Welcome to the Decipher podcast. It's a week lens where we had a
name vulnerability which we it's been a while since we've had one
of those. Always fun.
Yeah, especially around the holidays, it's a good time to to
get a like, you know, log for J or something like that over
Thanksgiving weekend here in the US, it's perfect time to to drop
a really serious bug I. Know that's that's always fun to
see. Was it react for shell or react
to shell? I've seen both.
I've seen. Yeah.
So we have two names for the same bug, which also happens
quite often depending on who names them and things.
It's getting to be like the threat actor naming conventions
where you're like, you need one of those like Always Sunny in
Philadelphia, like cork boards with like the strings and like,
how does this connect to that? I mean, we can get into that
later on. Who's exploiting this bug?
But at least this it's only two things and you can kind of you
get what the idea is. Yeah, yeah, it is.
It is always funny. I feel like, you know, the
researchers will come out and they'll be like, I dubbed this
like, you know, log for shell. Right.
It's like a, a nighting ceremony or something.
I dub the React for shell. Yeah, got it.
Yeah. So I by this point, I'm sure
everybody is aware of the bug we're talking about.
It's a, you know, 10 out of 10 unauthoricated remote code
execution bug in React to React framework or React library and
the Node library, which are, you know, extremely popular
JavaScript libraries. And the initial disclosure to
the developers was on November 29th, which is over the weekend
here. And the public disclosure I
believe happened on Wednesday, so or excuse me, December 3rd.
So a few days, but very quick turn around between initial
disclosure and public disclosure and fixed versions and all that
kind of thing. But the bug itself is obviously
very serious and the two vulnerable libraries are
extremely widely deployed. These things are everywhere,
especially React. You know, it's in like 40 or 50%
of apps. It's it's all over the place.
And we were just talking before we started recording, I was
looking at some of the stats on how many people have updated so
far and they're not good. It's the, the numbers are very
low. The percentage of people that
have been able to to update the their apps to fix versions of
the library is not great right now, which you know, after 48
hours isn't shocking. But given the nature of this bug
and how many serious level headed researchers in threaten
tell people we've seen saying, hey, hey, hey, this is not a
drill. Go fix this like right now you I
would expect a little more urgency from folks.
But it might also be the case where these libraries are in
places that are not easy, easy to update to.
You know some of these apps you might not be able to update
right away. Yeah, that's kind of what I was
gonna. What I was thinking is kind of
the the rollout of patches is going to be a little bit slower,
I'd imagine because of that reason you just mentioned.
And this one's tough too, because we're, you know, Amazon
also came out and has said and a few other researchers that, you
know, at this point, obviously threat actors are trying to
exploit this. And it's it's, you know, fairly
easily exploitable for the most part.
So I mean, this is one of those ones where the pace at which
threat actors are moving is going to be a lot faster than,
you know, the time it takes for organizations to, A, become
aware of this honestly. B be able to kind of find and
understand where this fits into their own internal environments
and then see actually, you know, roll out the patch.
So I think it's just one of those tricky situations.
And then of course, you've got all these fake PO CS flying
around Twitter. Got to love that.
I yeah, that's such a weird phenomenon to me.
Like I, it's a, it's like a childish thing of like, hey, I
was there first. Look what I did.
But then I mean, some of them in past cases have turned out to be
malicious, like they're essentially like malware loaders
or something. But I think in some of these
cases, it's just like people thought they had PO CS and
they're not. But like the guy that disclosed
the bug has a thing on his site like saying look we've seen a
bunch of fake or invalid PO CS and it's such a weird thing.
Like I don't, I don't really understand what the point of
that is. Yeah, I think it is like to your
point, it's partially like in my in my personal opinion like
probably for clout a little bit. And then also there's not really
I, I wish there was more of a discussion around the exposure
or disclosure, I guess of PO CS in the security industry.
Like I think there's, it's, it's something that needs to be done
responsibly. And like, you know, obviously
UCS have played a valuable part in kind of vulnerability
disclosure and management and all that.
But then there's also a tricky situation in times like these.
I mean, it's definitely an interesting topic.
And then when you have these fake ones, it's just like you're
sending research, you know, basically like security teams
down, down the wrong rabbit hole and taking valuable time away
when they're already at a time crunch for something important
like this. Yeah, it's a weird thing because
sometimes like the thing that you just described is like
sending security teams down the wrong path or something like
that. This the researcher who
disclosed the vulnerability, whose name is Lachlan Davidson,
I hope I'm pronouncing Lachlan correctly said that some of the
PO CS are, you know, would likely produce false negatives.
So if you're running the POC and it says, oh, you know, it
doesn't work against your app or your, your endpoint or something
be like, OK, cool, we're, we're good.
But some of them aren't aren't, you know, valid.
They're they're looking at the wrong thing or testing the wrong
thing. So you might have a, you know, a
false negative, which is in this case much more dangerous than a
false positive. Yeah, yeah, My conspiracy self
wonders if, you know, maybe threat actors are like launching
some sort of POC disinformation campaign or if that's something
they're going to be doing in the future if they're not already
so. I love this.
You've been hanging out with me and donning you too much for
these conspiracy theories. I like it.
I know. Yeah, it's so the bug itself is
obviously very dangerous. And almost immediately, as you
mentioned, Amazon's threat Intel team came out with a blog
describing exploitation activity from some China aligned threat
groups. And I have to say we the threat
actor naming conventions, we could do an entire podcast on
that whole thing. But the ones in Amazon's blog
post, which came out yesterday, I believe two of the, I don't
know what these are Earth Lamia, LAMIA, don't know what that is,
never seen it. And Jackpot Panda.
Jackpot Panda, I kind of enjoy that name.
The other one, I don't know what the hell that is, but two
Chinese aligned threat groups already out there exploiting
this. I'm sure there's more, I'm sure
there's individual actors doing this, but the Chinese threat
actors are almost always the quickest and you know, a lot of
times most successful when they're jumping on things like
this. They have a lot of resources at
their disposal and they will sometimes pull those resources
even among, you know, state backed ACT, state backed actors
and contractors and that sort of thing just to get a jump on
these. And that seems to be what we're
seeing right now. Yeah, it's, I think it's really
interesting just the operational alignment for a lot of these
Chinese, you know, threat groups versus when you look at that
stacked up to where we're at on the defense side for something
like this, which is still even just in the beginning of the
roll out of the patches. So it's, it's definitely a
bigger overarching issue that we deal with when we, when it comes
to kind of more widespread vulnerabilities like this.
You know, there's a little bit of a lag, I guess behind how,
how easily threat actors are able to jump on this.
Yeah, this bug has brought up a sort of one of the things that I
think we've written about and talked about for many years.
And lots of people in the security community have talked
about too, which is the value. Value is not the right word, but
patching something like this, you know, going through a fire
drill like this when something very serious gets disclosed
versus a comprehensive security program that is trying to
mitigate risk, you know, as a broader thing on a, on a
constant on a continuous basis, You know, trying to figure out
ways where something like this wouldn't even if you have
vulnerable apps, they wouldn't be reachable or things like
that. You know, the broader idea of
risk mitigation versus running through these, you know, react
and patch, God, no pun intended there.
That's so bad. These, these patching fire
drills all the time, which we see, you know, not weekly, but
pretty regularly, at least monthly on very serious bugs.
And that's, you know, it's an easy thing to tell people tell
organizations to go do that, But a lot of orgs don't have the
money or people to do those things.
You know, it's, it's really tough.
Even, I mean, you were mentioning there was a
Cloudflare outage last night, which you know, isn't connected
to an attack, but they were, they were their logs were
essentially like overwhelmed because of this, which is like
an insane thing to think of for Cloudflare.
Right to check. All the resources on the planet,
literally. Yeah, I know.
Yeah, They said that the root cause was disabling some logging
to help mitigate this week's React CV.
So it's yeah. Yeah, if they can't, if they
can't do it, I don't know who can.
Yeah, I know. But that's I think you bring up
a a good point for sure. I think organizationally and
like strategically, it's really difficult for a lot of companies
too, just because I mean, we saw and maybe we saw that this seems
like it was a little more like of a well known thing.
But like even back with a log 4J or things like that, like even
being able to understand like you don't even know what's out
there in your in your environment for a lot of these
different types of vulnerabilities.
So I think, I think it's just tough to be able to plan ahead
for that a lot of times. I mean, if anything, I guess
it's planning ahead for what you don't know and trying to best
prepare yourself on that front. Yeah, which is a really
difficult theoretical thing to do.
You know, the the unknown unknowns or whatever that phrase
is. Like it's also a question of
resource allocation for even for, you know, an organization
with a mature security team and a lot of financial and human
assets to throw at a problem like this.
Do you throw them all at this problem or you probably have
other attacks and other things that you're worried about as
well? It's not all one thing, you
know, there's, there's always a variety of problems to deal
with. So you know, even a a good,
fast, mature security team isn't always going to be able to react
quickly to something like this. Yeah, I did see a post from
Kevin Beaumont that was talking about how basically this, the
flaw applies to React 19, which was I think he said it was
released in the past year. And then it applies when you're
using React server components, which are also fairly new.
So like, I wonder too, in terms of just the overall like when
we're talking about a tax surface and like how
organizations can approach this, like maybe that might help like
cut back a little bit on trying to understand how what the
impact is. But that said, like, you know,
it's hard to even track those different types of versions and
all of these different types of, you know, things and whether you
do have kind of that React server components and where
those are so. Yeah, it's.
Kind of a mess. No, it's absolutely.
And you know, the, the Chinese exploitation part of this is
interesting. It's, it's kind of what you
would expect honestly, as we mentioned before.
And it kind of plays into a separate story that you wrote
this week on some lawmakers and other folks getting a little
worked up that maybe our telecom networks aren't, you know,
completely secure, which is a hilarious thing to think about.
Like, you know, but this is like kind of pegged to the one year
after the the Salt typhoon intrusions were exposed, you
know, something that was well known in the security community
beforehand, but you know, became public about a year ago when the
government woke up and was like, what?
Wait a minute, There are there are foreign actors in our
telecom networks. What are you talking about You?
Would have known. Who could see it coming?
Yeah, that was, I remember, I think I covered that and maybe
you covered part of it too. But the that the reaction to
that was one of those ones where, you know, you and
senators like blast putting, you know, different telecom industry
people on blast. Oh yeah.
Things of being like, we like, you know, we're not going to
stand for this. And so just like as background
context, this was the salt typhoon targeting of, you know,
all those different telecom vendors.
I think it was like AT and TT mobile, like all the, you know,
big ones. And then that led to them being
able to access, you know, some communications that were related
to government officials. And then also like obviously all
the like Americans, you know, that different type of data too.
So it was not great. And one of the things that came
out of that which, you know, we talked about this I think on the
last podcast we did two weeks ago was the FCC coming out.
I think it was beginning of this year, January and saying, hey,
we're going to start implementing some some new rules
for these for communications infrastructure companies in
order to better address security risks and be able to like
bolster those types of measures. And then Fast forward to
November there, the FCC reversed that ruling.
Yes, so. And what's happened between
January and November, Lindsay? Yeah, yeah.
What's? Changed.
So, so the so anyways, all that to say, that was like one of the
the big points of discussion during this hearing that I
listened it on earlier this week on Tuesday.
It was basically kind of a culmination of some government
officials and then also some private sector folks, which, you
know, I always like that because it's, it's good to hear out of
their own, you know, mouths like how a private sector is like
dealing with this, like what their, what their opinions are
on it. So we got to hear from a couple
of different people that were either working at telecom
companies or who were part of kind of an alliance that was,
you know, supporting that industry.
So, you know, it was interesting, you know, you kind
of got the arguments on both sides that you would have
thought and that we talked about on the podcast last time, which
is, you know, on the on the pro side of the FCC reversal.
People were saying, you know, this is prescriptive, it's
ineffective. It doesn't hold up to the
environment of how like telecom organizations are operating
today. And then the critics were coming
back and saying, well, now we don't have any sort of
understanding publicly of like how telecom companies are, you
know, aligning to standards set in place about security and how
we can address threats like Salt Typhoon.
So it was, yeah, there was a lot of talk around that.
One of the, I don't know if they discussed this in that specific
hearing, they they almost always do.
Somebody from the telecom side will will explain this, but one
of the big problems is the telecom networks, like most old
networks, are extremely heterogeneous and have extremely
old hardware and software in places that they can't be
swapped out or, you know, upgraded in a lot of cases.
You know, some of the the stuff that some of the attacks that
that we've seen against telecom networks take take advantage of
bugs in software that people have never heard of because it
was implemented like 45 years ago or things like that.
So there's always that underlying issue of, OK, this is
a really rapidly aging network. You know, the obviously the
front end of it is upgraded all the time with, you know, 5G and
all that kind of stuff that they're always trying to get us
to buy new devices for. But the a lot of the underlying
infrastructure is real old and, you know, not fixable in a, in
a, you know, broader sense. Yeah, I think it's really
important to to note that because it is really easy from
kind of the security industry like almost bubble to be like
you need to apply these, you know, checklist basically of
like different standards that make sense from a if, if you're
in a environment that maybe is more a standard business
environment. But like to your point, if you
are in like a very specialized critical infrastructure
environment, it's going to be very, very different.
And when you're dealing with those issues, obviously you need
to be dealing with them and, and being able to secure those.
But it's, it's going to have to be in a very different way than
kind of what what most people are used to within our industry
when they're talking about these things.
And they talked about that a little bit in terms of the need
for like a meeting of like a better understanding of standard
when we talk about standards and things like that.
So. You know, I thought there was,
there was a lot of different advice that was thrown around
and, you know, I appreciated the the brainstorming and like all
these different things. But there was, you know, there
was talk of everything from like, you know, all the same
things we've really seen people discuss like cultural shifts or,
or like threat intelligence sharing, public private
collaboration, all those different things.
So you know, I personally I didn't walk away from the
meeting like fully understanding like if there was 1 correct
action that like everyone totally agreed on.
I guess like maybe info sharing but.
Oh good, it's. Like easiest thing to do moving
forward. And I think it's just like a
broader recognition to your point is needed about like that
there is like a very specific internal environment for a lot
of these organizations. And like how do we, how do we
come together and like understand how we can kind of
have both security and then also like understand that there's
very custom requirements that businesses in that industry need
to kind of be so? And the other sort of related
part of that is these big telecom companies are companies.
They're, you know, they're enterprises.
They are not government agencies.
And but the networks that they operate are essentially critical
infrastructure for the nation and are treated as such by the
government. So they sort of have this like
government oversight in a lot of ways that can be, you know, kind
of onerous, but also in other ways their businesses that have
to run like businesses, you know, they have to have to turn
profits. They have to, you know, compete
against each other, even though in a lot of cases they are
cooperating and, you know, in certain ways as well.
So it's a weird sort of dynamic among the companies themselves
and also between the companies and the government because they
get treated like, yet you're part of a government agency
because you're, you know, everything you do like the
nation's business depends on these networks running, you
know, efficiently and being up all of the time.
If there's and, you know, a billionth of a percent of
downtime in any of these major telecom networks, people lose
their shit, you know, and it's a it's a weird dynamic.
There's no real way around it. Like we're not going back to
government owned, but actually I take that back.
I don't know. I I don't know.
Yeah, let's hope we're not going back to government owned telecom
infrastructure, but who can say? That's a good point too.
And you know, we see that with a lot of even, I mean we're
talking about these massive orgs right now, but this is, this
applies to a lot of different sectors within that are
categorized as critical infrastructure.
And like, for instance, even like, you know, local water
utilities or things like that, there's a lot of pressure now
to, you know, now that those have been categorized under
this, this particular, you know, sector that SISA has put it, you
know, under something that is really important when it comes
to cybersecurity. There's a lot of pressure for
them. But then at the same time, it's
not like tit for tat, but you know, when you look at kind of
more of those local water utilities, like they still have
their own way that they need to get budget, which is, you know,
through kind of these local processes.
So it's Oh yeah. Interesting the different
dynamics there that need to go into play.
Yeah. And another thing, just like the
the water utilities, these large telecom networks are not a
network in the sense of like they're wholly, you know,
discreet things. They're built up of pieces of
little regional telecoms that were, you know, absorbed over
decades, you know, little regional like New England
telecoms and Midwest telecoms and all that kind of stuff that
had their own infrastructures and ways of doing things and
processes and all that kind of stuff.
And that's all happened over time.
So it's not like one thing, you know, the, the AT&T network is
not like a homogeneous thing that they, you know, that all
operates the same way. It's, you know, it's a weird
kind of Frankenstein's monster of things.
Yeah, Yeah, that's, that's a good point.
And then looking at the other side of the coin, when, when
we're talking about Salt Typhoon and these, you know, different
threat actors that have been targeting these networks, the
like, the thing that I think could have been discussed more
was like just this extreme persistence of, of these threat
actors. You know, I don't like, I,
we're, we're not ready for that from, from the communications
infrastructure side of things. And like, I, I think that's what
worries me most is just like exactly how long and like easy
it is for Chinese threat actors right now to stay in, in these
networks. I mean, they're probably in
there right now, so. Yeah.
I mean, yeah, we've talked about this a million times, but the
thing that maybe some of these legislators and lawmakers and
regulators don't may not understand, some of them do.
But this is a job for those threat actors.
You know, many of them, especially the the Chinese and
Russian and North Korean ones are employed by their
governments to go and do this thing.
You know, this is their job that they get up and do every day for
8 hours or 10 hours is to find a way into US or other Western
telecom networks and sit there and be pre positioned for
whatever operations may come next.
That's that's what they do, you know, and it's a weird thing to
explain and be like, yes, there are offensive cyber teams all
over the world that, you know, just get up everyday looking for
ways to attack us. You know, the parallels with
like military are not exact. They're always used, but they're
not. We don't just have foreign
armies pre positioned on, you know, in like Louisiana or North
Dakota all the time, as far as I know.
But we do have foreign threat actors in our networks at all
times. And it's just one of those weird
things you have to wrap your brain around and be like,
they're here. We just have to find a way to
mitigate their access. And you can try and eject them,
but they have they've shown over and over again that they don't
find a way back in. Yeah, even the SYSA advisory
that I think it was yesterday or the day before on on Brick Storm
that came out basically warning that Chinese threat actors have
been targeting Gov orgs in the tech sector with this malware,
which, you know, they described as sophisticated that
essentially has enabled threat actors to, I think they said
achieve persistent access an average of 393 days.
That's not good. It's not what you want.
That's a long time. It's a really long time.
Yeah, so and I think, you know, it's, it's a good point that
these are, this is their full time job is like trying to
figure out the best way to maintain that access because
that level of persistence is is extremely valuable for threat
actors. Yeah.
You know, think of all the things that they can collect and
you know, data isn't an information, it's not it's, it's
constantly changing and like being able to stay on top of
that is is really valuable. So.
Yeah. I mean, they can sit there and
depending on their level of access, look at, you know, the
way that the network is changing, the way that personnel
is changing inside the organization, what they're, you
know, patching levels are how they're thinking about their,
you know, annual budgets and all that kind of shit.
It's just, you know, 390. I mean, by my math, that's more
than a year. I think that's a long time.
Yeah. Yeah, it is.
You'll. Get a full FCC role enabled and
then reversed in that time. We sure did.
Yeah. It's wild what can happen inside
of a year. Yeah.
All right, so between now and Christmas, which is holy shit,
three weeks away, I'm sure we'll do a couple more of these
podcasts, but also some more movie podcasts.
We were talking about doing Die Hard, which I'm one of the
people that is like, this is not a Christmas movie.
So it's a movie that take place at Christmas, but we can save
that for the podcast. But so we'll do that in the next
week or two. Are there any?
I was thinking about Home Alone because it's been on all the
time and it's such a like delightful, like, you know,
social engineering isn't the right word.
I guess it is, but that could be a fun one too.
Yeah, I think so. I love home alone.
Home alone too. Yeah, Home Alone too I think is
honestly more of my favorite. Yeah, aside from the bird lady
who just freaks me out, I can't like the pigeon lady.
Just every time she's on screen, I'm just like, oh.
Man is what's who's the better side character, the pigeon lady
or the old man in Home alone The.
Old man, I always forget about him in the in the home alone
every time. I'm like fight.
With his. Son, why is this like Dickens
ghost guy shoveling snow and showing up in the church and
being a weirdo? I always forget about it.
Yeah, I don't know. He freaks me out too, honestly.
Yeah, both of them scary. Characters.
Yeah, and his name is literally Marley, right?
The old man. I'm pretty sure it is.
Yeah, just like in A Christmas Carol.
Yeah. I don't.
I don't know. They both weird me out.
John Hughes. Interesting dude.
But yeah, I don't know. We could.
We can talk it out. I don't know which one we
should. I think the first Home Alone is
maybe the more like, although he does a lot of damage at the
townhouse in in home loan too too.
So that's, yeah, I maybe we could put it up to vote on
Twitter or something, see what more people want, yeah.
I do feel like I don't know about your generation but like
my kids like home alone too more.
It's like their thing. Yeah, I don't know if it's like
a generational thing, but personally I like the New York
City. Like I like the vibe of New York
more. So yeah, I mean, I'm, I'm down
for both, for either. Do both.
Yeah. I mean, the the first one is
obviously it's like it's set in Chicago in the same like area of
every John Hughes movie from the 80s.
You're like, OK, Ferris Bueller probably lives around the
corner. Like, you know, the pretty and
pink kids live down the street or whatever it is.
It's like OK. Massive houses by the way where
like 6 kids live in one like. Their house is crazy.
That thing is so weirdly The thing is filmed in.
Like the town that my mom is from.
Really. Yeah, all.
They're all filmed in this little suburb outside of
Chicago. But the the old man in Home
Alone one, we're getting sidetracked here.
But the old man, he lives by himself on that same St. like
next door to the Home Alone family.
Like, how is he affording that? Their house is like a $9 million
house. He's just.
He looks like he's barely hanging on.
I don't. Yeah, I I think it's time to go
to retirement. Yeah, also houses way more
affordable in the 80s kids. Yeah.
Oh, must be nice. Yeah.
Oh man. Yeah, born too late.
We. Can discuss during the podcast.
Oh, we will. We're.
In cybersecurity conversations. That's right, housing prices and
old men. Yeah, yeah.
All right. Well, good to see you.
Have a good weekend and talk to you next week all.
Right, see you in tennis. Bye.