Hello and welcome to the Decipher podcast.
I'm Dennis Fisher here with Lindsay O'Donnell Welch.
Lindsay, it has been an absolutely bananas week in the,
in the cybersecurity world. Like we were just chatting
before this and we've been texting back and forth for the
last couple days trying to decide what to talk about on
this podcast. And we kept like just saying, I,
I need this stuff to all slow down.
Like I, I just like, I need everybody to chill for a minute,
like cut it out. Yeah, unfortunately that's not
how it works. It's not.
No, we know that very well. Unfortunately.
It's I, we just recorded a podcast 2 days ago about the
Axios compromise. And there's, we're going to talk
about the continued fallout from that and some of the probably
long term effects from it. And also some of the, you know,
very predictable think pieces that I've seen from people think
pieces in the right word, but people, you know, venting on
various social media platforms about, you know, supply chain
security and open source security and those kind of
things, which are, you know, we, we could have seen that coming.
Yeah, I know it it. I feel like when we think about
the Axios NPM issue, there's a lot that goes into that.
But I guess just to start, we can talk about the updates since
we last talked about this whenever Wednesday or whenever
that was Tuesday. And since we last talked about
it, I think you updated the article on the Decipher website.
But a couple researchers have come out and attributed this to
North Korea linked actors, which we did briefly talk about last
time. But I think there's a little
more of an understanding now that about kind of what the
motivations are of these threat actors based on research that
I've seen from Elastic Microsoft, I think there was one
or two other researcher. Google.
Analysis that came out Oh yeah, Google Mandiant, yeah.
So that, you know, that's kind of the the big development
that's that's come out of this. Yeah, it definitely is that I
think Google refers to this group is UNK 1069, which is, you
know, UNK in their nomenclature is just an uncategorized Group,
One that they haven't sort of graduated to the formal, you
know, naming conventions that they have.
But it's a financially motivated threat actor from North Korea.
As we sort of speculated about in the last episode where we
were saying, you know, there was some talk out there at that
point that this is, this looked like it was North Korea based on
some of the malware that was used and some of the coding
artifacts, which is one of the things that Google talked about
in their analysis. They named the back door that
this intrusion used as Wave Shaper version 2, which is a
descendant, as you might imagine from the name of Wave Shaper,
which you know, they, they have tied to this group.
So that's kind of the main way that they tied this intrusion to
that 1069 group and they have a whole deep analysis of the
malware itself, the back door, how it works, all the all the
capabilities and all that kind of stuff.
So it seems pretty solid from from everything that I've read
so far. Yeah.
And there was another unique aspect of it as well that I
think we were texting about earlier.
But the the fact that I think it was ACNN article came out
talking about how the end goal for this appears to be
cryptocurrency, which you know, as as we know about North Korea,
you know, that makes sense. That's kind of the at the heart
of all of their intrusion that we've seen.
And I mean, it's a little different from crypto mining,
which we had been discussing earlier.
Yeah, this is like, it appears like maybe going straight to the
source, which is like crypto firms or whatever.
But it that certainly makes sense knowing, you know, kind of
what we know about North Korea and their TTPS and everything
else. It definitely does if for people
that aren't completely familiar with the way that these things
operate. The last, I don't know, 10
years, 12 years, North Korean threat actors, you know, those
that are directly working for the state government, as well as
some that I assume are contractors and private sector
threat groups, have been just essentially funding the North
Korean military and missile programs through cryptocurrency
thefts. And on a large scale, you know,
some that you've heard of, some that you probably haven't, there
are numerous examples of this. You can go and you can go and
find them very easily. And some of these have been in
the hundreds of millions of dollars.
So also some hard currency thefts, not just cryptocurrency,
some actual money instead of no magic Internet money.
But they're it's not a stretch to say that they are funding
part of their common economy with this kind of activity.
You know, that's what these threat intelligence teams have
found. You know, our, the US government
has indicted several actors as part of this, sanctioned some of
these groups that that stuff doesn't have a real effect on
them, as you can tell. But yeah, I mean, this, this
makes sense. Just imagine, had this, had the
window of exposure for this been more than the two to three hours
that it seems like it was for these two malicious packages.
Had this been not noticed for say 36 hours or a couple of
days, imagine what the potential damage could have been from
that. You know, it, it, it kind of,
it's kind of mind boggling what what may have happened.
Yeah, I know. Definitely.
And you know, I think that the whole North Korean piece of this
that you know, kind of, as you've mentioned that this is
really how in a, in a sense they are powering their economy like
that is fascinating to me. I think, you know, I, I'm
curious if there's any sort of any books about that or, or
whatever, because I'm sure if there, it's, there is a whole
other level and dimension to that and it's just insane.
Yeah, I, I don't know that anybody has read or written a
not specifically about them. I think, you know, the the books
that like some of the folks we know, like, you know, Andy
Greenberg and Kim Zetter and other folks have have written,
have more focused on other. Yeah, more on like the Russian
side of things as opposed to the North Korean aspect of it.
I think for various reasons, like there's just not that much
known about the way that North Korea operates.
You know, there. Yeah, there just isn't.
We don't really know what's happening there.
And that's by design, obviously. But, you know, we know far more
about the way that Russian threat groups operate and
probably even Chinese as closely as as these researchers track
the North Korean threat groups. We don't have like the at least
not that I've seen them. They may exist privately.
The sort of, you know, social graph and breakdown of how all
these units are tied together. The way that you, you can find
those for, you know, Chinese threat groups and Russian threat
groups and that sort of thing. Probably for US, honestly.
But I, I've never seen one of those for DPRK.
They they may exist, but I've never seen one.
Yeah, I know there's kind of a weird, you know, mystery around,
you know, I know there's like Lazarus and subgroups and all of
that, but it's it's hard to know.
And then also just the, you know, the fake job interviews,
like, Oh my God, cryptocurrency and fake job interviews right
now, those are kind of the two big things that North Korean
threat actors are that we're seeing with them.
And both of those things are just, again, it's, it's
fascinating to me because it's working at such a wide scale.
And you look at something like this attack and this is
absolutely working for them as well.
And so, you know, they're looking for the ways that they
can kind of sneak into organizations or try to get
those credentials. And with that end goal, that
financial end goal, and it's, you know, they seem to be
successful at a wide scale. It's crazy.
I mean, the, the sort of axiom that you hear now that attackers
don't break in, they log in, you know, which is a very simplistic
way of, of saying that a lot of these really successful attacks
do use, you know, people on the inside, either voluntary,
voluntarily or involuntarily. Like whether they're, they were
placed there through one of those, you know, insider
schemes, the, the fake IT workers or, you know, however
you want to turn that thing or they're just stolen credentials
that, you know, are being used for, for various attacks.
But these kind of the supply chain attacks like the Axios one
and the, and the team PCP ones that we've seen over the last
few weeks, it's weird that they're all clustered together
like this, but these things happen all the time.
You know, the, the supply chain attacks are have turned out to
be incredibly effective ways for for threat actors to get access
to high value, you know, organizations and accounts over
time. You know, we've seen it time and
time again. Yeah, definitely.
The other thing I wanted to mention too, just another like
kind of smaller update from when we last talked about this news
item, but the maintainer of Axios kind of came out and did a
little bit of a breakdown of what had happened further.
And I know last time we talked a little bit about the fact that,
you know, it seems like his you mentioned there was a compromise
and I think you said his his codes have been somehow accessed
or something like that. Two factor backup codes 2.
Factor backup codes. So he came out and essentially
said like the gist of it was was that he someone had gained his
trust as someone they basically pretended to be someone who was
interested in working or partnering together on open
source is what he said. And I know I talked about the XC
back door last time. Like this seems again very
similar to that, which is if you remember, in that case, there
was a maintainer who was feeling overwhelmed because these these
projects, like a lot of the times are come down to like, you
know, like one person in a lot of cases and looking for help,
maybe looking to partner with someone, looking for support and
then threat actors taking advantage of that and kind of
slipping in as through social engineering or whatever.
So I don't, you know, based on this, I still don't understand
fully the initial access vector. Like I couldn't really
understand it from this explanation, but like it sounds
like that was an interesting part of.
Yeah. The kind of how this attack
played out from the beginning. Yeah, it's a very old school
social engineering tactic to sort of gain the the targets
trust, you know, that this person appeared to like express
interest and be, you know, helping with this project,
becoming a contributor, contributor or maybe even a
maintainer. And it it's not clear from his
post like what period of time this took place over, but it,
and he doesn't say specifically like I gave them access to my
maintainer account. It doesn't sound like that to
me. It sounds like in, in one way or
another, they were able to kind of weasel some access to his,
you know, MPM and GitHub accounts and then locked him
out, like changed the e-mail address and locked him out so
that they could, they could do this.
And it's very clear from the various analysis that I've read
that this is a, you know, a very well planned and, you know,
tightly executed attack. It was not a haphazard thing.
And this just backs that up. Yeah, Yeah, definitely.
So yeah, that was the other kind of new development there.
It's, it's like depressing the way that we talked about it in
the last episode of like all these open source projects, you
know, people start them as, you know, kind of a hobby or a side
project or something like that. Or because they want to do
something good and help, you know, help the ecosystem or
something along those lines. And then something like this
happens and they're, you know, they're spending their spare
time doing this and, you know, responding to bug reports and,
you know, feature requests and all that kind of thing.
And in that post that you mentioned Lens, he you know, at
the end of it, he says it's sad to me that zero trust can be not
zero trust architecture, but zero as in no trust can be put
in people as my only objective is to create useful things with
code. But it seems like the world is
strongly against that with someone trying to steal, slash,
exploit something at every corner.
That's so sad. Yeah, I know.
It's like. Yeah, this, this guy, this
person is clearly just trying to, like you said, like this is
something that they're doing, you know, as a free service to
the world. Because they wanted to do
something cool that they thought was, you know, interesting and
might might, you know, be useful to other people.
And it's one of those things like you, like we know people
who, you know, have developed open source tools or given
things away like that. And people just end up like
shouting at them. Like, why didn't you do it this
way? Or why didn't you add this
feature that I emailed you about like 9 months ago or, you know,
things like that. People, we can't have nice
things. Like people just can't be
grateful. You know, they just have to, I
don't know, it's, it does just, it's a little depressing when
you see that, you know? 'Cause, you know, and you know,
I know there was a lot of discussion about this like 2 or
so years ago and like I think the OSS Foundation or something
like came out and said like we here's what we need.
Like, you know, all we need more support from the companies that
are, you know, reaping the benefits of these sorts of
projects. I really haven't seen anything
since then. I mean, maybe I'm just have
been, you know, there hasn't been any big announcements, but
I'd be curious to talk to, you know, either maintainers or like
people in the open source community and see what's going
on and if. I haven't seen much.
Yeah, there's been a bunch of efforts like that over the
years. And it always happens after
something like this where there's a lot of attention on
it. And then all of a sudden
everybody's like, well, oh, why didn't you have this security
feature? Why didn't you do this?
And he, this maintainer says in his message, he's like, you
know, I'm not totally versed in security.
I didn't, I, I didn't realize that I needed to have MFA on
every single account and this and that, which is completely
understandable. Yeah.
He's just trying to write a cool software tool.
And yeah, the, the whole open source security, the problem is
that there's no funding for that like that.
And that's what the OSSF was trying to do was like get some
money together and then give stipends to some of these like
load bearing projects that could, you know, actually do
something with that money, like hire a full time developer or a
part time developer to do code audits or add some different
security features. And you know, I think the thing
that you mentioned would came out after happened after log 4 J
if I remember right. I think that was like the
inciting incident. They all kind of run together.
But yeah, it's there have been various effort attempts at this
over the years. And some of them, you know, more
realistic than others. But you do see people sometimes
yelling at large software vendors who incorporate a lot of
open source software into their products to to hey, throw some
money at this. You know, you benefit from this,
give some funding to this. And I know that some of them do.
And, you know, some of them trumpeted, some of them don't.
So you don't always hear that, you know, say Microsoft or you
know, Cisco or Google or whoever gave 200 grand to very, you
know, to some project, but it's, it's not nearly as common as it
should be. Right.
Yeah, that's, it's unfortunate. It's, it's also hard though.
It's a hard business. It's a hard model.
The way it's set up is not, you know, it's not going to work
itself out, I guess in an easy manner, just operationally so,
yeah. No, I mean.
It as well. Commercial software vendors with
huge development and QA and security teams have a hard time
securing their own products. So in defending against account
takeovers and source code depth and things like that.
So individual maintainers who are doing this as a side project
and aren't, you know, kind of don't stand a chance against
somebody on the level of a North Korean state actor.
You know, what can you do in the face of that?
Yeah, just. Hold on and hope for the best,
and that's not really a strategy.
Yeah. True.
Unfortunately, yeah. So the other thing that I wanted
to talk about with you is kind, I mean it's a little bit
related, but we've talked a lot about AI in the last few months
as everybody has in various capacities.
And something that struck me both last week at RSA and even
this week it two things. One is just how insanely fast
this is all going in terms of how both threat actors are using
AI tools and how. Offensive vulnerability
researchers are using them as well to find bugs in, you know,
software targets. I you know, just in various
conversations with people last week at RSA, people both on like
the defender side and also on the vulnerability research side
were just talking about how they can't even really wrap their
arms around the speed with which things are changing.
Like almost on an hourly basis with how how much better and
more efficient some of these models are getting at finding
actual vulnerabilities and writing exploits for them at the
same time, which is something that people have been
predicting. Like that's one of the effects
of the broad availability of these tools that people have
been worried slash excited about in the security world is, oh,
we're going to be able to automate vulnerability discovery
and then that'll help us on the defensive side because we'll be
able to go patch all those bugs or whatever.
But there are two things happening. 1 is companies and
again, open source project maintainers are being absolutely
buried by bug reports, you know, in the like, up until very
recently, like within the last couple of months, those were
trapped Most of those were were slop, they were AI generated
junk that almost never included a real bug or something that
actually mattered if it was a reproducible bug, it was, you
know it was, it was noise. But in the last like month or
two, I've seen so many people saying, OK, now we're just
getting report after report after report of legit serious
slash critical bugs in our software slash project.
And you know, say, just take Axios for example, like somebody
that's a single maintainer or maybe part of a two person team,
If they just start getting inundated with valid bug reports
that were, you know, found by AI tools, you know, getting say,
even as few as like 6 or 8 a week, like no way they can
handle that. How can they triage those and
then go write patches for them and deploy the patches and all
that kind of stuff. And even some of our friends
that work at large commercial software vendors are having a
really hard time dealing with this.
And they have professional triage teams that do nothing but
this, and they're getting absolutely buried by these.
Yeah, I mean, this was already an issue even before AI, but now
AI has just made it explode like it's so much worse.
And I feel like I was listening to Casey Ellis, who with Bug
Crowd, who founded Bug Crowd, he was talking about, I think it
was at that Run Zero event that you talked at during RSA as
well. He's talking to Todd Beardsley
about how bug bounty's going to change in particular because of
AI and because of kind of this like influx of AI generated
reports. And he made a really good point,
which was basically that, you know, these AI is lowering the
barrier to be able to generate these reports and it's making it
faster and more effective. But then on the other side of
the coin, companies are still really bad at patching and
they're really bad at like, you know, responding to these
things. And there's still
vulnerabilities that exists that we that companies know about
that haven't been patched yet. So there's just that's, that's
kind of the, the biggest issue in all of this is that there's a
discrepancy between, you know, bad actors that want to use AI
tools to figure find vulnerabilities and even good
actors that want to disclose the vulnerabilities and the
companies that are able to not able to keep up with with
everything. Yeah.
I mean, one of the things that people that have thought very
deeply about this for the last, you know, say 2025 years, it
came to a conclusion, you know, years ago is there's essentially
an infinite supply of bugs in software.
You know, it's not, it's, it's inexhaustible.
You will, if you keep looking, you will keep finding bugs.
They, they may, there may be a limited supply of critical ones
or serious ones, but you will just keep finding bugs and
software for the obvious reason that it's written by humans and
humans make errors and blah, blah, blah.
But up until very recently, even with automated fuzzing tools and
things like that, there was kind of an upper limit on how many,
how many resources that say an individual, even a highly
skilled individual vulnerability researcher could, could, how
many bugs that person could find in a given amount of time.
You know, because then they they have to, they have to not only
find the bug, but make sure it's exploitable, possibly write an
exploit for it or send the crash dump along with the
vulnerability report to the vendor that the vendor might ask
them to write a patch for it, which happens more than you
would think, which is insane. And like go through this whole
process now with these AI tools, 99.9% of that is automated and
it's doing as good or better job than very high end, you know,
offensive security researchers and exploit devs can do on their
own. And these are, you know, folks
with 15 or 20 years of exploit development experience that make
very, very good money to do that.
And now we just have tools doing it.
You know, there was a two things I wanted to mention.
One is a, a post my friend Tom Taschek wrote that I think it
just came out on Monday. Yeah, it was Monday or maybe
Sunday called Vulnerability Research is Cooked.
And for people that don't know who Tom is, you, you can go read
his CV. He's one of the original
vulnerability researchers from the mid 90s, started a couple of
successful security companies. Montesano is one of those.
He's extremely well respected, one of the smartest people I've
ever met and thinks very deeply about these things.
And he writes like one blog post every six years.
So when he writes one, like people tend to pay attention to
it. And he essentially said what
I've been saying much less succinctly.
It's a good word to trip over. But he goes into much more
detail about why this is true, but essentially said, I think
this outcome is locked in. This is going to happen.
It's just a question of, you know, how quickly.
And we're seeing it right now. You know, there was a a
researcher who people might know named Tai Dong, who's a
Vietnamese security researcher, very well known, just, you know,
helped discover a couple of really serious TLS attacks back
in the day. He and his team used clawed to
find a full remote code execution exploit in BSD.
Like yes, I think they published it yesterday.
And they were like, this is what a very high end team would have
spent weeks or months doing just last year.
And now tada, you know, it's like it's getting spooky.
Like it's it's crazy fast. Yeah, that's, I feel like we
keep seeing the writing on the wall here a little bit.
And it's funny, you bring it like, you know, it's bad when
these really, really smart researchers are coming forward
and being like, this is, this is not good.
No, yeah. Yeah, I and I also, I, I was
going to talk about like this at unprompted, which is this
conference they had a couple weeks ago about specifically
about AI, which was an awesome, like they released the talks on
YouTube and it, it was a really, really interesting event.
But there was one session by Nicholas Carlini, who is a he's,
you know, really, really smart research scientist at Anthropic
and was basically, you know, saying the same thing, which is
just talking about how good LLMS are at creating vulnerability
reports right now. But what stuck out to me from
from that talk in particular is people then during the Q&A
session were saying, OK, So what do we do?
Like do we build safeguards? Like how do we deal with this?
And. Too late.
Yeah. And I think, you know, he was
like, we need to find a way to fix this.
Like we need to basically like we that we're going to need like
all the help that we can at this point to like be able to step up
and meet this, this challenge. But like I, I was trying to rack
my brain about how we could, how you know, when we actually enter
this era of like this, where in this situation and scenario that
you describe, like how we're going to be able to handle that.
And I really couldn't like there's no, there's no
safeguards. There's not really any way to
implement safeguards because this is something where threat
actors are going to be abusing legitimate tools similar to you
know what we do what we have right now with other many other
things, but just at a way faster and scarier scale.
And there's not any like rules or, you know, regulations or
anything when we're AI right now and how it's being used.
There's not even really any sort of, we don't have any rules
right now where if like someone uses AI to like make a statement
or write something or create code like at like it's just like
at the most basic level, like there's nothing that, you know,
there's no principle that is, you know, connected to AI.
So, yeah, I don't know. I think that's kind of the heart
of all this is we're just going into this and we don't have any
sort of standard set up for it. No, there's, there's none
whatsoever. I mean, we have historically a
terrible time trying to develop any kind of security standards
or even like societal norms around how to disclose
vulnerabilities. Like that's been going on for
literally 30 years. And there's still no like, broad
agreement on that. You still see people arguing on
Twitter about that like literally every day.
So no, I have absolutely no faith that this will be, you
know, that any of this will be contained in any sort of way
anytime soon. It's funny that that talk you
just mentioned, that's actually the vulnerability that those
researchers I just described developed the exploit for.
That They, that's the exact one that Ty and his team just said
to Claude, oh, here's this bug in BSD.
Write an exploit. 8 hours later, they had a fully functioning
exploit for it. Yeah.
So like, that's like weeks of work for, you know, smart people
with lots of experience. And now it's just, yeah, it's an
AI model. You know, I think right now the
only thing that's limiting this honestly might be money and how
much money researchers want to burn, you know, paying for AI
model time to, to do this kind of stuff like that.
That's not cheap. I mean, that's, I'm sure it'll
come down the way that everything does except for food
and gas and housing. But you know, but I'm sure that
model usage costs will, will stabilize or, you know, there
will be some, some sort of economic model that makes it
feasible for people to use them on an ongoing basis.
But that might be the only thing that's holding back, holding
this back from going absolutely, you know, straight up in terms
of the number of vulnerabilities and exploits that these things
are writing every day. Right, yeah.
The the other thing that I think about too is how this is going
to play out in real life. Like, are we just going to start
seeing an explosion of exploitation?
Like, is it going to be like, how is it going to look in three
months like? Oh God, I know.
Yeah, so 'cause we're seeing, we're seeing the efforts from
good, you know, from white hat, you know, researchers right now
and we're seeing through their research how easy this is.
But like, you know, the way that we're going to see this front in
terms of how how threat actors are going to use it to increased
exploitation is entirely different story.
Yeah, I think if we, you know, as you said, like sometime this
summer, if we're having a conversation like this, things
might be radically different already, you know, by mid June
or mid-july or something like or after Black Hat, who knows,
there could be the landscape could look completely different.
And we just, yeah, I haven't, I've asked that that question of
lots of researchers and security folks.
Nobody seems to have a, a really like, you know, solid answer
that they are 100% sure of because I don't think anybody's
sure of anything in this, in this world right now with AI.
But threat actors using AI tools to, you know, automate exploit
development is something that's obviously happening right now.
The exploitation I itself, I still feel like is probably for
the most part being done by individual operators just
because it, that takes some care and, and, you know, precision to
do that, but I don't know how long that'll that state of
affairs will last. And, you know, we, we talked
about on our last podcast, like the radio silence from Sisa on
that, that Axios compromise, as much as we've heard from
Washington about AI and none of which is like coherent really.
I haven't, I haven't really seen anything on this either like the
security implications of AI models or more of what we've
seen is, you know, the environmental impacts of AI
companies and that sort of thing and how they're destroying our
economy. But that's a whole other
discussion. But this kind of stuff, I
haven't seen really anything from senators, even the ones
that understand it. Like, I don't know, unless I'm,
I'm forgetting. I haven't, you know, I haven't
seen anything from like Ron Wyden or the folks that actually
understand what's going on. You know, obviously they have
their hands full with a war and other things.
But yeah. Yeah, that's a good point
though. And I I'm don't know why that
is. Maybe it's just not like a hot
political issue right now, but it's certainly.
It might just be that people don't know what to like, how to
talk about it. Like, because honestly, like
we've been saying for the last 20 minutes, it's just changing
so quickly. You know, you just, you really
can't get your arms around it at any point in time.
Yeah, I know. Like personally for me over the
past two years, the shift has been really interesting to see.
Just as someone in cybersecurity who's covering news too, is like
when, when AI, when we were first talking about AI like 2-3
years ago, I think at that point I was like rolling my eyes and I
was just like, this is just all hype.
No, no actual like substance in this and now like.
That was true then, by the way. Yes, Yeah, yeah, that's true
that. Was accurate.
And then like within the last year or like even six months,
like I feel like I was just like, oh, Oh, no, like.
Yeah. This not only has substance, but
like this is very, you know, there is some potentially really
bad use cases out of this. So yeah, it, you know, it's like
when you see the long range forecast and they're predicting,
you know, like 4 feet of snow or something, you're like, yeah,
they're always wrong. That never happens.
And then it gets closer and it gets closer.
You're like, oh, this is the Yep, it's going to happen.
That's a very New England. It is, yes.
Yeah, You can tell it. Yeah.
My psyche is still damaged from this past winter, but yeah,
yeah, you're right. I mean, the, our friend Gary
McGraw, who's the, the, the person I know who's thought the
most about AI and machine learning over the last because
he did his PhD on this in the the 90s.
So he very few people know more of thought more about this than
than Gary has. And, you know, even he is, I
think I haven't talked to him in the last couple weeks about
this, but even he, I think is kind of like amazed by how the,
you know, just the absolute uptick in craziness that's gone
on recently. Yeah, no, I was thinking, yeah,
we need to have Gary back on the podcast, like to have, you know,
I remember I think it was maybe like last year or the year
before you last talked to him or something.
But I would be really interested to hear what he has to say
specifically about how things have accelerated recently so.
Yeah, I'd have to roust him out of his semi retirement and his,
you know, his farm down by the river.
But yeah, he would do it. Yeah.
I I should call him. He's he's, he'll probably text
me. He has like superhuman powers to
know when somebody's talking about him.
But yeah, All right. The last thing I wanted to
mention is we are again sponsoring with our friends at
Material Security, their security theater event.
They've been doing a series of these.
They did one in San Francisco, one in New York and they're
doing one this coming Tuesday, April 7th in Austin, TX.
And the the movie this time is Hackers, which is one that we is
on our our list of hacker movie podcasts, one we're going to do
sometime soon. But these events are really
great. I'm I'm going to be in Austin
for this. I'm really excited about it.
So they show the movie and they do some movie trivia beforehand.
They have prizes. It's all like, you know, a bunch
of security nerds and movie nerds sitting around, you know,
kind of laughing at the absurdness of hackers and, and
just having a good time. So if you are in the Austin
area, I'd, I'd encourage you to register.
You can go to material dot security slash theatre or
material dot yeah, material dot security slash theatre and you
can find the registration there. It'll be a great time.
I'm going to bring some decipher swag with me.
So he he some of that away. I know that's.
Good. Yeah, that sounds really fun.
I 'cause we always, you know, we, we have our kind of hacker
movies that we do. But like, there's something
about sitting down with people who really appreciate hacker
movies and specifically hackers and watching it together and
then some cool trivia like that just sounds so fun.
I'm excited. I did not see this dumb movie in
theaters and I'm I'm talking about about it.
I I like this movie. It's fun.
It's completely ridiculous. There's a whole subset of the
security community that this is like, this is their movie, the
way that Like Sneakers is my generation's movie.
People, I don't know what it is about this movie.
Maybe it's, you know, it's kind of the campiness and like the
roller blades and the pagers and like the neon colors and all
that kind of shit. But some people just love this
movie so much. So.
Yeah, it'll be fun to see in the theater.
Should be great. That's.
Awesome. Yeah, and we do.
We are going to have a couple upcoming Hacker Movie podcast
episodes. We're going to have your
colleague John Hammond on one. We don't know exactly when
that's going to happen yet, but I saw him at blackout last week
and asked him if he wanted to do one of these with us.
And his immediate response was, do you know that movie Black
Hat? Yes, I do, John.
I sure, sure do. So we're going to do Black Hat
with Jon Hammond, which will be an absolute blast because that
movie is absurd too. Like the the one that the one
where Thor is a hacker is the way that somebody described that
to me, which I thought was just perfect.
That's that's a great description of it.
They should have just made that the tagline.
Honestly, yes, had they known how big the the MCU was going to
be, they because this came out sort of before all of that, but
yeah, that would have been that's retroactively.
They should do that just yeah, Thor as a hacker, yeah, but
yeah, so we'll do Black Hat pretty soon and we should do
hackers too. Get that going because that'll
that'll be a super fun one, especially after I go and sit
through it in the theater, which will be quite an experience.
Yeah, definitely. Yeah, we've got to run through
some more and to like any of our listeners too.
If, if anyone has any suggestions, we would love to
hear them. Be sure to comment on our maybe
our Twitter page or whatever to see for SEC.
Yeah, we would love to hear those 'cause we have our own
list. But I know that there's some
like people every once in awhile will mention a movie to me and I
watch an, an embarrassing number of movies.
But sometimes people just you know, mention oh, have you seen
this? I'm like, no, I've never even
heard of that. So there's a lot out there that,
you know, we probably haven't thought of.
So if you guys have like favourites that you'd like to
see from, you know, especially recently because I'm more on
like the 80s nineties scale and lens.
I think you're on more on like the 2000 scale.
But yeah, some of the more recent, like straight to
streaming ones that you and I have talked about, like Heart of
Stone, I think is one that we really need to do given the AI,
Oh my gosh, aspect of that movie.
I, I can't imagine that there's eight people listening to this
who know what Heart of Stone is. But somehow you and I both
watched it, I think like in the same week separately, like
whenever it came out last year or two years ago.
And whoa, is that movie terrible.
But it would be an entertaining podcast.
They do, yeah. I think there is like a sub, a
weird subset of AI movies that I think we need to also do.
Like what was the one? There was one who?
Let's see. Well, the last two Mission
Impossible movies are, yeah, centered around AI in a very
stupid way. Right, I know it's it's just
crazy there. There have been some other good
ones too. I'm blinky on the names, but
I'll find them. There's a lot there.
There's so many, especially in the the streaming era.
You can, you can find a bunch on like, you know, Amazon or
Netflix or two V or whatever and it'll just the thumbnail will
just be some person like in front of a transparent screen,
like you know, with their hands up and a bunch of like ones and
zeros or something. What's happening?
Yeah. I know there that was also
there's like a kind of a weird subplot in that House of
Dynamite movie that came out recently, which is more about
like a nuclear war. But there's some, you know,
cybery stuff in there. And also that horrific show that
came out last year, Zero Day. Oh, well, yeah, that was.
I couldn't finish that. Oh, it's so.
Bad. It's such good hopes for such
high hopes. God, it had Robert De Niro.
It had Robert De Niro. Yeah.
And it was like, I, I don't, I can't even calculate what
ungodly amount of money they must have paid him to do that.
Yeah. Whatever it was, I hope he had a
good time 'cause that was absolute garbage.
Oh, I know there was, there was this is interesting.
It wasn't so much AI mean. First of all, this is a
documentary and it wasn't like fiction like it was an actual
thing about actual events with some people that we know in it.
But had you heard of a most wanted teen hacker on HBO?
Yeah, I mean, that was I watched that during maternity leave.
That was kind of interesting to watch.
It was a four part series. And yeah, there were it.
It was one of those things where like I I like watching hacker
movies because they don't hit too close to home.
Like like you're just like, oh, like this is a feel good, like
culturally like significant movie.
And then I was watching this and I was just like, I remember
writing about that. I remember looking at that.
Like very much so, yeah. And then like you said, there's
just people that we know, like on screen you're like, oh God,
wait, I know her. Yeah, it's it's a little too
close to home. That is a good one, though.
That's. Yeah, that's kind of, yeah.
The true ones are a little bit like I tend not to like those as
much just because for the reason you just explained, like you
need some kind of escape, like I need to see the ones and zeros
flying through the air to make it, you know, unrealistic to to
put me at ease. Or you know, we were talking
about the pit a few weeks ago on here in the cyber aspects of
that which I don't. You're caught up right?
Like you've seen. OK, so they kind of forgot about
it for like a week. They just were like, OK, I mean,
which is plausible because the show is just hour by hour,
right? But this past episode I'm.
Just I'm laughing because I know exactly like you're going to
talk about. They just kind of were like they
said, OK, well, the other two hospitals paid the ransom, so
we're just going to bring our network back online and we feel
good about that. And a even if you pay the rent,
if those hospitals paid the ransom, good for them.
That does not mean that anything is coming back online anytime
soon over at those hospitals. Right.
And you bring your network back up.
If the hackers were in your network beforehand and you turn
it back on, guess what? Kaboom.
Like they're like, I don't know. That's funny too, because Nurse
Dana was like, she was like, she what did she call it?
She was like, the cyber conflict is over.
And I was like, it's not a conflict.
Like no. Hospitals were attacked.
What did she you screenshotted it?
You screenshotted it on Twitter? It was something about like
these cyber assholes or something.
Like this I was like that is perfect.
Yes, that's what it was. Yeah.
Yeah, right. But she did.
She was like the cyber conflict is over.
Like what's the conflict like? You guys just turned your power
off like I don't. But that was, you know what?
I give them props. That's realist.
Like, realistically how probably like someone who didn't
understand cybersecurity would talk about all these things,
like just being like, yeah, the cyber conflict, it's done and
we're all safe now. So yes, that's exactly right.
Those are the kind of, you know, calls and texts we get from,
like, our parents that are just like, I heard there's a cyber
war. Is that true?
I don't know. What are you talking about?
Be specific because probably which one?
Yeah, right. Exactly who?
Tell me who, which two parties you're talking about.
And I'll tell you what, if you're right.
Yeah. OK.
Well, that's been our movie and TV portion of the podcast.
So again, if you're in Austin, come see me and all the great
material security folks next Tuesday.
It's at the Alamo Draft House, which is, I've never actually
seen a movie in one of those. I'm excited.
It should be super cool. Like they have the awesome
reclining chairs and all that kind of stuff.
So beats the hell out of the movie theater at the mall that I
go to. Yeah, A. 100%.
Yeah, All right, Linds, great to see you.
You too. All right, talk to you soon.
Bye.