Talkin' Bout [Infosec] News

Register for FREE Infosec Webcasts, Anti-casts & Summits –
https://poweredbybhis.com

00:00 - PreShow Banter™ — The Problem With Extensions
03:10 - Lawmakers Want to Ban VPNs – BHIS - Talkin’ Bout [infosec] News 2025-12-01
03:47 - Story # 1: Stop Putting Your Passwords Into Random Websites (Yes, Seriously, You Are The Problem)
https://labs.watchtowr.com/stop-putting-your-passwords-into-random-websites-yes-seriously-you-are-the-problem/
12:05 - Story # 2: Lawmakers Want to Ban VPNs—And They Have No Idea What They’re Doing
https://www.eff.org/deeplinks/2025/11/lawmakers-want-ban-vpns-and-they-have-no-idea-what-theyre-doing
21:19 - Story # 3: Critical 7 Zip Vulnerability With Public Exploit Requires Manual Update
https://hackread.com/7-zip-vulnerability-public-exploit-manual-update/
25:49 - Story # 4: ‘Slop Evader’ Lets You Surf the Web Like It’s 2022
https://www.404media.co/slop-evader-browser-extension-pre-generative-ai-search-filter/
37:08 - Story # 5: China’s Espionage in Europe is Deepening and More Sophisticated than Acknowledged, Expert Says
https://www.kyivpost.com/post/64814
39:10 - Story # 6: Apple Update Warning For All iPhone 17, 16 And 15 Users—Act Now
https://www.forbes.com/sites/zakdoffman/2025/11/30/apple-update-warning-for-all-iphone-17-16-and-15-users-act-now/
42:39 - Story # 6: Meta is earning a fortune on a deluge of fraudulent ads, documents show
https://www.reuters.com/investigations/meta-is-earning-fortune-deluge-fraudulent-ads-documents-show-2025-11-06/
50:23 - Story # 7: Meta had a 17-strike policy for sex trafficking, former safety leader claims
https://www.theverge.com/news/827658/meta-17-strike-policy-sex-trafficking-testimony-lawsuit
52:41 - Story # 8: Man behind in-flight Evil Twin WiFi attacks gets 7 years in prison
https://www.bleepingcomputer.com/news/security/man-behind-in-flight-evil-twin-wifi-attacks-gets-7-years-in-prison/

Brought to you by:

🔗 Black Hills Information Security
https://www.blackhillsinfosec.com/
🔗 Antisyphon Training
https://www.antisyphontraining.com/
  • (00:00) - PreShow Banter™ — The Problem With Extensions
  • (03:10) - Lawmakers Want to Ban VPNs – BHIS - Talkin' Bout [infosec] News 2025-12-01
  • (03:47) - Story # 1: Stop Putting Your Passwords Into Random Websites (Yes, Seriously, You Are The Problem)
  • (12:05) - Story # 2: Lawmakers Want to Ban VPNs—And They Have No Idea What They're Doing
  • (21:18) - Story # 3: Critical 7 Zip Vulnerability With Public Exploit Requires Manual Update
  • (25:48) - Story # 4: 'Slop Evader' Lets You Surf the Web Like It’s 2022
  • (37:07) - Story # 5: China’s Espionage in Europe is Deepening and More Sophisticated than Acknowledged, Expert Says
  • (39:10) - Story # 6: Apple Update Warning For All iPhone 17, 16 And 15 Users—Act Now
  • (42:38) - Story # 6: Meta is earning a fortune on a deluge of fraudulent ads, documents show
  • (50:22) - Story # 7: Meta had a 17-strike policy for sex trafficking, former safety leader claims
  • (52:40) - Story # 8: Man behind in-flight Evil Twin WiFi attacks gets 7 years in prison

Creators and Guests

Host
Bronwen Aker
Bronwen Aker is a BHIS Technical Editor who joined full-time in 2022 after years of contract work, bringing decades of web development and technical training experience to her roles in editing pentest reports, enhancing QA/QC processes, and improving public websites, and who enjoys sci-fi/fantasy, Animal Crossing, and dogs outside of work.
Host
Corey Ham
Corey Ham has been with Black Hills Information Security (BHIS) since 2021 delivering red teaming and OSINT services. Currently, Corey leads the ANTISOC team at BHIS, providing subscription-based continuous red teaming to BHIS clients. Outside of his time at BHIS, you can find him out in the woods or up on a mountain somewhere.
Host
Ralph May
Ralph is a U.S. Army veteran and former DoD contractor who supported the United States Special Operations Command (USSOCOM) with information security challenges and threat actor simulations. Over the past decade, he has provided offensive security services at Optiv Security and Black Hills Information Security (BHIS) across various industries. His expertise spans network, physical, and wireless penetration testing, social engineering, and advanced adversarial emulation through red and purple team assessments. Ralph has developed several tools, including Bitor (set to release in January 2025) and Warhorse, which enhance efficiency in penetration testing infrastructure and operations. He has spoken at numerous conferences, including DEF CON, Black Hat, Hack Miami, B-Sides Tampa, and Hack Space Con.
B
Guest
Belouve
S
Guest
Shecky

What is Talkin' Bout [Infosec] News?

A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.

Join us live on YouTube, Monday's at 4:30PM ET
https://www.youtube.com/@BlackHillsInformationSecurity

Brought to you by Black Hills Information Security.
https://www.blackhillsinfosec.com

Corey Ham:

It's probably the dumbest thing I've seen so far.

Bronwen Aker:

Yeah.

Andy:

I I just I have a problem with extensions, period. Every time I see,

Corey Ham:

you know, What's some extensions the problem with that?

Shecky:

I tried extensions. It didn't they didn't take.

Andy:

I know. There was nothing formidable No. That

Corey Ham:

They were just like, no. You are bald. Congratulations.

Andy:

We just we need better super glue for Shaki.

Bronwen Aker:

Definitely.

Andy:

Yeah. Mean, I've just taken the training for years. Extension attacks that, you know, I mean, some you you have something that works well for, you know, years or whatever. Then as soon as it starts getting some subscribers, like, hey, this guy that made $20 off of this thing now gets an offer from somebody for, like, a thousand dollars. And they're like, oh, hell yeah.

Andy:

I'm a pro developer now. Give me my thousand dollars and now you have a malicious extension.

Bronwen Aker:

Or the ones who just stop doing the development and it it lies fallow and some they had a weak password, so somebody hacks the development account for that extension and boom. Now you've got malware and it's it's, you know, even better because there's no recourse.

Shecky:

Or they put their password or API key inside of the extension so that way people could read it in plain text and just wonder how long it's on

Andy:

table. Altogether. They were like, you know what? This JSON's not pretty enough. I have an idea.

Andy:

Let me just slap it into this website with all my API keys and let me send it to my buddy, make sure it's super pretty.

Shecky:

Hello, Ralph.

Ralph May:

Hey. What's going on?

Andy:

You got nothing? I'm giving y'all gold. What's up, Ralph?

Ralph May:

What is up? We talking about extensions? I love extensions. I have, like, 50 on my computer right now. That's the most extensions I could possibly put in the browser and then it

Corey Ham:

Dude, I have asked Jeeves. I put it back.

Ralph May:

You put it back.

Bronwen Aker:

I really need to do my my talk on why all web browsers are evil. They've they've always been evil. They haven't gotten any less evil.

Ralph May:

Oh, no way. I upgraded to the Atlas now and like, it browses the internet for me. Like, I don't even like, I just think about what I want. It's just like, alright.

Corey Ham:

It tells you what prompts you should definitely use.

Andy:

Love using I

Ralph May:

love using AI to make prompts for AI. It's like Yes, I just

Corey Ham:

want two AIs pooping back and forth forever. Alright. Go ahead and roll the roll the finger. Let's do this.

Andy:

Corey, have you not seen the Infinite Backrooms? Literally two AIs just arguing back. They created a religion, man.

Corey Ham:

Okay. I'm interested. Is this an article? Go find an article so we can talk about it.

Andy:

It's it's like over a year old, but yeah. It they made like a meme coin that at one point was worth like a million dollar, a billion dollars or something. It it was a whole thing.

Corey Ham:

That sounds terrifying.

Andy:

Yeah.

Corey Ham:

Hello, and welcome to Black Hills Information Security's talking about news. Somehow, it's 12/01/2025. Are we really at the end already? Is it time for 2025 to go? I can't believe

Shecky:

the end. My only friend. The end.

Corey Ham:

The end. It's it's today, we're gonna talk about AI slop. We're gonna talk about some I was sorry. Watchtower Labs blogs. I feel like the Watchtower folks, they just get increasingly like, every blog is a little bit more aggressive.

Corey Ham:

Like, so, I mean, I think they publish really awesome research and I really do respect what they do. They, you know, they have a ton of CVEs to their name and some really interesting blogs. But I do think it's funny how like, over time, they're just getting more and more aggressive. Like, this blog in the let's talk about this one first. So essentially, headline is websites that let you store information publicly are insecure because they let you store information publicly.

Corey Ham:

So this is a Watchtower Labs article essentially about Code Beautify and Yeah. What's the other one? JS JSON formatter. Both of these are tools that, you know, kinda like Cyberchef or other similar tools that let you review, you know, I guess, if you don't know how to format JSON or Beautify JSON It's

Ralph May:

pretty print. It's pretty print, man.

Corey Ham:

It's pretty print, I guess. Or if you for Code Beautify, you know, if you it's just a lot of like, do you not have time to install Versus Code? Well, use this instead. Right? That is

Ralph May:

convenience correct. Right. Thing.

Corey Ham:

But the problem with this is, you know, turns out these tools have the ability to save data. Like, you can be like, share this. Let's save this for later. And essentially, this Watchtower Labs post shows they did some, you know, deep dive research on what people are putting in there. And, you know, essentially, the long story short is there's all kinds of sketchy data in there including secrets and all kinds of stuff.

Corey Ham:

Active directory credentials, code repository keys, database credentials, LDAP configs, cloud environment keys.

Ralph May:

I love how that ID is just like literally the title. Or no, wait. It's only like one, two, six characters.

Bronwen Aker:

So basically, the takeaway is that people putting sensitive and inappropriate data into website forms predates AI by a lot.

Corey Ham:

Yeah. I mean, the the title really says it all. Parentheses, yes, seriously, you are the problem. This is not really like this is not a breach of, you know, any of these services. This is just functionality in these services where, you know, you can just post data and save it.

Corey Ham:

Right? Like, that's the you know, I

Ralph May:

So I I think the other side of this too, and I've seen this in web app application testing, is the actual, you know, the what do you call it? The obscurity through a unique identifier. Right? Like, that's security. So if you have so like, essentially, there's some random value that if you guess it, you can read this.

Ralph May:

Right? Like, that's the key.

Corey Ham:

Yeah. Like a five digit ID or something. Yeah.

Andy:

Yeah. That They they could have made that ID a thousand characters when you have a recently posted thing on the website. Okay. The obscurity kinda goes out the window.

Corey Ham:

But Yeah. This reminds me of this reminds me of Pastebin. Literally just Pastebin. Yeah. But again, like So then that comes back

Ralph May:

to two things, though. This is where I was trying to kinda go. Right? Is that, yes, you shouldn't post sensitive data in there regardless. Like, you shouldn't be saving sensitive data into some, like, essentially public forum almost.

Ralph May:

Right? Yeah. But the platform shouldn't have, a recently posted thing on there. Like, it it should

Bronwen Aker:

Yeah. Yeah.

Ralph May:

Kind of have, like, by default, if you put something or save something in there, it is private until you explicitly make it public. I mean, AWS had this exact same problem. Right? When s three buckets first came out, they were always all public. That was the default.

Ralph May:

And then eventually, they realized this was a horrible idea and they had to make like 17 widgets and buttons and like, are you sures to, you know, prevent people from doing it. Now people still do it, but, you know, by default, AWS was kind of setting people up for failure. Right? If they didn't understand what they're

Corey Ham:

Yeah. I mean, I think it's pretty funny, specifically JSON formatter, if you go to it now and you click on save, it says, we are stopping save facility to prevent NSFW content and are working to make it better. Yeah. So they're they're claiming that it's based on NSFW, meaning not save for work content. So are people, like, posting JSON porn?

Corey Ham:

Is that don't What does it sound like?

Ralph May:

Safe for work anymore?

Corey Ham:

Yeah. Does it say, like, sexy colon true? And people are like, oh, sexy colon true.

Ralph May:

Maybe people were sending messages through this platform. I don't know.

Corey Ham:

I don't know. But it's hilarious that they disabled the save functionality on JSON formatter, but claimed For that it was based

Ralph May:

encode, like, a a picture, and then you could share it that way. I don't know what the character limit is, but

Corey Ham:

I mean, I yeah. Like, ASCII art porn in JSON format.

Ralph May:

Base 64, like, actual data, and and, you know, it could be an actual JPEG, you know. Yeah.

Corey Ham:

I guess Wouldn't sharing

Belouve:

corporate passwords be not suitable for work?

Corey Ham:

I mean, sure. I think that's safe for work. That's my job title as an IT support professional.

Belouve:

To to publicly share passwords.

Corey Ham:

Yeah. Yeah. I mean, how am I gonna what? Am I gonna call the user? No.

Corey Ham:

I'll just post it. I'll save it on JSON format Yeah. And I'll send them the

Belouve:

Send them the link.

Corey Ham:

Yeah. So, I mean, basically, the long story short is, don't put your company's data into this tool and definitely if you do, don't save it. Like, if you're gonna do something stupid, don't save the evidence of your stupidity. If you're

Ralph May:

gonna do this, at least give it to an AI so they can tell you

Corey Ham:

that shit. Give it to someone who can really give it to someone who can really monetize it.

Ralph May:

Right? Exactly. Yeah. I wonder

Bronwen Aker:

how long it's gonna be before JSFiddle and SQLFiddle wind up being revealed to do the same thing, because they have a save feature as well.

Ralph May:

Mhmm. Yeah.

Corey Ham:

This is why

Bronwen Aker:

I never have that. As a former developer showing through.

Corey Ham:

I don't know. But I love Watchtower. Keep doing you. Keep putting funny memes in your blog posts. And I guess, honestly, this is one of those things for pen testers and for security professionals out there.

Corey Ham:

Maybe review whether these sites are allowed in your egress policies and maybe don't allow them if you're worried about this type of data leakage. This is not the only one of these. There's probably 10,000 more of these other sites that are the same. There's PaceBin, there's GhostBin, there's, you

Ralph May:

know, there's There's bazillion bins.

Corey Ham:

Yeah. So, you know, blocking egress is easier said than done. But this is definitely worth reviewing and removing. I'm only my biggest thing that I'm sad about with this one is that I wasn't the one to find it first. Because I love digging through the garbage of the internet to find stuff like that.

Ralph May:

I just didn't realize that there were just a list of the recently posted things. I mean, like, that just sounds like a

Corey Ham:

Tresby trope. Right? Even if it was just so it's the IDs for these things are six digit hex. Yeah. How many requests do Yeah.

Ralph May:

You you could you would accidentally probably land on some, you know. Yeah. Just kidding. Especially, I don't know if it's actually random. What if it just goes in order?

Corey Ham:

It's just zero no. I think it's random. I'm assuming it's random.

Ralph May:

God rest my soul. Someone's gonna I

Corey Ham:

will say.

Ralph May:

This and be like, what?

Corey Ham:

So the the based on six digit hex, which is what Code Beautify is using, that's only 16,000,000 requests Yeah. Which is not out outside of

Andy:

the realm

Ralph May:

of reasons. Can slow that for sure. Yeah. You would hit so many though, I mean, before you got to 16,000,000. Also, here's my other question too.

Ralph May:

What like, if they expire, do they just drop off of the database? Like, I mean, that sounds like collisions waiting to happen, only 16,000,000.

Corey Ham:

True. Yeah. No. No one's ever only only 15,000,000 people have ever wanted to format JSON. It's fine.

Ralph May:

Save it. I've used this site before, just that you don't save anything on there.

Corey Ham:

Yeah. I've I've of course. And I think a lot of people have used a site like this. Very few people have actually saved

Ralph May:

that page. It's like I've never went to the site. I'm like, I need to save this just in case I need to go back to it. Like, why? Right?

Corey Ham:

I feel like it's gotta be mostly troubleshooting. It's like, hey, this doesn't work. Here's my JSON response from your API. Here here's I'll

Ralph May:

save it. Yeah.

Corey Ham:

But Yeah. I mean I'll send it

Ralph May:

to though if it's not sensitive, but it sounds like people were using it as a scratch pad. So I mean,

Corey Ham:

it's kinda like how this is the same category as like peep we can't have nice things, like passwords are a good example of this. Like, we can't have nice things. People cannot be trusted with passwords. I think that's true with what is sensitive data. Yeah.

Corey Ham:

What is sensitive data? Well, everything is sensitive data. So don't allow people to post anything on the site if if you don't want to, you know, get exposed. That's my take.

Bronwen Aker:

Speaking of nice things and, you know, sensitive data, what is this nonsense about lawmakers in Wisconsin wanting to get rid of VPNs?

Belouve:

Of course, it's Wisconsin. Like, I I

Corey Ham:

I love that they would ban that would be so funny if they actually ban VPNs, then no one in the government could access their work anymore.

Ralph May:

I I don't even know how like, I don't know how you even go through with, like, actually banning VPNs. Like, how how Yeah.

Corey Ham:

Do you do that?

Ralph May:

Yeah. Like, what is that? Like, I don't yeah.

Corey Ham:

No. Just block just on the Wisconsin state firewall, block port, you know, 500? Like, do you do?

Ralph May:

But you you can't just block a single port and expect VPNs to be. So, I mean, essentially, the only way that I've seen, like, somewhat of success at this and by the way, this is not actual success. It's like China and other very restrictive countries, what they do is they have to monitor all the traffic, and then they have to look for certain kinds of indicators that might indicate it's a VPN. It could be

Corey Ham:

a port. It could be

Ralph May:

deep packet inspection. You know, it could be all of this stuff. It's extremely expensive, and they still have to cast kind of a wide net, and there there's no way they'll stop at all. They there's just it's impossible without a sense of blocking Internet.

Corey Ham:

And just to be clear, the way that they're doing it is they're basically saying, your website has to check whether someone's using a VPN and block people from Wisconsin. That's like the stupidest thing I've ever it's like, how do you like, beginning okay. Of Step one, how do you do this? Well, they say they're coming from Utah, so I don't know where they're actually coming from. Like, what would even be the enforcement for this?

Corey Ham:

You have to just know the origin IP of every single VPN connector? Like, I don't know.

Bronwen Aker:

Well, and the the other thing too, they're throwing it into, we're saving the children. No, you're not.

Ralph May:

Oh my god. It's

Corey Ham:

like, yeah.

Bronwen Aker:

One more time, we've got lawmakers who have no idea what technology does or how it works, and they're trying to legislate to defend something and they're making it worse.

Ralph May:

Are kids just, like, using this many VPNs? Is that is that do we have, like, research to correlate that, like, that's and that that's how they're stopping it? Like or even that you even need a VPN for any of this stuff? Like, I can't

Corey Ham:

think that like, what? Well

Bronwen Aker:

Schools require VPNs for children to log log in for remote classwork, but that's normal.

Ralph May:

Well, now we've said it's bad. Like The yeah. Well, the amount of work

Corey Ham:

this would take. The amount of work it would take. The amount of like, it is not technically feasible for an ISP to block a VPN because of all the different ways you can tunnel traffic. Like, this essentially is like the most basic misunderstanding of how, you know, technology works. Right?

Corey Ham:

Like, we can tunnel any VPN over any protocol. We can tunnel it over HTTPS. We you know, it's like, it's Here's never gonna

Shecky:

the here's the thing is something like that is gonna go ahead and affect the everyday Joe who does not understand how VPNs work or how he can bypass this stuff. You take a look at a bunch of your streaming services like the BBC iPlayer that goes ahead and does a decent job of blocking people trying to VPN in to The UK to go ahead and get free BBC shows off of it. This sort there is some sort of technology out there that streaming services are using to try and block down some of this stuff. Now, is it gonna stop somebody like you or me from it? Or somebody that looks into it?

Shecky:

Probably not. Will it block the everyday lazy Joe? Probably.

Corey Ham:

Well, so I kind of disagree with that. So the way that so the way that they block you know, the way streaming services block VPNs is they just keep an IP database of streaming or a VPN endpoints. Right? So they have like these IP info or another service that says Yep. Oh, the origin endpoint for this user is VPN.

Corey Ham:

We're gonna block this endpoint. Right? So that's pretty easy to do technologically. And basically, my assertion would be if the state blocks VPNs or certain protocols of VPNs, the VPN provider, whatever, MolVad, ProtonVPN, Just gonna add whoever it is, just changes the client so that it uses whatever obfuscation technique isn't being blocked by Wisconsin at this very moment. And then it's just a moving target of like,

Bronwen Aker:

okay, becomes a game of whack a mole

Corey Ham:

at And that it's not up to the user. The user's just rolling whatever VPN client they want, but the VPN provider has a huge business interest in

Andy:

Yeah.

Corey Ham:

Block and bypassing whatever the state's block is. Cat and mouse game between the state ISP and the VPN provider

Ralph May:

Who's getting paid and the state ISP who's not gonna get any Correct. Like, the more the better their technology is, does nothing. Like, they don't get Correct. Funding. They don't get nothing.

Ralph May:

Like, this is it goes nowhere. Right? Additionally Yeah. It really starts to affect the constituents. Right?

Ralph May:

Now, they get to decide whether this is something that they wanna fight.

Corey Ham:

How much money do you wanna spend in IT funds for the government to try to figure out how to block or, you know, if you're an ISP, do you wanna just incur the fines and not block it because it's cheaper than trying to roll it? The other thing is like, never underestimate just the sheer will and determination of a child trying to do something they are not supposed to be allowed to do. Like, coding hacking? Kids will yes. That's how all of us got into hacking.

Corey Ham:

Kids will be coding up entirely new VPN bypasses that You don't even have to code it up.

Ralph May:

They'll be asking their AI to do it for them. Right? Like, you know

Bronwen Aker:

Okay. Here's the other thing though. Who really are the number one users of VPNs? Businesses. So essentially, what the lawmakers in Wisconsin are saying is that your sensitive data for your business isn't important to us because we have to save the children.

Corey Ham:

Yes. That's another thing. It's funny that they would have to figure out how to differentiate between legitimate uses of a VPN.

Ralph May:

And the only way to do that is to look at the data on the VPN. Doesn't that defeat the whole purpose of the VPN? Right? Is zero.

Corey Ham:

Do you

Bronwen Aker:

know who

Andy:

this isn't going to stop? 15 year olds who wanna look at porn.

Corey Ham:

Yes. Correct. No matter what.

Andy:

100% Everyone like it's except teenagers trying to look

Corey Ham:

at Also, like, the whole, like, legitimate business, you know, like, how do you differentiate between NordVPN or whatever, ProtonVPN Mhmm. And not a commercial VPN? Well, what what if I just spin up a new Wisconsin company called Technology Incorporated that our main business all of our our employees are everyone, and our main business objective is have Internet provided to everyone. And what do you know? Now it's a corporate VPN.

Corey Ham:

I just can sell that like, it doesn't make any sense. I don't see how you would possibly do it like Yeah. Yeah.

Belouve:

Well, I'm I'm I'm reading through the I'm reading through the bill here, being from Wisconsin, and of course, it's all from But one what I'm seeing is that, like, there's they have this this whole, like, hey, you need to you need to filter for a virtual private network system or virtual private network provider. But the the the prelude to this is that if you're a business entity that you're publishing material harmful to minors on the Internet, then you need to make sure you do this. So every business Well, that's every business.

Corey Ham:

Every business that I guess, I don't know who that applies to, but if you're Netflix and you have shows that are 18 plus, which they all do

Belouve:

Yeah. They're gonna they're gonna do very broad thing. I also think it's rich that this certain party cares about child abuse. There's some I other mean, I think it's like done

Andy:

this in Texas to a certain extent.

Corey Ham:

Yeah. Like, if if you What?

Andy:

They blocked VPNs? I've I've heard that if you try to visit adult sites in Texas, they will give you a, hey, you can't do this in Texas thing unless you, like, create an account or verify your ID or blah blah blah.

Ralph May:

That's how it is.

Andy:

Unless you use a VPN.

Corey Ham:

That's how it is in a lot of places. Yeah. Florida's the same way.

Ralph May:

Right? But it's it's up to the That's

Corey Ham:

where the VPNs come in. Yeah. So Wisconsin's a step ahead

Ralph May:

I use of being a Texas VPN to access Florida's

Corey Ham:

I mean, that's the thing, is it's just like it gets into that, like, the infinite combination of the, you know, different states, different policies, content harmful to minors. I would call certain sports harmful to minors. Are we gonna allow them to watch, you know, like like, it's or like religious things, or it could radicalize them. Like, it's what it's like anything else. Like, you could totally categorize anything as harmful to minors.

Belouve:

There are certain there are certain chapters of religious works that you could Yeah. There's there's there's there's oh, oh, yeah. Now I now I can't watch my church livestream. So

Ralph May:

The the VPN argument does boil down to the, like, encryption. Right? Whether you should be able to outlaw encryption. Right? That's the whole like, that's where it kinda funnels into essentially.

Ralph May:

Right? So yeah.

Corey Ham:

Yeah. Anyway, I think we can we can Yeah.

Andy:

We can

Ralph May:

we can let this one die.

Corey Ham:

We'll we'll see what happens when you know, if they actually roll this law, what happens. Like, we know laws already rolled to block access to miners to and now everyone's using a VPN. So now they're like, one step further, let's see what happens if we block the VPNs. Yes. I don't know.

Corey Ham:

Stay tuned. Subscribe or whatever you do. Yeah.

Bronwen Aker:

Like and Hey,

Ralph May:

this one's close to you, Corey. Seven Zip. It's got the a critical vulnerability with public exploit.

Corey Ham:

Yeah. But it's not that exciting.

Ralph May:

Alright. Alright. Alright.

Andy:

Well, Slow down. What up?

Ralph May:

Give it to us then. You you seem so excited.

Corey Ham:

So, okay. This is seven Zip, which is a, you know, file compression tool. Actually, I would say seven Zip is pretty commonly used in corporate environments, more than you might expect. Probably more than WinRare. I mean, what company

Ralph May:

is paying Oh, WinRare for though. I mean, they all got that license still you have

Corey Ham:

What company is paying is not paying for a WinRare license these days? But, yeah. Basically, there's a vulnerability, a critical vulnerability in seven Zip. This is gonna be the plague of every sysadmin's existence on Nessus scans for the next year. Oh, And sadly, hackers won't be able to really do much about it.

Corey Ham:

It all they have to do the big the big scary one about this one is all they have to do is open the archive. They don't have to extract anything. They don't have to do anything. They just have to open the archive. And that's the scary thing.

Corey Ham:

It's already been fixed. It's already been patched. It was patched in July 2025. So version 25 plus is already fixed. The the big thing is like people assume that seven zip isn't being automatically updated or patched in most environments.

Corey Ham:

So It's not. So maybe this will be a like gift that keeps on giving, but the problem is, I you know, if I'm a hacker sending in payloads somewhere, I have no idea if they have seven zip, but I guess I could ask them to install seven zip, but then they're probably gonna get the most latest version of seven zip.

Ralph May:

Yeah. So

Bronwen Aker:

Yeah. You

Corey Ham:

just have to hope.

Andy:

No. They're they're gonna Google seven zip, and they're gonna find an ad for a different malware. A different malware.

Ralph May:

This is like one of those things where it's like in the bag of tricks. Right? You're on an internal already, and you see that they have seven Zip installed. You see the version is vulnerable. You're like, win win.

Ralph May:

Right? Like, yes, you already have some level of access, but this is now gonna allow you to, you know, maybe make that initial first administrative access or like that higher level above where you are.

Belouve:

So

Corey Ham:

Yeah. And also, this could be really good for watering hole attacks, meaning like, I'm on a file share, I put a bunch of seven zip files around the file share, and just hope that someone opens it, like, have, you know executivecompensation. Executivecompensation.7 zip, and then see if someone opens it, and, you know, I just get a bunch of callbacks from that over time. Yeah. Yeah.

Corey Ham:

I I I mean, it's not good. This is not the full first vulnerability of this type in seven zip. This has kind of been a long running track. And so I would assume, hopefully, companies that are rolling seven zip to their corporate workstations have an update mechanism baked in. And, you know, if you're just people installing it, they'll probably be updating, hopefully.

Corey Ham:

It

Ralph May:

is one of those tools though that weirdly enough, probably a lot of organizations do have since it is like pretty much free to install and and out. So, yeah.

Corey Ham:

It's pretty I think it's required in a lot of industries to use encryption. Right? If you're sending, like, if you're in healthcare or other industries, you can't just be emailing around sensitive data. So a lot of companies are using sensitive shouldn't. Data.

Corey Ham:

You can't. Well, yeah. And you shouldn't. But it's also like

Andy:

Email's You know, email's not safe. Just use JSON Beautifier. Yeah.

Corey Ham:

Yeah. That's that's true.

Ralph May:

I just use Pastebin, the secret notes. Oh, interesting.

Bronwen Aker:

In the day

Corey Ham:

when I worked Tans,

Bronwen Aker:

we always had to have students install seven zip because the native extraction utilities on both Mac and Windows couldn't handle the heavy files for the virtual machines. So, I mean, it's yet it this is this is definitely potentially going to inflow impact a lot of people who don't update regularly. But, you know, that's one of the reasons why you should update regularly.

Corey Ham:

Yep. Update your seven zips, people. It's gonna be eight zip sometimes.

Ralph May:

Yeah. You gotta use seven zip to update seven zip though.

Corey Ham:

That's Yes. How many people

Andy:

that don't update regularly are reading Hack Read?

Corey Ham:

Or or are listening to this podcast?

Ralph May:

Yes. Yes. I assume Tell your family members.

Shecky:

Yeah. Your family members update now.

Corey Ham:

It it doesn't have a built in update check mechanism. Right? No.

Ralph May:

Doesn't have any of that now.

Corey Ham:

So that's like, that's why everyone's panicking about this, because like, it won't when you open seven Zip, it won't say, oh, your your seven Zip installation's outdated. Yeah. Alright. What else we got?

Ralph May:

Well, I was gonna talk about this article about searching the Internet before AI. Oh, Slothivator? Let's talk about Slothivator. Right.

Andy:

Right. We were joking we

Corey Ham:

were joking about this before the podcast. Let's talk about Sloppivator.

Ralph May:

I didn't hear that. The

Bronwen Aker:

pre pre show banner.

Corey Ham:

Explain someone explain Sloppivator to me like I'm five and don't use AI.

Bronwen Aker:

Sloppivator is a browser plugin that restricts what you will be able to access so that all of the articles you read are pre November 2022, which was when ChatGPT was released.

Corey Ham:

So okay. I want get back to

Bronwen Aker:

dorks. Okay?

Corey Ham:

The biggest okay. The biggest thing about this article is that it the the person who made this is an artist. Okay? That is the thing to know. This is art.

Corey Ham:

This is not actually useful. It is more of a statement on the way of the state of things than it is actually useful. All it does is that it just uses Google search functions to filter out websites that are November whatever 2022, which is the day ChatGPT was released, which I feel like I mean, I do wanna poke many holes in this just because we're technical and that's what we do. Number one, people use search engines other than Google. Number two, AI existed before ChatGPT was released.

Corey Ham:

Oh. Yes. I don't believe

Bronwen Aker:

I remember Watson.

Belouve:

I do think this covers like five five search engines though.

Corey Ham:

Oh, there's only five search engines. No one's just using ChatGPT.

Belouve:

Yeah. One's using anything else. So I think it I think it covers, like, if you search Reddit as well, then it'll be like, no. It needs to be something that is before November.

Ralph May:

So you're just gonna forget the You're gonna find only useless garbage.

Belouve:

Yeah. That I mean, that's the explain it, like, on five is, like, just pretend today's date is November 2022. And if if you if you come across anything after November 2022, that's it it slows it it

Corey Ham:

don't slows disagree. Stupid.

Ralph May:

I don't disagree. By being slop. Right? I I'm not I'm not disagreeing or or saying that that is that is not true. But what I am going to say, though, is that things before AI weren't slop either.

Ralph May:

Like, I don't understand. Like, you know, like, I get it. They're AI slop, so that's a different kind of slop. But like, before, everything was like, you know, it was homegrown, like GMO type stuff. Right?

Corey Ham:

Yeah. I mean Non GMO stuff. Yeah. I was gonna say, there's been slop on the Internet forever. Apparently, you know, the the person, the artist who made this really feels that, you know, sites like YouTube, Reddit, Stack Exchange, and apparently, Mumsnet, which is for parenting Mhmm.

Corey Ham:

Are full of slop and, you know, they're really specifically wanna search those sites without results from 2022. Oh.

Bronwen Aker:

But And that is a legitimate complaint. I mean, AI's generated slop has taken over YouTube and it's

Corey Ham:

Has it?

Bronwen Aker:

How It has. Oh. Oh, it's bad.

Corey Ham:

What does that look like? Because I haven't really seen that. Maybe that's the real

Bronwen Aker:

It I mean, there are entire channels that are nothing but AI stuff. There's one like history to to help you sleep, and it's AI generated history stuff with AI generated animations. And I'm I know enough about history where I've I've watched a couple of these things and it's like, no, that's wrong. No, that's wrong. Then that then Yeah.

Bronwen Aker:

And but it's it's AI slop, but it's there and people are eating it up. And it's it's just it's it's awful. And of course Yeah. Yes. Slop has existed long before the the LLMs and AIs came along to add to the problem.

Bronwen Aker:

But, you know, it's it's kinda like junk mail escalating when email came along.

Corey Ham:

Yeah. It's Interesting.

Belouve:

It's And

Bronwen Aker:

go ahead.

Belouve:

Yeah. You also have, like, AI swap products, which I mean, I go, like, for the holidays, like, be on the lookout for that because they're just gonna be like, oh, here's here's this awesome thing. Like, you can get, like, a full suit of Star Wars armor for, $50. Look at it. Here it is on, like, the, you know, here it is on the, you know, on the website.

Corey Ham:

Here's an image that's definitely not AI generated.

Belouve:

That's definitely not AI generated because it's it's going to be, like, slightly different between different pictures, and they don't have any sort of product things. The product reviews for these things are you can tell are kind of AI generated because they'll have a lot of them will have, like, that that qualifier tool. They'll be like, you know, as a hacker, I like this. As a college student, this is extremely useful. As a person in this industry, I like this.

Belouve:

It will all

Corey Ham:

have a model. It will all a large language model.

Andy:

Have the

Bronwen Aker:

prompt buried in whatever the product is.

Belouve:

Yeah. So you have to be on the lookout for that.

Corey Ham:

Okay. But have we not like, I know that slop the amount of slop is shocking. Like, don't disagree with that. But I will say, I I was it's crazy to think of a time on the Internet where we had to question whether some of the images were real or fake. That's never been

Andy:

a thing.

Corey Ham:

Quotoshop doesn't We

Andy:

need to Corey, we need to play this video that Zach just just dropped in Discord. I I think I think everyone needs to see this. It's it's important. It's short.

Corey Ham:

Okay. That's a that's a Megan thing. I can't play videos.

Ralph May:

Yeah. I don't even know how videos are.

Corey Ham:

I'm not authorized for that kind of access.

Andy:

Oh. Where'd Megan go?

Ralph May:

The I I think the the amount of AI stuff that we have now too is just I think that's really what I was getting at.

Corey Ham:

I want an enhanced version of this add on that goes back before the release of Photoshop as well.

Ralph May:

Oh, alright.

Belouve:

Well, now you're gonna

Ralph May:

have to get Internet Explorer and there is actually, I saw this the other day. There is a Windows 95 that somebody wrote that you can run on your computer. It's not it's it's our it's our prebuilt. They, like, rebuilt it all in JavaScript, and it works great. It, like, it's like Windows 95, you can just install it on your computer, Mac, Linux, whatever.

Ralph May:

It works great.

Corey Ham:

So Okay. Is there a news article for this or do you just happen to know

Ralph May:

about this? No. I just I'll I'll send I'll send the link. But, yes, there's a Windows 95 and you could browse the Internet as if it was Windows 95. So there's like you can go to like So

Corey Ham:

you can't browse the Internet? Well, a lot

Ralph May:

of websites you can't browse the Internet in Windows 95. You have to go to specific websites because Internet Explorer will explode.

Corey Ham:

Just Yeah. So I will say

Andy:

Does it take you like ten minutes to load any website?

Ralph May:

No. That's why you gotta go to the websites that are designed to load in Windows 95. You know what I mean?

Andy:

I think because it'd still take like ten minutes.

Ralph May:

No. It's not on 56 k.

Bronwen Aker:

Only if you're using a modem. Yeah. And a landline.

Corey Ham:

I I will say, I do think there's actually a legitimate business case for the a product like this. Something that's designed to help you easily identify and and filter out AI generated content, whether it's images, videos, whatever it is. I think there's a legitimate business opportunity here. However, unfortunately, that product itself is gonna have to be AI driven. So it's kinda like, it's gonna be slop on slop.

Corey Ham:

It's gonna be like Oh. Using an AI model to tell whether something is generated by an AI model. It's just like turtles all the way down, just the same thing looping back

Andy:

and forth forever.

Shecky:

No. What we Hopefully, we're

Belouve:

getting there

Andy:

though. We need is AI

Shecky:

we need is we AI to go ahead need AI to photoshop an AI generated image of AI photoshopping an AI generated image. That's what we need.

Andy:

That makes perfect sense. So, like, at least Sora too, the or or Nano Banana Pro or whatever the hell Google's new thing is. Like, they're actually doing, like, built in, not watermarking, but invisible watermark type stuff that

Corey Ham:

you can actually cryptographic.

Andy:

Yeah. Yeah. So that, you know, it can actually be identified as slop. If everybody does that, then I mean, 90% of the slop's gonna go away. Yes.

Andy:

You can do a local model. You can you can get around it. But the whole reason we have so much of this slop is because it's so accessible. And just because it's so easy and the barrier to entry is so incredibly low. As soon as you start adding any technical barriers to untraceable slop, 99% of it is gonna get filtered out as easy slop.

Corey Ham:

Yeah. I mean, I I think the biggest thing is, like, we need we as nerds need to make sure that the people around us who are not necessarily as nerdy as us understand how easy it is to generate slop and as long as once you know that slop exists and that it, you know, what it can be and what it can do, it's not that hard to identify and filter it out just, you know, kind of browsing past it. But if you think everything on, you know, every video you see on the internet is real, then you're gonna have a bad time. Right? Like that that's, you know, you don't wanna do that.

Corey Ham:

So I will say I have seen some pretty funny videos of people like using AI to render in like, you know, as an example, like a daughter is texting her dad pictures of like, I let this plumber into our house and it's just like clearly a homeless guy in their kitchen or whatever. And the dad's like calling her. She has like 15 missed calls from dad being like, what? He's in our house and they're just using AI to, you know Jesus. Add a person into the house.

Corey Ham:

So, you know, she had to increase awareness that these things are out there and that, you know, slop is slop and we gotta watch out for it. Inform the non nerds in your in your world.

Bronwen Aker:

Downloaded the Zach video. I can see if it will play with audio.

Corey Ham:

Let's see if we can Yeah. Show off some slop.

Bronwen Aker:

Here we go.

Corey Ham:

No audio. No audio. That's all

Ralph May:

It it does play perfect. Just no

Corey Ham:

This isn't slop. It's definitely not generated with Sora. It doesn't have any watermarks.

Andy:

That looks exactly like Zach.

Ralph May:

Yeah.

Andy:

I couldn't tell that that wasn't Zach.

Bronwen Aker:

Looks like Zach almost always wears a cap, doesn't he?

Ralph May:

How many fingers does

Corey Ham:

Zach have? Does he have seven?

Ralph May:

Does he have seven? But see, that's just the thing, they'll fix that and then they'll fix the next thing and then they'll fix the next thing and then you'll just be like, damn it, I can't tell. And then be like, now

Belouve:

what do we do?

Corey Ham:

Not saying

Bronwen Aker:

at least the fact that AISlop is out there is hitting mainstream media. We just finished up season seven of The Rookie here in this household, and they had an episode where a woman used AI to catfish her own husband. And he fell for it and didn't count didn't notice the fact that one hand of the the person had seven fingers and the other hand only had three. It was it so at least it's hitting mainstream consciousness. I will say that's a plus.

Bronwen Aker:

Yeah. Yeah. But we're not out of the woods yet. It's gonna get ugly before it gets better. Uglier.

Bronwen Aker:

Alright.

Corey Ham:

Let's talk about China. Even though John isn't here, we can maybe summon him by talking about China. China. He's on a plane. Yeah.

Corey Ham:

So this is an article from Kyiv Post talking about basically China is also increasing their espionage attempts targeting Europe. So, you know, I don't think this is super surprising. We've seen it a lot in The US with, you know, the salt typhoon infections of US ISPs and government hacks and things like that. But essentially, this is just an article talking about emphasis on cyber espionage in recent European cases. They're trying to build relationships with people.

Corey Ham:

They're trying to, you know, embed themselves more deeply in European institutions, which is pretty spooky. I guess, super surprising necessarily, but it is interesting. Yeah. One of the cases they outline is big hunt headhunters approaching paramilitary individuals with lucrative job offers. Right?

Corey Ham:

Which is like, you know, an interesting tactic. It's basically like recruiting foreign assets. Right? That's like espionage. Classic one.

Corey Ham:

This is this is not new. Right? It's the same play Corey,

Andy:

minor minor correction. Parliamentary staff,

Corey Ham:

not paranoid. I can't read. Basically So that's worse.

Ralph May:

Same thing.

Corey Ham:

That's way worse. And and just basically government employees. Weapons. Government employees without weapons, not

Andy:

The pen is mightier than the sword, Ralph.

Corey Ham:

Yes. Absolutely. Yeah. Basically, trying to recruit a foreign resource. There's evidence of that happening in The UK.

Corey Ham:

I'm sure it's happening here. I don't know if we've seen any news articles necessarily talking about that here, but I'm sure that if you're a staffer for Trump, you're getting a lot of really interesting LinkedIn messages these

Ralph May:

days. Well,

Andy:

on the bright side, we don't have a bunch of former government employees that suddenly got laid off.

Corey Ham:

No. No one is looking for any jobs or anything.

Andy:

So they're not gonna be susceptible to this sort of thing.

Corey Ham:

No. No. That's true. Yeah. No one would fall well, no one would fall prey to this.

Corey Ham:

No. No. Anyway, did you all see the iOS vulnerability, I guess? It's like Apple? Is it it's like, is it?

Bronwen Aker:

I can't. I don't know. Update all the things.

Corey Ham:

There's a hidden setting that you must change that leaves your phone open to attack.

Bronwen Aker:

Oh. Apple left hidden settings?

Ralph May:

Up up

Bronwen Aker:

down down

Corey Ham:

left devices. Right. What is the actual So basically, the vulnerability is that the USB port is enabled after reboot? Is that the vulnerability?

Belouve:

No. I think I think just after unlock.

Ralph May:

Yeah. After you've unlocked that the USB port is available.

Belouve:

Yeah.

Ralph May:

You can change it to always ask or ask for new accessories.

Corey Ham:

Allow automatically when unlocked Yeah. Change to Yeah. Always ask ask for new accessories? I mean, if my phone's unlocked, I don't see, like

Ralph May:

Look, there's If you plug if your phone's unlocked and you plug in and you plug a USB accessory in there, I I guess it doesn't prompt or give you any

Corey Ham:

Yeah. Same thing. Just don't see any interests? I can't imagine a scenario where, I guess, I'm I'm charging my phone while it's unlocked. Are we gonna go back

Andy:

to No. No. No.

Corey Ham:

Delicious phone Juice jacking?

Shecky:

Can we

Corey Ham:

bring it up? Juice jacking?

Ralph May:

Corey, I think what they're

Corey Ham:

Juice saying is jacking.

Andy:

After a reset and you unlock it once, like, counts as unlocked. Yeah. Whereas after this update, every time it's locked, it would count as locked or something. Weird.

Belouve:

Don't even have that I don't have that option on my phone after update. So I updated this morning because I got that prompt saying, hey, there's

Corey Ham:

a You got juice jacked?

Belouve:

No. Didn't get juice jacked. No. Was a there was I got a prompt being like, hey, your iPhone's out of date because it just company portal and everything there goes, hey, you're you're trying to

Ralph May:

do your because they knew you were

Corey Ham:

gonna get juice jacked soon.

Belouve:

Yeah. So I I updated it and that setting isn't there anymore. Like, I don't have the I don't have under the privacy and security like what they show in I'm I don't I don't have that

Andy:

in the Or was it a text message that was like, click here to update your iPhone? It was a finish.

Belouve:

No. Yeah. Okay. So no. It's it's through, like, the the Okta app.

Belouve:

So it'll have if if you're if you try to you know, if you if you look up your your push notification on your Okta app, like, it'll say, like, hey. You know, it's like a little, like, security icon in the corner. It says, hey. You're not on the latest version. Your your phone isn't running.

Corey Ham:

Looks like he got juice jacked.

Bronwen Aker:

It's not me.

Corey Ham:

He got juice jacked. Oh, no.

Ralph May:

That's one way to go.

Corey Ham:

They got Baloo. Those juice jackers are those juice jackers take take things serious. Don't wanna mess

Belouve:

with them.

Ralph May:

I plug my phone into every suspicious USB port. If they're gonna waste a zero day on me

Corey Ham:

And always when it's unlocked,

Ralph May:

of course. It's always unlocked. I don't have

Corey Ham:

a code. Oh, he's back.

Belouve:

Yep.

Corey Ham:

How was the how did it feel to get juice jacked, Baloov?

Belouve:

I don't know.

Corey Ham:

What does it feel like?

Belouve:

No. It feels it feels fine. I'm not I I don't know.

Corey Ham:

You're gonna feel a slight pinch.

Belouve:

Slight pinch? Oh, I I

Ralph May:

The classic. Just your nerves.

Corey Ham:

No. It's just your nerves. I I I

Belouve:

I I've had all sorts of needles on all sorts of nerves this year. So if it's anything like that, I'm used to it.

Corey Ham:

Anyone else have any other fun articles? It was kind of a slow news week, honestly. I almost like everyone's eating turkey. Thanksgiving.

Andy:

I don't know how fun it is, but we can talk about meta slash Facebook doing meta slash Facebook things that aren't really

Corey Ham:

What even what even is that? I I saw the news article and I was like, I don't understand this.

Bronwen Aker:

Andy, you talking about the the strike policy?

Corey Ham:

The

Bronwen Aker:

For sex trafficking?

Corey Ham:

This is an old no. Oh, we we that is an article we talk about. That's a different one.

Andy:

I mean, yeah. So there's there's the is that the one that I put in the notes?

Shecky:

No. You put down the one about the mental health, the study on mental health.

Andy:

No. No. The mental the mental health one was there. And then we have the one from, like, three weeks ago about, you know, Meta making, like, $16,000,000,000 a year off of what they know to be fraud.

Bronwen Aker:

Yeah. Well, the one it's a little

Corey Ham:

bit elaborate. In our note.

Bronwen Aker:

Met November 24 is the date on it from The Verge. Meta had a 17 strike policy for sex traffic.

Corey Ham:

That's a lot of strikes. I I've won the baseball and it already I takes can't imagine how much longer it would take with 17 strikes

Bronwen Aker:

in To me,

Ralph May:

strike policy that goes to 17 is not much of a strike policy. That was what

Corey Ham:

the AI recommended. Why

Bronwen Aker:

do we even bother kind of thing?

Corey Ham:

Alright. Either way, why don't you run us through this article, Andy, and we can see what's going on. We I guess I'm gonna

Ralph May:

I'm gonna borrow the strike

Andy:

policy. Here, let me let me post the fraudulent ad one.

Belouve:

Oh, gosh.

Bronwen Aker:

Meta's just all Fraudulent ads?

Corey Ham:

Really? News this week.

Ralph May:

They have 17

Andy:

No. This this is a this isn't old. This is like November So we're we're we're dragging up some old news here. But Meta had, like, 10% of its revenue from 2024 was projected that it would come from ads from scammers and banned goods and everything else. And, like, they they knew this.

Andy:

And they had policies internally.

Corey Ham:

I'm curious about that. It's pretty funny. It's like, yeah, we know they're scammers, but I mean, money.

Ralph May:

Money. I mean, what would

Andy:

you were actually charging the scammers more money.

Ralph May:

Oh, this is classic.

Andy:

Like, programmatically. So they'd like, oh, this is high risk to be fraud. Let's charge them more money.

Ralph May:

Oh, my gosh. Yeah.

Corey Ham:

Okay. So this is leaked. Is this leaked documents? These aren't these are this was not intentional for them to publish this. Right?

Bronwen Aker:

A cache of previously unreported documents reviewed by Reuters also shows that the social media giant for at least three years failed to identify and stop an avalanche of ads that exposed Facebook, Instagram, and WhatsApp billions of users to fraudulent e commerce and investment schemes online casinos and banned medical products.

Andy:

Now, hey, in Facebook's defense, they will ban advertisers if the automated systems predict that the marketers are at least 95% certain to be fraud. Well, hold on. So they have

Corey Ham:

to Only after 17 strikes.

Andy:

Yeah. Okay. That is you you have to get 16 strikes first.

Corey Ham:

And then you

Andy:

once you're at that.

Corey Ham:

Fool me once. Shame on you. Fool me twice. Shame on you. Fool me thrice.

Corey Ham:

Shame on you. I don't know what the I don't know what the word is for 17 times, but also shame on you. Oh my god. Yeah. I mean, that is, I guess Capitalism.

Corey Ham:

Their defense, I think, like, they acknowledged basically that like, okay. Yeah. It's true. But also, the data was, you know, excessively broad or, you know, they basically were just like, this is, you know, a mislabeling trick like, oh, we just cat it ads.txt and grep for scam and that was 10%. So that's, you you know, like I don't know exactly what they're saying but The the part

Andy:

of this that frustrates me is that if any one of us tomorrow was like, hey, I have this great business idea. We're gonna do nothing but serve up fraudulent ads to people and we're gonna make $10,000,000,000 next year, we would go to jail.

Corey Ham:

No. They're too big to

Andy:

we would go to jail.

Ralph May:

Too big to jail. That's that's how it works.

Corey Ham:

So, okay. My question would also be, what is Google's percentage of scams and ads? Because like every advertiser has to has to grapple with this. Yeah. If you have the ability for me to create an ad, it's incredibly difficult for you to differentiate whether I'm a legitimate provider of that service or a scam provider of that service.

Corey Ham:

So I guess I'm curious what other major advertising networks are doing about this. Like, does Google have 10% ads? Is is this ever been disclosed?

Andy:

It to be massive. I mean, Google can't even or doesn't want to stop, like, malvertising for Chrome. If they can't stop malvertising for their own products, then what hope does anyone else have?

Corey Ham:

Yeah. I mean, I think I couldn't find, like, a corollary number, but basically, this is something every company is gonna have to contend with. I think the biggest thing is like, the potential worst case scenario here is like if this gets under, you know, congress senate attention and and one of these people who run these programs gets called under. I mean, already brought Zuck in and we're like, how does the internet work? I can't questions.

Corey Ham:

Yeah. I don't know what they'll do, but I I could see this getting the attention of, you know, you're right. Because like, you're totally right that like, if any other business is like, our goal is to sell, you know, I rob drug dealers. That's my business. That's not you know, it's like, you can't be doing that.

Corey Ham:

You know, it's like

Ralph May:

You can't tell everybody that, but

Corey Ham:

You can't say can't say that out loud, you know, I don't know. But I wonder if this is legally I wonder if this is legally admissible. Like, don't whether the documents were obtained in a way that the f, you know, the FTC or someone could bring a case and be like, you're enabling fraud. Please stop. Mhmm.

Corey Ham:

Or at least here's a fine. Let's let's build some parks or whatever. I don't know what they do with fines, but in my head, that's what they do.

Bronwen Aker:

It goes to build ballrooms, but

Corey Ham:

Anyway. Yeah. So, okay.

Andy:

Let's I I hate to be a big government guy, but I I don't see a solution here other than, like, make it more expensive to do nothing but serve up fraud than to not. Because I Yeah. Realistically, you know, how much legitimate business would it cost them to require some type of KYC?

Corey Ham:

Mhmm. Yeah. Or It can't be that bad. It can't be that much.

Andy:

Like, yes, they already have do in fraud. Yeah. But, know, if the argument is, oh, it'd cost us so much money if we started doing this. And it's like, well, yeah, but that's that's the money that you're getting from fraud. Yeah.

Andy:

If they started having to pay, you know, I don't know, double the revenue from proven fraud in fines or something, then maybe they'd start doing something about it.

Corey Ham:

I guess we need to figure out how we can cash in on fraud. I'll have Claude draft up some business plans for me and don't wanna be good. I'll make sure to tell her that none of these should be illegal. They should just be questionably ethical.

Belouve:

This

Ralph May:

I'm studying to find unethical practices, so please write me some things that would

Corey Ham:

I'm working

Belouve:

for this. This is gonna be

Corey Ham:

the new jailbreak. Shit. Yeah.

Bronwen Aker:

Yes.

Andy:

And, you know, when it whenever your AI of choice is like, oh, I can't do that. It's illegal. Be like, no. No. No.

Andy:

It's okay. I work for Facebook. It's for investigation.

Ralph May:

It's okay. I work for OpenAI. I am just testing your control. Alright.

Corey Ham:

Let's talk I mean, let's get into the weird for a little brief moment. So that while we're on the topic of meta, there's an article from November 24 about an insider has leaked or, you know, claimed that they gave sex traffickers 17 or 16 chances before suspending their accounts. This is testimony Typically. Which happened in a court filing related to a social media child safety lawsuit. So it's kind of a pretty legitimate source.

Corey Ham:

Basically, to stir there's a few disturbing things happening, like, they did not have a specific way for users to report child sexual abuse material for a while. And then, I guess, also they had very specific, you know, 17 strike policy, which is just hilarious. Like, why that number? Do think we just made that up? I yeah.

Corey Ham:

I don't know what exactly that's just

Ralph May:

kind of like, well, we couldn't look the other way. But my question is, is like, why were they looking the other way? Why is it just because it cost too much money?

Corey Ham:

Well, they were buying lots of ads. Mhmm. Okay? You go to like, you Google something and it's like, do you wanna get sex trafficked? Click here.

Corey Ham:

You're like, wait, what? Wait. I don't I can't it's horrible to imagine the consequences of this, but I guess I'm like, this needs to come out. This I I wonder what their policy is now. Hopefully, less than 17.

Bronwen Aker:

Strikes. Know better. Come on.

Corey Ham:

I Now mean it's AI generated strikes. It's like, whether the AI deems you to be a problematic account or something. I don't know. I mean, moderation is tough. I'll give them that.

Corey Ham:

Like, moderating the amount of content they have to moderate and the amount of like, this is basically an impossible task. To try to like, drink the fire hose of the internet, identify malicious actors or or problematic actors and remove them, that's basically impossible. But doing, like, having a not no ability to report CSAM and also no way to, you know, have like a policy like a one strike. Like, why tolerate this at all? I I I guess false positives because you could use it to DOS people but like, I don't know.

Corey Ham:

It's kind of a crazy thing. The other thing is like, once you ban these accounts, can't they just sign up for another account? Like, it's kind of stomping out ants. Like, you're not really actually doing anything.

Bronwen Aker:

Whack a mole.

Corey Ham:

Yeah. Whack a mole. Yeah. I don't know. Either way, that is a shocking revelation and kind of fits with the last article.

Corey Ham:

I think we should talk real quick while we're on CD topics about the guy with the WiFi pineapple.

Bronwen Aker:

Oh, no. I missed Okay. That

Andy:

So I missed this one.

Corey Ham:

Basically, the article title is an Australian man who was behind in flight evil twin attacks got seven years in prison. So basically, here's the scenario. There's an Australian man. His name is or his I I forget his name. But basically, he's a 44 old 44 year old dude who travels with a WiFi pineapple.

Corey Ham:

And you might be thinking, well, traveling with a WiFi pineapple is not that sketchy. But then, the the unfortunate thing is he's using the WiFi Pineapple to capture login details specifically for females and then using their credentials and things that he's capturing to get into their personal accounts and then, you know, grab their, you know, sensitive intimate images. So basically, it's a pervy thing as always. It's not a security thing. It's a pervy thing.

Corey Ham:

Essentially, this this goes back to 2024. He was charged in 2024 because someone on a plane, one of the employees on the flight just noticed that they were doing that they like, he was using a rogue device somehow. I don't know how they actually could tell.

Belouve:

But So

Ralph May:

I have I have a couple things here. Right? From a technical standpoint, I understand how you would make a rogue AP. Right?

Corey Ham:

Right. But You just call it United WiFi or

Ralph May:

whatever Yeah. You And you connect. Cool. What what I don't understand is how he was capturing the credentials. So one way to do it would possibly be to make a fake Facebook site and

Corey Ham:

then Yeah. That's exactly what he was doing. See.

Bronwen Aker:

Yeah. He he had a a malicious access point with a phishing web page to steal

Ralph May:

You pretty much have to use something like Evilgenics or something like that for it to actually work though.

Corey Ham:

But it wouldn't work. It's literally just gonna be like fake Facebook login, error logging in. Error. Right? Because he

Shecky:

Alright.

Corey Ham:

Presumably, he's If not

Andy:

I remember if I remember correctly from the, like, original one when this came out however long ago, it was, like, to get access to the in flight Wi Fi, log in with Google. Log in with Facebook.

Ralph May:

Okay.

Andy:

Okay. He was doing a, like, fake SSO login to capture the credits.

Bronwen Aker:

Yeah. He he had password.

Ralph May:

He wouldn't get that he didn't get that session, would he?

Corey Ham:

Yeah. Nothing ever worked. Nothing ever because there's no way he was able to bridge his WiFi Pineapple to a functioning Internet connection.

Ralph May:

I could give He you, could've got on the WiFi of the airplane. Yeah. Yeah.

Andy:

I guess how they caught him, because they were like, all these people aren't paying for the WiFi now.

Corey Ham:

This guy's going down.

Belouve:

I I don't know. I don't know the details.

Corey Ham:

Wi Fi revenue has dropped on every flight that this guy goes on. We gotta investigate this.

Belouve:

I do know of others that have done this, and usually it involves, like, a travel router to where it's like you are getting the access to it. You're putting things out. This was on the way to DEFCON, and they, you know, they were on a different flight, but they were saying it's like, yeah, there are people

Corey Ham:

No. We got juice jacked again. Oh, no. Double juice jackings in one day.

Ralph May:

The Internet doesn't want them to know.

Corey Ham:

It looks like, hopefully, he's not connected through some other dude's WiFi pineapple. You got Jason's

Bronwen Aker:

He's running again.

Belouve:

He's back away. You Jason's license in one shot. You make me full screen and then I drop out, so I don't know. Weather. It is.

Belouve:

Yeah. It's probably just it's probably my it's probably my internet line that's getting too cold up here.

Corey Ham:

Yeah. So, I mean, basically, the the end of this story is the guy got sentenced to seven years, which is So what was

Ralph May:

the evidence? So how did they capture the evidence though? Now I'm curious of like

Corey Ham:

They seized his devices.

Bronwen Aker:

They seized

Corey Ham:

So basically, he here's the here's what happened. So in 2024, he gets off the plane and they're like, give us all your devices. Uh-huh. And then, you know, they find 1,700 items of intimate images and videos, personal credentials, records of fraudulent WiFi pages. He tried to like remotely wipe his device, it didn't work, you know, it's like, oh, it becomes a comedy of errors of like you didn't criminal you didn't criminal very well as a so

Bronwen Aker:

Okay. It it's hard though now with all of the sharing and synchronizing to completely eliminate all of your forensic evidence unless you're really careful about making sure you're only using one or two devices. If he's not a cybersecurity expert and he did have multiple devices syncing with all of these images and videos and information, that's a that becomes a really difficult attack surface to protect against someone coming in and figuring out forensically all the badness that you've done.

Corey Ham:

I mean, I guess, but clearly he's smart enough to set this up so he can also just not sync his data to a freaking cloud service provider.

Belouve:

Like, I

Corey Ham:

don't know. I mean, it's it is what it is, but it doesn't matter. But, you know Yeah. But I think the crime benefits or I think the crime fits the time. That's that's a pretty heinous thing.

Corey Ham:

1,700 images or 1,700 items is a lot. I'll be I'll qualify again. Yeah. The amount of amount of personal information in that is significant. And it's also it's interesting, like, wonder what the the the counts.

Corey Ham:

I mean, these are all like Australian laws, but they had unauthorized causing unauthorized access or modification of restricted data, attempting to cause unauthorized access, stealing, unauthorized impairment of communication. So people were like, I couldn't stream Frozen one count of possessing or controlling data with the intent to commit a serious offense. Is there one for being a perv? Apparently not.

Ralph May:

That's more of a of a infraction.

Corey Ham:

It's an interesting from a cyber security perspective though, it is interesting to think about, like, if you're a SOC defender, how do you defend your employees on plain WiFi? It's really hard to defend against this attack. If someone, you know, makes a rogue AP and an employee connects to it and then they type in their credentials, like those credentials are compromised. Basically MFA, like it's the same.

Andy:

I mean, just make make your people use phishing resistant MFA, Like, enforce HYTO two.

Corey Ham:

Right. Yep. And

Bronwen Aker:

VPNs. But not in

Corey Ham:

Wisconsin. No.

Ralph May:

Those are banned. Oh, not on airplanes. International law.

Corey Ham:

It's it's international. Baby, we could get married by the captain.

Ralph May:

Oh, god. Yeah.

Bronwen Aker:

Yikes. Nice.

Corey Ham:

That's a rough one. Alright. Has anyone have we got any, like, chicken articles or other, like, fun positive articles to to finish on instead of weird pervy guy within pineapple? I

Bronwen Aker:

could always share the brining recipe I used for our turkey this year.

Ralph May:

Oh, brining.

Bronwen Aker:

We we we brined using brown sugar and maple mixture, then spatchcocked it, and then smoked it. And it was

Corey Ham:

That sounds incredible.

Bronwen Aker:

Amazing. It was and and I I discovered this year that the trick to really awesome green bean casserole is mixing in shredded Parmesan. And I'm not talking the cheapy stuff, I'm talking the good Parmesan and oh my god. Not the

Corey Ham:

wood chips?

Bronwen Aker:

Or no. Not not the wood chips. Not the the white fluffy stuff. No. You wanna have the good stuff that is actual shredded cheese.

Bronwen Aker:

It was amazing. And, of course, I'm talking to John over the weekend, and he says, oh, yeah. I've been doing that for years. Like, shit. Shit.

Bronwen Aker:

Shit. Shit. Uh-huh.

Corey Ham:

Throw your arm. Sorry.

Andy:

It's okay.

Corey Ham:

So, okay. Now the question is, so Bronwyn, one of the things he used to do was he used to send me AI generated images of things for the holidays. So how can I can you share a prompt that would generate a really good looking turkey for me? Because I I it's Thanksgiving's over. I already baked my turkey and I'm gonna forget about that episode before next year.

Corey Ham:

But I need an AI generated turkey to eat for my dinner.

Bronwen Aker:

Well, I can just send you pictures of the actual bird because I did the food porn thing.

Corey Ham:

No. I only I want the opposite of slop. I only want slop. I want only slop.

Bronwen Aker:

The the nature of the prompt will depend on which AI you're using because how you prompt in mid journey is very different from how we would prompt in Copilot or ChatGPT. So so name your poison in terms of the the origin generating AI, and I will try to to, off the cuff, provide you with a prompt suitable to meet the desired outcome.

Corey Ham:

I'd like to go with Ralph deep frying a frozen turkey.

Bronwen Aker:

Which which AI do you want to use?

Corey Ham:

With Copilot.

Bronwen Aker:

Okay.

Corey Ham:

Wow. Fancy. You can send me that. Just send me it offline.

Andy:

So I don't

Ralph May:

Yeah. It's RIP me.

Bronwen Aker:

Yeah. I don't use Rock.

Andy:

Sorry. That's gotta do it.

Corey Ham:

Here's some Ralph lore for you. Ralph, at least last time I checked, actually does deep fry his turkeys and has never burned down his house to so far. Yeah.

Ralph May:

Oh, so true. Yeah. It's it's not that hard.

Corey Ham:

If he can do it, you can do

Ralph May:

it. Exactly.

Andy:

Oh, yeah. That's why burned

Ralph May:

their house down. They'd like, it wasn't true.

Corey Ham:

It wasn't. Meanwhile, I I did burn my house down too.

Bronwen Aker:

Oh, yeah. The city of Pasadena actually had a PSA on how not to burn your house down by frying your turkey.

Ralph May:

I bet.

Corey Ham:

Yeah. I bet. It happens. In California, that hits a little different for sure. Yeah.

Corey Ham:

Yeah. Well Alright. Well, thanks everyone for coming. I think that's a good a place as any to call it and we'll see you next week.

Bronwen Aker:

Bye, guys.

Corey Ham:

Bye, y'all.