1
00:00:12,960 --> 00:00:17,200
Welcome to the Decipher podcast.
This is a quick podcast that 

2
00:00:17,200 --> 00:00:22,240
we're doing on Tuesday morning 
or Tuesday afternoon. 

3
00:00:22,240 --> 00:00:24,960
I guess it's been a long day for
both of us. 

4
00:00:24,960 --> 00:00:28,680
I think Lindsay and we're going 
to be talking about this Axios 

5
00:00:28,680 --> 00:00:34,360
MPM supply chain compromise that
I guess happened Sunday night 

6
00:00:34,360 --> 00:00:37,160
into Monday morning, but came to
light today. 

7
00:00:38,560 --> 00:00:43,520
And it's a really, it's a very 
simple story, but also like it 

8
00:00:44,400 --> 00:00:46,480
complex at the same time, if 
that makes any sense. 

9
00:00:46,480 --> 00:00:49,800
Like a lot of supply chain 
stories are. 

10
00:00:50,320 --> 00:00:54,400
And we've seen a lot of supply 
chain compromises in the last 

11
00:00:54,400 --> 00:00:58,400
like 10 days. 
It's something like that. 

12
00:00:58,400 --> 00:01:05,280
And this one does not seem to be
at the moment connected to the 

13
00:01:06,720 --> 00:01:11,400
chain of them that we've seen 
from is it team PCP, Am I 

14
00:01:11,800 --> 00:01:13,640
getting accurate? 
OK, going off memory here. 

15
00:01:13,640 --> 00:01:17,560
Yeah, it doesn't seem to be 
connected to those right now. 

16
00:01:17,560 --> 00:01:23,200
This seems to be a standalone 
incident, but this is I I woke 

17
00:01:23,200 --> 00:01:26,040
up this morning and 
unfortunately looked at Twitter 

18
00:01:26,160 --> 00:01:33,680
like an idiot and saw all of 
this like detonating and it's 

19
00:01:34,280 --> 00:01:36,080
the. 
The facts of the thing are very 

20
00:01:36,080 --> 00:01:39,760
simple. 
Sometime in there was about a 

21
00:01:40,160 --> 00:01:45,280
somewhere between A2 and a three
hour window where an attacker 

22
00:01:45,280 --> 00:01:50,720
was able to gain access to the 
GitHub and MPM accounts of one 

23
00:01:50,720 --> 00:01:56,160
of the maintainers of this axios
package and inserted A 

24
00:01:56,160 --> 00:02:02,160
trojanized package that became a
dependency and for two different

25
00:02:02,160 --> 00:02:03,520
versions. 
We'll we'll get to that. 

26
00:02:03,520 --> 00:02:08,199
There were two malicious version
versions and this is one of 

27
00:02:08,440 --> 00:02:11,039
probably. 
I don't know how to quantify 

28
00:02:11,039 --> 00:02:15,520
this, but this is one of the 
more popular MPM or JavaScript 

29
00:02:15,520 --> 00:02:18,080
libraries anywhere. 
It has more than 100 million 

30
00:02:18,080 --> 00:02:20,160
weekly downloads, which is 
massive. 

31
00:02:20,200 --> 00:02:27,800
Obviously it's a huge part of a 
lot of JavaScript applications 

32
00:02:27,840 --> 00:02:32,200
and programs. 
So anybody that had, you know, 

33
00:02:32,200 --> 00:02:35,840
their apps set to auto update 
and download new versions of 

34
00:02:35,840 --> 00:02:38,880
this library every time there's 
one available might have gotten 

35
00:02:38,880 --> 00:02:44,480
hit with this in that two to 
three hour exposure window. 

36
00:02:44,960 --> 00:02:51,000
And once the package was 
installed, it ends up installing

37
00:02:51,000 --> 00:02:53,480
a payload. 
And it was cross-platform. 

38
00:02:53,480 --> 00:02:56,960
There was a, a Unix payload, a 
Mac OS payload and a Windows 

39
00:02:56,960 --> 00:03:01,120
payload, all of which were rats,
remote access Trojans with 

40
00:03:01,240 --> 00:03:04,760
various capabilities, you know, 
system reconnaissance, data 

41
00:03:04,760 --> 00:03:07,520
exfiltration, all that kind of 
fun stuff. 

42
00:03:08,040 --> 00:03:11,240
And this very quickly, like 
spread across, you know, 

43
00:03:11,400 --> 00:03:16,000
Infosec, Twitter and everywhere 
else and is turned into a pretty

44
00:03:16,000 --> 00:03:19,640
big deal. 
And I think not, you know, 

45
00:03:19,640 --> 00:03:21,320
there's two factors. 
One, it's a very popular 

46
00:03:21,320 --> 00:03:23,920
library. 
And two, there was, there's just

47
00:03:23,920 --> 00:03:27,440
been this string of supply chain
attacks in the last 10 days that

48
00:03:27,440 --> 00:03:30,480
I think have everybody on edge. 
You know, this is just kind of 

49
00:03:30,480 --> 00:03:35,160
the the cherry on top of a a 
crap sundae that we've been 

50
00:03:35,160 --> 00:03:39,000
dealing with for a while. 
Yeah, it's funny cuz we covered 

51
00:03:39,000 --> 00:03:45,120
the team PCP kind of slew of 
supply chain attacks last week. 

52
00:03:45,160 --> 00:03:49,520
And they had, you know, if, if 
our viewers recall, they had 

53
00:03:49,560 --> 00:03:54,040
kind of targeted a bunch of 
different, you know, things like

54
00:03:54,040 --> 00:03:57,680
trivia and then some of these 
other ones and had jumped from 

55
00:03:57,680 --> 00:04:00,160
one to the other. 
And so seeing this, I think a 

56
00:04:00,160 --> 00:04:02,440
lot of people were like, is this
team PCP? 

57
00:04:02,440 --> 00:04:05,000
But no, it seems like this is 
different. 

58
00:04:05,000 --> 00:04:08,480
And I think I've seen Mandiant, 
Google Mandiant came out and 

59
00:04:08,480 --> 00:04:12,880
Elastic and they had attributed 
it to the DPRK. 

60
00:04:12,880 --> 00:04:16,839
I'm not sure where that, you 
know, where the direct 

61
00:04:16,839 --> 00:04:21,600
attribution kind of clues are 
coming from there, but it, it 

62
00:04:21,600 --> 00:04:25,560
has been really something that 
is keeping people on edge, as 

63
00:04:25,560 --> 00:04:28,480
you said. 
And you know, supply chain 

64
00:04:28,480 --> 00:04:31,160
attacks, you know, not new at 
all. 

65
00:04:31,160 --> 00:04:36,440
But it, it's such a big kind of 
punch in terms of how it impacts

66
00:04:36,920 --> 00:04:40,080
people and the downstream 
trickle, downstream trickle 

67
00:04:40,080 --> 00:04:41,560
effects. 
And even on this one you 

68
00:04:41,560 --> 00:04:46,320
mentioned this has like 100 
million weekly downloads, which 

69
00:04:46,320 --> 00:04:48,160
is just the scale of that is 
insane. 

70
00:04:48,160 --> 00:04:52,120
So even if it was, the exposure 
window was like 3 hours. 

71
00:04:52,120 --> 00:04:55,720
Like it's still such a big kind 
of blast radius there. 

72
00:04:56,040 --> 00:04:58,240
Yeah, it is. 
I'm not great at math, but in 

73
00:04:58,240 --> 00:05:02,400
that three hours that could be, 
you know, hundreds of thousands 

74
00:05:02,400 --> 00:05:04,720
or millions of downloads 
potentially. 

75
00:05:05,840 --> 00:05:10,480
And I know your colleague at 
Huntress, John Hammond did a I'm

76
00:05:10,680 --> 00:05:12,480
convinced that John doesn't 
sleep. 

77
00:05:12,480 --> 00:05:15,920
I, I assume that like at some 
point he does, but I've, I have 

78
00:05:15,920 --> 00:05:19,480
no evidence of it. 
He, I know he did a live stream 

79
00:05:19,600 --> 00:05:22,200
at some point last night when 
this was all happening and then 

80
00:05:23,080 --> 00:05:25,560
recorded something that that's 
up now. 

81
00:05:25,560 --> 00:05:27,600
You can go find it on John's 
YouTube channel. 

82
00:05:27,600 --> 00:05:35,640
But he was talking about one of 
the interesting factors of this 

83
00:05:35,640 --> 00:05:42,080
is that the maintainer's account
that got compromised had MFA 

84
00:05:42,080 --> 00:05:45,440
enabled on it. 
So the the question that 

85
00:05:45,440 --> 00:05:48,680
everyone is asking is like, how 
did, how did the attacker bypass

86
00:05:48,680 --> 00:05:51,640
that? 
And John said in his his video, 

87
00:05:51,640 --> 00:05:55,760
and I'm not, I don't have the 
message in front of me, but the 

88
00:05:55,760 --> 00:05:58,960
maintainer at some point on 
GitHub said it looks like the 

89
00:05:58,960 --> 00:06:02,840
attacker somehow got access to 
my backup codes and used one of 

90
00:06:02,840 --> 00:06:08,880
my MFA backup codes to bypass, 
you know, the on device 2 

91
00:06:08,880 --> 00:06:12,480
factor. 
I I'm struggling to figure out 

92
00:06:12,480 --> 00:06:16,480
how that might have happened 
remotely. 

93
00:06:16,520 --> 00:06:21,280
And unless those things are he 
had them stored somewhere that 

94
00:06:21,280 --> 00:06:24,440
was then somehow accessible. 
I I don't know well. 

95
00:06:25,720 --> 00:06:29,160
I could have thought of as well.
Yeah, yeah. 

96
00:06:29,160 --> 00:06:32,760
Unless they were stored in an 
e-mail or something connected to

97
00:06:32,800 --> 00:06:35,520
a compromised e-mail account or 
something along those lines. 

98
00:06:36,560 --> 00:06:41,360
But you know, it, it sort of 
goes to show that this was not a

99
00:06:41,360 --> 00:06:45,040
simple operation. 
I mean, there are various ways 

100
00:06:45,040 --> 00:06:48,400
to bypass MFA. 
That's not a common one. 

101
00:06:48,400 --> 00:06:53,160
Usually it takes some version of
the victim doing something like,

102
00:06:53,200 --> 00:06:57,560
you know, like push notification
bombing where you're just like, 

103
00:06:57,560 --> 00:06:59,560
OK, fine. 
Eventually you get tired of it 

104
00:06:59,560 --> 00:07:02,640
and you and you say yes to the 
to the push or something like 

105
00:07:02,640 --> 00:07:06,440
that, or somebody calls you on 
the phone or some nonsense like 

106
00:07:06,440 --> 00:07:10,120
that. 
This kind of MFA bypass is much 

107
00:07:10,120 --> 00:07:11,560
less common. 
Right. 

108
00:07:11,880 --> 00:07:14,360
Yeah. 
I'll be curious to see kind of 

109
00:07:14,360 --> 00:07:17,600
what we learn more about that as
as this progresses. 

110
00:07:17,760 --> 00:07:21,160
And then also just the sheer 
like numbers of impact. 

111
00:07:21,160 --> 00:07:24,360
And I know you mentioned before,
you know how that might all roll

112
00:07:24,360 --> 00:07:26,280
out. 
But like what kind of, you know,

113
00:07:26,280 --> 00:07:29,240
how many organizations are going
to come out and have their own 

114
00:07:29,240 --> 00:07:32,440
kind of issues and data 
exfiltrated and what kind of 

115
00:07:32,680 --> 00:07:35,360
data breach notifications we're 
going to see because of this? 

116
00:07:36,160 --> 00:07:39,240
And I, you know, I don't think 
we'll see that information come 

117
00:07:39,240 --> 00:07:42,040
out for, you know, we'll 
continue to see that come out 

118
00:07:42,040 --> 00:07:45,200
and rolling over the next like, 
you know, days, weeks, whatever.

119
00:07:45,200 --> 00:07:50,040
But I'm very curious to see kind
of the long term impact of this.

120
00:07:50,520 --> 00:07:53,160
I think this is going to be one 
of the ones that has a long tail

121
00:07:53,520 --> 00:07:59,400
because the this library is so 
popular and the way that it's 

122
00:07:59,400 --> 00:08:04,640
used, like it's used in a lot of
CI and CD pipelines and, and 

123
00:08:04,640 --> 00:08:08,120
those sorts of things. 
So it's in a lot of cases 

124
00:08:08,120 --> 00:08:11,280
probably auto updating. 
And I think there's going to be 

125
00:08:11,280 --> 00:08:14,800
a lot of developers and probably
organizations that have no idea 

126
00:08:14,800 --> 00:08:18,680
that they were hit with this and
they may not find out for quite 

127
00:08:18,680 --> 00:08:21,760
a while. 
It could be hours to days to 

128
00:08:21,760 --> 00:08:25,560
weeks before they actually 
figure this out because not 

129
00:08:25,560 --> 00:08:30,960
everybody is paying, you know, 
close attention to security news

130
00:08:30,960 --> 00:08:33,679
like this every single moment of
their lives like we are. 

131
00:08:34,080 --> 00:08:36,919
You know, there's people 
actually building apps that will

132
00:08:37,200 --> 00:08:40,440
find out about this a few days 
from now when, you know, they 

133
00:08:40,440 --> 00:08:44,280
read a Reddit post or something.
And then it, you know, they kind

134
00:08:44,280 --> 00:08:48,080
of unwind things and figure out,
oh, God, this, this got us or 

135
00:08:48,080 --> 00:08:50,760
something like that. 
Yeah. 

136
00:08:50,840 --> 00:08:53,360
I think it's going to be one of 
those where we're going to see a

137
00:08:53,360 --> 00:08:57,960
whole bunch of, you know, stuff 
spread out over a long timeline.

138
00:08:58,800 --> 00:09:02,840
Yeah, definitely it is. 
And you know it is funny like 

139
00:09:03,640 --> 00:09:07,840
the in terms of the malware and 
you mentioned this a little bit 

140
00:09:07,840 --> 00:09:11,680
in the article that you wrote, 
but it's cross-platform as well.

141
00:09:11,680 --> 00:09:15,600
So you know as you as you said, 
it's Windows, Mac OS, Linux, 

142
00:09:15,600 --> 00:09:19,080
like it does not discriminate. 
So that's another kind of aspect

143
00:09:19,080 --> 00:09:23,040
of the proliferation I guess of 
this type of attack, so. 

144
00:09:24,000 --> 00:09:31,000
Yeah, which is that also shows 
that this was not something done

145
00:09:31,000 --> 00:09:33,840
on a whim. 
You know, this is, this is a 

146
00:09:33,840 --> 00:09:37,920
team or an individual that knows
what they're doing and has some 

147
00:09:37,920 --> 00:09:42,080
resources at their disposal. 
You know, if they can develop a 

148
00:09:42,080 --> 00:09:46,760
RAT that's cross-platform like 
that for Mac, Windows and Linux.

149
00:09:46,760 --> 00:09:48,920
I think I said Unix earlier. 
I don't know where my brain is, 

150
00:09:48,920 --> 00:09:56,120
but the, that does lend itself 
to, you know, kind of the 

151
00:09:56,440 --> 00:09:59,160
professional team aspect of 
this. 

152
00:09:59,160 --> 00:10:03,120
And you mentioned that Mandy and
I think you said Elastic are 

153
00:10:03,240 --> 00:10:05,640
sort of pointing the figure at 
North Korea. 

154
00:10:06,360 --> 00:10:08,600
I, I saw that too. 
And I think John might have 

155
00:10:08,600 --> 00:10:11,000
mentioned it in his, his video 
as well. 

156
00:10:12,200 --> 00:10:16,160
And I the one indicator that I 
saw is somebody mentioned that 

157
00:10:16,640 --> 00:10:19,760
the, there was some kind of 
malware artifact that was 

158
00:10:20,760 --> 00:10:24,960
similar to something that some 
North Korean actor had used in 

159
00:10:24,960 --> 00:10:29,560
the past. 
But I also feel like, you know, 

160
00:10:29,560 --> 00:10:31,840
North Korea has just become kind
of the go to. 

161
00:10:32,560 --> 00:10:36,480
Like if you don't have a better 
idea, like it's like the bad kid

162
00:10:36,480 --> 00:10:38,240
in your neighborhood. 
Like if somebody, you know, 

163
00:10:38,240 --> 00:10:40,680
knocked your trash can over, 
you're like, I was, it was that 

164
00:10:40,680 --> 00:10:43,360
kid. 
You know, you just kind of like,

165
00:10:43,840 --> 00:10:47,160
because like, nobody's ever 
going to argue with you. 

166
00:10:47,240 --> 00:10:49,520
Nobody's going to North Korea is
not going to come out and say 

167
00:10:49,520 --> 00:10:52,280
no, that wasn't us. 
That's not our style, You know, 

168
00:10:52,440 --> 00:10:57,640
we do that so. 
Yeah, it says I'm looking up 

169
00:10:57,640 --> 00:11:00,520
right now. 
The they it looks like some 

170
00:11:00,520 --> 00:11:05,840
researchers said the Mac OS 
binary that was delivered by the

171
00:11:05,920 --> 00:11:11,520
specific post install hook that 
they had tracked has an overlap 

172
00:11:11,520 --> 00:11:20,760
with like a back door that yeah 
and linked to that specific DPRK

173
00:11:20,760 --> 00:11:24,400
actor. 
So, but yes, I think you know, 

174
00:11:24,400 --> 00:11:30,200
given kind of the like details 
of certain amount of 

175
00:11:30,200 --> 00:11:34,440
sophistication that we're seeing
with the initial access and 

176
00:11:34,520 --> 00:11:37,520
other types of things, you know,
I guess it does make sense that 

177
00:11:37,520 --> 00:11:40,400
this would be like, you know, at
least a, a group that is 

178
00:11:40,400 --> 00:11:46,360
somewhat more like categorized 
or like fully formed than just, 

179
00:11:46,640 --> 00:11:50,880
you know, people that are doing 
this kind of offhanded so. 

180
00:11:51,120 --> 00:11:55,000
Yeah, yeah, for sure. 
And the, the timeline on this is

181
00:11:55,000 --> 00:11:59,400
really interesting. 
It's in the the blog blog post 

182
00:11:59,400 --> 00:12:02,960
that that you guys have up on 
Huntress that John wrote that 

183
00:12:02,960 --> 00:12:07,440
has like a timeline of both the 
intrusion itself as well as like

184
00:12:07,440 --> 00:12:11,600
the pre attack staging and all 
of that. 

185
00:12:11,600 --> 00:12:15,720
So that the trojanized package 
was something that didn't even 

186
00:12:15,720 --> 00:12:21,720
exist before this whole episode.
It's sort of a typo squatted 

187
00:12:21,840 --> 00:12:27,200
version of a legitimate package,
but it it just depends a name to

188
00:12:27,200 --> 00:12:29,880
the front of it. 
It's called plain crypto JS, I 

189
00:12:29,880 --> 00:12:33,280
believe. 
And you know that this was 

190
00:12:33,280 --> 00:12:36,000
created like 18 hours before the
intrusion. 

191
00:12:36,440 --> 00:12:42,000
And then, you know, researchers 
started sort of noticing this 

192
00:12:42,000 --> 00:12:46,560
thing showing up. 
And then once the the package 

193
00:12:46,560 --> 00:12:51,720
was published and put into the 
Axios versions that, you know, 

194
00:12:51,720 --> 00:12:58,280
consumed it and then went live, 
Huntress saw like infections 

195
00:12:58,280 --> 00:13:01,520
within seconds after that, which
is bananas. 

196
00:13:01,760 --> 00:13:06,040
Like that shows you like that 
auto update, you know, hamster 

197
00:13:06,040 --> 00:13:11,040
wheel that that can really turn 
into a a whole, you know, pile 

198
00:13:11,040 --> 00:13:14,040
of trouble in these. 
Cases, yeah, absolutely. 

199
00:13:14,960 --> 00:13:19,280
And that's probably what the 
attackers knew that was going to

200
00:13:19,280 --> 00:13:22,520
happen and kind of what they 
were going for, because it seems

201
00:13:22,520 --> 00:13:26,160
like it is like a quick hit and 
just kind of cast that wide net 

202
00:13:26,160 --> 00:13:29,640
and try to get those initial 
infections and as. 

203
00:13:30,000 --> 00:13:32,880
And that's that's usually the 
nature of supply chain attacks 

204
00:13:32,880 --> 00:13:35,320
anyways, instead of them being a
little more targeted. 

205
00:13:36,280 --> 00:13:39,600
And in fact, that's really kind 
of what we saw last week with 

206
00:13:39,600 --> 00:13:44,960
what Team PCP was doing as well,
which was just trying to get AS 

207
00:13:45,240 --> 00:13:48,720
big and broad of a scale of 
attack and victims as they could

208
00:13:48,720 --> 00:13:49,080
and. 
Then. 

209
00:13:49,920 --> 00:13:52,760
Kind of crunching in and not 
going for stealth really, but 

210
00:13:52,760 --> 00:13:56,280
going for like trying to get, 
just trying to get in and get 

211
00:13:56,280 --> 00:14:00,160
out. 
Yeah, that's kind of the the 

212
00:14:00,160 --> 00:14:06,640
beauty and the horror of supply 
chain attacks is they can, they 

213
00:14:06,640 --> 00:14:12,480
can have these like massive long
range effects and these huge 

214
00:14:12,480 --> 00:14:16,680
blast radiuses, as you said, 
Linds, and they can go on. 

215
00:14:16,680 --> 00:14:19,720
You know, even though this was 
the malicious packages in this 

216
00:14:19,720 --> 00:14:22,680
case were taken down after a 
couple of hours, the damage was 

217
00:14:22,680 --> 00:14:26,520
already done. 
And, you know, this attack was 

218
00:14:26,520 --> 00:14:28,760
obviously planned in advance and
they knew what they were doing 

219
00:14:29,720 --> 00:14:34,040
to a certain extent. 
And I don't know what their 

220
00:14:34,040 --> 00:14:36,040
ultimate goal was. 
You know, they might have had, 

221
00:14:36,440 --> 00:14:40,880
you know, some specific 
organization or app in mind or 

222
00:14:40,880 --> 00:14:44,640
something like that and just 
decided this was like the the 

223
00:14:44,680 --> 00:14:47,600
way to go. 
But supply chain attacks can, 

224
00:14:47,680 --> 00:14:53,520
you know, have really, really 
long, you know, tails and 

225
00:14:53,960 --> 00:14:56,560
tremendously broad downstream 
effects. 

226
00:14:56,720 --> 00:14:59,720
And, you know, they can be a a 
huge bang for your buck if 

227
00:14:59,720 --> 00:15:01,600
you're the threat actor on the 
other side of it. 

228
00:15:01,920 --> 00:15:04,480
We've seen that like there's 
still effects from solar winds 

229
00:15:04,480 --> 00:15:07,680
happening now. 
You know, you'll, if you, if 

230
00:15:07,680 --> 00:15:10,600
you're bored on a weekend, go 
look up SEC filings. 

231
00:15:10,600 --> 00:15:14,280
You'll still see like people 
reporting damage from the solar 

232
00:15:14,280 --> 00:15:16,840
winds attack like in the past 
fiscal year. 

233
00:15:17,240 --> 00:15:23,320
And that was what 2021 or two 
like that, that is still 

234
00:15:23,320 --> 00:15:27,240
happening, you know, and some of
the other supply chain attacks 

235
00:15:27,240 --> 00:15:29,160
that have happened in the in the
last few years. 

236
00:15:29,160 --> 00:15:35,280
So, you know, I guess we can log
for J fits into that. 

237
00:15:36,160 --> 00:15:38,160
You know, it's a different type 
of supply chain attack. 

238
00:15:38,160 --> 00:15:43,800
But you know, that thing was 
that was one of those where it 

239
00:15:43,800 --> 00:15:46,880
was a utility that a lot of 
people didn't even know that 

240
00:15:46,880 --> 00:15:50,720
they had in their environments 
or forgot that they had or had 

241
00:15:50,720 --> 00:15:53,760
never heard of and some 
developer was using or things 

242
00:15:53,760 --> 00:15:56,720
like that. 
And it turned into a giant can 

243
00:15:56,720 --> 00:15:59,560
of worms. 
Yeah, there's, we've seen all 

244
00:15:59,800 --> 00:16:03,680
these types of attacks in all 
different forms over the past 

245
00:16:03,680 --> 00:16:07,200
over, you know, well, we've seen
them, I mean, at least since 

246
00:16:07,320 --> 00:16:10,280
like for, for decades. 
But Oh yeah, no doubt. 

247
00:16:10,800 --> 00:16:13,600
It's definitely seemed like it's
been like a wider scale 

248
00:16:14,040 --> 00:16:15,160
recently. 
Sorry, it's. 

249
00:16:17,000 --> 00:16:18,720
OK, it's the beauty of live 
podcasting. 

250
00:16:18,840 --> 00:16:20,960
Yeah, right. 
Delete. 

251
00:16:23,320 --> 00:16:26,800
But yeah, anyways, we've seen 
these types of attacks like, you

252
00:16:26,800 --> 00:16:31,680
know, happen a lot over the past
decade, but it does seem like 

253
00:16:31,680 --> 00:16:34,800
the ones we've seen over the 
past like 5-6 years have just 

254
00:16:34,800 --> 00:16:40,000
been much higher in scale, as 
you mentioned, like solar winds,

255
00:16:40,000 --> 00:16:43,800
like, you know, some of these 
other ones and so. 

256
00:16:43,880 --> 00:16:45,440
Yeah. 
Yeah. 

257
00:16:45,600 --> 00:16:50,080
And the other thing too is that 
when you think about these types

258
00:16:50,080 --> 00:16:55,840
of attacks, like historically 
there was kind of the the 

259
00:16:55,840 --> 00:17:00,400
intention was just crypto mining
with a lot of these types of 

260
00:17:00,560 --> 00:17:03,960
things. 
And I think that now it's has 

261
00:17:03,960 --> 00:17:09,440
now shifted to much more 
insidious types of animals like,

262
00:17:10,440 --> 00:17:13,119
you know, like data 
exfiltration, like kind of 

263
00:17:13,119 --> 00:17:16,520
honing in on those passwords and
then using them to like launch 

264
00:17:16,520 --> 00:17:19,079
further attacks and things like 
that. 

265
00:17:19,079 --> 00:17:23,760
And so I think that also it kind
of makes it a lot more of a 

266
00:17:23,760 --> 00:17:26,440
dangerous type of impact that 
we're going to see. 

267
00:17:27,160 --> 00:17:31,360
God, the crypto mining error was
such a like we were, we were it 

268
00:17:31,360 --> 00:17:36,000
was so nice like compared to 
this like yes, I know honestly, 

269
00:17:36,280 --> 00:17:40,320
such a gentler time in the in 
the security landscape. 

270
00:17:40,720 --> 00:17:43,240
We're just going to use some of 
your resources to try and mine 

271
00:17:43,240 --> 00:17:47,640
these stupid coins that, you 
know, for the most part of 

272
00:17:47,720 --> 00:17:51,680
worthless. 
But yeah, I kind of do too, 

273
00:17:51,680 --> 00:17:53,760
honestly. 
It was yeah. 

274
00:17:54,040 --> 00:17:58,520
What a what a time that was that
in the NFT era. 

275
00:17:59,400 --> 00:18:04,640
But yeah, yeah, I'll, yeah. 
It'll be really interesting to 

276
00:18:04,640 --> 00:18:07,760
see how this sort of continues 
to shake out the next few days 

277
00:18:07,760 --> 00:18:11,360
and weeks. 
And, you know, whether whether 

278
00:18:11,360 --> 00:18:14,680
we find out more about who was 
behind it and the motivations 

279
00:18:14,680 --> 00:18:21,720
and, or kind of the the what was
taken, that will sometimes give 

280
00:18:21,720 --> 00:18:26,080
you, you know, some insight into
the, you know, the ultimate 

281
00:18:26,080 --> 00:18:33,560
motivations of the hackers. 
But you know, in some, in some 

282
00:18:33,560 --> 00:18:35,720
ways the motivations don't 
really matter. 

283
00:18:35,800 --> 00:18:37,960
Like they were, it seems like 
they were just trying to get 

284
00:18:37,960 --> 00:18:39,560
access to a whole bunch of 
systems. 

285
00:18:40,040 --> 00:18:43,040
And then, you know, maybe we'll 
see some ransomware fall out 

286
00:18:43,040 --> 00:18:46,160
from it. 
Maybe we'll see a bunch of, you 

287
00:18:46,160 --> 00:18:47,760
know, data breaches like you 
said. 

288
00:18:47,760 --> 00:18:52,320
I'm, I'm sure that's the most 
immediate thing we'll see and 

289
00:18:52,320 --> 00:18:56,800
maybe some follow on ransomware.
But you know, there, there, 

290
00:18:57,360 --> 00:19:00,040
there will definitely be a whole
bunch of like things stacked on 

291
00:19:00,040 --> 00:19:01,520
each other over the next few 
months. 

292
00:19:02,280 --> 00:19:07,040
Yeah, definitely. 
And then the the other thing too

293
00:19:07,040 --> 00:19:11,560
is like that, you know, as you 
mentioned companies not being 

294
00:19:11,560 --> 00:19:14,120
aware of this and that it's 
happened to them. 

295
00:19:14,120 --> 00:19:16,880
So I think just getting the word
out right now is really 

296
00:19:16,880 --> 00:19:19,400
important. 
And then also like helping 

297
00:19:19,400 --> 00:19:23,920
people understand the specific 
mitigations that they can take 

298
00:19:23,920 --> 00:19:28,400
to kind of deal with this and 
the guidance for defenders as 

299
00:19:28,400 --> 00:19:29,680
well. 
So I think that's kind of 

300
00:19:29,680 --> 00:19:32,160
immediate term what we need to 
do here. 

301
00:19:32,320 --> 00:19:34,720
Yeah, no doubt. 
And you know what's interesting 

302
00:19:34,720 --> 00:19:38,640
to me, I looked this morning and
I looked again this afternoon 

303
00:19:38,640 --> 00:19:43,440
and I, I don't see it unless 
it's somewhere that I'm missing.

304
00:19:44,000 --> 00:19:46,120
I don't see a word from SISA 
about this. 

305
00:19:46,400 --> 00:19:53,360
Like not, not a thing. 
And, you know, we've talked 

306
00:19:53,360 --> 00:19:58,240
about the things that have 
happened at SISA in the last few

307
00:19:58,240 --> 00:20:04,560
months, but I struggle to think 
that if this was a year ago, we 

308
00:20:04,560 --> 00:20:08,400
wouldn't have seen a whole lot 
of communication about this. 

309
00:20:09,400 --> 00:20:13,840
You know, even if it was just a,
a broad, a broad alert that this

310
00:20:13,840 --> 00:20:18,760
has got, that this has happened,
you know, and to check your logs

311
00:20:18,760 --> 00:20:22,680
or that sort of thing. 
I haven't seen a single single 

312
00:20:22,680 --> 00:20:25,760
peep about it. 
Yeah, I remember, I think it was

313
00:20:25,760 --> 00:20:30,400
the XE backdoor, the one with 
the geaton, like what was that 

314
00:20:30,400 --> 00:20:34,200
like 3 years ago or something. 
But they had a pretty big part 

315
00:20:34,200 --> 00:20:38,000
in trying to put port the 
advisory and, you know, make 

316
00:20:38,000 --> 00:20:40,080
sure that Debs knew what was 
going. 

317
00:20:40,080 --> 00:20:42,640
On SO. 
Yeah, it is that. 

318
00:20:42,640 --> 00:20:45,360
I hadn't even thought about that
until you said it, but that is 

319
00:20:45,360 --> 00:20:49,640
such a interesting point. 
Yeah, it's, it's a little 

320
00:20:49,640 --> 00:20:54,280
depressing. 
And I promise you that this is 

321
00:20:54,760 --> 00:20:56,560
going to affect some government 
agencies too. 

322
00:20:56,600 --> 00:20:59,680
There's no way it doesn't. 
It would be impossible for. 

323
00:21:00,440 --> 00:21:03,360
Sure. 
You know, not just federal, but 

324
00:21:03,560 --> 00:21:07,040
plenty of state and local and 
tribal government agencies, I'm 

325
00:21:07,040 --> 00:21:13,240
sure that do not have their own 
cybersecurity people or IR staff

326
00:21:13,240 --> 00:21:16,400
or anything resembling that to 
help them. 

327
00:21:18,200 --> 00:21:21,400
And you know, this, this is 
another thing that like just 

328
00:21:21,400 --> 00:21:28,400
reinforces to me how much the 
Internet ecosystem is held up by

329
00:21:28,400 --> 00:21:34,680
like 12 pieces of open source 
software and you know, like 4 

330
00:21:34,680 --> 00:21:38,760
companies. 
And if one of those gets kicked 

331
00:21:38,760 --> 00:21:42,760
out from under the table, the 
whole thing just starts to tilt.

332
00:21:43,280 --> 00:21:46,360
You know, it's like every time 
one of these happens, somebody 

333
00:21:46,360 --> 00:21:51,160
posts that that XKCD cartoon of 
like, you know, the, the little 

334
00:21:51,160 --> 00:21:54,160
pillar holding up this giant 
like mousetrap. 

335
00:21:54,160 --> 00:21:56,800
And it's like open source 
software right here. 

336
00:21:56,920 --> 00:21:59,080
And it's it's funny 'cause it's 
true and. 

337
00:21:59,360 --> 00:22:02,120
It's and then yeah, it happens 
over and over again. 

338
00:22:02,680 --> 00:22:05,760
Something about yeah, how things
are going into threat landscape 

339
00:22:05,800 --> 00:22:06,960
right now. 
Right. 

340
00:22:07,000 --> 00:22:12,280
And I mean, it's super easy in 
these cases always to point your

341
00:22:12,280 --> 00:22:14,960
finger to maintainer or 
something like that. 

342
00:22:14,960 --> 00:22:18,400
But again, doesn't seem to me 
that the these maintainers did 

343
00:22:18,400 --> 00:22:21,520
anything wrong from what we know
at this point. 

344
00:22:21,560 --> 00:22:26,160
And these people are not being 
paid for what they're they just 

345
00:22:26,160 --> 00:22:28,000
wrote some software and you 
decided to use it. 

346
00:22:28,200 --> 00:22:31,200
You know, that's a whole other. 
Discussion. 

347
00:22:31,880 --> 00:22:36,040
Whole other discussion, yeah. 
And not one that we can do in a 

348
00:22:36,040 --> 00:22:41,160
short podcast, but yeah, it's 
been it's been quite a couple 

349
00:22:41,160 --> 00:22:43,080
weeks for the supply chain 
world. 

350
00:22:44,240 --> 00:22:47,040
Yeah, definitely. 
It is weird that you know this 

351
00:22:47,040 --> 00:22:50,880
is coming right on the heels of 
the other attacks that you know,

352
00:22:50,880 --> 00:22:52,160
everyone's kind of been covering
last. 

353
00:22:52,160 --> 00:22:54,120
Week so I. 
Don't know but. 

354
00:22:54,760 --> 00:22:57,400
It's funny because I not funny, 
ha ha. 

355
00:22:57,400 --> 00:23:03,200
But I ran into somebody from 
Socket, one of the, you know, 

356
00:23:04,560 --> 00:23:07,040
teams that really focuses on 
this stuff. 

357
00:23:07,040 --> 00:23:11,920
And at RSA last week, right when
all that that stuff was 

358
00:23:11,920 --> 00:23:15,840
happening and I said, how's it 
going? 

359
00:23:15,840 --> 00:23:17,960
He was, he just shook his head, 
didn't even say anything. 

360
00:23:17,960 --> 00:23:20,160
He was just like, in a long 
week. 

361
00:23:20,560 --> 00:23:22,400
Yeah, yeah. 
A tough one. 

362
00:23:22,880 --> 00:23:24,720
Like Tufts of hair coming. 
Out. 

363
00:23:25,680 --> 00:23:26,880
Razzled. 
Yeah, yeah. 

364
00:23:27,040 --> 00:23:30,040
And that was like Wednesday 
afternoon, though it's, it's 

365
00:23:30,040 --> 00:23:32,040
been almost a week since then. 
So yeah. 

366
00:23:33,280 --> 00:23:34,640
Tough times. 
I know. 

367
00:23:34,640 --> 00:23:37,080
Wow. 
Yeah. 

368
00:23:37,560 --> 00:23:40,200
I, I have a lot of empathy for 
those folks. 

369
00:23:40,200 --> 00:23:43,360
It's not, you know, not super 
easy. 

370
00:23:43,360 --> 00:23:47,920
So the resources for folks that 
are that are trying to learn 

371
00:23:47,920 --> 00:23:50,760
about this and trying to figure 
out what to do, mention the the 

372
00:23:50,760 --> 00:23:55,400
Huntress post that you guys have
up, the video that John did. 

373
00:23:55,400 --> 00:24:01,400
Socket has a great analysis, 
Elastic has a good analysis, and

374
00:24:01,400 --> 00:24:04,040
so does Whiz. 
I think there's probably others.

375
00:24:04,040 --> 00:24:07,720
You mentioned that Mandiant has 
something or was that just like 

376
00:24:08,120 --> 00:24:10,600
a tweet or something? 
Yeah, it was just, it was a 

377
00:24:10,600 --> 00:24:11,800
statement like an. 
Official. 

378
00:24:12,360 --> 00:24:17,360
From them but but yeah it is and
we we'll post all those in the 

379
00:24:17,360 --> 00:24:20,680
show notes but like I will say 
it has been like heartwarming I 

380
00:24:20,680 --> 00:24:23,920
guess in a weird way like to see
just everyone come together and 

381
00:24:24,520 --> 00:24:29,160
like you know, trade, you know 
intelligence and and try to get 

382
00:24:29,160 --> 00:24:31,840
the word out so. 
I agree it is. 

383
00:24:31,840 --> 00:24:36,400
That's one of the benefit is not
the right word, but one of the 

384
00:24:36,720 --> 00:24:41,240
like side effects of things when
these things happen is you do 

385
00:24:41,240 --> 00:24:43,560
see that community spirit that's
still there. 

386
00:24:44,040 --> 00:24:48,960
It's hard to see sometimes 
because we this community loves 

387
00:24:48,960 --> 00:24:53,520
to, you know, eat its young in 
some cases, but you do see it 

388
00:24:53,520 --> 00:24:55,800
when things like this happen and
everybody kind of pulls together

389
00:24:55,800 --> 00:24:59,360
and is like, well I saw this, we
saw that, you know, let's try 

390
00:24:59,360 --> 00:25:02,560
and pull our resources and see 
how we can help people, which is

391
00:25:02,880 --> 00:25:04,440
very nice. 
Right. 

392
00:25:04,720 --> 00:25:05,880
Yeah, for sure. 
Yeah. 

393
00:25:06,680 --> 00:25:08,840
All right. 
Well, thanks Linz. 

394
00:25:08,840 --> 00:25:12,920
It's great to have you back and 
I'm sorry you got dumped into 

395
00:25:12,920 --> 00:25:15,280
the deep end your first few days
back coming. 

396
00:25:16,080 --> 00:25:19,200
Back with a bang, yeah. 
Oh, yeah, no rest for the 

397
00:25:19,200 --> 00:25:21,640
wicked. 
All right, talk to you soon. 

398
00:25:21,720 --> 00:25:22,760
See ya. 
Thanks. 

399
00:25:22,800 --> 00:25:22,880
Bye.