13.309
ability to query all the files that exist in the
633
00:31:13.329 --> 00:31:13.849
web directory.
634
00:31:14.450 --> 00:31:15.170
Cool, right?
635
00:31:15.789 --> 00:31:17.930
Now we know, right? And you're like, oh, well, crap,
636
00:31:17.950 --> 00:31:20.250
I don't want that. So, even though you didn't decorate it,
637
00:31:21.130 --> 00:31:23.250
You know, you still can call some of these functions.
638
00:31:23.269 --> 00:31:25.789
And there are plenty of functions that you may not
639
00:31:25.849 --> 00:31:28.470
decorate that I can still call and get information on
640
00:31:28.589 --> 00:31:31.940
certain files. And it's just the way the web server
641
00:31:32.059 --> 00:31:35.019
itself that's serving up those files handles those verbs.
642
00:31:35.039 --> 00:31:37.640
But I mean, now, if that web server does that
643
00:31:37.680 --> 00:31:40.220
by default, it's by default insecure.
644
00:31:40.460 --> 00:31:41.200
Right, exactly.
645
00:31:41.269 --> 00:31:44.230
So, that's up. that's a vulnerability in the website.
646
00:31:44.509 --> 00:31:44.789
Yeah.
647
00:31:44.970 --> 00:31:45.789
Not in your code.
648
00:31:45.849 --> 00:31:46.069
Yeah.
649
00:31:46.130 --> 00:31:50.109
And that's, I think it'll be interesting to see how different,
650
00:31:50.410 --> 00:31:54.599
you know, web serving technologies, right? Whether it's whatever, it
651
00:31:54.619 --> 00:31:58.700
doesn't matter. Django to IS to whatever, how they handle
652
00:31:58.759 --> 00:32:02.250
this new verb. And whether they just make it a
653
00:32:02.329 --> 00:32:05.130
default and say, hey, by default, we're going to do X.
654
00:32:05.349 --> 00:32:08.410
Or whether they make it shut off and you have
655
00:32:08.450 --> 00:32:10.089
to come turn it on for whatever.
656
00:32:09.849 --> 00:32:10.789
Reason you want it on. I would hope that that
657
00:32:10.809 --> 00:32:11.910
would be the way they do it. That's what I'm
658
00:32:11.930 --> 00:32:12.650
looking for.
659
00:32:12.869 --> 00:32:13.009
Yep.
660
00:32:13.029 --> 00:32:15.990
But that's not a guarantee. But we didn't see that
661
00:32:16.019 --> 00:32:18.099
with most of the other verbs, right? I asked if
662
00:32:18.140 --> 00:32:20.700
you share up, you know, a site for the most part,
663
00:32:20.819 --> 00:32:22.980
if all the verbs that are there are there and
664
00:32:23.019 --> 00:32:23.640
you can call them.
665
00:32:23.859 --> 00:32:27.380
Well, yeah. IIS, though. I mean, come on. That was
666
00:32:27.480 --> 00:32:30.180
created before the idea of web security was an idea.
667
00:32:30.200 --> 00:32:32.619
Tomcat's pretty good, but it's had a lot of problems, too.
668
00:32:33.059 --> 00:32:38.279
But I imagine Microsoft with ASP.NET and all of the
669
00:32:38.380 --> 00:32:43.690
major vendors of backend and certainly the clouds probably would
670
00:32:43.769 --> 00:32:46.309
have been aware that query was coming.
671
00:32:46.670 --> 00:32:47.430
I would hope to.
672
00:32:47.650 --> 00:32:51.289
They're probably working with the W3C or whoever put this out.
673
00:32:51.769 --> 00:32:53.930
to say, okay, well, this is what's going on and
674
00:32:53.990 --> 00:32:55.579
here's how you got to handle it.
675
00:32:55.690 --> 00:32:58.029
Yeah, absolutely. I would hope so too. Just, I would
676
00:32:58.049 --> 00:33:00.720
be cautious if, and actually, you know what might be interesting?
677
00:33:00.740 --> 00:33:01.359
Hope is not a plan.
678
00:33:01.920 --> 00:33:05.900
It might be interesting to see how many web scanners
679
00:33:05.980 --> 00:33:08.279
out there, like, you know, hackers who are trying to
680
00:33:08.299 --> 00:33:10.099
hit your site, they're looking for all different types of things.
681
00:33:10.119 --> 00:33:13.680
It'll be interesting to see when people start using this verb.
682
00:33:14.059 --> 00:33:14.819
Right.
683
00:33:14.980 --> 00:33:17.180
In their scanning to see if it just throws weird
684
00:33:17.259 --> 00:33:19.460
errors that they can latch onto. Right.
685
00:33:19.660 --> 00:33:22.519
Well, it sounds like that's the pointy end of the show.
686
00:33:22.599 --> 00:33:26.099
So thank you, Dwayne and Patrick. And thanks for listening, everybody.
687
00:33:26.140 --> 00:33:28.880
That's what we had for all the stories last week.
688
00:33:28.920 --> 00:33:31.319
And we'll see you next week on Security This Week. Bye-bye.
689
00:33:31.339 --> 00:33:31.900
Good to see you, Colin.
