Hello, welcome to the Decipher podcast.
I'm Dennis Fisher. Welcome to our weekly news wrap
up edition of the podcast. Before we get started, here's
how you can get a hold of us. Obviously you're listening to
this podcast, so you know how to find that, but if you want to
send us an e-mail, you can get me at Dennis at decipher dot SC.
You can find us on social media at Decipher SEC.
That's our Twitter, our blue sky handle.
It's also our YouTube channel. You can find us there.
Most of our podcasts are also video podcasts now, aside from
these weekly news wrap episodes because you don't need to just
look at me staring into my laptop talking to you about
security stories on a on a Thursday evening or Friday
morning, whenever you're listening to this.
But the rest of our podcasts are up on our YouTube channel.
And we had one that went up this week early in the week, I think
it was Monday with Ryan Dewhurst from Watchtower, which is a
really cool conversation I had with Ryan.
We talked a lot about his background, how he got into
hacking and cybersecurity in general.
And also the work that Watchtower does kind of the, you
know, threat intelligence landscape as a whole, that whole
world. So it's, I'd encourage you to go
listen or watch to really fun conversation.
Ryan's a really smart and engaging guy.
So it was a lot of fun. And we have another podcast
coming. We're going to record it next
week. Not sure if we'll post it next
week, probably the week after. Hacker movie podcast.
Doing this with two of my good friends, Wade Baker and Rich
Mogul, and we are doing Star Wars.
That's right, Hacker Movie podcast about Star Wars.
Those two guys, Rich and Wade, both huge Star Wars fans.
I'm a Star Wars, appreciate her. I like Star Wars.
I'm not an obsessive like some folks in the security community
are. I've seen all the movies.
You know, I'm of the generation where the the original trilogy
was our kind of thing. You know, I saw those things in
the theater, so should be a fun one.
We had a few requests from people that were like, why don't
you guys do Star Wars? It's like the original Hacker
movie. And I thought about it a little
bit. I was like, yeah, you know what
kind of is? Let's do it.
So watch out for that one. I'll obviously let everybody
know on social media when that goes up, but it should be a
really fun one. Rich and Wade know a whole lot
about the whole Star Wars universe, so you might actually
learn something as well as being entertained.
So all right, let's dive into the news this week.
It was one of those weeks where, you know, it was Microsoft Patch
Tuesday, and also Apple released some pretty important security
updates. Start with the Microsoft
updates. You know, as usual, dozens and
dozens of patches from Microsoft across all of their product
lines. Windows, Windows Server, Office,
you know, you know the drill. But this was kind of an unusual
one because Microsoft patched 6 vulnerabilities that had been
actively exploited. 6 is a lot you guys like usually if there's
one or two in the Microsoft monthly updates, it gets some
attention. 6 is a whole lot. I can't recall that many in
recent memory. I'm I'm sure there have been six
in a month, but 6 is a ton. The total number of CVS patched
this month was 60, so 10% or you know, a little more than 60 CVS.
So almost 10% of the vulnerabilities have been
actively exploited in the wild. It's quite a lot.
We have all the details in the story that's up on the site
right now. You can go and look at that.
If you haven't looked through the the Microsoft updates and
advisories, you should do that for sure.
If you're a window shop, which I think everybody is, you don't
really have a lot of choice, but go have a look at those.
There are, you know, varying degrees of seriousness of the
vulnerabilities, but the fact that these six have all been
exploited tells you something. At least one of them, I think
maybe two were identified in conjunction with Google's threat
intelligence group, which tells you something.
A couple of them are elevation of privilege.
A couple of them are, you know, more serious than that.
So go have a look at those. The one that kind of stood out
to me was CBE 202621533, which is in the Windows Remote Desktop
Services feature. It's kind of an issue with the
privilege management and it was discovered by crowd strike
researchers, which also tells you something.
Those are the ones you want to pay attention to.
It does require authorization, but obviously there are ways to
go about gaining that authorization on a Windows
system. So the fact that crowd strike
researchers reported this tells you that it may have been, you
know, seen in in IR engagement or another incident that they're
aware of. So that's something you should
definitely pay attention to. I encourage you to go read our
story as well as the the Microsoft advisories themselves.
They, you know, the Microsoft bulletins over time have giving
you less and less information about what's actually going on.
You will get the indication that something has been exploited and
that Microsoft is aware of the exploitation, but you don't
really get any more context in that.
You essentially have to go and look at third party resources to
go and find that out. Find out what the context is,
how it's been used, how often it's been used, in what ways,
against what kind of targets. You know, in some cases, I'd say
in a lot of cases, the exploitation that's detected in
these in these cases is usually targeted.
You, you will often see them say, you know, very limited
cases or highly targeted or some kind of language like that, that
gives you an indication that these were used in possibly just
one or maybe just a handful of targeted attacks against
specific victims. So, you know, that's not
nothing, but it does give you some indication that, OK, this
is not mass exploitation. It's not being used by, you
know, every cybercrime group on Earth.
It's not, you know, thrown into some exploit kit yet.
So you may have a little time there.
But you know, in any case, you want to pay attention to any
exploited vulnerabilities in the wild from Microsoft.
So along those same lines, Apple released all their semi regular
security updates this week as well.
They patched dozens of vulnerabilities in Mac OS, iOS,
Watch OS, the iPad OS, all the various OSS.
And the one vulnerability that sticks out there is one that has
been exploited in the wild. Also in what you know, Apple
describes as an extremely sophisticated attack in scare
quotes there against specific targeted individuals, plural, on
versions of iOS before 26. OK, so the new version that just
came out is 26.3, you know, a a point release, but a pretty
major one in terms of security content.
This specific vulnerability has been in iOS for a very long
time. So it's in many, many versions
of iOS. Most people I think are, you
know, you would not unless you have like an old phone that
you're using for some specific task or whatever, an old iPad
that you're keeping alive for whatever reason.
Most people are on relatively modern versions of iOS.
You're not worried about how long it's been there, but the
point is that this has been used in targeted attacks.
It sounds like you know a relatively small number of them,
but when Apple discloses these, this kind of exploitation, a
lot, I would say I don't know. Probably most of the time these
bugs are ones that have been seen by threat intelligence
groups used in targeted attacks by the commercial spy Ware
vendors. So think about the the vendors
that sell, you know, something like, you know, the commercial
spy Ware that's used against activists, journalists,
dissidents, all those types of groups that are typically at
risk from commercial spy Ware vendors and their customers.
A lot of times these especially iOS bugs that you see termed
extremely sophisticated, used in extremely sophisticated attacks.
That's where they're identified. Those are the highly complex.
And yeah, I mean, the word sophisticated is beaten into the
ground in this industry. But in some cases, it's
apartment, these kind of exploit chains that take, you know, a
lot of time, a lot of development resources, resources
and a ton of money to develop. Those are the ones that end up
as zero days in these commercial spyware products that are used
to target, you know, the groups I mentioned, journalist
dissidents at risk groups around the world.
So if you want more information on how that whole ecosystem
works, you should go look at the work that the Citizen Lab does
up in Canada. They are the preeminent research
group that is tracking the way that the commercial spyware
ecosystem works and the kind of vulnerabilities that they're
they're developing and putting into their products.
It's a really, we've talked about it before on this podcast.
It's a really concerning and kind of gross ecosystem, even on
the surface. The farther you dig into it, the
the worse you will feel about the world.
So I don't know if you want to do that on a, you know, on a
bleak winter day, but those are the kinds of bugs, this these
kind of Apple iOS bugs and sometimes Android bugs that are
extremely valuable to those types of groups.
And in this case, this bug was reported to Apple by Google's
threat analysis group. That group is the team at Google
that specifically tracks advanced threat actors, and that
word advanced is doing a lot of work there.
But what they're trying to do is keep an eye on the top level
threat actors out there. You can think about APT teams,
state backed groups, state aligned groups, and the people
that are using commercial spyware products.
So that gives you another indication, some more context
around where this this bug came from.
So that's that's another one you want to dig into.
If your organization, you know, deploys iOS devices, Mac OS
devices, that bug was also in Mac OS, but it has not been
exploited against Mac OS as far as Apple, you know, has has said
it's only been exploited against iOS.
So that gives you a little more context, but it's this
definitely seems like like one of those point updates that you
want to you want to install as soon as possible, especially on
iOS devices. So let's pivot a little bit to
something, you know, a little different.
If you listen to this podcast regularly, you know that we, me
specifically love movies and TV shows, especially ones that have
something to do with the hacker scene.
Depending on your age, you might be aware of a show called CSI
Cyber. That was around about 10 years
ago. And I bring this up because one
of the actors in that that show, James Van Der Beek, passed away
this week, you know, very sad in a battle with cancer.
And I was, he was, you know, obviously well known for
Dawson's Creek. I didn't, I never watched that
show. But you know, he's been in a
bunch of movies. Varsity Blues, probably the most
famous one, but he was in the show CSI Cyber, which was a a
spin off from the normal CSI mothership.
And when the show came out, I was at threat post with a bunch
of my friends and we decided to watch the first episode of the
show, which I think came out in 2015.
And we did like this running diary.
It was four of us that basically we kept a chat log of how how
this show went and how silly it was.
I'll try and find it and post it.
It's it's pretty entertaining. I have to say.
The show came on at 10:00 on like a Thursday night.
So we, it was just four of us like up late watching this
goofiness and, you know, talking about it.
But the real reason I bring this up is because there's two,
there's an episode of season 2 called Gone in Six Seconds that
aired in November of 2015. And two of my friends, Charlie
Miller and Chris Valasek, who are, you know, very well known
security researchers, obviously most well known for their
research against against on cars, you know, automotive
security systems. They've both done tons and tons
of other stuff in their careers. Go look at Charlie's Apple
security research. He was a pioneer in that in that
world. Chris has done all kinds of
crazy stuff too. But they had a cameo on this
episode called Gone in Six Seconds that, you know, had a
car hacking storyline. And it was kind of a big deal in
the security community when this happened.
Like Charlie and Chris were posting, you know, photos from
the the set with some of the actors.
I don't remember one with Van der Beek specifically.
I do remember one with Shad Moss or one of the other actors.
I'll try and find that as well. But it's a pretty entertaining.
They they have a very small cameo, but if you know those
guys, you can see them in the background.
You can kind of see the sardonic smiles on their faces.
It's I don't know where you'd be able to find it at this point.
I think it might be on Amazon, but you might have to pay to go
watch this. It would probably be worth it.
You might be able to find a just that clip on YouTube somewhere.
But CSI cyber is an artifact from a time when the movie and
TV industry was sort of, you know, obviously there's been
like hacker movies like hackers and sneakers and whatever.
But this was a time when they were trying to sort of weave
cybersecurity and hacking into other shows in this very odd and
often like completely ridiculous way.
Especially. I mean, I don't know that I ever
watched more than two. I watched the first episode of
the show and I watched the one that Charlie and Chris Chris
were on just because I know those guys and it was funny.
I don't think I ever watched any more episodes of it.
It was only on for two seasons, but it was pretty funny in the
premiere. I think they it centers on
somebody hacking a baby monitor, which is a thing that happened.
Like there's been research on those.
It's kind of silly at this point, but that's what the
premier centered on or at least part of it.
So it's pretty entertaining. If you are looking for something
completely ridiculous and fun to watch at some point, dig into
some CSI Cyber. You don't really need to know
any of the storylines or anything, but if you can find
that episode, it's gone in six seconds.
It aired on November 8th, 2015 and you will have a good time.
I promise you, you'll you'll get a few laughs out of it.
So that was just the random pop culture corner for this week.
So hope that brought you a little little fun.
So thanks everybody for listening and I'll talk to you
again next week and keep an eye out for the Tar Wars hacker
episode. That'll be U soon.
Take care.