Welcome to the Blue Security Podcast, a weekly podcast for
information security defenders where we bring you discussions
on best practices, tools, and implementation for enterprise
security. Now here are your hosts for
today's show, Andy JA and Adam Brewer.
Welcome to this week's episode of the Blue Security Podcast.
I'm Andy, your host. I am Adam, your Co host.
All right, so often times when I'm looking for stuff to talk
about, I'll find things that like I'm using personally or
things that affect me personally.
And so this story really piqued my interest because this was
actually something that came out a few weeks ago.
And then I read the story and I was kind of a little concerned
and then I found the story that the bug was was fixed.
So what happened was there was a story that came out a few weeks
ago that talked about the Signal encrypted chat, right?
So we've talked about Signal on this show before.
It's something that I use daily, one of the most secure consumer
end to end encrypted messaging apps that's out there.
And So what happened was, and This is why I kind of piqued my
interest, was there was a story that said the FBI was actually
able to extract deleted signal messages from a suspect's iPhone
using some forensic tools. And the content of the messages
have been displayed in a notification.
So like when when you have your lock screen and the notification
comes up and might see a preview or something of that message
that was stored inside the phone's database even after the
messages inside of the Signal app were deleted.
And so in the specific case that exposed this, the messages were
able to be recovered from the defendant's phone in connection
with an attack on the Prairie Land ICE Detention Center
facility. And then Signal had been removed
from the device, but incoming notifications were preserved in
the internal memory. So when a secure message is
received, the iPhone generates a notification preview, and under
normal circumstances, dismissing that alert should instruct the
OS to permanently delete that temporary text from memory.
But due to a specific logging error, this deletion process had
failed. So notifications that were
displayed message content were cached inside the device for up
to a month. And crucially, the vulnerability
was not in Signal itself, but in Apple's internal notification
storage. So, you know, that's kind of
part of the the issue is that Signal can only really secure
what would they own, right? This was, this was a problem
with Apple's iOS. So I saw this and again, like I
use Signal. So I was like, yeah, this is
this is interesting. A vulnerability that shouldn't
happen. Something that I also do, which
you know, it depends on your level of risk is I don't have
any previews that show up on my phone.
If the phone is unlocked, nothing can be seen from
imessages, Signal, whatever. Only after I've unlocked the
phone will it appear in the Notification Center and I'll be
able to see that there was a message.
But I think it sounds like even in this case, anytime there's a
preview in the Notification center that's cashed.
And So what did Apple do? They patched the bug.
And so on April 22nd, so just a few days ago, there was an
update which I have already updated my iOS to the latest
version 26 point 4.2. So if you haven't seen that yet,
go ahead and you know, go to your settings and look for the
update because it might not have pushed through yet.
Same thing with Pad OS which is 26 point 4.2 and then iOS 18
point 7.8 for older devices. So Apple described it as a
logging issue fixed through improved data redaction.
Signal confirmed the patch and ensured all inadvertently
preserved notifications will be deleted and no forthcoming
notifications will be preserved from deleted applications and
said no action is needed within Signal itself, just install the
update. So couple of just kind of
takeaways really. This kind of highlights that gap
of expectation like as a user, if I delete the app and delete
the data, I would, you know, think that the OS would manage
that. And so there was a gap here and
and we don't really know for how long this bug existed and how
many times, you know, attackers were able to to possibly get
this. But you know, Sky's not falling,
right? It was fixed.
It was bug. And also the FBI had physical
access to the device. So in a lot of cases when we
lose physical access to something, it's kind of like
security is already lost at that point, right?
And so that's something to to take into consideration.
Signal also already had an option to prevent message
content from appearing in notifications at all.
So users can go to the Signal settings, notification
notification content and set it to name only or no name slash
content. That's interesting because I
haven't done that, but I might actually go and do that just
just for kicks because any time I want to read a message, I
still always just go into the Signal app itself.
So yeah. And the the fix addresses the
notification database flaw, but it doesn't change how messaging
apps store data internally. Users still need to relay rely
on app level encryption and privacy settings.
So anytime you're you have a chat application, make sure you
go into the settings and see how the privacies are for that
specific app. Your thoughts on this, Adam?
So while you were talking I just pulled open Signal on my iPhone
just to take a look because I was wondering if they were
conflating the OS level notification settings where you
mentioned. Andy, you can configure do this
behavior when the phone is locked, change the behavior of
the phone is unlocked, which most iPhones do by default
nowadays. Anything with a Face ID iPhone I
should say, blocks most notifications unless the phone
is unlocked. Default behavior.
What this does is this is on the Signal side of it.
So if you know how all this stuff works, you understand that
Apple operates the Apple Push Notification Service, or APNS,
and your app provider then pushes the notification to APNS,
which then pushes it to your devices.
Changing this setting on the Signal side prevents the message
content from ever being sent to APNS at all, which is something
you'd expect from Signal. Do you have that option?
I think most other messaging apps do not because their
audience tends to be less tinfoil Hattie.
Although in this case, there was a setting and it would have
helped had you, this person leveraged it.
You, you you've summarized well. I need the the sky is not
falling. It's unfortunate this happened.
I know on this show, you and I have always had a very strong
opinion of Apple and their cybersecurity posture and they
do a great job. And in fact, I don't know if you
mentioned it. I was, I think grabbing my phone
at the moment. They did actually patch iOS 18
as well, which they don't always do.
So noted that even for down level operating system devices,
they can still take advantage of this this security fix as well.
So you know, it's it's interesting.
I think it's it's a good point that how something behaves from
a front end perspective, just not necessarily mapped to how it
behaves from a back end perspective.
A lot of modern operating systems have a lot of different
logging and auditing tasks always running, and those are
coded independently from how the UI is drawn and displayed to the
user. So don't always assume that the
way the UI shows up matches the underlying behaviour.
So that's a good lesson learned to take forwards.
Yeah, it's an interesting event and and a good lesson learned.
And of course, Signal had a setting that that would have
helped. And also go patch your iOS and
Apple devices. The problem with the signal
setting and I went and checked WhatsApp as well, just as a as a
double check as you were talking at home and it does have a
notifications where you can check off the preview.
But in both of these cases, and I'm sure this is the case with
with all apps for the most part, is that the default is to show
the preview. Tyranny of the Default.
Right. And so everyone, the mass
majority of people are not going to go in to notifications and
disable preview unless you're like tinfoil, highly like
myself, right? So I didn't even have this set
within the app, but I went ahead and disabled it.
I'm going to see how the experience is for a while.
Well, and and again, it goes back to Apple has such a good
reputation for security. I don't think it was something
that ever crossed anyone's mind on maybe I don't want this
getting handed off to AP and S at all.
Maybe I don't want this going to the notification system at all.
I mean, my thought up until we just had this conversation 20
minutes ago would have been well, the OS level configuration
is perfectly fine and in in this case it wasn't and now it is.
So it's kind of one of those things I'm I think we can move
on, but it's interesting to note for sure and, and something to
keep in mind. And you know, alternately, I
think my my point around and you made the point as well, the gap
between what shows in the UI versus what happens under the
hood are not one in the same. I think my my main take away too
is, you know, as we're where as we're thinking about security,
is that tyranny of the fault? Is that what you make default
wherever that choice is, that is what the majority of people are
going to go with. It's very rare that anyone is
going to go beyond, you know, like whatever.
So if you say, you know, phone number, MFA is is my default.
Well, that's what the majority of people are going to use.
If you say, you know, got to use an authenticator app, that's
what the majority of people are going to use.
And if you say fish resistant is going to be the default, then
that's where everyone's going to have to be.
So it's just like insecurity as we look at these things, that
default setting is extremely important.
That's a pretty sick segue to our next topic.
Yeah, you like that? I like that so.
In in other news of the UK National Cybersecurity Center
has now fully backed pass keys. They said that consumers first
choice of login should be pass keys and the the key to this is
to understand that they said consumers and not just
enterprise security. So this is a recommendation for
everyday people. The NCSC also no longer
recommends passwords unless they're used where pass keys are
not yet available on a digital service.
And this is really a landmark position from a national
government cybersecurity agency. So kudos to the UK National
Cybersecurity Center for coming out and say this.
What has changed over let's say the last 12 months that makes
them kind of say this and confident enough to say this is
that they've worked closely with the Fido Alliance and they've
observed positive progress across the passkey ecosystem and
saw success in the use of passkeys within the NHS, which
is I think the National Health Service, a system within within
the UK. And then in other word, other
real world large scale deployments have really
validated the technology. Previously the NCSC has outlined
challenges around inconsistencies in the passkey
ecosystem, which we have also highlighted on our show on
there's different flavors of pass keys, confusing
terminology, lack of consensus on when pass keys should be
used. Also like you know, syncopal
pass keys weren't available right away, but now they are.
And so there's there's has been multiple kind of barriers for
normal people and consumers getting into.
Pass keys plus other factors required.
There's a lot of sites where let's say you had legacy 2FA
stood up and then they start supporting pass keys.
A lot of them will take your pass key and then still hit you
up for another validation. Like Amazon will want your your
one time passcode on top of it. And it's like, guys, what are we
doing here? Like this doesn't make any
sense. This bonkers.
And then it doesn't feel any better.
It doesn't feel more frictionless.
And so it actually feels more friction filled in some ways.
It's truly beneficial when it satisfies all factors in which
while it should, it is inherently a multi factor
authentication. But anyhow, that's another
inconsistency and implementation where some sites will override
your two FA configuration if you're signing in with a passkey
that's considered sufficient. Our employer Microsoft being one
of them. And so now the NCSC has said
that progress within the industry have made some of those
concerns addressed enough to recommend Passkey's to the
general public. The NCSC has rolled out its
Passkey a position specifically to consumers with more guidance
for businesses expected in the future.
But for businesses, the authentication guidance is still
to use single sign on or SSO when possible.
But this whole announcement that we're going to have, the link to
the article in the show notes is specifically for consumers,
which is, is pretty, pretty big. Google made passkeys the default
sign in for all users in 2023. And then Apple followed in 2024.
Microsoft made passkeys available to all consumer
accounts in 2025. And also the default now when
you make a new Microsoft account is a passkey.
So we talked about the tyranny of default.
It's like when if you're brand new and you're starting to, to,
when you go to Microsoft to make a Xbox calendar, Outlook or
whatever it is, the default experience is a passkey, a
password list passkey. And so now the NCSC is, is
catching up to a lot of where some of these major platforms
are. But again, that governing body
carries some official weight to it.
You could say that, yeah. And it's interesting this is on
the consumer side first versus enterprises.
And I think in a lot of ways I can get why they would go that
direction that the consumer facing organizations, esecially
Google and Ale have done a very good job imlementing it.
And in fact, Windows has had ass key support for a long time.
But it just recently got updated to where it has very clean
integration with password managers to where they can hook
in at a operating system level and deliver their pass keys when
prompted, which is really nice and very well done.
So generally in a consumer experience, I think it's it's
almost there. There's still some
inconsistencies and some challenges.
And unless you're like 100% in the Apple ecosystem or 100% in
the Google system, you're still probably going to need a
password manager to overcome it. But it's certainly getting
better. And again, it's, it's a chicken
and an egg kind of problem where you have to start pushing these
defaults and have to start driving people that direction.
And then the pain points will get addressed as more and more
people use it and point out edge cases and different examples and
different challenges they're having.
So again, great news. You and I Andy have been banging
the drum on password list and fish resistant MFA forever and
this is yet another step in the right direction.
So you love to see it. Thanks NCSC in the UK and let's
keep the momentum going forward. I also think that, like you and
me, a lot of the people that, you know, work in tech and hang
on tech are a little bit of an anomaly, especially in my age
group too, where like I'm, I'm like a, you know, elder
millennial slash, you know, Zennial and you're and you're
like an elder millennial as well, right.
So we grew up in an era where, you know, no, no electronics
existed and then transitioned, you know, from dial up to
broadband to smartphones and all that.
And so I have noticed that there are a lot of people outside
attack, maybe in a different age group, like younger, they don't
even have computers, They don't have personal computers.
They they literally do all of their computing on their phone,
right? And so I think if you're in that
kind of category where you don't, you don't use a computer,
like you're not a gamer, you don't, you're not in tech.
You might have a work laptop, but you literally only use it
for work, right? And you're on your phone.
I think in that case, passkeys are really seamless because you
might be on an Android and using the Google password manager that
integrates well with Android, or you're on Apple and you have the
vault there and you can just store a pass key for a new thing
just right there on the phone and key chain.
Yep. And so I think if you're in
those categories and you're just throwing your pass keys in there
and you're just doing all your computing on the same device, it
works very well and very seamless.
That's a really good point because there's Speaking of like
picking on millennials and us going through all the things.
There's a lot of memes that talk about how millennials when they
make a big purchase, they have to do it on a big screen.
Like if I'm booking a vacation, it's like I got to get my PC
out. I hate doing it on my phone.
Yeah, I won't. Do it on my phone.
Yeah. It's true other generations are
perfectly fine booking a flight on their phone and it's bizarre
to me. Like no, that's a big screen
purchase. So yeah, that's a good point.
When you're when you're just naturally switching devices less
and you're all in one ecosystem, it's way easier to already be on
board with pass keys. OK, so our final topic, and I
saw this post and I just wanted to talk about it because you
know, it's another person kind of hammering the point that
we've made. And if if you're new to the
podcast or, you know, even if you've listened to us a while,
you've you've heard us say this point.
But if you're new, this might be the first time you've come
across this opinion. And I just wanted to echo it
because I follow Marcus Hutchins on LinkedIn.
And you might not know that name if you're new to cybersecurity,
but Marcus Hutchins has been around for a long time and he
carries some weight in the cybersecurity industry.
And he's known online as malware tech.
And the reason why he's kind of globally recognized is because
one of the things that he did was he single handedly stopped
one of the worst cyberattacks in the world has ever seen.
So Wanna Cry in 2017 was a ransomware attack that just kind
of was rippling across the entire world's technical
ecosystem. And that was want to.
Cry in In case you don't remember, it was the one where
Microsoft patched Windows XP because the National Health
Service hello, coming back up again.
They were hit particularly hard by this, and they had a ton of
XP still in their environments. And so at the time, Terry
Myerson, who was running Windows, made the decision like
we are patching XPI know it's out of support.
I know we told everyone to get off it, but we're doing the
right thing. We're not going to keep, you
know, the entire country, the United Kingdom in the dark Ages.
From a healthcare perspective, this is the right thing to do.
We're going to take care of it. So that's how bad it was.
It got Microsoft a patch XP years after it went out of
support. Yeah, and it was rampant.
I mean, it just rippled across the world, right?
And So what Marcus did at the time, he was only 22 years old,
he reverse engineered a sample of the malware and what he found
was in the code was Adns entry, a website, a URLA domain, so to
speak. And so he he went and he looked
to see if it was registered. It wasn't.
And so he just went ahead and registered it.
And what happened was that that was inherently a kill switch
that was built into the malware. And so once he registered the
domain, the malware's, you know, beaconed out, saw that the
register, the website was registered and that stopped it.
And so that's why he's kind of like an urban legend in the
cybersecurity world because, you know, he, he was able to just he
was the first person to register that, reverse engineer it, then
register the domain and, and actually stopped the ransomware
attack that was. Globally affecting everyone.
So pretty impressive resume for a 22 year old.
Right, right. Might know a thing or two about
malware. Yeah.
And so, you know, he had this post that was on LinkedIn.
So if you if you go and you I'll put the post like in in the show
notes, of course. But what he was saying is all
this fascination with anthropic mythos.
And we had talked about how it found a bunch of like bugs in
these old, you know, open source software.
And, you know, he, he was saying that for, for this, it's not
necessarily that it's like something that's earth
shattering because no one's really looking for these bugs
because no one's getting paid to look for these bugs.
That's the whole problem. It like BSD, which is, you know,
a Linux operate Unix operating system.
Berkeley Software Distribution. Mythos was able to find that
remote code execution, 17 years old remote code execution
vulnerability and with no authentication running, and it
found another one in open BSDA 27 year old bug, right?
And so BSD doesn't have a bug bounty program.
So there's no financial incentive for anyone to be
looking over these, over the code and to report them.
And in fact, if I found the bug, I would make more money selling
it to attackers than I would reporting it to BSD.
You know, like he said, ABSD kernel, a remote code execution
RCE would probably fetch around somewhere 100,000 to 200,000 on
the black market. So that's a lot of money to just
give up. If you found it and you know it,
it might not be useless. He said while most bugs look
mostly useless, you never truly know whether a bug is useless or
not. Sometimes a seemingly useless
bug can be chained with another vulnerability to receive or
achieve RCE, remote code execution.
So he also said that anyone that found the bug would have been
financially incentivized to keep it quiet.
And BSD has about .1% of the market share, so there's
probably not a whole lot of people bothering to even bother
to audit the code in the 1st place.
And there's a big difference between a bug going unnoticed
and unreported. So what Mithos was able to do
was not necessarily something that no one could do.
It's just that it performed the work that no one else wanted to
do at the cost of, you know, $20,000 worth of tokens or
something like that, right? And so it's it's able to do this
meaningless work that no one will just go and do on their
own, which is the problem with open source software, which Adam
will probably go on a rant on. But that's the that's the danger
by using open source, especially if you don't know if there's a
bug bounty program or no one's looked at it just because it's
it could be widely used but still have bugs.
So it's just, I think in general, if your S BOM includes
open source software, you really need to be on it and careful
about where you're using it, especially if it's a critical
application for your enterprise. Andy, I think it was you, maybe
it was someone else who made the point that commonly used
components in a software bill of materials will actually start to
benefit from being frequently scanned with AI tooling and
should get really, really hardened as a result of it.
Provided there's enough of volunteer software developers
willing to take those pull requests and implement those
changes, which is no given thing.
And there's potentially, and we'll see if this is FUD or if
it's reality. Potentially there's could be a
lot of those. It could be a lot of work comes
in instead of shipping features for playing catch up and doing a
lot of patching of 17 year old vulnerabilities.
Could be not fun for a while to be a contributor to an open
source project. But I think most widely used
components will probably benefit from very thorough and
consistent checking across a lot of orgs kind of redoing the same
thing. And they'll get really, really
hard and they'll be excellent. So this could in the long run be
in that positive. But for something like this,
Open Bsdi keep wanting to say Free Bsdi think that's another
distribution. They they found both.
OK, Yeah, yeah, not as widely used.
You know, it's not a Linux derivative, it's a Unix
derivative to be specific. I guess we'll see how this plays
out and we'll see how much Mythos is never going to ship by
the way. And Tropic is said Mythos is a
research preview. These changes will ship in a in
a more Consumer Focus, but like a shipping focused product, like
a new, a cloud opus, a release as an example.
And 4.7 was a step in that direction.
It is not, you know, the full kind of mythos implementation.
A mythos is also, you made the good point, very, very expensive
to run today. So there still gets into a cost
element where we are not, we're not to the point yet where these
are so commoditized and so cheap to run that it is trivial to
point it out a large code base like a Unix based operating
system and say go to town. You still have to have some
money to invest to do that. So again, I think it's going to
start with a lot of folks researching their bill of
materials and we'll go from there.
Ultimately, I think this is a short term pain, long term gain
thing because eventually we are seeing kind of Moore's law
happen in the AI space where the cost of tokens is decreasing
exponentially year over year as as the entire stack he gets more
efficient. You talk about not just the
silicon, not just the GPU's, but the CPU's, the interconnects,
the networking, the memory, the software stack it's running on
top of all of that is getting more efficient.
And you compare where we were three years ago, four years ago
to today, it's like a hockey stick curve in terms of the
difference. And so eventually it will get to
the point where a really good researcher model is not terribly
expensive to run and we can fire it off at, again, I mean, all
the public facing repositories on GitHub, I mean, that's not a
crazy thing to dream about. It's not tomorrow, but it's a
Sunday thing. We can effectively put them out
of business. Now it's going to go back to can
we implement the code changes And well, we're also going to
have AI. It already can, you can give it
a pull request and it can go write code.
You still need a human to review it, I think at this point, but
even that's going to lessen with time.
So I I think the stories of an impending cybersecurity
apocalypse are a little overblown because the tools are
available on both sides and the tools can be very powerful in
the good guys hands too, to write much more secure code to
find more vulnerabilities. You talked about chaining
vulnerabilities as well, and that's something these tools are
particularly good at finding. When Mythos first got announced,
it was it was noted how clever it was at chaining
vulnerabilities and just doing things humans aren't very good
at. I am an eternal optimist.
I'm almost a toxic optimist at times.
But I, I do think in this case, it was there was no human
solution to hardening cyber or to hardening open source
software. Tonya Jenka, our very first
guest on this show, pointed out there's no cybersecurity ferry
running around and doing security evaluations on open
source software. Well, guess what?
The cybersecurity ferry may have been invented.
It's, it's these tools. And are they economical to run
today on every open source tool? Probably not.
Can we see a future that's not far off where they are?
Absolutely, yes. And do we have a future where we
can help accelerate writing the code to fix the vulnerabilities?
Also yes. So I think there's a very good
possibility the the good guys here will be the good guys and
gals will be OK. There's going to be a lot of
work to do and it's going to be in on a very accelerated
timeline where we're going to need to work fast and with a
sense of purpose and a sense of urgency.
And if you work in corporate America, you are sick of sense
of urgency because you, everything's urgent,
everything's now, this will actually be something that has a
true sense of urgency and actually does impact the world.
This isn't some, you know, oh, we got a fire here and it's, you
know, some manager needs a spreadsheet.
Like it's not a real fire. This will actually be that.
And that's kind of exciting too. Like I, I know a lot of us got
into this business to make a difference and we're going to
have a chance to do that in a big, big way in the near future.
So I think that's exciting. That's the bull view, the
bullish view on what's lies ahead.
But we're really good note from Marcus here.
Yeah, I think what you were saying in the beginning was a
point that I made when we talked about Mythos the first time was
it's being released in this project, right?
Swear glass wing, I think it's called where 40, you know, top
organizations have access to it to test it and run it.
And Microsoft, our employer is one of them.
So in all of these major companies, so I'm sure Apple and
Google also have access to it and they're going to they all,
every one of those companies use open source software somewhere.
And so I would assume as part of that exercise in testing that
they would also run it on at least the open source software
that they're using and so that the more commonly used ones
across the board would get it. I just read an article on how
Mythos is is helping with Mozilla and Firefox.
It found something like 270 some bugs in the latest version of
Firefox. And so it's it's something that
these vulnerabilities were not identified by fuzzers or human
red teamers. So AI was just able to find, you
know, 270 some plus bugs and AI flag 22 of them as security
sensitive. So I do think you're right, like
this will be a little bit of short term pain as we're kind of
fixing and implementing all these fixes and patches.
But in the long term, this is definitely A plus for security.
I just think that in general, a lot of organizations don't have
an idea of what open source they're using, and so be very
cautious of what you're using because attackers have access to
these tools too, and they're probably scanning a lot of the
common ones as well, finding bugs and using them for their
own nefarious. Purposes 100% and you're right.
You know when when Microsoft, Apple and Google all got their
hands on this software, you know, job one was run it against
the Windows code base or run it against the Mac OS code base or
run it against Android. Job 2 was OK.
Now run it against everything that we we import into those
code bases, any third party code, we leverage our libraries
and go scan all those. And that has already happened.
And by the way, again, you know, just to close it out here, our
employer, Microsoft did their April monthly Patch Tuesday
couple a week or two ago. And it was relatively large, one
of the larger ones in a while. And so there was again, kind of
some FUD on Z. That's this is they found all
these in mythos and they fixed all these.
And it's like actually, if you go look, April is typically one
of the largest patch Tuesdays. That's just very normal.
So it's actually very historical and cyclical.
And it's it's actually not abnormal at all for a typical
April cycle because by the way, total side note, Windows hot
patch, you don't need to reboot your Windows systems every month
anymore. They can go without reboots
every two out of three months now.
So February and March are non reboot months.
If you have Windows hot patch enabled, the operating system
just patches on the fly and keeps running, no restart
required. April is a restart required
month. So that also is now a thing
we're seeing where on those months that are restart months.
So January, April, July, October are all larger patches now as a
result of it. So you know, I'm sure and by and
by the way, Andy and I totally do not have access to Mythos,
have not touched it or anything that is definitely above our pay
grade, but it's definitely that that is happening.
So I think both closed source and open source is benefiting
and we'll see that trickle down effect for sure.
All right, well, that's our show for this week.
Thanks for watching and listening.
As always, our contact information will be in the show
notes if you have any questions or topics you want us to talk
about in the future, along with the links to the stories that we
used for the show today. So go ahead and click those if
you want to read them. Thanks and we'll talk to you
guys next week. Thank you for listening to the
Blue Security Podcast. Please check out the show notes,
catch up on episodes you may have missed, and subscribe so
you don't miss any future episodes.
Find Andy on Twitter at a Jaw Zero and Adam at AJ Brewer.
See you at our next episode.