1 00:00:13,160 --> 00:00:15,320 Hello and welcome to the Decipher podcast. 2 00:00:15,320 --> 00:00:17,880 I'm Dennis Fisher here with Lindsay O'Donnell Welch. 3 00:00:18,320 --> 00:00:21,200 Lindsay, it has been an absolutely bananas week in the, 4 00:00:21,640 --> 00:00:26,160 in the cybersecurity world. Like we were just chatting 5 00:00:26,160 --> 00:00:28,520 before this and we've been texting back and forth for the 6 00:00:28,520 --> 00:00:30,560 last couple days trying to decide what to talk about on 7 00:00:30,560 --> 00:00:34,920 this podcast. And we kept like just saying, I, 8 00:00:35,080 --> 00:00:36,440 I need this stuff to all slow down. 9 00:00:36,440 --> 00:00:39,560 Like I, I just like, I need everybody to chill for a minute, 10 00:00:39,640 --> 00:00:42,440 like cut it out. Yeah, unfortunately that's not 11 00:00:42,440 --> 00:00:44,000 how it works. It's not. 12 00:00:44,320 --> 00:00:48,560 No, we know that very well. Unfortunately. 13 00:00:48,560 --> 00:00:54,720 It's I, we just recorded a podcast 2 days ago about the 14 00:00:54,720 --> 00:00:59,720 Axios compromise. And there's, we're going to talk 15 00:00:59,720 --> 00:01:05,080 about the continued fallout from that and some of the probably 16 00:01:05,080 --> 00:01:08,200 long term effects from it. And also some of the, you know, 17 00:01:08,800 --> 00:01:12,840 very predictable think pieces that I've seen from people think 18 00:01:12,840 --> 00:01:16,840 pieces in the right word, but people, you know, venting on 19 00:01:17,240 --> 00:01:21,440 various social media platforms about, you know, supply chain 20 00:01:21,440 --> 00:01:23,360 security and open source security and those kind of 21 00:01:23,360 --> 00:01:26,600 things, which are, you know, we, we could have seen that coming. 22 00:01:27,200 --> 00:01:31,240 Yeah, I know it it. I feel like when we think about 23 00:01:31,240 --> 00:01:36,320 the Axios NPM issue, there's a lot that goes into that. 24 00:01:36,320 --> 00:01:39,880 But I guess just to start, we can talk about the updates since 25 00:01:39,880 --> 00:01:42,800 we last talked about this whenever Wednesday or whenever 26 00:01:42,800 --> 00:01:47,920 that was Tuesday. And since we last talked about 27 00:01:47,920 --> 00:01:51,480 it, I think you updated the article on the Decipher website. 28 00:01:51,480 --> 00:01:56,000 But a couple researchers have come out and attributed this to 29 00:01:57,360 --> 00:02:01,640 North Korea linked actors, which we did briefly talk about last 30 00:02:01,640 --> 00:02:03,480 time. But I think there's a little 31 00:02:03,480 --> 00:02:08,560 more of an understanding now that about kind of what the 32 00:02:08,560 --> 00:02:12,080 motivations are of these threat actors based on research that 33 00:02:12,080 --> 00:02:17,680 I've seen from Elastic Microsoft, I think there was one 34 00:02:17,680 --> 00:02:20,200 or two other researcher. Google. 35 00:02:20,200 --> 00:02:23,120 Analysis that came out Oh yeah, Google Mandiant, yeah. 36 00:02:23,760 --> 00:02:27,200 So that, you know, that's kind of the the big development 37 00:02:27,520 --> 00:02:31,080 that's that's come out of this. Yeah, it definitely is that I 38 00:02:31,080 --> 00:02:35,280 think Google refers to this group is UNK 1069, which is, you 39 00:02:35,320 --> 00:02:40,240 know, UNK in their nomenclature is just an uncategorized Group, 40 00:02:40,240 --> 00:02:45,720 One that they haven't sort of graduated to the formal, you 41 00:02:45,720 --> 00:02:48,160 know, naming conventions that they have. 42 00:02:48,640 --> 00:02:53,240 But it's a financially motivated threat actor from North Korea. 43 00:02:53,720 --> 00:02:57,920 As we sort of speculated about in the last episode where we 44 00:02:57,920 --> 00:03:01,840 were saying, you know, there was some talk out there at that 45 00:03:01,840 --> 00:03:05,120 point that this is, this looked like it was North Korea based on 46 00:03:05,120 --> 00:03:07,200 some of the malware that was used and some of the coding 47 00:03:07,200 --> 00:03:10,320 artifacts, which is one of the things that Google talked about 48 00:03:10,320 --> 00:03:17,680 in their analysis. They named the back door that 49 00:03:18,320 --> 00:03:24,320 this intrusion used as Wave Shaper version 2, which is a 50 00:03:24,320 --> 00:03:28,280 descendant, as you might imagine from the name of Wave Shaper, 51 00:03:28,960 --> 00:03:31,920 which you know, they, they have tied to this group. 52 00:03:31,920 --> 00:03:36,920 So that's kind of the main way that they tied this intrusion to 53 00:03:36,920 --> 00:03:42,520 that 1069 group and they have a whole deep analysis of the 54 00:03:42,520 --> 00:03:46,000 malware itself, the back door, how it works, all the all the 55 00:03:46,000 --> 00:03:47,720 capabilities and all that kind of stuff. 56 00:03:47,720 --> 00:03:52,640 So it seems pretty solid from from everything that I've read 57 00:03:52,640 --> 00:03:54,440 so far. Yeah. 58 00:03:54,680 --> 00:03:58,560 And there was another unique aspect of it as well that I 59 00:03:58,560 --> 00:04:00,560 think we were texting about earlier. 60 00:04:00,560 --> 00:04:05,320 But the the fact that I think it was ACNN article came out 61 00:04:05,520 --> 00:04:10,200 talking about how the end goal for this appears to be 62 00:04:10,200 --> 00:04:15,800 cryptocurrency, which you know, as as we know about North Korea, 63 00:04:16,360 --> 00:04:19,440 you know, that makes sense. That's kind of the at the heart 64 00:04:19,440 --> 00:04:21,880 of all of their intrusion that we've seen. 65 00:04:21,880 --> 00:04:24,760 And I mean, it's a little different from crypto mining, 66 00:04:24,760 --> 00:04:26,120 which we had been discussing earlier. 67 00:04:26,360 --> 00:04:30,200 Yeah, this is like, it appears like maybe going straight to the 68 00:04:30,200 --> 00:04:32,880 source, which is like crypto firms or whatever. 69 00:04:33,960 --> 00:04:37,560 But it that certainly makes sense knowing, you know, kind of 70 00:04:37,560 --> 00:04:40,640 what we know about North Korea and their TTPS and everything 71 00:04:40,640 --> 00:04:43,600 else. It definitely does if for people 72 00:04:43,600 --> 00:04:47,240 that aren't completely familiar with the way that these things 73 00:04:47,240 --> 00:04:51,840 operate. The last, I don't know, 10 74 00:04:51,840 --> 00:04:56,400 years, 12 years, North Korean threat actors, you know, those 75 00:04:56,680 --> 00:05:00,160 that are directly working for the state government, as well as 76 00:05:00,240 --> 00:05:02,960 some that I assume are contractors and private sector 77 00:05:03,680 --> 00:05:09,440 threat groups, have been just essentially funding the North 78 00:05:09,440 --> 00:05:12,720 Korean military and missile programs through cryptocurrency 79 00:05:12,720 --> 00:05:16,240 thefts. And on a large scale, you know, 80 00:05:16,400 --> 00:05:20,680 some that you've heard of, some that you probably haven't, there 81 00:05:20,680 --> 00:05:24,280 are numerous examples of this. You can go and you can go and 82 00:05:24,280 --> 00:05:29,680 find them very easily. And some of these have been in 83 00:05:29,680 --> 00:05:31,560 the hundreds of millions of dollars. 84 00:05:32,520 --> 00:05:36,040 So also some hard currency thefts, not just cryptocurrency, 85 00:05:36,040 --> 00:05:39,360 some actual money instead of no magic Internet money. 86 00:05:39,800 --> 00:05:45,160 But they're it's not a stretch to say that they are funding 87 00:05:45,240 --> 00:05:48,800 part of their common economy with this kind of activity. 88 00:05:49,400 --> 00:05:51,720 You know, that's what these threat intelligence teams have 89 00:05:51,720 --> 00:05:54,760 found. You know, our, the US government 90 00:05:54,760 --> 00:06:00,800 has indicted several actors as part of this, sanctioned some of 91 00:06:00,800 --> 00:06:03,120 these groups that that stuff doesn't have a real effect on 92 00:06:03,120 --> 00:06:06,480 them, as you can tell. But yeah, I mean, this, this 93 00:06:06,480 --> 00:06:09,600 makes sense. Just imagine, had this, had the 94 00:06:09,600 --> 00:06:14,000 window of exposure for this been more than the two to three hours 95 00:06:14,000 --> 00:06:17,360 that it seems like it was for these two malicious packages. 96 00:06:18,120 --> 00:06:23,160 Had this been not noticed for say 36 hours or a couple of 97 00:06:23,160 --> 00:06:27,480 days, imagine what the potential damage could have been from 98 00:06:27,480 --> 00:06:29,760 that. You know, it, it, it kind of, 99 00:06:30,680 --> 00:06:33,360 it's kind of mind boggling what what may have happened. 100 00:06:34,240 --> 00:06:36,440 Yeah, I know. Definitely. 101 00:06:36,440 --> 00:06:42,360 And you know, I think that the whole North Korean piece of this 102 00:06:42,360 --> 00:06:45,080 that you know, kind of, as you've mentioned that this is 103 00:06:45,080 --> 00:06:49,080 really how in a, in a sense they are powering their economy like 104 00:06:49,080 --> 00:06:52,760 that is fascinating to me. I think, you know, I, I'm 105 00:06:52,760 --> 00:06:56,520 curious if there's any sort of any books about that or, or 106 00:06:56,520 --> 00:07:00,880 whatever, because I'm sure if there, it's, there is a whole 107 00:07:00,880 --> 00:07:04,480 other level and dimension to that and it's just insane. 108 00:07:05,880 --> 00:07:11,840 Yeah, I, I don't know that anybody has read or written a 109 00:07:13,480 --> 00:07:17,200 not specifically about them. I think, you know, the the books 110 00:07:17,200 --> 00:07:20,520 that like some of the folks we know, like, you know, Andy 111 00:07:20,520 --> 00:07:24,880 Greenberg and Kim Zetter and other folks have have written, 112 00:07:24,880 --> 00:07:31,240 have more focused on other. Yeah, more on like the Russian 113 00:07:31,240 --> 00:07:34,640 side of things as opposed to the North Korean aspect of it. 114 00:07:34,640 --> 00:07:38,440 I think for various reasons, like there's just not that much 115 00:07:38,440 --> 00:07:41,600 known about the way that North Korea operates. 116 00:07:41,640 --> 00:07:44,560 You know, there. Yeah, there just isn't. 117 00:07:44,600 --> 00:07:46,240 We don't really know what's happening there. 118 00:07:46,240 --> 00:07:51,760 And that's by design, obviously. But, you know, we know far more 119 00:07:51,920 --> 00:07:55,640 about the way that Russian threat groups operate and 120 00:07:55,640 --> 00:08:02,200 probably even Chinese as closely as as these researchers track 121 00:08:02,920 --> 00:08:07,320 the North Korean threat groups. We don't have like the at least 122 00:08:07,320 --> 00:08:09,800 not that I've seen them. They may exist privately. 123 00:08:10,200 --> 00:08:16,360 The sort of, you know, social graph and breakdown of how all 124 00:08:16,360 --> 00:08:18,720 these units are tied together. The way that you, you can find 125 00:08:18,720 --> 00:08:21,520 those for, you know, Chinese threat groups and Russian threat 126 00:08:21,520 --> 00:08:25,040 groups and that sort of thing. Probably for US, honestly. 127 00:08:25,080 --> 00:08:28,440 But I, I've never seen one of those for DPRK. 128 00:08:28,640 --> 00:08:30,280 They they may exist, but I've never seen one. 129 00:08:30,800 --> 00:08:35,480 Yeah, I know there's kind of a weird, you know, mystery around, 130 00:08:35,559 --> 00:08:38,320 you know, I know there's like Lazarus and subgroups and all of 131 00:08:38,320 --> 00:08:40,159 that, but it's it's hard to know. 132 00:08:40,520 --> 00:08:44,880 And then also just the, you know, the fake job interviews, 133 00:08:45,280 --> 00:08:48,560 like, Oh my God, cryptocurrency and fake job interviews right 134 00:08:48,560 --> 00:08:51,280 now, those are kind of the two big things that North Korean 135 00:08:51,480 --> 00:08:55,040 threat actors are that we're seeing with them. 136 00:08:55,040 --> 00:08:59,040 And both of those things are just, again, it's, it's 137 00:08:59,040 --> 00:09:02,760 fascinating to me because it's working at such a wide scale. 138 00:09:02,760 --> 00:09:05,640 And you look at something like this attack and this is 139 00:09:05,840 --> 00:09:07,800 absolutely working for them as well. 140 00:09:08,200 --> 00:09:11,760 And so, you know, they're looking for the ways that they 141 00:09:11,760 --> 00:09:17,040 can kind of sneak into organizations or try to get 142 00:09:17,040 --> 00:09:19,240 those credentials. And with that end goal, that 143 00:09:19,240 --> 00:09:22,960 financial end goal, and it's, you know, they seem to be 144 00:09:22,960 --> 00:09:26,120 successful at a wide scale. It's crazy. 145 00:09:26,200 --> 00:09:31,040 I mean, the, the sort of axiom that you hear now that attackers 146 00:09:31,040 --> 00:09:34,520 don't break in, they log in, you know, which is a very simplistic 147 00:09:34,520 --> 00:09:39,080 way of, of saying that a lot of these really successful attacks 148 00:09:39,600 --> 00:09:45,640 do use, you know, people on the inside, either voluntary, 149 00:09:45,920 --> 00:09:49,400 voluntarily or involuntarily. Like whether they're, they were 150 00:09:49,400 --> 00:09:52,760 placed there through one of those, you know, insider 151 00:09:52,760 --> 00:09:57,240 schemes, the, the fake IT workers or, you know, however 152 00:09:57,240 --> 00:10:00,800 you want to turn that thing or they're just stolen credentials 153 00:10:00,800 --> 00:10:06,520 that, you know, are being used for, for various attacks. 154 00:10:06,520 --> 00:10:10,760 But these kind of the supply chain attacks like the Axios one 155 00:10:10,760 --> 00:10:14,080 and the, and the team PCP ones that we've seen over the last 156 00:10:14,080 --> 00:10:16,680 few weeks, it's weird that they're all clustered together 157 00:10:16,680 --> 00:10:18,720 like this, but these things happen all the time. 158 00:10:19,080 --> 00:10:21,880 You know, the, the supply chain attacks are have turned out to 159 00:10:21,880 --> 00:10:27,720 be incredibly effective ways for for threat actors to get access 160 00:10:27,720 --> 00:10:33,640 to high value, you know, organizations and accounts over 161 00:10:33,640 --> 00:10:35,200 time. You know, we've seen it time and 162 00:10:35,200 --> 00:10:37,960 time again. Yeah, definitely. 163 00:10:39,200 --> 00:10:42,320 The other thing I wanted to mention too, just another like 164 00:10:42,480 --> 00:10:46,920 kind of smaller update from when we last talked about this news 165 00:10:46,920 --> 00:10:51,920 item, but the maintainer of Axios kind of came out and did a 166 00:10:51,920 --> 00:10:56,760 little bit of a breakdown of what had happened further. 167 00:10:56,760 --> 00:10:59,920 And I know last time we talked a little bit about the fact that, 168 00:11:00,600 --> 00:11:05,280 you know, it seems like his you mentioned there was a compromise 169 00:11:05,280 --> 00:11:11,440 and I think you said his his codes have been somehow accessed 170 00:11:11,440 --> 00:11:14,920 or something like that. Two factor backup codes 2. 171 00:11:14,920 --> 00:11:20,640 Factor backup codes. So he came out and essentially 172 00:11:20,640 --> 00:11:29,000 said like the gist of it was was that he someone had gained his 173 00:11:29,000 --> 00:11:34,200 trust as someone they basically pretended to be someone who was 174 00:11:34,200 --> 00:11:38,120 interested in working or partnering together on open 175 00:11:38,120 --> 00:11:44,440 source is what he said. And I know I talked about the XC 176 00:11:44,440 --> 00:11:47,680 back door last time. Like this seems again very 177 00:11:47,840 --> 00:11:51,040 similar to that, which is if you remember, in that case, there 178 00:11:51,040 --> 00:11:55,800 was a maintainer who was feeling overwhelmed because these these 179 00:11:55,800 --> 00:11:59,280 projects, like a lot of the times are come down to like, you 180 00:11:59,280 --> 00:12:04,440 know, like one person in a lot of cases and looking for help, 181 00:12:04,440 --> 00:12:08,280 maybe looking to partner with someone, looking for support and 182 00:12:08,280 --> 00:12:10,640 then threat actors taking advantage of that and kind of 183 00:12:10,640 --> 00:12:13,760 slipping in as through social engineering or whatever. 184 00:12:13,760 --> 00:12:17,000 So I don't, you know, based on this, I still don't understand 185 00:12:17,000 --> 00:12:20,680 fully the initial access vector. Like I couldn't really 186 00:12:20,680 --> 00:12:24,640 understand it from this explanation, but like it sounds 187 00:12:24,640 --> 00:12:27,640 like that was an interesting part of. 188 00:12:28,080 --> 00:12:30,480 Yeah. The kind of how this attack 189 00:12:30,480 --> 00:12:35,000 played out from the beginning. Yeah, it's a very old school 190 00:12:35,000 --> 00:12:39,760 social engineering tactic to sort of gain the the targets 191 00:12:39,760 --> 00:12:43,480 trust, you know, that this person appeared to like express 192 00:12:43,480 --> 00:12:45,880 interest and be, you know, helping with this project, 193 00:12:46,240 --> 00:12:49,120 becoming a contributor, contributor or maybe even a 194 00:12:49,120 --> 00:12:52,400 maintainer. And it it's not clear from his 195 00:12:52,400 --> 00:12:58,800 post like what period of time this took place over, but it, 196 00:12:59,600 --> 00:13:03,640 and he doesn't say specifically like I gave them access to my 197 00:13:03,640 --> 00:13:05,680 maintainer account. It doesn't sound like that to 198 00:13:05,680 --> 00:13:09,520 me. It sounds like in, in one way or 199 00:13:09,520 --> 00:13:14,840 another, they were able to kind of weasel some access to his, 200 00:13:15,080 --> 00:13:18,720 you know, MPM and GitHub accounts and then locked him 201 00:13:18,720 --> 00:13:23,760 out, like changed the e-mail address and locked him out so 202 00:13:23,760 --> 00:13:25,520 that they could, they could do this. 203 00:13:25,920 --> 00:13:29,840 And it's very clear from the various analysis that I've read 204 00:13:29,840 --> 00:13:34,120 that this is a, you know, a very well planned and, you know, 205 00:13:34,200 --> 00:13:37,320 tightly executed attack. It was not a haphazard thing. 206 00:13:37,680 --> 00:13:41,160 And this just backs that up. Yeah, Yeah, definitely. 207 00:13:42,400 --> 00:13:46,120 So yeah, that was the other kind of new development there. 208 00:13:47,240 --> 00:13:50,440 It's, it's like depressing the way that we talked about it in 209 00:13:50,440 --> 00:13:54,240 the last episode of like all these open source projects, you 210 00:13:54,240 --> 00:13:58,720 know, people start them as, you know, kind of a hobby or a side 211 00:13:58,720 --> 00:14:01,480 project or something like that. Or because they want to do 212 00:14:01,480 --> 00:14:06,200 something good and help, you know, help the ecosystem or 213 00:14:06,200 --> 00:14:11,760 something along those lines. And then something like this 214 00:14:11,760 --> 00:14:13,640 happens and they're, you know, they're spending their spare 215 00:14:13,640 --> 00:14:18,960 time doing this and, you know, responding to bug reports and, 216 00:14:18,960 --> 00:14:21,160 you know, feature requests and all that kind of thing. 217 00:14:21,640 --> 00:14:25,400 And in that post that you mentioned Lens, he you know, at 218 00:14:25,400 --> 00:14:31,000 the end of it, he says it's sad to me that zero trust can be not 219 00:14:31,000 --> 00:14:35,720 zero trust architecture, but zero as in no trust can be put 220 00:14:35,720 --> 00:14:39,880 in people as my only objective is to create useful things with 221 00:14:39,880 --> 00:14:42,680 code. But it seems like the world is 222 00:14:42,680 --> 00:14:45,680 strongly against that with someone trying to steal, slash, 223 00:14:45,680 --> 00:14:48,080 exploit something at every corner. 224 00:14:49,040 --> 00:14:50,760 That's so sad. Yeah, I know. 225 00:14:51,800 --> 00:14:54,920 It's like. Yeah, this, this guy, this 226 00:14:54,920 --> 00:14:58,280 person is clearly just trying to, like you said, like this is 227 00:14:58,280 --> 00:15:03,840 something that they're doing, you know, as a free service to 228 00:15:03,880 --> 00:15:06,760 the world. Because they wanted to do 229 00:15:06,760 --> 00:15:09,520 something cool that they thought was, you know, interesting and 230 00:15:09,520 --> 00:15:13,080 might might, you know, be useful to other people. 231 00:15:13,640 --> 00:15:19,160 And it's one of those things like you, like we know people 232 00:15:19,160 --> 00:15:22,520 who, you know, have developed open source tools or given 233 00:15:22,520 --> 00:15:25,640 things away like that. And people just end up like 234 00:15:25,640 --> 00:15:27,400 shouting at them. Like, why didn't you do it this 235 00:15:27,400 --> 00:15:29,320 way? Or why didn't you add this 236 00:15:29,320 --> 00:15:32,840 feature that I emailed you about like 9 months ago or, you know, 237 00:15:32,840 --> 00:15:35,600 things like that. People, we can't have nice 238 00:15:35,600 --> 00:15:36,840 things. Like people just can't be 239 00:15:36,840 --> 00:15:39,200 grateful. You know, they just have to, I 240 00:15:39,240 --> 00:15:43,440 don't know, it's, it does just, it's a little depressing when 241 00:15:43,440 --> 00:15:46,640 you see that, you know? 'Cause, you know, and you know, 242 00:15:46,640 --> 00:15:49,520 I know there was a lot of discussion about this like 2 or 243 00:15:49,520 --> 00:15:54,400 so years ago and like I think the OSS Foundation or something 244 00:15:54,400 --> 00:15:57,560 like came out and said like we here's what we need. 245 00:15:57,560 --> 00:16:01,280 Like, you know, all we need more support from the companies that 246 00:16:01,280 --> 00:16:04,200 are, you know, reaping the benefits of these sorts of 247 00:16:04,200 --> 00:16:06,840 projects. I really haven't seen anything 248 00:16:06,840 --> 00:16:09,800 since then. I mean, maybe I'm just have 249 00:16:09,800 --> 00:16:12,600 been, you know, there hasn't been any big announcements, but 250 00:16:12,960 --> 00:16:17,840 I'd be curious to talk to, you know, either maintainers or like 251 00:16:17,840 --> 00:16:20,320 people in the open source community and see what's going 252 00:16:20,320 --> 00:16:22,680 on and if. I haven't seen much. 253 00:16:23,280 --> 00:16:25,960 Yeah, there's been a bunch of efforts like that over the 254 00:16:25,960 --> 00:16:27,840 years. And it always happens after 255 00:16:27,840 --> 00:16:30,520 something like this where there's a lot of attention on 256 00:16:30,520 --> 00:16:32,040 it. And then all of a sudden 257 00:16:32,040 --> 00:16:35,320 everybody's like, well, oh, why didn't you have this security 258 00:16:35,320 --> 00:16:36,640 feature? Why didn't you do this? 259 00:16:36,640 --> 00:16:40,640 And he, this maintainer says in his message, he's like, you 260 00:16:40,640 --> 00:16:42,360 know, I'm not totally versed in security. 261 00:16:42,360 --> 00:16:46,560 I didn't, I, I didn't realize that I needed to have MFA on 262 00:16:46,560 --> 00:16:50,200 every single account and this and that, which is completely 263 00:16:50,200 --> 00:16:52,120 understandable. Yeah. 264 00:16:52,120 --> 00:16:53,760 He's just trying to write a cool software tool. 265 00:16:54,360 --> 00:16:59,960 And yeah, the, the whole open source security, the problem is 266 00:16:59,960 --> 00:17:03,800 that there's no funding for that like that. 267 00:17:03,800 --> 00:17:08,079 And that's what the OSSF was trying to do was like get some 268 00:17:08,079 --> 00:17:12,440 money together and then give stipends to some of these like 269 00:17:12,480 --> 00:17:16,920 load bearing projects that could, you know, actually do 270 00:17:16,920 --> 00:17:19,800 something with that money, like hire a full time developer or a 271 00:17:19,800 --> 00:17:24,319 part time developer to do code audits or add some different 272 00:17:24,319 --> 00:17:26,640 security features. And you know, I think the thing 273 00:17:26,640 --> 00:17:29,920 that you mentioned would came out after happened after log 4 J 274 00:17:30,240 --> 00:17:32,240 if I remember right. I think that was like the 275 00:17:32,240 --> 00:17:35,640 inciting incident. They all kind of run together. 276 00:17:35,640 --> 00:17:39,840 But yeah, it's there have been various effort attempts at this 277 00:17:39,840 --> 00:17:43,480 over the years. And some of them, you know, more 278 00:17:44,520 --> 00:17:50,240 realistic than others. But you do see people sometimes 279 00:17:50,360 --> 00:17:54,600 yelling at large software vendors who incorporate a lot of 280 00:17:54,600 --> 00:17:59,400 open source software into their products to to hey, throw some 281 00:17:59,400 --> 00:18:01,680 money at this. You know, you benefit from this, 282 00:18:02,320 --> 00:18:04,680 give some funding to this. And I know that some of them do. 283 00:18:04,840 --> 00:18:08,080 And, you know, some of them trumpeted, some of them don't. 284 00:18:08,320 --> 00:18:12,280 So you don't always hear that, you know, say Microsoft or you 285 00:18:12,280 --> 00:18:18,800 know, Cisco or Google or whoever gave 200 grand to very, you 286 00:18:18,960 --> 00:18:25,400 know, to some project, but it's, it's not nearly as common as it 287 00:18:25,400 --> 00:18:27,240 should be. Right. 288 00:18:27,240 --> 00:18:31,480 Yeah, that's, it's unfortunate. It's, it's also hard though. 289 00:18:31,720 --> 00:18:33,680 It's a hard business. It's a hard model. 290 00:18:33,680 --> 00:18:38,720 The way it's set up is not, you know, it's not going to work 291 00:18:38,720 --> 00:18:43,440 itself out, I guess in an easy manner, just operationally so, 292 00:18:43,600 --> 00:18:44,720 yeah. No, I mean. 293 00:18:45,000 --> 00:18:47,920 It as well. Commercial software vendors with 294 00:18:48,040 --> 00:18:54,640 huge development and QA and security teams have a hard time 295 00:18:55,400 --> 00:18:59,040 securing their own products. So in defending against account 296 00:18:59,040 --> 00:19:01,480 takeovers and source code depth and things like that. 297 00:19:01,480 --> 00:19:06,040 So individual maintainers who are doing this as a side project 298 00:19:06,400 --> 00:19:10,680 and aren't, you know, kind of don't stand a chance against 299 00:19:11,600 --> 00:19:15,480 somebody on the level of a North Korean state actor. 300 00:19:15,880 --> 00:19:19,800 You know, what can you do in the face of that? 301 00:19:20,920 --> 00:19:23,120 Yeah, just. Hold on and hope for the best, 302 00:19:23,120 --> 00:19:24,560 and that's not really a strategy. 303 00:19:24,600 --> 00:19:25,800 Yeah. True. 304 00:19:25,800 --> 00:19:31,360 Unfortunately, yeah. So the other thing that I wanted 305 00:19:31,360 --> 00:19:34,360 to talk about with you is kind, I mean it's a little bit 306 00:19:34,360 --> 00:19:39,160 related, but we've talked a lot about AI in the last few months 307 00:19:39,160 --> 00:19:41,560 as everybody has in various capacities. 308 00:19:41,560 --> 00:19:46,520 And something that struck me both last week at RSA and even 309 00:19:46,560 --> 00:19:51,360 this week it two things. One is just how insanely fast 310 00:19:51,360 --> 00:19:57,200 this is all going in terms of how both threat actors are using 311 00:19:57,280 --> 00:20:01,720 AI tools and how. Offensive vulnerability 312 00:20:02,040 --> 00:20:06,160 researchers are using them as well to find bugs in, you know, 313 00:20:06,160 --> 00:20:10,880 software targets. I you know, just in various 314 00:20:10,880 --> 00:20:15,720 conversations with people last week at RSA, people both on like 315 00:20:15,720 --> 00:20:18,640 the defender side and also on the vulnerability research side 316 00:20:19,280 --> 00:20:24,480 were just talking about how they can't even really wrap their 317 00:20:24,480 --> 00:20:28,760 arms around the speed with which things are changing. 318 00:20:28,760 --> 00:20:34,360 Like almost on an hourly basis with how how much better and 319 00:20:34,360 --> 00:20:37,480 more efficient some of these models are getting at finding 320 00:20:37,480 --> 00:20:40,160 actual vulnerabilities and writing exploits for them at the 321 00:20:40,160 --> 00:20:44,360 same time, which is something that people have been 322 00:20:44,360 --> 00:20:47,160 predicting. Like that's one of the effects 323 00:20:47,160 --> 00:20:50,480 of the broad availability of these tools that people have 324 00:20:50,480 --> 00:20:56,680 been worried slash excited about in the security world is, oh, 325 00:20:56,680 --> 00:20:59,640 we're going to be able to automate vulnerability discovery 326 00:21:00,520 --> 00:21:03,760 and then that'll help us on the defensive side because we'll be 327 00:21:03,760 --> 00:21:06,920 able to go patch all those bugs or whatever. 328 00:21:07,440 --> 00:21:16,000 But there are two things happening. 1 is companies and 329 00:21:16,520 --> 00:21:19,360 again, open source project maintainers are being absolutely 330 00:21:19,360 --> 00:21:24,640 buried by bug reports, you know, in the like, up until very 331 00:21:24,640 --> 00:21:28,040 recently, like within the last couple of months, those were 332 00:21:28,040 --> 00:21:31,120 trapped Most of those were were slop, they were AI generated 333 00:21:31,800 --> 00:21:36,640 junk that almost never included a real bug or something that 334 00:21:36,880 --> 00:21:40,080 actually mattered if it was a reproducible bug, it was, you 335 00:21:40,080 --> 00:21:46,120 know it was, it was noise. But in the last like month or 336 00:21:46,120 --> 00:21:50,040 two, I've seen so many people saying, OK, now we're just 337 00:21:50,040 --> 00:21:54,600 getting report after report after report of legit serious 338 00:21:54,600 --> 00:21:58,440 slash critical bugs in our software slash project. 339 00:21:58,920 --> 00:22:04,320 And you know, say, just take Axios for example, like somebody 340 00:22:04,440 --> 00:22:07,120 that's a single maintainer or maybe part of a two person team, 341 00:22:08,280 --> 00:22:12,920 If they just start getting inundated with valid bug reports 342 00:22:13,160 --> 00:22:17,840 that were, you know, found by AI tools, you know, getting say, 343 00:22:18,280 --> 00:22:23,240 even as few as like 6 or 8 a week, like no way they can 344 00:22:23,240 --> 00:22:25,600 handle that. How can they triage those and 345 00:22:25,800 --> 00:22:29,520 then go write patches for them and deploy the patches and all 346 00:22:29,520 --> 00:22:33,240 that kind of stuff. And even some of our friends 347 00:22:33,240 --> 00:22:35,440 that work at large commercial software vendors are having a 348 00:22:35,440 --> 00:22:37,720 really hard time dealing with this. 349 00:22:37,720 --> 00:22:41,720 And they have professional triage teams that do nothing but 350 00:22:41,720 --> 00:22:44,360 this, and they're getting absolutely buried by these. 351 00:22:45,920 --> 00:22:49,440 Yeah, I mean, this was already an issue even before AI, but now 352 00:22:49,440 --> 00:22:54,600 AI has just made it explode like it's so much worse. 353 00:22:55,760 --> 00:23:01,000 And I feel like I was listening to Casey Ellis, who with Bug 354 00:23:01,000 --> 00:23:07,680 Crowd, who founded Bug Crowd, he was talking about, I think it 355 00:23:07,680 --> 00:23:12,760 was at that Run Zero event that you talked at during RSA as 356 00:23:12,760 --> 00:23:15,360 well. He's talking to Todd Beardsley 357 00:23:15,360 --> 00:23:20,800 about how bug bounty's going to change in particular because of 358 00:23:20,840 --> 00:23:25,040 AI and because of kind of this like influx of AI generated 359 00:23:25,040 --> 00:23:27,200 reports. And he made a really good point, 360 00:23:27,200 --> 00:23:33,320 which was basically that, you know, these AI is lowering the 361 00:23:33,320 --> 00:23:38,480 barrier to be able to generate these reports and it's making it 362 00:23:38,480 --> 00:23:41,080 faster and more effective. But then on the other side of 363 00:23:41,080 --> 00:23:46,360 the coin, companies are still really bad at patching and 364 00:23:46,360 --> 00:23:50,000 they're really bad at like, you know, responding to these 365 00:23:50,000 --> 00:23:51,400 things. And there's still 366 00:23:51,640 --> 00:23:56,480 vulnerabilities that exists that we that companies know about 367 00:23:56,480 --> 00:24:00,640 that haven't been patched yet. So there's just that's, that's 368 00:24:00,640 --> 00:24:03,840 kind of the, the biggest issue in all of this is that there's a 369 00:24:03,840 --> 00:24:08,400 discrepancy between, you know, bad actors that want to use AI 370 00:24:08,400 --> 00:24:12,560 tools to figure find vulnerabilities and even good 371 00:24:12,560 --> 00:24:16,680 actors that want to disclose the vulnerabilities and the 372 00:24:16,680 --> 00:24:20,360 companies that are able to not able to keep up with with 373 00:24:20,360 --> 00:24:22,000 everything. Yeah. 374 00:24:22,640 --> 00:24:26,200 I mean, one of the things that people that have thought very 375 00:24:26,200 --> 00:24:29,760 deeply about this for the last, you know, say 2025 years, it 376 00:24:30,720 --> 00:24:34,600 came to a conclusion, you know, years ago is there's essentially 377 00:24:34,600 --> 00:24:37,320 an infinite supply of bugs in software. 378 00:24:37,880 --> 00:24:41,440 You know, it's not, it's, it's inexhaustible. 379 00:24:41,440 --> 00:24:44,760 You will, if you keep looking, you will keep finding bugs. 380 00:24:45,200 --> 00:24:49,360 They, they may, there may be a limited supply of critical ones 381 00:24:49,360 --> 00:24:52,520 or serious ones, but you will just keep finding bugs and 382 00:24:52,520 --> 00:24:55,800 software for the obvious reason that it's written by humans and 383 00:24:55,800 --> 00:24:57,760 humans make errors and blah, blah, blah. 384 00:24:58,480 --> 00:25:04,200 But up until very recently, even with automated fuzzing tools and 385 00:25:04,200 --> 00:25:08,480 things like that, there was kind of an upper limit on how many, 386 00:25:08,840 --> 00:25:13,160 how many resources that say an individual, even a highly 387 00:25:13,160 --> 00:25:18,640 skilled individual vulnerability researcher could, could, how 388 00:25:18,640 --> 00:25:21,960 many bugs that person could find in a given amount of time. 389 00:25:21,960 --> 00:25:26,040 You know, because then they they have to, they have to not only 390 00:25:26,040 --> 00:25:31,760 find the bug, but make sure it's exploitable, possibly write an 391 00:25:31,760 --> 00:25:37,040 exploit for it or send the crash dump along with the 392 00:25:37,040 --> 00:25:40,560 vulnerability report to the vendor that the vendor might ask 393 00:25:40,560 --> 00:25:42,880 them to write a patch for it, which happens more than you 394 00:25:42,880 --> 00:25:47,200 would think, which is insane. And like go through this whole 395 00:25:47,200 --> 00:25:55,120 process now with these AI tools, 99.9% of that is automated and 396 00:25:55,120 --> 00:26:00,800 it's doing as good or better job than very high end, you know, 397 00:26:00,920 --> 00:26:04,760 offensive security researchers and exploit devs can do on their 398 00:26:04,760 --> 00:26:06,360 own. And these are, you know, folks 399 00:26:06,360 --> 00:26:11,760 with 15 or 20 years of exploit development experience that make 400 00:26:12,160 --> 00:26:14,040 very, very good money to do that. 401 00:26:14,040 --> 00:26:15,600 And now we just have tools doing it. 402 00:26:16,480 --> 00:26:20,280 You know, there was a two things I wanted to mention. 403 00:26:20,280 --> 00:26:25,880 One is a, a post my friend Tom Taschek wrote that I think it 404 00:26:25,880 --> 00:26:30,200 just came out on Monday. Yeah, it was Monday or maybe 405 00:26:30,200 --> 00:26:33,400 Sunday called Vulnerability Research is Cooked. 406 00:26:33,800 --> 00:26:36,920 And for people that don't know who Tom is, you, you can go read 407 00:26:36,920 --> 00:26:40,800 his CV. He's one of the original 408 00:26:42,720 --> 00:26:47,880 vulnerability researchers from the mid 90s, started a couple of 409 00:26:48,280 --> 00:26:51,880 successful security companies. Montesano is one of those. 410 00:26:52,320 --> 00:26:55,240 He's extremely well respected, one of the smartest people I've 411 00:26:55,240 --> 00:26:58,400 ever met and thinks very deeply about these things. 412 00:26:58,920 --> 00:27:01,560 And he writes like one blog post every six years. 413 00:27:01,560 --> 00:27:04,760 So when he writes one, like people tend to pay attention to 414 00:27:04,760 --> 00:27:07,480 it. And he essentially said what 415 00:27:07,480 --> 00:27:11,000 I've been saying much less succinctly. 416 00:27:11,760 --> 00:27:18,320 It's a good word to trip over. But he goes into much more 417 00:27:18,320 --> 00:27:23,720 detail about why this is true, but essentially said, I think 418 00:27:23,720 --> 00:27:27,480 this outcome is locked in. This is going to happen. 419 00:27:27,480 --> 00:27:30,200 It's just a question of, you know, how quickly. 420 00:27:30,480 --> 00:27:33,640 And we're seeing it right now. You know, there was a a 421 00:27:33,640 --> 00:27:36,960 researcher who people might know named Tai Dong, who's a 422 00:27:37,000 --> 00:27:41,800 Vietnamese security researcher, very well known, just, you know, 423 00:27:41,880 --> 00:27:45,600 helped discover a couple of really serious TLS attacks back 424 00:27:45,600 --> 00:27:49,720 in the day. He and his team used clawed to 425 00:27:49,720 --> 00:27:55,240 find a full remote code execution exploit in BSD. 426 00:27:55,320 --> 00:27:57,280 Like yes, I think they published it yesterday. 427 00:27:57,720 --> 00:28:01,080 And they were like, this is what a very high end team would have 428 00:28:01,080 --> 00:28:05,600 spent weeks or months doing just last year. 429 00:28:05,720 --> 00:28:11,040 And now tada, you know, it's like it's getting spooky. 430 00:28:11,120 --> 00:28:16,720 Like it's it's crazy fast. Yeah, that's, I feel like we 431 00:28:16,720 --> 00:28:19,920 keep seeing the writing on the wall here a little bit. 432 00:28:19,960 --> 00:28:23,720 And it's funny, you bring it like, you know, it's bad when 433 00:28:23,800 --> 00:28:27,160 these really, really smart researchers are coming forward 434 00:28:27,160 --> 00:28:30,040 and being like, this is, this is not good. 435 00:28:30,560 --> 00:28:34,160 No, yeah. Yeah, I and I also, I, I was 436 00:28:34,160 --> 00:28:37,480 going to talk about like this at unprompted, which is this 437 00:28:37,920 --> 00:28:40,640 conference they had a couple weeks ago about specifically 438 00:28:40,640 --> 00:28:44,880 about AI, which was an awesome, like they released the talks on 439 00:28:44,880 --> 00:28:48,200 YouTube and it, it was a really, really interesting event. 440 00:28:48,200 --> 00:28:53,600 But there was one session by Nicholas Carlini, who is a he's, 441 00:28:53,920 --> 00:28:58,640 you know, really, really smart research scientist at Anthropic 442 00:28:58,640 --> 00:29:02,400 and was basically, you know, saying the same thing, which is 443 00:29:02,400 --> 00:29:07,160 just talking about how good LLMS are at creating vulnerability 444 00:29:07,160 --> 00:29:11,520 reports right now. But what stuck out to me from 445 00:29:11,560 --> 00:29:16,880 from that talk in particular is people then during the Q&A 446 00:29:16,880 --> 00:29:20,520 session were saying, OK, So what do we do? 447 00:29:20,520 --> 00:29:25,360 Like do we build safeguards? Like how do we deal with this? 448 00:29:25,360 --> 00:29:26,480 And. Too late. 449 00:29:27,040 --> 00:29:29,080 Yeah. And I think, you know, he was 450 00:29:29,080 --> 00:29:31,640 like, we need to find a way to fix this. 451 00:29:32,640 --> 00:29:36,640 Like we need to basically like we that we're going to need like 452 00:29:36,640 --> 00:29:39,640 all the help that we can at this point to like be able to step up 453 00:29:39,640 --> 00:29:44,600 and meet this, this challenge. But like I, I was trying to rack 454 00:29:44,600 --> 00:29:49,040 my brain about how we could, how you know, when we actually enter 455 00:29:49,040 --> 00:29:53,040 this era of like this, where in this situation and scenario that 456 00:29:53,040 --> 00:29:56,200 you describe, like how we're going to be able to handle that. 457 00:29:56,200 --> 00:30:00,360 And I really couldn't like there's no, there's no 458 00:30:00,360 --> 00:30:02,240 safeguards. There's not really any way to 459 00:30:02,640 --> 00:30:06,240 implement safeguards because this is something where threat 460 00:30:06,240 --> 00:30:10,560 actors are going to be abusing legitimate tools similar to you 461 00:30:10,560 --> 00:30:14,720 know what we do what we have right now with other many other 462 00:30:14,720 --> 00:30:17,800 things, but just at a way faster and scarier scale. 463 00:30:19,800 --> 00:30:25,800 And there's not any like rules or, you know, regulations or 464 00:30:25,840 --> 00:30:30,600 anything when we're AI right now and how it's being used. 465 00:30:30,800 --> 00:30:35,360 There's not even really any sort of, we don't have any rules 466 00:30:35,360 --> 00:30:41,200 right now where if like someone uses AI to like make a statement 467 00:30:41,200 --> 00:30:47,120 or write something or create code like at like it's just like 468 00:30:47,160 --> 00:30:51,680 at the most basic level, like there's nothing that, you know, 469 00:30:51,680 --> 00:30:57,000 there's no principle that is, you know, connected to AI. 470 00:30:57,000 --> 00:30:59,560 So, yeah, I don't know. I think that's kind of the heart 471 00:30:59,560 --> 00:31:03,160 of all this is we're just going into this and we don't have any 472 00:31:03,160 --> 00:31:07,040 sort of standard set up for it. No, there's, there's none 473 00:31:07,040 --> 00:31:10,200 whatsoever. I mean, we have historically a 474 00:31:10,200 --> 00:31:14,920 terrible time trying to develop any kind of security standards 475 00:31:14,920 --> 00:31:20,400 or even like societal norms around how to disclose 476 00:31:20,400 --> 00:31:22,000 vulnerabilities. Like that's been going on for 477 00:31:22,000 --> 00:31:26,000 literally 30 years. And there's still no like, broad 478 00:31:26,000 --> 00:31:28,280 agreement on that. You still see people arguing on 479 00:31:28,280 --> 00:31:30,880 Twitter about that like literally every day. 480 00:31:32,800 --> 00:31:39,840 So no, I have absolutely no faith that this will be, you 481 00:31:39,840 --> 00:31:42,880 know, that any of this will be contained in any sort of way 482 00:31:42,880 --> 00:31:46,480 anytime soon. It's funny that that talk you 483 00:31:46,480 --> 00:31:50,360 just mentioned, that's actually the vulnerability that those 484 00:31:50,360 --> 00:31:53,280 researchers I just described developed the exploit for. 485 00:31:53,640 --> 00:31:59,040 That They, that's the exact one that Ty and his team just said 486 00:31:59,040 --> 00:32:01,400 to Claude, oh, here's this bug in BSD. 487 00:32:01,840 --> 00:32:04,840 Write an exploit. 8 hours later, they had a fully functioning 488 00:32:05,560 --> 00:32:07,640 exploit for it. Yeah. 489 00:32:08,400 --> 00:32:14,480 So like, that's like weeks of work for, you know, smart people 490 00:32:14,480 --> 00:32:20,160 with lots of experience. And now it's just, yeah, it's an 491 00:32:20,480 --> 00:32:23,920 AI model. You know, I think right now the 492 00:32:23,920 --> 00:32:29,960 only thing that's limiting this honestly might be money and how 493 00:32:29,960 --> 00:32:36,080 much money researchers want to burn, you know, paying for AI 494 00:32:36,160 --> 00:32:39,080 model time to, to do this kind of stuff like that. 495 00:32:39,120 --> 00:32:42,040 That's not cheap. I mean, that's, I'm sure it'll 496 00:32:42,040 --> 00:32:45,080 come down the way that everything does except for food 497 00:32:45,080 --> 00:32:50,760 and gas and housing. But you know, but I'm sure that 498 00:32:52,160 --> 00:32:56,120 model usage costs will, will stabilize or, you know, there 499 00:32:56,120 --> 00:33:00,920 will be some, some sort of economic model that makes it 500 00:33:01,040 --> 00:33:04,840 feasible for people to use them on an ongoing basis. 501 00:33:04,920 --> 00:33:09,880 But that might be the only thing that's holding back, holding 502 00:33:09,880 --> 00:33:15,160 this back from going absolutely, you know, straight up in terms 503 00:33:15,160 --> 00:33:19,000 of the number of vulnerabilities and exploits that these things 504 00:33:19,000 --> 00:33:21,680 are writing every day. Right, yeah. 505 00:33:21,880 --> 00:33:27,000 The the other thing that I think about too is how this is going 506 00:33:27,000 --> 00:33:31,160 to play out in real life. Like, are we just going to start 507 00:33:31,160 --> 00:33:35,520 seeing an explosion of exploitation? 508 00:33:35,520 --> 00:33:40,520 Like, is it going to be like, how is it going to look in three 509 00:33:40,520 --> 00:33:42,680 months like? Oh God, I know. 510 00:33:43,200 --> 00:33:48,720 Yeah, so 'cause we're seeing, we're seeing the efforts from 511 00:33:48,760 --> 00:33:52,480 good, you know, from white hat, you know, researchers right now 512 00:33:52,480 --> 00:33:56,640 and we're seeing through their research how easy this is. 513 00:33:56,640 --> 00:34:00,680 But like, you know, the way that we're going to see this front in 514 00:34:00,680 --> 00:34:05,520 terms of how how threat actors are going to use it to increased 515 00:34:05,520 --> 00:34:09,800 exploitation is entirely different story. 516 00:34:10,080 --> 00:34:15,080 Yeah, I think if we, you know, as you said, like sometime this 517 00:34:15,080 --> 00:34:17,920 summer, if we're having a conversation like this, things 518 00:34:17,920 --> 00:34:23,000 might be radically different already, you know, by mid June 519 00:34:23,120 --> 00:34:27,159 or mid-july or something like or after Black Hat, who knows, 520 00:34:28,120 --> 00:34:31,400 there could be the landscape could look completely different. 521 00:34:31,480 --> 00:34:36,080 And we just, yeah, I haven't, I've asked that that question of 522 00:34:36,239 --> 00:34:40,000 lots of researchers and security folks. 523 00:34:40,000 --> 00:34:44,360 Nobody seems to have a, a really like, you know, solid answer 524 00:34:44,360 --> 00:34:47,520 that they are 100% sure of because I don't think anybody's 525 00:34:47,520 --> 00:34:52,320 sure of anything in this, in this world right now with AI. 526 00:34:52,320 --> 00:34:59,080 But threat actors using AI tools to, you know, automate exploit 527 00:34:59,080 --> 00:35:02,200 development is something that's obviously happening right now. 528 00:35:03,000 --> 00:35:09,040 The exploitation I itself, I still feel like is probably for 529 00:35:09,040 --> 00:35:13,400 the most part being done by individual operators just 530 00:35:13,400 --> 00:35:19,920 because it, that takes some care and, and, you know, precision to 531 00:35:19,920 --> 00:35:25,520 do that, but I don't know how long that'll that state of 532 00:35:25,520 --> 00:35:28,720 affairs will last. And, you know, we, we talked 533 00:35:28,720 --> 00:35:32,720 about on our last podcast, like the radio silence from Sisa on 534 00:35:32,720 --> 00:35:37,880 that, that Axios compromise, as much as we've heard from 535 00:35:37,880 --> 00:35:43,240 Washington about AI and none of which is like coherent really. 536 00:35:43,960 --> 00:35:47,160 I haven't, I haven't really seen anything on this either like the 537 00:35:47,160 --> 00:35:52,480 security implications of AI models or more of what we've 538 00:35:52,480 --> 00:35:59,400 seen is, you know, the environmental impacts of AI 539 00:35:59,400 --> 00:36:02,280 companies and that sort of thing and how they're destroying our 540 00:36:02,280 --> 00:36:03,600 economy. But that's a whole other 541 00:36:04,080 --> 00:36:06,720 discussion. But this kind of stuff, I 542 00:36:06,720 --> 00:36:10,680 haven't seen really anything from senators, even the ones 543 00:36:10,680 --> 00:36:13,000 that understand it. Like, I don't know, unless I'm, 544 00:36:13,360 --> 00:36:15,520 I'm forgetting. I haven't, you know, I haven't 545 00:36:15,520 --> 00:36:19,160 seen anything from like Ron Wyden or the folks that actually 546 00:36:19,160 --> 00:36:22,040 understand what's going on. You know, obviously they have 547 00:36:22,040 --> 00:36:24,440 their hands full with a war and other things. 548 00:36:24,440 --> 00:36:27,080 But yeah. Yeah, that's a good point 549 00:36:27,120 --> 00:36:29,680 though. And I I'm don't know why that 550 00:36:29,680 --> 00:36:33,360 is. Maybe it's just not like a hot 551 00:36:33,440 --> 00:36:37,320 political issue right now, but it's certainly. 552 00:36:38,520 --> 00:36:42,360 It might just be that people don't know what to like, how to 553 00:36:42,360 --> 00:36:45,040 talk about it. Like, because honestly, like 554 00:36:45,040 --> 00:36:47,520 we've been saying for the last 20 minutes, it's just changing 555 00:36:47,520 --> 00:36:52,600 so quickly. You know, you just, you really 556 00:36:52,600 --> 00:36:56,280 can't get your arms around it at any point in time. 557 00:36:57,400 --> 00:37:00,400 Yeah, I know. Like personally for me over the 558 00:37:00,400 --> 00:37:04,240 past two years, the shift has been really interesting to see. 559 00:37:04,240 --> 00:37:08,320 Just as someone in cybersecurity who's covering news too, is like 560 00:37:08,800 --> 00:37:12,880 when, when AI, when we were first talking about AI like 2-3 561 00:37:12,880 --> 00:37:15,920 years ago, I think at that point I was like rolling my eyes and I 562 00:37:15,920 --> 00:37:18,400 was just like, this is just all hype. 563 00:37:18,600 --> 00:37:23,320 No, no actual like substance in this and now like. 564 00:37:23,720 --> 00:37:26,920 That was true then, by the way. Yes, Yeah, yeah, that's true 565 00:37:26,920 --> 00:37:28,160 that. Was accurate. 566 00:37:28,840 --> 00:37:32,960 And then like within the last year or like even six months, 567 00:37:32,960 --> 00:37:37,160 like I feel like I was just like, oh, Oh, no, like. 568 00:37:37,760 --> 00:37:40,560 Yeah. This not only has substance, but 569 00:37:40,560 --> 00:37:45,280 like this is very, you know, there is some potentially really 570 00:37:45,280 --> 00:37:51,000 bad use cases out of this. So yeah, it, you know, it's like 571 00:37:51,000 --> 00:37:54,320 when you see the long range forecast and they're predicting, 572 00:37:54,360 --> 00:37:57,080 you know, like 4 feet of snow or something, you're like, yeah, 573 00:37:57,080 --> 00:37:59,520 they're always wrong. That never happens. 574 00:37:59,800 --> 00:38:01,600 And then it gets closer and it gets closer. 575 00:38:01,600 --> 00:38:04,240 You're like, oh, this is the Yep, it's going to happen. 576 00:38:05,040 --> 00:38:07,920 That's a very New England. It is, yes. 577 00:38:08,560 --> 00:38:10,560 Yeah, You can tell it. Yeah. 578 00:38:10,560 --> 00:38:14,120 My psyche is still damaged from this past winter, but yeah, 579 00:38:14,840 --> 00:38:17,200 yeah, you're right. I mean, the, our friend Gary 580 00:38:17,200 --> 00:38:22,680 McGraw, who's the, the, the person I know who's thought the 581 00:38:22,680 --> 00:38:25,160 most about AI and machine learning over the last because 582 00:38:25,160 --> 00:38:28,240 he did his PhD on this in the the 90s. 583 00:38:28,720 --> 00:38:34,360 So he very few people know more of thought more about this than 584 00:38:34,400 --> 00:38:39,480 than Gary has. And, you know, even he is, I 585 00:38:39,480 --> 00:38:41,640 think I haven't talked to him in the last couple weeks about 586 00:38:41,640 --> 00:38:48,120 this, but even he, I think is kind of like amazed by how the, 587 00:38:48,320 --> 00:38:52,280 you know, just the absolute uptick in craziness that's gone 588 00:38:52,280 --> 00:38:55,680 on recently. Yeah, no, I was thinking, yeah, 589 00:38:56,000 --> 00:38:59,920 we need to have Gary back on the podcast, like to have, you know, 590 00:38:59,920 --> 00:39:03,360 I remember I think it was maybe like last year or the year 591 00:39:03,360 --> 00:39:05,520 before you last talked to him or something. 592 00:39:05,520 --> 00:39:09,760 But I would be really interested to hear what he has to say 593 00:39:11,000 --> 00:39:14,600 specifically about how things have accelerated recently so. 594 00:39:14,600 --> 00:39:18,720 Yeah, I'd have to roust him out of his semi retirement and his, 595 00:39:19,080 --> 00:39:22,040 you know, his farm down by the river. 596 00:39:22,040 --> 00:39:24,120 But yeah, he would do it. Yeah. 597 00:39:24,280 --> 00:39:27,000 I I should call him. He's he's, he'll probably text 598 00:39:27,000 --> 00:39:30,320 me. He has like superhuman powers to 599 00:39:30,320 --> 00:39:31,560 know when somebody's talking about him. 600 00:39:31,560 --> 00:39:36,240 But yeah, All right. The last thing I wanted to 601 00:39:36,240 --> 00:39:40,600 mention is we are again sponsoring with our friends at 602 00:39:40,600 --> 00:39:44,880 Material Security, their security theater event. 603 00:39:44,880 --> 00:39:46,360 They've been doing a series of these. 604 00:39:46,360 --> 00:39:51,560 They did one in San Francisco, one in New York and they're 605 00:39:51,560 --> 00:39:56,240 doing one this coming Tuesday, April 7th in Austin, TX. 606 00:39:56,760 --> 00:40:04,600 And the the movie this time is Hackers, which is one that we is 607 00:40:04,600 --> 00:40:09,720 on our our list of hacker movie podcasts, one we're going to do 608 00:40:09,720 --> 00:40:13,240 sometime soon. But these events are really 609 00:40:13,240 --> 00:40:15,000 great. I'm I'm going to be in Austin 610 00:40:15,000 --> 00:40:16,600 for this. I'm really excited about it. 611 00:40:16,600 --> 00:40:22,720 So they show the movie and they do some movie trivia beforehand. 612 00:40:22,720 --> 00:40:25,880 They have prizes. It's all like, you know, a bunch 613 00:40:25,880 --> 00:40:29,840 of security nerds and movie nerds sitting around, you know, 614 00:40:29,840 --> 00:40:35,520 kind of laughing at the absurdness of hackers and, and 615 00:40:35,520 --> 00:40:39,400 just having a good time. So if you are in the Austin 616 00:40:39,400 --> 00:40:41,720 area, I'd, I'd encourage you to register. 617 00:40:41,720 --> 00:40:47,520 You can go to material dot security slash theatre or 618 00:40:47,520 --> 00:40:51,280 material dot yeah, material dot security slash theatre and you 619 00:40:51,280 --> 00:40:54,000 can find the registration there. It'll be a great time. 620 00:40:54,080 --> 00:40:56,520 I'm going to bring some decipher swag with me. 621 00:40:56,520 --> 00:40:59,960 So he he some of that away. I know that's. 622 00:41:00,840 --> 00:41:03,440 Good. Yeah, that sounds really fun. 623 00:41:04,800 --> 00:41:08,120 I 'cause we always, you know, we, we have our kind of hacker 624 00:41:08,120 --> 00:41:10,400 movies that we do. But like, there's something 625 00:41:10,400 --> 00:41:15,120 about sitting down with people who really appreciate hacker 626 00:41:15,240 --> 00:41:19,360 movies and specifically hackers and watching it together and 627 00:41:19,360 --> 00:41:24,280 then some cool trivia like that just sounds so fun. 628 00:41:24,640 --> 00:41:28,200 I'm excited. I did not see this dumb movie in 629 00:41:28,400 --> 00:41:30,040 theaters and I'm I'm talking about about it. 630 00:41:30,040 --> 00:41:32,280 I I like this movie. It's fun. 631 00:41:32,320 --> 00:41:36,040 It's completely ridiculous. There's a whole subset of the 632 00:41:36,040 --> 00:41:39,400 security community that this is like, this is their movie, the 633 00:41:39,400 --> 00:41:42,480 way that Like Sneakers is my generation's movie. 634 00:41:43,280 --> 00:41:47,000 People, I don't know what it is about this movie. 635 00:41:47,000 --> 00:41:50,520 Maybe it's, you know, it's kind of the campiness and like the 636 00:41:50,520 --> 00:41:54,920 roller blades and the pagers and like the neon colors and all 637 00:41:54,920 --> 00:41:58,960 that kind of shit. But some people just love this 638 00:41:58,960 --> 00:42:01,720 movie so much. So. 639 00:42:01,920 --> 00:42:04,240 Yeah, it'll be fun to see in the theater. 640 00:42:04,520 --> 00:42:05,280 Should be great. That's. 641 00:42:05,800 --> 00:42:08,720 Awesome. Yeah, and we do. 642 00:42:08,720 --> 00:42:14,200 We are going to have a couple upcoming Hacker Movie podcast 643 00:42:14,200 --> 00:42:16,960 episodes. We're going to have your 644 00:42:16,960 --> 00:42:20,480 colleague John Hammond on one. We don't know exactly when 645 00:42:20,480 --> 00:42:25,120 that's going to happen yet, but I saw him at blackout last week 646 00:42:25,160 --> 00:42:28,480 and asked him if he wanted to do one of these with us. 647 00:42:28,480 --> 00:42:34,360 And his immediate response was, do you know that movie Black 648 00:42:34,360 --> 00:42:37,520 Hat? Yes, I do, John. 649 00:42:38,040 --> 00:42:42,360 I sure, sure do. So we're going to do Black Hat 650 00:42:42,360 --> 00:42:44,800 with Jon Hammond, which will be an absolute blast because that 651 00:42:44,800 --> 00:42:49,440 movie is absurd too. Like the the one that the one 652 00:42:49,440 --> 00:42:51,840 where Thor is a hacker is the way that somebody described that 653 00:42:51,840 --> 00:42:53,920 to me, which I thought was just perfect. 654 00:42:54,680 --> 00:42:57,280 That's that's a great description of it. 655 00:42:58,040 --> 00:42:59,680 They should have just made that the tagline. 656 00:43:00,240 --> 00:43:04,360 Honestly, yes, had they known how big the the MCU was going to 657 00:43:04,360 --> 00:43:08,480 be, they because this came out sort of before all of that, but 658 00:43:08,600 --> 00:43:11,920 yeah, that would have been that's retroactively. 659 00:43:11,920 --> 00:43:16,920 They should do that just yeah, Thor as a hacker, yeah, but 660 00:43:16,920 --> 00:43:19,800 yeah, so we'll do Black Hat pretty soon and we should do 661 00:43:19,800 --> 00:43:22,640 hackers too. Get that going because that'll 662 00:43:22,640 --> 00:43:26,120 that'll be a super fun one, especially after I go and sit 663 00:43:26,120 --> 00:43:28,920 through it in the theater, which will be quite an experience. 664 00:43:29,400 --> 00:43:31,880 Yeah, definitely. Yeah, we've got to run through 665 00:43:31,880 --> 00:43:35,400 some more and to like any of our listeners too. 666 00:43:35,400 --> 00:43:38,360 If, if anyone has any suggestions, we would love to 667 00:43:38,360 --> 00:43:42,160 hear them. Be sure to comment on our maybe 668 00:43:42,160 --> 00:43:46,160 our Twitter page or whatever to see for SEC. 669 00:43:46,640 --> 00:43:48,880 Yeah, we would love to hear those 'cause we have our own 670 00:43:48,880 --> 00:43:50,960 list. But I know that there's some 671 00:43:50,960 --> 00:43:54,520 like people every once in awhile will mention a movie to me and I 672 00:43:54,520 --> 00:43:57,360 watch an, an embarrassing number of movies. 673 00:43:57,360 --> 00:44:01,520 But sometimes people just you know, mention oh, have you seen 674 00:44:01,520 --> 00:44:02,840 this? I'm like, no, I've never even 675 00:44:02,840 --> 00:44:05,480 heard of that. So there's a lot out there that, 676 00:44:05,640 --> 00:44:07,320 you know, we probably haven't thought of. 677 00:44:07,320 --> 00:44:10,400 So if you guys have like favourites that you'd like to 678 00:44:10,400 --> 00:44:14,160 see from, you know, especially recently because I'm more on 679 00:44:14,160 --> 00:44:16,440 like the 80s nineties scale and lens. 680 00:44:16,440 --> 00:44:18,600 I think you're on more on like the 2000 scale. 681 00:44:18,600 --> 00:44:23,280 But yeah, some of the more recent, like straight to 682 00:44:23,280 --> 00:44:26,040 streaming ones that you and I have talked about, like Heart of 683 00:44:26,040 --> 00:44:29,280 Stone, I think is one that we really need to do given the AI, 684 00:44:29,280 --> 00:44:33,680 Oh my gosh, aspect of that movie. 685 00:44:34,080 --> 00:44:37,520 I, I can't imagine that there's eight people listening to this 686 00:44:37,520 --> 00:44:41,080 who know what Heart of Stone is. But somehow you and I both 687 00:44:41,080 --> 00:44:43,720 watched it, I think like in the same week separately, like 688 00:44:44,160 --> 00:44:46,600 whenever it came out last year or two years ago. 689 00:44:47,440 --> 00:44:49,600 And whoa, is that movie terrible. 690 00:44:49,600 --> 00:44:51,680 But it would be an entertaining podcast. 691 00:44:52,360 --> 00:44:55,000 They do, yeah. I think there is like a sub, a 692 00:44:55,000 --> 00:44:59,880 weird subset of AI movies that I think we need to also do. 693 00:45:00,320 --> 00:45:06,080 Like what was the one? There was one who? 694 00:45:06,120 --> 00:45:09,280 Let's see. Well, the last two Mission 695 00:45:09,280 --> 00:45:14,600 Impossible movies are, yeah, centered around AI in a very 696 00:45:14,600 --> 00:45:18,720 stupid way. Right, I know it's it's just 697 00:45:18,960 --> 00:45:21,960 crazy there. There have been some other good 698 00:45:21,960 --> 00:45:24,800 ones too. I'm blinky on the names, but 699 00:45:24,800 --> 00:45:26,480 I'll find them. There's a lot there. 700 00:45:27,080 --> 00:45:29,720 There's so many, especially in the the streaming era. 701 00:45:30,200 --> 00:45:36,080 You can, you can find a bunch on like, you know, Amazon or 702 00:45:36,080 --> 00:45:39,680 Netflix or two V or whatever and it'll just the thumbnail will 703 00:45:39,680 --> 00:45:44,280 just be some person like in front of a transparent screen, 704 00:45:44,280 --> 00:45:47,480 like you know, with their hands up and a bunch of like ones and 705 00:45:47,480 --> 00:45:50,000 zeros or something. What's happening? 706 00:45:51,000 --> 00:45:53,600 Yeah. I know there that was also 707 00:45:53,600 --> 00:45:58,760 there's like a kind of a weird subplot in that House of 708 00:45:58,760 --> 00:46:04,840 Dynamite movie that came out recently, which is more about 709 00:46:04,840 --> 00:46:08,960 like a nuclear war. But there's some, you know, 710 00:46:09,000 --> 00:46:13,240 cybery stuff in there. And also that horrific show that 711 00:46:13,240 --> 00:46:16,960 came out last year, Zero Day. Oh, well, yeah, that was. 712 00:46:17,320 --> 00:46:19,400 I couldn't finish that. Oh, it's so. 713 00:46:19,760 --> 00:46:21,360 Bad. It's such good hopes for such 714 00:46:21,360 --> 00:46:25,080 high hopes. God, it had Robert De Niro. 715 00:46:26,360 --> 00:46:28,400 It had Robert De Niro. Yeah. 716 00:46:28,400 --> 00:46:32,560 And it was like, I, I don't, I can't even calculate what 717 00:46:32,680 --> 00:46:35,080 ungodly amount of money they must have paid him to do that. 718 00:46:35,360 --> 00:46:38,440 Yeah. Whatever it was, I hope he had a 719 00:46:38,440 --> 00:46:41,000 good time 'cause that was absolute garbage. 720 00:46:42,000 --> 00:46:46,320 Oh, I know there was, there was this is interesting. 721 00:46:46,320 --> 00:46:48,920 It wasn't so much AI mean. First of all, this is a 722 00:46:48,920 --> 00:46:54,960 documentary and it wasn't like fiction like it was an actual 723 00:46:54,960 --> 00:46:58,000 thing about actual events with some people that we know in it. 724 00:46:58,000 --> 00:47:02,640 But had you heard of a most wanted teen hacker on HBO? 725 00:47:02,640 --> 00:47:05,720 Yeah, I mean, that was I watched that during maternity leave. 726 00:47:05,720 --> 00:47:07,200 That was kind of interesting to watch. 727 00:47:07,200 --> 00:47:12,680 It was a four part series. And yeah, there were it. 728 00:47:12,800 --> 00:47:16,200 It was one of those things where like I I like watching hacker 729 00:47:16,200 --> 00:47:19,200 movies because they don't hit too close to home. 730 00:47:19,200 --> 00:47:24,440 Like like you're just like, oh, like this is a feel good, like 731 00:47:24,440 --> 00:47:28,000 culturally like significant movie. 732 00:47:28,000 --> 00:47:31,160 And then I was watching this and I was just like, I remember 733 00:47:31,160 --> 00:47:33,680 writing about that. I remember looking at that. 734 00:47:34,000 --> 00:47:37,880 Like very much so, yeah. And then like you said, there's 735 00:47:37,880 --> 00:47:41,120 just people that we know, like on screen you're like, oh God, 736 00:47:42,040 --> 00:47:45,840 wait, I know her. Yeah, it's it's a little too 737 00:47:45,840 --> 00:47:47,600 close to home. That is a good one, though. 738 00:47:47,640 --> 00:47:51,680 That's. Yeah, that's kind of, yeah. 739 00:47:52,440 --> 00:47:56,600 The true ones are a little bit like I tend not to like those as 740 00:47:56,600 --> 00:48:00,960 much just because for the reason you just explained, like you 741 00:48:00,960 --> 00:48:04,680 need some kind of escape, like I need to see the ones and zeros 742 00:48:04,680 --> 00:48:08,960 flying through the air to make it, you know, unrealistic to to 743 00:48:08,960 --> 00:48:11,680 put me at ease. Or you know, we were talking 744 00:48:11,680 --> 00:48:17,680 about the pit a few weeks ago on here in the cyber aspects of 745 00:48:17,680 --> 00:48:20,800 that which I don't. You're caught up right? 746 00:48:20,800 --> 00:48:27,720 Like you've seen. OK, so they kind of forgot about 747 00:48:27,720 --> 00:48:30,720 it for like a week. They just were like, OK, I mean, 748 00:48:30,720 --> 00:48:34,040 which is plausible because the show is just hour by hour, 749 00:48:34,040 --> 00:48:36,880 right? But this past episode I'm. 750 00:48:37,200 --> 00:48:40,640 Just I'm laughing because I know exactly like you're going to 751 00:48:40,760 --> 00:48:44,240 talk about. They just kind of were like they 752 00:48:44,240 --> 00:48:47,600 said, OK, well, the other two hospitals paid the ransom, so 753 00:48:47,600 --> 00:48:50,200 we're just going to bring our network back online and we feel 754 00:48:50,200 --> 00:48:54,280 good about that. And a even if you pay the rent, 755 00:48:54,280 --> 00:48:57,160 if those hospitals paid the ransom, good for them. 756 00:48:57,440 --> 00:49:00,400 That does not mean that anything is coming back online anytime 757 00:49:00,400 --> 00:49:02,880 soon over at those hospitals. Right. 758 00:49:03,240 --> 00:49:06,280 And you bring your network back up. 759 00:49:06,680 --> 00:49:10,440 If the hackers were in your network beforehand and you turn 760 00:49:10,440 --> 00:49:13,240 it back on, guess what? Kaboom. 761 00:49:13,480 --> 00:49:18,440 Like they're like, I don't know. That's funny too, because Nurse 762 00:49:18,600 --> 00:49:25,000 Dana was like, she was like, she what did she call it? 763 00:49:25,000 --> 00:49:27,080 She was like, the cyber conflict is over. 764 00:49:27,160 --> 00:49:29,000 And I was like, it's not a conflict. 765 00:49:29,080 --> 00:49:30,960 Like no. Hospitals were attacked. 766 00:49:31,200 --> 00:49:33,440 What did she you screenshotted it? 767 00:49:33,840 --> 00:49:36,440 You screenshotted it on Twitter? It was something about like 768 00:49:36,440 --> 00:49:38,040 these cyber assholes or something. 769 00:49:38,040 --> 00:49:39,720 Like this I was like that is perfect. 770 00:49:39,960 --> 00:49:41,640 Yes, that's what it was. Yeah. 771 00:49:42,000 --> 00:49:43,400 Yeah, right. But she did. 772 00:49:43,400 --> 00:49:45,120 She was like the cyber conflict is over. 773 00:49:45,280 --> 00:49:49,000 Like what's the conflict like? You guys just turned your power 774 00:49:49,000 --> 00:49:51,480 off like I don't. But that was, you know what? 775 00:49:51,480 --> 00:49:53,240 I give them props. That's realist. 776 00:49:53,240 --> 00:49:56,960 Like, realistically how probably like someone who didn't 777 00:49:56,960 --> 00:49:59,600 understand cybersecurity would talk about all these things, 778 00:49:59,600 --> 00:50:04,560 like just being like, yeah, the cyber conflict, it's done and 779 00:50:04,560 --> 00:50:07,720 we're all safe now. So yes, that's exactly right. 780 00:50:07,720 --> 00:50:11,440 Those are the kind of, you know, calls and texts we get from, 781 00:50:11,440 --> 00:50:14,920 like, our parents that are just like, I heard there's a cyber 782 00:50:14,920 --> 00:50:16,440 war. Is that true? 783 00:50:17,360 --> 00:50:19,720 I don't know. What are you talking about? 784 00:50:20,000 --> 00:50:22,920 Be specific because probably which one? 785 00:50:23,640 --> 00:50:24,800 Yeah, right. Exactly who? 786 00:50:25,440 --> 00:50:27,720 Tell me who, which two parties you're talking about. 787 00:50:27,720 --> 00:50:29,120 And I'll tell you what, if you're right. 788 00:50:30,680 --> 00:50:31,600 Yeah. OK. 789 00:50:32,320 --> 00:50:35,160 Well, that's been our movie and TV portion of the podcast. 790 00:50:35,160 --> 00:50:40,960 So again, if you're in Austin, come see me and all the great 791 00:50:40,960 --> 00:50:43,640 material security folks next Tuesday. 792 00:50:43,640 --> 00:50:47,200 It's at the Alamo Draft House, which is, I've never actually 793 00:50:47,200 --> 00:50:48,720 seen a movie in one of those. I'm excited. 794 00:50:49,200 --> 00:50:52,120 It should be super cool. Like they have the awesome 795 00:50:52,120 --> 00:50:54,280 reclining chairs and all that kind of stuff. 796 00:50:54,280 --> 00:50:57,520 So beats the hell out of the movie theater at the mall that I 797 00:50:57,520 --> 00:51:00,200 go to. Yeah, A. 100%. 798 00:51:00,520 --> 00:51:02,960 Yeah, All right, Linds, great to see you. 799 00:51:02,960 --> 00:51:05,360 You too. All right, talk to you soon. 800 00:51:05,520 --> 00:51:05,720 Bye.