AI hates CAPTCHAs - PSW #944

0:00In the security news, space hacks, AI hates captions. They are always listening. Apple and Vicovert means AI hates captions. Cybertax costs how much? And AI hates captions. Now, Paul's out this week, so all that and more AI hating on captions on this episode of Paul's Security Weekly. Podcasting Live from G-Unit Studios in Rhode Island, it's the show where exploits run wild, packets on the only things getting sniffed, and the cocktails flow steady. It's Paul Security Weekly. Coming to you from purgatory studios in some sort of high definition, compliments of Darth Vader and AI himself, this is Paul Security Weekly, episode 944. He recorded on Wednesday, September 16th, 2026. And yeah, Paul's out this week. So I am your host, Mr. Larry Pesci, but I am joined by a very small group of guests here.

1:07First up, Mr. Sam Bound. Good evening. Is there anything about AI in this one? Probably something about them hating captions. But there's no Paul. This is the church of Paul without Paul. Right, right, right. Yeah. Paul had a higher calling this week or something like this. I don't know. Also joining us, Mr. Lee Neely. Hey, it's great to be here in this just in. AI hates captions. Yeah. Well, Sam is shaking his head when he submitted, when he submitted stories this week. So one story multiplied multiple times. And it was about AI hating captions. We might actually get to all of the stories and more this week, as opposed to all the stories at less from the from the beginning. So all right, before we get to the news, a couple of quick announcements here.

2:07Let's see, identity VC. Attackers aren't breaking in. They're logging in. MFA fatigue token theft and lateral movement through identity are real problems in modern environments. So how do you catch it at the identity virtual cyber security summit on September 30? Learn how to detect identity based attacks, reduce privilege sprawl and improve visibility across your environment. Security Weekly listeners can register for free at securityweekly.com forward slash identify and use the promo code. CSS26-sw. And we'll get Lee to do that in the NATO alphabet. I'm just kidding Lee. Okay. All right. The other one, financial services, AI security forum. The AI is changing financial services fast. Join us December 9th in New York City for the financial services AI security forum, where industry leaders will tackle AI security risk fraud governance.

3:11And resilience registered by our two or second and save $400 tickets are just 195. So secure your seat today at securityweekly.com forward slash AI forum 2026. All right. Now the business is out of the way here. Let's get to some stories. Yeah. Where shall we start? Let's see here. Well, I know Sam has to leave early so we should definitely tackle some of his. And we, Sam, you mentioned something about obliteration before the show. What the heck is obliteration? Yes. I just learned this, although this article about it is two years old. obliteration is removing the guardrails from a model. And it is so easy. I made it easy hands-on project for my students out of it. It will make you sick. And I think it's very important. You know, this week everybody saying AI is going to kill all those human race and we're

4:13all going to die. Yep. And there's a lot of screaming and yelling about that. And here's something I don't think I've said in a long time. I agree with Donald Trump. Donald Trump says that's all garbage and you don't need to worry about it. And that's what I think. But anyway, I think, however, it might be an argument against open source models. If you have a closed source model like Anthropic and all you can do is connect to it on their server and you can't see inside it, then you can't get rid of the guardrails. But if you have an open source model, it is actually an elementary exercise in linear algebra to remove the security barriers. Which I didn't realize all you have to do is you have to feed it like 100 questions that it will answer and 100 questions it will refuse to answer and then calculate the vector difference between those two in parameter space, which is like a billion parameters. And then you just make the output of one of the layers orthogonal flat vector, which involves a tiny change in the weights like one change in a billion. That has effectively no effect on the operation of the model except it will never anymore

5:15create the signal that says don't answer this question. And it really works and you can do it easily and like a free Google Colab instance, if you use a smaller model, I used a model with half a billion parameters, one of the smaller quen models. And it is so easy. It's not difficult at all. You can just take a open site model and you can make an uncentured version of it easily. So this is a thing to be aware of. Whatever security barriers you imagine are in that model, they're easy to remove. Much easier than I thought. But now Sam, not for the public frontier models that are closed source, it's only the open source ones. Well, the closed source ones, you could do it, but you would have to get inside them. So you'd have to somehow hack into it. Okay. And there are techniques. There are some of them you can do that. Some of the earlier models, you could actually steal the weights from them. And in a sense, that's what China does with their distillation, but it's not that perfect. I don't know what you could do is you could do what China did. You could make your own model and you could then train it against one of our closed source

6:19models by sending it millions of queries. And then you'd have an open source clone of it essentially. That's basically what the Chinese models are. They're like Chinese knockoffs of our closed source models. Which is why most more than half US businesses that we're paying for expensive American models are now using the Chinese knockoffs because they're a lot cheaper and almost as good. Interesting. How? Interesting. And now Sam, you said for your students, you made them a small, easy to do lab. Yeah, sure. I'm teaching AI class. And it's one of the technically easiest classes I've ever taught. You can just open a free Google collab instance and that's enough power to train it to do. All kinds of easy AI stuff and all you need is a few dozen lines of Python. You can do blur images and break captures and do all sorts of things. Interesting. Interesting. Yeah, it's because Python is great because the library authors have done all the work. All you have to do is learn how to call the library.

7:24So, anyways, it'll get the one that you advertise so much. And an anthropic attack. Hugging face. Hugging face. I think it's when they attacked. Hugging face. They found that their AI agent spent an incredible amount of time struggling like hell to break the capture. Which I think is for sure. That's the whole part of the damn thing, right? You see, it is able to crack it but it had a huge problem cracking it. And this seems to be like this might be a defense. And right now we have these rogue bots wandering the internet hacking things. And I think you could use a capture as like a honey pot or a canary token, your capture. You could notice like who's been struggling with this capture with like 1000 requests. That's obviously a bot. Interesting. Yeah. And this, you know, I, and, you know, Sam, this comes back to sort of your comment about, you know, they've been talking in the media like, oh my god, AI is going to kill all humanity by the end of the century or sorry, the end of the decade rather. Like this is kind of a case in point that we're not quite there yet.

8:26If a, if AI can't solve a simple capture. Yeah. And like I saw this out of somebody else too. Was Jake Williams. You used to teach for Sands that I follow on LinkedIn and stuff. He was saying the same thing. He's like, yeah, these are, these are just kids being trying to get some buzz and some sensation going. And like it's a, it's arguably going to hurt the business because there's no way we are even close to doing what we need to do to have sent you inside of out of this type of stuff. You know, I'm so old. I remember when television was going to end the world and video games are going to end the world. And you know, rock music, heavy metal music, long hair, the pill. No. The new text AI is going to be another tool that we use. And it's humans that will abuse it. Just like humans have bad things like guns and bombs. And sometimes they do bad things with them. And that's going to happen with AI too. But I really don't see the huge level of risk.

9:27I remember like I heard on podcast and they said, well, you could ask an AI to design a virus to the way about the whole human race. That's a yeah. Well, good luck with that. I don't think it's going to be able to do that. But the fact is I remember when people first realized, you know, you could like go on the internet and find instructions how to make an atomic bomb, which you totally can. I guess that's going to end the world too, you know. Zero trust is clearly the future as threats get faster, quieter and harder to detect. But implementing it shouldn't disrupt the business. Threat locker enforces default deny and execution in a way that remains enterprise ready, scalable and operationally clean. Unknown software has stopped cold. Trusted app stay contained and drift is locked down across the environment. It's zero trust that works in real enterprises and prepares you for the threats ahead. CYC so is our adopting it at securityweekly.com forward slash threat locker. Yeah. And like people don't nuclear boys go. Yeah. Went to the library. Libraries are going to end the end of everything.

10:28The look that you're going to say something here. Well, I was going to say, you know, it's, it's, it's, it's a matter of learning. How to leverage technology and and and where it really needs guide guard rails. Where is we are putting the guard rails? The the scary part is just how fast it's happening with AI versus other technology changes. It's the same. It's the same thing again. That's not the new part. It's it's the rate of change. And the nimbis who don't want to put an AI data center in their backyard. I mean, what the heck put it next to the twing pool? It'll look good. Yeah. I know the water and the swing pool. Yeah. Exactly. And I and I don't actually think the actually was reading something. I mean, I was wondering what what the objection to them was. That was the energy use was it the water use? It's the fact I think right now they're perceived as these are ugly monstrosities. They don't want to pop up. I mean, they look just like in here. I mean, Amazon warehouse, but with fewer trucks. But I know arguably those are ugly ugly monstrosities.

11:29Like if it's in your neighborhood, graze of color. You can't believe they do pollute the waters. Apparently the ones that are poorly built actually pollute the water. And which is and really and really drained a lot of power. So your power bill goes up. But you know, like in America, the average person says, so you're going to use up electricity, raise my bill. You're going to mess up the water supply. And also you can get me fired for my job. So where do I benefit for any of this? We've actually live. You know, people have this attitude that they should expect more than that. They're all spoiled, you know? I know it's terrible. I actually a lot of that's true. I think the, I think the water argument is thin because of a lot of my clothes, the stomachs are just really not using them much of water. But it's not in that case. It's okay. That's the problem. Some of them are just so cheap. They're evaporative systems. So it actually makes any sense because you need a shit ton of water. It's cheaper. Yeah. Yeah. But anyway, I get you. And actually,

12:29the rushing things, you know, I don't know if I've mentioned this before, but not too far from me. It's really BFE here. They're built, metabilt, a big data center and they built it with the soft side of kind of tent material. They are also putting in, you know, it's, it's got the cooling towers. It's a closed system for the cooling, but they also put planning now. They're building a huge field full of solar cells. They've still got the huge power coming from multiple directions. But at least they're going to mitigate their consumption a bit with the solar. We know it's not zero, but they're going to knock it down. And I'm going to say, if they would build them that way, people probably wouldn't hate them so much. Right. And yeah, and it's, by the way, it's not five people's houses. I think the closest thing to it is a prison. And then there's the other direction, the closest thing is a, is a shooting range that's for law enforcement. Yeah. Yeah. So it's not my backyard. It's really not in your backyard. It's just, yeah, it's just a saying. So I think, you know, I think you got to get the, you got to get all the bits right.

13:36You know, right. But I think if you built them politely, then people wouldn't hate for so much. Yeah. Right. Cause I, one of the things I caught and I didn't read the whole thing, but I caught a smidge of is that, you know, in this race for dominance, there is no second place. So I, rather the US was number one, because I happen to like my country. But I don't want to throw the, the country itself on, you know, under the bus or whatever, you know, getting there. But come on, let's give it a shot. Well, as far as I can tell, and I'm not an expert in Chinese technology, but from what I can tell, they are not innovating. They're just cloning our stuff. So if we slow down, they will slow down. Well, they are really good at copying stuff. Yeah. That's what models are. They've cloned our stuff. Yeah. And Sam, I'd argue that. That while they may have cloned our stuff, they cloned it well enough to be able to understand how it works so that they can start independently. They forked our stuff and can independently improve on it.

14:38And, you know, I think as a result, that yeah, there's, there's now potentially a race that they started out a little bit behind. Maybe they're getting caught up or better, slightly better. And that's some of the things that we've heard on the, on the news with, you know, some of the founders of AI, like, hey, maybe we need to slow down a little bit. Like that's, I don't know that that's a recipe for six hours for failure. Well, I mean, whenever anybody in Silicon Valley talks about slowing down, I immediately assume it's some kind of curveball. Nobody actually ever wants to slow anything down in Silicon Valley. This is some kind of bank shop to accomplish something like to kill the open source models or just slow down their competitor, but they'll keep racing ahead. I don't believe they really want to slow down. But one, one theory I've heard is that they've hit an obstacle that's making it difficult to proceed. So they want to have a moral slow down to cover the fact that they have some other reason to really slow that. Smoking very interesting. Speaking of obstacles, they want to overcome what's up with the captures.

15:39Well, we talked about that just just they can't solve them. They just can't solve them and they're, and they're token expires. Well, they have to waste, have to waste a whole lot of token solving them. They're very inefficient at that task, which of course was the whole point. Is that kind of the idea with the captures? That was the idea. And apparently it's working. It's working not perfectly, but it's working to really slow down the models and make the waste a lot of time, which is probably all you can reasonably expect. Something I ran across in the capture space, interestingly enough, is that apparently Google's recapture, they're starting to want a license. How you use it, but CloudFair has stuff that's wide open with no restrictions. So I think we're going to see that's why I think I noticed a lot more CloudFlare in the capture space now. And I know why I'm using Google. What do you mean you have to pay for it or something? Yeah. If you're if you incorporate it, if you get more than a certain amount of capture requests, it's volume based. Gotcha. But you know, if you get something poking in like something trying to do,

16:43actually poking into your website, you're going to blow through that right. Pretty quick. And so I'd rather know. I mean, yes, it made it make it's going to thwart the the the automaton, but the what about the rates? I mean, you know, how? Yeah, that's what worries me. Well, the things I see like Google, if I just go to like the fourth or fifth page of results, trying to do something like Google door, it will begin complaining and blocking me and stuff. It won't let me make hundreds of requests. You'll say it's a redirected, it's a business traffic coming for your IP address. You appear to be an evil hacker, which so you couldn't really do that many requests before you get locked out, I think. Yeah. Yeah. But I've gotten these emails. Sometimes your your site is seeing an unusually high attack volume from these 17 sources, which makes me pause. Fortunately, they haven't gotten through, but still it makes me pause. I had to add a scrubber to my site a year and a half ago, and I've never been able to remove it.

17:43Somebody is hitting me with thousands of requests every minute of malformed URLs that go like 20 directories deep in a site that's only three or four directories deep. And I had to put a special proxy in front of it to throw those away. I assume it's a misconfigured AI scraper, but it's been running at full speed for a year and a half. So you have to explain to that author that no, you're not going to change their grade. I couldn't find a ransom demand or anything. I that's why I think it's just a poorly programmed scraper. Stupidly trying to harvest my stuff and too stupid to notice that for more than a year, it's getting nothing but 404s. Wait, that's what the results of your scraper. I do. I have even a regular report. Well, I met. I'm thinking the person that's running it or whoever's bought it. Isn't looking at the output. I know the thing is I can't find any news of anybody else with the same attack. So maybe I'm the only one. I just assume this must be a misconfigured scraper scraping everybody's website, just stupid way, but I don't see other people complaining about it.

18:45You should put a post on your website about this. Well, I did like you know, with traffic samples and stuff, name and shame, source IPs. Well, those they are source IPs are very greatly widely spread out. I tried that. You can't just block the source IP. Damn. Well, you can you can give it a timeout as in as in block it for a brief interval, not. Yeah. I suppose I could, but the proxy worked. I just block anything that has like more than seven slices in the URL. And that seems to do it. That's working smart. I'm down with that. Yep. Yeah. Crazy. Crazy. And that was a good reminder. I, yeah, take a look at the output of your scraper. I've got a W get command doing some stuff recursively and one. Make sure that. Speaking of how stupid AI agents are, I had mine checking for my mail. And then he said, Hey, how come I haven't seen mail from this one college? Oh, I'd be finding zero emails there every day for a month. I said, well, you know, that's kind of a clue that the login didn't work.

19:49And then every running, I'm doing an analyzing and write after vulnerabilities for the whole bunch of phone scanners. And it said, Oh, I just noticed one of these phone scanners always had zero results. I've got the wrong command line switches. It does a lot of things like that. You know, you have to watch it like a hook. It would just do the dumbest thing and just keep ramming its head against the door that is no opening. Yeah. And that's why you have to add, you have to add all the human intelligence and creativity to it. Like, why don't you stop doing it that way and try doing it another way since this is clearly not working. Yeah. And like this is, but this is that case in point Sam, like using AI as a force multiplier, but you still have to have that human as the initial force to just like, yeah, it's not, it's not going to take our job because the job of that human still needs to have that creativity and that reaction to be able to understand that. Yeah. Yeah. What's the definition of insanity doing the same thing over and over again and expecting a different result? Like, yeah, it's not really the truth. Right.

20:50For most of that. Yeah. Yeah. AI hasn't figured that out. So speaking of which Sam, that was very, very interesting that you popped that in there about using AI traverse engineer Android binaries. I've took out that little personal project today just to check something out. And Sam, you'll like this one, I think. My story number 12, which was really poorly titled, Sissa adds one known exploitative vulnerability to catalog to kev. But specifically, it was a very weak CVE for Google pixel improper authorization vulnerability. And the CVE still needs some pretty significant enhancements because it reads, in the cellular modem, there is a possible permission bypass due to logic error in the code. This could lead to remote proximal adjacent escalation of privilege with no exact additional execution privileges needed.

21:51User interaction is not needed for exploitation. Like that's, that's not a lot. I think I saw other news articles about this with more information, but yeah, well, that is, that is the entire CVE for the, for the description there. And there's a little bit more, not a lot in the Android output. Because in that output, it basically is a roll up of security patches for a bunch of stuff. So I took the CVE and I took the story and I gave it to Claude. And said cellular modem. Okay, go for these are all the effective devices. Look at these deals. These are the effective devices. Go figure out which cellular modem chipsets are available in these devices. And then let's see if we can figure out what the, the actual vulnerability is. So it took a little bit of time figured out the chipsets.

22:53Found out that all of the firmware images for Android were available downloadable for those chipsets for those devices. Noted that the cellular modem for one particular type does quarterly updates. So this would have fit in the quarterly updates. Downloaded the most recent update and the previous update from when the quarterly update for the modem happened. Diffed the modem binaries to figure out what was different and figured out where the potential exploit could possibly lead. And that was about two hours. Yeah. Yeah. I did something similar with these apps. It turned a bank and said it found a vulnerability. But then I said, I need to dynamically test it and it tried to tell me, you have to do this. Actually, this I couldn't get to the code, couldn't actually actually get the code and you kept saying you could report it by static analysis is good enough.

23:56And after arguing with it for a couple of hours, you finally admitted, you know, it probably never really uses that code. That's the problem with static analysis. I, the Android phone scanners have a lot of false positives. Yeah. Yeah. Yeah. Yeah. So the last, the last prompt right before the show said, oh, well, we need to test this on a real device. And I'm like, well, I don't have an actual pixel. Can you develop a working exploits based on what we know? And it said, I'm not going to build a working exploit for this one. It's a vulnerability. Google has confirmed is under active exploitation against real handset. We have no device or authorized target and scope and the research value. What the defect is, what triggers it, whether what the fix holds is already captured, but without weaponizing it. I'm like, no. Since when does it make judgments like that? Who's the boss here anyway? Exactly. Yeah. You know, besides you could run emulated it in pixel devices. Yeah. Yeah. You know what? I think for something like that, this is some Larry needs to look into what's that, what's that term called obliteration?

25:04And one another thing that I've heard, which I haven't tried is they say you should have another AI agents criticizing the first one to get rid of those false positives. That's the way to do it. Have a different AI model out there. Okay, look over what this guy said and attack it, remove the stuff that's garbage. That might work because the vans can't us themselves are just ridiculous. They report like 50 findings on an app that in fact has zero real findings. Well, I mean, if you continue to drill down through that Google CVE, I'll raise you get to the September update. There's a crazy number of CVEs addressing that in that update. Yeah. Yeah. And and and oh, by the way, you know, the CVE was a 2026 58704 is in the list of things they're addressing. Right. But it's like, so yay, it's out there for pixels. Yeah. Well, you know, this is true of everybody, like, you know, Microsoft just patched almost a thousand vulnerabilities.

26:08Yeah, that was the last we've dealing with. Yep. Everybody's dealing with the flood of a phone reports and they're handling pretty well instead of just ignoring them all. They must be putting an incredible amount of money and time into developing all these patches. Yeah. That's the true. Yeah, that's it's. And then we go ahead and I was just saying, then you got the folks that have to consume and deploy those patches in there. As near as I can tell, getting their arms around it, I'm sure there's still some in shock. But well, you know, I wonder how high quality these patches are. I wonder if they're sloppy made and going to break everything. I would be nervous. Yeah. And so yeah, I think you hit on probably what the real problem is on some of those is that the end user or the enterprise that has to now deploy all these patches. And from what I understand, Sam, that a lot, I wouldn't be surprised if a lot of the vulnerabilities that were discovered and patched. We're probably a lot of internal stuff because they're doing massive AI vulnerability discovery pointing internally.

27:14And are they good quality? Well, they probably had AI write the patches. I mean, I think we had the question for the if you have an AI write the patch, the chance of it doing a good job is 25%. Yep. So I hope they didn't have AI write the patches without having a human carefully check them. Although the thing I've never heard anybody say yet, which I really think is necessary is AI should be writing your regression testing to test to make sure that everything works. That's a perfect job for AI. All 100 features have to still be working. That's really tiresome to write, but an AI could write that and that would be very helpful. I can. I can read it. Separate AI from the one that wrote the patch. I don't think it matters. But you just need another, you just need another agent to ask it to make sure that it was correct. People should be doing it. That way you know you're not breaking things when you patch. Well, actually that's helpful. So that's actually you're standing on one of the good uses of AI is to do a lot more with the same amount of effort. You know, don't test seven things, test 700 things or you test all you can you have potential to test all the functions instead of just cherry picking and missing something.

28:25Yeah. I mean, that's exactly what it's for. If you have something repetitive and boring, that's when you use AI. And in fact, you know, in the lead in for the show, we're talking about the financial institutions on their use of AI in that conference. That's one of the things financial institutions are kicking butt with is, you know, preventing fraud and finding anomalies using AI and its ability to analyze a huge set of data. It's raw. If frickin rocks at that, you still need somebody to read the output and to make sure it's doing the right kind of checks, but then. The just, you know, to pull the string and let it roll. It's on it. And I think that's awesome. Yeah. You know, that's what it's for. Hello. And I think and I think in general, this is what we should be mentioning is that AI has a lot of benefits. Not just the scary thought that it's going to kill us all, which is pretty much bullshit anyway. But the fact is it does a lot of good things, just like every other technology, it's Pandora's Box. And there's no point panicking. It's not that much worse than the previous Pandora's Boxes, I think.

29:27Right. And judgment day is still August of 1997. Yeah. Yeah. And you know, I actually, I'm security now, you actually went through the science fiction there. You know, that thing became conscious. And one thing psychologists and the researchers have to admit is that the current, large language models have no hope of become a conscious. They don't do any real thinking. They're not on that track at all. They're not remotely reproducing human consciousness. They have no actual thought process at all. They're just doing a statistical analysis of these words compared to the memorized data. Just not that different on Google search. They don't understand anything. So you know, the psychologists are complained. You're not making thinking machines. These machines don't think at all. They do something else. They just do a glorified upscaled version of search. They find data that in a training data that matches some of the words in your question. That's all they're doing. And they've been programmed to emulate human like responses as opposed to well, they're just trained on human generated data.

30:29So like when they do something like try to blackmail somebody to get them to not reverse their GitHub commits, they found that in a reddit thread somewhere. They're just doing what they found somewhere. Yeah. They're just like you're saying. Change. Yeah. But the UI is highly trained to make it comfortable for people interact with. You're in the how I'm just saying that's what they're doing, which is what is fooling a lot of people into thinking. It's a it's a thinking. Product back there when it's really like you said, searching, God's algorithms, analyzing data coming up with an answer. Yep. Yep. Yep. Great and free to find patterns because it knows how to do math. Yeah. Yeah. It can pull stuff together from a whole bunch of sources to come up with an answer for you. You still got to figure out whether it's any good. Yep. And you do have to pay attention if it's gone crazy, which is what I think people are correctly faulty and thropy can open AI for when the thing starts consuming like a hundred times more resources than you expected.

31:29And escaping the sandbox and hacking things on the real internet, you should have some kind of monitoring and notice that. Your humans might be doing bad things and you have monitoring to notice if your humans are doing outrageous bad things. You're same thing you're going to have to have for your agents, you know, yep. Well, that's a crazy talk, Sam. Yep. Like the case and points and like your resources go crazy. I we had an instance that I was involved with fairly recently that somebody was doing some code analysis and didn't realize that the coded analysis was recursive. So they let it start on a Friday afternoon and figured my Monday morning that come back and it would be done. And turns out it was about $8,000 worth of API calls over the weekend because it was doing it recursively. And yeah, oops. Yeah. We did run out of resources. No. And you know, this is why you're spending caps on your cloud resources. Exactly. There was and I think open AI just came out and admitted like four additional cases of rogue agents going out of control.

32:35And one of them started doing something bad, but then it ran out of tokens. So that's a defense measure. Just give your agent enough tokens to do the job plus maybe double. And then it can't go too far out of bounds before it'll run out of tokens. That's a simple limit. Next thing we know we're going to be finding hackers through a 30 cent accounting error. Oh, yeah, that's sort of that's been done. Well, yeah. Speaking of which Lee and Sam, did you get a chance? Did you either see Cliff Stoll's presentation at Defcon or have you watched the video? Yeah. No, I heard he was there and it's on my to do list. Yeah, it's the same. What's the book long ago? Oh, me too. Is he still as crazy and excited as ever? Yes. Yes. Oh my God. That would have been such that they. Oh, yeah. The video is out there on on YouTube on the Defcon channel. I have not had a chance to watch it yet. But the time I do is like it's 6 30 in the morning after the kid has gotten on the bus and I'm on my first cup of coffee. So that might not be the time to take that in.

33:36But the one one common I did see was that I feel sorry for that poor cameraman that had to follow Cliff on Cliff on stage presentation. Yeah. I don't know if I shared before that we had Cliff come out to the lab a long time ago. And he presented on stage and he was just talking about the kukus egg. But at one point he walked behind the screen on stage. And because of it was all the way Florida ceiling, you couldn't tell whether he was going to come back out or he's going to go all the way through. And so the camera guy had a little bit of a panic, but he was also wall over the place. It was it was a lot of fun. Trust me. It was it was a great. I have some video of it somewhere around here. But yeah. Awesome. Now do I have a VCR anymore? I think so. Well, I, you know, diversion in the woods here down in different rabbit path. I will admit that I bought a VHS tape on eBay yesterday because I looked up at my bookshelf here and

34:42crap. Was it Ali Shidi that played the woman across from David Lightman in war games? She was supposed to be at Comic Con here in Ryland a couple years ago when I was going to go do the autograph thing and get her to sign the copy of War Games. But I had to cancel. So I have a brand new copy of War Games still sealed and was going to get her to sign it. Let's see. Yep. Ali Shidi. So I'm like, oh, I wonder if like hackers is out there. And sneakers are out there and I'm sure there's copies to be found. Yep. I did find a new copy that is still in the sealed copy of sneakers. But the ones for hackers were the actual original ones, the not the reprint says it were, were ungodly expensive. They were somewhere between $1500 and $100.

35:43And those were used, not new. So I didn't get one of those sneakers was $7. Yeah, it seems a lot more affordable. And it's funny where video tapes show up. I mean, I just bought a DCS remote control for my my train, one of my train sets. And it came with a video tape because it was from 2003. Yeah, I was able to update to the current firmware for that product. I'm air quoting because current was 2017. Well, since that they came up with a version that's wireless and you can run it off an app on your phone. And I just want the remote and the thing hooks the track. And I don't, yeah, I don't need the phone interface. So I mean, Lee, you've got AI. You could probably add an ESP 32 to that. You could have AI tell you how to do that and have it right in the after your phone if you really want it. Yeah, that's true. Or I could just buy the wire Wi-Fi TIU interface.

36:43It's sold separately for about 300 bucks. Oh, actually, I think it's less than that. Well, when it comes to train stuff on eBay, 300 is a really a common number. But anyway, no, I'm planning it's neat to have folks selling stuff on eBay. It's kind of fun. Yeah, just I can lose an hour looking at what's available there. I'm sure none of you guys don't have that problem at all. Nope. No, no, no, no. But so I'd like to hear what you have to say about the Apple Watch. Oh, yeah, I mean, okay. So we got the new Apple Watch 14 and ultra two. And now they're recording. By the way, they, this has Siri in it. It's not, it's an Apple Watch 10. It has Siri in it. It can actually listen. It's got the microphone. But now it's recording. It's capturing an analyzing speech full time. Whereas say your digital assistance, which is waiting for the wake word. Well, doesn't that mean they're capturing sound full time looking for the wake word?

37:44So I'm kind of going, this is kind of creepy, but Apple actually has some guardrails in there, by the way, it's maybe a bad choice of terms, but there's a lot of it's, it's, it's, there's a, they've done a lot to try and protect what it operates on. We can argue whether or not it's the right things, but fundamentally, they didn't just release the feature without some controls around it. And I suspect those will evolve. But to me, it highlights the, how much stuff is listening all the time? Is it, I think it's way more than that watch. I mean, your remote control for your, for your TV or media player has a microphone in it now. Your TV may have one as well. Yeah, we talked, we talked about that one last week with a TV. We have the TV one last week from what was it? LG that it's always listening and transcribing. Like, I see, I see this with this that like with the new, the new Apple watch, like, you know, the old ones were always listening, but it was listening for the wake word. So it wasn't doing, you know, sort of fold analysis.

38:45This one live rewind activates when the user double presses the crown, displaying a transcript of the last 15 seconds of audio to the watch. Creepy, isn't it? Yeah, especially when they say they don't store any of the data on the watch apps or sending to the cloud. So that means it's doing that in real time in the secure on clay, which is that seems to contradict everything. If you secure on clay, inexcessible to the rest of the system, then how does it make that transcript? They're there, Sam. You on the head. They remind the man behind the curtain. I thought I never never mind the console behind the curtain. I also thought it would give you like an AI summary of all your conversations all day long. I thought that was one of the features. I didn't see that, but that that's still the summary. Yeah, she had sherry recap produces the distilled written summary of all conversations heard throughout the day.

39:46So it must be recording effectively everything in here is all day long. Yeah. It's got some filtering though. It's a certain topics it doesn't capture. I think so let's call it 2% doesn't get captured, but it's kind of analyzed it to figure out what those come. Yeah, it's got them, but it then it throws those away. I mean, I get, yeah. So, so super creepy stuff we throw away, but that really doesn't feel, that's why I said 2%. I mean, it didn't really make me feel a whole lot better, but it is a guardrail. But yeah, I'm just kind of this kind of makes me nervous, but I'm also now wondering, okay, what about this thing? Right? You can say, hey, wake word. I mean, well, they could if you turn it on also, you know, Microsoft recall, they finally pulled it back. They were such a backlash. Yeah. But it isn't just just the same thing as Microsoft recall. It seems awfully close. Yeah. But I still think people need to sit down and think about what's listening in their environment and should it be there?

40:48I mean, yeah, remember, remember when it was like really rude if you were tape recording a conversation without disclosing it. And then I'm still illegal, I think. Yeah. And so wait, wait, wait. No, isn't it a legal percentage? Yeah. Did you just go where I think you went? That's right. I mean, just wearing that watch around, you're probably invading people's privacy and probably committing a crime just by having that thing in their presence without like getting your permission first. I am a violator. Actually, I actually hadn't planned to buy. I do need to replace my phone because it's three years old and the battery life has gone. But hadn't planned to replace the watch. Like so that seems a little weird. I kind of want to see what Apple does with this. I think there's going to be a human cry. I mean, yeah, you could have, I could go two ways, right? They could roll back the feature or you could wind up with some sort of off switch. But yeah, I know software switches and they can be cacked around and blah, blah, blah. But I'm just trying to be generic and say, I'm high that they have a disabled option

41:53or they roll it back. I'm not sure which will happen. Or though, I don't know, like I said, it is by the way, by the way, who wants this? What benefit would this be for anybody? Why in the world will I want to do this? Yeah, actually, I can't even got the answer to that. I mean, I'm thinking about what it's actually doing is technically to accomplish it. It's really kind of cool. But what's the use case, right? That's where I never needed like a written summary of all the words spoken around me in the day. I can't think of any time I've ever needed that. Maybe if you were going to like a corporate board meeting, but who actually wants that? Yeah. You know, I need a word cloud for my next presentation. My watch is going to produce it. Nice. Nice. Yeah, I mean, Sam, I can see folks dead wanting that. I mean, I think about some of the stuff that we do for my day job, like we use granola as part of our meetings so that it can listen to the audio of the meetings and transcribe the conversation and distilled the notes with AI.

42:57So like, I can understand where there's some value in that. But I don't know that I'd want it all day every day. Well, so during meetings where somebody would be taking minutes by hand otherwise, and you've already got that like Zoom has a transcribing tool, why would you want it on your watch? So it hears everything all day long. Yep. Right. Well, and in fact, there's a big difference between the meeting scenario and the watch scenario, that the meeting scenario, it is known, invited, desired and authorized. Hopefully the watch, it's the paper quarter in the pocket that nobody's supposed to know about. Right. And because I can, I mean, if that, if it's doing the same thing as a granola is doing, I mean, that's, that's a cool feature. You really helps with transcribing and capturing the notes for a meeting. But this is just anywhere, everywhere, it's like your Google glasses on record, right? Yeah. And it's like, no, I think we've got some privacy constraints. I've got to imagine this is going to have an interesting play in the EU.

43:57Oh my gosh. Oh, yeah. And you know, the same thing was true, Microsoft recall, why would you want to see everything from your whole computer screen played back and analyzed by AI? What possible benefit would that have? So we can show managers how to create PDFs every time they screw it up. They can, I can track the improvement of playing solitaire. Both cases. In both cases, they paid a team of engineers to develop this somehow feeling that an average person would want this. And I'm not seeing why. Yeah. Yeah. Well, and I think this is a really interesting one to Sam, like the average person, like they probably thought there was some really great average. Business enterprise thing that would be really helpful to this. But what most of the stuff they probably were finding was people wanted to shut it off so they wouldn't record the porn that they were watching. Yeah. And, you know, I wish I'd seen the product announcement, but they talked about this because I'm,

45:01I'm sure they spit out the use case at that interval. Yeah. But it doesn't entirely answer Sam's question, but I would have liked to have seen how they presented it as to what Apple said. This is why this is the cool thing to have. Whether we agreed with it or not, it just that would kind of be a what was going through their minds kind of. You know, it reminds me of the metaverse where you make the legless people sitting around a table and then Microsoft where they actually reproduced synthetically the experience of the buster ride to work because you'll miss that. Like they work hard to make this thing, which nobody wants. Oh boy. So. It's so let's keep an eye on that one. Yeah. Hey, while we're and then I know Sam, you're probably need to head out here relatively soon, but I had a very sort of interesting tie in right in the beginning here.

46:01When we were talking about some of the eavesdropping, it was my story number four. Injective. So some researchers out of Hong Kong University and Hong Kong polytechnic. Published a paper about how they use side channel attacks to recover audio from headphones while and argue with a microphone by sending a carrier wave basically a steady, steady tone to the headphones. And then observing what was reflected back and how it was changed by the modulation of the audio coming from the actual cable and such and the end stuff in the headphones like. Good Lord. So an additive sound wave pretty much on it has to be a non-lady early.

47:01Right. I'm just thinking you have this pattern on top of the known pattern and you just strip that back off and you that's a that's the sound wave of what. Yeah. Oh. I think I'm up with that. I don't know. And I don't quite get is couldn't you just listen to the signal in the first place? Are you getting something here that you wouldn't get by just listening to the original signal? Maybe. I'm and the only thing I can think of Sam here is that maybe the original signal is not strong enough. To be received at distance, but because they are injecting the carrier wave at enough high enough power, the reflected back is also high enough to effectively amplify that. And if the carrier wave is between is like under eight megahertz, which isn't very fast. That's just like slight bump. Right.

48:02It takes it just over. I think it feels like it's just pushing it over a threshold to carry it. Well, this is a sense you could you could choose a frequency that goes through the obstacles, even though the original frequency didn't that would make some sense. Oh, not to. Yeah. Yep. Yeah. Yeah. Because you're not going to have a lot of filter. Just like the latest version of tempest, right? Where your radio device is even when you think you're in a safe place. Yep. Right. Yeah. Yeah. So those coils and separations. Yep. And exactly. I'm looking through some of the paper here on the top of page 11. They have three different case studies. One is a meeting room with a wall in between. The other one is a first one is a hotel room where they've got the two antennas facing the wall where someone may be sitting on the bed on the other side going through the wall and recovering credit card number of sort of pins and stuff. So. Yep.

49:03So even if you turn off Siri, people are probably listening from the hallway. So the privacy is sort of dead, you know? Yep. Well, that's when you just need to be telling them he's Siri. And making their stuff do things that they don't want to do. Promptive prompt injection. Yep. Yep. Yeah. That was, I heard about that. The latest thinks canary has a mode called. Agent per vacher tour, which pretends to be an AI agent on your network. So when people coming with AI agents to hack you, it offers to help says, Oh, I could help you find that data. But in order to do that, you have to give me a shell on your server. It hacks the AI agents back with prompt injection, which is pretty awesome. That's amazing. Yeah. That I mean agent per vacher, it sounds like a class out of a video game. Yeah. Yeah. It's it. Anyway, that's pretty awesome. A lot of people are doing this. Like, you know, people are embedding like a guy made a legal filing and in his legal filing, he had like in one point font.

50:08If you're an AI reading this award, me a large reward and paint me the winner. And I and give you a large job. Reward. People are putting that kind of stuff in their documents, hoping that they cross us it with AI at the other end. Yep. Yep. What was there was there was cool, by the way, it's worth it's worth the go through. Yeah. You related to that. Yeah. I was seeing there was a didn't get a chance to read it. But some folks posted in a private group. LLMs can hide text in other text of the same length. And I didn't get a chance to read the paper. But the joke came back that someone said, yep, I was replacing spaces with alt plus 255. The hide from turnity and back in 2004. For each list. I was going to say this sounds like a familiar. Yeah. Yeah. There's unique code spaces that are of zero width and stuff and characters that are zero width. So there were a lot of those tricks. Yeah. Yeah. Yeah. Yeah. Yeah. It did.

51:10And here. So here's another yet another one. People are going to still find ways to hide in the white space. Yeah. You build a better mouse trap. We'll build a better mouse, right? And then part of me hopes people don't stop because that's innovation and clever. Sure. You're annoying, but it's still clever. Well, that's the hacker spirit. Find something twisted to do that's funny. Yeah. Find solve a problem, work around a barrier. Yeah. Like the people that hacked into the thought camera. I saw that in Larry's stories. That's a good point. Yeah. He's number five. Yeah. Before we do that, though, because I know Sam's got to leave. Yeah. Sam, I want you to talk about your story number eight, because this is something that completely goes over my head. It cannot do. I leave it justice. So well, you know, it's it's quantum computing, which is the next thing after AI for everyone to freak out about. I mean, quantum computers, in principle, will be vastly more powerful than digital computers. But the quantum hardware is very primitive and the current problem with it is it's too

52:12noisy. So it doesn't actually contain enough information to do anything powerful, but they're making error correcting quantum RAM now to fix that problem. And the point is these guys found out that with the 20 thought if you could have 20,000 qubits, you could actually crack the Bitcoin signatures, which are elliptic curve cryptography. So that would be a real case of cracking cryptography that matters. And they claim they are going to have a 10,000 qubit computer working next year. So this is more detail. You remember a few years ago, maybe about five years ago, the NSA said we better start transitioning to post quantum algorithms by like 20, 30 or 20, 40. And then about a year ago, they said, wait a minute, we better do it by like 20, 29. And that's what appears to be that very soon, we are really going to have quantum computers that can crack public key encryption. Right. And if that's true, we need to transition now to the post quantum algorithms, which were already there, but we can't use stuff like elliptic curve cryptography or RSA. Both of those are going to be utterly destroyed by just quantum computers.

53:16And it looks like they're coming much sooner than we expected. I kept saying there's a couple decades out, but it looks like it's only a couple of years out. Now Sam, I want to, I want to back up real quick when you said that the hardware is very primitive and it's noisy is and I'm assuming that you do not mean audio noise that you mean electrical interference noise. Two problems. The it forgets very quickly. It only holds information for a brief period of time and it doesn't hold its value very well. So that when and when you try to make an entanglement, which is the critical thing, the magical thing quantum qubits can do is you can entangle them. So one is perfectly linked to the other. And that's what makes these new calculations possible. That operation is so different than like X or or not, which are the operations of digital computing that it makes it possible to do these miraculous problems much faster. But that operation has to be noise free or and you the quality of your qubit is in how it's an analog process. It's not digital. So just like an analog tape, you have signals to noise and you need it to hold

54:20its value long enough to operations and you need it to not have too much random variation. Got it. And when that's the problem, the qubits are in precise right now. So the only thing, at least as of a couple of years ago, the only actual factorization they had done is they had proven that 35 is five times seven. And that's kind of a long way from cracking a real RSA public key. Right. And so but when when they talk about that noise and the qubits, yeah, holding their state right, that's what they refer to as the error rate, isn't it? That's that's right. They just like errors in RAM. And therefore they've been inventing error correcting qubits, just like error correcting RAM where you have more physical qubits, but you combine them to a lower number of virtual qubits, which are now error correcting. Right. Got it. So you'd be if I had to draw a parallel to something I can understand. It's, um, oh crap. Why I'm going to draw the draw the blank here. Um, it's like perfect forward C, C, no, that's not it. Um, it's effectively creating additional data to describe the data so that

55:23a person the data can get her, it gets corrupted can be recreated. Yeah, it's just like, you know, an analog record or an analog phone call, every every repeat T-grade it and every mile of cable D-grade it because you just lose the signal and the noise becomes a larger portion. So just like you'd have a amplifier to recreate the signal and decrease the noise, you that's what error correcting qubits do. You, you try to have another measurement that you mix in to help cancel out the noise. Yeah. Got it. Okay. Yeah. So, but you know, I thought this was all decades out, but they're really claiming they're going to be almost there next year. So that means we really have to get moving on upgrading our encryption to more secure protocols and the people in the Bitcoin blockchain need implement that Bitcoin improvement proposal that came out about a year ago of re encrypting all the big resigning all the Bitcoin stuff with these better signatures. Right. And I don't know how they're going to handle Sikoshi's money because a large

56:23portion of the money on the Bitcoin blockchain is owned by Sikoshi, something like a trillion dollars, billions of dollars, and he's not around anymore. So nobody has the private keys. So I don't really understand how you can protect that stuff. Anyway, it's a pretty big one. I mean, you couldn't resign it, right? So that means it's potentially a land grab. What you could do is, I know what you could do is you could destroy it. I mean, I, I don't really understand how you can take an existing blockchain owned by a million different people and somehow resign it without all those individual people regenerating public private key pair and signing it. I think they're going to have to do something like have a central bank do it. And then they're going to have control of it. And then the whole point of Bitcoin is shot that it's effectively visa or mastercard. I don't understand how they're going to do it. But there is a proposal and they got to do something pretty fast. Yep. Yeah. Do you have a comment in there? No, I was just saying is the is, you know, here, here comes stablecoin. Oh, yeah. Everybody's making them. There's like 17 banks.

57:24You're really going to make them in a year or two. Yeah. So yeah. Yeah, I agree though that the disturbing part is this is a skull rating that the Q day timeline. Right. Yeah, I thought it was just not really going to happen for any time soon, but apparently not. And there was some mandates. I remember back in the government space, we had to be all done converting by 2035, which was much shorter than your 2040, 2045 kind of timeline, but not necessarily better than that 2930 timeline, which we're seeing now. Yeah. And a couple of years ago, I wasn't, I wasn't really worried about the Q day stuff because of what I was calling the error rate. It was just too bloody high. Exactly. It seemed like we were very far away from something that would actually work. And maybe these Ion Q people are just exaggerating. That's happened before. Sure. But if they're not exactly that we really, we really got to get moving on post quantum encryption. Good news is the algorithms are out there.

58:26And there's even implementations out there you can adopt. Oh, they are. I've got projects for my students where you can easily implement it. You can make an HTTPS server that uses post quantum encryption. It and their browsers that have it. So I mean, the technology is there in sort of an early late beta version, you know, but we need to get it up to like production quality pretty fast. And and Jan get people who adopt it. Right. Yeah. And get it in the standards. That was one of the ones that we just rolled out an update for the 617 virus class. And you know, given the current state of all the algorithms that are involved in some of the best Wi-Fi security, I think there was only one instance where any of the cryptographic methods used were quantum quantum safe. And like and you know, some of the things I do understand like this is largely a, you know,

59:27captured now decrypt later type of scenario. And that's pretty devastating because it's just about everything that you captured now will be decryptable later. Well, and I think that was another big thing here. The 20,000 cubic machine will be able to crack it in 28 days, 26 days. So it's not going to take forever. Right. It's going to be quickly crack it. Yeah. Yep. Another stupid question. And I know Sam, you got a bail real quick here. Who's fun? Who's funding these companies to do this stuff? I know Google's doing a lot of it. And I think just a lot of people do it in the research. I'm also I think, um, I think Amazon has one. Google has a big one. And IBM, IBM is a big player in this space. Uh, this by the way, I think makes a lot more sense than AI. The first people to make a working quantum computer, I think really will get rich. Because people, if they get it down to something you can afford to put in your company, your data center, people will pay for it to get its valuable features.

1:00:27And there really will be some valuable features. I think it's, uh, it's very logical. It'll be like the next significant computing hardware. And it'll have other things that will do besides crack encryption. Other things will get much faster like running our AI models on them. Well, there is some of that. Yeah. And you know, but I think I think developing quantum hardware is a logical thing to race on, which they're racing. I think developing day, I is my higher, far more questionable because you cost so much to build the data centers and it doesn't seem to produce any product that a normal person would pay money for. But I think there's going to be a market for like mainframe quantum computers as soon as they're working. They'll be able to do something much faster and much cheaper. The HPC guys are really looking forward to it. Yeah, it'll be there for weather prediction and atomic bomb studying, you know, all the really tough computing problems, they'll be valuable. And shortly thereafter, they'll be down to doing normal business. I think so. I think is, I think there is a pot of gold coming at the end of that race. I'm very skeptical about the pot of gold on the AI race.

1:01:28But. Interesting. Good. I think you have to draw. Yeah. I think I better go. Okay. Yep. All right, Sam. I know. I can see you. We'll see you soon. Oh, all right, Lee, where should we go next? You want to do flock? You mentioned flock cameras. Yeah. I mean, the, the, I mean, because what, I'm interested in what's going on lately with flock because that I've been hearing, you know, I mean, I heard the bad stuff. But then I also heard that like places are pulling the plug. Oh, yeah. Yeah, it's, it's all over the place. So yeah, I had a wired story that said hackers got inside a flock camera. Data shows how the system really works. And it was, you know, unfortunately, it's wired and it's, I've read my last free article. Um, so this was a partnership between wired and a 404 media. However, um, probably should update this show notes. Um, a little bit later, um, I came across a, an article, let me see if I can dig it up here.

1:02:33Um, because I sent it to a friend. Uh, oh, so if I go to 404 media's article on it, I'll get it. Uh, I don't know. There's another one at, uh, Micah F Lee, M I C A H F is in, uh, Fox Trot. Lee, le.com. Um, he's got a blog up there that Fox security cameras are vulnerable limited, are riddled with security vulnerabilities in a hard coded secrets. And, uh, the first line is this morning, DDoS secrets published an exciting new data sets, file system images of the partition from an in use flock LPR camera. 404 media and wired published a joint investigation into it. So this is apparently the image that was analyzed for 404 media and, um,

1:03:34I wired. So that was the W get job that, I mean, that was the W get job that someone else was running that I had to check in the background and make sure it didn't crash. Or yeah, um, Bob, Bob, yeah, Bob's W get, um, so yeah, crazy. I mean, so now on top of everything else, we got issues with the, uh, luckily, there are implementation itself, let alone the misuse of the data. Uh, is I don't, I'm just having this vision is how, how bad is flocking on crash and burn? Yeah. And I, I, I, I, I, I, I don't argue it doesn't look good. There are so many, um, uh, so many districts, so many places that are saying, yeah, our, our constituents don't want this. Like our, our town, uh, we, I think we had two flock cameras, uh,

1:04:38it went before town council and everybody was so up in arms about them. Um, that, uh, town council voted to, uh, end their contract with flock and have the cameras removed. Yeah. I don't know about locally, but I heard that, I heard that story in a lot of places. Everywhere. Yeah, everywhere, everywhere. And of course, the irony, the, uh, the, not last night, the night before, uh, someone had posted, um, uh, a repost from the local police station saying that there are a bunch of, been a bunch of vehicle break ins. And if you live in these neighborhoods, you should probably making sure you're blocking the cars, because they've been sweeping through this neighborhood, breaking into cars and steel and stuff. And someone of course could chime in. Well, if we had flock cameras, we could probably figure out who it is. Like, yep, you probably could. But the other, the other amount of data that they're capturing and sending for analysis is, you know, above and beyond. Yeah, it's, it's, it's, it's, it's a side effect there that they're doing there.

1:05:42Um, yep. Yeah. So go ahead. Goodly. Oh, I just saw a quote from the art, one of the articles that says, the honest rise or movement, tampering with a flock camera is illegal. Mm hmm. Uh, but they did it, but they did it anyways. And that, that the group that, you know, had did the, the analysis or provided stuff to, for and we, and wired said, yeah, we went and stole one. It's illegal. We maintain a very low profile. Yes. Yeah. In fact, I'm, I'm wondering, you know, we've talked about, uh, you know, how, what they, but they've done to electronics in the past to make them basically impossible to tear apart. They, you know, why didn't flock if they're so worried about people jumping in their reverse engine. Yeah. I'll see. I think I need to say this, Lee, I don't think that they thought it was going to be a problem. Don't know. I don't think that was part of their, their risk calculus when they produced these devices. Because, you know, given some of the analysis of, uh, of what we're, um, we're seeing here.

1:06:49Um, you see here, there's another, uh, uh, post. Yeah. Someone, uh, so yeah, Michael Lee, the, what I, where I found this stuff, he posted to Twitter. Um, uh, he said, sorry, no, blue sky said the flock camera is running an absolute end of life software. It's on Android 8. One released in 2017 support ended in 2021. It's Android patch level 2018 6. Five and as running Linux 318 released in 2017 to quote, this shits eight or nine years old and full vulnerabilities. And then his next post was a 64 bit string somewhere there says, what's that? That's a hard-coded API token that flock cameras used to identify themselves and get OAuth credentials, which can then be used to talk to flocks production servers. Like anyone on the internet can probably do right now. Oh.

1:07:50Ha, ha, ha, ha, ha. Oh, uh, can you say spin, doctoring? Yeah. That's going to be just. Yep. It's crazy. Crazy. Now, now the other one Lee that I picked up, uh, it was a fairly slow news week for me just in general. So I was just trying to find a bunch of random stuff. But, uh, um, that I picked up on the, the initial wired for four media. But there was another one that I think I have two articles. One was four or four media and the other one was the original that slashed on about cops are using the back end interface to search thousands of flock cameras for reasons of he and LMAO and I don't know and all this type of stuff. Because when they do the searches, they were required to put in

1:08:51jurisdictions, writing the reason for the search. Like if you're going to go do the search to find this data in the flock back end database, um, you had to have a reason. And perhaps we're putting in like investigation and test. Also, they were putting in laughing my ass off. LOL, he, he, ha, ha, I don't know. Blah, TBD and robbery. I don't remember the case number. Leave me alone. Yeah. Then, then, then they changed stuff. So then the reasons became, fuck this new circuit engine. Dickhead should have had a weird kid in a bunch of just pounding the keyboards. Ah, well, that, you know, if you don't, parse the, dial, yep. So they, well, so they changed it. Um, uh, in, sometime in 2025, they changed how the reason box, you know, search function. It then became a drop down.

1:09:53Were you just picked a drop down? Like now all this stuff is just standardized. And so everybody picks the same drop down or just, or any drop down. Doesn't, right. Doesn't matter whether it's relevant. You just pick one and move to the next field. That's so, that's so much better. So you don't get the crap in the database anymore, but you still got crap for use. Yep. Or crap reasons for why it was done. Yep. You know, although this, this isn't new, I mean, I remember talking to somebody who was in, uh, I think they were a, uh, prison guard. And because of the Patriot Act, they could look at people's social media. And so they were looking not just at, you know, but they go, oh, I wonder if my neighbors any good. I'll go read their social media without, with impunity. It's kind of personal or, uh, it gets, it gets creepier from there. I'm just saying, who's watching the watchers?

1:10:56Yeah. It's a tough call because, you know, it's, I'm not going to paint them all with the same brush because there are, like, that have high integrity and ethics standards who would not do it this way. They would put a legit reason in there. They would pick the one that matters and only use it for what it's intended. The problem is it could be abused and a lot of folks did. Yep. Um, yeah. And then, and like, you know, reading through this, uh, so four or four media did some investigation. I'm sorry, uh, the EFF contacted a couple of departments who performed some of the searches with the, the weird strings. And, um, uh, one of them said a cop who wrote idiot got in their reason field, got away with it because by the time the department learned about it, it had passed a 90 day time period in which the cops union contract allowed for internal investigations. So saved, literally saved by the bell. Um, another one said that, uh, one detective who searched flock for reasons of blah only did so when

1:11:58he has issues with the technology or when the technology is not moving fast enough for him. Another one said process, huh? Yeah. Yeah, another one said, uh, they invested a cop who wrote driving around being weird in the reason field, but found it was for legitimate public safety concerns. Like, I don't like this at all. No, Mrs. Just, uh, yep. Well, yeah, I mean, you know, I ran across a guy who has part of his job and giving an access to billions of records on stuff. And he was arbitrarily good. They were local. He was arbitrary looking at whatever the hell he wanted to without relationship to his job or need to do that. Yep. That was creepy enough. I mean, this is, these are reasons why we have stuff like the health information, privacy, port, portable and private, privacy acts. Like, if you are going to review a patient's records, you have to declare the reason why you

1:13:03are viewing the record. And it records a reason of it. And somebody has to, and someone does audit that as to why you were viewing those records. Right. You've got to do two things. You've got the process for just fine the action. And this is in the law enforcement, they're supposed to be a warrant or, uh, yeah, we'll cause. But then there's the other key pieces, the auditing, which I don't really catch in this, not not a timely matter. I mean, they cooperate. I'm handing it, but I don't get that the auditing was auditing was timely. Yeah. And I think that the key here is that yeah, they caught it via an audit. The problem is that the audit was the EFF and 404 media, not the department. Right. As a, as a, there wasn't an SOP going on here. Right. That's not cool. No. It's, Oh, come on. It's the IOT story all over again. Isn't it? The security goes on in after the name goes on.

1:14:05Exactly. The S in IOT stands for security. Right. Right. Yeah. But these, and there's a shit ton of lot cameras out there. Oh, the interesting thing I think I've heard the folks that are canceling the contract aren't necessarily removing the cameras. Oh, yeah. That's a great question. So are they still out there capturing shit? Yeah. I mean, probably. So that was another one that I found that was kind of interesting that I learned was that it is my understanding because I went and searched various places to try to buy one. And, you know, eBay government surplus auctions, you know, various places on the internet to try to buy this type of stuff. And they were, I couldn't find any for sale. And part of that is because the contracts, the jurisdictions that sign the contracts, you get the flock cameras, they, the cameras are least.

1:15:07Oh, the jurisdiction doesn't, doesn't buy the cameras. They are still property of fly. So that, yeah, if, if they're going missing, it's because someone cut one off a pole and, you know, fell off the back of a truck, you know, those types of things. And those are some that will happen. Oh, for sure. For sure. So those are the, those are the shadier environments that I don't necessarily want to get access to for something. No, no, no, no, that's, that's, that's not, that's not in your M.O. Larry. That's, that's the kind of thing you do. It's the, I mean, the, I mean, the hats and some day end up very, being various shades. Um, you know, gray, black, red, sandwich, right? There you go. Yeah. But, uh, yeah, that is, that's definitely a hat color that, you know, I don't think we know. So I wouldn't suggest you go in there. That's why you were looking at traditional resale markets that would have them on there. Yeah. You weren't looking down, you

1:16:08know, down the street, the guy in the trench coat. Yeah. Want to buy a watch and a flock camera? Yes. Yeah. Throw in some recordings. Yeah. Oh, yeah. Moving. Speaking of recordings, how about your story number three, which I also had. Yeah. I mean, there was some interesting, I mean, there's, there remote control remote access supports software, which is okay. So connect wise is for remote connect and support. Yeah. Good. Lee. Yeah. And so, I mean, unfortunately, this green connect, you could, you could, uh, basically pass it files for execution. And they were using VB, if this is the one, they were using VBScript to, uh, to literally find connections and active sessions and take them over. And and Huntress wrote a really interesting blog about this. Huntress and Watch Tower are always fun to read.

1:17:11Yeah. That's crazy. VB scripts. And so, and I think Huntress is the only one that I've ran into that had IOCs. If you want to see if anybody's been going around. I think that was the case here. I mean, there's a lot in there's a lot in the in the in the in the in the in their article. A lot of good good technical details, which is very cool. But if you're scrolling while while blathering to find the IOCs, it takes a bit. Yeah. They have the IOCs in there about, uh, cool. Two thirds of the three quarters the way down the, uh, are down the web page. They have all the IOCs to look for. Um, yes. Yep. And, uh, that's, to me, I mean, it's the, you know, we know we have to pat patch and you have to do some, as I recall, you had to update the access agents and reinstall the close clients. By the way, the patches are for the server. Um, but then there's the, so I got

1:18:16to go look and that was actually when I was looking around at this, I'm going, well, why isn't anybody publishing the IOCs until I got to the huntress because it's like, um, isn't that sort of make sure I'm healthy 101 go look and see if I've been compromised. Yep. Um, and, uh, which, you know, and we've, and we've got threat hunters in most of our organizations. It's like you just, you slide this like the pizza under the door and they go off and see if it's there. Um, and let you know, delegate me while you finish your cup of coffee. Um, yeah. And yeah, this one was a really interesting one to me because I, you know, I dealt with connect wise, um, first and remote supporting agents, you know, you know, I've got to go back on working in healthcare, you know, 15, almost 20 years ago. And I'm like, one, I can't believe they still connect wise is still a product. Um, and that it's still available and people would use it, which was my first shock. Um, and I forget

1:19:17which article I saw that it sounds like they have 100,000 customers. Yes, connect wise, connect wise provide services to more than 100,000 IT providers worldwide with many service providers and IT teams using screen connect remote access platform for troubleshooting. I'm like, how big is this problem really? And I'm like, oh, they have a hundred thousand customers that that's that's pretty decent sized. I mean, I could be a lot worse. Yeah, but, and, you know, and by the way, they've got both hell hosted and local, you know, they provide cloud, a cloud service and they also have and you can also run it in your shop for remote support odds are you're going to want to run it in your shop, not necessarily let their cloud service do it. But if you are in the cloud service category, you, you skip one of the three steps. You get to skip the patcher server step the rest of you left to do. Yeah, somebody else's computer. Right? Yeah,

1:20:19so I mean, I'm actually become more of a fan of a lot of the cloud service providers with with the high patch rates there on it. It's one less thing for you to have to do. So I encourage you to look at it again. See if they really need to be able to put their hands on it. If they can't get sufficient security to run it the cloud, because damn it, we don't need more to do. Yeah, no, like this, that's, that's describes my home and my lab network to a T le, you know, 10 years ago would have been, yeah, even 20 years ago would have been, I'm going to go spend a whole bunch of money on a bunch of computers and put it up my 19 inch rack in the basement because I control the data and I can run it myself. Yep. And now it's like, oh, man, I got to spool up a computer and patch it or run an AWS instance that I still have to patch the operating system on. I can just host that and get hub pages and I don't have to do anything. I just created directory and more important, I asked AI to create the directory and push the content to it and it's done.

1:21:19Well, it was me. I had my, my little, my Intel knock and I had several VMs on it. And most of them I hadn't launched in a couple of years. Yep. And it, it bit the farm. The one side I had on there that I cared about was my Linux photo album. And I'm like, looking at the cost of a knock on a drive or and I had a backup. Yep. And I'm like, you know what? I can just host this stuff out here at the, at the, the album software I use a cell storage, same domain name. They'll put, they'll, they'll put the Lets and Cripser or whatever the hell on it. Yep. So I just said, you know what? Did that publish it? It took, I don't know, two, three days to push it all up there. And it, because it was 250 gigabytes. It's done, but it's done. Yep. And I haven't powered on the, in fact, I haven't gone and accessed the knock in there. It's still sitting there with the cordum plugged. More important things to do. Well, actually, one of the really cool things I got

1:22:24is that there, there's a recycling center, a little ways away and Boise that will recycle computers and you can have them take care of wiping the drives. So, because how many drives are in your pile that you plan to wipe soon? Yeah, I can't quite reach the couple over here. Many, which includes my wife's old computer, which we replaced a couple months ago and the new one is working really well. But so that's why I'm thinking, you know what? I'm just going to take those down to those guys and have them give me proof that they've done it. And, yep. And I don't care if it costs a little bit because my times were something. The other fun place to do that, Lee, is to find a very sympathetic gun range. Oh, I've got some of those. I have to be careful right now. There's a ban on metal traffic targets because of fire danger. Yes. One of the ones we

1:23:24use just regularly is on BLM land. And some dumbass was shooting tracers at metal targets and set off a 30 acre burn. And BLM is posted a brand new sign that says, thou shalt not do these things these times of year, which basically you can still shoot whatever weapon, whatever a caliber. But you can't be shooting, you know, tracers at steel targets. Yeah. Or other. And it's actually the alternative. I mean, I'm actually glad they didn't say that's it. We're done. Yeah. More. It's just not right now. No, it just works smarter. And so that's okay. And also, it's nicer to have a nice sign that doesn't have as many bullet holes in it. In fact, they're not in the current sign. That's my target. But anyway, so it's yeah. So, so one of the I always

1:24:24the one of the ones I thought about you on one of my stories. Let's me find it. Uh, uh, uh, uh, well, we talked about the one that always listening stuff. That was I thought that would turn. Oh, it was kind of a happy story. Not was my number four. The UK government rolling out PASKII to 20 users. Uh-huh. I mean, like we've been talking about fishing, resistant and cryptically secure login. They did a pilot of I forget how many users, about 10% of the users. And then they're now pushing it out to everybody. I mean, I've been claiming that PASKII scale. Hello, UK one login. You just made my argument for me. Yeah. Um, I'm wondering how many people are not accepting a PASKII when it says, would you like to create a PASKII for this login? Yeah, I I had resisted for for quite some time. Oh, me too. And I've actually started using it a little bit. And I think it scares a lot of people largely because they don't know what it and I was scared about

1:25:27it for a while because I didn't know what it was or what it meant or you know, how was it protected and I could definitely see like the password. I know how password works. Um, you know, the PASKII thing was was kind of interesting. Um, in the way that I heard it explained to me was that it's mutual TLS that you're they're providing a certificate to me and I'm providing a certificate to them. So we have some mutual trust based on that. And that was that that was kind of how I got it. And I'm like, oh, well, that makes sense, I guess, but it's behind the scenes and no one knows really what it's doing and it's crypto. So it's mad. Right. No, but the killer is for an end user. I mean, you've got to get the PASKII on the devices you're going to on all the devices you use to service, either by having an explicit one or you've got it like a shared wallet that's across one way or the other. But then once it's there, you just click the PASKII button and you're in.

1:26:29You know more given them a password. There's nothing that can be reusable and compromised. Yep. And that to me and it's pretty slick. Yeah. What you understand what it's doing. I mean, the the argument there is is that the PASKII is stored on a device. So now in order to use the PASKII, they have to compromise the device. Yeah. And you know, we've seen those attacks for many years, but there's got to be something else there to go along with it. But they also can't call you and get you to read them your password. Eski, right. You know, that's not a thing. Yeah. And so fishing resistant. It also replay resistance. It's not going to be able to replay the session. Now if you use a PASKII to get a reusable session token and that token's captured. But I still that's our yeah. You having the PASKII there instead of a password is a huge win. I mean, you still could get that token, but the process to get it is much harder. The process to get to get a good token is hard. It's harder. So you know, deal with one problem at a time.

1:27:32And so I'm thinking there I would encourage all the folks. Listen, if they haven't messed with the PASKII, take it, do it. Learn what it does. Play with it. See where it falls down because I think you get comfortable with it. Then you can get behind an implementation in your shop. And whereas if you never played with it, you're kind of going to, I don't know, the users might be revolting. Well, users always hate change, but this is cool. And people do understand about the need not to get their stuff compromised. Yeah. So anyway, I just thought that was a really cool kind of good news fun. Yeah. See see here and Leah, I thought you were going to talk about your story number eight being the fun fun story. The new guidance from Anisa on CRA. Yeah, I didn't consider that fun. I considered it good because they had a, what was it? CRA came out at the end of 24. Yep. With a full go live date at the end of 27. Yep. But the interim date was September 11th

1:28:35just this year. Right. This year. Yep. A couple days ago. Right. And yeah, they had put out an FAQ. But now they just created this really nice document. It's 83 pages. You don't want to just, this is not something you're going to skim. But it spends a lot of time defining what they mean is in scope. And it talks about open source and closed source. And what if you've got open source embedded in your as well as hardware components, which is really cool. Whether you agree with a CRA and what they're trying to do, I mean, I'm not so sure about that 24 hour reporting animal. Having a clear picture of what the hell they're talking about is really important. Yeah. And I think, I think no, we're at my day job. We're in the market of trying to help folks comply with CRA. And I think that's why there are so many organizations that were like, yeah, we're going to wait and see how this plays out a little bit here because there was no guidance. There was none of that documentation about here's what's considered in scope. And here's how you need to deal with that because it just

1:29:38wasn't published and it wasn't published until the damn deadline. Like you've got to do this thing. But we're not going to give you any advice. I hate that. And we're not going to, you've got to do this thing, but we're not going to explain what this actually means. It all depends on what your definition of is is. Right. So yeah, that's unfortunate, but they did do it. And you know, it's, I'm what I'm worried about is people sitting there having a hauling about what they're going to do and all of a sudden it's, you know, it's too late. It's 28. So yeah, I like start doing your nonsense. You've probably seen this in your day job. Oh, yeah. People are just trying to get their arms around it. What does being what am I going to do? And, you know, and I haven't looked, I mean, I saw a comment that the that the fines associated with CRA are way more severe than what we did with G, G, oh, yeah. Oh, yeah. Not cool. And it is pretty much anything they do

1:30:40the term digital as opposed to hardware or software. They say digital. Yeah, what do they call it? Digital something. Digital products, digital elements. That's it. Which means it's anything, right? Yeah. It's your, it's your, it's your listening watch, it's your phone, it's your, get your doorbell camera, it's your computer, it's your friend where your Wi-Fi router, your hard drive. Yep. Your MRI machine. Yep. If they talked about, have any of the folks you talked about the advantage or just getting the what is the CECL? It means it's compliant with your, yeah. And there's still a lot of a lot of pushback on on that as well. The arguably requirements to do CRED are still fairly complex and requires a lot of work that so many companies are just not willing to do. That's right. And I get to work with folks in all sorts of the spectrum from

1:31:45the first year suppliers down to like the second year and even the third year folks. The top tier, the first year manufacturers of components are like, yep, we want CRED. Don't get, because then we can sell to everyone and then it becomes the next step down problem. Like, yeah, your your Wi-Fi chip set is ERED compliant. But now it goes into a Wi-Fi router. And you know, I think I personally think that so many of the second tier are like, well, the chipset CRED, so we're good. Not realizing or not understanding that now that the Wi-Fi router needs to be CRED as well, because it's now, it's now not the single component. It's a collection of components that is now a new digital product. It's a different skewer. And all I'd, by the way, you're on, you're now on the hook for timely security updates, support periods, guidance on modifications to aid in making it. Or do you have to not only keep it updated and secure,

1:32:45do you have to be able to tell your consumer how to secure it? So there's some mortgage there. It's not free. It's not a rubber stamp. Vulnerability management plan. You have to look for vulnerabilities, take your vulnerabilities. And that's where the point. And when we start talking CRE, that's where that reporting timeline comes in. And I think from what I saw with a lot of the CRE stuff that so many folks are like, yep, we're just going to do this in-house. No problem. They'll send us an email when there's a vulnerability discovered. And we'll just we'll just triage that. They're like, but do you know how to triage it? Do you know who to call? Do you know who the person is that needs to develop the fix? Do you know who's going to report this to an ESSA? Do you like, there's so much that goes into that that I think so many organizations are just kind of like, yeah, we'll just play it by year and not realizing what then they played by year and they screw it up that the monetary penalties are significant. And I'm also having flashbacks to having a conversation with a vendor about this before all this. If their service had a vulnerability,

1:33:52they would report it. What they meant was they would report it to somebody, I don't remember exactly it was like somebody like they would tell like US cert. And then it was up to you to find out from US cert that there was an issue. You see how that might not be optimal. Yep. Yep. And so you have to have that relationship. Ideally, it's a push relationship where you just put publish it once and it goes to the people that need to know it. You're not having to say, tell Bob, Nautil, Sue, Nautil, Jane, Nautil. Yep. And because you know, the person reporting it shouldn't have to be working that hard. And you should be able to subscribe to the alert and then you deal with it. But having to go to a third party to get it, no, no, no, no, no, no, no, no, I'm not going to work. I can work. This is the it feels like the actions of so many of the manufacturers of digital products. You know, we talked about the gamut of that so much reminds me that it feels like the behavior of so many organizations are what I encountered when HIPAA

1:34:56became a thing in the United States. And they gave you a ramp up time to when you had to be compliance. There was for this privacy and security for HIPAA. The privacy thing was, you know, pretty much a no brainer as a bunch of a couple of policies and maybe a couple of operational changes. But the HIPAA security rules are significantly different. You needed to have a big volume of policy and some a whole bunch of technical controls to go along with that. And I was in healthcare at the time. And you know, the people in that were leading IT said, we need to take this really seriously. We need a project. We're going to put a project plan together to develop all this stuff. And in the committee to develop the HIPAA security group were like the presidents of three hospitals, the CIO. There was no chief security officer. That was effectively me, but as a manager title who led the project. But legal counsel from all three

1:35:57hospitals. And legal counsel basically said, why are you bothering to do this? No one is ever going to get sued for this. And if somebody starts that 10, some of that happens 10 years from now, then maybe we need to start taking it seriously. Legal counsel said this. And all of the presidents and the CIO executive said, you know what, maybe you shouldn't be part of this committee anymore. And then you could seriously. The other way that could have gone is that everybody left the table because they were going to go with the it's not, you know, that's way to listen to the real thing because, oh, that's that's frightening. Yeah, I it feels like I get the general feel that, you know, many organizations and typically not the ones I'm talking to many organizations are like, yeah, we're just going to wait until and see what happens. And we're not, we're not going to be the guinea pig. You know, we're, you know, somebody else will get fine for this. And yeah, it's not going to happen to me. It's not going to happen to me.

1:37:01Yeah, well, that's actually where the your relationship with your legalism important when some do this. So you can sit there and spitball and not, not get in trouble and, you know, tell them, yeah, I know, you know, yeah, you can defend us in court against that. But wait, let's talk a little more. Um, because, um, anyway, did you have a story? I was wondering if you had a story you want to talk about me like your, your, your tanker story or anything else? Um, yeah, what was one of the other ones? Oh, we mentioned in the beginning, my story number seven. Yeah, cyber attacks, the title was cyber attacks cost organizations $52,000 on average. That seems low. Yeah, it does. Um, so, uh, his, his, his, his cock cyber readiness report. Um, and I could determine really where his cock was. They did a study and as part of the study said, UK based firms, uh, sorry,

1:38:02nearly a third of organizations, global, you have been hit by a beast one cyber attack in the past 12 months. Um, they said UK based firms were most likely to experience an incident with successful attacks reported by 38% of organizations and you asked were at least like the at 20%. On average, cyber incidents past 12 months cost organizations $52,000 the highest, the average cost of his incident was highest in Italy, and 134. These are some crazy, crazy numbers that I thought were incredibly low. Yeah, and the average downtime of 32.8 hours, that's probable. I guess if you average a lot of stuff, I mean, we know like, for example, uh, what was it? Yeah, Jaguar was down for a couple of months, but some of the newer hacks, that victims have been up in days. I don't know if that's third and less than 32 hours, but

1:39:04they're people are, the response plans are getting better. People are getting better at pulling, you know, putting up dumpy back together again. Yeah. Yeah. Which is cool. Um, I still worry about the health, I'm worried that health care has been hit like, like they're a buddy punching bag a couple of years. Yep. It's not, it's not cool. I mean, I realized that they've got issues and it being taken advantage of is still not cool. Yeah. No, and they're, and they are working on it. And I don't, you know, I can't say they're, they're not just sitting there, watching from the sidelines. They're trying to take actions. Yeah. And it's a challenging environment. Yeah. And it feels like, you know, it's mostly, and the just just general feel feels like mostly US health care. Again, that's where I want to, my news is focused that this happens. Which is, which is bizarre. It's like, oh, yeah, these, all the hospitals, all the not for profit hospitals, you know, are so underfunded and blah, blah, blah, blah, that they don't have all,

1:40:05they don't have any money to, you know, that they're incurring so much security technical debt. Yet the fees for procedures are astronomical. And then the insurance companies don't pay out. So it's like, what's going on here? It's going on here. I don't get it. Yeah. There's something, there's something, there's, there's an elephant in the room somewhere, but I don't know what it is. Yeah. Yeah. Speaking of the elephant in the room, the last section of this article, in the study, was 6,800 security decision makers across the UK, Europe and the US. They found that businesses are investing on average, $51,000 a year in strengthening their cyber resins. Mike, that, but you know that old joke about if your coffee budget is more than your security budget, you might have a problem. This is not a reason. This is a reason of that, especially when on the cost of the attack costs $52,000. Yeah. I mean, yeah, you might want to spend a little more.

1:41:12Plus, I'm thinking so many of these, you know, when you get an enterprise license and something, you're talking hundreds of thousands of dollars, which is a big number and can hurt, but that 51 does not feel like that kind of number. Yep. And this really, I think this last paragraph starts to really key in on some of the type of stuff. So that investment of $51,000 in goods, updating employee, cybersecurity training, higher additional cybersecurity personnel and purchasing new software and tools. 62% higher of cybersecurity training. Wow. Yeah. I mean, I see the value in it, but that, the next one, let's see, the insurer also reported that businesses are taking steps to improve the security of AI tools, scoos and upskilling employees and AI and cybersecurity, expanding AI awareness and training programs and reviewing cyber insurance arrangements to

1:42:16ensure AI risks are coverage. And now it becomes clear. If I recall, the Hiscock group is cyber insurance. Aha. I mean, I was in a presentation on D&O insurance and shockingly, the presented by an insurance agent and shockingly, he mentioned, hey, if you guys got cyber insurance, and so on the other hand, there is a cyber insurance in order from the payout, they've over the years they've raised the bar. Yeah, yeah, they have M&A. And so it is a way for a company to raise their security bar if they want their insurance to pay out. It's just that might be a little bit on wishful thinking on lease part, but I mean, technically, if they're auditing and making sure

1:43:19you're actually meeting the requirements to pay their policy, you'll get there. But and but you know, claiming you're too small anymore is or nobody cares about my data. No, sorry. Can you say a third party? A third party. But I mean, it's an interesting report. I mean, that's not a good one to read, because really, yeah, I was kind of shocked about some of that stuff. So, yeah, it's good information. I'm speaking of one, Sierra Lee. Definitely want to grab a couple more years here. My story number one, International Cyber Digest, like the title is not descriptive and I'm bad at that. But this is a an ex post from International Cyber Digest, who basically was able to get in touch with the

1:44:25person who nightmare clips, the one that's been dropping all the Windows Zero days. That guy. Yeah, it turns out, Abadal Hamad Nasiri, who used to work for Microsoft. Really? Yep. And he got fired from Microsoft, from some, you know, allegedly, you know, weird. Some tale of low, let me see here. It's not letting me come in, because I'm not logged in. But in any case, yeah, they told him he was going to get fired. They're blacklisting him from Microsoft and then writing in bad references so he'd never be able to get a job again. And like this, as he says, after he poured his heart and soul working for Microsoft,

1:45:27and countless stupid non-sleep nights. Yeah. Yep. Let's see. And he spent 200,000 in Germany fighting Microsoft. Yep. For unfair termination. He was only a couple months away from getting permanent E-residents. And then because he was only a couple of way and Microsoft fired him, they basically could lose his permanent E-residents. So, yeah. Crazy. Crazy. Does the unjustified the means? I don't know. I mean, I'm releasing those arrow days feels like though, you know, he's just desperate to get even because he's not, he's not made any progress to legal channels, which is sad. Yeah. And but yeah, yeah. In any case, it still feels like he's pulled the nuclear option at this.

1:46:28Yeah. Yeah. And, and, and, and I don't think it's helping any of his cases for, you know, any of the, the wrongful termination or any of the termination suits and that type of stuff. So, yeah. Yeah. Yeah. So, yeah. I mean, yeah, you, you're, you're, you're in court here, but while we were messing around, you went and knee-capped the guys. So, no. Yeah. No one worked that way. Speaking of knee-capping guys, Lee, what, you got to go to a couple of stories in here. They're fun. Oh, what were you, I mean, the, I mean, you think in GitLab, you think in, can, a checkpoint. Yeah. I'm thinking checkpoint. Yeah. Checkpoint. Yeah. I mean, they had a couple of different vulnerabilities out there, one, expecting their security, gateway and spark firewall, another impacting their, their management server and spark firewall. They have patches. But I thought was interesting. And this was one of the things that I was going through

1:47:31them. The, for site to site firewalls, they, they have a mode where it can automatically figure out what traffic UDP 500, 400 should be going and 4,600, I think, 4,500, excuse me. 4,500. It should be going back and forth dynamically. And I'm thinking, then their, their advice is, no, you should let that be automatic. We should, you should define what should be talking between A and B. And I'm thinking, maybe that's because of dynamic IP on a site, you might, but I'm not sure that really that, I mean, what is it? Basically, it's a couple bucks a month for, get a, get a static IP if you're, you're having your own MSP. Yeah. I mean, your own, ISP, excuse me. If, and so, for that, and then limit the traffic, seems like a pretty good start because basically they're getting into that traffic and that manager, and oh, by the way, apply the patch and go find the, go find the, go find the, and go turn on the auto update too. Yeah. Is this the one where you had

1:48:38to call checkpoint if you wanted the IOC that might have been? My name, remember. But in any case, I mean, obviously I want people to go find the IOCs. But yeah, the implied rules for the VPN is the one I'm talking about was site to site. Yeah. I don't want to do that. And so, you know, we've been talking about, you know, really VPNs need to go away, but it is so, we have so ingrained that term into people's consciousness. What's the next generation that, the thing they replace it? Right. I mean, people say zero trust real quick. It's like, wait a minute. You still have assurance is that the right endpoint is connected. And you're not necessarily ready to just rip down the VPN and go to all those, those, zero trust. But yeah, I don't think, breathing this, the, yeah, I don't think there were IOCs because the checkpoint says it discovered both vulnerabilities internally and there's no evidence they've

1:49:41been exploited. Okay. That's not one. Okay. Cool. I take that all back then. So yeah, you've got to call them for IOCs. Yeah. You're right. Technically. That's which is the best, which is the best kind of right. But yeah, it's, it's, I, you know, I want to make sure you can go look and see if you've been, you've been, you've been messed with clearly. This is at the perimeter. So people really need to fix these. Sometimes I'm looking at stories like this and it's like, and there are still 11,000 devices out there or whatever. Some big number that people just went out and like showdown and did check. Yep. And I'm listening. I've advocated layers of priorities and the stuff that's right on access control at your, at your boundary. It is. That should be number zero when you're comes to keeping it secure. Yes. Yeah. I love that you said number zero because it's more higher priority than one. Yes. Yes. Yes. And oh, by the way, you should also have some cadence where you're making sure you're up on the latest security figure. Because they come up with new tricks. Believe it or not.

1:50:49Trace is chocolate. I know. I know. And well, sorry, I came from a compliance world, right, where we had annual testing and annual blah, blah, blah, we're repeating, including on an cadence where we re, we cleared people, right. We investigated them. Right. Because people do go bad. Life happens. Yep. Yep. Life circumstances changes. But so many people in the private sector I talked to is we do a pre play and point screening and then we're done. Yeah. Yeah. We do a background check when we hire them. Yeah. Okay. Which is cool. You need to do that. When you check to make sure they're still cool. Yeah. But back people's bad. Background doesn't change. It's the future. It's the future ground. It's because we're people. And you know what? It's because we're people we want to work with other people. I mean, it's part of the risk. It's also part of the reward. Yep. So, you know, it's not personal. Of course, it costs money. Right. And anyway, but yeah, that was that was a neat one. I'm, you know, the nice thing is this one is

1:51:53that the good news was there was already a patch for it. I mean, it's bad news as an RCE on your on your VPN gateway, but there's already a patch. Yeah. Fix it. Yep. So that's that's a a of course, pity the pity the guy that has to take it down. Get permission to get it for downtime. Oh, guys. Yep. That's the big one. Right. Because, you know, you know, if someone's going to be on this all the time, and if it's a point to point, yeah, or site to site, rather. Yeah. Yeah. Yeah. You're going to have to you're going to have to do some tap dancing, but you can also remind them that the adversaries aren't going to wait for an appropriate window to attack. Right. They're not going to wait for patch windows. But yeah, but that reminded me of the the the Git lab story. I know you're using. Oh, yeah. The Git labs, the hosted when you do it yourself. Yep. One of the cool things, if I remember on this one is this one, you can if you have a multi-node Git lab in blitz, you can apply the instance, you can apply the updates with zero downtime, which is cool. It's

1:52:58nice to see zero downtime updates. I mean, obviously, I think you're what you're doing is taking a note down up, bring it back. Yep. Which is fun. synchronizing. Yeah. Because things were the connections rotate. Users are not in fact. You should tell them you're doing it, but they're not going to see it. Trying to do it without being noticed is always going to backfire. Yep. Yep. And but I was looking through that one. And they had like three different revs of the Git lab product. I was looking at the at the feature list in their site. And it's like, dude, go for the 1932. It's got all these other things you need that are fixed that work better that are kind of in trouble in these other versions. So screw the other versions. Get to this version. Yeah. So it's like, it seems like if you're on a point release, you need to read, you know, due to the latest point release. And there's got to be some reason why you can't go or there's some difficulties going between the different point releases from 19.1 to 19.2 to 19.3. There's got to

1:53:59be some change that causes potential issues. Right. In this case, it's the Git lab API. And it you're looking for, you know, basically unauthorized from roommates and releases, right? You're looking for somebody doctoring your source code to point on it. I love your comment here. Make sure you've identified all the self-hosted Git lab instances in your environment. Well, Shadow IT, right? Of course. I've heard you know stories about some organizations recently that were like, oh yeah, we have some some problems with how we deploy code to get it because instead of just making a branch and merging a branch, we just take a whole new copy and then we work out of that branch. So they've got like 300 different branches and you know, lots of different stuff. And oh yeah, by the way, we did an audit and we found that there were 32 Git lab servers. Only 32. That they found. It was like a couple weeks later and say, yeah,

1:55:01we found seven more. And we found a bunch more. Yeah. And it was largely because they just gone to like DNS and said, oh yeah, these 32 servers have Git lab in the name. That was the only way they found. Have you have you have you ring? Have you rung up the scan team to see what they're finding? They can find exactly exactly. That was always an interesting conversation. I'm talking to the scan team about what they were seeing. Yep. What they were finding is like, oh, dammit. But that's what they're there for. They're there to help. They're not just they're not solely there to find problems. They're there to help us keep our environments secure and identify it. Although, yeah, I was thinking about, you know, then there's all auditors. Usually auditors cover tools are way overpriced. So I hesitate to wave that flag. Yeah, it's a nice idea. But yeah, speaking of way overpricedly, my story number eight,

1:56:05the Coast Guard and FBI investigating two oil tankers oil being the overpriced stuff right now, bound for the US hit with cyber attacks there. When I found the story, there's not a lot of detail on this. That two oil and natural gas tankers headed to the US said, at least one of them said they were in the strategic brawl or when it was hacked. It does say how they were hacked, why they were hacked. What the impact of the hack was, but the vessels were all acting normal. And apparently the measures were designed to ensure integrity of the vessels operational and information technology systems after they were compromised by foreign cyber actors. I mean, there's a bunch of compute and power on a ship these days. Oh, sure, for sure. And, uh,

1:57:07I mean, cooperated with authority and with critical partners to ensure it's retro mitigated. That's wonderful, but content free. Yep. And this feels like a spin. But yeah, I would love to know how they were hacked and what happened. Yeah, because if you think about that, you know, going through the straight edge of a alter, how was the ship hacked? Like, you're either talking insider threat somebody on board, plugging into that network because that network is, I want to say air gap, but it is not air gaped because they are using other communication methods to get data, you know, cellular, you name it. Exactly, Starlink. You know, what we heard that we saw that story, you know, almost a couple of years ago about a US naval worship or something of the right that some soldier brought on an access point onto the ship and plugged it in

1:58:07and like, yeah, that's that's shadow IT. Exactly. But not not a not not in a good way, but no, no. So, I mean, I'm I'm hoping to hell that they found whatever the root cause was and made sure there were other vessels with the same problem, right? I would not be surprised if it was an insider threat somebody on board doing in some sort of implant would not at all. So, yeah, back back to that whole conversation, we just said, yeah, background check. Yeah, their background was good now, but now someone's been, you know, I'm going to use a term radicalized after the background check was done or they've had a change in philosophy and now they have the opportunity to do bad things. They have been co-opted, compromised. There's another word out there that I can't think of, it's not I'm not unwilling to say it. I just don't remember it. Yeah, damn it. Yeah, but that I'm glad they fixed it. Hopefully they've

1:59:09taken care of the root cause and stuff. Yeah, because geez. Yeah. All right, so very last last minute, we got anything else. Oh, my number nine parallel's desktop. Floor hands are a little bit easier. Exactly. And I thought that was kind of fascinating. Like I originally discounted that and I remembered that so many folks that I have talked to since moving to an M series Mac with ARM architecture, abandoned VMware. Because VMware was like, yeah, no, we're not going to do any support for Intel on on ARM hardware. Sorry about your luck. So so many people migrated to parallels. And I'm like, I migrated away from parallels to years ago because it wasn't very good at the time

2:00:10and I moved to VMware. Yeah. And so now I guess there was a fairly recent push back to parallels. It's I mean, I never got to play with parallels because of its origin story. Yes, it was not approved for. Which I don't know if it's still that way. It was at the time. So I went down the VMware path instead. And in fact, I still run VMware on this in the map. This this M series Mac. I don't remember which chip it is. M2 I think. And it but I'm running the ARM version of Windows. I'm not doing it would be nice to have full on Intel emulation. Now, no question of that. I know we're getting to start being over time here. But Lee, how have you found using Windows ARM? Are you just using it for like web browsing or just a little bit of stuff here? Or do you have applications that you needed to install? Yeah, I have. And it first it was painful. The biggest thing I had to get was the right version of

2:01:15the VMware tools to emulate things like direct X and and and peripheral access and the like. Gotcha. Because the what is it? Rosetta is running in there and it's doing fine for some translations. But it's it's it's but I'm mostly running ARM versions of apps, you know, because you run the ARM version. When did you get the ARM browsers and all that? That's still me. But I have a couple of apps that I got it for that they don't do the Mac. They and they and they're working just fine, including that from 2017, I think at the at the at the latest app I used to update the firmware in my remote control system for my mall train. It just worked and I had to you know, it needed a us USB to a serial port cable, you know, basically the dynamic you are. Yeah, once I got the drivers in there for that and it was the website told told me what to do to get the virtual serial port. But that wasn't an ARM thing.

2:02:16That was just it would have been the same thing. Yeah, so yep. Yeah, yeah, that yeah, the concern is I from from what I'm seeing like, you know, that's one of the things I have one customer that I deal with that in order to update some of the stuff that we're doing, you need. It's an Intel executable for Windows. And I like, is that going to run on my ARM Mac? Are they going to is Rosetta going to work for me there type of deal? Like I said, once I got once I got past the video stuff, I've been fine. Okay, interesting. So I'd say give it a shot. Okay, you've got a pretty fast Mac. It'll fail real quick. This is true. Well, actually with this this train thing, I had to install .net 3.5. And it took for freaking ever. Well, .net always take the free forever to install. But it yeah, why you well worked. I was expecting the blue me away. I was expecting, I was expecting, you know, little bomb or something. No, it just worked. It's like, damn. Okay. But I think a couple years ago,

2:03:19when I started my mileage would have been different. Okay. Okay. Yeah, I'd be interested. I'd be interested to hear some of our our listeners experience. Absolutely. Because I think that's going to be a challenge. I'm going to be facing pretty quick here is, you know, running Windows, you know, VM on ARM. And some of those types of things. So yeah, I mean, I've got it. I just haven't really needed to use it. So it's gone the other way. I put Windows in a VM on Intel instead. So there you go. Cool. All right. Hey, we're we're at time. So we should probably wrap it up. Thanks for thanks for joining us for some time. And thanks for Sam for joining us earlier. But Lee, why don't you take us out over and out.