Oops, all vulns! (Citrix NetScaler problems, the FBI ShinyHunters saga cont’d and MORE)

WEBVTT
1
00:00:00.111 --> 00:00:03.254
So Citrix, obviously bad week, embarrassing.
2
00:00:03.274 --> 00:00:05.756
We were all talking about your vulns all weekend.
3
00:00:05.836 --> 00:00:10.160
People were coming in over the weekend, chasing your vulns before you even put out an advisory.
4
00:00:10.460 --> 00:00:12.241
Start putting your stuff out faster.
5
00:00:12.301 --> 00:00:16.365
Literally the first thing that I saw was shut it down.
6
00:00:16.565 --> 00:00:19.387
The fact that we found out about this via Reddit is crazy.
7
00:00:19.488 --> 00:00:22.470
This is not the first of these vulnerabilities.
8
00:00:22.630 --> 00:00:24.352
Let's zoom out and make an eye contact.
9
00:00:25.112 --> 00:00:27.915
These zero days are getting cheap and they're not slowing down.
10
00:00:34.043 --> 00:00:36.004
Good morning, hackers.
11
00:00:36.084 --> 00:00:41.266
Welcome to The Lowdown presented by Mays, the best podcast on the internet for hackers.
12
00:00:41.727 --> 00:00:42.507
Matt, how you doing, man?
13
00:00:42.647 --> 00:00:43.668
I see you're wearing a hoodie.
14
00:00:43.728 --> 00:00:45.769
Has Texas finally fallen below 95 degrees?
15
00:00:45.969 --> 00:00:46.309
No, man.
16
00:00:46.329 --> 00:00:47.129
It's the air conditioning.
17
00:00:47.149 --> 00:00:48.650
I'm in my shortest shorts.
18
00:00:48.830 --> 00:00:52.652
It's 93, but we do have four days of crazy rain coming up.
19
00:00:52.672 --> 00:00:55.773
This is how Texas enters fall, by the way, every year.
20
00:00:55.973 --> 00:00:58.895
It's like, okay, now we're going to flood biblically.
21
00:00:59.655 --> 00:01:02.579
Uh, and then the temperature is going to fall because of it.
22
00:01:02.659 --> 00:01:03.479
So yeah, that's it.
23
00:01:03.760 --> 00:01:09.245
But I'm actually going to miss the first couple of cold days in Texas, which is sad because it's like a religious experience for me.
24
00:01:09.285 --> 00:01:15.232
Like opening that door on that first day and the air hits your nostrils and it's like a little bit chilly, just like a little bit.
25
00:01:15.332 --> 00:01:17.254
It's like number starts with a six.
26
00:01:17.294 --> 00:01:18.695
It's like, oh man, it's nice.
27
00:01:18.715 --> 00:01:19.396
But I'm going to miss it.
28
00:01:19.416 --> 00:01:19.836
You know why?
29
00:01:20.817 --> 00:01:21.158
Why is that?
30
00:01:23.404 --> 00:01:30.451
your boy is going to be keynoting the AI summit at sector, which is black hat Canada.
31
00:01:30.631 --> 00:01:33.373
So I am the opening keynote for the AI summit.
32
00:01:33.393 --> 00:01:34.855
Just saying, what are you talking about?
33
00:01:34.875 --> 00:01:37.397
Are you going to be like, AI is going to kill us all or what's the, what's the game plan?
34
00:01:37.497 --> 00:01:40.379
AI is already killing us all is the talk.
35
00:01:40.439 --> 00:01:52.910
No, so the talk is the commoditization of the nation state hacker, kind of stuff that we've talked about, about like how we make content sometimes about like spyware and nation state stuff and like the comments are like, 99% of people don't need to worry about this.
36
00:01:52.930 --> 00:01:55.432
And it's like, well, yeah, but those 1% are in our audience.
37
00:01:56.032 --> 00:02:06.164
But now threat models are changing because people with lower budgets, lower skill sets are able to actually weaponize things.
38
00:02:06.184 --> 00:02:15.075
We have a story on our show notes today about open weight model capabilities in the cyber realm, which are only about four to six months behind Frontier.
39
00:02:15.715 --> 00:02:16.817
model capabilities.
40
00:02:16.837 --> 00:02:18.999
And that's kind of the talk, right?
41
00:02:19.039 --> 00:02:23.284
It's just like the timeline history of nation state level zero days.
42
00:02:23.304 --> 00:02:29.791
And then what we're seeing now and how like the value of a zero day is just going down and everyone's threat model is going to change.
43
00:02:29.991 --> 00:02:30.632
So there you go.
44
00:02:31.012 --> 00:02:33.355
If you can't come to my keynote, you just got the cliff notes.
45
00:02:33.715 --> 00:02:36.218
Thank you for coming to quite literally my TED Talk.
46
00:02:37.299 --> 00:02:37.979
Yeah, yeah.
47
00:02:52.031 --> 00:02:59.455
Talking about Citrix in particular, you know, we'll kind of dive into these big net scaler bugs that have been going on the last couple of days.
48
00:02:59.735 --> 00:03:07.418
But you made it sound like there was a larger, like, macro-level conversation, kind of some bad blood with the community as it applies to Citrix.
49
00:03:07.499 --> 00:03:08.559
Can you kind of fill me in on that?
50
00:03:08.579 --> 00:03:10.260
Because I'm not well-read on Citrix.
51
00:03:10.978 --> 00:03:15.439
What the hell is going on at edge device companies right now?
52
00:03:15.599 --> 00:03:17.160
Like what's going on in Citrix?
53
00:03:17.180 --> 00:03:18.540
We're asleep behind the wheel.
54
00:03:18.660 --> 00:03:19.560
And then what?
55
00:03:19.780 --> 00:03:25.582
Four other stories we're going to talk about right after Citrix, our edge device zero days out of the 90s.
56
00:03:25.942 --> 00:03:26.102
Yeah.
57
00:03:26.122 --> 00:03:32.543
Like, we just talked about the Cisco email gateway one last week, and it was SQL injection in an email.
58
00:03:32.783 --> 00:03:33.644
In an email gateway.
59
00:03:33.704 --> 00:03:34.244
That's like unholy.
60
00:03:34.264 --> 00:03:34.784
What are we doing?
61
00:03:35.344 --> 00:03:36.225
What are we doing?
62
00:03:36.385 --> 00:03:36.625
Right?
63
00:03:36.705 --> 00:03:43.909
Like, I hate, I hate, hate, hate throwing stones, you know, like throwing stones, glass houses, all of that from the cheap seats.
64
00:03:44.089 --> 00:03:45.029
But we're not.
65
00:03:45.089 --> 00:03:45.730
We've been here.
66
00:03:45.770 --> 00:03:46.530
We've done this.
67
00:03:46.670 --> 00:03:48.171
Like, this is nuts.
68
00:03:48.291 --> 00:03:57.676
I know that security is hard, guys, but this is embarrassing when Citrix, if you guys are unfamiliar for some reason, Citrix is wildly popular as an edge device.
69
00:03:58.276 --> 00:04:06.442
that companies use to give access to sensitive internal machines and web apps and things like that from outside.
70
00:04:06.882 --> 00:04:10.505
So, of course, these are juicy targets for attackers to get into corporate networks.
71
00:04:10.985 --> 00:04:16.469
And then this is the, what, umpteenth time in the last 18 months that I've seen
72
00:04:17.490 --> 00:04:25.353
us know about an RCE being exploited in Citrix from the wild days before we've heard about it from Citrix.
73
00:04:26.013 --> 00:04:26.673
Yeah, it's pretty bad.
74
00:04:27.193 --> 00:04:28.333
Like, come on.
75
00:04:28.534 --> 00:04:29.094
You know what I mean?
76
00:04:29.414 --> 00:04:38.657
Like, if we're all collapsing all of our exploitation timelines that, like we just said, zero days are getting cheaper and, like, exploitation of zero days is getting faster, zero days have always been a thing.
77
00:04:38.677 --> 00:04:39.677
This isn't new, right?
78
00:04:39.717 --> 00:04:43.678
Like, exploitation of previously unknown vulnerabilities is not new, right?
79
00:04:44.098 --> 00:04:45.799
But to just be like,
80
00:04:47.227 --> 00:04:54.235
How many days later that the whole industry is already sharing intel about this exploit did Citrix come out and do it?
81
00:04:54.315 --> 00:04:55.417
Should we go through the timeline?
82
00:04:57.179 --> 00:05:02.064
Do you know the first place I saw talks about this vulnerability?
83
00:05:02.264 --> 00:05:03.085
Yeah, was it Reddit?
84
00:05:03.125 --> 00:05:04.167
That's also where I saw it.
85
00:05:05.093 --> 00:05:11.256
Dude, so guys, like, please, we'll have the editor put this Reddit thread on the screen.
86
00:05:11.576 --> 00:05:15.899
But literally, the first thing that I saw was shut it down.
87
00:05:16.139 --> 00:05:28.625
A phone call that I got from my, not Citrix, from the distributor that works with the Dutch National Intelligence or Dutch Crime Center was like, unplug your Citrix device right now and hung up the phone.
88
00:05:28.665 --> 00:05:29.745
And I saw that on Reddit.
89
00:05:29.765 --> 00:05:32.367
That's how I was like, whoa, okay, what the hell is going on with Citrix?
90
00:05:33.067 --> 00:05:33.447
Insane.
91
00:05:33.828 --> 00:05:43.094
That is our threat intelligence right now for our massive B2B edge device that controls all of the ingress into my corporate network.
92
00:05:43.735 --> 00:05:49.799
I get some random MSP in the Netherlands got a heads up from their cert.
93
00:05:49.819 --> 00:05:51.300
First of all, kudos Dutch cert.
94
00:05:51.580 --> 00:05:55.223
You've been on fire this week because you also just arrested the shiny hunters guy.
95
00:05:55.243 --> 00:05:56.144
We're going to get to that next.
96
00:05:56.524 --> 00:05:57.985
But like, okay, cool.
97
00:05:58.005 --> 00:06:00.467
The Dutch are cracked and like doing awesome stuff.
98
00:06:00.667 --> 00:06:00.947
Yeah.
99
00:06:01.087 --> 00:06:13.239
But like literally a random IT supplier, a random IT supplier in the Netherlands called somebody who decided to put on r slash Citrix, not even r slash cybersecurity.
100
00:06:13.499 --> 00:06:16.823
It's not like, this isn't like a threat Intel feed, right?
101
00:06:17.203 --> 00:06:19.545
It's like, does anyone know what's going on with Netscaler?
102
00:06:19.746 --> 00:06:21.868
We just got a call from IT supplier.
103
00:06:21.888 --> 00:06:24.030
They couldn't give any details, but they invite us to turn...
104
00:06:24.190 --> 00:06:24.871
Burn it off.
105
00:06:25.231 --> 00:06:27.172
Shut down our net scalers immediately.
106
00:06:27.553 --> 00:06:31.476
How is that the guidance and the first flow that we get?
107
00:06:31.496 --> 00:06:32.957
That's absolutely insane.
108
00:06:33.257 --> 00:06:34.278
Yeah.
109
00:06:34.798 --> 00:06:35.899
This vuln is kind of crazy.
110
00:06:35.919 --> 00:06:38.361
I want you to talk about the vuln because you dug into it, right?
111
00:06:38.561 --> 00:06:39.102
Yeah, I did.
112
00:06:39.422 --> 00:06:43.925
The other bit that I want to make sure that we talk about for our listeners is like, what the hell do we do about this?
113
00:06:44.706 --> 00:06:59.411
Because not only is the vuln and the exploitation kind of nuts, Gossie the dog, Kevin Beaumont, kudos, always awesome at tracking these kinds of things, is like on the hunt to figure out which of these devices on the internet are like already owned.
114
00:07:00.191 --> 00:07:03.232
He's over 100 victim orgs already.
115
00:07:03.672 --> 00:07:04.973
And this one's super weird.
116
00:07:05.013 --> 00:07:10.255
It's not like a spray and pray type situation, which I think is going on already now.
117
00:07:10.415 --> 00:07:12.435
I think Great Noise published some spray and prays going on.
118
00:07:12.935 --> 00:07:14.436
But the ones that he's talking about...
119
00:07:15.205 --> 00:07:21.495
Like each one has a unique web shell that can't be scanned remotely unless you're the attacker.
120
00:07:21.775 --> 00:07:21.955
Right.
121
00:07:21.975 --> 00:07:26.062
So he's saying that this is espionage level exploitation going on.
122
00:07:26.162 --> 00:07:26.342
Right.
123
00:07:26.362 --> 00:07:30.829
So this is not super like opportunistic is like what the evidence is pointing to for him.
124
00:07:31.389 --> 00:07:37.114
He's like naming the whole thing pit scaler in his write-ups because it like dumps like a Perl script type thing or whatever.
125
00:07:37.935 --> 00:07:41.498
But they all have like unique IPs per victim.
126
00:07:42.159 --> 00:07:53.008
So like all of the threat intel that's coming out that he's tracking is like one at a time helping him map like victim orgs because the IOCs are unique per victim.
127
00:07:53.228 --> 00:07:53.809
This is weird.
128
00:07:53.909 --> 00:07:54.730
It's like a weird one.
129
00:07:55.350 --> 00:07:57.732
Yeah, I'm not sure if I agree that it's espionage, though.
130
00:07:57.872 --> 00:08:04.037
I would have agreed with him five years ago, like, that having web shells pop up at that rate or espionage.
131
00:08:04.237 --> 00:08:08.300
Are you saying that the nation-state threat actor is commoditized?
132
00:08:08.521 --> 00:08:09.421
I may be saying that.
133
00:08:09.541 --> 00:08:16.667
I may even be saying that, yeah, the average threat criminal can whip up 10 web shells in a minute.
134
00:08:17.247 --> 00:08:18.568
With an open-weight model, by the way.
135
00:08:18.809 --> 00:08:21.351
It's a spoiler to the rest of the podcast.
136
00:08:21.611 --> 00:08:22.732
Yeah, man, I just think that, like,
137
00:08:23.652 --> 00:08:24.172
Yeah.
138
00:08:24.252 --> 00:08:28.593
Unless it requires an insane amount of compute, anyone can be a nation state reader.
139
00:08:28.613 --> 00:08:28.873
You're right.
140
00:08:28.933 --> 00:08:35.755
He might have some other indicators for him saying that that I don't have in my notes right here.
141
00:08:35.855 --> 00:08:36.416
Kevin's dope.
142
00:08:36.556 --> 00:08:37.356
So like – Yeah.
143
00:08:37.536 --> 00:08:37.776
Oh, no.
144
00:08:37.796 --> 00:08:41.137
I'm just saying like I don't agree with that, but I know that he's well-read and –
145
00:08:41.317 --> 00:08:42.337
Totally, totally, totally.
146
00:08:43.218 --> 00:08:57.143
But it might be true that like threat hunters, even at his scale, might not be tuning their like, oh, this is nation state signals to our new future world where their capabilities are a bit more commoditized, if you will.
147
00:08:57.283 --> 00:09:00.364
Sorry, just like name of the show is what I'm doing right now.
148
00:09:00.384 --> 00:09:01.024
Yeah, yeah, yeah.
149
00:09:01.044 --> 00:09:02.285
Name of my keynote, name of my keynote.
150
00:09:03.746 --> 00:09:04.086
I'm sorry.
151
00:09:04.106 --> 00:09:04.586
I'm excited.
152
00:09:04.606 --> 00:09:06.127
It's my biggest keynote I've ever done.
153
00:09:06.467 --> 00:09:08.008
I'm kind of jazzed about it.
154
00:09:08.288 --> 00:09:08.488
All right.
155
00:09:08.568 --> 00:09:09.949
You dug into the Volns, right?
156
00:09:09.969 --> 00:09:11.729
You made some videos this week about the Volns.
157
00:09:12.410 --> 00:09:12.610
Yes.
158
00:09:12.870 --> 00:09:18.333
You probably went a little bit more low level than I did on the Volns and the code.
159
00:09:18.393 --> 00:09:21.714
Can you hook me up with understanding what's going on?
160
00:09:21.734 --> 00:09:24.856
Because some of these sound out of the 90s to me, and some of these sound cool.
161
00:09:24.916 --> 00:09:25.276
What's going on?
162
00:09:25.336 --> 00:09:30.698
Yeah, so I guess to set the stage here, it's important to understand, like, low-level, Matt, what is a Netscaler?
163
00:09:30.758 --> 00:09:31.358
I'll be real with you.
164
00:09:31.378 --> 00:09:32.339
I don't know.
165
00:09:32.479 --> 00:09:33.319
I'm not a network engineer.
166
00:09:33.359 --> 00:09:47.545
But what I was reading is that, like, this is your traditional, you know, device that you put in the middle of the line between the internet and the network, and you use it to either, you know, inspect TLS traffic, to do some kind of filtering, or to act as, like, a DMZ gateway, right?
167
00:09:47.565 --> 00:09:47.905
So, yeah.
168
00:09:48.225 --> 00:09:54.230
In a lot of corporate environments, for example, you have the internet, you have your inner traffic, and you want to inspect that traffic, okay?
169
00:09:54.250 --> 00:10:01.677
So you install a rogue cert on devices, and then you have the TLS inspection happen on a device, and you do that for filtering.
170
00:10:01.717 --> 00:10:05.400
It's not a firewall necessarily, but it's kind of like a lightweight version of that.
171
00:10:05.580 --> 00:10:06.181
It's a gateway.
172
00:10:06.261 --> 00:10:11.365
It can do gateway, it can do VPN, it can do application gateway level stuff, and it could do authentication.
173
00:10:11.405 --> 00:10:16.929
So it's like you're sitting at home, you want to get onto internal stuff, internal apps, internal network stuff.
174
00:10:17.470 --> 00:10:20.492
Netscaler is like one of the most popular devices to make that happen.
175
00:10:20.652 --> 00:10:22.934
Okay, and so to do that, right, has to be high performance.
176
00:10:23.014 --> 00:10:24.195
So two things are going to occur.
177
00:10:24.755 --> 00:10:30.559
One, it's going to be written in a memory-unsafe language, unfortunately, like C most of the time.
178
00:10:31.200 --> 00:10:36.423
And two, the code is going to have this thing that I call organizational inertia, right?
179
00:10:36.463 --> 00:10:40.967
Like they're going to have a hard time justifying major changes to it because it works.
180
00:10:41.067 --> 00:10:41.747
Don't touch it.
181
00:10:41.767 --> 00:10:45.210
And if you break it, networks fall offline, and companies don't like that, okay?
182
00:10:45.230 --> 00:10:45.350
Okay.
183
00:10:45.830 --> 00:10:49.272
So there were two CVEs that kind of fell out of this whole threat thing.
184
00:10:49.552 --> 00:10:54.955
We're going to call them 88771 and 88772, okay?
185
00:10:55.515 --> 00:10:57.696
771 is comically bad.
186
00:10:57.896 --> 00:11:01.858
And going back to Matt's comment about this being the 90s, that's true for both CVEs.
187
00:11:02.319 --> 00:11:06.141
The first one is particularly 90s because the exploited CVEs,
188
00:11:06.801 --> 00:11:09.162
endpoint, if you will, is a Perl script.
189
00:11:09.542 --> 00:11:09.802
Okay?
190
00:11:10.122 --> 00:11:13.164
We are not talking about Python or C or Bash.
191
00:11:13.184 --> 00:11:15.745
We are talking about literally a Perl script.
192
00:11:15.805 --> 00:11:17.746
So everything I'm about to say...
193
00:11:18.598 --> 00:11:24.100
Came from a series of two write-ups by Sin Sinology, who is a researcher at Watchtower.
194
00:11:24.460 --> 00:11:25.801
Bro never misses.
195
00:11:25.921 --> 00:11:29.542
Literally some of the best content I've ever seen online for, like, exploit breakdowns.
196
00:11:30.122 --> 00:11:33.664
This first article is called, Oh, look, the foot gun went off again.
197
00:11:33.904 --> 00:11:38.886
We're talking about, like, Bash and Perl in a pipeline that processes user data.
198
00:11:39.546 --> 00:11:43.849
The TLDR on this bug is it is a command injection as root.
199
00:11:44.210 --> 00:11:45.611
Yes, I said that out loud.
200
00:11:45.651 --> 00:11:47.372
That is the bug, and it is 2026.
201
00:11:47.392 --> 00:11:48.173
You are not confused.
202
00:11:49.073 --> 00:12:02.003
What's happening here is when the device has a crash, right, when something crashes on the device, a lot of the times there's this binary called NSPPE, and that binary drops a core, right, a core dump.
203
00:12:02.023 --> 00:12:03.324
This is what happens if the binary is crash.
204
00:12:04.125 --> 00:12:12.593
And in a log, it'll say NSPPE-00, and then in parentheses, the process ID, unexpectedly died, okay?
205
00:12:12.833 --> 00:12:17.257
So that log number is, or that process number is in this log message.
206
00:12:17.657 --> 00:12:20.480
And there's another process called PitBoss.
207
00:12:21.000 --> 00:12:23.883
And what its job is, is to take that PID
208
00:12:24.423 --> 00:12:28.526
and parse it so that you can use that as a core dump number, right?
209
00:12:28.546 --> 00:12:36.512
So it's going to take basically a string, and it's going to parse it using bash inside of Perl, and it's going to use that to do a file operation, okay?
210
00:12:37.253 --> 00:12:46.080
The problem is the way that it parses this string is by using a combination of find and grep on user data,
211
00:12:46.560 --> 00:12:53.363
So what you're able to do is literally just try to log in to the NetScaler and have a string that matches that pattern.
212
00:12:53.903 --> 00:13:01.667
But on the inside of that pattern, you can just do a simple command injection, and it will run that command as root because PitBoss is running as root.
213
00:13:02.167 --> 00:13:02.927
That's the whole thing.
214
00:13:02.987 --> 00:13:08.009
Literally log in with the same pattern as the core name, and you get into the device.
215
00:13:08.109 --> 00:13:09.130
It's, like, trivially simple.
216
00:13:09.850 --> 00:13:11.051
So that's the first bug, okay?
217
00:13:11.091 --> 00:13:14.612
That one's, like, kind of funny, kind of 1990s, kind of command injection.
218
00:13:14.632 --> 00:13:14.752
Yeah.
219
00:13:16.333 --> 00:13:45.875
the second yeah jump in before second bud send it the footgun blog has one of the funniest like AI generated yeah memes ever that we need to show on screen of like the blinged out Netscaler box and they've named it AGI pronounced A-G let's go and he's got like the bling watch and a Citrix bling thing and a grill anyway it's so good dude maybe AI wasn't a mistake this is great okay continue yeah
220
00:13:46.406 --> 00:13:47.686
Yeah, that's the first bug, right?
221
00:13:47.706 --> 00:13:50.607
So, you know, root-level command injection, not good.
222
00:13:50.647 --> 00:13:55.169
The reason why command injections are bad, obviously, is, like, there's no knowledge required, right?
223
00:13:55.189 --> 00:13:56.349
Like, you don't need to leak anything.
224
00:13:56.409 --> 00:14:02.271
The problem with a lot of vulnerabilities is, like, to get the exploit to work, you have to know, like, oh, the base address of the image is here.
225
00:14:02.331 --> 00:14:07.373
Like, oh, we have to, like, on this version, we have to return to this offset in the global offset table.
226
00:14:07.413 --> 00:14:11.614
But in a command injection, it's just, like, as long as you get the pattern right, which is static,
227
00:14:12.174 --> 00:14:12.534
You win.
228
00:14:13.034 --> 00:14:20.056
The second bug is a little less egregious on the vulnerability itself, but more egregious on the actual exploitation, right?
229
00:14:20.496 --> 00:14:22.977
So this is in, this is called 772.
230
00:14:22.997 --> 00:14:29.059
It is a vulnerability in the DTLS handshaking of this device, right?
231
00:14:29.079 --> 00:14:30.880
So TLS, right, transport layer security.
232
00:14:31.140 --> 00:14:35.361
This is how you wrap a TCP connection in authentication, encryption, all that good stuff.
233
00:14:36.041 --> 00:14:41.368
DTLS is a newer quote unquote protocol that basically does TLS around a UDP connection.
234
00:14:41.408 --> 00:14:48.316
A lot of that code is hand jammed in this NSPPE binary, which is where the second bug unravels.
235
00:14:48.416 --> 00:14:50.178
In classic C fashion, right?
236
00:14:50.318 --> 00:14:52.761
Like no shame on anyone that writes a bug like this.
237
00:14:52.781 --> 00:14:53.342
It's very common.
238
00:14:53.682 --> 00:14:54.423
Buffer overflow, right?
239
00:14:54.623 --> 00:15:04.057
Something about the handshake in the NSPPE binary trusts a length given by the user, and if you add enough of those user-trusted lengths together, you overflow a stack buffer.
240
00:15:04.117 --> 00:15:04.738
Okay, cool.
241
00:15:04.798 --> 00:15:05.239
Not a big deal.
242
00:15:05.840 --> 00:15:08.664
The issue, though, that I'm kind of like scoffing at a little bit...
243
00:15:09.445 --> 00:15:14.068
is the binary is compiled with none of the modern mitigations, right?
244
00:15:14.128 --> 00:15:17.950
I think the only mitigation the binary has is the binary is NX.
245
00:15:18.190 --> 00:15:22.373
It's non-executable, meaning that the binary stack cannot be executed as code, right?
246
00:15:22.813 --> 00:15:28.536
The rest of the protections, right, the binary being compiled as PIE, position independent, not a thing.
247
00:15:29.357 --> 00:15:31.338
The binary having stack canaries, right?
248
00:15:31.878 --> 00:15:32.278
Not a thing.
249
00:15:32.919 --> 00:15:35.541
The binary having Railrow relocatables are read-only.
250
00:15:35.561 --> 00:15:36.282
Not a thing.
251
00:15:36.662 --> 00:15:43.828
So what this turns into is you're able to do your traditional stack-based buffer overflow where you return to a thing like mProtect.
252
00:15:44.129 --> 00:15:47.832
mProtect is being used to now turn the address of the stack segment
253
00:15:48.212 --> 00:15:48.972
into executable.
254
00:15:49.012 --> 00:15:51.033
Well, you can mprotect to mmap, right?
255
00:15:51.053 --> 00:15:54.194
Get a page, and then from there, you get a place to put your code.
256
00:15:54.534 --> 00:15:59.515
Ultimately, it's your traditional 1990s wrap-around to shell code and run code arbitrarily.
257
00:16:00.076 --> 00:16:02.996
Again, running as root, and so you get a root shell on this device.
258
00:16:04.077 --> 00:16:07.318
One thing that would have literally saved them this whole headache, sort of,
259
00:16:08.173 --> 00:16:09.574
is that they compile the stack canaries.
260
00:16:10.374 --> 00:16:13.376
The problem with the stack canary is it blocks you from doing an overflow.
261
00:16:13.756 --> 00:16:18.498
So in order for a canary to land, or for an exploit to land, you need to be able to leak the canary.
262
00:16:18.518 --> 00:16:19.339
You need two primitives.
263
00:16:19.359 --> 00:16:23.741
You need to have an arbitrary-ish, or at least like a local read and the overflow itself.
264
00:16:24.301 --> 00:16:25.982
And so that would have saved them some heartache.
265
00:16:26.542 --> 00:16:35.327
So as a result, right, as Matt kind of alluded to before, we're seeing some spray and praise float around where people are, like, doing the first exploit if it's, you know, vulnerable to that.
266
00:16:35.347 --> 00:16:41.731
And then the second exploit only works, by the way, if you have DTLS enabled, which is a default setting if you have a VPN gateway.
267
00:16:41.771 --> 00:16:44.193
So like Matt said, this is an application gateway.
268
00:16:44.593 --> 00:16:49.856
If you are using this to get to a downstream VPN server, that will enable the DTLS functionality.
269
00:16:50.757 --> 00:16:52.098
And that is what makes it vulnerable.
270
00:16:52.118 --> 00:16:52.298
Yeah.
271
00:16:52.818 --> 00:16:58.961
Two pretty funny bugs, both of which that have been patched, diffed, and analyzed by the homies over at Watchtower.
272
00:16:58.981 --> 00:16:59.762
So great work there.
273
00:16:59.782 --> 00:17:03.523
And if you're wondering, how do people even root cause these bugs?
274
00:17:03.563 --> 00:17:07.585
Because a vendor like Citrix is not going to tell you exactly when and where the bug is.
275
00:17:08.026 --> 00:17:16.950
What these people do is they take the firmware from the vendor of the old version and the firmware from the vendor of the fixed version, do a bin diff, and that will literally fall out.
276
00:17:17.290 --> 00:17:19.671
the security patches of what made the bug go away.
277
00:17:19.691 --> 00:17:24.214
And then you can then logically deduce, okay, so if they did this to fix it, it was broken here.
278
00:17:24.234 --> 00:17:27.375
And that's what people like Cincinnati do for their jobs.
279
00:17:27.476 --> 00:17:28.576
So really cool stuff.
280
00:17:28.896 --> 00:17:30.477
Also, fuck you, Citrix.
281
00:17:30.537 --> 00:17:34.039
I want to do that too, but you put your damn firmwares behind a license wall and that's annoying.
282
00:17:34.239 --> 00:17:35.200
So yeah.
283
00:17:36.000 --> 00:17:36.640
Okay, that's all I got.
284
00:17:36.840 --> 00:17:39.141
I wonder if AI is good at RE-ing things like that.
285
00:17:39.401 --> 00:17:40.181
They're really good.
286
00:17:40.201 --> 00:17:44.322
I'm working on a video right now called A Lightbulb with AI, and it's hilarious.
287
00:17:44.582 --> 00:17:51.624
Dude, I literally sat on a firmware pull of a lightbulb for over a year, and I couldn't figure it out because it was just a flat...
288
00:17:51.644 --> 00:17:52.365
It wasn't like an elf.
289
00:17:52.385 --> 00:17:53.725
It was like a flat RTOS image.
290
00:17:54.205 --> 00:18:03.748
I gave it to Opus 5, I believe, and it fully parsed the entire image, found all of the RTOS images inside of it, found all their base addresses in five minutes.
291
00:18:04.620 --> 00:18:05.223
Years of work.
292
00:18:05.644 --> 00:18:05.765
No.
293
00:18:06.066 --> 00:18:06.689
Here we go.
294
00:18:06.809 --> 00:18:07.311
It did it itself.
295
00:18:07.472 --> 00:18:07.773
Insane.
296
00:18:07.813 --> 00:18:10.002
Skill issue on my part, potentially, but also the AI is really good.
297
00:18:10.122 --> 00:18:10.323
Anyway.
298
00:18:10.931 --> 00:18:13.112
Skill issue solved.
299
00:18:13.132 --> 00:18:15.312
We've got some other stuff.
300
00:18:15.412 --> 00:18:29.155
I always like to, instead of just like doom porning this stuff and volume porning this stuff, Google put out a great, great write-up on how to defend and hunt against these Citrix exploits.
301
00:18:29.195 --> 00:18:33.797
This is widely popular devices, right, that people need to be on top of.
302
00:18:34.377 --> 00:18:39.438
So please go read the Google blog from their Threat Intelligence blog.
303
00:18:40.178 --> 00:18:41.979
uh, about how to defend against this.
304
00:18:42.019 --> 00:18:43.240
They've got hunts for you.
305
00:18:43.280 --> 00:18:47.563
They've got an actual dissection of the malware and the behavior that you can look for on your network.
306
00:18:47.583 --> 00:18:52.126
And then they've also got steps of like what to do, uh, about it.
307
00:18:52.226 --> 00:19:01.752
Obviously there's patching involved, but if you're, if you think that you might've been owned, just like patching is not a sufficient like step to eradicate this stuff.
308
00:19:02.052 --> 00:19:02.193
Um,
309
00:19:03.313 --> 00:19:04.034
So go check that out.
310
00:19:04.294 --> 00:19:12.541
And if you're concerned about actually defending your own code vulnerabilities, you're going to want to talk to today's sponsor, the video maze.
311
00:19:13.842 --> 00:19:14.242
Check it out.
312
00:19:14.520 --> 00:19:18.063
Hey hackers, before we keep going, I wanna take a quick break and say a quick thank you to our sponsors.
313
00:19:18.323 --> 00:19:21.845
Today's Lowdown episode is sponsored by our friends over at Maze.
314
00:19:22.326 --> 00:19:27.630
Maze has spent the last couple of years using AI to find and remediate vulnerabilities in the cloud.
315
00:19:27.730 --> 00:19:34.495
And now they've released Maze Code, AI agents that find and deeply investigate vulnerabilities in your code.
316
00:19:34.715 --> 00:19:42.158
Now we all know the deal, software composition analysis tools and SaaS toolings are all historically really bad at just making more noise.
317
00:19:42.198 --> 00:19:49.060
They find issues that may not actually be real and just create a lot of problems for your engineers to deal with that don't solve real security vulnerabilities.
318
00:19:49.161 --> 00:19:50.181
I get it, we've been there.
319
00:19:50.821 --> 00:19:56.225
Maze code is a really cool tool because Maze code actually knows how your code works.
320
00:19:56.545 --> 00:20:01.609
Maze code investigates every finding with the context of how your code is actually deployed.
321
00:20:02.009 --> 00:20:09.614
Sure, you're using a version of lib.xml2 that's vulnerable, but the actual code path to hit that vulnerability is not exposed in your Docker image.
322
00:20:09.874 --> 00:20:13.437
Maze code can find that and won't show you that that vulnerability is a big deal.
323
00:20:13.577 --> 00:20:18.140
Every vulnerability that Maze code reports comes with evidence that it's real and a way to fix it.
324
00:20:18.460 --> 00:20:22.822
Check out Maze at go.thelowdownpod.com slash Maze.
325
00:20:22.942 --> 00:20:26.624
That's go.thelowdownpod.com slash Maze.
326
00:20:26.804 --> 00:20:27.404
Thanks again, Maze.
327
00:20:27.544 --> 00:20:28.365
Let's keep going.
328
00:20:29.345 --> 00:20:29.926
And we're back.
329
00:20:30.106 --> 00:20:31.967
Absolute cinema transition, Matt.
330
00:20:32.007 --> 00:20:34.448
That was, dude, S tier, S tier, S plus.
331
00:20:35.568 --> 00:20:38.590
Perfect score in DDR sponsor revolution, dude.
332
00:20:38.610 --> 00:20:38.990
That was great.
333
00:20:39.492 --> 00:20:39.752
All right.
334
00:20:39.972 --> 00:20:41.113
There's a long tail.
335
00:20:41.213 --> 00:20:44.456
So Citrix, obviously, bad week, embarrassing.
336
00:20:44.696 --> 00:20:46.958
We were all talking about your vulns all weekend.
337
00:20:47.218 --> 00:20:51.802
People were coming in over the weekend chasing your vulns before you even put out an advisory.
338
00:20:52.162 --> 00:20:53.263
What's going on over there?
339
00:20:53.864 --> 00:20:55.505
Start putting your stuff out faster.
340
00:20:55.545 --> 00:20:56.146
This is crazy.
341
00:20:56.186 --> 00:21:01.650
Patch, I get the patches take some time, but the fact that we found out about this shit via Reddit is crazy.
342
00:21:01.770 --> 00:21:05.354
So real quick, I understand that in this scenario, people are mad at Citrix.
343
00:21:05.774 --> 00:21:07.516
But is there a longer tale to this story?
344
00:21:07.536 --> 00:21:11.400
I feel like people are mad from the past as well.
345
00:21:11.500 --> 00:21:13.723
Notoriously, this is what happens.
346
00:21:13.823 --> 00:21:14.063
Okay.
347
00:21:14.203 --> 00:21:21.331
Notoriously, they are asleep at the wheel when it comes to actually notifying this stuff that's going on.
348
00:21:21.511 --> 00:21:24.034
This is not the first of these vulnerabilities.
349
00:21:24.515 --> 00:21:27.459
This isn't even the first in the last couple months.
350
00:21:27.659 --> 00:21:28.119
You know what I mean?
351
00:21:28.300 --> 00:21:29.601
Of like these types of vulnerabilities.
352
00:21:29.942 --> 00:21:31.904
This happens a lot every year.
353
00:21:32.565 --> 00:21:39.514
And they really need to up their game on like handling this stuff, communicating it, getting stuff out, all that, you know,
354
00:21:40.014 --> 00:21:40.735
jazz, right?
355
00:21:41.055 --> 00:21:43.157
I mean, people hate on Microsoft all day.
356
00:21:43.177 --> 00:21:46.939
Microsoft does pretty darn good at this particular aspect of things, right?
357
00:21:46.979 --> 00:21:54.465
Like, that's why the Nightmare Eclipse stuff is such a story because it really messes up with Microsoft's process on, like, trying to handle a lot of this, right?
358
00:21:54.865 --> 00:21:56.707
But, yeah, I mean...
359
00:21:57.387 --> 00:22:00.010
A lot of people leave a lot to be desired when it comes to comms.
360
00:22:00.090 --> 00:22:04.554
This, I mean, what are we, four or five days of like the internet is talking?
361
00:22:04.594 --> 00:22:06.136
Like we all have to talk to each other.
362
00:22:06.156 --> 00:22:17.387
I need to have access to these little threat intel communities that I'm in in order to not be exploited by this at scale because I can't rely on the...
363
00:22:19.509 --> 00:22:25.332
Dude, if you're a big Citrix customer, this is not a small check that you're writing every year.
364
00:22:25.512 --> 00:22:25.732
Yeah.
365
00:22:26.112 --> 00:22:26.592
Overdo it.
366
00:22:26.652 --> 00:22:41.579
You expect a level of enterprise support of like, keep me up to date and safe and supported without me having to have like a crack threat hunting team and a threat Intel feed and all this kind of stuff in order to feel warm and fuzzy about my edge devices on this.
367
00:22:41.759 --> 00:22:43.880
Yeah, and it's also not a small IR either.
368
00:22:43.920 --> 00:22:50.604
Like, this is, like, they're landing as root on one of the most trusted devices on the network, right?
369
00:22:50.664 --> 00:22:52.405
And I want to highlight a couple things here, right?
370
00:22:52.766 --> 00:22:55.888
The goal of this podcast, by the way, is not, like, to shit on companies.
371
00:22:55.988 --> 00:22:58.669
It's more to try to push the industry in a safer direction.
372
00:22:59.250 --> 00:22:59.530
And, like,
373
00:23:00.090 --> 00:23:04.973
There are such minor changes that could have been made to make this a safer thing, right?
374
00:23:05.053 --> 00:23:10.537
Like, just literally enabling mitigations on the binaries in this device is a good step one.
375
00:23:10.977 --> 00:23:17.061
Step two, yeah, like, doing any amount of PR, being like, hey, or Threat Intel, hey, we observed this.
376
00:23:17.141 --> 00:23:18.642
You know, we're putting this patch out.
377
00:23:19.103 --> 00:23:22.905
Like, these are the things that have to happen to make the world a safer place, right?
378
00:23:22.965 --> 00:23:25.347
It's like, yeah, I don't know.
379
00:23:25.367 --> 00:23:29.190
It's frustrating because, like, it's such a simple fix, and I acknowledge that organizations...
380
00:23:30.010 --> 00:23:35.916
tend to make the technical problem the easiest solution, and the real problems are bureaucratic and organizational level.
381
00:23:36.277 --> 00:23:39.120
But guys, like, at a certain point, that's not an excuse, right?
382
00:23:39.300 --> 00:23:40.862
It has to just be a thing that happens.
383
00:23:41.652 --> 00:23:50.034
you and I could have double the followers we have if we just lulled about these vulns all the time, right?
384
00:23:50.214 --> 00:23:55.216
Like, it's such an easy button when it comes to content in this industry where it's like, what?
385
00:23:55.336 --> 00:23:55.916
This vuln?
386
00:23:56.036 --> 00:23:58.237
You know, we joke about the vulns from the 90s, right?
387
00:23:58.277 --> 00:24:00.798
And it is kind of like, oh, man, come on, guys, right?
388
00:24:01.398 --> 00:24:01.818
But like...
389
00:24:02.778 --> 00:24:03.279
We get it.
390
00:24:03.459 --> 00:24:08.523
Like we get that writing secure software is, is a challenge and like whatever.
391
00:24:08.683 --> 00:24:13.526
And so I'm not even sitting here being like, lol, these volumes can't believe it.
392
00:24:13.707 --> 00:24:13.947
Right?
393
00:24:14.567 --> 00:24:25.796
Like there is a conversation to be had there, but just handling it when you have zero days in a way that is up to standard of the industry is what I'm talking about.
394
00:24:25.816 --> 00:24:26.697
And that this ain't it.
395
00:24:27.117 --> 00:24:27.537
You know what I mean?
396
00:24:27.557 --> 00:24:28.418
A Reddit, a Reddit,
397
00:24:29.642 --> 00:24:35.308
getting called from the Dutch MSP to be like, yo, pull it offline.
398
00:24:35.368 --> 00:24:36.069
That's our answer.
399
00:24:36.830 --> 00:24:37.851
We got to pull it offline.
400
00:24:39.052 --> 00:24:39.533
You know what I mean?
401
00:24:39.573 --> 00:24:41.776
Like that, these are mission critical devices.
402
00:24:42.136 --> 00:24:47.923
So you're asking your customers to take on downtime to mitigate the risk for, for,
403
00:24:48.860 --> 00:24:50.001
Four or five days?
404
00:24:50.581 --> 00:24:56.465
Do you think it's possible for a company to, like, yoink their corporate VPN for five days?
405
00:24:56.785 --> 00:24:57.126
No.
406
00:24:57.906 --> 00:24:58.166
Right.
407
00:24:58.387 --> 00:25:00.748
Like, so it's just, man, this is rough.
408
00:25:00.908 --> 00:25:02.269
This is rough.
409
00:25:03.610 --> 00:25:07.192
There's a long tail conversation to be had here, and we're going to have a bit of it.
410
00:25:07.433 --> 00:25:10.795
Because edge devices are having a bad couple years.
411
00:25:11.255 --> 00:25:12.056
Years, right?
412
00:25:13.076 --> 00:25:14.978
These are juicy targets for a reason.
413
00:25:15.558 --> 00:25:20.705
They are like, you can't, we joke about the PLCs on critical infrastructure.
414
00:25:20.865 --> 00:25:22.026
Just pull this shit off the internet.
415
00:25:22.307 --> 00:25:25.851
Why do you have these management devices for a power plant on the internet?
416
00:25:25.991 --> 00:25:26.212
Right?
417
00:25:26.272 --> 00:25:27.273
Like this is what we talk about.
418
00:25:27.814 --> 00:25:30.197
These devices, you cannot pull off the internet.
419
00:25:30.217 --> 00:25:30.537
Right?
420
00:25:30.597 --> 00:25:30.797
Right.
421
00:25:31.378 --> 00:25:35.180
There is like a zero trust thing where you could do like device off, right?
422
00:25:35.200 --> 00:25:38.322
So if your employees get a corporate device, there could be a cert on that device.
423
00:25:38.362 --> 00:25:43.045
And that's the only thing that lets them touch this thing that is quote unquote on the internet, right?
424
00:25:43.065 --> 00:25:51.610
And there's like some zero trusty type things that you could do to like kind of get more modern with this than just having like a username and password on the internet.
425
00:25:52.250 --> 00:25:53.531
And this thing could have zero days.
426
00:25:54.072 --> 00:25:54.292
But...
427
00:25:55.132 --> 00:25:56.873
That wouldn't just like solve it, right?
428
00:25:56.953 --> 00:25:58.473
It still needs an internet connection.
429
00:25:58.653 --> 00:26:01.914
So like zero days would still maybe happen, right?
430
00:26:01.974 --> 00:26:03.834
Even if you do some device off type stuff.
431
00:26:04.354 --> 00:26:05.475
But what do we have?
432
00:26:05.675 --> 00:26:07.395
One, two, three others that we could talk about.
433
00:26:07.415 --> 00:26:08.916
And I'm sure we missed some.
434
00:26:09.136 --> 00:26:10.316
We were like, we got to start recording.
435
00:26:10.336 --> 00:26:11.256
Let's go, right?
436
00:26:11.756 --> 00:26:13.097
That's the issue with these devices, right?
437
00:26:13.117 --> 00:26:16.037
At the end of the day, like something has to touch the internet.
438
00:26:16.057 --> 00:26:18.218
The internet must be inter at some point.
439
00:26:18.938 --> 00:26:27.005
You know, the goal of a well-architected network is to take as much of that threat, that attack surface off the Internet.
440
00:26:27.165 --> 00:26:30.047
But at the end of the day, the traffic has to hit a wall somewhere.
441
00:26:30.088 --> 00:26:35.092
And a lot of the times it's at literally these devices that are the gateway into the rest of the network.
442
00:26:35.152 --> 00:26:35.312
Right.
443
00:26:35.332 --> 00:26:39.035
So they are the critical point of failure that they handle all the auth.
444
00:26:39.335 --> 00:26:41.777
And they're also getting all of the eyes from the threat actors.
445
00:26:42.478 --> 00:26:42.638
Yeah.
446
00:26:43.764 --> 00:26:46.086
Okay, let's zoom out.
447
00:26:46.186 --> 00:26:47.027
I'm making eye contact.
448
00:26:47.067 --> 00:26:49.008
We're having a serious conversation here, okay?
449
00:26:49.709 --> 00:26:52.551
These zero days are getting cheap, and they're not slowing down.
450
00:26:52.712 --> 00:26:54.793
This has been years of edge device zero days.
451
00:26:54.973 --> 00:26:56.655
This is what nation states are doing.
452
00:26:56.915 --> 00:27:09.146
We've got the former FBI director, Ray, sat in front of Congress and said that they have evidence of nation state threat actors, especially China, compromising wide swaths of U.S. company and companies
453
00:27:09.786 --> 00:27:13.328
federal edge devices and then not doing anything with that access.
454
00:27:13.348 --> 00:27:13.648
Yeah, yeah.
455
00:27:13.668 --> 00:27:16.170
There was brick store malware on appliances.
456
00:27:16.210 --> 00:27:17.230
There was all sorts of stuff.
457
00:27:17.250 --> 00:27:20.452
We have evidence that this is happening, okay?
458
00:27:21.547 --> 00:27:22.887
We're going to talk about three more right now.
459
00:27:23.187 --> 00:27:27.168
Obviously, like stay on top of your patches and do all of this kind of stuff.
460
00:27:27.328 --> 00:27:32.069
But it's time we have a serious conversation about zero days getting more popular.
461
00:27:32.109 --> 00:27:40.171
This is like, Ed, you just made a video about Docker container security boundaries because the Linux kernel vulnerabilities are up going.
462
00:27:40.511 --> 00:27:41.771
We have one every week now, right?
463
00:27:41.791 --> 00:27:44.332
We have over 50 on track for over 50 this year.
464
00:27:44.352 --> 00:27:45.072
Yeah.
465
00:27:45.932 --> 00:27:47.914
This is going to keep happening on the edge devices.
466
00:27:48.514 --> 00:27:54.439
Your whole company can't just get pwned because an edge device zero day happens.
467
00:27:54.679 --> 00:28:04.086
You need a multi-layered security defense strategy that includes zero days as probable, probable going to happen.
468
00:28:04.467 --> 00:28:07.549
What happens once the zero day gets exploited on this edge device?
469
00:28:08.029 --> 00:28:10.852
Are you ready for what happens when this zero day gets exploited?
470
00:28:11.572 --> 00:28:14.094
Zero days are not invisibility cloaks, okay?
471
00:28:14.194 --> 00:28:18.217
So the attacker gets on, the attacker then has to do something attackery, right?
472
00:28:18.718 --> 00:28:22.801
Just because they get remote code execution on your device doesn't mean that that's game over.
473
00:28:23.161 --> 00:28:24.803
That shouldn't mean game over, right?
474
00:28:24.823 --> 00:28:27.925
You should have many, many, many layers of detections.
475
00:28:27.985 --> 00:28:29.807
Detections are now more important.
476
00:28:29.847 --> 00:28:32.709
Detections at machine speed are more important now than ever.
477
00:28:32.729 --> 00:28:37.173
You can't have an alert going to somebody during business hours that gets...
478
00:28:37.813 --> 00:28:41.477
a page that has to go look in the alert of what just happened on my edge device.
479
00:28:41.717 --> 00:28:50.525
No, you need to be reacting at machine speed and detecting and isolating and doing all sorts of stuff and responding, quarantining, whatever it is, whatever it is.
480
00:28:50.866 --> 00:28:51.126
Okay.
481
00:28:51.226 --> 00:28:52.747
I had to get serious and zoom out a little bit.
482
00:28:53.228 --> 00:28:53.528
Sorry.
483
00:28:53.668 --> 00:28:54.169
I'm sorry.
484
00:28:54.669 --> 00:28:55.170
This is hard.
485
00:28:55.190 --> 00:28:56.130
Honestly, how dare you?
486
00:28:56.191 --> 00:28:56.371
No, no,
487
00:28:56.771 --> 00:28:57.352
I'm sorry.
488
00:28:57.392 --> 00:28:57.993
This is hard.
489
00:28:58.073 --> 00:28:58.513
I get it.
490
00:28:58.834 --> 00:28:59.234
I get it.
491
00:28:59.495 --> 00:29:02.438
But Sam Altman said, we got to take cybersecurity seriously now.
492
00:29:02.859 --> 00:29:08.566
I know you guys haven't been taking it seriously for 25 years, but Sam Altman said, you got to take it seriously now.
493
00:29:08.586 --> 00:29:09.287
I'm sorry.
494
00:29:10.092 --> 00:29:17.636
I sound like a hipster, but, like, I'm happy and, voice crack, I'm happy and annoyed that, like, cybersecurity is mainstream now.
495
00:29:17.796 --> 00:29:22.118
Like, it's cool because it's, like, waking up people, but also, hey, fuck you guys.
496
00:29:22.138 --> 00:29:24.179
We've been talking about this for, like, 25 years.
497
00:29:24.680 --> 00:29:27.001
Why do we suddenly now care about it, you know?
498
00:29:27.281 --> 00:29:32.505
It's, I mean, I'm getting asked at like kids' soccer games and birthday parties about this stuff now.
499
00:29:32.766 --> 00:29:34.487
We are definitely in the mainstream, right?
500
00:29:34.507 --> 00:29:34.827
That's crazy.
501
00:29:34.847 --> 00:29:37.590
Like, I had a dad come up to me and be like, hey, so are we cooked?
502
00:29:37.770 --> 00:29:40.892
Like, I was like, wait, are you talking AI?
503
00:29:40.912 --> 00:29:42.854
Like, and you just know what I do for a living?
504
00:29:42.914 --> 00:29:45.456
Oh, no, I was literally at a poker table this weekend.
505
00:29:45.476 --> 00:29:48.138
And the guy was like, so what are your thoughts on all these AI hacks?
506
00:29:48.178 --> 00:29:51.321
And I'm like, Jesus Christ, this random guy.
507
00:29:51.341 --> 00:29:51.701
Brother.
508
00:29:51.721 --> 00:29:52.662
Yeah, like.
509
00:29:52.722 --> 00:29:54.462
Talk to me about AI at the poker table.
510
00:29:54.543 --> 00:29:54.983
Insane.
511
00:29:55.003 --> 00:29:55.603
Pull up a seat.
512
00:29:55.783 --> 00:29:56.723
Here's my YouTube channel.
513
00:29:56.743 --> 00:29:57.223
What is this?
514
00:29:57.423 --> 00:29:58.344
Like and subscribe.
515
00:29:58.364 --> 00:29:59.164
Yeah.
516
00:29:59.224 --> 00:30:02.285
Okay, we got three more that we want to talk about, edge device stuff.
517
00:30:02.605 --> 00:30:04.425
So we got, how do you say it?
518
00:30:05.666 --> 00:30:06.446
Microtick.
519
00:30:06.726 --> 00:30:07.086
Microtick.
520
00:30:07.206 --> 00:30:07.866
Microtick, yeah.
521
00:30:07.946 --> 00:30:08.506
Microtic.
522
00:30:08.586 --> 00:30:10.747
It looks like microtic, yeah, but it's microtick.
523
00:30:11.447 --> 00:30:14.628
Microtik routers, which seem to be popular in certain parts of the world.
524
00:30:14.868 --> 00:30:20.109
We've got another Cisco 9.8 or 10 CVE.
525
00:30:20.129 --> 00:30:22.690
We just did this with the email gateway last week.
526
00:30:23.490 --> 00:30:30.252
And then we've got unauthenticated command injection on Zimbra devices out of Microsoft Intel.
527
00:30:30.432 --> 00:30:32.833
Turns out, I found some numbers.
528
00:30:33.053 --> 00:30:34.633
I'm going to let you talk about some of the vulns.
529
00:30:34.673 --> 00:30:37.654
I found some numbers on...
530
00:30:38.494 --> 00:30:40.035
I'm not, I wasn't super familiar with Zimbra.
531
00:30:40.055 --> 00:30:41.695
I know you're like, I don't know what a Netscaler is.
532
00:30:41.715 --> 00:30:43.836
That's kind of how I felt on Zimbra.
533
00:30:43.876 --> 00:30:52.018
I know about it, but like 12,000 Zimbra servers exposed on the internet, 8,200 currently unpatched to this vuln.
534
00:30:52.438 --> 00:30:52.939
Not great.
535
00:30:53.059 --> 00:30:53.879
What are the vulns, man?
536
00:30:54.339 --> 00:30:55.240
Let's start with Microtik.
537
00:30:55.260 --> 00:31:04.509
So the reason why we're bringing up Microtik is they seem to be kind of the go-to network device for a lot of people around the world, particularly because they're fairly cheap.
538
00:31:04.529 --> 00:31:09.353
You can go online and get these devices for not a lot of money, and they do, like, enterprise-level stuff, right?
539
00:31:09.373 --> 00:31:15.839
Like, if you go right now and you want to buy a Ubiquiti 24-port PoE 10-gig switch...
540
00:31:16.582 --> 00:31:17.483
You're looking at like $800.
541
00:31:17.503 --> 00:31:19.704
You're looking at like... And that's like the base one.
542
00:31:19.864 --> 00:31:21.325
It might even be more expensive than that now.
543
00:31:21.806 --> 00:31:23.627
Microtix run a lot cheaper than that.
544
00:31:23.667 --> 00:31:25.048
They're in a couple of hundreds of dollars.
545
00:31:25.088 --> 00:31:26.969
They make kind of like a good home lab solution.
546
00:31:26.989 --> 00:31:31.732
And for countries that don't have a lot of money, like around the world, maybe they make for like a better like enterprise solution, right?
547
00:31:31.993 --> 00:31:35.115
And as a result, when bugs on these things come out, it's like a big deal.
548
00:31:35.435 --> 00:31:36.275
There's actually a story.
549
00:31:36.295 --> 00:31:38.637
I think it was like, fuck, at this point, six years ago.
550
00:31:38.657 --> 00:31:39.638
Maybe it was eight years ago.
551
00:31:40.058 --> 00:31:54.317
where a big Microtik bug came out, and there was, like, a Russian vigilante that got caught, like, SSH-ing via the bug into other Microtiks and upgrading them, like, for people, because he knew that it was, like, such a big deal that this bug existed.
552
00:31:54.778 --> 00:31:55.158
Anyway...
553
00:31:56.379 --> 00:32:06.945
Obviously, as a result of AI, I think it's like the Polish cert has been releasing vulnerabilities that they're finding in Microtix, a variety of their management interfaces, right?
554
00:32:06.965 --> 00:32:13.269
So the one I'm looking at right now is in their HTTP request handling of their web management interface.
555
00:32:13.609 --> 00:32:20.453
There is an integer underflow vulnerability that is reachable before authentication that can lead to achieve arbitrary code execution as root.
556
00:32:20.893 --> 00:32:22.514
There were two bugs previously.
557
00:32:22.614 --> 00:32:24.135
So one, I think about a week ago.
558
00:32:25.055 --> 00:32:39.823
about a week ago, where there was an issue in the state machine within the SSH authentication, where something, something, something, you basically could trick the SSH system into being done authenticating before it was actually done.
559
00:32:40.264 --> 00:32:49.589
And then via an old feature that exists in the micro tick, if you specified after that key exchange that your username was negative two, it would just drop you into a shell.
560
00:32:49.649 --> 00:32:52.731
So you could SSH into the device with no password.
561
00:32:53.431 --> 00:33:03.518
Um, again, these bugs are ridiculous, but I think a lot of these are more, like, you have these two subs... Well, actually, okay, first of all, the HTTP one is just a pure memory corruption bug.
562
00:33:03.658 --> 00:33:08.642
This, to me, implies that they're, like, hand-jamming all of their, like, HTTP stuff.
563
00:33:09.002 --> 00:33:13.025
Why you wouldn't just use, like, Lighty or Nginx or something is kind of confusing to me.
564
00:33:13.806 --> 00:33:15.227
But the SSH one feels more like...
565
00:33:16.307 --> 00:33:19.948
a subsystem over here made an assumption about subsystems over here.
566
00:33:20.068 --> 00:33:25.349
And because those like threat assumptions weren't communicated, they like led to a massive vulnerability.
567
00:33:25.369 --> 00:33:26.109
I don't know.
568
00:33:26.129 --> 00:33:33.070
They're kind of weird, but ultimately I think the two takeaways here are like, don't hand jam things that you don't need to hand jam, right?
569
00:33:33.090 --> 00:33:37.351
Like if you're hand jamming HTTP, I don't know, maybe use like a lib curl or something.
570
00:33:37.851 --> 00:33:41.572
And then for SSH, a hundred percent, that's like number one.
571
00:33:41.972 --> 00:33:44.813
I don't know how the internals of that work, but like don't roll your own crypto.
572
00:33:44.873 --> 00:33:45.493
If that's what's happening.
573
00:33:46.513 --> 00:33:47.954
Interesting stuff here for sure.
574
00:33:48.054 --> 00:33:52.737
Don't roll your own crypto has been advice that I've been saying since I've out of the womb, right?
575
00:33:52.797 --> 00:33:55.619
I mean, this is not new advice, right?
576
00:33:55.719 --> 00:33:56.120
That's rough.
577
00:33:56.140 --> 00:33:57.040
The negative two thing is funny.
578
00:33:57.060 --> 00:33:57.941
Have you seen that?
579
00:33:58.401 --> 00:34:06.486
There's like a meme video going around where someone rubs a genie lamp and the genie comes out and he asks if he can ask for negative wishes.
580
00:34:07.046 --> 00:34:07.887
What's up, dude?
581
00:34:08.087 --> 00:34:08.868
I'm your genie.
582
00:34:09.108 --> 00:34:10.449
Can I wish for less wishes?
583
00:34:11.249 --> 00:34:16.032
I guess, yeah, you can wish for less wishes, like an idiot.
584
00:34:16.292 --> 00:34:22.156
Oh, but I'm not an idiot, because surely the wish servers weren't designed to hold negative numbers of wishes, because who would wish for negative wishes?
585
00:34:22.296 --> 00:34:30.981
So if I start with three wishes and then I wish for negative three wishes, the act of wishing will bring me down to two wishes, and the wish itself will bring me down to negative one.
586
00:34:31.161 --> 00:34:37.505
Thus causing an overflow error in the wish servers, bringing me up to the highest possible integer value of wishes available by the data type.
587
00:34:38.045 --> 00:34:39.766
Uh, yeah, maybe, man.
588
00:34:40.446 --> 00:34:40.946
I don't know.
589
00:34:41.186 --> 00:34:43.087
I don't work server-side development.
590
00:34:43.127 --> 00:34:45.168
I'm just customer service.
591
00:34:45.548 --> 00:34:50.069
And he tries to figure out, he's like, oh, are we in a 64-bit thing?
592
00:34:50.129 --> 00:34:53.891
And he does like Underflow and he gets like a trillion wishes because of it.
593
00:34:54.111 --> 00:34:56.332
You now have 4 million.
594
00:34:56.372 --> 00:34:57.092
Wait, whoa, whoa, whoa.
595
00:34:57.112 --> 00:34:57.632
How'd you do that?
596
00:34:57.832 --> 00:34:59.973
Yeah, yeah, yeah.
597
00:35:00.133 --> 00:35:01.293
That reminds me of this.
598
00:35:01.473 --> 00:35:01.813
Yeah, okay.
599
00:35:01.853 --> 00:35:02.914
Login is negative two.
600
00:35:03.414 --> 00:35:04.434
Yeah, man.
601
00:35:04.534 --> 00:35:10.876
So again, the world of memory corruption bugs and logic issues is still alive and well.
602
00:35:11.416 --> 00:35:23.058
There's been a lot of talk, I think, for a long time with the popularization of Rust, and now AI finds everything kind of world, that maybe bugs will go away and will live in a memory-safe society with no issues.
603
00:35:23.638 --> 00:35:23.978
Maybe.
604
00:35:24.278 --> 00:35:25.138
Maybe in 10 years.
605
00:35:25.318 --> 00:35:25.679
I don't know.
606
00:35:25.739 --> 00:35:29.319
But in the meantime, it's going to get worse before it gets better, unfortunately.
607
00:35:29.639 --> 00:35:31.020
So that's the first one on Microtik.
608
00:35:31.040 --> 00:35:32.320
The first, I guess, three at this point.
609
00:35:33.108 --> 00:35:39.112
And then after that, you have the Cisco SD-WAN vulnerabilities.
610
00:35:39.192 --> 00:35:42.213
Again, not a lot actually going on that tells you what's happening in these bugs.
611
00:35:42.233 --> 00:35:47.717
But at a high level, it's a similar issue as like the Netscaler things.
612
00:35:48.297 --> 00:35:59.403
SD-WAN is this protocol that's kind of like a VPN, but it allows site A and site B in a large corporate network to attach to each other as if they were the same network, right?
613
00:35:59.423 --> 00:36:01.565
Like it's software-defined wide area network.
614
00:36:02.445 --> 00:36:06.748
The issue with these, obviously, is vulnerability exists in this SD-WAN manager.
615
00:36:07.108 --> 00:36:25.138
It allows a nefarious attacker or a nefarious actor to not only modify the configuration of these corporate networks, but potentially add their own network to the SD-WAN network, and then from there have a privileged perspective over not only the layout, but, like, the flow and the configuration of these networks, right?
616
00:36:25.558 --> 00:36:27.700
And so there is a vulnerability that said, quote,
617
00:36:28.380 --> 00:36:32.381
The manager mishandles URI encoding in an HTTP request.
618
00:36:32.441 --> 00:36:38.402
A crafted request can therefore bypass authentication rule intended to restrict access to a single API endpoint.
619
00:36:38.762 --> 00:36:45.584
What this smells like to me is like if you try to go to slash yes, we are logged in dot JavaScript.
620
00:36:45.884 --> 00:36:49.985
If you change the E in yes to percent, what is it?
621
00:36:51.065 --> 00:36:51.245
Six.
622
00:36:52.045 --> 00:36:57.889
6, 6.5, one of those, the URI encoded version of it, it would just let you in because it doesn't match the blacklist.
623
00:36:57.929 --> 00:36:59.430
It's blacklisting that URI, right?
624
00:36:59.490 --> 00:37:05.034
So, again, very, again, funny for me, not so funny for Cisco and their friends bug.
625
00:37:05.794 --> 00:37:06.895
But that is what we're dealing with.
626
00:37:06.915 --> 00:37:07.536
So, yeah.
627
00:37:07.936 --> 00:37:09.217
That's the Cisco one.
628
00:37:09.237 --> 00:37:09.477
What's up?
629
00:37:09.797 --> 00:37:15.821
This one is specifically like hardening guide says do not have, you know, 443, 22, 830.
630
00:37:16.561 --> 00:37:20.003
Like do not have these admin interfaces on the internet.
631
00:37:20.083 --> 00:37:25.026
So like, once again, that's like one of our perennial pieces of advice on these management interfaces.
632
00:37:25.226 --> 00:37:25.427
Yeah.
633
00:37:25.647 --> 00:37:33.492
Because this one straight up remote attacker, no login access can then interact with the manager's API as if they were an admin user, period.
634
00:37:33.652 --> 00:37:33.912
Like...
635
00:37:34.352 --> 00:37:34.692
That's it.
636
00:37:35.092 --> 00:37:37.313
Like, they are the net admin.
637
00:37:37.393 --> 00:37:41.994
They can perform all operations on this, including adding their network to your network, right?
638
00:37:42.014 --> 00:37:46.635
Like, as if they, okay, boom, their device from their network is now part of the corporate network.
639
00:37:46.795 --> 00:37:48.076
Yeah, important to highlight, right?
640
00:37:48.096 --> 00:37:56.978
Like, in the SD-WAN configuration, like, somewhere on node B of the network, there has to be a key exchange that, like,
641
00:37:57.378 --> 00:38:00.801
this site and this site are communicating and agreeing that handshake has to occur.
642
00:38:01.121 --> 00:38:04.524
A bug in that interface is no blame because you literally can't take that off the internet, right?
643
00:38:04.544 --> 00:38:06.105
That has to exist for this to occur.
644
00:38:06.425 --> 00:38:10.088
But this is literally the admin interface of the manager.
645
00:38:10.849 --> 00:38:12.410
Maybe we don't expose those to the internet.
646
00:38:12.430 --> 00:38:21.357
Now to highlight a kind of an important caveat here, the cloud deployed version, which is on the internet by default on purpose, has been patched by Cisco.
647
00:38:21.477 --> 00:38:23.118
So like that is self-managed by Cisco.
648
00:38:23.158 --> 00:38:23.859
They maintain it.
649
00:38:23.899 --> 00:38:25.100
They secure all that stuff.
650
00:38:25.800 --> 00:38:32.865
The ones that are on-prem, right, which is probably like a more common, I'm not actually sure, but the ones that are on-prem require you, the manager, to patch them.
651
00:38:33.246 --> 00:38:34.927
And so the patch is available for this.
652
00:38:35.027 --> 00:38:36.908
So that's that on Cisco.
653
00:38:37.489 --> 00:38:37.849
What's that?
654
00:38:37.989 --> 00:38:47.116
Just a really important caveat as you're listening to all three of these, even if you don't like the vuln breakdown stuff, these are all actively exploited in the wild right now.
655
00:38:47.136 --> 00:38:47.256
Yeah.
656
00:38:48.016 --> 00:38:49.877
Like that's why we're talking about them.
657
00:38:50.377 --> 00:38:54.239
This isn't just like Vuln Corner with Matt and Ed, right?
658
00:38:54.339 --> 00:38:56.860
Like active exploitation campaigns going on.
659
00:38:57.161 --> 00:39:04.044
The Zimber one, Microsoft Red Intel has like a really good breakdown of the actual active exploit steps that are going on.
660
00:39:04.384 --> 00:39:14.849
Obviously, this vulnerability is an important initial access, but there's all sorts of persistence, privilege escalation, defensive Asian, all sorts of stuff going on in active exploit.
661
00:39:15.753 --> 00:39:16.053
Yeah.
662
00:39:16.973 --> 00:39:26.035
So the Zimmer one is interesting because the bug itself is in SMTP, but the bug is exploited in SNMP.
663
00:39:26.075 --> 00:39:30.897
So SMTP, right, is the mailer protocol and SNMP is the management protocol.
664
00:39:31.377 --> 00:39:43.760
What's interesting here is this really feels like to me, kind of like the microtectic comment I made before, a scenario where there are two separate subsystems that make assumptions about the other that don't communicate those security promises, right?
665
00:39:45.980 --> 00:40:07.518
If you are able to make an SMTP request, a mail request, that gets into the SNMP path, if the SMTP message contains a command injection exploit, like a dollar sign packet, dollar sign, whatever, the SNMP subsystem will take that and accidentally run it.
666
00:40:07.859 --> 00:40:09.920
I think what's happening here is in developer land, right?
667
00:40:09.961 --> 00:40:11.202
Like the...
668
00:40:12.302 --> 00:40:16.684
maybe the assumption on the SNMP side is that only like control plane data gets there.
669
00:40:16.724 --> 00:40:18.044
So the data is inherently trusted.
670
00:40:18.385 --> 00:40:25.647
And then on the other side, the SMTP daemon manager is like, oh, well, surely we can give data to the SNMP side and that would be fine, right?
671
00:40:25.667 --> 00:40:29.569
And kind of you cross those two paths and you have, you know, SMTP to command ejection.
672
00:40:29.629 --> 00:40:30.970
I mean, it's just everything, right?
673
00:40:31.090 --> 00:40:36.792
Untrusted user input being like treated like trusted, you know, anything, right?
674
00:40:36.952 --> 00:40:38.973
Is the core of so many vulnerabilities.
675
00:40:39.133 --> 00:40:39.333
Yeah.
676
00:40:40.014 --> 00:40:50.933
So yeah, this input via the mail message either needs to be sanitized or you need to be doing something on these commands that it just doesn't matter what comes in this size.
677
00:40:50.953 --> 00:40:52.937
A proper command doesn't come out the other side.
678
00:40:53.460 --> 00:40:59.783
Yeah, my overall suggestion there from an AppSec perspective is don't run the system command.
679
00:41:00.063 --> 00:41:01.483
Don't use the popen command.
680
00:41:01.523 --> 00:41:03.244
I don't know if it's written in C or whatever.
681
00:41:03.264 --> 00:41:06.505
I'm assuming it's written in C or it could be bash.
682
00:41:06.525 --> 00:41:12.528
A, don't run any piece of data from the user that can be untrusted in bash, period.
683
00:41:12.868 --> 00:41:21.391
And then there should just be a tool in your CICD that says, hey, if the function system is linked into your binary, fail it.
684
00:41:21.511 --> 00:41:22.592
Like, no, not allowed.
685
00:41:23.152 --> 00:41:31.179
Either write the functionality that the binary is doing or use the exec VE syscall and make sure you don't have input that can go to bash, right?
686
00:41:31.199 --> 00:41:39.005
Because it's like that is just – to the title that Watchtower wrote, oh, look, the foot gun went off again.
687
00:41:39.186 --> 00:41:45.171
Like system, P, open, and bash are all foot guns that should never be able to parse user data ever.
688
00:41:45.831 --> 00:41:48.013
You're going to get it wrong once and then that's it forever.
689
00:41:48.593 --> 00:41:53.076
For a lot of these appliances, you don't have that level of control over how the appliance is handling shit.
690
00:41:53.176 --> 00:41:55.658
But yeah, if you work for some of these appliance shops.
691
00:41:55.678 --> 00:41:56.238
That's what I'm saying.
692
00:41:56.299 --> 00:42:00.261
I'm saying within the appliances developer cycle, this should be a rule.
693
00:42:00.481 --> 00:42:05.725
I think I literally made a comment in my video going out tomorrow that it should be illegal to parse user data in Bash.
694
00:42:06.105 --> 00:42:07.506
I'm not a government regulation guy.
695
00:42:07.526 --> 00:42:09.768
The government is wrong all the time about everything.
696
00:42:10.649 --> 00:42:12.110
But in this case, I don't know.
697
00:42:12.130 --> 00:42:14.691
Maybe you could find if you fucking have a command injection in 2026.
698
00:42:14.792 --> 00:42:15.152
I don't know.
699
00:42:16.055 --> 00:42:17.896
Speaking of the government being wrong about everything.
700
00:42:18.036 --> 00:42:18.637
Hell yeah, brother.
701
00:42:18.657 --> 00:42:19.478
Is that a good transition?
702
00:42:19.618 --> 00:42:20.198
Are we good?
703
00:42:20.238 --> 00:42:21.579
Are we good on edge device phones?
704
00:42:21.759 --> 00:42:22.139
Okay.
705
00:42:22.380 --> 00:42:26.563
So our good friends, shiny hunters who we've been talking about for the last few weeks, right?
706
00:42:26.583 --> 00:42:27.483
They hacked the FBI.
707
00:42:27.503 --> 00:42:28.644
We all made videos about it.
708
00:42:29.244 --> 00:42:32.066
I decided not to, cause I was too slow and you guys are all better than me.
709
00:42:33.007 --> 00:42:43.555
But so Dutch police arrest quote unquote air quotes for those listening and not watching reformed hacker in shiny hunters investigation.
710
00:42:43.575 --> 00:42:43.675
Okay.
711
00:42:44.335 --> 00:42:45.517
So this comes out of Krebs.
712
00:42:45.537 --> 00:42:50.064
He's usually good for like an exclusive on a lot of these like law enforcement type activities.
713
00:42:51.146 --> 00:42:54.871
But this arrest just got announced like, what was it yesterday?
714
00:42:54.891 --> 00:42:55.392
The day before?
715
00:42:57.391 --> 00:43:01.452
of this guy, Vanderstop, in the Netherlands.
716
00:43:02.152 --> 00:43:07.394
Again, that's why we said Dutch on a tear this week with the Citrix phone, because here they are showing up again.
717
00:43:08.794 --> 00:43:13.955
The FBI was obviously involved coordinating with a Dutch version of the FBI.
718
00:43:13.975 --> 00:43:16.216
I don't have their acronym in front of me right now.
719
00:43:16.736 --> 00:43:17.636
But guess what?
720
00:43:18.556 --> 00:43:19.376
Guess what about this guy?
721
00:43:19.896 --> 00:43:20.216
What's that?
722
00:43:20.857 --> 00:43:22.217
He was a security consultant.
723
00:43:23.008 --> 00:43:23.368
Really?
724
00:43:23.728 --> 00:43:25.749
Yeah, the call was coming from inside the house.
725
00:43:26.150 --> 00:43:26.510
Holy shit.
726
00:43:26.530 --> 00:43:29.431
So offensive security lead at Neo Security.
727
00:43:29.551 --> 00:43:34.733
And I actually had some people reach out to me saying that they used to be coworkers with this guy at like pen test shops and stuff.
728
00:43:35.134 --> 00:43:35.774
Wow.
729
00:43:36.534 --> 00:43:46.619
So the timeline is interesting here because we just got notice of this arrest this week, but the arrest actually happened a little while ago.
730
00:43:46.839 --> 00:43:50.741
So the arrest happened before the FBI hack happened.
731
00:43:51.815 --> 00:43:57.760
So now it's like, oh, was the FBI hack in retaliation for them grabbing one of their guys?
732
00:43:59.101 --> 00:43:59.401
Fuck.
733
00:43:59.581 --> 00:44:00.042
Yeah, yeah.
734
00:44:00.062 --> 00:44:01.403
And like, we didn't know about it, right?
735
00:44:01.803 --> 00:44:04.926
So it says, Van der Stapp was arrested.
736
00:44:04.966 --> 00:44:09.790
Dutch authorities on or around September 16th have been held in custody for questioning since.
737
00:44:10.711 --> 00:44:13.553
Which is before, when was the FBI hack?
738
00:44:13.613 --> 00:44:15.214
The 24th or something like that?
739
00:44:15.314 --> 00:44:17.136
It's like literally a week ago, within a week.
740
00:44:17.816 --> 00:44:18.056
Yeah.
741
00:44:18.317 --> 00:44:20.339
So September 25th.
742
00:44:20.800 --> 00:44:22.202
Yeah.
743
00:44:22.242 --> 00:44:22.723
That came out.
744
00:44:22.783 --> 00:44:23.243
Yeah, yeah.
745
00:44:23.343 --> 00:44:33.818
So I didn't realize that until recently that the timeline was actually flipped here, which makes me think that, you know, maybe his other Shiny Hunters homies...
746
00:44:34.998 --> 00:44:37.839
are keeping ops alive, right?
747
00:44:37.919 --> 00:44:39.820
So obviously they shared access.
748
00:44:39.860 --> 00:44:43.782
We didn't exactly cut the head off the Hydra here, right?
749
00:44:44.922 --> 00:44:46.063
But yeah, this one's interesting.
750
00:44:46.083 --> 00:44:51.825
And we're seeing a lot of conflicting information come out of Shiny Hunters since, right?
751
00:44:52.165 --> 00:44:58.668
So obviously we kind of talked about the FBI hack and the extortion that they were saying, this is not extortion.
752
00:44:58.928 --> 00:45:02.189
Yeah, we're stealing your data to make you do something, but it's also not extortion, by the way.
753
00:45:02.389 --> 00:45:03.070
Right, right, right.
754
00:45:03.190 --> 00:45:06.512
And so they've since come out and been like, okay, mission achieved.
755
00:45:06.992 --> 00:45:19.941
This was all just to make sure that like the PR for us, they've even come out and said it like, hey, we wanted the record straight about us so that the people that we are extorting will take us seriously, right?
756
00:45:20.161 --> 00:45:21.882
And so mission achieved.
757
00:45:21.902 --> 00:45:24.204
You all talked about our FBI hack enough.
758
00:45:24.584 --> 00:45:25.024
We did it.
759
00:45:25.064 --> 00:45:25.925
That's all we wanted.
760
00:45:26.205 --> 00:45:29.627
We will not be releasing the FBI data is what they've come out and said.
761
00:45:29.647 --> 00:45:30.328
Yeah.
762
00:45:31.088 --> 00:45:32.870
today or yesterday since, right?
763
00:45:34.451 --> 00:45:42.899
But then they also, I saw them come out and say like, this guy goes by Umbreon, this Vanderstopp that got arrested goes by Umbreon online.
764
00:45:43.779 --> 00:45:43.960
And...
765
00:45:45.022 --> 00:45:48.926
Umbreon, if you guys aren't Pokemon enjoyers, is a Pokemon name.
766
00:45:49.487 --> 00:45:57.355
And the logo of shiny hunters that when they deface things like the FBI jobs site was a shiny Umbreon, right?
767
00:45:57.535 --> 00:45:59.156
You can be a shiny Pokemon.
768
00:45:59.177 --> 00:46:02.340
If you're not a Pokemon fan, there's a such thing as a shiny version of a Pokemon.
769
00:46:02.360 --> 00:46:02.560
Yeah.
770
00:46:03.000 --> 00:46:03.720
Anyway, sorry.
771
00:46:04.301 --> 00:46:08.022
I used to be a Shiny Hunter Twitch streamer, by the way.
772
00:46:08.202 --> 00:46:08.822
Did you really?
773
00:46:08.982 --> 00:46:09.422
Yeah, yeah.
774
00:46:09.602 --> 00:46:11.063
Wow, that's new lore I just learned.
775
00:46:11.183 --> 00:46:11.723
New lore.
776
00:46:11.803 --> 00:46:12.303
New lore.
777
00:46:12.484 --> 00:46:13.164
That's crazy.
778
00:46:13.204 --> 00:46:17.825
Yeah, my Twitch, I used to legitimately Shiny Hunt on Twitch streams.
779
00:46:17.985 --> 00:46:22.287
So, dear FBI, I was not a Shiny Hunter acting group.
780
00:46:22.727 --> 00:46:24.308
Clarifying statement, phrasing.
781
00:46:26.049 --> 00:46:33.113
I would hunt for legitimate shiny Pokemon on sword and shield, which are not weapons.
782
00:46:33.253 --> 00:46:36.535
Okay, gosh, I can't do this.
783
00:46:38.095 --> 00:46:41.958
But a lot of conflicting statements coming out since this has come out.
784
00:46:41.998 --> 00:46:44.179
Shiny hunters are like, actually, Umbreon's not one of us.
785
00:46:44.599 --> 00:46:45.720
And then they've come out and been like,
786
00:46:46.320 --> 00:46:50.521
Yeah, you got our leader, but we're going to continue operations.
787
00:46:50.901 --> 00:46:57.723
By the way, any organizations that we're currently extorting, you should not think that you got a free pass because this guy got arrested.
788
00:46:58.063 --> 00:46:59.924
Like, we are still very much in business.
789
00:47:01.424 --> 00:47:03.404
Frankly, the Dutch police are a big joke.
790
00:47:03.424 --> 00:47:05.225
They're incapable of doing anything.
791
00:47:05.345 --> 00:47:08.226
Incompetent, irrelevant, unimportant, useless.
792
00:47:08.966 --> 00:47:10.746
Oh, that was how you really feel.
793
00:47:10.766 --> 00:47:11.106
Holy shit.
794
00:47:11.166 --> 00:47:11.607
Yeah, yeah.
795
00:47:11.807 --> 00:47:12.707
Is their current statement.
796
00:47:13.707 --> 00:47:15.468
So there's a lot going on with...
797
00:47:15.728 --> 00:47:21.850
This is like why we all kind of caveat asterisk a lot of like stuff that we read out of threat actor groups.
798
00:47:22.191 --> 00:47:30.474
Because obviously there isn't like a bunch of people like wearing a shiny hunter badge being like showing up at shiny hunter headquarters and like they are clearly shiny hunters.
799
00:47:30.734 --> 00:47:32.575
A lot of people are making a lot of statements...
800
00:47:33.215 --> 00:47:34.736
you know, as if they're shiny hunters.
801
00:47:34.756 --> 00:47:36.897
Some of them are truly affiliated with the group.
802
00:47:37.817 --> 00:47:39.058
Attribution is hard and weird.
803
00:47:39.338 --> 00:47:45.301
And like, it's hard to trust a lot of what they say, which was their whole PR campaign is like, by the way, you could trust us.
804
00:47:45.901 --> 00:47:47.822
We are very legitimate hackers.
805
00:47:47.842 --> 00:47:48.902
We are not sextortionists.
806
00:47:48.922 --> 00:47:49.502
We are not whatever.
807
00:47:49.523 --> 00:47:50.223
But then they are like...
808
00:47:50.763 --> 00:47:52.384
No, you didn't just arrest our guy.
809
00:47:52.584 --> 00:47:53.304
Actually, you did.
810
00:47:53.804 --> 00:47:56.925
You know, it's like, it's all kind of weird and hard to understand.
811
00:47:57.325 --> 00:48:08.448
The more important bits for you listening to this, if you're like in the cybersecurity industry, this is your job, is the vulnerabilities that they use are still very actively exploited.
812
00:48:08.568 --> 00:48:10.109
Like, cool, you're watching all the drama.
813
00:48:10.129 --> 00:48:13.289
It's kind of fun little TV show that you're watching on full on Twitter.
814
00:48:13.690 --> 00:48:15.390
By the way, Oracle PeopleSoft.
815
00:48:15.550 --> 00:48:17.233
still in active exploitation.
816
00:48:17.333 --> 00:48:27.548
I've got another Threat Intel blog out of Google about like renewed mass exploitation campaign targeting Oracle PeopleSoft in relation to all of this.
817
00:48:27.949 --> 00:48:28.249
So...
818
00:48:29.037 --> 00:48:32.338
What do I constantly say on all of my content, including this podcast?
819
00:48:32.719 --> 00:48:39.721
I think one of the most important things that you can do as a blue teamer is pay attention to threat actors, behaviors, and MOs.
820
00:48:40.222 --> 00:48:42.843
They are telling you how they're going to hack you.
821
00:48:43.343 --> 00:48:51.046
I've been on the lead incident response seat when groups like shiny hunters have attacked my company.
822
00:48:51.766 --> 00:48:58.109
And they did it the same exact way they targeted peers of mine in the months leading up to my attack.
823
00:48:58.309 --> 00:49:02.031
And I didn't learn the lesson and be like, well, we're going to be next.
824
00:49:02.091 --> 00:49:03.472
And this is exactly how they're going to do it.
825
00:49:04.132 --> 00:49:05.513
We should have our playbook in place.
826
00:49:05.633 --> 00:49:06.553
I didn't do that.
827
00:49:06.673 --> 00:49:07.674
And I suffered for it.
828
00:49:07.814 --> 00:49:07.994
Right.
829
00:49:08.034 --> 00:49:10.335
So I'm telling you, watch what they're doing.
830
00:49:11.095 --> 00:49:17.678
Shiny Hunters, Scattered Spider, Klopp, any of these big cybercrime groups are just screaming about their MO.
831
00:49:18.158 --> 00:49:19.199
Have a playbook right now.
832
00:49:19.459 --> 00:49:20.059
Stop what you're doing.
833
00:49:20.479 --> 00:49:21.240
Like and subscribe.
834
00:49:21.620 --> 00:49:23.080
And then go figure out your playbook.
835
00:49:23.521 --> 00:49:26.282
It's kind of funny how it's like, you know, you watch those movies with like the...
836
00:49:26.962 --> 00:49:33.284
the traditional super villain, and they lay out their whole evil plan, and everyone's like, no one would actually do that in real life.
837
00:49:33.304 --> 00:49:41.067
And it's like, no, these guys are so hellbent on reputation and standing in the community that they're literally going to tell you how they do this shit.
838
00:49:41.087 --> 00:49:48.089
And, you know, like you said, just be on top of this, of the trends, and you can generally predict what's going to happen to you, unless you're the, you know, patient zero.
839
00:49:48.109 --> 00:49:49.429
Then in that case, sorry, that sucks.
840
00:49:49.549 --> 00:49:51.050
But Threat Intel also helps with that.
841
00:49:52.380 --> 00:49:53.140
Yeah.
842
00:49:53.420 --> 00:49:54.721
The Krebs article is pretty good on this one.
843
00:49:54.761 --> 00:50:01.344
It talks a lot about a bunch of the different cybercrime groups and, like, their reactions to a lot of this.
844
00:50:01.804 --> 00:50:08.487
And then gives a lot of intel based on some, like, professional threat hunters and stuff and data on all of it.
845
00:50:08.547 --> 00:50:11.849
So please, like, go through and pay attention to a lot of this.
846
00:50:12.989 --> 00:50:13.990
Some of the, like...
847
00:50:14.670 --> 00:50:24.273
statements out of the group, like try to read between the lines, but in terms of like their behavior and all this kind of stuff, super important to follow in all this.
848
00:50:24.293 --> 00:50:28.955
We also have another article in here, shiny hunters defiant after FBI calls on members to come forward.
849
00:50:28.975 --> 00:50:32.596
Basically after this arrest, they're like, Hey guys, we're on, we're on you.
850
00:50:33.256 --> 00:50:34.857
Uh, they actually released a video.
851
00:50:34.877 --> 00:50:35.737
Did you watch that video?
852
00:50:35.997 --> 00:50:39.018
Should we just like, yeah, the FBI video.
853
00:50:40.052 --> 00:50:40.493
Oh, yeah.
854
00:50:40.513 --> 00:50:41.073
What's his name?
855
00:50:41.153 --> 00:50:42.835
The deputy director for cyber, right?
856
00:50:43.755 --> 00:50:46.938
I'm Brett Leatherman, assistant director of the FBI's cyber division.
857
00:50:47.519 --> 00:50:53.083
Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of shiny hunters.
858
00:50:53.203 --> 00:51:01.891
So this is the FBI leader of cyber division talking about the Dutch law enforcement high tech crime unit arresting this guy.
859
00:51:02.071 --> 00:51:04.913
OK, I saw some tweets basically saying like,
860
00:51:06.034 --> 00:51:08.415
I haven't seen the FBI this spicy in a while.
861
00:51:08.455 --> 00:51:10.255
They're like, gloves are off.
862
00:51:10.855 --> 00:51:15.656
A group linked to cyber attacks in the United States, the Netherlands, and around the world.
863
00:51:16.377 --> 00:51:20.178
The Dutch high-tech crime unit arrested the suspect under Dutch law.
864
00:51:20.378 --> 00:51:24.599
So he was just going on to say, this is how it's supposed to work, right?
865
00:51:24.939 --> 00:51:25.859
Like, look at all of us.
866
00:51:26.159 --> 00:51:29.820
They flex a lot when they do multi-national things.
867
00:51:29.880 --> 00:51:33.721
We actually saw this recently with some Nigerian takedowns.
868
00:51:34.121 --> 00:51:44.270
And like a lot of international EU and US like cybercrime units, like helped take down some Nigerian stuff, man, do they've, they have a budget on PR.
869
00:51:44.690 --> 00:51:52.818
They've got a website branding, graphics, animation videos, mission accomplished banner comes down on the aircraft carrier type stuff.
870
00:51:52.838 --> 00:51:53.198
Yeah.
871
00:51:53.298 --> 00:51:55.319
when they do these missions.
872
00:52:08.787 --> 00:52:12.468
breached $140 million, taken $70 million in extortion payments.
873
00:52:12.888 --> 00:52:13.348
It's wild.
874
00:52:13.368 --> 00:52:14.828
These guys are in... Not extortion.
875
00:52:15.468 --> 00:52:15.928
Not extortion.
876
00:52:16.108 --> 00:52:16.589
No, I'm sorry.
877
00:52:16.609 --> 00:52:17.149
Not extortion.
878
00:52:18.849 --> 00:52:20.809
17 years old to like 22 years old.
879
00:52:21.049 --> 00:52:21.309
Yeah, yeah.
880
00:52:21.369 --> 00:52:23.750
And they've taken $70 million in payments.
881
00:52:23.950 --> 00:52:25.330
They've demanded a lot more.
882
00:52:25.450 --> 00:52:27.410
And I've read numbers over $100 million.
883
00:52:27.951 --> 00:52:31.431
So the numbers are like, again, attribution is hard.
884
00:52:31.471 --> 00:52:32.991
Which threat actor group took what?
885
00:52:33.252 --> 00:52:34.352
Like who paid who?
886
00:52:34.652 --> 00:52:35.292
All this kind of stuff is hard.
887
00:52:35.312 --> 00:52:35.692
Extortion payments.
888
00:52:36.012 --> 00:52:40.475
They often target third-party vendors and cloud-based platforms, stealing sensitive data and extorting victims with threats to publish it.
889
00:52:40.916 --> 00:52:45.599
The FBI is grateful to all the partners who've assisted us, especially the Dutch National Police and the industry partners who shared information with us quickly.
890
00:52:45.959 --> 00:52:48.741
Now, to the remaining members of Shiny Hunters, you've heard about the arrest of your colleague.
891
00:52:49.001 --> 00:52:51.383
We're confident you've seen or heard things in recent days that the public is not.
892
00:52:51.828 --> 00:52:52.689
Okay, I like this part.
893
00:52:53.049 --> 00:52:57.894
So, to the rest of Shiny Hunters, we know that you know things that the public doesn't.
894
00:52:58.435 --> 00:52:58.615
Right?
895
00:52:58.695 --> 00:52:59.376
Because what?
896
00:52:59.456 --> 00:53:00.637
They went into this guy's apartment.
897
00:53:00.657 --> 00:53:01.118
They got his stuff.
898
00:53:01.138 --> 00:53:02.359
I think it was his parents' house, right?
899
00:53:02.399 --> 00:53:03.440
Like, got stuff.
900
00:53:03.460 --> 00:53:04.361
Is this his parents' house?
901
00:53:04.481 --> 00:53:05.502
I think so, man.
902
00:53:05.642 --> 00:53:10.708
Bro, making 70 mil as a cyber criminal from your mom's basement is like peak hacker, by the way.
903
00:53:10.748 --> 00:53:11.428
That's awesome.
904
00:53:11.588 --> 00:53:12.790
Okay, hold on.
905
00:53:12.850 --> 00:53:14.471
I might be thinking about the other...
906
00:53:15.172 --> 00:53:17.993
couple guys that just got picked up that are 17 or whatever.
907
00:53:18.133 --> 00:53:19.834
I forget where this guy got picked up.
908
00:53:20.394 --> 00:53:27.217
Either way, it's hard to wash $75 million and turn it into real money that you can like spend on a home, by the way.
909
00:53:27.417 --> 00:53:27.657
Right.
910
00:53:27.757 --> 00:53:30.738
Like, uh, super difficult.
911
00:53:31.058 --> 00:53:34.960
I can't, I can't find it quickly on like where, where he was, but yeah, it's something like that.
912
00:53:34.980 --> 00:53:35.740
These guys are young.
913
00:53:35.940 --> 00:53:36.160
Right.
914
00:53:36.901 --> 00:53:37.041
Um,
915
00:53:37.681 --> 00:53:40.382
But they're basically like, okay, we got his devices.
916
00:53:40.703 --> 00:53:44.305
You guys have seen what we've taken offline.
917
00:53:44.725 --> 00:53:50.068
You guys have evidence of things that have disappeared off of your cyber criminal network, right?
918
00:53:50.448 --> 00:53:54.330
Like, so that means that they know things that we don't all.
919
00:53:54.490 --> 00:53:59.693
I like, that's kind of like a, okay, I'm making eye contact with the camera talking to you type thing going on here.
920
00:54:00.153 --> 00:54:02.935
Other groups believed anonymity or their friends would protect them and they were wrong.
921
00:54:03.415 --> 00:54:07.117
Arrests have a way of changing who is willing to talk and seized infrastructure has a way of showing us who's left.
922
00:54:07.597 --> 00:54:11.738
Whoa, C's infrastructure has a way of showing us who's left.
923
00:54:11.878 --> 00:54:15.259
And by the way, arrests have a way of making your friends talk.
924
00:54:15.779 --> 00:54:16.139
Kind of wild.
925
00:54:16.159 --> 00:54:17.839
The longer you stay in this, we know we learn about you.
926
00:54:18.319 --> 00:54:19.520
You know how to find us and we know how to find you.
927
00:54:19.880 --> 00:54:21.560
I suggest you reach out first while the choice is still yours.
928
00:54:22.160 --> 00:54:23.141
You know how to find us.
929
00:54:23.441 --> 00:54:24.681
We know how to find you.
930
00:54:25.781 --> 00:54:26.901
Based FBI.
931
00:54:27.302 --> 00:54:29.522
Reach out to us while the choice is still yours.
932
00:54:30.102 --> 00:54:31.623
That's fucking wild, right?
933
00:54:32.003 --> 00:54:32.543
Kind of crazy.
934
00:54:32.843 --> 00:54:33.223
Cinema.
935
00:54:34.202 --> 00:54:39.665
Anyway, like we talked a lot about like Team PCP did nothing wrong on a few episodes ago.
936
00:54:39.905 --> 00:54:41.506
Really interesting conversation, right?
937
00:54:41.646 --> 00:54:44.508
About like threat actor behavior and whatnot.
938
00:54:45.188 --> 00:54:46.129
That's not this, right?
939
00:54:46.189 --> 00:54:47.910
This is like $70 million.
940
00:54:48.510 --> 00:54:50.571
Like Team PCP never took extortion payments.
941
00:54:50.591 --> 00:54:52.532
That's why they get that treatment.
942
00:54:53.213 --> 00:54:57.215
You take $70 million, you get the eye contact from the FBI in the video here.
943
00:54:59.460 --> 00:55:00.501
All right, man.
944
00:55:01.081 --> 00:55:03.683
What, like, enough with Shiny Hunters.
945
00:55:03.963 --> 00:55:05.484
We teased it earlier.
946
00:55:05.844 --> 00:55:08.166
Openweight models getting really good at hacking.
947
00:55:08.566 --> 00:55:14.130
And for some reason, we got Frontier models basically advertising for them.
948
00:55:14.550 --> 00:55:15.811
What is this Anthropic blog?
949
00:55:15.831 --> 00:55:17.553
Did you read this one about GLM53?
950
00:55:18.333 --> 00:55:20.173
So I didn't read it in depth.
951
00:55:20.353 --> 00:55:21.234
I did skim it.
952
00:55:21.374 --> 00:55:33.896
Now, the reason that I didn't read it is because the minute I saw Anthropic writing about GLM-5.3, particularly in the context of advanced cyber capabilities, I knew it was propaganda.
953
00:55:34.196 --> 00:55:41.818
Like, literally, this is just, I think, Dario and friends trying to continue to make the case for the regulation of open-weight models.
954
00:55:41.838 --> 00:55:42.138
Yeah.
955
00:55:42.278 --> 00:55:44.782
And we can go more into a nuanced conversation here a little bit.
956
00:55:44.882 --> 00:55:53.115
I think there is a little bit of merit to the conversation, but also a lot of unethical, call it capitalistic incentives to do that as well.
957
00:55:53.877 --> 00:55:56.761
But yeah, this write-up is basically them being like, wow, guys.
958
00:55:57.402 --> 00:55:59.845
Oh, GLM-53 is kind of scary, huh?
959
00:56:00.205 --> 00:56:02.968
Like, it'll do cyber stuff and it has no guardrails?
960
00:56:03.348 --> 00:56:05.590
Sheesh, we should regulate this model, huh?
961
00:56:05.610 --> 00:56:06.271
What do you think?
962
00:56:06.291 --> 00:56:07.352
That's the whole article.
963
00:56:07.452 --> 00:56:12.717
It's like them showing that, you know, it's basically as good as Mythos and it will do whatever you want.
964
00:56:12.917 --> 00:56:13.618
That's the whole article.
965
00:56:14.719 --> 00:56:17.722
Now, what would a company like Anthropic have to gain from doing that?
966
00:56:17.742 --> 00:56:18.323
I don't know, Matt.
967
00:56:18.343 --> 00:56:19.103
What are your thoughts on that?
968
00:56:19.124 --> 00:56:21.366
That's an interesting perspective for them to have.
969
00:56:21.766 --> 00:56:24.827
I mean, this is just like masks off, right?
970
00:56:25.087 --> 00:56:27.867
On the like exact motivations of what's going on.
971
00:56:28.047 --> 00:56:28.868
Yeah.
972
00:56:29.288 --> 00:56:38.590
That being said, I have very good friends that I respect in cybersecurity on polar opposite sides of this particular topic.
973
00:56:38.710 --> 00:56:42.511
The panel we literally did in San Francisco, a planet scale had two of them, I'm assuming, right?
974
00:56:42.531 --> 00:56:42.991
Yep, yep.
975
00:56:43.071 --> 00:56:44.371
So Daniel's one, right?
976
00:56:44.711 --> 00:56:47.412
Daniel Meisler is like far end.
977
00:56:47.772 --> 00:56:48.972
This is super dangerous.
978
00:56:52.133 --> 00:56:54.675
models freely available to anybody.
979
00:56:55.635 --> 00:57:09.302
And you've got like a teenager who's pissed at the world and can just like speak dear agent ruin, you know, low levels life because this video that he made really pissed me off.
980
00:57:09.382 --> 00:57:16.546
And then the agent could do that with various other capabilities of like ruining you, right?
981
00:57:16.606 --> 00:57:19.428
Like whatever that is, because it has no safeguards.
982
00:57:20.715 --> 00:57:21.496
I am of...
983
00:57:22.397 --> 00:57:25.279
I wouldn't say I'm like polar opposite Meissler, right?
984
00:57:25.660 --> 00:57:30.925
But I just find it really convenient that all of these people...
985
00:57:32.119 --> 00:57:33.920
The frontier models included, right?
986
00:57:34.120 --> 00:57:35.121
And this is my argument to do.
987
00:57:35.141 --> 00:57:36.102
Daniel and I are good friends.
988
00:57:36.342 --> 00:57:38.604
We talk about this via text a lot.
989
00:57:38.804 --> 00:57:41.906
Like we have group texts where we go back and forth on this topic a lot.
990
00:57:42.066 --> 00:57:48.531
And one of my key points that I just can't really get past, right, is yes, everything you're saying might be true.
991
00:57:49.092 --> 00:57:49.392
Okay?
992
00:57:49.812 --> 00:57:55.716
Models and increasingly open weight models without safeguards could get more and more dangerous, right?
993
00:57:55.736 --> 00:57:55.877
Right?
994
00:57:56.637 --> 00:58:12.187
But if that's the case, if like all of a sudden this like very widely available, highly capable model that's like basically free exists, I have it too.
995
00:58:13.880 --> 00:58:14.581
I have it too.
996
00:58:14.861 --> 00:58:17.643
This is like, and like Dan's like, well, defense always lags.
997
00:58:17.683 --> 00:58:24.709
I'm like, defense always lags before the super capable, infinitely free and usable model, right?
998
00:58:25.209 --> 00:58:27.931
If we're in magic wand land, right?
999
00:58:27.951 --> 00:58:29.192
Because that's what we all are.
1000
00:58:29.292 --> 00:58:30.893
We're all in magic wand land, right?
1001
00:58:31.234 --> 00:58:32.595
Of like future capability.
1002
00:58:33.570 --> 00:58:34.571
that doesn't exist yet.
1003
00:58:35.051 --> 00:58:38.915
I mean, there's stuff to talk about about current capability of exploitation and whatnot, right?
1004
00:58:39.155 --> 00:58:43.760
But in terms of like 10% of humanity is going to die is the conversation about the future.
1005
00:58:44.280 --> 00:58:45.501
If we're in magical...
1006
00:58:46.308 --> 00:58:52.172
like AI capability land, we also need to be in magical, I have it too to protect myself.
1007
00:58:52.612 --> 00:59:00.717
Like you cannot have, well, only the bad guys have the infinitely capable and free thing, right?
1008
00:59:01.778 --> 00:59:03.499
If the teenager has it, I have it.
1009
00:59:03.819 --> 00:59:08.362
And I probably have a better one because I have one that does cost some money or something like that, right?
1010
00:59:08.902 --> 00:59:11.284
So that's like, I have a hard time getting past that.
1011
00:59:12.039 --> 00:59:15.503
That all being said, I will caveat, like, I'm a cyber guy.
1012
00:59:15.683 --> 00:59:17.185
I'm thinking cyber stuff, right?
1013
00:59:17.626 --> 00:59:21.010
Other people are thinking biochemical stuff, nuclear stuff.
1014
00:59:21.150 --> 00:59:30.320
I don't know enough about where AI's capabilities might get there that, like, it doesn't matter that I've got the, like, AI defense thing in biochemical land.
1015
00:59:30.360 --> 00:59:31.342
How do you stop that, right?
1016
00:59:31.862 --> 00:59:36.026
There's an interesting quote I want to bring up on screen about this very topic.
1017
00:59:36.867 --> 00:59:38.028
We'll get back to the GLM one.
1018
00:59:38.048 --> 00:59:45.374
But there was this Ezra Klein from The New York Times interviewed Bill Gates kind of about this topic today.
1019
00:59:45.814 --> 00:59:57.665
And the question was, so why is anything needed beyond the simply natural incentives under capitalism and normal corporate reputational management?
1020
00:59:58.238 --> 01:00:05.220
basically like arguing or not arguing, but just asking like, why do we need this regulation or guardrails or whatever it is?
1021
01:00:05.700 --> 01:00:11.582
And Bill Gates said this, obviously you cannot separate Bill, the speaker from the message here, right?
1022
01:00:11.782 --> 01:00:17.103
Uh, so Bill Gates stuff, but I think it's, I mean, he's been thinking about this stuff a lot longer than a lot of us.
1023
01:00:17.123 --> 01:00:18.324
So I think it's worth reading.
1024
01:00:18.684 --> 01:00:21.965
He goes, I almost can't believe you're asking that.
1025
01:00:22.325 --> 01:00:25.266
This is the most dangerous thing that humans have ever gone near.
1026
01:00:26.506 --> 01:00:30.028
In other areas, do we just say, hey, go ahead, release your drugs?
1027
01:00:30.569 --> 01:00:31.409
There's no FDA.
1028
01:00:31.429 --> 01:00:32.990
There's no airline safety board.
1029
01:00:33.010 --> 01:00:35.552
There's no requirement that cars use seatbelts.
1030
01:00:35.992 --> 01:00:39.155
Do we just use the liability laws to try to keep humans safe?
1031
01:00:39.375 --> 01:00:40.976
Like, oh, you're shipping opioids.
1032
01:00:41.056 --> 01:00:44.438
Someone should just sue you if something bad happens is what he's getting at, right?
1033
01:00:45.038 --> 01:00:51.543
Because we've created a society that tries to keep people safe not by saying, oh, we can just bankrupt that person who does the bad thing.
1034
01:00:51.563 --> 01:00:51.683
Right.
1035
01:00:52.583 --> 01:00:54.404
And he goes, there's no filtering.
1036
01:00:54.544 --> 01:00:56.085
You say there's filtering, there's no filtering.
1037
01:00:56.405 --> 01:01:02.707
You can take an open source model that can create bioweapons and disable any monitoring of any kind that exists today.
1038
01:01:03.027 --> 01:01:05.268
So no, there's no filtering of any kind.
1039
01:01:05.568 --> 01:01:10.170
And so say you kill a hundred million people, you want to just use a lawsuit.
1040
01:01:10.570 --> 01:01:12.071
I almost can't keep a straight face.
1041
01:01:12.391 --> 01:01:13.952
That's the direct quote from, from Bill.
1042
01:01:15.152 --> 01:01:15.813
This is what I'm saying.
1043
01:01:16.913 --> 01:01:22.198
There's like this magical future gray area of capability, right?
1044
01:01:22.218 --> 01:01:27.162
That he's talking about killing 100 million people with bioweapons that like, I don't know.
1045
01:01:27.322 --> 01:01:29.304
That's like that part's wacky and weird.
1046
01:01:29.845 --> 01:01:30.085
Yeah.
1047
01:01:31.170 --> 01:01:36.594
So I guess, and again, we're going into like unstructured, open-ended thought territory for me.
1048
01:01:36.614 --> 01:01:38.455
So I may not make a logical statement here.
1049
01:01:38.615 --> 01:01:46.681
But I think I am closer to Daniel Meisler than I am to you in this topic.
1050
01:01:46.761 --> 01:01:49.382
Again, as it applies to cyber, I'm not a biochemist.
1051
01:01:49.522 --> 01:01:51.744
I don't know anything about virology or whatever.
1052
01:01:51.804 --> 01:01:54.306
Like, you know, if they can make COVID with an AI, then fine.
1053
01:01:54.326 --> 01:01:54.686
So be it.
1054
01:01:55.306 --> 01:01:55.527
Yeah.
1055
01:01:56.462 --> 01:02:11.113
As it applies to cyber technology, I think like as an attacker, if my goal were to just intrude on you and your family to make your life hard, you know, the technology already exists for that, right?
1056
01:02:11.133 --> 01:02:14.856
Like exploits exist to get into your firewall, into your home PC, etc.
1057
01:02:15.337 --> 01:02:16.437
And what does AI do there?
1058
01:02:16.598 --> 01:02:21.802
AI makes it so that it's much easier to do that and I can do that at a cheaper cost.
1059
01:02:22.490 --> 01:02:33.868
I would argue there is no parallel on the defense and that, like, structurally, in, like, the current fabric of how technology is designed, there cannot be.
1060
01:02:34.008 --> 01:02:34.709
Like, what are we going to do?
1061
01:02:34.769 --> 01:02:35.270
Are you going to...
1062
01:02:37.472 --> 01:02:39.914
put a monitoring solution on your firewall?
1063
01:02:39.974 --> 01:02:45.719
Are you also going to break the code signing that Microsoft has and then write your own AV for your own device?
1064
01:02:45.959 --> 01:02:59.230
Like, I think that in at least the short term until we have a better solution architecturally, like, I think open-weight models do favor the attacker because we just don't have the same openness with defense that we do with offense.
1065
01:03:00.660 --> 01:03:02.061
I don't think you're able to defend yourself.
1066
01:03:02.521 --> 01:03:04.322
So I think I agree that they are dangerous.
1067
01:03:04.382 --> 01:03:09.884
My thing with the whole it's dangerous conversation, though, like, yeah, sure, it's dangerous.
1068
01:03:10.044 --> 01:03:10.304
Okay.
1069
01:03:11.125 --> 01:03:13.946
I literally have Quen 3-8 on my computer upstairs.
1070
01:03:14.626 --> 01:03:15.987
What are they going to do about that?
1071
01:03:16.167 --> 01:03:21.049
Are they going to come and, you know, Second Amendment in reverse, like, seize my models?
1072
01:03:21.129 --> 01:03:24.391
Like, is there now a constitutional amendment, a right to free models?
1073
01:03:24.411 --> 01:03:24.831
You know what I mean?
1074
01:03:25.071 --> 01:03:27.072
Like, I don't know how you regulate this at this point.
1075
01:03:30.033 --> 01:03:32.814
And we said, yeah, matrix math is illegal, and we stopped doing it.
1076
01:03:33.234 --> 01:03:37.895
And then maybe there was a world where now the open AIs can be government-regulated and you can't do open-weight models at your house, and fine.
1077
01:03:38.755 --> 01:03:43.797
But, like, with the cat out of the bag, with Pandora's box open, what is the solution?
1078
01:03:43.817 --> 01:03:46.978
Like, what if we all agreed that, you know, open-weight models are dangerous tomorrow?
1079
01:03:46.998 --> 01:03:48.358
Okay, now what?
1080
01:03:48.698 --> 01:03:49.138
You know what I mean?
1081
01:03:49.839 --> 01:03:50.919
I don't know where it goes.
1082
01:03:51.290 --> 01:03:53.691
Yeah, I'm super interested in following this.
1083
01:03:53.751 --> 01:03:57.712
I was just reading Alex Damos has like an interesting thread about it.
1084
01:03:57.772 --> 01:03:58.572
We can include...
1085
01:03:58.652 --> 01:04:00.132
I mean, yeah, there's a lot of takes on this.
1086
01:04:00.533 --> 01:04:17.597
I'm really interested how the next couple months go on this because I don't exactly trust the leaders at the helm for a lot of things, specifically when it comes to absolute cutting-edge technology to truly understand it and try to get a handle on it.
1087
01:04:18.117 --> 01:04:19.638
Well, this comes from the...
1088
01:04:20.523 --> 01:04:23.613
seeing people who ask the TikTok CEO if he's on their Wi-Fi.
1089
01:04:23.693 --> 01:04:27.526
I mean... Mr. Chute, does TikTok access the home Wi-Fi network?
1090
01:04:29.467 --> 01:04:31.769
Only if the user turns on the Wi-Fi.
1091
01:04:32.129 --> 01:04:32.510
I'm sorry.
1092
01:04:32.550 --> 01:04:33.430
I may not understand that.
1093
01:04:33.510 --> 01:04:35.972
So if I have a TikTok app on my phone.
1094
01:04:38.034 --> 01:04:38.294
Dude.
1095
01:04:38.755 --> 01:04:48.663
Yeah, let's go ahead and wheel the current lawmakers in and then ask them to fucking make decisions about frontier models is not exactly.
1096
01:04:48.683 --> 01:04:49.744
I don't know.
1097
01:04:49.764 --> 01:04:50.825
I'm not optimistic about it.
1098
01:04:51.145 --> 01:04:51.425
I agree.
1099
01:04:51.485 --> 01:04:52.206
Let's go with that.
1100
01:04:53.306 --> 01:05:01.371
And then, yeah, obviously incentives are just perverse for these frontier model leaders to be the ones talking about this stuff because they're going to be able to survive it.
1101
01:05:01.651 --> 01:05:03.072
So it's regulatory capture, right?
1102
01:05:03.092 --> 01:05:04.032
It's like, yeah, we're going to be good.
1103
01:05:04.232 --> 01:05:12.397
Like, we're going to help write the damn laws so that we can survive it because we've got, you know, trillion dollars that we can just buy some of these lawmakers and figure it out.
1104
01:05:13.037 --> 01:05:15.118
That being said, is everything they said in this article wrong?
1105
01:05:15.178 --> 01:05:17.040
No, a lot of it is completely accurate.
1106
01:05:17.180 --> 01:05:17.360
Yeah.
1107
01:05:17.400 --> 01:05:17.540
Right?
1108
01:05:17.600 --> 01:05:17.780
Yep.
1109
01:05:17.980 --> 01:05:20.502
It's like 5.3 can write exploits.
1110
01:05:20.762 --> 01:05:25.546
Literally, these graphs that we can show on the screen, it's basically Mythos preview level.
1111
01:05:28.368 --> 01:05:30.290
It is at the same tier as Mythos, right?
1112
01:05:30.350 --> 01:05:39.297
And even if you don't have the full GLM 5.3, I have friends who are using GLM 5.3 Flash on two Sparks right now to do pretty good, pretty rapid vulnerability search on RE.
1113
01:05:39.657 --> 01:05:45.421
Yeah, so they're right, but it's really hard to listen to them about what should be done about it.
1114
01:05:46.342 --> 01:05:49.123
Because they're the ones selling the solution.
1115
01:05:49.143 --> 01:05:50.003
You know what I mean?
1116
01:05:50.183 --> 01:05:56.525
Like, basically, Dario and Sam get up and talk about how scary this is so that you need to use them to defend yourself.
1117
01:05:57.025 --> 01:05:57.845
And that's rough.
1118
01:05:58.326 --> 01:05:59.566
What are they even saying should be done?
1119
01:05:59.586 --> 01:06:10.069
I mean, the last paragraph of this article is literally, Governments should conduct safety testing on sufficiently capable AI models, including successors to GLM53, without high-quality evaluations from sources that are independent.
1120
01:06:10.329 --> 01:06:13.570
The impact of these capabilities may not become fully clear to the developers on the ground.
1121
01:06:13.630 --> 01:06:32.487
okay so we do this testing the government you know who has been wheeled out to do the fucking testing without knowing what's going on they're like yep it's dangerous okay then what like what are they suggesting occurs yeah we hope they work appropriately to appropriately safeguard these capabilities and prevent misuse but like you said it's open source code what are we gonna do what are
1122
01:06:33.303 --> 01:06:33.963
This is wild.
1123
01:06:33.983 --> 01:06:35.103
I don't know.
1124
01:06:35.343 --> 01:06:35.543
All right.
1125
01:06:35.704 --> 01:06:36.764
I'm interested in how this goes.
1126
01:06:37.044 --> 01:06:38.224
Apocalypse incoming.
1127
01:06:38.444 --> 01:06:38.864
Incoming.
1128
01:06:38.884 --> 01:06:39.104
Yeah.
1129
01:06:39.244 --> 01:06:39.704
I don't know, man.
1130
01:06:39.804 --> 01:06:40.565
It's a weird world.
1131
01:06:40.665 --> 01:06:45.546
Again, I don't think that the guy that left Anthropic and said like, oh, we're all going to die.
1132
01:06:45.766 --> 01:06:46.906
Oh, it's like it's that bad.
1133
01:06:46.926 --> 01:06:50.127
I think a lot of that is like an unfortunately really dark marketing play.
1134
01:06:50.427 --> 01:06:55.068
But I think there does there is like an existential issue in the not only like labor market.
1135
01:06:55.108 --> 01:06:56.688
What do people do when AI can do everything?
1136
01:06:56.708 --> 01:06:58.988
But also like these models are good at exploits.
1137
01:06:59.048 --> 01:07:01.449
So what does the next five years of defense look like?
1138
01:07:01.569 --> 01:07:08.134
And we literally saw during the Hugging Face incident that, like, Anthropic refused to help the defenders due to these safeguards.
1139
01:07:08.254 --> 01:07:12.258
And they had to use GLM-5-3 in order to do these things.
1140
01:07:12.318 --> 01:07:16.821
So, like, we're obviously—and they acknowledge that in this article that work is yet to be done on these safeguards.
1141
01:07:17.242 --> 01:07:17.982
It's kind of crazy.
1142
01:07:18.343 --> 01:07:20.404
But, yeah, I mean, I think they're right.
1143
01:07:20.504 --> 01:07:24.387
It's just hard to listen to the people with crazy incentives to talk about it.
1144
01:07:24.688 --> 01:07:25.729
I think they're right, though.
1145
01:07:25.749 --> 01:07:27.270
Defenders, we talked about it, need to be—
1146
01:07:27.850 --> 01:07:28.912
defending at machine speed.
1147
01:07:29.112 --> 01:07:31.035
What can help you defend at machine speed, right?
1148
01:07:31.215 --> 01:07:32.557
It's like, turns out, models can.
1149
01:07:33.158 --> 01:07:33.679
All right, man.
1150
01:07:34.019 --> 01:07:34.580
Another week.
1151
01:07:34.660 --> 01:07:35.241
Sign us off.
1152
01:07:35.582 --> 01:07:36.203
All right, everybody.
1153
01:07:36.263 --> 01:07:37.765
Appreciate you listening as usual.
1154
01:07:37.825 --> 01:07:39.688
If you are here, well, thank you for being here.
1155
01:07:39.708 --> 01:07:40.048
That's awesome.
1156
01:07:40.088 --> 01:07:40.489
I appreciate that.
1157
01:07:40.509 --> 01:07:42.472
If you're here on Spotify, do me a favor, hit that five.
1158
01:07:42.552 --> 01:07:43.092
star button.
1159
01:07:43.352 --> 01:07:47.073
I've actually heard we've gotten some organic follows on Spotify.
1160
01:07:47.093 --> 01:07:50.774
We're getting pushed by the Spotify algo, and that's because of you rating it five stars.
1161
01:07:50.794 --> 01:07:51.454
We appreciate that.
1162
01:07:51.534 --> 01:07:54.775
Also, the best way to help the show out is to check out our sponsor, Maze.
1163
01:07:54.835 --> 01:07:56.216
Worked with them for a long time.
1164
01:07:56.316 --> 01:07:57.316
Really great team over there.
1165
01:07:57.576 --> 01:08:03.698
Guys, if you're in the world of AppSec, if you deploy code anywhere in the world and you want to make sure it's secure, go check out Maze.
1166
01:08:03.778 --> 01:08:05.138
Good sponsor of the show next week.
1167
01:08:05.358 --> 01:08:06.038
One last thing.
1168
01:08:06.498 --> 01:08:09.719
If you want to hang out with us live, we're going to be at Sentinel One Con.
1169
01:08:09.739 --> 01:08:12.560
We've got a discount code we can include in it.
1170
01:08:12.700 --> 01:08:13.781
Just one con in Vegas.
1171
01:08:13.821 --> 01:08:18.242
If any of you are Sentinel One fans and want to come hang out, we're going to be doing a bunch of live content there.
1172
01:08:18.522 --> 01:08:19.022
We will be there.
1173
01:08:19.402 --> 01:08:19.742
All right, y'all.
1174
01:08:19.762 --> 01:08:20.182
Thanks for listening.
1175
01:08:20.202 --> 01:08:20.543
Appreciate it.
1176
01:08:20.563 --> 01:08:21.023
See you next week.
1177
01:08:21.243 --> 01:08:21.543
Peace.