Talkin' Bout [Infosec] News

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

🔗 Register for FREE webcasts, summits, and workshops -
https://poweredbybhis.com

Chapters
  • (00:00) - PreShow Banter™ — testing testing
  • (00:11) - Hot Take Predictions for Next Year – 2025-12-15
  • (02:10) - Story # 1: Russian kids revolt as Kremlin bans Roblox, other popular apps
  • (10:21) - Story # 2: Google's killing off its dark web report because users didn't know what to do with it
  • (20:05) - Story # 3: Coupang data breach traced to ex-employee who retained system access
  • (31:13) - Story # 4: Roomba maker iRobot bought by Chinese supplier after filing for bankruptcy
  • (34:18) - Story # 5: February report from researcher found Chinese KVM had an unclearly documented microphone and communicated with China-based servers, but many of the security issues are now addressed [Updated]
  • (36:48) - Story # 6: When adversaries bring their own virtual machine for persistence
  • (41:57) - Story # 7: Oh no! Hackers snuck malware inside uber-popular Windows app Notepad++
  • (44:20) - Hot Take Predictions for 2026

Links
Story # 1: Russian kids revolt as Kremlin bans Roblox, other popular apps
Story # 2: Google’s killing off its dark web report because users didn’t know what to do with it
Story # 3: Coupang data breach traced to ex-employee who retained system access
Story # 4: Roomba maker iRobot bought by Chinese supplier after filing for bankruptcy
Story # 5: February report from researcher found Chinese KVM had an unclearly documented microphone and communicated with China-based servers, but many of the security issues are now addressed [Updated]
Story # 6: When adversaries bring their own virtual machine for persistence
Story # 7: Oh no! Hackers snuck malware inside uber-popular Windows app Notepad++


The team looks ahead to 2026 and shares practical, sometimes blunt predictions about where cybersecurity is heading. They discuss how AI will continue reshaping both offense and defense, with attackers using automation at scale while defenders struggle to operationalize AI beyond marketing hype.

The conversation highlights growing risk from identity abuse, cloud misconfigurations, and insecure SaaS sprawl, noting that many breaches will still come down to basic failures rather than advanced exploits. They also predict continued burnout in security teams, more consolidation among security vendors, and increasing pressure to prove real ROI from security tools.

On the positive side, the hosts see improved detection engineering, better security education, and more community-driven knowledge sharing. Overall, the message is clear: fundamentals still matter, hype won’t save you, and organizations that focus on people, process, and visibility will be better positioned for 2026.


Brought to you by:
Black Hills Information Security
https://www.blackhillsinfosec.com

Antisyphon Training
https://www.antisyphontraining.com/

Active Countermeasures
https://www.activecountermeasures.com

Wild West Hackin Fest
https://wildwesthackinfest.com

Creators and Guests

Host
Corey Ham
Corey Ham has been with Black Hills Information Security (BHIS) since 2021 delivering red teaming and OSINT services. Currently, Corey leads the ANTISOC team at BHIS, providing subscription-based continuous red teaming to BHIS clients. Outside of his time at BHIS, you can find him out in the woods or up on a mountain somewhere.
Host
Hayden Covington
Hayden Covington joined Black Hills Information Security (BHIS) in the Summer of 2022 as a SOC Analyst. He chose BHIS after hearing many great things over the years and seeing the quality of work, as well as finding people who have the same passion for the field as he does. His favorite part of the job so far has been the community. Previously, Hayden worked in a SOC for a Naval contractor, where he also served as their SOAR project manager and SME, as well as insider threat lead. When he’s not working, Hayden can be found doing anything athletic (like triathlons!), as well as enjoying video gaming and Formula 1.
Host
John Strand
John Strand has both consulted and taught hundreds of organizations in the areas of security, regulatory compliance, and penetration testing. He is a coveted speaker and much loved SANS teacher. John is a contributor to the industry-shaping Penetration Testing Execution Standard and 20 Critical Controls frameworks.
Host
Ralph May
Ralph is a U.S. Army veteran and former DoD contractor who supported the United States Special Operations Command (USSOCOM) with information security challenges and threat actor simulations. Over the past decade, he has provided offensive security services at Optiv Security and Black Hills Information Security (BHIS) across various industries. His expertise spans network, physical, and wireless penetration testing, social engineering, and advanced adversarial emulation through red and purple team assessments. Ralph has developed several tools, including Bitor (set to release in January 2025) and Warhorse, which enhance efficiency in penetration testing infrastructure and operations. He has spoken at numerous conferences, including DEF CON, Black Hat, Hack Miami, B-Sides Tampa, and Hack Space Con.
Host
Wade Wells
Wade Wells has been working in cybersecurity for a decade, focusing on detection engineering, threat intelligence, and defensive operations. Wade currently works as a Lead Detection Engineer at 1Password, where he helps build and mature scalable detection programs. Outside of his day-to-day work, Wade is deeply involved in the security community through teaching, mentoring, podcasting, and running local events
Guest
Andy Pettit "Nerf"
Andy Pettit is a cybersecurity practitioner and lifelong builder with a hacker’s mindset, driven by deep curiosity and a desire to understand how systems truly work. He began coding in C at age 12 building custom MUDs and has been pulling systems apart ever since, focusing on gaps between design and real-world behavior. Andy brings a whole-business perspective from over a decade as managing partner of Clown Shoe Motorsports, shaping his views on risk, reliability, cost, and people. He volunteers with Black Hills Information Security and Antisyphon Training as a Nerd Herder and is a top 5% MetaCTF competitor, endurance racer, and HPDE instructor with NASA Texas Region.
C"
Guest
Charles "bsdbandit"
Guest
MaryEllen
MaryEllen Kennel has held numerous roles in CyberSecurity, and is currently ranked top 1% in MetaCTF. MaryEllen has spoken at several conferences, including Magnet Forensics, KringleCon, and most recently, Wild West Hackin’ Fest in Deadwood, SD. MaryEllen grew up Mennonite, and treasures spending time with family.
MB
Producer
Meagan Bentley
Guest
Michael "Shecky" Kavka
Shecky, as he is commonly called, has been in the professional world of IT for nearly 30 years the last 11 as a blue team security engineer. He is focused on detection engineering, threat intel and analysis. Outside of his day to day he is involved in Bsides312, Hak4Kidz and Burbsec (Chicago's cybersecurity meetup conglomerate).

What is Talkin' Bout [Infosec] News?

A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
Join us live on YouTube, Monday's at 4:30PM ET

bsdbandit:

Testing. Testing.

John Strand:

Hey, everybody. Would you like to see a crooked finger? Would you like to see a crooked finger with some amazing music? Let's bring out the crooked finger with the amazing music, and then we'll see what happens from now. Testing.

John Strand:

Testing. Hello, everybody, and welcome to another edition of Black Hills InfoSec talking about news. I'm your host, kind of, John Strand. Since I don't think we got Corey trying to join, but look at him. Look at him and laugh.

John Strand:

Look at him laughing and blamed about the fact that his video is not working.

Ralph May:

Maybe his shameless on.

John Strand:

Maybe yeah. Maybe he's trying to do it from his phone in the passenger seat of a diesel pickup

Corey Ham:

Listen. The images you're about to see may shock you. Okay?

Charles bsdbandit:

Oh, my.

John Strand:

You got a haircut.

Corey Ham:

No. No. I didn't get a haircut. That's what everyone's been saying that I got a haircut. No.

Corey Ham:

I just changed my desk to the different spot.

John Strand:

It's in a slightly different spot. Still looks good.

Corey Ham:

Alright.

John Strand:

I feel like ESD coming and going, though.

Ralph May:

Yeah. Every time Corey gets on camera, there's more There

bsdbandit:

we go.

John Strand:

One day. There we got him.

Wade Wells:

So it's gonna

John Strand:

be like

Corey Ham:

it? It's just gonna be me in a jungle and like you can't even see my Yeah.

John Strand:

Cats prowling around. Be like, is that is that an is that an ocelot behind you? Got him to keep

Wade Wells:

the Puma company.

Corey Ham:

So That's the goal. That's

Wade Wells:

the goal.

John Strand:

My Emmett

Ralph May:

is really gonna connect with you.

John Strand:

This is our last show of the year, everybody.

Wade Wells:

I I just went back. I was like, holy moly.

Wade Wells:

Oh, didn't even realize that. I'm glad I came.

Wade Wells:

Yeah. Yeah. It's kind

John Strand:

of kind of closing it out. So Like, you know what we're not gonna do today? We're not gonna do the year end review and the predictions. Oh my goodness.

Corey Ham:

Oh, what? I was just gonna say we should do it because it's kind of a slow news game.

John Strand:

Okay. We can totally do some predictions. Yeah. Let's do some predictions.

Corey Ham:

Yeah. There's not many good stories.

John Strand:

I think there's

Corey Ham:

some At good least not on my radar. There's Everyone's

bsdbandit:

gonna take off.

Corey Ham:

There's the Roblox one. Oh, that one

John Strand:

was good one. Let's talk about that one.

Wade Wells:

That's a good one.

Corey Ham:

It's really it's not really newsworthy. It's literally just kids complain when you take away Roblox like it's not. Not.

John Strand:

I I I think that you're you're right about that one. I mean, they do just complain, but I I I between this and then what happened down in Australia with the social media ban for kids, I think it it points to, like, a a bigger trend that's happening, and I don't know how security is gonna fit into it. I just don't. I mean, are we gonna be having getting called into boardrooms where it's like, okay. We need to validate the age of everybody that's coming to this particular website.

John Strand:

That might be where we're going. Is that gonna be under our banner? Kind of hope it's not because that that type of HRE type thing kind of sucks. But everything kind of rolls down to security anyway. But now that's that's the only hot take I have on it is you have, you know, or you're gonna ban it in Russia, and I think it also kinda ties in what's going on in Australia, and I don't necessarily have an opinion about that right now.

Corey Ham:

Woah. Woah. Woah. You can take away social media. That's fine.

Corey Ham:

Taking away Roblox, that's

John Strand:

a different

Corey Ham:

story. Wait, you gotta

Wade Wells:

you gotta be careful. This may this may become a World of Tanks situation with this Roblox server. The next thing you know, like, all

Ralph May:

the Yeah.

bsdbandit:

You never know.

Corey Ham:

You never know. Yeah. That is a good point. That like Okay. So I think the only So we talked about it last week.

Corey Ham:

Basically, they did I think they banned it officially last week, and now this is just the Fallout article being like I mean, the quote in the article is pretty funny, the person literally said, they have gotten an a message from literally every child in Russia.

Wade Wells:

I think they

John Strand:

said every second child. Every

Corey Ham:

second child. Every second child aged eight to 16. So, I mean, yeah. That's mean, that's what you'd expect.

John Strand:

It's like everything else that's going on in Russia but this. This is the This is what makes

Wade Wells:

the world hate it.

John Strand:

So how long until

Corey Ham:

we get RuBlocks? The other thing RuBlocks. Fuck.

John Strand:

RuBlocks are you?

Corey Ham:

That's pretty good. I I think the other only other interesting tidbit in this article is that Roblox casually dropped in the article that they have responded to Russia specific takedowns of LGBT type

Charles bsdbandit:

content? Or

Corey Ham:

Which is like

John Strand:

It was immoral, I think is what they said. Some kind of like Oh. Moral fabric blah blah blah blah blah. And it's like, have you seen the Internet? And that's what bothers you.

John Strand:

Oh.

Wade Wells:

I mean

John Strand:

Okay. I see.

Corey Ham:

Alright. State specific takedowns. I I mean, I'm guessing this is the norm, but, like, would they do the same thing for America? Would they do content takedown if Trump is like, I don't want this on my platform?

John Strand:

But I think that I think that we've already seen that. Right? Like, if we're looking at, like, Google and Apple whenever they talk to China, they're willing to do things for China. But there's no way they would do for The United States. So I I think we've already seen large organizations that have that kind of True.

John Strand:

Difference in the way that they handle different countries. And I think I don't know. It seems like a lot of the companies whenever they started out, they had like, you know, this idea of a moral fabric. And then it was like, you know what's awesome?

Corey Ham:

That Money is better than morals. Well

Wade Wells:

well, speaking to that moral fabric. Right? Like Sony, Nintendo and Microsoft have all backed out of Russia. It's just Roblox's state. Point.

Wade Wells:

Right? So they are company.

Corey Ham:

For for now. For

Charles bsdbandit:

now. With

Wade Wells:

2,000,000 active daily users. So I don't think I I used the data center that I first got hired at actually used to host Roblox servers. Like that was one of our big contracts. It it was cool until you get DDoSed every weekend telling peep telling kids calling us while they're DDoSing us Why

Corey Ham:

is it server? Yeah.

Wade Wells:

No. I'm saying you better give me a a server or we're gonna continue to DDoS you. Oh, bitch. Dude, it

John Strand:

Oh, you punk bitch, you're a noob.

Corey Ham:

Charles. Charles, you sound like you're straight out of Ventrilo right now and I absolutely love What

Charles bsdbandit:

is going on here?

Corey Ham:

It's something about your mic. It just it's hitting a nostalgia thing for me and I love it.

John Strand:

I like it. I

bsdbandit:

I appreciate guess we're gonna work

Charles bsdbandit:

with it, though. But

Corey Ham:

Hell, yeah. Yeah.

bsdbandit:

But yeah. I just think that, like I said, with,

Charles bsdbandit:

like, with Nintendo, there are it's always gonna be some kind of merry-go-round. Right? You're gonna see, like, okay. Right now, it's Roblox. Next, it could be Kirby's Adventure.

Charles bsdbandit:

Maybe Mario might do something wrong one day. We we we just never know.

Corey Ham:

Right? Man.

Charles bsdbandit:

And it's interesting to see what the kid how the kids are gonna respond. Are we creating the next generation of programmers and open source people that are just gonna start, hey. You know what?

bsdbandit:

You could take roadblocks. We're gonna go rubleck. You take roadblocks, we're gonna go with something else.

John Strand:

See? And I wanna

Charles bsdbandit:

I wanna pull on

John Strand:

that thread. I wanna pull that thread because I I think kind of what you're getting at is I think that a lot of people that make these choices two things. One, I think they don't know how the Internet and how technology works. Right?

Ralph May:

Right.

John Strand:

Like, I I think that they don't understand that there's a way to try to hack around a lot of these things. And the Internet is not Facebook and Roblox and Minecraft. People are gonna find other creative things. But I also don't think that that's necessarily their goal. Right?

John Strand:

Their goal isn't necessarily reducing it to zero. I think their goal is reduction. And I'm not just talking about the Roblox issue. I'm talking about any time that they try to ban social media. In Australia, there's a bunch of people like, well, that's just stupid.

John Strand:

They're gonna get around it through this way and this way and this way, and they're gonna use VPNs. That's fine. I think that they're okay with that. I think it's more of an issue of fragmentation and reduction. And I'm sorry, I'm getting to a point on this and it's taking me longer than I should, but I'm really tired.

John Strand:

And I think somewhat it goes back to Arab Spring, honestly. Because when you looked at Twitter and what happened during the Arab Spring, the ability to use a single platform that kind of became the platform that everyone was using for Egypt and other countries that had kind of takeovers. I think that that's terrifying to some countries. Right? If you have that type of platform that's kind of an uncontrolled, that is a problem.

John Strand:

And I think sometimes when you're looking at Russia doing this or China is already doing it with video games and all kinds of other things, they have been for years. I think it's less of an issue of trying to reduce it to zero, and it's more of an issue of reduction and fragmentation. So you don't have that social media platform that's as big as like Twitter was, where it can create this movement across these different countries that can not be controlled by the governments. That's that's kind of, like, if we're getting into some kind of weird takes. That's one of my weird takes on this one as well.

John Strand:

And I already think we spent too much time on

Corey Ham:

Yeah. Well, so people in the audience, John, are curious where you are. So can you state if you can play Roblox or cannot play Roblox where you're based

Wade Wells:

right now?

Charles bsdbandit:

That's the ultimate challenge.

Corey Ham:

Yeah. I

John Strand:

I can I can Okay? Play Roblox.

Corey Ham:

That's all we need to know.

John Strand:

Alright. I'm at International Airport. I just looked at the facility for Wild West Hacking Fest at Mile High for 2027. I'm really excited about it. Somebody says it looks like he's in a Subway sandwich shop.

John Strand:

I'm in the United Red Carpet Club.

Ralph May:

No. Wait. They have wallpaper there at Subway.

Corey Ham:

Yeah. Was gonna say that wallpaper is way too bougie for Subway. Are you kidding me?

John Strand:

It is.

Corey Ham:

The Subway bread is only 30% bread.

Wade Wells:

Really hope one of our listeners is at the airport right now and can run.

Wade Wells:

And I'm sorry. If they can Okay. Yes.

Corey Ham:

This is not We do not condone this or encourage it. Do not do this. That's how you go to jail. Yeah. But, yeah.

Corey Ham:

Anyway, let's move on. I I guess, unless one I guess, now that I think about it, it is very normal for countries to fall or companies to follow the laws of the countries they're based in. That's just how it is. Like, you you just have to

Charles bsdbandit:

Yeah.

Corey Ham:

You have to pay the troll toll to get sovereign nations to agree to do business with you, I guess. Yeah. Alright. What else I we

John Strand:

there's a story we could stay on Russia, but I would like to talk about the Google killing off its dark web report. I think that that's interesting. What are your takes on it?

Corey Ham:

So as the resident dark web fake expert, I think the first of all, I was also surprised to learn that this existed. Like, I I you know, dark web information, like, flare reports and credential exposures and have I been pwned and all that kind of stuff, I definitely agree with their logic of it being just impossible to really know what you're supposed to do based on it, especially for the end user. Like, to be honest, we don't even we have trouble getting our customers to understand how this all works and do stuff, let alone just a random person who subscribed to Google One. So I definitely don't think the information is that actionable for people. My only thing that I really hope is that Google still does all of the stuff they were doing before, which is like protecting the accounts even if they're not telling you they are, if that makes sense.

Corey Ham:

So like, making sure that if dark web credential disclosures happen, that they invalidate session tokens and invalidate credentials and accounts so that, you know, things are safe, user accounts are safe, if that makes sense. So it's like This is I don't care that much that they tell you, I just still want them to keep protecting the accounts based on dark web data.

Ralph May:

This is classic Google killing off another service.

Corey Ham:

They love killing a

Wade Wells:

They love

Charles bsdbandit:

I'm not surprised.

Ralph May:

Yeah.

Wade Wells:

But it's a It honestly sounds like a service that none of us even knew about though.

Ralph May:

Yeah. Unless you had Google One, which most people don't even want any Google stuff.

Hayden Covington:

Google One. They gave it to me for free and I still don't know what

Ralph May:

it is.

John Strand:

Do you think like like, seriously, if I was in charge of this, it'd be like, okay. How can we make this more user friendly rather than just throwing it away? Right? This also makes me wonder how many people like, if you think about your aunts, your uncles, people that are not computer savvy, when and let's say that they stumbled into this report that none of us knew about. Right?

John Strand:

And they looked at it. I I talked to a lot of people that get compromised, and they blame Google. They blame Yahoo. They blame, you know, Hotmail or whatever. They're like, oh, yeah.

John Strand:

Well, Google clearly let them back my account. And it's like, well, what is your password? What was password? 1234. I wonder how much of it by showing people just kind of the dark underbelly of computer security and the problems, the security perspective of their accounts, we're blaming Google.

John Strand:

Right. It's like shooting the messenger.

Corey Ham:

Right. Yes. That totally happened. I

John Strand:

I think that that may be part of it as well.

Corey Ham:

Yeah. No. That is definitely a thing. We warn our customers about that. So like, here's a common scenario we encounter with our customers.

Corey Ham:

They we've actually had this both directions. One direction is a comp an employee of a customer's stuff gets hacked. Right? They get hit by impulse dealers and then we pick it up because it's their work email. We check their work credentials, they aren't valid, but then we tell the customer, hey, you need to tell this person because they have like Netflix, Amazon, Chase, like, all these other But but then like, the situation there is incredibly awkward to go to an employee and be like, you got hacked, we know about it, but it wasn't our fault.

Corey Ham:

The other thing that we've had happen is we've had customers tell us, hey, can you validate this? Because the some employee signed up for a service like Google One's dark web information and it said that their work credentials were compromised and so they thought that we got breached because of that. So it's Exactly. Like basically, all of this whole situation just leads to confusing outcomes for everyone, and so I'm not I get it. I get just being like, no, we're out.

Corey Ham:

We're good.

Hayden Covington:

Yeah. Because there

John Strand:

Years ago, I can't remember the name of the company, but ReconNG had a module. We got an API key for, like, $5,000 where you could it was kind of like, have I been pwned, but you could get access to the hashes and the credentials. I we demonstrated this at DerbyCon, and we demonstrated against the FBI with permission from the FBI. We worked with them before we disclosed it in the issue at at DerbyCon. And it was a it was a cool presentation by Tim Tomes, you wanna go look at it.

John Strand:

After that, we had a whole bunch of people that would call us up, and they would say, yeah. Can you look that up for us? And we would, and we would sit down and we'd look it up. And then we'd show them you have, like, 47 credentials that are compromised out on the open web and things like that. And then they would get mad at us.

John Strand:

So we thought it would be a great sales technique. Right? We could do it. We could show them, hey. Here's the things that are out there.

John Strand:

This is the stuff that we're seeing, and here's the things that we can help you with. And almost immediately, it was like, maybe get angry. Right? They'd be like, how did this happen? Where did these credentials come from?

John Strand:

Where are you getting this information? How come you have this information? What are you doing that's illegal that gives you this? It got really dicey, so it killed it after like two calls. And I still to this day have people that are starting up pen testing companies that come to me and they're like, so I got this idea for getting customers.

John Strand:

What we're going to do is we're going find companies that have a lot of data breach. We're going to reach out and set up a meeting. Extortion sell of marketing tools. I'm like, don't do that. That that's not gonna work.

John Strand:

And they get all excited and they're like, well, we're gonna give it a shot. We're gonna give it a shot. And then they usually call me up and like, yeah, did that. It didn't it didn't it didn't go the way that

Wade Wells:

we thought it was.

John Strand:

So there's definitely a shoot the messenger aspect to this.

Wade Wells:

From the other side of this, right, from the blue team side, I have had this where I've had to reach out to contact and be like, hey, I found your account. It's your personal account. But if your personal account's on here, probably means your entire passwords are all locked. Yes. Did you save any work passwords on there?

Wade Wells:

You said you did it? We're gonna reset your password anyway. Like, usually, the moment you say anything, that's the I guess that's the one thing about being, like, insider defense. Usually, everyone immediately jumps to you the moment you say, hey, you got something. Where as from a a red teamer or an attacker, I could definitely see the suspicion being built as you telling them about it.

Wade Wells:

But I wish I wish I would've known about this because I would subscribe to it, to tell you the truth.

Wade Wells:

Yeah. I know

John Strand:

it's true. Right?

Corey Ham:

Well, yeah. I mean, at the end of the day, like, this information isn't gonna blow your mind. It's gonna be like No. And also, the to kind of like I know we've kind of maybe talked about this article a little too long. The other hilarious scenario, and I tell customers this all the time, no one's there's no validation of this data.

Corey Ham:

And we've actually seen instances of a threat actor was trying to hack our customer, was saving the logins they were attempting against the customer in their browser that got hit by info stealers, and then we reported them as branch credentials, and they said, this isn't credentials, this is a hacker trying to get into our site. So like, there's no validation of the data. Right? Like there's I can type anything, and and also, this very smart customer who I hope is listening, also self misinformationed and intentionally infected their did some Honey credentials, infected them with an info sealer intentionally, and so now they know they can validate like that you have good info sealer data because they intentionally breached a login that isn't a real user that they like keep track of for Nice. In postular tracking.

Corey Ham:

So like, yes, it's one of those things of like, the data isn't validated. I can say I can I can go on breach forums right now and say I have a sick combo list and it's just random b s? Right?

Wade Wells:

I'm not

Corey Ham:

So what

Wade Wells:

what if what if you had a company that could validate though? Like a password company?

Corey Ham:

Well, there's that. There well okay. Thing. That's all

Wade Wells:

I'll say about that. That's all we'll

Ralph May:

say about that. You can say so password?

John Strand:

I don't know.

Corey Ham:

Yeah. I cannot. That's there's a legit If

John Strand:

that company was to do password stuff, they would that would that mean way that they would have their password stored in some kind of access with reversible encryption that people could do those types of checks? Or how far down this rabbit hole are we gonna go?

Wade Wells:

Technically, it only gets unencrypted when you put your code in it.

Wade Wells:

No. I'm not.

John Strand:

I'm definitely not gonna talk about problem.

Wade Wells:

Yeah. I

John Strand:

know. So how about

Wade Wells:

well, so well, but

Corey Ham:

there is a legitimate point here, which is that a lot of other companies do this for you already. I think, obviously, we're talking about password managers. Password managers do this for you already. They tell you if your passwords are compromised. Also, like, Mozilla can do this.

Corey Ham:

Like, tons of other services do this as well. And so, it's just kind of like an extra unnecessary step. So it

Hayden Covington:

It just seems like a not fleshed out product that no one really understood how to use correctly, and then they're just killing it off because no one knows how to use it and it's a waste of however much it costs them to do, which probably isn't But multiply that by their user base, that becomes bigger.

Corey Ham:

Correct. If it's 1¢ per user, it's still an uncalculably large amount of money.

John Strand:

And it quickly gets to the point, like, how many times have you been in presentations that are like, the only way we're gonna get security is by user awareness. And at some point, you realize that's not gonna work because the users don't care. Right? Like, they they have other things to do. And I'm not saying that like they're dumb or they're idiots.

John Strand:

It's just they have a job and that job is accounting. That job is web dev. That job is surfing the Internet. I don't know what they're doing. I don't know what people do outside computer security.

John Strand:

Roblox. Right? And computer security and thinking about this crap deeply is not something they have cycles to put in their life. And that's kind of a terrifying concept because it leads to a lot of these types of breaches and these types of things that we actively take advantage of in the, you know, continuous pentesting side of VHIS. Do we wanna try another story though?

Corey Ham:

Yeah. Yeah. Let's talk about Coupang. Coupang? Coupang?

Corey Ham:

Coupang?

John Strand:

Coupang? Coupang.

Corey Ham:

Coupang. I don't know how to say it. I'm sorry if you are

John Strand:

Apologize if you're Korean. Yes.

Corey Ham:

If if you're Korean and you know what this company is and know how to pronounce it, I'm sorry. Coupang. Yeah. This is a breach. It's apparently the largest online retailer in South Korea, which is make Yep.

Corey Ham:

Makes it huge. It's a pretty sizable breach of, I think, what did they say, 36,000,000 users or something like that? 33,000,000 users? The I think the so basically, the story goes that they raided this company, which that is honestly to me the biggest, like, that is the biggest surprise. Like, I commented in the Notion being like, could you imagine a US company getting raided because they got breached?

Corey Ham:

Like, even Yeah. Can you even imagine? Like, in The US, we'd be like, yeah, we got breached. Hold on, Corey. Hold on.

Corey Ham:

We'll see you on the stock exchange.

Ralph May:

Hold on. Uh-oh.

John Strand:

Okay. I'm done imagining it.

Wade Wells:

That was

Corey Ham:

fantastic. Thank

Wade Wells:

you. Continue. Yeah. I wanna know what

Hayden Covington:

company he was imagining.

Charles bsdbandit:

Alright? Yeah.

Corey Ham:

Hope Yeah. Well, I mean, so basically, they they I I don't know if this is South Korean law or I don't I have no idea how things work in South Korea. But basically, they raided this company like it was an FBI thing and took all their information. Even though the company was court cooperate cooperating with the investigation, they came in and they got fancy blue boxes and took all their stuff home with them, I guess. Basically, they've investigated and it turns out that it I guess, it sounds like it was an inside job, but also Yes.

Wade Wells:

Kind of

Corey Ham:

not so much of an intentional inside job. It was like a past employee who still had access and probably shouldn't have. Right?

John Strand:

Yeah. It was a citizen that disappeared. Yeah. But they also this is over 50% of the total population of South Korea. Right.

Hayden Covington:

And the second to last

Wade Wells:

paragraph is a little Jeez.

Andy "Nerf":

But haven't the recent breaches in South Korea been, like, the entire population?

John Strand:

Yeah. Let's go to the second to last paragraph.

Andy "Nerf":

So haven't the recent breaches in South Korea been, like, the entire population? So, I mean, in in comparison, isn't

John Strand:

this kind of a nothing burner?

Wade Wells:

We don't know.

John Strand:

The CEO resigned.

Charles bsdbandit:

Wow. Man.

Corey Ham:

No breach of

John Strand:

the economy. I love the fact that South Korea, like, they actually have shame in their executive ranks. Like, the CEO resigned. He's like, I'm I'm not. You know?

John Strand:

I can't remember what airline it was. There was a CEO of an airline. His daughter got on the airplane and treated the flight attendant. I wanna say poorly. It doesn't do it justice.

John Strand:

Like, it was horrific what they had this flight attendant do, and he resigned too. But you would never see that in The US. Like, I I don't I don't know, like, how bad of an incident would have to be for the CEO to fall. I mean, don't they hire CISOs to take the fall for them? Isn't that what

Wade Wells:

you're supposed to do?

Corey Ham:

Yeah. Don't worry, John. He's gonna he he's gonna come be the CEO of a US company or something.

John Strand:

Yeah. Very shortly. There was the second to last paragraph someone was talking about. Can we bring that up and go to the second to last paragraph and read that one?

Hayden Covington:

Yeah. It's it's talking about how, like, the it's very interesting to think about. Like, we we talked about, you know, oh, what if, a US company had gotten raided because they got breached? It sounds like like it says they're being treated as the victim, but if negligence or other legal violations are found, they could be held liable in some capacity. So you got breached, and if they find out that you did something wrong, they could totally hang you out to dry.

Wade Wells:

Now The old no logs, no breach scenario.

Corey Ham:

Okay. Okay.

John Strand:

So it's different. So this is different, but I've worked I've worked incidents where the FBI has gone in the Secret Service in some instances and has seized equipment rather dramatically. And usually in those particular situations when they do that, either a, they think that there's a scenario where there's an employee that's like like like, there's multiple employees working together. Or b, they believe that there's a nation state level component of it, and they have the warrants to basically get that. Even if it's not adversarial with the company, they literally come in and start seizing servers and workstations.

John Strand:

Now that is exceedingly rare. And I don't think that they brought ops down for this company either. Right? I think that they were just taking hard drives of workstations. So that would kind of match up with what I've seen with some US companies where law enforcement has done this type of heavy handed tactic.

John Strand:

But most of the time when they do it, they either, a, think that there's the exigency of the circumstances that another employee will wipe the data, or they believe that there's a nation state component, and they have to move very quickly without notifying the company. But once again, I mean, can think of two in the last twenty five years where that happened. So it's something like this.

Corey Ham:

The other thing I'm not clear on is when they talk about liability, are they talking about like, do they have the concept, like, we have of civil liability versus criminal liability? I don't even know if that's, like

Charles bsdbandit:

I'd In

Corey Ham:

The US, I I don't think there's any criminal liability for breaches whatsoever. Correct?

Hayden Covington:

I can't

Corey Ham:

doing it.

Hayden Covington:

Yeah. It sounds more like it's about negligence about the data loss or maybe even like the repercussions of that data loss. Because it talks about how much, like high volume phishing is there is now related to this company and how many reports the police are getting. So I imagine it's just can they hold them liable for something just in general.

Corey Ham:

Yeah. But is it criminal liability or is it money? Because if it's money, it's kind of a different story.

John Strand:

So but getting into it, it it they do have an act that is very similar to GDPR. I think it's called PEPA. Hold on. I'm just looking it up right now. But you can be held liable if you haven't had like like, it it's basically like GDPR.

John Strand:

So if you end up which, by the way, I had someone in London that's like, you guys talk about GDPR, but you need to learn more about GDPR. So I hear you. We're gonna learn more to educate ourselves. But you can absolutely be held accountable under the South Korean GDPR in that particular situation. So, yes, they do have, which is something we miss in The United States.

Wade Wells:

Could you imagine like working and like some dude rushes in the office, pushes you aside, types host name on your computer, your host name comes up and he goes, yep, and then just takes it and runs away with the computer?

Wade Wells:

You just go

Wade Wells:

That's what I imagine.

Charles bsdbandit:

Might as well.

John Strand:

So years ago when I went to work for years ago when I went to work for Accenture. And there's video on this I checked like a few months ago from an old flip phone, an old Nokia Razr. Was it Motorola Razr? I was working at Accenture and I wasn't on the security team yet. And this guy just came into my office and he was wearing a suit and he just grabbed my trash can.

John Strand:

And I grabbed my trash can, and I'm like, what are you doing with my trash cans? And he mumbled something. I can't even remember what he mumbled. But then he jerked the trash can with me holding on to the trash can and, like, drug me down the hallway between, like, the cubicles for a few pee. And somebody was able I was, like, screaming at this guy.

John Strand:

I'm like, what the hell are you doing? But he was literally the equivalent of a penetration tester back in 2000 that was hired. And he was doing the the the thing where he's going around and kind of actively dumpster diving, where he was trying to pull down trash and find credentials. And he had drugged me a little bit down

Corey Ham:

the It's a pretty good pen tester

Ralph May:

you got there.

Wade Wells:

It's not

John Strand:

white. It's not white what you're talking about?

Wade Wells:

I would say that's more violent.

Wade Wells:

That was that's

John Strand:

So the report. Only one person stopped us from actively taking their trash. That that was me. I I want.

Corey Ham:

Like, that guy that guy's a future

John Strand:

Sam's instructor. Instructor. Let's get there.

Wade Wells:

Jeremy is

Hayden Covington:

just fine with this. Okay.

Charles bsdbandit:

Is that the physical definition of try harder?

Wade Wells:

Yeah. And every people. Right? It

Corey Ham:

sounds like it worked

Hayden Covington:

except for John.

John Strand:

I know. Explain more. So I did Contesting never skipped a like

Corey Ham:

I I I while we were hearing John's amazing security awareness training, I got I I apparently, executives can be held up to two years and fine. So basically, you could be imprisoned for data breaches. Yes. For failing to implement private proper security measures. So this could have actual jail time associated with it, explains why they're taking it so seriously and How?

Corey Ham:

Like they're, yeah.

John Strand:

So Were you able to find anything in this article or other articles about how long the guy had been separated from the company?

Corey Ham:

It was for a year. 2024, he he parted ways. So it's definitely This looks bad

Wade Wells:

for them.

Corey Ham:

It's definitely bad for them. Like, it's there's pretty clear there's pretty clear evidence that that this guy should not have had access to the data that he did and that definitely on the company to to close that out after an employee loses leaves the firm. Gotta roll those passwords.

Wade Wells:

That's always been a detection of mine, like, looking for employees who have been off boarded, who are improperly off boarded, like, that's usual Yeah. Thing that's floating around. Right? So

John Strand:

Well, I think the tools like Paintcastle will go through and say, like, when's the last time an account has been accessed too.

Wade Wells:

Yeah. Oh, they do

Ralph May:

a lot of stuff. I mean, they are also cool if they leave that in, like, a folder and then you're on a pen test and then, like, it has all the passwords in it. That's

John Strand:

I like it when they

Wade Wells:

do that.

John Strand:

We found this folder with all of these this thing called the SAM file from the previous pen test. You should

Ralph May:

probably change those passwords. Pretty interesting. Yeah. Yeah. You didn't change any of those.

Ralph May:

That's cool.

John Strand:

Now we have seen over the years where we have seen previous years pen test reports while we're pen testing. And there's a little bit of the, like, looking over the bathroom stall, how did they do it? Like, you know.

Ralph May:

Or either that or, like, you guys missed all of this stuff, or you're like, oh, that's

Corey Ham:

how they did it? Okay.

Ralph May:

Let me try that. Let's see if it works this year. Ah, it does. Perfect.

John Strand:

Yeah. There was one of the companies that I was doing expert witness stuff, and they had five years of pen test reports, And I got to review them, and the the disparity of, like, the skill set and the quality was all

Ralph May:

over place. Oh, it's all over the place. There's no unifying body. There's no unifying body So, for the like, you can get a pro, you can get, like, an intern, essentially. And I mean that in, like, the sense of they've never actually done this, so they don't have the experience to handle this kind of test.

Ralph May:

So but there's no way to tell.

Corey Ham:

So That was always me.

John Strand:

The intern?

Corey Ham:

Yeah. Yeah. Me and Ralph doing Red Teams many years back, same vibe. But we always pulled it out, you know? We always we always figured it out.

Hayden Covington:

You always got away with that trash can.

Corey Ham:

You just pulled hard. We always got away with that dress.

John Strand:

But you had hair back then. I had hair back then. Everyone had hair. Everyone had hair. It was luxurious.

Corey Ham:

I I didn't have hair.

Wade Wells:

No mustache. Modern

John Strand:

day Scott Stapp. Look at that guy. So Did you guys

Ralph May:

oh, I I did have one article I wanted to cut cut on for, like, a second.

Charles bsdbandit:

Did you

Ralph May:

guys read the that iRobot was filing for chapter 11?

John Strand:

Oh, no.

Corey Ham:

Will Smith is gonna be out of a job?

John Strand:

Yeah. Oh, no.

Ralph May:

So, alright. Here's here's here's my interesting take on it. Right? I read the article about it and I kind of saw the writing on the raw, because right now there's like a robot vacuum war with China, and they're building like an army of robot vacuums. So And they're really good.

Ralph May:

About this is the company that ended up alright. So that robot iRobot filed chapter 11, and they actually immediately during that filing sold the company to Shocker, a Chinese company. They're gonna inherit all of the IP of iRobot. What's more interesting is that iRobot was already using this particular company to build all of their robotic vacuum. Right?

Ralph May:

So, like Wow. It wasn't like they sold it off to a competitor. Like, they were already, like, part of the supply chain thing. Right?

Corey Ham:

It was like, hey, you owe us for parts, they were like, nah, just take the whole company.

Hayden Covington:

Yeah. Exactly. Consolidation at this point. You can

Ralph May:

have it. And what I think is interesting is how it's not just robotic vacuums. It's all kinds of robotic devices, whether it be lawnmowers and vacuums and other things that are being developed in China now. And from a security standpoint, right, Like, where does that put us on this thing where they're essentially taking this whole market of all the stuff that lives in our house, right, the consumer market? And, you know, where does that put from, like, a a bigger picture?

Ralph May:

I don't know. It's just something to think about.

John Strand:

What we need to do is we need to do, like, some contact where we take one of these robot vacuums that's, like, industrial and use it for like, get remote access to it and then bridge the wireless network. Because a lot of these devices, they're on the wireless network because they have to for activation and things like that. That's that's one of the things that I would look for is like, what is the backdoor for updates and firmware and things like that? And is there a way to bridge onto the wireless network that it's it's part of? Because you're you're just bringing these things into your house.

John Strand:

And I think we had another story about a KVM, because it's not out of the realm of possibility of

Corey Ham:

I China doing this world that to keeps a KVM.

Wade Wells:

Yeah. Those vacuums are mapping your house too. That's the other thing. Yeah.

Corey Ham:

At least they have room know what else is mapping my house though? Myself. Zillow.

Ralph May:

Yeah. I was gonna say.

Corey Ham:

Was gonna point out can just look at every photo. Yeah, dude. You can just look at the detailed photos of my house from the listing and there's nothing details?

Ralph May:

I mean, honestly, they should be hiring those little robots out to do surveys.

Wade Wells:

I do feel like those robot vacuums whenever my

Corey Ham:

definitely come in.

Wade Wells:

It comes straight for me every time. It knows.

John Strand:

It's you, right? It doesn't like you. No. ACDC? Wait.

John Strand:

Wait. There's a point ACDC who made who when it starts coming towards you because you might be dealing with a maximum overdrive situation.

Corey Ham:

Nah. If you're in the and you're controlling Wade's robot, let us know. Please take pictures.

Ralph May:

The the Nano the Nano KVM one was about in essence, the device was getting created and the software configuration was was just like horrible. Right? And so I think this goes across the board for any kind of either consumer device. Doesn't have to be just from China. There's, like, wildly different products and product pricing.

Ralph May:

And depending on those, they might just not be able to afford really any security, but they're like, hey. It looks. It works. Right? Like, we're just trying to sell stuff.

Ralph May:

Sell stuff.

John Strand:

Well, but I also think I also think with this is you if you look at, the components, Ralph, that they build these things out of. Right? Like, lot of this crap is just Frankenstein. They get the circuit board from here. They do this, they do that.

John Strand:

And a lot of times, there'll be components within those circuit boards that they don't even use. Right? Like, whatever they did with this little, what is it, nano KVM that they got from China, had a little microphone in it. And I'm willing to bet that they just whoever that KVM company was, they just got access to a whole bunch of really small boards, and they had lots of features that were built into them. And that's

Hayden Covington:

something that

John Strand:

can be turned on after that is the way I kinda see it.

Ralph May:

Well, something that's interesting about the Chinese market is that all of these vendors, right, they're all right next to each other. So they're like, hey, I can just go over here and get this board. These already I'll make this and we kind of put it all together, and they didn't have to, like, call around the world and get them all shipped in. They're, like, literally in the same building almost. Right?

Ralph May:

And so, I mean, this is this economies of scale for them to to develop this stuff. So, yeah.

Wade Wells:

I thought the NanoKVM, more interesting part, it was beaconing back via DMS. Right?

Ralph May:

Oh, that's Like it

Wade Wells:

was hitting check. It was it was hitting check.

Corey Ham:

Thing is straight up implant. It's

Wade Wells:

the reason my baby monitor isn't on the network anymore, man. Like, soon as I hook up pick as soon as I hooked up the Ubiquiti, I realized that my baby monitor was hitting China. And I was like, this is man.

Wade Wells:

Isn't that

Ralph May:

something? It's funny because you you mentioned that because we're actually working on building ESP 32, what do you call it, implants. Right? Drop devices. So this is ESP 32 with a PoE.

Ralph May:

So you can just drop one of these little bad boys as opposed to, like, the traditional ARM based system or or not ARM, but like Raspberry Pis. Right? Yeah. Super low power. Same same idea, though.

Ralph May:

Right? Like, this that's exactly what that chips running in the in those KBMs. They're like it's a RISC chip, which is, in essence, like, the equivalent of an ESP 32, but they're so much more powerful now that you could do all kinds of tasks. It's pretty wild.

Corey Ham:

Put a mic in it. They already the the Chinese people gave you an idea. Put a

Ralph May:

mic Yeah. In No. You could totally put you could put all kinds of fun stuff on here. It's just you.

Wade Wells:

Could I bring my own VM on there?

Wade Wells:

No. Good.

Hayden Covington:

Oh, good segue.

Wade Wells:

It's so Only

John Strand:

if it's QMU. Oh, tell us more.

Corey Ham:

I I have no idea what article this is. I'll go You hit it.

John Strand:

This red is canary.

Andy "Nerf":

Red canary one.

John Strand:

Beyond the bomb when adversaries bring their own virtual machine for persistence, which I think is funny because we've been using virtualization for now.

Corey Ham:

We've been doing this for years. EDRs are the thorn in our side.

John Strand:

Yeah. So I don't know if anybody else had read this, but they base the one thing that I thought was interesting, and Wade, I wanted to get your take on this was the spam bomb. I'm trying to figure out how we go from spam bomb because they show, like, the timeline. They're like, spam bomb, spam bombing, and then it's like initial access. I'm like, how did I get from point a to point I missed how we did this.

Wade Wells:

There's a No. No. Engineering.

John Strand:

They called? Is that how they did?

Andy "Nerf":

Yeah. So they spam bombed them, and then they called and said, hey. This is your service desk. Are you having any problems with your email?

Wade Wells:

And the

John Strand:

guy was like, was timeline? I've got all the I was reading the timeline wrong. Okay.

Corey Ham:

This is an ancient technique. This is this is this is for two There's

Andy "Nerf":

words other than the pictures, John?

John Strand:

Thanks, Andy.

Wade Wells:

Thanks. So I found this article I found this article somewhat interesting as like a defender because like, I think the hot thing is more of like bring your own vulnerable drivers. Right? That's the that's the thing or bring your own like executable in and then that I I actually haven't seen VMs as much so I'm actually I'm not surprised you guys are using it. But I will tell you this, from an Intel standpoint, Red Canary usually writes some of the best Intel reports.

Wade Wells:

And this report is very good so I was a little disappointed when I got to the end and all of the I IOCs were were just IPs and hashes. There's no Okay.

Corey Ham:

Yeah. There's no And there's threes.

Wade Wells:

There's no MITRE stuff. I was like, were they rushing to get this out because of something or would did they just not wanna do the the hard like, the five extra steps?

Corey Ham:

So how big was

Wade Wells:

this VM though

John Strand:

that I

Wade Wells:

had to download?

John Strand:

That's what I want.

Wade Wells:

Not big.

John Strand:

Not big. Was really small, but I think it did get bigger. I'm not

Wade Wells:

They brought it over they brought it over via RMM and then Yeah. They ran a couple commands, threw it up and then I believe they did sliver c two in order for c two and then because of course. Of course. Right? And then of Red Canary was able to see the actual server via Shodan.

Wade Wells:

Came back at it which which was amazing. Always good to do that. And then they found a couple of things for actual like SoxBoxy.

John Strand:

$7? Wasn't this a Windows seven box? Because they

Wade Wells:

were think

Corey Ham:

this is just a really bad pen test.

Wade Wells:

It is a Windows seven.

Corey Ham:

To the Internet. They use Windows seven. Come on. Dude. What?

Ralph May:

The the target host was Windows seven?

Corey Ham:

No. That's what

John Strand:

I was trying to figure out too.

Corey Ham:

It's like the VM.

John Strand:

So you you can afford Red Canary. So you can afford Red Canary, but you're still running Windows seven. There's like, there's there's there's a dichotomy happening in this report that kind of like like is interesting.

Corey Ham:

Oh my god. Right. The the the downloaded a whole Windows seven VM? Correct. And then they Linux VM.

Corey Ham:

Like, why Windows?

John Strand:

I don't understand that.

Corey Ham:

It's so bad. It gets worse. They downloaded a Windows seven VM, and then they just c two ed it. And just used it to launch beacons in their network? Dude, just Guys, just use SSH.

Corey Ham:

Terminals If are all you want is a network proxy, you don't need to freaking I think it a joke. QEM. Yeah. Think it

John Strand:

was a joke. I think that they set up like a like an iron hacker challenge in China. They're like, okay. Here's what you gotta here's what you gotta okay. Okay.

John Strand:

First, you gotta use QEMU. Alright? Then probably

Wade Wells:

Then you gotta use Windows seven. Then then did you, like,

John Strand:

credit this thing?

Wade Wells:

Yeah. Okay. Let's go.

Corey Ham:

Was this that try hack me advent of cyber, but in China or something?

Ralph May:

Yeah. Would kill me too if you looked in the Windows seven VM. They had to actually, like, bypass Windows Defender to get their payload to run-in their own video.

Charles bsdbandit:

Oh, yeah. Someone made

Hayden Covington:

a really good comment in the Discord. Said, just go with what Claude knows. Imagine they're just trying to use AI and it's like, well, first, install Windows. And like, okay.

Wade Wells:

I guess. Do that later. Hey.

Charles bsdbandit:

I see an ISO. Let me grab it. There we go.

John Strand:

This the strangest hack the box ever. I

Corey Ham:

Oh, my will say though, I don't think this is China. If anyone, this would be Russia. Like, it's the Windows seven licenses we had, an ISO g dot t x d. This isn't China, dude. China would be using Red Flag OS or something.

Charles bsdbandit:

When in when in doubt, blame China. Yeah.

Ralph May:

I do I do wanna know where this Windows seven image that was so small is.

Corey Ham:

Yeah. Why didn't they put that in the IOCs? Why didn't they

Wade Wells:

put that in IOCs? Just a link to download it? What do

Corey Ham:

you mean?

John Strand:

Yeah. Find it in your environment, just just delete it. Just just delete it and make it go away.

Ralph May:

My god.

Corey Ham:

Executives hate this one trick to keep Windows seven running without violating compliance requirements. Yeah.

John Strand:

Oh. Yeah. Trying to find the next story.

Wade Wells:

A lot.

John Strand:

Plus plus had another, like, way to drop now. We're on Supply chain. Plus.

Corey Ham:

This isn't the first one and probably won't be the last.

John Strand:

Seems very similar It seems very similar to to the old school GOP generic update process exploit that existed a number of years ago. But there's been a couple against Notepad plus plus for their symbol similar to this as well.

Ralph May:

You guys use Notepad?

John Strand:

Notepad plus plus.

Corey Ham:

Yeah. Because you do. Have Versus Code.

Charles bsdbandit:

I use Google for everything.

John Strand:

Languages such as Fortran and COBOL that has That's

Corey Ham:

the reason to use it? That's the reason right there.

John Strand:

I thought it was weird that that was in the article about this attack. I just threw that in there. I just feel like the author of this article, A PC World, is like a hardcore notepad plus plus and he fights with people.

Hayden Covington:

It's a tough test.

John Strand:

And he's he's gotta sneak that in. He's like, well, if you're using Ortran, it's like, no, I'm not.

Wade Wells:

I'm still I'm still a hardcore Notepad plus plus user.

Corey Ham:

Oh. Dude, regex. Like, I

Wade Wells:

can easily use regex. I can add characters when I'm doing mass amounts of queries. Say someone throws me an IOC list, I can add a four in front I of can parse it.

John Strand:

Say supports cobalt, form a tran.

Corey Ham:

Yeah. Say the line. Hey,

John Strand:

Say it, barn.

Charles bsdbandit:

Hey, Wade. I was once guilty of v I ing everything, but Versus Code has slapped my hands to

Corey Ham:

Yeah. You can use v s You can use VIM bindings in Versus Code. That's what I do.

Charles bsdbandit:

I do. Best of both worlds. Yep. H j k l, always.

Wade Wells:

It's just nice. Yeah. I don't Versus Code takes forever to launch sometimes. No you know.

John Strand:

And it doesn't support the whole or Fortran.

Wade Wells:

90% of the time it's

bsdbandit:

Not terrible.

Hayden Covington:

Versus code sucks. Just use like cursor or something. It's so much better. Right?

Wade Wells:

Right. Right.

Ralph May:

Oh, yes.

John Strand:

I just used said knock from the command line as my editor.

Andy "Nerf":

So There are some extensions available for for trans syntax highlighting in CSS.

Ralph May:

Perfect. Yeah. See

Corey Ham:

Those are malware. Those are malware. Probably. Oh, boy.

Wade Wells:

We got we got fifteen minutes. Let's do predictions.

John Strand:

Do we want do we want the

Corey Ham:

Oh, are we actually going to? We should do that.

Wade Wells:

Yeah. I I will give I'll give my hot take prediction.

John Strand:

You wanna

Corey Ham:

go first?

bsdbandit:

Go for it.

Wade Wells:

I'll go first. More Salesforce application breaches. Yep. Agree. I think that's gonna be a key Make sure you profile.

Wade Wells:

If you have Salesforce, go in there, grab the logs, start profiling all those apps and just make

Corey Ham:

sure they are talking from

Wade Wells:

the right IP over and over again. It's pretty easy thing.

Corey Ham:

Yep. That's on our radar. We're already simulating that attack against our customers and it's been eye opening to say the least. Yeah. Gotcha.

Corey Ham:

Alright.

John Strand:

I think my prediction is I think six seven will stop being funny. Oh, man.

Hayden Covington:

We're gonna be into 2026. So it has of the six. I think that's a prediction for '27.

John Strand:

This monkey's gone to heaven. But my my real prediction, and I hope I hope I'm right on this one, and I very well could be wrong. But I think that this this whole kind of down slowing of computer security hiring, I I predict come 2026, it's gonna bounce back, and we're gonna see a lot more hiring. I think I think especially around the time of Black Hat Defcon, think you're gonna start seeing a lot of people having conversations of the AI protection and all the amazing things that we were supposed to get with AI are not securing our environments. And I think a lot of organizations are going to realize they're behind the eight ball and having people to be able to help protect their networks.

John Strand:

And I hope to God them right. Because the alternative is two things, either a, we just continue to go into oblivion into 2027 and people keep thinking that AI is going to solve all things computer security. Or even worse than that, AI does, which I don't think is gonna happen, but we'll we'll see. So that's my prediction. I think we're gonna see a hiring snap back around August, and that's just me throwing something to the wall and see if it sticks.

Corey Ham:

My prediction is there's some kind of AI caused cyber event that Mhmm. Like, I don't know I don't wanna call it like Skynet type. I'm not saying I'm I'm not at all saying that it is like an intrusion by AI or something like that. I'm talking about like

John Strand:

Maybe it's two AI agents fighting over DNS records.

Wade Wells:

I don't know.

Corey Ham:

At some point, there's going to be a mass Internet outage in 2026 related to something that AI did, and also related to cybersecurity. So stay tuned on this podcast, because I bet you that's gonna happen.

Hayden Covington:

Is that a threat, Corey? That was really specific.

Corey Ham:

Yes. That was really specific. Super specific. If if you do not subscribe to this podcast, the Internet will not make it through 2026. It will go down at least once.

Shecky:

Along those same lines, that breaches into my prediction for next year, which is that we're gonna see a massive breach due to AI walls falling down from prompt injection.

Corey Ham:

Oh. Due to asking nicely? Woah.

John Strand:

I think a good one. I think that now the the question is, what do we qualify as massive? Like are we talking front page New York Times?

Shecky:

Yes. We're talking like front page we're talking something along the lines of at least a solar wind scale.

John Strand:

Oh. That's that's big. That's Okay. I dig that one.

Charles bsdbandit:

I think

Wade Wells:

I think

Ralph May:

vibe coding and AI is going to cause a class of vulnerabilities that everyone is affected by. Right? Yeah.

John Strand:

So I could go with Shaky's. I could

Ralph May:

go with Shaky's. So in essence, that what would happen is is that because everyone has decided to use AI to do all of this and the AI has the same functional issue, it creates a class that everyone, you know, essentially has. Right? Yeah.

Corey Ham:

It would Some be weird training thing that got coded into a thousand programs.

Ralph May:

And then everyone's like, oh my god, instead of EM dashes though, it's gonna be something like way worse than that. Right? Like Yeah. It'll be something that everyone is affected by because they're, you know, coding in this way, even if they're not doing because they don't have time to look all of it because they fired half the team so that they could do more, you know. So Okay.

John Strand:

New I like that

Wade Wells:

one. OASP 10. I can see it being added.

Ralph May:

Yep. Yeah. Yeah. Yep. Don't do this.

Ralph May:

Don't use EMDAT.

Charles bsdbandit:

I think I think just to just to piggyback, I think the same is gonna happen in the the API and web space when it comes to, like, vibe coding and everything else. But I think it I think AI is gonna set it back set us back a lot further as far as, like even with these new AI browsers where, you know, there's some instances where within the server response, you're you're getting, like, a username and password. And who knows? That application could have been coded by a bunch of Vibe coders that don't really think about security whatsoever. They just think about pushing the product out.

Charles bsdbandit:

So I do think that AI is gonna cause a huge gaping hole in the world of application security. Just my prediction.

John Strand:

Nice. Nice.

Corey Ham:

I agree. Hayden, anyone else have any? Yeah. Anyone else?

MaryEllen:

I mean, I was kind of I kind of have two, really. I was thinking about what BSD Bandit just said. Like, I think five hacking is gonna become, like, huge. And I also think I'm not gonna say which one, but I think that one of the major CTF platforms that's out there is gonna go under.

Charles bsdbandit:

Oh. Oh. That's a good that's a good prediction.

Corey Ham:

Oh, because

John Strand:

Good thing we're not a major CTF platform.

Ralph May:

Now you say because of, like, the Vibe hacking, it's, like, too much like, it's too trivial to, like, for the for the AI agents to do it. Is that is that what you're saying?

MaryEllen:

No. They won't. I don't think they'll be related.

Corey Ham:

Those people

Wade Wells:

I I felt

John Strand:

like they were. That that one's interesting. I think that that one's interesting because there's a lot of VC funding going into this space, and VC funding wants to have a flush.

Ralph May:

Yeah. We here's a open question for everyone. When do you guys think or do you think the AI bubble will pop? Like, do you think

Wade Wells:

it's a big deal?

Ralph May:

Yeah. I

John Strand:

do think it's gonna pop. Think it's gonna have I think it's gonna be tied with all the things that we're talking about here because I I think it's possible everything we discussed comes to pass. Right? Massive AI vulnerabilities causing organizations to pause and reflect. Venture capital realizing that the amount of money that they've been sinking into AI, they're not gonna see those returns for a decade and half.

Ralph May:

Decade. Yeah.

John Strand:

I I and AI vibe coding, I mean, we're already seeing with organizations where we're pen testing them. And we find vulnerabilities and they're like, we don't know how to fix this because this was created by AI. We're already seeing the beginning of a lot of these different things. And we don't see a good way out.

Shecky:

Yeah. And add on to that right now, you're starting to see Nvidia. Their stock prices and the stock prices of some of these other companies start breaking down. I mean, you've got Disney now investing in open AI

Hayden Covington:

Oh, yeah.

Shecky:

To try and

Ralph May:

help

John Strand:

keep them afloat.

Charles bsdbandit:

The beginning.

Shecky:

You're already seeing the start of the of the bubble popping as everybody's rushing to try and shore up the tech industry.

Corey Ham:

Yeah. Yeah. There's only

John Strand:

one that's gonna go away.

Charles bsdbandit:

It's just gonna be minimized.

Hayden Covington:

It's gonna be an overcorrection, which kinda ties into like what my, I guess, only prediction could be, which is a little bit selfish, I think. But I'm I'm thinking that the, like, the trend of automating tier one stock is gonna continue And it's gonna go well to the point where they start branching into the higher tiers of, like, SOC analysis. And it's really gonna start

Wade Wells:

someone cut them off.

John Strand:

Cut them

Corey Ham:

off right now.

Wade Wells:

Well, it's gonna start paying people.

Corey Ham:

The models are gonna get better, and then they're gonna think, well,

Hayden Covington:

we can just do all of it.

John Strand:

And then they're gonna start messing up bad. You remember whenever I started talking to our own internal SOC, there was a bunch of people that started freaking out, like, when we started getting stuff set up. And I remember having conversations with multiple SOC analysts. And I was like, I don't look at AI as something that I can reduce costs. I look at AI as something that we can kick more ass with.

John Strand:

Right?

Hayden Covington:

Exactly.

John Strand:

And that's what we've been focusing on is not like, how can we reduce our headcount? Right? We just want to be able to do more and be more effective in what we are doing. And I'm already seeing that. Like some of the some of the crap that you guys are coming up with and what you're detecting is like top notch.

John Strand:

But it's hard getting there. Right? I think that a lot of organizations, instead of the growing pains that we're going through, I think that, you know, one of the things about a SOC is it can be this black hole where you don't know that you've gotten too far ahead in your skis by laying off people and cutting costs and dropping and dropping and dropping and dropping until you're tumbling down the side of the mouth. And at that point, it's too late. And I think that you're a 100% right about that.

John Strand:

But I think if if you're a SOC, you know, you don't need AIs like saving money. Look at AI, like, we finally have a tool that can help us get caught up.

Corey Ham:

Yeah.

John Strand:

And Yeah. We're not using it that way.

Hayden Covington:

I have two comments on that. As I've written a talk and a half about this in the last couple of days, but the two things that I came away with are someone said this to me is that a force multiplier only works if you have a force to multiply. So if your analysts are not skilled enough, they cannot properly utilize AI for proper investigations. Mhmm. So I think that really just is the crux of the issue is you're not gonna be able to know whether or not it's wrong.

Hayden Covington:

You're not gonna know how to prompt correctly in the right directions for your investigations unless you are experienced enough to utilize it. And, yeah, I think that they're just gonna keep pushing it further and further as the models get better without giving it time to mature. And I think it's really gonna screw some people over.

Wade Wells:

Yeah. Both of our blue team con both of our blue team summit talks on AI now.

Hayden Covington:

Mine mine's actually on taking threat intel and turning it into detections.

Wade Wells:

Okay. Good. Good.

Wade Wells:

I've done

John Strand:

that already. My wish list is Detection Forge. Like, this is this is what I hope to see in 2026 from our SOC. DetectionForge is the tool that we use to create our detects and it does validation. I want it to kick out atomic Red Team Atomics

Hayden Covington:

as well. Oh, yeah.

John Strand:

Like, so we do DetectionForge, it just kicks that out to the side.

Hayden Covington:

So what we have now, John, that you'll be interested to see at some point is we can create issues for detection stories and tag Copilot, and it'll write a first draft. And then the Copilot code reviewer will review the first draft. And Yeah. It's worked pretty well so far. One of them was really crap, but most of them have been pretty good and at least enough to where it saves you, you know, thirty minutes, forty five minutes of templating and, oh, which MITRE tag should I add to this?

Hayden Covington:

I gotta make sure the reference links are indented like saves you time but also you still need somebody there to make sure it's right.

Corey Ham:

And You do. In a that's the important part.

Wade Wells:

Was gonna say in a in a combo with Hayden and John about hiring more than having the AI sock, I I this is what I'm hoping to see but I think I'm I'm being too positive is what I've seen with these AI summaries is I could probably teach someone that does not have a lot of security experience to be a somewhat decent sock analyst very very quick. And I don't think enough people are utilizing that in order to spin up or at least hire new people to get into a SOC because they just don't wanna pay people. But it it's so easy to spin someone up right now that just has basic security knowledge and have the AI hold their hand through a lot of this stuff that I just I hope

John Strand:

it happens. Here's the problem, Wade. Here's the here's the problem with that. We have seen people, whether it's interns, whether it's end testers, whether it's junior SOC analysts, and also talking to a number of customers where AI is doing one of two things to people. Like, either a, it makes them lazy.

John Strand:

And I'm seeing that a lot. To where people aren't actually trying to understand the core fundamentals of what things are coming to them or they use it as a tool to try to do amazing things. And it seems like that's a very small subset of the universe right now. And that's a big concern that I have is if somebody's using vibe coding, that's great. Use that as a tool.

John Strand:

Try to strive. But then you're also getting this huge percentage, and I hate to say it, but talking to my customers, I think it's like 65, 70% of the people are using AI as just this lazy crutch to where basically they're saying, yeah, AI told me that that wasn't malicious. And it's like, well, did you verify it? Well, AI told me it wasn't Yeah. AI AI generated that code for the website.

John Strand:

It should be fine. It worked. It passed my checks. Right? And that's my biggest concern in this industry is, hate to tell you, but I think it's about 70% of the industry, especially the younger generation, has came up and they've been using AI to generate papers.

John Strand:

They've been using all these different services. And they get to the point where they have to do a job, and they continue to trust implicit this service that they have.

Ralph May:

And that's my view here. That's really what AI slop is. Right? Yeah. Yeah.

Ralph May:

Effort something. But the but that something that they made would have taken a lot of effort for someone to actually do, but that it was just AI, so but nobody appreciates it because the thing that we all appreciate in this world is the reckon recognition of the limited time we have on the server.

Hayden Covington:

And I have another good good PowerPoint quote for you is one of the ones that I threw in is that AI can make a good analyst great, but it can't make a bad analyst good. Because there has to be some amount of foundational understanding to be able to prompt and correctly recognize issues.

Corey Ham:

Well, And I think

John Strand:

that we're gonna be changing our hiring process in testers and in SOC analysts. Like what was it? Just trying to hire a CICD pipeline engineer or developer is one of the most or two of the most painful things I've ever done in this company over the past year. And I I think that we've got to try to come up with a way where we're using our platform in our LMS where somebody wants to work here, we've got to create challenges that cannot be easily solved by AI. And then try to use that, try to filter these people out because we're getting onto interviews with people.

John Strand:

And I don't know if you guys I think we talked about it on the show a couple of weeks ago. We had one interviewee that we are 99% certain was taking all of the questions we were asking and answering it with AI to the point where the interviewers asked him to turn around from his computer and answer a question, and he refused to do so. So Yeah. Yeah. It's getting weird out there, folks.

Corey Ham:

Alright. Everyone else Be coming. Soapbox. I wanna take my AI soapbox. I think Go for it.

Corey Ham:

The things the things that we said when all this AI stuff started are still true. Like, my my claim was AI is not gonna replace people's jobs. It's people who don't use AI will be replaced. Not AI replaces a person. Yeah.

Corey Ham:

Like And I also would like to mirror what Hayden said, which is I have yet to see someone who isn't very good at their job fix it with AI. That's not it's not gonna happen. Nope. I've seen people who are really good at their jobs get even better with AI. Like, that is, I think, what's happening is the people who are good are getting even better and more efficient and faster.

Corey Ham:

The people who suck are still gonna suck. And I think Right. John, like, no matter how you came up in the world, like, the same thing you said about, oh, I was brought up on AI, is the same thing as it was in the nineteen fifties. It's like, you just listened to what your professors told you and didn't actually learn anything. Like, you you're just a parrot for information that you learned in college.

John Strand:

Or used Google to answer these questions.

Corey Ham:

Exactly. Like, I think, really, AI maybe turbo charges it and it makes it harder for people to figure out that, you know, you're kind of full of crap. But I think at the end of the day, like, you know, like everyone else has mirrored here. If you don't know how to validate the results coming out of the AI, it you are

Charles bsdbandit:

It's

Corey Ham:

up Your output's not gonna be good no matter what it is.

Wade Wells:

Yeah. I think I think I just realized something. We're starting to become closer to a Star Trek order environment. You know where your your, like, reputation is your currency. So therefore Mhmm.

Wade Wells:

Because we can't trust people, you have to trust their reputation and the people around them. Yeah. Yeah. Get a rep oh my god. That's another Black Mirror.

John Strand:

It's But really awesome.

Corey Ham:

Like a skeleton with a Santa hat. I don't know. I can't tell what It's

John Strand:

got punk rock, misfits vibes. I wanna call it the CTF winners, Ninja Cat. Congratulations, Ninja Cat. You get one year on demand access to anti siphon security training platform, which our full catalog is available still for Black Friday. Just go to anti siphon's website, And you should see a banner at the top.

John Strand:

And then QNS came in second, QNS, and they get one anti siphon training class of their choice. So hats off to both of them and their hard work. By the way, if you're wondering what this is, join our Discord server and you'll see that there's a CTF Discord chat. And you can get in there and get more information about what this is. But the point is, our webcast, we're trying to add in more hands on little micro CTF challenges with every single webcast that we do instead of making them passive.

John Strand:

So with that, let's take it out. Thank you so much, everybody. Go forth and do awesome things, and we'll see you in the New Year.

Corey Ham:

See you in twenty six seven.

Charles bsdbandit:

Later. Now.

Corey Ham:

Dude. That

Wade Wells:

is Yeah. Pretty

Hayden Covington:

We're still here. '25.