1
00:00:01,234 --> 00:00:03,544
State of Ai and law is an upcoming,

2
00:00:04,261 --> 00:00:06,333
fun conference that I just saw come through

3
00:00:06,333 --> 00:00:06,572
my.

4
00:00:07,303 --> 00:00:09,126
That is definitely a consequence if you not

5
00:00:09,126 --> 00:00:11,267
wanna go to. That that sounds like literally

6
00:00:11,267 --> 00:00:13,669
a snake oil summit, but like, a

7
00:00:14,041 --> 00:00:14,200
no.

8
00:00:15,568 --> 00:00:17,086
I think it's gonna be relevant a lot

9
00:00:17,086 --> 00:00:18,604
of things. Could be fine.

10
00:00:19,403 --> 00:00:21,320
I would go there. It would just like

11
00:00:21,320 --> 00:00:23,567
a big coat and have, like, Gpus in

12
00:00:23,567 --> 00:00:25,718
my jacket. Be like, hey. You your it.

13
00:00:26,037 --> 00:00:27,311
Alright. You let that here.

14
00:00:28,506 --> 00:00:31,948
Some graphics guys. Jack creepy quickly. Hey. They

15
00:00:31,948 --> 00:00:34,022
need Gpus? It's like a big deal. Why

16
00:00:34,022 --> 00:00:36,177
do you think Nvidia is the first 3000000000000

17
00:00:36,177 --> 00:00:38,810
dollar company. Alright? It's not because the Fortnite.

18
00:00:39,784 --> 00:00:41,622
I need Gpus you don't sell there, You

19
00:00:41,622 --> 00:00:43,220
can bring to a crypto conference with you.

20
00:00:43,460 --> 00:00:45,777
Yeah. Exactly. Exactly. I got a crypto conference

21
00:00:45,777 --> 00:00:47,216
next week. You better get these water hot,

22
00:00:47,456 --> 00:00:48,495
man. These single fresh.

23
00:00:49,149 --> 00:00:51,310
I got something better than Gpus. I got

24
00:00:51,310 --> 00:00:54,190
long lived static access key pairs for Aws.

25
00:00:55,310 --> 00:00:57,070
There you go. I got someone else's credit

26
00:00:57,070 --> 00:00:58,109
card. That's what he just said.

27
00:00:59,718 --> 00:01:02,742
Yeah. Brian, Brian says no Corey or John

28
00:01:02,742 --> 00:01:03,220
this week.

29
00:01:04,970 --> 00:01:06,736
And we didn't let him in. What, it's

30
00:01:06,896 --> 00:01:09,443
Johnny. Yeah. John is here. No. He's not

31
00:01:09,443 --> 00:01:10,477
in. He's not in rest stream.

32
00:01:11,273 --> 00:01:13,820
He's too slow. He's around today. So... I

33
00:01:13,900 --> 00:01:15,333
I think he's always around. Does that make

34
00:01:15,333 --> 00:01:15,833
sense

35
00:01:16,621 --> 00:01:18,451
he's I think he just trying to get

36
00:01:18,451 --> 00:01:18,531
in.

37
00:01:19,486 --> 00:01:20,679
Do we have dropped gp?

38
00:01:21,793 --> 00:01:22,293
Gp.

39
00:01:23,559 --> 00:01:25,785
Yeah. Try shredded the Gp. That's what I

40
00:01:25,785 --> 00:01:28,171
was stranger. It gets pretty creepy all of

41
00:01:28,171 --> 00:01:29,682
the rage without the personality.

42
00:01:30,557 --> 00:01:32,783
And and just. It sounds so much like

43
00:01:32,783 --> 00:01:33,260
and also.

44
00:01:34,234 --> 00:01:36,474
I I actually listened to this podcast for

45
00:01:36,474 --> 00:01:38,554
the first time this week. Oh, yeah.

46
00:01:39,194 --> 00:01:39,515
You sound?

47
00:01:40,155 --> 00:01:41,754
I sounded okay, but we sound like a

48
00:01:41,754 --> 00:01:44,247
bunch of Luna studio it's crazy like I

49
00:01:44,247 --> 00:01:46,245
was like, oh my god. Well, you you've

50
00:01:46,245 --> 00:01:48,722
only just realized this. Yeah. I've never... I

51
00:01:48,722 --> 00:01:51,770
don't listen to myself. Right? Like, we're going

52
00:01:51,770 --> 00:01:53,279
straight hard into ice cream. I'm like, man.

53
00:01:53,517 --> 00:01:55,821
I just need to, like, stop talking. Maybe...

54
00:01:57,727 --> 00:01:59,180
This is what. I'll

55
00:01:59,649 --> 00:02:01,083
I can bring the button down shirts and

56
00:02:01,083 --> 00:02:03,154
add Pat fatima of respect ability to go

57
00:02:03,154 --> 00:02:04,509
along with Kelly's professionalism.

58
00:02:05,226 --> 00:02:06,660
Beyond that yet. We're all screwed. We're not

59
00:02:06,660 --> 00:02:08,572
going to button down shirts. We're going tin

60
00:02:08,572 --> 00:02:10,417
foil hat. We go to the opposite direction.

61
00:02:10,655 --> 00:02:13,620
Oh, gosh. Oh my god. It's funny. Wicked

62
00:02:14,393 --> 00:02:16,381
we sometimes do deep dives, but mostly we

63
00:02:16,381 --> 00:02:17,255
just do hot.

64
00:02:19,497 --> 00:02:21,166
My shirt has 2 2 buttons.

65
00:02:21,881 --> 00:02:24,663
2 whole buttons. 2 whole buttons. Gotta be

66
00:02:24,663 --> 00:02:26,411
button? 1 of them is not button.

67
00:02:26,983 --> 00:02:29,049
Oh, what are the good thing? Got... We

68
00:02:29,049 --> 00:02:30,161
got them we got them wearing a month

69
00:02:30,161 --> 00:02:31,830
out from Hacker Summer camp.

70
00:02:32,704 --> 00:02:35,030
Mh A month out. Counting down. You got

71
00:02:35,030 --> 00:02:37,590
a little calendar like do. This is probably

72
00:02:37,590 --> 00:02:38,949
gonna be the, like, Def com, which is

73
00:02:38,949 --> 00:02:40,870
also kinda what. It's gonna be the last

74
00:02:40,870 --> 00:02:42,469
1 I go to for a long time

75
00:02:42,469 --> 00:02:43,270
to tell you the truth.

76
00:02:44,004 --> 00:02:45,224
Plaza? Babies

77
00:02:45,685 --> 00:02:48,004
babies. Kids most likely... You can bring them

78
00:02:48,004 --> 00:02:50,485
along. It's so much fun. I'm sure.

79
00:02:52,258 --> 00:02:55,198
It's gonna be a hundred and 16 degrees

80
00:02:55,198 --> 00:02:58,138
fahrenheit. That's in the f or fahrenheit stands

81
00:02:58,138 --> 00:03:00,142
for freedom units if you're... Not watching the

82
00:03:00,381 --> 00:03:02,535
Us but that I only understand Celsius for

83
00:03:02,535 --> 00:03:05,029
some weird reason. So hot. The car,

84
00:03:05,805 --> 00:03:08,118
started exploding last time. It was that hot

85
00:03:08,118 --> 00:03:10,526
during def con. Is it just hard start

86
00:03:10,526 --> 00:03:11,026
seen?

87
00:03:11,881 --> 00:03:14,512
Yeah. Oh my god. On the asphalt, it

88
00:03:14,512 --> 00:03:17,085
never gets cold, which means that the temperature

89
00:03:17,223 --> 00:03:18,260
increases through the week.

90
00:03:18,995 --> 00:03:19,495
Oh

91
00:03:20,594 --> 00:03:20,915
wow.

92
00:03:21,555 --> 00:03:23,555
See. See. I'll be I don't drive that.

93
00:03:23,715 --> 00:03:25,074
Are you are you are you going out,

94
00:03:25,235 --> 00:03:26,923
Ralph? Yeah. I'll be there. Be better there.

95
00:03:27,082 --> 00:03:28,354
Okay. Oh, yeah. You're aren't you giving a

96
00:03:28,354 --> 00:03:30,978
talk? Yeah. I'll be the Red team Village

97
00:03:30,978 --> 00:03:32,489
we're doing a huge workshop. It's gonna me

98
00:03:32,569 --> 00:03:35,131
Okay. Cool. Okay. I'll, nice. I'm I'm flying

99
00:03:35,131 --> 00:03:37,285
in Monday and leaving Monday. So it'll be

100
00:03:37,285 --> 00:03:38,880
a long week for me. Wow, that that's

101
00:03:38,880 --> 00:03:41,374
too much. I have, like, a great 4

102
00:03:41,433 --> 00:03:44,716
day biggest rule. This is... That's This is

103
00:03:44,716 --> 00:03:46,385
my last her off. Like, this is this

104
00:03:46,385 --> 00:03:48,929
is the last office of wade. Yeah. So

105
00:03:48,929 --> 00:03:52,029
he's retiring. I'm retiring after this entire. Wait.

106
00:03:53,301 --> 00:03:54,987
Wow I mean, what what do you think

107
00:03:54,987 --> 00:03:56,578
about children, man? I think this is terrifying.

108
00:03:56,816 --> 00:03:57,055
Yeah.

109
00:03:59,203 --> 00:04:02,226
Oh gosh. Wow so. You'll be back. In

110
00:04:02,226 --> 00:04:04,000
fine. I got I got free tickets to

111
00:04:04,000 --> 00:04:06,159
b sides Las vegas. So I was like,

112
00:04:06,319 --> 00:04:07,379
I have to go that...

113
00:04:07,919 --> 00:04:10,479
Yeah. And then I'll probably sneak into Black

114
00:04:10,479 --> 00:04:12,354
hat or something like that. And

115
00:04:13,373 --> 00:04:15,450
get my party passes and then go to

116
00:04:15,530 --> 00:04:15,849
Def on.

117
00:04:16,808 --> 00:04:18,326
Yes. You know we don't pay for black

118
00:04:18,326 --> 00:04:19,685
that. Like, that's that's too much.

119
00:04:20,578 --> 00:04:23,369
The pro year lanyard. Like, the the lanyard

120
00:04:23,369 --> 00:04:26,001
never changed. So stroke with any black ben

121
00:04:26,001 --> 00:04:28,075
ever. You think I've ever been ever. Like,

122
00:04:28,314 --> 00:04:30,244
I've never officially been to black hat. I've

123
00:04:30,244 --> 00:04:30,744
only.

124
00:04:32,402 --> 00:04:33,841
But the way. I mean I might know

125
00:04:33,841 --> 00:04:36,718
somebody that could loan you. Alright. Alright fairly

126
00:04:36,718 --> 00:04:38,416
weird me. Are you skin?

127
00:04:39,355 --> 00:04:41,525
Okay. I've never I've never been the swan

128
00:04:41,525 --> 00:04:43,202
guy. Like, right. I've never worn the hat

129
00:04:43,202 --> 00:04:44,639
in the nautical. I don't get to go

130
00:04:44,639 --> 00:04:46,315
to the fancy ones. So I definitely go

131
00:04:46,315 --> 00:04:47,911
to the vendor hall. It's gonna be everything

132
00:04:47,911 --> 00:04:49,598
you want in more I sneak in there,

133
00:04:49,678 --> 00:04:51,028
and you talk to the people who you

134
00:04:51,028 --> 00:04:52,775
know, like, okay. Gotta talk to that person

135
00:04:52,775 --> 00:04:54,521
to get to this party, and you go

136
00:04:54,521 --> 00:04:56,030
straight for them. You talk to them, get

137
00:04:56,030 --> 00:04:57,936
the party, get the shirt and you leave.

138
00:04:58,269 --> 00:04:59,546
And then you look around to see if

139
00:04:59,546 --> 00:05:01,461
anyone saw nobody cares. You just walk in

140
00:05:01,461 --> 00:05:03,535
backwards. Knowing 1 for some reason, it's like

141
00:05:03,535 --> 00:05:04,275
a mine

142
00:05:04,732 --> 00:05:05,371
a mind trick.

143
00:05:06,023 --> 00:05:08,648
Is it to go? Yeah. It's tough. Stevie

144
00:05:08,727 --> 00:05:09,761
1 let's go. Go.

145
00:05:24,391 --> 00:05:26,773
Welcome to Black Hills information Security talking about

146
00:05:26,773 --> 00:05:28,838
the news. I'm your host today, Ralph May

147
00:05:28,838 --> 00:05:31,142
because John And both didn't it make it

148
00:05:31,142 --> 00:05:33,545
in weirdly enough. But the reason why is

149
00:05:33,545 --> 00:05:36,417
because I'm joined with a monster cast, and

150
00:05:36,417 --> 00:05:38,012
we have filled up the entire screen.

151
00:05:41,043 --> 00:05:41,681
Yes, we have.

152
00:05:42,254 --> 00:05:42,814
Yes. We have.

153
00:05:43,615 --> 00:05:45,134
We were gonna crash rest stream.

154
00:05:46,014 --> 00:05:47,214
Yeah. I don't I don't think I think...

155
00:05:47,375 --> 00:05:49,134
That's why they have a limit. Right? So

156
00:05:49,134 --> 00:05:52,910
yeah. I am joined by Charles Sean Michael

157
00:05:53,069 --> 00:05:55,069
Allen, who doesn't join that often. Welcome. Thank

158
00:05:55,069 --> 00:05:58,590
you. Thank you wade, waiting through logs, waiting

159
00:05:58,590 --> 00:06:01,903
wells, you know, the whole thing. Mike. Andrew,

160
00:06:02,358 --> 00:06:04,426
who also has join that much. I don't

161
00:06:04,426 --> 00:06:06,096
even know your name. It's it's a is

162
00:06:06,096 --> 00:06:07,289
a key. Ralph.

163
00:06:10,008 --> 00:06:11,440
It's doomed with you do. Doom.

164
00:06:12,394 --> 00:06:13,030
It's Pd doom.

165
00:06:13,905 --> 00:06:16,211
It's an Ai reference to when Ai is

166
00:06:16,211 --> 00:06:17,267
gonna be a catastrophic

167
00:06:17,642 --> 00:06:19,471
event with due to Ai.

168
00:06:20,122 --> 00:06:23,066
But you call me, Kelly Ralph. Oh, I

169
00:06:23,066 --> 00:06:24,418
knew... I knew I remember your name.

170
00:06:25,611 --> 00:06:26,645
I'll just get it now.

171
00:06:28,406 --> 00:06:30,707
Can I get Stevie Wonder? Yes. We have

172
00:06:30,865 --> 00:06:33,642
Stevie Wonder or Ryan a aka, making us

173
00:06:33,642 --> 00:06:35,961
look pretty Sound good, you know, bringing us

174
00:06:35,961 --> 00:06:37,874
into focus, and then, finally,

175
00:06:38,431 --> 00:06:40,742
alex. If you're told... Never told us why

176
00:06:40,742 --> 00:06:41,640
you were in the sunglasses.

177
00:06:42,256 --> 00:06:44,980
Okay. Yes. Yeah. I'm wearing sunglasses for those

178
00:06:44,980 --> 00:06:46,892
who can't see the video, and

179
00:06:47,848 --> 00:06:49,203
it's because I have a little bit of

180
00:06:49,203 --> 00:06:49,841
a Psa.

181
00:06:50,415 --> 00:06:51,634
The Psa is

182
00:06:52,175 --> 00:06:53,455
if you... Have glasses,

183
00:06:54,254 --> 00:06:56,435
don't leave in your car because

184
00:06:57,785 --> 00:06:58,577
how they heat.

185
00:06:59,766 --> 00:07:01,906
The high ass heat that we've been having

186
00:07:01,906 --> 00:07:02,223
lately.

187
00:07:03,095 --> 00:07:04,546
Know cooked my glasses

188
00:07:04,935 --> 00:07:07,175
and it, like, melts on them mall, and

189
00:07:07,254 --> 00:07:08,854
I couldn't see anything out of them after

190
00:07:08,935 --> 00:07:10,774
I got my glasses out of my car.

191
00:07:11,175 --> 00:07:13,586
So now I'm stuck with my my sunglasses,

192
00:07:13,746 --> 00:07:15,521
which are prescription sunglasses.

193
00:07:16,295 --> 00:07:17,491
So it's the only thing I have right

194
00:07:17,491 --> 00:07:20,120
now. So, yeah, I look like Stevie Wonder

195
00:07:20,120 --> 00:07:22,351
or Ray Charles or blue Blues Brothers.

196
00:07:23,245 --> 00:07:25,245
It doesn't deal with it meme? Or deal

197
00:07:25,245 --> 00:07:27,725
with it mean? Or deal with it. Wow.

198
00:07:28,045 --> 00:07:30,125
Well, I I can't imagine how hot it

199
00:07:30,125 --> 00:07:31,899
must have been in your car milk glass.

200
00:07:32,139 --> 00:07:34,699
Right? Like, how is your dashboard The the

201
00:07:34,699 --> 00:07:36,699
car itself is fine. I was wondering about

202
00:07:36,699 --> 00:07:38,860
that. Like, wow... That's good thing that they

203
00:07:38,860 --> 00:07:41,443
test cars and, like the Sahara or whatever

204
00:07:41,817 --> 00:07:44,043
for this crap, but they don't do that

205
00:07:44,043 --> 00:07:45,553
to to glasses apparently.

206
00:07:46,030 --> 00:07:47,937
Oh, my gosh. That's pretty wild.

207
00:07:48,509 --> 00:07:50,423
So look at it Ryan that it's so

208
00:07:50,423 --> 00:07:50,583
hot.

209
00:07:51,460 --> 00:07:54,092
In Orlando, but I went... We went out

210
00:07:54,092 --> 00:07:56,166
for the holiday weekend. I was in a

211
00:07:56,724 --> 00:07:58,240
right outside New Summer smyrna Beach.

212
00:07:59,134 --> 00:08:01,454
And it's just the the car was in

213
00:08:01,454 --> 00:08:03,214
the sun direct sun and it was just

214
00:08:03,214 --> 00:08:04,814
the, you know, it gets a lot hotter

215
00:08:04,814 --> 00:08:06,334
in the car than it does outside.

216
00:08:07,069 --> 00:08:09,779
Well yeah. I think. Cooked down 40 40

217
00:08:09,779 --> 00:08:12,409
degrees. Hotter in cars? You think something like

218
00:08:12,409 --> 00:08:14,721
that? Wow. That sounds reasonable oh, yeah.

219
00:08:16,653 --> 00:08:18,272
So nothing happened

220
00:08:18,651 --> 00:08:20,569
last week, and we're good to go. So

221
00:08:20,569 --> 00:08:22,887
we're just gonna talk about cars in classes.

222
00:08:23,446 --> 00:08:24,485
That'll get that whole.

223
00:08:25,456 --> 00:08:26,888
No. I'm just kidding, obviously, But do you

224
00:08:26,888 --> 00:08:28,399
I wanna talk about first, we had a

225
00:08:28,399 --> 00:08:30,466
couple that people wanna talk about. Weirdly, I

226
00:08:30,466 --> 00:08:32,852
wanna talk about that Ss open Ssh that

227
00:08:32,852 --> 00:08:34,453
we've already about so I'm just. You could

228
00:08:34,453 --> 00:08:35,642
talk talk about but just talk about. What

229
00:08:35,642 --> 00:08:36,593
do you what you what you wanna set?

230
00:08:36,751 --> 00:08:38,336
I... No It's already been said, So it

231
00:08:38,336 --> 00:08:40,529
doesn't matter. Right. We can talk about about

232
00:08:41,930 --> 00:08:43,129
I guess Talk about the,

233
00:08:43,690 --> 00:08:45,149
Europe pool taking down

234
00:08:45,529 --> 00:08:48,250
500 and Yes. Id 3 Cool. Right servers.

235
00:08:48,904 --> 00:08:49,064
Right?

236
00:08:49,943 --> 00:08:51,222
I guess they took down a bunch of

237
00:08:51,222 --> 00:08:52,980
servers. It was kind of like, an orchestrated

238
00:08:52,980 --> 00:08:55,537
attack on older unlicensed versions of cobalt strike

239
00:08:55,537 --> 00:08:57,235
used for red teams. Dude they're.

240
00:08:57,789 --> 00:08:59,464
I guess they took down supposedly according to

241
00:08:59,464 --> 00:09:00,900
this article, 690

242
00:09:01,139 --> 00:09:03,532
Ip addresses were flagged from 27 different countries.

243
00:09:03,691 --> 00:09:05,286
And I'm not exactly sure how they took

244
00:09:05,286 --> 00:09:07,461
them down. Maybe they went to the

245
00:09:07,933 --> 00:09:09,629
server owners or

246
00:09:10,325 --> 00:09:12,239
what it may be to actually, to take

247
00:09:12,239 --> 00:09:12,877
these offline.

248
00:09:13,913 --> 00:09:14,711
Operation Morph.

249
00:09:15,269 --> 00:09:15,428
Yeah.

250
00:09:17,593 --> 00:09:18,548
That's some good ones, lately.

251
00:09:19,502 --> 00:09:21,966
Yeah. So what do you think this is

252
00:09:21,966 --> 00:09:24,511
going to help? Right? Like... Yeah. So supposedly

253
00:09:24,511 --> 00:09:26,536
these... Couple strike servers are being used for

254
00:09:26,752 --> 00:09:29,057
malicious, you know, malicious Not actors are using

255
00:09:29,136 --> 00:09:31,203
Cobalt strike. But then I'm like, well, you

256
00:09:31,203 --> 00:09:33,528
have a hoo target who's still using C...

257
00:09:33,688 --> 00:09:36,244
Or Cobalt Strike is not getting detected. And

258
00:09:36,244 --> 00:09:38,321
then, you know, just taking all these offline

259
00:09:38,321 --> 00:09:40,893
help and who doesn't help. Well, and and

260
00:09:40,893 --> 00:09:42,512
how long before those same

261
00:09:42,891 --> 00:09:44,649
same ones are just finding new server?

262
00:09:45,288 --> 00:09:47,206
Yeah. Yeah. I am confused about how they

263
00:09:47,206 --> 00:09:49,057
took them offline. It it might have a

264
00:09:49,057 --> 00:09:50,808
nugget of information in there? Like, did they

265
00:09:50,808 --> 00:09:53,935
go to the, like, cloud provider Or what

266
00:09:54,311 --> 00:09:56,142
You gotta click on the the actual...

267
00:09:56,794 --> 00:09:58,794
Like the link inside the article to go

268
00:09:58,794 --> 00:09:59,294
to

269
00:09:59,674 --> 00:10:00,735
the national Crime

270
00:10:01,274 --> 00:10:03,034
agency of Gov. They have a couple more

271
00:10:03,034 --> 00:10:05,126
juicy tidbits, but not a lot. Using a

272
00:10:05,126 --> 00:10:07,671
platform on a they used mist. Private sector

273
00:10:07,671 --> 00:10:08,148
and

274
00:10:08,705 --> 00:10:11,012
cyber criminals, the put out. We know about

275
00:10:11,012 --> 00:10:13,487
that. Mh. The numbers are... The numbers are

276
00:10:13,487 --> 00:10:15,311
impressive. Right? 690

277
00:10:15,311 --> 00:10:16,104
individual instances,

278
00:10:17,055 --> 00:10:18,958
spread out cost a hundred and 29.

279
00:10:19,609 --> 00:10:22,485
Different Internet service providers in 27 countries.

280
00:10:23,364 --> 00:10:24,802
So did the... Do we think that use

281
00:10:24,802 --> 00:10:25,840
show 5 these?

282
00:10:27,606 --> 00:10:27,765
Yes.

283
00:10:28,559 --> 00:10:30,544
Strictly. No. It actually said they used a

284
00:10:30,544 --> 00:10:32,212
couple different private companies,

285
00:10:32,767 --> 00:10:35,070
like work together to, kind of create indicators

286
00:10:35,070 --> 00:10:35,547
to compromise.

287
00:10:36,039 --> 00:10:37,392
There's a bunch of little ways to to

288
00:10:37,392 --> 00:10:39,224
tell that a Cobalt strike servers out there,

289
00:10:39,463 --> 00:10:42,170
especially you haven't done any, like, due diligence

290
00:10:42,170 --> 00:10:43,922
on, you know, masking the

291
00:10:44,892 --> 00:10:46,642
the Java Ssl and other things like that.

292
00:10:46,802 --> 00:10:48,415
So there's a little little indicators

293
00:10:48,870 --> 00:10:51,040
if you haven't done your homework, But

294
00:10:51,908 --> 00:10:53,104
I'm just not sure how they actually, like

295
00:10:53,104 --> 00:10:55,494
turned it all. Right? It took 3 years

296
00:10:55,494 --> 00:10:56,393
to do this

297
00:10:56,769 --> 00:10:59,081
to get. Yeah. It's 690 servers.

298
00:10:59,653 --> 00:11:01,008
They're were all run at the next day

299
00:11:01,008 --> 00:11:01,746
bravo O.

300
00:11:03,318 --> 00:11:05,628
I think, Andrew, the delay wasn't the the

301
00:11:05,628 --> 00:11:08,789
technical aptitude. It was getting it into courts

302
00:11:09,069 --> 00:11:10,984
and getting a hearing and getting the orders.

303
00:11:11,224 --> 00:11:13,458
It's usually the Department of Justice that takes

304
00:11:13,458 --> 00:11:15,793
the most amount of time, not the technical

305
00:11:16,331 --> 00:11:17,383
implementation of it. Sure.

306
00:11:18,261 --> 00:11:20,414
And maybe 3 years, like, from the time

307
00:11:20,414 --> 00:11:22,887
they identified the Ip addresses to the time

308
00:11:22,887 --> 00:11:24,801
that those servers were taken down. Is that

309
00:11:24,801 --> 00:11:26,338
right? Is that's

310
00:11:27,128 --> 00:11:27,287
like,

311
00:11:28,082 --> 00:11:29,832
that's really terrible. Actually

312
00:11:30,388 --> 00:11:32,535
I mean, they... You know, those actors kept

313
00:11:32,535 --> 00:11:34,761
doing actions for 3 whole year. Yeah. That

314
00:11:34,761 --> 00:11:35,954
that's what I was gonna say. Like, if...

315
00:11:36,033 --> 00:11:37,961
If a Cobalt strike server was alive for

316
00:11:37,961 --> 00:11:40,834
3 years. That's that's some... That's a long

317
00:11:40,834 --> 00:11:44,026
time. That's some good. That's like, increasing all

318
00:11:44,026 --> 00:11:44,585
of the

319
00:11:45,078 --> 00:11:47,463
dwell timed ratios for every single security port

320
00:11:47,463 --> 00:11:50,006
out there, like, they're all completely false. Well

321
00:11:50,006 --> 00:11:50,983
timed. It's just

322
00:11:51,596 --> 00:11:53,584
we're doing horrible as a security community.

323
00:11:54,394 --> 00:11:56,940
Mean... I don't think honestly, this feels like

324
00:11:56,940 --> 00:11:59,827
they didn't release a lot of information, probably

325
00:11:59,964 --> 00:12:01,476
because they don't want us to know how

326
00:12:01,476 --> 00:12:03,329
they did. Right? But I also

327
00:12:03,799 --> 00:12:06,277
Good. Oh, it might be legal proceedings and

328
00:12:06,277 --> 00:12:08,275
and things that they can't release just yet.

329
00:12:08,674 --> 00:12:10,273
Definitely. And it it goes through all, like,

330
00:12:10,353 --> 00:12:12,431
the big government agencies who all helped out.

331
00:12:12,590 --> 00:12:14,835
Right? Like, pretty much it all the big

332
00:12:14,835 --> 00:12:17,455
boys just knocking on doors. 26 countries, like,

333
00:12:17,614 --> 00:12:19,361
I'm looking way over here because my screen

334
00:12:19,361 --> 00:12:22,640
is huge. That's why. But 27 countries

335
00:12:23,508 --> 00:12:23,986
Flex. Yeah.

336
00:12:25,900 --> 00:12:28,054
27 countries they do list all, like, the

337
00:12:28,054 --> 00:12:30,446
cool people who helped, like, Bay systems, T,

338
00:12:30,686 --> 00:12:32,440
shadow servers, Spam House, Bc.

339
00:12:33,013 --> 00:12:35,001
And then the 1 tool that they talk

340
00:12:35,001 --> 00:12:37,785
about they used is miss. Right? Like, and

341
00:12:37,785 --> 00:12:40,423
that's the open source, the malware. Permission sharing

342
00:12:40,423 --> 00:12:41,850
platform, which I find kind of funny. That's

343
00:12:41,850 --> 00:12:43,752
the only thing they really mentioned, which is

344
00:12:43,752 --> 00:12:46,131
okay. You guys shared Io c's. Great. Good

345
00:12:46,131 --> 00:12:47,265
job. But

346
00:12:47,733 --> 00:12:49,726
A lot of the times, don't they track

347
00:12:49,726 --> 00:12:51,719
these via just like packet signatures and stuff

348
00:12:51,719 --> 00:12:54,429
like that. Like, they're able... There's some malfunction

349
00:12:54,429 --> 00:12:57,157
formed or some data. That they're able to

350
00:12:57,157 --> 00:12:59,554
actually fingerprint it and not just scanning the

351
00:12:59,554 --> 00:13:00,193
server itself.

352
00:13:00,832 --> 00:13:03,638
Does anybody anybody question that I think Cobalt...

353
00:13:03,877 --> 00:13:05,092
I mean, cobalt strikes

354
00:13:05,545 --> 00:13:06,681
pretty easy to

355
00:13:07,849 --> 00:13:10,948
like, pretty reasonably easy to find the architect.

356
00:13:11,599 --> 00:13:13,432
Yeah. There are there a bunch of different

357
00:13:13,432 --> 00:13:14,945
methods that you could use to detect levels

358
00:13:15,025 --> 00:13:15,184
Strike.

359
00:13:15,981 --> 00:13:18,154
If if you're not aware of those methods

360
00:13:18,292 --> 00:13:20,450
or how... To defend against them, then a

361
00:13:20,450 --> 00:13:21,878
lot of those defaults are kind of enabled,

362
00:13:22,115 --> 00:13:23,939
and you can look for them. Another thing

363
00:13:23,939 --> 00:13:25,922
they might be doing too is, like, getting

364
00:13:25,922 --> 00:13:27,602
indicators of compromises to from other systems and

365
00:13:27,602 --> 00:13:29,506
then associating that with the, actual,

366
00:13:30,220 --> 00:13:31,727
Ip address that or the target that is

367
00:13:31,727 --> 00:13:33,789
going to. Not using proxies, all these other

368
00:13:33,789 --> 00:13:36,028
fun stuff. I mean, there were compromised or

369
00:13:36,028 --> 00:13:38,413
not compromised, but, they were, like, stolen keys

370
00:13:38,413 --> 00:13:41,196
or hacked versions of Cobalt strike anyways. So,

371
00:13:41,355 --> 00:13:42,945
you know, their security is probably relaxed.

372
00:13:43,756 --> 00:13:45,188
Yeah. I'm just wrapping my head around like

373
00:13:45,188 --> 00:13:48,051
that, the the naming convention sometimes of morph

374
00:13:48,051 --> 00:13:48,529
and it's, like,

375
00:13:49,563 --> 00:13:51,074
why did they choose that name And and

376
00:13:51,074 --> 00:13:52,919
that might be, like, It but it it

377
00:13:52,919 --> 00:13:55,726
might be, like, a hint for, like, why

378
00:13:56,101 --> 00:13:57,692
or how they they shut these things down?

379
00:13:57,851 --> 00:14:01,049
Because I'm remembering, like, no. Morph with giving

380
00:14:01,049 --> 00:14:02,960
the, not red bill pill blue pill,

381
00:14:03,996 --> 00:14:06,305
then they can lock on to Neo and

382
00:14:06,305 --> 00:14:07,832
pop them out of the matrix. So

383
00:14:08,548 --> 00:14:09,581
Maybe that's the type of thing with the

384
00:14:09,661 --> 00:14:11,410
Cobalt strikes is that it's a similar thing.

385
00:14:13,001 --> 00:14:15,784
You know, we're identifying those cracked versions and

386
00:14:15,784 --> 00:14:17,318
only those cracked versions

387
00:14:17,627 --> 00:14:19,453
locking on them popping them out of matrix

388
00:14:19,453 --> 00:14:22,072
and take them down. So I order if

389
00:14:22,072 --> 00:14:23,897
tony's are sort of, like, yeah. Let me

390
00:14:23,897 --> 00:14:25,582
sure Morph, like, just pick a random name

391
00:14:25,582 --> 00:14:27,255
out of a hat, but sometimes there's a

392
00:14:27,255 --> 00:14:29,168
little bit of a the nuances. They're a

393
00:14:29,168 --> 00:14:31,160
little tip of the hat for... Yeah. We

394
00:14:31,160 --> 00:14:33,327
named it this for a reason. Pick That's

395
00:14:33,327 --> 00:14:35,635
a lot of credit. They probably s chat

396
00:14:35,795 --> 00:14:38,024
Gp, what to call their operation 3 years

397
00:14:38,024 --> 00:14:40,492
ago. Yeah. That's what chad Gp 2 spin

398
00:14:40,492 --> 00:14:41,624
out. That would... Yeah.

399
00:14:43,301 --> 00:14:45,218
Me the chat cheap t 4 would have

400
00:14:45,218 --> 00:14:46,976
been much better title. Much better. We didn't

401
00:14:46,976 --> 00:14:48,827
thought it that long. Yeah This does look

402
00:14:48,827 --> 00:14:50,822
like Isp take downs, though, from the description.

403
00:14:50,981 --> 00:14:53,375
It says for you it's between law enforcement

404
00:14:53,375 --> 00:14:55,050
and private partners, and what that tells me,

405
00:14:55,623 --> 00:14:58,029
that it was probably Isp little black hole

406
00:14:58,403 --> 00:15:01,025
and not just some kind of sophisticated take

407
00:15:01,025 --> 00:15:03,884
down. Yeah. They should have went to everyone's

408
00:15:03,884 --> 00:15:06,443
house assuming they found out. Really like that

409
00:15:06,443 --> 00:15:09,228
your virtual command host. Are we having a

410
00:15:09,228 --> 00:15:10,581
virtual command host right now?

411
00:15:12,889 --> 00:15:13,127
Yes.

412
00:15:13,764 --> 00:15:14,241
Absolutely.

413
00:15:14,975 --> 00:15:15,534
News command.

414
00:15:16,254 --> 00:15:17,294
Yes. News command.

415
00:15:18,254 --> 00:15:19,774
Do you guys wanna talk about the Clickbait

416
00:15:19,774 --> 00:15:21,615
article, at least, I think it's clickbait, but

417
00:15:21,934 --> 00:15:24,743
the Ro 20 24 is out. Everyone go

418
00:15:24,743 --> 00:15:26,754
change your passwords that can compromise

419
00:15:27,367 --> 00:15:27,526
today.

420
00:15:28,322 --> 00:15:30,707
Oh, else has... Wait. What... Has anybody on

421
00:15:30,707 --> 00:15:31,764
this call downloaded?

422
00:15:32,154 --> 00:15:34,315
The Rock 20 24 list I have it.

423
00:15:34,554 --> 00:15:36,794
Yeah. Okay. Yeah. Because I downloaded it earlier

424
00:15:36,794 --> 00:15:38,394
too. And so I wanted to get anybody

425
00:15:38,394 --> 00:15:39,754
else's take on it. My take on it

426
00:15:39,754 --> 00:15:41,444
is, like, I saw a couple of the

427
00:15:41,444 --> 00:15:43,911
headlines about it this morning, and Zach ping

428
00:15:43,911 --> 00:15:46,697
us about it, all the anti sip instructors

429
00:15:46,697 --> 00:15:47,732
to see if somebody wanted to do a

430
00:15:47,732 --> 00:15:49,085
video about it. So I looked into it

431
00:15:49,085 --> 00:15:49,563
a little bit.

432
00:15:50,532 --> 00:15:52,520
And all... Like, All, all I'm seeing from

433
00:15:52,520 --> 00:15:54,770
the headlines and stuff is, you know, there's

434
00:15:54,906 --> 00:15:55,724
10000000000

435
00:15:56,019 --> 00:15:58,087
passwords and everything out there, and and some

436
00:15:58,087 --> 00:15:59,757
of the new stories I was saying said,

437
00:16:00,249 --> 00:16:02,629
a bunch more data was in there. But

438
00:16:02,629 --> 00:16:04,693
actually looking into the file after downloading it,

439
00:16:05,089 --> 00:16:07,073
it's a bunch of junk from what I've...

440
00:16:07,232 --> 00:16:09,234
What from what I've seen personally, Mean, yeah,

441
00:16:09,314 --> 00:16:11,471
there's probably some passwords in there, but it's

442
00:16:11,471 --> 00:16:14,508
not like credential pairs or anything like that,

443
00:16:14,828 --> 00:16:16,506
but, you know, everybody seems to be all

444
00:16:16,506 --> 00:16:17,545
kinda up in arms about.

445
00:16:18,198 --> 00:16:20,194
In the... The articles I've seen. I really

446
00:16:20,194 --> 00:16:21,790
feel like this is exactly the wording the

447
00:16:21,790 --> 00:16:22,908
word lizzie, basically?

448
00:16:23,466 --> 00:16:25,882
Yeah. It it... Like, it's a terrible artist

449
00:16:25,941 --> 00:16:28,426
actually. Yeah. It just it just makes me

450
00:16:28,426 --> 00:16:30,975
think of 2 things. It's gonna make Colleague...

451
00:16:31,294 --> 00:16:32,329
I I don't know what the size of

452
00:16:32,329 --> 00:16:33,843
it is, but it's gonna make Ka a

453
00:16:33,843 --> 00:16:35,755
lot larger now. If it's if it's...

454
00:16:39,428 --> 00:16:39,928
50

455
00:16:44,534 --> 00:16:46,948
of that, it's gonna... With people are teaching

456
00:16:47,326 --> 00:16:48,043
cybersecurity classes,

457
00:16:48,681 --> 00:16:49,341
it's gonna

458
00:16:49,798 --> 00:16:52,031
john and and hash are gonna take a

459
00:16:52,031 --> 00:16:53,786
lot longer to run now. Yeah.

460
00:16:54,678 --> 00:16:56,994
Kidding. But I I did download it. It's

461
00:16:57,712 --> 00:16:59,868
like 40 50 gigs. Un compress. It's a

462
00:16:59,868 --> 00:17:02,183
hundred and 50 k... Or 40, 50 gigs

463
00:17:02,183 --> 00:17:04,194
compress. A hundred and 50 un compress. Yep.

464
00:17:04,913 --> 00:17:05,872
Was it just

465
00:17:06,352 --> 00:17:08,589
password list? Right? I mean, I'm assuming you

466
00:17:08,589 --> 00:17:10,747
opened it up and, Yeah. Yeah. So I

467
00:17:10,747 --> 00:17:14,355
did some basic searches through it. And it

468
00:17:14,355 --> 00:17:14,855
was

469
00:17:15,551 --> 00:17:18,262
like, a list of, you know, passwords as

470
00:17:18,262 --> 00:17:19,776
usual, and then there'd be a a ton

471
00:17:19,776 --> 00:17:22,418
of hash in there, mixed in with email

472
00:17:22,418 --> 00:17:24,003
addresses and other things, But it it was

473
00:17:24,003 --> 00:17:26,247
there's it was not any kind of formatting

474
00:17:26,460 --> 00:17:27,728
where it's, you know, you're gonna be able

475
00:17:27,728 --> 00:17:30,048
to research it to someone's if password or

476
00:17:30,048 --> 00:17:30,367
whatever.

477
00:17:31,644 --> 00:17:34,538
Yeah. No. So, I was gonna say we've

478
00:17:34,676 --> 00:17:36,273
compiled lists, and I know corey is probably,

479
00:17:36,352 --> 00:17:38,918
like, burning right now. With the database that

480
00:17:38,918 --> 00:17:41,068
we have just like, the passwords. Right? And

481
00:17:41,068 --> 00:17:42,421
you d the whole list, and then we

482
00:17:42,421 --> 00:17:44,969
use that on, you know, a path for

483
00:17:45,207 --> 00:17:46,338
a pass crap tracking. Right?

484
00:17:47,135 --> 00:17:48,890
And and the list is not nearly a

485
00:17:48,890 --> 00:17:50,087
hundred and 50 gigs. Right?

486
00:17:50,804 --> 00:17:53,038
So, you know, I I imagined there had

487
00:17:53,038 --> 00:17:54,075
to been a lot of extra stuff in

488
00:17:54,075 --> 00:17:55,590
there than just passwords. Right?

489
00:17:56,404 --> 00:17:58,022
That had been from compromised

490
00:17:58,641 --> 00:18:01,358
breaches. So... Yeah. I mean, the virtual rock

491
00:18:01,358 --> 00:18:03,036
you had a lot of that also that...

492
00:18:04,250 --> 00:18:04,410
Yeah.

493
00:18:05,769 --> 00:18:08,170
Yeah. Yeah. There's usually a bunch of junk

494
00:18:08,170 --> 00:18:10,330
and any word list for sure. The reason

495
00:18:10,410 --> 00:18:12,170
I I kinda call it clickbait is this

496
00:18:12,170 --> 00:18:14,102
kind of like... What what is it highlighting

497
00:18:14,102 --> 00:18:15,379
here? Is there like, was there a new

498
00:18:15,379 --> 00:18:16,816
breach inside of here and it really wasn't.

499
00:18:16,976 --> 00:18:18,892
It's just somebody compile comp combining them all

500
00:18:18,892 --> 00:18:20,968
together into 1 big, you know, text file

501
00:18:20,968 --> 00:18:23,615
literally, a text file. Right? Which dare you

502
00:18:23,615 --> 00:18:25,763
to open up in Microsoft work or any

503
00:18:25,763 --> 00:18:28,310
other, you know, not notepad. No notepad. Please.

504
00:18:28,549 --> 00:18:30,061
Please try this and see what happens. Right?

505
00:18:30,713 --> 00:18:32,224
Yeah it it does highlight a couple of

506
00:18:32,224 --> 00:18:34,212
things, though that it... It's kind of buried

507
00:18:34,212 --> 00:18:35,643
at the at the end of the article

508
00:18:35,643 --> 00:18:36,995
where it says, like, hey, If if you

509
00:18:36,995 --> 00:18:38,450
don't reuse your passwords,

510
00:18:38,919 --> 00:18:40,532
and you don't use simple passwords,

511
00:18:41,305 --> 00:18:42,976
you don't have nothing to worry about. Also,

512
00:18:43,055 --> 00:18:44,964
if you use Mfa, you don't have anything

513
00:18:44,964 --> 00:18:46,893
to worry about. Well, that right there. It's

514
00:18:46,893 --> 00:18:49,530
like, 3 things to highlight. Like, check your

515
00:18:49,530 --> 00:18:50,509
environment for

516
00:18:50,968 --> 00:18:52,726
people that are using the same password for

517
00:18:52,726 --> 00:18:54,338
everything. They have a user account. They have

518
00:18:54,338 --> 00:18:56,327
an admin account. They have a domain admin

519
00:18:56,327 --> 00:18:56,487
account,

520
00:18:57,441 --> 00:18:59,112
check through, and you can get these indicators

521
00:18:59,112 --> 00:19:00,624
at saying, hey, by the way, this person

522
00:19:00,624 --> 00:19:02,454
is using the same password for all 3

523
00:19:02,454 --> 00:19:03,171
of those accounts.

524
00:19:03,824 --> 00:19:04,943
They have service counts,

525
00:19:05,502 --> 00:19:08,138
admin accounts, everything to just have this nasty

526
00:19:08,138 --> 00:19:10,536
habit. Of, reusing the same passwords locked that

527
00:19:10,536 --> 00:19:12,460
down. Like, that's... Then you don't, you know,

528
00:19:12,540 --> 00:19:13,809
then you don't have to worry about this.

529
00:19:14,126 --> 00:19:15,950
You know, or, you know, the complex passwords

530
00:19:15,950 --> 00:19:18,330
don't let people use the name of your

531
00:19:18,330 --> 00:19:19,282
company as a password.

532
00:19:19,854 --> 00:19:21,851
Don't and with some of these, you know

533
00:19:21,851 --> 00:19:23,470
practices, so it does highlight

534
00:19:24,168 --> 00:19:27,538
again, yeah. I'm mfa. Don't use it. Don't

535
00:19:27,538 --> 00:19:28,096
reuse passwords.

536
00:19:28,735 --> 00:19:30,250
You can do... You can... These are things

537
00:19:30,250 --> 00:19:31,845
that you can do something about so that

538
00:19:31,845 --> 00:19:34,158
when these articles do come come out. Yeah.

539
00:19:34,318 --> 00:19:35,275
You can look at them and say, it's

540
00:19:35,275 --> 00:19:37,085
a it's a nothing burger. It's a it's

541
00:19:37,204 --> 00:19:39,196
it's a bunch of, you know, it it's

542
00:19:39,196 --> 00:19:40,014
a bunch of

543
00:19:41,506 --> 00:19:42,462
you know, fun,

544
00:19:43,179 --> 00:19:45,091
effective. Yeah. Like, if you if you have

545
00:19:45,091 --> 00:19:47,098
put those practices in place, but unfortunately... A

546
00:19:47,098 --> 00:19:47,736
lot of companies.

547
00:19:48,294 --> 00:19:50,048
They don't have those practices in place. They

548
00:19:50,048 --> 00:19:50,925
allow simple passwords.

549
00:19:51,403 --> 00:19:53,716
Everybody's using the same password for all 5

550
00:19:53,716 --> 00:19:55,525
of their accounts at different privilege levels, currently

551
00:19:55,644 --> 00:19:57,470
and Mfa is something that they go, we

552
00:19:57,470 --> 00:20:00,249
can't turn Mfa on for whatever various business

553
00:20:00,249 --> 00:20:00,567
reasons.

554
00:20:01,123 --> 00:20:03,559
Yeah. It's it's kind of interesting because and

555
00:20:03,996 --> 00:20:05,502
the other thing in this is gonna get

556
00:20:05,582 --> 00:20:07,088
Corey going again too is,

557
00:20:07,723 --> 00:20:09,626
steele locks. Right? And that's actually kind of,

558
00:20:09,705 --> 00:20:11,133
like, the more up and coming way,

559
00:20:11,862 --> 00:20:12,362
of

560
00:20:12,737 --> 00:20:13,476
enterprise compromise,

561
00:20:13,851 --> 00:20:16,737
right, as opposed to just compromising a straight

562
00:20:16,794 --> 00:20:19,657
credential through a data breach of another organization.

563
00:20:19,816 --> 00:20:21,502
Right? I mean, there's a lot of that

564
00:20:21,502 --> 00:20:24,127
out there. And, those include session, you know,

565
00:20:24,365 --> 00:20:26,831
session tokens. Right, or, you know, Max for

566
00:20:26,831 --> 00:20:27,125
those

567
00:20:28,363 --> 00:20:28,763
services.

568
00:20:29,322 --> 00:20:31,080
So it... It's a little more advanced than

569
00:20:31,080 --> 00:20:31,640
just passwords.

570
00:20:32,279 --> 00:20:34,038
But, yeah, if you're not using 2 factor

571
00:20:34,038 --> 00:20:35,556
and all these other things that we probably

572
00:20:35,556 --> 00:20:36,835
harp it on many, many times,

573
00:20:37,725 --> 00:20:39,075
again, that's why I kinda feel like it's

574
00:20:39,075 --> 00:20:40,743
a little clickbait. But, yeah. And agreed on,

575
00:20:40,822 --> 00:20:43,046
like, the the info dealers, like, if a

576
00:20:43,046 --> 00:20:44,793
lot of blue team like myself, Like, you

577
00:20:44,793 --> 00:20:45,293
see

578
00:20:45,924 --> 00:20:48,644
the the masked version of those info dealer

579
00:20:48,644 --> 00:20:50,744
logs then it goes. This person got compromised,

580
00:20:51,284 --> 00:20:52,964
here are all the passwords, it shows only

581
00:20:52,964 --> 00:20:54,644
like, the first 3 letters of the password.

582
00:20:54,979 --> 00:20:56,490
But it's the same 3 letters, like, for

583
00:20:56,490 --> 00:20:58,400
everything you're, like, oh good grief. Like, it

584
00:20:58,400 --> 00:21:00,571
is clear... They're clearly using the same password

585
00:21:00,866 --> 00:21:00,946
everywhere.

586
00:21:01,742 --> 00:21:03,651
Including the 1 that, you know, when you

587
00:21:03,651 --> 00:21:05,569
buy it from an intel company, they will

588
00:21:05,569 --> 00:21:07,708
let you know the password for, you know,

589
00:21:07,866 --> 00:21:10,877
the user at, you know, BIS dot com.

590
00:21:11,289 --> 00:21:12,796
Yeah. They'll mask everything else. And you're like,

591
00:21:12,876 --> 00:21:15,177
oh. They're using the same password everywhere including

592
00:21:15,177 --> 00:21:16,844
in our environment. And you see those from

593
00:21:16,844 --> 00:21:18,510
the info dealer logs, how many of them

594
00:21:18,510 --> 00:21:19,566
are just the same

595
00:21:20,034 --> 00:21:22,111
you know, first 3 digits before it gets,

596
00:21:22,751 --> 00:21:25,307
masked out. I think the real clickbait article

597
00:21:25,307 --> 00:21:27,717
here would be to compare this dump. To

598
00:21:27,717 --> 00:21:30,263
the original Rock list and see what the

599
00:21:30,263 --> 00:21:32,411
the worst candidates are? Like, what are the

600
00:21:32,411 --> 00:21:34,971
worst trends from the original what are the

601
00:21:34,971 --> 00:21:36,243
worst trends from this 1 and let's see

602
00:21:36,243 --> 00:21:37,516
if they've actually changed.

603
00:21:38,549 --> 00:21:40,378
We... The answer is no.

604
00:21:41,492 --> 00:21:43,559
I'll I'll put together nice on all script

605
00:21:43,559 --> 00:21:46,046
to do that. Yes. What's... Yeah. Tell me

606
00:21:46,046 --> 00:21:48,042
all the difference between the original Rocky list

607
00:21:48,042 --> 00:21:49,000
and this, Like,

608
00:21:49,638 --> 00:21:51,714
I mean, I will The this list the

609
00:21:51,714 --> 00:21:53,311
passwords ending 24.

610
00:21:54,044 --> 00:21:55,711
That I heard that are, like, anything on

611
00:21:55,711 --> 00:21:58,092
the all the larger ones or hash from

612
00:21:58,092 --> 00:21:58,648
what I've read,

613
00:21:59,363 --> 00:22:01,268
Like, they're just random digits are not even

614
00:22:01,268 --> 00:22:01,506
password.

615
00:22:02,077 --> 00:22:04,144
Yeah. Also, throwing the hash and there kinda

616
00:22:04,144 --> 00:22:06,074
confuse me a little bit, especially if they're

617
00:22:06,210 --> 00:22:08,038
salted hash. I I didn't see which ones

618
00:22:08,038 --> 00:22:09,253
they have in there. So

619
00:22:09,563 --> 00:22:10,991
you know, kinda interesting.

620
00:22:13,134 --> 00:22:14,403
What else do you guys wanna talk about?

621
00:22:15,117 --> 00:22:16,307
Besides talking about passwords,

622
00:22:17,036 --> 00:22:18,463
Should we talk about ticket master?

623
00:22:19,177 --> 00:22:20,128
What do passwords?

624
00:22:20,604 --> 00:22:23,165
They're a great company, and I enjoy their

625
00:22:23,458 --> 00:22:24,275
the value

626
00:22:24,663 --> 00:22:27,683
that structure pairs do the do the hack

627
00:22:27,683 --> 00:22:29,511
red, like, the article I just sent in

628
00:22:29,511 --> 00:22:32,293
there. Right? It actually is pretty well formatted.

629
00:22:32,531 --> 00:22:33,167
It has, like,

630
00:22:33,977 --> 00:22:36,442
straight to the facts. So so did they

631
00:22:36,442 --> 00:22:36,942
hack

632
00:22:37,397 --> 00:22:39,862
Taylor Swift tickets? So so the are... So

633
00:22:39,862 --> 00:22:41,850
they the argument is that they hack them.

634
00:22:42,168 --> 00:22:44,644
Right, shiny hunters are so hot right now.

635
00:22:45,358 --> 00:22:48,052
I will admit, got into ticket master and

636
00:22:48,211 --> 00:22:50,668
Immediately x filled a large amount of data,

637
00:22:50,906 --> 00:22:54,940
2 that they believed was valued at 22000000000

638
00:22:55,720 --> 00:22:57,080
dollars. So originally,

639
00:22:58,693 --> 00:22:59,810
S hunters actually said,

640
00:23:00,768 --> 00:23:03,321
live nation who owns Ticket master what was

641
00:23:03,321 --> 00:23:05,476
actually gonna pay a 1000000 dollar ransom to

642
00:23:05,476 --> 00:23:05,955
keep quiet.

643
00:23:06,688 --> 00:23:08,922
Right off the bat. But then once shiny

644
00:23:08,922 --> 00:23:09,901
hunters realized

645
00:23:10,358 --> 00:23:13,310
that they actually had Taylor swift ticket data,

646
00:23:14,124 --> 00:23:16,761
they increased the they increased the ransom to

647
00:23:16,761 --> 00:23:19,419
8000000 dollars. The Right. But they

648
00:23:19,798 --> 00:23:21,716
increase the ransom. What they did was they

649
00:23:21,716 --> 00:23:23,809
applied a 7000000 dollar processing fee.

650
00:23:26,690 --> 00:23:26,929
Yeah.

651
00:23:27,650 --> 00:23:28,609
Not a reversal.

652
00:23:29,329 --> 00:23:30,609
So if you go a little bit down

653
00:23:30,609 --> 00:23:32,529
further, they they talk about the data at

654
00:23:32,529 --> 00:23:34,539
risk great. 980000000

655
00:23:34,539 --> 00:23:37,969
sales orders, 600000000 order details, 1200000000.0

656
00:23:37,969 --> 00:23:39,085
party lookup records.

657
00:23:39,723 --> 00:23:41,181
440000000

658
00:23:41,319 --> 00:23:43,884
unique email addresses, bunch of others. It keeps

659
00:23:43,884 --> 00:23:44,123
going.

660
00:23:44,760 --> 00:23:47,148
So they disclosed the decent amount information, but

661
00:23:47,307 --> 00:23:49,536
I will admit the live nation did clap

662
00:23:49,536 --> 00:23:52,333
back and said, the way they're ticketing system.

663
00:23:52,492 --> 00:23:55,507
So, Shiny Hunters got barcodes. That's what they

664
00:23:55,507 --> 00:23:57,807
got 4 tickets. But I guess, the way

665
00:23:57,807 --> 00:24:01,407
that ticket master is situated, the barcodes can

666
00:24:01,407 --> 00:24:02,925
easily be rotated.

667
00:24:03,804 --> 00:24:06,841
So they rotated the barcodes and everybody's good

668
00:24:06,841 --> 00:24:07,580
and now

669
00:24:08,053 --> 00:24:09,721
You don't... You can't see T swift for...

670
00:24:09,879 --> 00:24:11,547
You wanna know why they rotate those barcodes

671
00:24:11,547 --> 00:24:11,785
codes?

672
00:24:12,420 --> 00:24:14,588
Or they have that built in? If party

673
00:24:14,723 --> 00:24:17,676
reseller? Yes. It's so that you can't scalp

674
00:24:17,676 --> 00:24:20,453
the tickets without ticket master getting their cut.

675
00:24:21,247 --> 00:24:24,104
Oh, there's... Actually pardon me, there's a... There's

676
00:24:24,104 --> 00:24:25,374
an article that came out

677
00:24:26,182 --> 00:24:29,038
Today of all days. Hackers reverse engineer ticket

678
00:24:29,038 --> 00:24:31,125
masters barcode system to unlock

679
00:24:31,498 --> 00:24:32,291
another flat. Yeah.

680
00:24:33,006 --> 00:24:35,084
I never submitted. Yes. That in the court.

681
00:24:35,322 --> 00:24:37,148
I'll put that in this spread actually. Good

682
00:24:37,148 --> 00:24:39,291
how we go that that excellent timing. So

683
00:24:39,291 --> 00:24:41,117
hope, maybe maybe that'll work out.

684
00:24:42,483 --> 00:24:44,632
But I don't know, like, anger... That's that's

685
00:24:44,632 --> 00:24:47,417
quite the community to anger if you start,

686
00:24:47,576 --> 00:24:50,379
like, poking the bear. Right? Like, that's Probably

687
00:24:50,379 --> 00:24:52,297
up there with Russia, type of deal.

688
00:24:53,495 --> 00:24:54,054
Maybe worse.

689
00:24:55,013 --> 00:24:56,451
Are you are you talking about? You're referring

690
00:24:56,451 --> 00:24:59,655
to cigarette mask or swift swift swift zwift.

691
00:24:59,894 --> 00:25:02,121
Not take a ass. That's what switch hack

692
00:25:02,121 --> 00:25:02,201
like,

693
00:25:03,076 --> 00:25:05,303
Ticket next swear kind of like... Like, there's

694
00:25:05,303 --> 00:25:08,103
even, like, regulation well, There's regulations, but who

695
00:25:08,103 --> 00:25:10,037
knows if those regulations are even gonna be

696
00:25:10,333 --> 00:25:12,643
put through now about ticket master and that

697
00:25:12,643 --> 00:25:13,917
type of stuff in the way that they're

698
00:25:13,917 --> 00:25:15,032
acting. But

699
00:25:16,003 --> 00:25:18,157
I think the t swift... The Swift are

700
00:25:18,157 --> 00:25:19,593
the the the true...

701
00:25:20,550 --> 00:25:21,906
The the main here.

702
00:25:22,624 --> 00:25:24,857
The maybe the concerns about the Ticket master

703
00:25:24,857 --> 00:25:28,163
breach is people that are potentially in in

704
00:25:28,461 --> 00:25:28,961
vulnerable

705
00:25:29,498 --> 00:25:29,998
situations

706
00:25:30,455 --> 00:25:33,725
and just pattern of life, peep... Like, if

707
00:25:33,725 --> 00:25:35,262
they've got stalker or whatever

708
00:25:36,211 --> 00:25:38,279
some so many defining pattern of life and

709
00:25:38,279 --> 00:25:40,666
and stuff like that for them? Charles, what

710
00:25:40,666 --> 00:25:42,630
do you mean? Can you elaborate me on

711
00:25:43,309 --> 00:25:45,950
So so if if if they've got names

712
00:25:45,950 --> 00:25:48,430
and and cities. So let's say somebody's got

713
00:25:48,430 --> 00:25:50,349
a stalker and they don't know what cities

714
00:25:50,349 --> 00:25:52,855
somebody's in. But they might know what what

715
00:25:52,910 --> 00:25:55,790
concerts they they've been to. They they could

716
00:25:55,845 --> 00:25:58,170
go through this hypothetically and and

717
00:25:58,876 --> 00:26:00,786
detect and get more information about them.

718
00:26:01,502 --> 00:26:03,888
Things like that. New. No. Not everyone's gonna

719
00:26:03,888 --> 00:26:06,473
know where I live. Got paste for. So

720
00:26:06,531 --> 00:26:08,844
has the... All the reach data has it

721
00:26:08,844 --> 00:26:10,120
been released to the public?

722
00:26:10,758 --> 00:26:13,230
It will eventually I'm sure. Yeah. It will

723
00:26:13,230 --> 00:26:15,237
eventually. Yeah. But most of the time. Most

724
00:26:15,237 --> 00:26:17,226
of the time. It gets released. Mh. But

725
00:26:17,226 --> 00:26:19,214
it's not yet. I see. Not. Yeah. It's

726
00:26:19,214 --> 00:26:20,169
still still too fresh.

727
00:26:20,805 --> 00:26:22,809
She is still too good. They're they're still

728
00:26:22,809 --> 00:26:24,718
trying to get that 8000000 dollars. Figure out

729
00:26:24,718 --> 00:26:26,866
when the next big Taylor Swift concert is

730
00:26:26,866 --> 00:26:28,377
and then expect it right then.

731
00:26:29,348 --> 00:26:30,465
Did they get any credit cards on this?

732
00:26:30,624 --> 00:26:32,618
Is this send anything about credit cards? It's

733
00:26:32,618 --> 00:26:35,330
it's just last 4. Slash last 4. Okay.

734
00:26:35,649 --> 00:26:36,446
I think it was

735
00:26:37,244 --> 00:26:40,214
particularly bad though for folks had reported fraud

736
00:26:40,214 --> 00:26:41,754
information. So that was 1 of the other

737
00:26:41,974 --> 00:26:43,815
neat pieces of information and another article as

738
00:26:43,815 --> 00:26:45,575
it said if you had reported fraud to

739
00:26:45,575 --> 00:26:47,494
ticket master more of your information was leaked.

740
00:26:47,987 --> 00:26:48,703
That's interesting.

741
00:26:49,339 --> 00:26:51,645
I also wonder if this is fallout from

742
00:26:51,645 --> 00:26:53,871
another breach because it just said a cloud

743
00:26:53,871 --> 00:26:54,666
based database.

744
00:26:56,271 --> 00:26:58,201
I thought it was linked back to snowflakes

745
00:26:58,257 --> 00:27:01,117
stuff. Third third party cloud database providers. Mention

746
00:27:01,117 --> 00:27:03,436
of Ticket master in their clan base back

747
00:27:03,436 --> 00:27:04,811
when the initial snowflakes.

748
00:27:05,346 --> 00:27:07,095
Yeah. So I'm I'm guessing it is very

749
00:27:07,095 --> 00:27:08,152
related. Ports.

750
00:27:09,004 --> 00:27:10,754
Of course, my camera just stops halfway through.

751
00:27:10,992 --> 00:27:11,492
So

752
00:27:12,122 --> 00:27:13,398
Okay. We don't need to see you anyway.

753
00:27:13,557 --> 00:27:15,071
I know That's. Majority of the people just

754
00:27:15,071 --> 00:27:16,745
listened to this podcast. I had no clue.

755
00:27:16,984 --> 00:27:19,057
I thought majority watched on Youtube no. Where

756
00:27:19,057 --> 00:27:19,296
our...

757
00:27:20,108 --> 00:27:20,848
Our are...

758
00:27:21,385 --> 00:27:22,902
We could all just turn our cameras off

759
00:27:22,902 --> 00:27:24,259
and we'd get the same numbers as probably.

760
00:27:24,578 --> 00:27:24,738
Yeah.

761
00:27:25,456 --> 00:27:27,132
Maybe I don't know. My mustache is pretty

762
00:27:27,132 --> 00:27:28,111
famous, but

763
00:27:28,504 --> 00:27:30,981
My gosh is pretty famous. Well,

764
00:27:31,940 --> 00:27:33,697
is it like two's? Weird flexes? Cool.

765
00:27:34,736 --> 00:27:35,295
You're right.

766
00:27:35,949 --> 00:27:37,784
So so much for me not saying weird

767
00:27:37,784 --> 00:27:39,700
stuff on lot on stream, but oh well.

768
00:27:40,098 --> 00:27:40,976
Alright. What's next?

769
00:27:42,413 --> 00:27:43,290
Oh sean.

770
00:27:43,864 --> 00:27:44,102
Trevor.

771
00:27:44,739 --> 00:27:47,047
Go short ron. Go for, Kelly. Go for

772
00:27:47,047 --> 00:27:49,435
it. Hit it. Okay. Well, for those of

773
00:27:49,435 --> 00:27:51,345
you who may not be aware, there was

774
00:27:51,345 --> 00:27:52,641
something of a regulatory

775
00:27:53,096 --> 00:27:54,626
earth quake last week.

776
00:27:55,583 --> 00:27:58,375
The Supreme Court was busy, quite busy last

777
00:27:58,375 --> 00:28:01,725
week. There was, basically, the Supreme Court overturned

778
00:28:01,725 --> 00:28:03,454
what's known as the Chevron defense

779
00:28:04,054 --> 00:28:06,534
The court case was known as lo bright.

780
00:28:07,095 --> 00:28:07,914
And basically,

781
00:28:08,294 --> 00:28:11,494
they not only overturned, but overrule something known

782
00:28:11,494 --> 00:28:12,615
as the Chevron doctrine.

783
00:28:13,109 --> 00:28:15,097
The chevron doctrine basically says,

784
00:28:16,132 --> 00:28:18,461
if there's a law that doesn't

785
00:28:18,995 --> 00:28:20,005
explicitly give

786
00:28:20,916 --> 00:28:22,287
directions or clear

787
00:28:23,530 --> 00:28:24,743
guidance to Congress

788
00:28:25,115 --> 00:28:27,120
that agencies such as

789
00:28:27,745 --> 00:28:28,142
Ftc,

790
00:28:28,697 --> 00:28:29,173
Fcc,

791
00:28:29,650 --> 00:28:33,482
Epa. The agencies are allowed to provide guidance

792
00:28:33,776 --> 00:28:34,276
and

793
00:28:35,300 --> 00:28:38,482
and 4 people of how the regulation is

794
00:28:38,482 --> 00:28:39,380
meant to be

795
00:28:39,914 --> 00:28:41,107
interpreted and then applied.

796
00:28:41,919 --> 00:28:43,675
And you might be saying, well, well, who

797
00:28:43,675 --> 00:28:46,388
cares about this? Well, this... The Chevron doctrine

798
00:28:46,388 --> 00:28:48,304
has been in place for about 40 years.

799
00:28:48,463 --> 00:28:51,113
And what's happened over the years is these

800
00:28:51,113 --> 00:28:51,613
regulatory

801
00:28:51,991 --> 00:28:53,028
agencies have becoming...

802
00:28:53,667 --> 00:28:55,424
Can I dare say fast and loose?

803
00:28:56,302 --> 00:28:58,298
They've taken more and more of,

804
00:28:59,415 --> 00:29:01,980
interpretations of the laws that congress has passed,

805
00:29:02,458 --> 00:29:04,153
and we've seen more and more

806
00:29:04,609 --> 00:29:07,738
cybersecurity regulations come again from some of those

807
00:29:07,875 --> 00:29:10,203
agencies that I've mentioned. Now you might be

808
00:29:10,203 --> 00:29:11,882
saying, well, what what does this have to

809
00:29:11,882 --> 00:29:13,080
do with me and what does this have

810
00:29:13,080 --> 00:29:13,960
to do with the fibers?

811
00:29:14,599 --> 00:29:16,676
Well, like I said, this is a pretty

812
00:29:16,676 --> 00:29:18,355
big deal that this was overturned?

813
00:29:18,929 --> 00:29:20,526
And now a lot of people are looking

814
00:29:20,526 --> 00:29:23,878
and asking what's gonna happen to these regulations

815
00:29:23,878 --> 00:29:27,071
that the Sec has passed or Ftc or

816
00:29:27,391 --> 00:29:27,790
Fcc.

817
00:29:28,600 --> 00:29:30,266
Well, we we don't know yet.

818
00:29:30,980 --> 00:29:33,941
When the Supreme Court actually handed down this

819
00:29:33,996 --> 00:29:36,377
decision, they said, it's not gonna...

820
00:29:37,426 --> 00:29:38,244
Undo anything

821
00:29:38,620 --> 00:29:41,428
that was previously done. So there is binding

822
00:29:41,565 --> 00:29:42,861
precedent precedent

823
00:29:43,237 --> 00:29:44,612
on what happened before

824
00:29:45,642 --> 00:29:48,754
But going forward, it opens the door for

825
00:29:48,754 --> 00:29:50,611
more legal challenges for

826
00:29:50,989 --> 00:29:53,876
cybersecurity regulations. You know, 1, 1 in particular

827
00:29:53,876 --> 00:29:54,913
that has people kind of,

828
00:29:55,711 --> 00:29:57,545
can I say a bit piss is the

829
00:29:57,704 --> 00:29:58,204
Sec

830
00:29:58,582 --> 00:30:00,597
regulations on 4 days for

831
00:30:00,974 --> 00:30:02,033
cybersecurity materiality?

832
00:30:02,983 --> 00:30:05,777
That 1 in particular has people upset. So

833
00:30:05,937 --> 00:30:09,071
I would expect to see more court challenges

834
00:30:09,289 --> 00:30:12,495
to some of these cybersecurity regulations But, if

835
00:30:12,495 --> 00:30:15,283
you're in G like me or you're you're

836
00:30:15,283 --> 00:30:17,115
listening to this podcast? And you're, like, what

837
00:30:17,115 --> 00:30:18,470
am I supposed to take away from this?

838
00:30:18,643 --> 00:30:20,546
You know, did did my world turn upside

839
00:30:20,546 --> 00:30:22,289
down this week because of what happened last

840
00:30:22,289 --> 00:30:24,191
week. No. I don't think your world turned

841
00:30:24,191 --> 00:30:24,508
upside down.

842
00:30:25,459 --> 00:30:27,721
Agencies are still gonna issue their

843
00:30:28,094 --> 00:30:30,874
interpretations of the laws that Congress past, But

844
00:30:30,874 --> 00:30:33,495
what's gonna happen now is judges will be

845
00:30:33,495 --> 00:30:36,234
able to exercise a bit more to discretion

846
00:30:36,694 --> 00:30:40,855
on their interpretations of if us a judges

847
00:30:40,855 --> 00:30:42,474
are going to be able to

848
00:30:43,509 --> 00:30:46,405
have more discretion, if they believe that the

849
00:30:46,544 --> 00:30:47,044
agency's

850
00:30:47,583 --> 00:30:49,660
interpretation of the law is correct or not.

851
00:30:50,154 --> 00:30:51,982
So I do think we're gonna be seeing

852
00:30:51,982 --> 00:30:53,573
a lot more legal cases,

853
00:30:54,209 --> 00:30:54,845
especially around,

854
00:30:56,594 --> 00:31:00,294
cybersecurity incident reporting data beach reporting requirements.

855
00:31:01,229 --> 00:31:03,541
And I think it also kind of, puts

856
00:31:03,541 --> 00:31:05,556
a new light on some of the Ai

857
00:31:05,853 --> 00:31:07,864
regulations. I know when our our notes we're

858
00:31:07,864 --> 00:31:10,261
gonna be talking about the California Ai regulation.

859
00:31:10,581 --> 00:31:13,298
Even though that's a state regulation. So guys,

860
00:31:13,538 --> 00:31:15,216
what are your thoughts on that? It's big

861
00:31:15,216 --> 00:31:17,307
and it's tiny all at once. In in

862
00:31:17,307 --> 00:31:18,024
what way that is...

863
00:31:18,821 --> 00:31:19,618
It's interesting. The...

864
00:31:20,256 --> 00:31:22,328
It's basically returning things to the state of

865
00:31:22,328 --> 00:31:25,213
affairs, for the 40 years preceding options. This

866
00:31:25,213 --> 00:31:26,730
is the 40 year overturn. The chevron document

867
00:31:26,730 --> 00:31:28,885
was also a 40 year overturn of the

868
00:31:29,125 --> 00:31:31,520
Apa the administrative procedures Act from 45,

869
00:31:31,919 --> 00:31:33,755
back when we first built most these agencies.

870
00:31:34,327 --> 00:31:34,725
And so,

871
00:31:35,519 --> 00:31:37,902
basically, things are now subject to judicial review

872
00:31:37,902 --> 00:31:39,331
again, which is the way it actually historically

873
00:31:39,331 --> 00:31:41,476
used to work. And so that means things

874
00:31:41,476 --> 00:31:43,479
will go to the courts instead of agencies

875
00:31:43,479 --> 00:31:45,152
if there is a lack of clarity in

876
00:31:45,152 --> 00:31:47,222
the laws that Congress passes. So the asterisk

877
00:31:47,222 --> 00:31:48,655
there is what lack clarity means.

878
00:31:49,292 --> 00:31:50,805
1 of the interesting things if you read

879
00:31:50,805 --> 00:31:52,734
the actual legal opinion is that they're very

880
00:31:52,734 --> 00:31:55,286
clear about saying that a law does not

881
00:31:55,286 --> 00:31:57,200
have to spell out, like, line for line,

882
00:31:57,440 --> 00:31:59,194
what agencies can do. Like, they don't... There

883
00:31:59,194 --> 00:32:00,151
doesn't have to be at something that says,

884
00:32:00,884 --> 00:32:03,214
you know, the Fcc can pass cybersecurity

885
00:32:03,590 --> 00:32:04,863
regulations, But there does have to be some

886
00:32:04,863 --> 00:32:07,171
sort of definition of the Fcc general mandate.

887
00:32:07,887 --> 00:32:09,661
And so we are likely to see more

888
00:32:09,797 --> 00:32:11,169
impact on this of a thing and where

889
00:32:11,169 --> 00:32:12,929
legal challenges are more likely to crop up

890
00:32:12,929 --> 00:32:14,849
are agencies that don't have anything to do

891
00:32:14,849 --> 00:32:16,450
with either security or technology.

892
00:32:16,929 --> 00:32:18,904
So rulings by the Fcc are probably less

893
00:32:19,024 --> 00:32:21,009
likely to be in the firing line because

894
00:32:21,009 --> 00:32:22,676
they are more likely to be upheld under

895
00:32:22,676 --> 00:32:23,073
judicial review.

896
00:32:24,026 --> 00:32:26,329
Rulings by security agencies are more likely to

897
00:32:26,329 --> 00:32:28,489
be safe. If you've got, you know, the

898
00:32:28,806 --> 00:32:30,577
Epa passing a

899
00:32:30,951 --> 00:32:31,451
cybersecurity

900
00:32:31,825 --> 00:32:32,325
notification

901
00:32:33,096 --> 00:32:34,129
regulation, Those are the sort of things that

902
00:32:34,129 --> 00:32:35,974
are more likely on very shaky footing right

903
00:32:35,974 --> 00:32:37,894
now and could be overthrow or overturned in

904
00:32:37,894 --> 00:32:38,375
the challenge.

905
00:32:39,654 --> 00:32:41,494
You know, Loki, that was a great explanation.

906
00:32:41,894 --> 00:32:43,746
Yeah, let me talk about let me talk

907
00:32:43,746 --> 00:32:45,656
about my feelings for a second here. This

908
00:32:45,656 --> 00:32:47,884
just kind pisses me off because I feel

909
00:32:47,884 --> 00:32:50,931
like we've been banging the drama on cybersecurity

910
00:32:51,068 --> 00:32:52,261
regulations for a long time.

911
00:32:52,834 --> 00:32:54,743
And we've you have been inch edging forward

912
00:32:54,743 --> 00:32:56,813
and I'm sort of getting some a more

913
00:32:56,813 --> 00:32:58,564
disciplined approach to cybersecurity.

914
00:32:59,121 --> 00:33:01,667
And now we're kind of on shaky ground

915
00:33:01,667 --> 00:33:04,473
and You know, sometimes in G, you, we

916
00:33:04,473 --> 00:33:06,786
try and encourage and we try to build

917
00:33:06,786 --> 00:33:09,019
a team at sometimes, we kinda have to

918
00:33:09,019 --> 00:33:11,173
beat people over the head with regulations. And

919
00:33:11,173 --> 00:33:11,991
now that those

920
00:33:12,543 --> 00:33:15,648
are might be in question. We've... As G

921
00:33:15,648 --> 00:33:17,558
people, we've lost a bit of our backing,

922
00:33:18,195 --> 00:33:19,867
I'm afraid to say, what are your thoughts

923
00:33:19,867 --> 00:33:21,713
on that? I think that's true. And I

924
00:33:21,713 --> 00:33:22,987
think in the in the macro sense, this

925
00:33:22,987 --> 00:33:25,056
is likely gonna be chaotic messy and not

926
00:33:25,056 --> 00:33:27,205
getting in the short term, but hopefully in

927
00:33:27,205 --> 00:33:27,763
the long term.

928
00:33:28,893 --> 00:33:30,725
Because with the chevron doctrine in place what

929
00:33:30,725 --> 00:33:31,601
you had was

930
00:33:32,159 --> 00:33:35,426
interpretive authority arrested with administrative agencies, most of

931
00:33:35,426 --> 00:33:37,657
which are not elected, often appointed,

932
00:33:38,628 --> 00:33:40,543
and are subject to very whim changes, you

933
00:33:40,543 --> 00:33:43,733
know, when the administration in, in Washington Dc

934
00:33:43,733 --> 00:33:44,052
changes.

935
00:33:44,850 --> 00:33:46,126
Regulations that are made by, you know, 1

936
00:33:46,126 --> 00:33:47,641
year can be undone 4 years later, if

937
00:33:47,641 --> 00:33:49,409
you have different party and power, for example.

938
00:33:49,887 --> 00:33:51,638
Part of this going back to the judiciary,

939
00:33:51,798 --> 00:33:53,549
and really it's not so much to the

940
00:33:53,549 --> 00:33:55,460
judiciary, the idea is to force congress to

941
00:33:55,460 --> 00:33:56,710
actually encode some of this

942
00:33:57,226 --> 00:33:58,734
delegation of responsibility into law, which I think

943
00:33:58,734 --> 00:34:00,242
is a good thing. Like, as you mentioned

944
00:34:00,322 --> 00:34:02,227
Congress has gotten pretty fast and loose with,

945
00:34:02,703 --> 00:34:03,203
passing...

946
00:34:04,053 --> 00:34:06,532
Actual legally binding regulations and just hand waving

947
00:34:06,532 --> 00:34:08,525
it off to agencies. So if Congress actually

948
00:34:08,525 --> 00:34:11,156
gets their act together, a gas and gets

949
00:34:11,156 --> 00:34:13,548
more of this encoded in law, like delegation

950
00:34:13,548 --> 00:34:14,186
of authority.

951
00:34:14,838 --> 00:34:15,711
I think that'd be a great thing in

952
00:34:15,711 --> 00:34:17,300
the long run. It's gonna reduce the amount

953
00:34:17,300 --> 00:34:18,729
of whips sewing you get every 4 to

954
00:34:18,729 --> 00:34:20,555
8 years. In the short term, though, it's

955
00:34:20,555 --> 00:34:21,270
it's gonna be a mess.

956
00:34:22,143 --> 00:34:24,146
You're gave this legal challenges. They're gonna be

957
00:34:24,146 --> 00:34:25,578
all over the place depending on where it's

958
00:34:25,578 --> 00:34:25,896
rising.

959
00:34:26,533 --> 00:34:27,726
And so it's gonna be a little wet

960
00:34:27,726 --> 00:34:30,056
wild for you know, the next call 4

961
00:34:30,112 --> 00:34:31,719
5 years. It would be my guess. Well,

962
00:34:31,960 --> 00:34:33,239
and the thing that worries to me about

963
00:34:33,239 --> 00:34:36,140
that short term is the lack of technological

964
00:34:37,480 --> 00:34:37,980
knowledge

965
00:34:38,440 --> 00:34:40,119
in the judicial system itself.

966
00:34:40,692 --> 00:34:42,594
How many of the judicial stuff, what are

967
00:34:42,594 --> 00:34:45,132
they gonna be talking about? How are they

968
00:34:45,132 --> 00:34:47,773
gonna determine if it's a techno technological

969
00:34:49,356 --> 00:34:52,147
cybersecurity type regulation? Is this a feasible 1,

970
00:34:52,466 --> 00:34:54,858
should this be done properly by that. There's

971
00:34:54,858 --> 00:34:56,293
so much that goes into it from that

972
00:34:56,293 --> 00:34:58,300
back end and we've seen it not just

973
00:34:58,300 --> 00:35:01,323
in the judicial, but in congress, the lack

974
00:35:01,323 --> 00:35:02,061
of technological

975
00:35:03,550 --> 00:35:04,027
knowledge.

976
00:35:04,998 --> 00:35:06,533
That's going forward in

977
00:35:07,068 --> 00:35:10,094
regulations and laws overall and in court cases.

978
00:35:10,890 --> 00:35:12,802
Do we do we feel like over the

979
00:35:12,802 --> 00:35:14,574
next 4 to 5 years, and I love

980
00:35:14,574 --> 00:35:16,255
that, by the way, you define the short

981
00:35:16,255 --> 00:35:17,694
term as the next 4 to 5 years

982
00:35:17,694 --> 00:35:19,315
because that feels like an eternity

983
00:35:19,775 --> 00:35:22,425
in in cyber crime, that this is going

984
00:35:22,425 --> 00:35:25,132
to give Cis and Cs kind of a

985
00:35:25,132 --> 00:35:27,760
scape out not to comply with current regulations

986
00:35:27,760 --> 00:35:29,353
because they feel like something might be der

987
00:35:29,353 --> 00:35:29,751
regulated.

988
00:35:30,323 --> 00:35:33,027
Mean, I don't think reg until they're overturned.

989
00:35:33,186 --> 00:35:34,539
So I don't know. That would be a

990
00:35:34,539 --> 00:35:36,130
very dangerous position to take because as he

991
00:35:36,130 --> 00:35:38,198
so. Well, you know, Andrea, I think you

992
00:35:38,198 --> 00:35:41,414
asked a good question there. It's about managing

993
00:35:41,548 --> 00:35:41,786
risk.

994
00:35:42,422 --> 00:35:44,565
And I do think there are some companies

995
00:35:44,565 --> 00:35:47,367
are gonna say, I got a team of

996
00:35:48,154 --> 00:35:50,790
fast, loose and hot lawyers, who can argue

997
00:35:50,790 --> 00:35:52,787
the weight out of this. I'm not gonna

998
00:35:52,787 --> 00:35:54,465
invest in cybersecurity controls.

999
00:35:55,356 --> 00:35:57,286
Because I don't think I need to. Other

1000
00:35:57,502 --> 00:35:59,885
organizations are gonna say, I I do wanna

1001
00:35:59,885 --> 00:36:01,395
invest in this because I want trust with

1002
00:36:01,395 --> 00:36:02,031
my customers,

1003
00:36:02,683 --> 00:36:05,074
I think it really boils down to your

1004
00:36:05,074 --> 00:36:07,625
risk appetite in your culture at your company.

1005
00:36:08,422 --> 00:36:10,016
Sure. I I just sort of see this

1006
00:36:10,016 --> 00:36:12,829
as as the opportunity to say if I'm

1007
00:36:12,829 --> 00:36:14,349
midst stream on a compliance rule roll out,

1008
00:36:14,429 --> 00:36:16,349
hey. I'll just like, kinda wait and see

1009
00:36:16,349 --> 00:36:18,030
how this walks out? Yeah.

1010
00:36:18,844 --> 00:36:21,079
And if if it does shake out that

1011
00:36:21,079 --> 00:36:23,154
the regulation stays in place that at least

1012
00:36:23,154 --> 00:36:23,973
gives me

1013
00:36:24,431 --> 00:36:27,166
a technical... Technically some kind of defense

1014
00:36:27,478 --> 00:36:29,070
later down the line if something did happen,

1015
00:36:29,150 --> 00:36:31,719
and I wasn't necessarily compliant, just playing devil's

1016
00:36:31,775 --> 00:36:34,003
advocate. I could see that argument being made

1017
00:36:34,003 --> 00:36:36,605
by some people. The the interesting thing is

1018
00:36:36,724 --> 00:36:38,798
For a challenge to be brought up, somebody

1019
00:36:38,798 --> 00:36:40,792
has to basically file a new a new

1020
00:36:40,792 --> 00:36:43,902
court case, alleging damages effectively or that they

1021
00:36:43,902 --> 00:36:45,577
have been some harm inflicted on them by

1022
00:36:45,577 --> 00:36:46,295
the regulation.

1023
00:36:47,029 --> 00:36:48,547
So it's... That's part of the thing is

1024
00:36:48,547 --> 00:36:50,385
it's not that every regulation that currently exists

1025
00:36:50,385 --> 00:36:52,144
is under review. Instantly, that's sort of that

1026
00:36:52,144 --> 00:36:54,222
whole idea of the existing j credence still

1027
00:36:54,222 --> 00:36:56,034
apply. So any regulation currently on the books

1028
00:36:56,234 --> 00:36:57,747
is still there. But it does open the

1029
00:36:57,747 --> 00:36:59,681
door for to someone file a new lawsuit

1030
00:36:59,739 --> 00:37:01,651
saying, I have been harmed by this regulation

1031
00:37:01,731 --> 00:37:02,926
It is causing me some kind of pain.

1032
00:37:03,324 --> 00:37:05,475
I believe it was non lawful in nature.

1033
00:37:05,969 --> 00:37:07,086
Which will then kick it back to the

1034
00:37:07,086 --> 00:37:09,001
courts for review. So I don't know. It...

1035
00:37:09,161 --> 00:37:10,438
That's I say, like, you could make that

1036
00:37:10,438 --> 00:37:12,592
argument, It feels like kinda shaky grounds unless

1037
00:37:12,831 --> 00:37:13,151
you know,

1038
00:37:14,525 --> 00:37:16,045
because who knows if there's even gonna be

1039
00:37:16,045 --> 00:37:17,644
a challenge to something unless you're gonna file

1040
00:37:17,644 --> 00:37:19,085
yourself. In which case, I don't know that

1041
00:37:19,085 --> 00:37:20,284
you wanna be the person who's gonna try

1042
00:37:20,284 --> 00:37:22,218
and battle something up to Supreme court. The

1043
00:37:22,218 --> 00:37:25,002
other question I've got is if they decide

1044
00:37:25,002 --> 00:37:26,297
to say that the Sec

1045
00:37:26,990 --> 00:37:28,740
regulation, the 4 day regulation.

1046
00:37:29,552 --> 00:37:31,782
Notification regulation is tossed out.

1047
00:37:32,499 --> 00:37:34,331
Who has the right to make that regulation

1048
00:37:34,331 --> 00:37:36,401
that actually has some teeth in it? Will

1049
00:37:36,401 --> 00:37:38,484
any of the... Will the teeth of any

1050
00:37:38,484 --> 00:37:39,380
of the regulatory

1051
00:37:40,148 --> 00:37:42,603
groups such as the Sec, the Fcc. Will

1052
00:37:42,603 --> 00:37:44,188
some of that might be taken out of

1053
00:37:44,188 --> 00:37:45,114
there where they can't

1054
00:37:45,553 --> 00:37:47,226
where the courts come back maybe and say,

1055
00:37:47,545 --> 00:37:49,856
well instead of 40000 dollars a day until

1056
00:37:49,856 --> 00:37:52,168
it gets fixed, you can only charge 5000

1057
00:37:52,168 --> 00:37:54,015
dollars a day. And a company is gonna

1058
00:37:54,015 --> 00:37:56,110
say, oh, 5000 dollars a day, that's

1059
00:37:56,566 --> 00:37:58,797
right on the money. Mh. How do we

1060
00:37:58,797 --> 00:38:01,005
get it to a point? Because I am

1061
00:38:01,282 --> 00:38:02,791
I'll be honest, I have no faith in

1062
00:38:02,950 --> 00:38:05,174
Congress doing anything proper about this at this

1063
00:38:05,174 --> 00:38:07,001
point in time that would give it real

1064
00:38:07,001 --> 00:38:07,239
teeth.

1065
00:38:07,874 --> 00:38:09,145
Who do we have that would have the

1066
00:38:09,145 --> 00:38:10,908
teeth going forward that could force some of

1067
00:38:10,908 --> 00:38:11,465
this paint.

1068
00:38:12,817 --> 00:38:14,886
Well, if if we elect a dictator,

1069
00:38:15,920 --> 00:38:17,034
you ui I have some key there.

1070
00:38:17,829 --> 00:38:17,885
Some...

1071
00:38:19,203 --> 00:38:20,721
I the thing that the perspective to keep

1072
00:38:20,721 --> 00:38:22,319
on the Congress, and I know I'm a

1073
00:38:22,319 --> 00:38:24,077
slightly mono here Shut up in a minute.

1074
00:38:24,396 --> 00:38:25,835
The thing to keep in mind with Congress

1075
00:38:25,835 --> 00:38:27,994
is Congress can delegate the authority in broad

1076
00:38:27,994 --> 00:38:29,742
strokes. Like, we don't have to rely on

1077
00:38:29,900 --> 00:38:31,648
Congress having the technical know how to pass,

1078
00:38:31,727 --> 00:38:33,236
you know, an encryption standard that makes sense,

1079
00:38:33,315 --> 00:38:35,559
for example. Or anything like that. It, like,

1080
00:38:35,718 --> 00:38:37,550
the the right solution to this is for

1081
00:38:37,630 --> 00:38:40,042
Congress to say something like agency x

1082
00:38:40,419 --> 00:38:43,286
has authority within broad strokes to regulate, you

1083
00:38:43,286 --> 00:38:43,446
know,

1084
00:38:44,178 --> 00:38:44,497
security,

1085
00:38:45,293 --> 00:38:48,321
encryption... Technology standards around things like security encryption

1086
00:38:48,321 --> 00:38:50,392
protection, privacy, etcetera... There's ways to define that

1087
00:38:50,392 --> 00:38:51,906
legally, I'm not a lawyer so, you know,

1088
00:38:52,065 --> 00:38:54,151
those don't take those words. But you can

1089
00:38:54,151 --> 00:38:56,300
define in broad terms though a legal in

1090
00:38:56,300 --> 00:38:57,915
that way. Like, most of the existing regulatory

1091
00:38:58,131 --> 00:38:59,666
agencies were back in the forties and fifties

1092
00:38:59,723 --> 00:39:01,449
were set up that way. And that's why

1093
00:39:01,649 --> 00:39:03,324
they do have broad authority in their areas

1094
00:39:03,324 --> 00:39:04,920
and can do things like right regulations. The

1095
00:39:04,920 --> 00:39:06,537
problem is a lot of more recent stuff

1096
00:39:06,915 --> 00:39:08,590
are from agencies that never had authorities in

1097
00:39:08,590 --> 00:39:10,275
those... Positions in the first place and just

1098
00:39:10,275 --> 00:39:12,101
started attacking on, you know, oh, hey, we

1099
00:39:12,101 --> 00:39:13,293
think we should have this authority.

1100
00:39:14,166 --> 00:39:15,358
So I think that's the that's the way

1101
00:39:15,358 --> 00:39:17,128
you get the teeth that stick. Is congress

1102
00:39:17,184 --> 00:39:20,146
del, which, again, I have very little faith

1103
00:39:20,146 --> 00:39:21,902
in congress in general. I have more faith

1104
00:39:21,902 --> 00:39:23,339
in them being able to say this is

1105
00:39:23,339 --> 00:39:25,894
somebody else's problem versus them passing an actual

1106
00:39:25,894 --> 00:39:27,491
detail regulation, which I don't think they they

1107
00:39:27,491 --> 00:39:29,525
would do a good job Nor should. Haven't

1108
00:39:29,585 --> 00:39:32,164
haven't we seen the states put out better

1109
00:39:32,304 --> 00:39:32,804
regulations

1110
00:39:33,105 --> 00:39:34,164
and rulings

1111
00:39:34,545 --> 00:39:36,224
with federal government anywhere anyway? Colorado?

1112
00:39:36,879 --> 00:39:38,075
Oh, California. Right?

1113
00:39:38,952 --> 00:39:42,005
See? That's a great segue into our article

1114
00:39:42,143 --> 00:39:42,962
on California's

1115
00:39:43,578 --> 00:39:45,891
proposed Ai bill. You guys take a look

1116
00:39:45,891 --> 00:39:46,130
at that.

1117
00:39:49,004 --> 00:39:51,068
Basically, there's a... It it it's interesting.

1118
00:39:51,862 --> 00:39:54,481
Again, we've got somebody in politics whose last

1119
00:39:54,481 --> 00:39:56,327
name is Wei. I don't know where these

1120
00:39:56,327 --> 00:39:59,060
guys come from. I really don't. Anyway, so

1121
00:39:59,677 --> 00:40:01,591
we've we've got a proposal for an Ai

1122
00:40:01,591 --> 00:40:03,505
bill, but a lot of, the tech companies

1123
00:40:03,505 --> 00:40:05,315
are up at arms on this because

1124
00:40:06,071 --> 00:40:09,494
they... People are interpreting the proposed law as

1125
00:40:09,494 --> 00:40:09,994
holding

1126
00:40:10,529 --> 00:40:11,825
developers responsible

1127
00:40:12,280 --> 00:40:14,468
in the case that there's... A catastrophic

1128
00:40:15,164 --> 00:40:15,324
event.

1129
00:40:16,041 --> 00:40:18,194
And and I really wanna highlight that word

1130
00:40:18,194 --> 00:40:18,694
catastrophic

1131
00:40:19,789 --> 00:40:22,341
because that's basically what the bill is talking

1132
00:40:22,341 --> 00:40:25,799
about. The interesting thing about the bill is

1133
00:40:26,333 --> 00:40:28,797
it is really getting mis misinterpreted. First of

1134
00:40:28,797 --> 00:40:31,838
all, we're talking about risk, who we're dealing

1135
00:40:31,838 --> 00:40:33,197
with. I think it's over,

1136
00:40:33,756 --> 00:40:34,795
500000000

1137
00:40:34,795 --> 00:40:38,072
dollars, and we're talking about Ai models. At

1138
00:40:38,152 --> 00:40:40,330
Ai models that lead to

1139
00:40:40,963 --> 00:40:42,579
a potential hazardous

1140
00:40:43,196 --> 00:40:43,595
capabilities.

1141
00:40:44,233 --> 00:40:46,466
And the tech community is up at arm

1142
00:40:46,466 --> 00:40:48,699
saying, hey, hey, hey. This... You're really, you

1143
00:40:48,699 --> 00:40:48,859
know,

1144
00:40:49,657 --> 00:40:51,264
what am I trying to say you're you're

1145
00:40:51,264 --> 00:40:54,469
raining on our right here, your s technology.

1146
00:40:55,560 --> 00:40:57,412
But I find this really kind of interesting

1147
00:40:57,469 --> 00:40:59,793
because this is the first time, we've got

1148
00:40:59,793 --> 00:41:01,547
a legislative body saying, hey,

1149
00:41:02,424 --> 00:41:05,614
before this technology gets off the tracks, let's

1150
00:41:05,614 --> 00:41:08,086
try and regulate it and think about risks.

1151
00:41:08,898 --> 00:41:09,398
And

1152
00:41:10,329 --> 00:41:11,999
I'm kinda curious to see how this plays

1153
00:41:11,999 --> 00:41:12,158
out.

1154
00:41:14,146 --> 00:41:16,452
Look up look up, Scott Wei, who is

1155
00:41:16,452 --> 00:41:17,905
the the Congressman.

1156
00:41:18,534 --> 00:41:20,838
Or the Congressman. The representative for the the

1157
00:41:20,838 --> 00:41:21,235
senator.

1158
00:41:21,712 --> 00:41:23,143
Is that is that what it is? Yeah.

1159
00:41:23,540 --> 00:41:25,288
Dex state? The state senator,

1160
00:41:26,098 --> 00:41:28,170
I thought he was young. Like his pictures,

1161
00:41:28,329 --> 00:41:30,822
he looks pretty young. He... So he's representing

1162
00:41:31,198 --> 00:41:33,843
San Francisco and San Mateo area, which... Makes

1163
00:41:33,843 --> 00:41:35,679
total sense where this bill going in. Right?

1164
00:41:35,918 --> 00:41:37,593
Like, that looks like he... If you look

1165
00:41:37,593 --> 00:41:39,508
at it, he's actually 54 years old,

1166
00:41:40,465 --> 00:41:40,840
which

1167
00:41:41,595 --> 00:41:43,922
maybe I'm reading the wrong thing, but

1168
00:41:44,615 --> 00:41:46,602
I I'm maybe I'm it maybe I am.

1169
00:41:46,761 --> 00:41:49,322
But if he is, He looks like the

1170
00:41:49,322 --> 00:41:50,997
right type of guy that would be able

1171
00:41:50,997 --> 00:41:53,230
to at least build some type of,

1172
00:41:54,108 --> 00:41:56,580
law around this and in the correct area

1173
00:41:56,580 --> 00:41:58,335
to have the right connections to build this.

1174
00:41:58,750 --> 00:42:00,190
I don't know... I'm not gonna read it

1175
00:42:00,190 --> 00:42:02,190
to the truth, but I love that 1

1176
00:42:02,190 --> 00:42:04,349
of the comments in this article is that

1177
00:42:04,349 --> 00:42:06,109
if it were passed and the state made

1178
00:42:06,109 --> 00:42:08,273
a mess stake using Ai, the finest so

1179
00:42:08,273 --> 00:42:10,262
high, it would put the state in a

1180
00:42:10,262 --> 00:42:10,762
perilous

1181
00:42:11,137 --> 00:42:12,967
position. So if government gets it wrong,

1182
00:42:13,618 --> 00:42:16,321
it might bankrupt a a state government office.

1183
00:42:17,275 --> 00:42:19,184
Considering the operating budgets of a lot of

1184
00:42:19,184 --> 00:42:20,933
corporations that's not entirely shocking.

1185
00:42:22,062 --> 00:42:24,075
I mean, 5 500000000 seems

1186
00:42:24,770 --> 00:42:25,270
I

1187
00:42:25,805 --> 00:42:27,956
given... How do they define a catastrophic event?

1188
00:42:28,115 --> 00:42:30,026
I guess, is my question. Kelly, it sounds

1189
00:42:30,026 --> 00:42:31,556
like you've read the article. Did did did

1190
00:42:31,556 --> 00:42:33,309
they get into that a little bit? I

1191
00:42:33,309 --> 00:42:35,462
don't remember, Sean to be honest.

1192
00:42:36,179 --> 00:42:38,172
Yeah. It's it's gone taken article. Like, you

1193
00:42:38,172 --> 00:42:39,945
know, things like the you know, if it

1194
00:42:39,945 --> 00:42:41,864
get hooked up for managing power grids that

1195
00:42:41,864 --> 00:42:44,265
at the Ai would white power grids or

1196
00:42:44,265 --> 00:42:46,184
enable people to build chemical weapons,

1197
00:42:47,159 --> 00:42:48,355
I know I... You know, it's like, another

1198
00:42:48,355 --> 00:42:49,711
thing that I saw from the article was,

1199
00:42:49,791 --> 00:42:51,545
like, at the beginning, It says, like, it's

1200
00:42:51,545 --> 00:42:52,444
asking Ai

1201
00:42:53,380 --> 00:42:56,671
companies to do security testing and implement

1202
00:42:57,619 --> 00:42:58,335
safety measures.

1203
00:42:59,052 --> 00:43:01,279
And then in response, meta was, like, what

1204
00:43:01,279 --> 00:43:02,710
but doing that is gonna make it less

1205
00:43:02,710 --> 00:43:03,188
less safe.

1206
00:43:04,315 --> 00:43:06,296
So I think I'm just trying to follow

1207
00:43:06,296 --> 00:43:08,594
the the logic that, like, adding safety measures

1208
00:43:08,594 --> 00:43:09,546
will make it less safe.

1209
00:43:10,338 --> 00:43:12,971
Let's... It's super. Interesting, when you talk about

1210
00:43:13,050 --> 00:43:15,272
L ob ability and how you're detecting things

1211
00:43:15,272 --> 00:43:17,597
like jail breaks and doing output

1212
00:43:18,129 --> 00:43:19,557
validation because in some ways,

1213
00:43:20,128 --> 00:43:22,356
If you are engineering a system that mitigate,

1214
00:43:22,993 --> 00:43:25,323
like the top 10, for Ll,

1215
00:43:26,097 --> 00:43:27,233
you are storing

1216
00:43:27,767 --> 00:43:29,255
potentially a ton of Pii

1217
00:43:29,614 --> 00:43:31,295
either intentionally or accidentally,

1218
00:43:31,775 --> 00:43:32,994
simply by logging

1219
00:43:33,295 --> 00:43:35,775
output. So we're not really there at the

1220
00:43:35,775 --> 00:43:38,255
point yet where security controls for Ll.

1221
00:43:38,669 --> 00:43:40,263
Have advanced to the point where it's not

1222
00:43:40,263 --> 00:43:43,292
actually creating additional risk if you're logging a

1223
00:43:43,292 --> 00:43:44,169
hundred percent of the time.

1224
00:43:45,045 --> 00:43:46,400
Did anybody see about...

1225
00:43:47,132 --> 00:43:47,927
Chat Bts.

1226
00:43:49,359 --> 00:43:51,291
What was it? Their their entire

1227
00:43:51,904 --> 00:43:53,018
rules being leaked.

1228
00:43:53,987 --> 00:43:56,771
Oh, their their forum. They had a private

1229
00:43:56,771 --> 00:43:57,271
forum

1230
00:43:57,647 --> 00:43:59,795
that, yeah, they had the data breach where

1231
00:43:59,795 --> 00:44:02,363
their employees only forum was

1232
00:44:02,914 --> 00:44:05,711
compromised, but they didn't tell anybody about it

1233
00:44:05,711 --> 00:44:06,211
till

1234
00:44:06,909 --> 00:44:09,307
a long while later. I think that article

1235
00:44:09,307 --> 00:44:10,985
was in our our notes for the show.

1236
00:44:11,399 --> 00:44:13,868
I thought that article very interesting. They said,

1237
00:44:14,027 --> 00:44:16,418
hey, don't worry. None of our Ll or

1238
00:44:16,418 --> 00:44:18,011
none of the good stuff was compromised.

1239
00:44:18,503 --> 00:44:20,487
It was just the forms where we talk

1240
00:44:20,487 --> 00:44:22,392
about stuff. You know, and from from a

1241
00:44:22,471 --> 00:44:24,852
G point of view, this actually kinda irritates

1242
00:44:24,852 --> 00:44:25,408
me greatly.

1243
00:44:26,618 --> 00:44:28,315
And then irritates me because

1244
00:44:28,693 --> 00:44:30,050
we spend a lot of time talking about

1245
00:44:30,050 --> 00:44:32,046
the difference between an incident and a breach.

1246
00:44:32,525 --> 00:44:34,622
Okay. Well, that's a that's a whole different

1247
00:44:34,760 --> 00:44:34,920
conversation.

1248
00:44:35,572 --> 00:44:37,959
But the the fact that something happened in

1249
00:44:37,959 --> 00:44:40,607
a company that people are already

1250
00:44:41,061 --> 00:44:42,039
concerned about

1251
00:44:42,429 --> 00:44:43,088
the technology

1252
00:44:43,626 --> 00:44:46,179
and the decisions it's making. There's... You know,

1253
00:44:46,418 --> 00:44:49,131
they had an opportunity to be open honest

1254
00:44:49,131 --> 00:44:51,862
and trans parent with with cut consumers and

1255
00:44:51,862 --> 00:44:53,461
they chose not to be, and that's what

1256
00:44:53,461 --> 00:44:55,778
upsets me. Yeah. And sorry. I didn't mean

1257
00:44:55,778 --> 00:44:57,137
to jump to a new article. It just...

1258
00:44:57,456 --> 00:44:59,235
You mentioned Ll and and

1259
00:44:59,549 --> 00:45:01,864
that that article... I saw that article today

1260
00:45:01,864 --> 00:45:04,578
and the risk from the risk possible from

1261
00:45:04,578 --> 00:45:07,292
that, made me think of of of what

1262
00:45:07,292 --> 00:45:09,298
we were discussing. Yeah. I would be curious

1263
00:45:09,298 --> 00:45:10,490
to hear from the group. Like, if you

1264
00:45:10,490 --> 00:45:12,875
think this this bill's gonna stick or land

1265
00:45:12,875 --> 00:45:14,624
in California because my guess would be no,

1266
00:45:15,181 --> 00:45:17,111
I think what we're gonna see is probably

1267
00:45:17,819 --> 00:45:19,751
something that's the equivalent of due diligence,

1268
00:45:20,285 --> 00:45:21,103
like Pci,

1269
00:45:21,478 --> 00:45:23,309
or if you're not doing your due diligence

1270
00:45:23,309 --> 00:45:25,855
to ensure that you're at least attempting to

1271
00:45:25,855 --> 00:45:26,332
mitigate,

1272
00:45:27,142 --> 00:45:27,381
abuse,

1273
00:45:28,176 --> 00:45:30,005
then you're in in trouble, but,

1274
00:45:30,721 --> 00:45:33,265
simply to say, if your model can be

1275
00:45:33,265 --> 00:45:34,776
used to do bad things, we're going to

1276
00:45:34,776 --> 00:45:36,367
find you regardless of the guard rails.

1277
00:45:37,018 --> 00:45:39,167
Yeah, Andrew, that's a good question. And and

1278
00:45:39,167 --> 00:45:41,157
again, let me say, I'm not a lawyer.

1279
00:45:41,793 --> 00:45:44,578
I'm a security person. There's a difference between

1280
00:45:44,578 --> 00:45:45,317
due diligence

1281
00:45:45,693 --> 00:45:46,743
and duke care.

1282
00:45:47,381 --> 00:45:48,280
And and

1283
00:45:48,817 --> 00:45:50,093
before vice president,

1284
00:45:50,651 --> 00:45:52,406
Harris went into office,

1285
00:45:53,044 --> 00:45:55,038
she set up a standard of do care

1286
00:45:55,038 --> 00:45:55,538
for

1287
00:45:56,409 --> 00:45:58,874
security in California, and that was the center

1288
00:45:58,874 --> 00:46:00,010
for Internet securities

1289
00:46:01,021 --> 00:46:01,657
security controls.

1290
00:46:02,373 --> 00:46:05,077
And that was, here's the minimum standards of

1291
00:46:05,077 --> 00:46:06,684
good things you gotta do to say you're

1292
00:46:06,684 --> 00:46:07,503
doing good

1293
00:46:07,881 --> 00:46:09,898
cybersecurity. So if this

1294
00:46:10,356 --> 00:46:12,990
bill does pass, maybe you know, we could

1295
00:46:12,990 --> 00:46:15,385
talk about maybe it's excessive and maybe the

1296
00:46:15,385 --> 00:46:17,704
threshold aren't set right. But maybe we should

1297
00:46:17,704 --> 00:46:21,278
talk about do care for artificial intelligence, not

1298
00:46:21,278 --> 00:46:22,390
necessarily due diligence.

1299
00:46:22,787 --> 00:46:24,455
Sure. I I think that's a great definition.

1300
00:46:25,425 --> 00:46:27,585
Because I think oftentimes we do skate by

1301
00:46:27,585 --> 00:46:29,825
on the the term due diligence because you

1302
00:46:29,825 --> 00:46:31,285
can certainly check all the boxes

1303
00:46:31,585 --> 00:46:33,045
or something like Pci,

1304
00:46:33,599 --> 00:46:35,295
N diligent, but also

1305
00:46:35,832 --> 00:46:37,587
not actually care about the data that you're

1306
00:46:37,587 --> 00:46:38,943
safeguard starting. Is that kinda of what we're

1307
00:46:38,943 --> 00:46:41,814
getting out here? Or biases or dis... How

1308
00:46:41,814 --> 00:46:43,304
the decisions that

1309
00:46:43,900 --> 00:46:46,043
the Ai made and how it impacts people?

1310
00:46:46,281 --> 00:46:48,106
Yeah. III just think if I was an

1311
00:46:48,106 --> 00:46:49,217
engineer on the other side of this law,

1312
00:46:49,376 --> 00:46:51,619
would be very, very concerned on account of

1313
00:46:51,619 --> 00:46:54,260
the non deter of decisions that are made

1314
00:46:54,260 --> 00:46:57,400
by models today and how easy it is

1315
00:46:57,780 --> 00:46:58,280
sometimes

1316
00:46:58,820 --> 00:47:00,099
to jail break.

1317
00:47:00,674 --> 00:47:01,174
Or

1318
00:47:01,791 --> 00:47:02,291
create

1319
00:47:02,669 --> 00:47:04,664
hallucinations in in the current models today because

1320
00:47:04,664 --> 00:47:07,618
we literally just don't kind of have a

1321
00:47:07,618 --> 00:47:09,949
firm understanding of of white how to avoid

1322
00:47:09,949 --> 00:47:11,150
that yet at a...

1323
00:47:11,869 --> 00:47:14,030
Like a design level. Do you think we're

1324
00:47:14,030 --> 00:47:15,469
back to the conversation where,

1325
00:47:16,429 --> 00:47:18,369
legislators don't understand the technology

1326
00:47:18,684 --> 00:47:20,590
We we never... Yeah. We... I don't think

1327
00:47:20,590 --> 00:47:22,894
we've ever left it anytime that. Or I

1328
00:47:22,894 --> 00:47:24,324
mean legislative just legislation side.

1329
00:47:24,721 --> 00:47:25,459
Yeah. We.

1330
00:47:25,833 --> 00:47:27,599
It's it's kind of the base line. Right?

1331
00:47:28,159 --> 00:47:30,556
Pretty no problem. But III think to what

1332
00:47:30,556 --> 00:47:31,754
you're getting at. I do think that it

1333
00:47:31,754 --> 00:47:33,112
kind of runs through this a little bit.

1334
00:47:33,592 --> 00:47:35,030
It's like the challenge with any of this

1335
00:47:35,030 --> 00:47:35,530
is

1336
00:47:36,243 --> 00:47:38,235
legislators definitely don't understand technology. All you need

1337
00:47:38,235 --> 00:47:39,908
to do is look through any congressional hearing

1338
00:47:39,908 --> 00:47:42,538
on anything related technology for 4 minutes, and

1339
00:47:42,538 --> 00:47:44,941
that's, like, eminent evident. And I don't think

1340
00:47:44,941 --> 00:47:46,532
it's different at the state level honestly, that

1341
00:47:46,532 --> 00:47:47,884
you might be have a slightly have better

1342
00:47:47,884 --> 00:47:48,282
hit chance.

1343
00:47:49,077 --> 00:47:50,350
So. I'm not, I... I'm not sure how

1344
00:47:50,429 --> 00:47:52,673
I feel about this 1II

1345
00:47:52,673 --> 00:47:54,745
like the idea of getting some controls around

1346
00:47:54,825 --> 00:47:57,057
Ai because I do feel like, societal. We're

1347
00:47:57,057 --> 00:47:58,731
a little bit too Gun h, you know,

1348
00:47:59,049 --> 00:47:59,766
let's let's go.

1349
00:48:00,498 --> 00:48:02,010
I don't know that anyone's actually got a

1350
00:48:02,010 --> 00:48:02,964
good approach to it yet.

1351
00:48:03,998 --> 00:48:06,226
Establishing some baseline of duke care seems like

1352
00:48:06,226 --> 00:48:08,786
a potential angle I think the idea behind

1353
00:48:08,786 --> 00:48:10,536
this law from what I can see in

1354
00:48:10,536 --> 00:48:12,206
the article of, like, trying to create some

1355
00:48:12,206 --> 00:48:13,661
liability is also

1356
00:48:14,036 --> 00:48:16,280
an interesting 1. You're, going down the road

1357
00:48:16,280 --> 00:48:18,371
of, like, creating legal liability about not man

1358
00:48:18,429 --> 00:48:20,816
specific actions. In some ways, this kind of

1359
00:48:20,816 --> 00:48:22,983
leaves with more leash to the companies to

1360
00:48:22,983 --> 00:48:24,340
say, like, hey, it's up to you to

1361
00:48:24,340 --> 00:48:26,016
protect yourselves how you want, but know that

1362
00:48:26,016 --> 00:48:27,773
if this happens, you know, you're on the

1363
00:48:27,773 --> 00:48:29,050
hook for it. In some ways I kinda

1364
00:48:29,050 --> 00:48:31,126
like that approach better than having specific standards.

1365
00:48:32,018 --> 00:48:33,213
Because Pacific standards is like, I don't know,

1366
00:48:33,292 --> 00:48:35,124
in my experience when doing audits and stuff,

1367
00:48:35,284 --> 00:48:37,115
they very quickly become a box checking exercise

1368
00:48:37,115 --> 00:48:38,868
and not something that people are actually are

1369
00:48:38,868 --> 00:48:40,541
sweating that do with my my 2 cents.

1370
00:48:41,592 --> 00:48:43,747
There are some some basic behaviors I think

1371
00:48:43,747 --> 00:48:45,683
that we can define and agree on though

1372
00:48:45,742 --> 00:48:48,215
from, you know, these things need to foundational

1373
00:48:48,215 --> 00:48:50,303
exist in order to even know that there's

1374
00:48:50,303 --> 00:48:52,455
abuse. And I... I'm gonna continue to say

1375
00:48:52,455 --> 00:48:54,846
this over and over, like, L security is

1376
00:48:54,846 --> 00:48:55,585
really an a

1377
00:48:56,041 --> 00:48:56,280
problem.

1378
00:48:56,853 --> 00:48:58,048
And if you don't at least have the

1379
00:48:58,048 --> 00:48:59,959
ability to know what data in, data out

1380
00:48:59,959 --> 00:49:01,472
for your model is and then know what

1381
00:49:01,472 --> 00:49:04,043
normal behavior is for the model, you can't

1382
00:49:04,340 --> 00:49:05,317
begin to even

1383
00:49:05,947 --> 00:49:08,014
conceive of whether or not it's being used

1384
00:49:08,014 --> 00:49:10,082
for good or for evil. That's a fair

1385
00:49:10,082 --> 00:49:11,991
point. And and then the companies need to

1386
00:49:11,991 --> 00:49:13,581
be honest as well and transparent.

1387
00:49:14,153 --> 00:49:15,907
There should be a minimum burden on on

1388
00:49:15,907 --> 00:49:18,616
time to disclose or for specific types of

1389
00:49:18,616 --> 00:49:21,326
behavior. III can certainly see Meta argument, though.

1390
00:49:21,645 --> 00:49:24,225
Yeah which I... I think the argument is

1391
00:49:24,360 --> 00:49:27,323
if we don't log, we're actually protecting people

1392
00:49:27,538 --> 00:49:29,921
because we're not potentially creating just another lake

1393
00:49:29,921 --> 00:49:31,271
of potentially sensitive data,

1394
00:49:31,842 --> 00:49:33,748
But I mean, I I don't buy that

1395
00:49:33,748 --> 00:49:34,566
for a minute

1396
00:49:35,495 --> 00:49:37,004
that there's not at least some telemetry or

1397
00:49:37,004 --> 00:49:38,354
metrics that are being used

1398
00:49:38,830 --> 00:49:40,680
internally, that couldn't be transparent

1399
00:49:41,068 --> 00:49:43,533
and leverage for security or even transparent security

1400
00:49:43,533 --> 00:49:44,726
that you could pass out to the customer.

1401
00:49:45,043 --> 00:49:46,952
Well, it's like Vpn saying they don't log.

1402
00:49:47,349 --> 00:49:49,734
Yeah. Of course, they don't. It's for your

1403
00:49:49,734 --> 00:49:50,131
safety.

1404
00:49:50,623 --> 00:49:51,818
Okay get Me started at the number of

1405
00:49:51,818 --> 00:49:54,207
people on Youtube touting Vpn as a security

1406
00:49:54,207 --> 00:49:56,198
solution. Yeah, they're selling something.

1407
00:49:56,994 --> 00:49:58,905
Privacy see. Privacy through Beef.

1408
00:49:59,400 --> 00:50:00,680
I I think we should keep track of

1409
00:50:00,680 --> 00:50:02,519
this though. I'd love to see on another

1410
00:50:02,519 --> 00:50:04,440
episode of the news, whether whether this passes

1411
00:50:04,440 --> 00:50:05,720
or fails? What kind of some of the

1412
00:50:05,720 --> 00:50:08,140
commentary is around it because it will be

1413
00:50:08,453 --> 00:50:10,442
interesting to see who goes first and see

1414
00:50:10,442 --> 00:50:12,589
how the discussion unfolds, and I think that's

1415
00:50:12,589 --> 00:50:15,055
gonna inform the next round of proposed legislation.

1416
00:50:15,864 --> 00:50:17,609
I, I'd like that also... And I I'd

1417
00:50:17,609 --> 00:50:20,147
also like to see if anybody could track

1418
00:50:20,147 --> 00:50:22,075
lobbyists obvious related to this

1419
00:50:22,623 --> 00:50:24,480
is out of my and curiosity?

1420
00:50:24,857 --> 00:50:25,097
Mh.

1421
00:50:25,815 --> 00:50:27,410
I think we know that there's a a

1422
00:50:27,410 --> 00:50:29,085
strong opinion from the tech companies.

1423
00:50:29,659 --> 00:50:31,018
But who would be on the other side?

1424
00:50:31,257 --> 00:50:32,935
Who would not want is the who who

1425
00:50:32,935 --> 00:50:34,933
would wanna see more Ai protections?

1426
00:50:35,732 --> 00:50:38,302
I would assume saying people, Ef efs. Would

1427
00:50:38,302 --> 00:50:40,525
be... Yeah. Yeah on the kind of the

1428
00:50:40,525 --> 00:50:42,114
forefront of that. So, you know, if you

1429
00:50:42,114 --> 00:50:44,337
haven't pulled out your wallet this year, attendees,

1430
00:50:44,655 --> 00:50:45,155
few

1431
00:50:45,608 --> 00:50:47,926
to donate to the Ef f, that was

1432
00:50:47,926 --> 00:50:49,915
maybe the time. So they've got.

1433
00:50:50,472 --> 00:50:53,336
Ac cl. Ac l. The E efs is

1434
00:50:53,336 --> 00:50:55,404
having... They they've just got a new bunch

1435
00:50:55,404 --> 00:50:58,074
of new... Swipe that they're out there raising

1436
00:50:58,295 --> 00:51:00,054
with... I really, somewhat interestingly

1437
00:51:01,015 --> 00:51:03,275
Is kind of at the forefront of the

1438
00:51:03,335 --> 00:51:07,178
definitions for ai security problems. Obviously, Doesn't get

1439
00:51:07,178 --> 00:51:09,728
involved at a a regulatory level, but, is

1440
00:51:09,728 --> 00:51:11,161
certainly doing a lot of raise awareness.

1441
00:51:11,734 --> 00:51:13,724
And that's just that's just people that are

1442
00:51:13,724 --> 00:51:15,715
concerned with privacy with just, you know, consumers

1443
00:51:15,715 --> 00:51:17,865
of stuff in general because this is this

1444
00:51:17,865 --> 00:51:19,457
is starting to become kinda of that insane

1445
00:51:19,457 --> 00:51:21,386
thing that gets... Just thrown into all sorts

1446
00:51:21,386 --> 00:51:23,539
of products being like, hey. Guess you're... It's

1447
00:51:23,539 --> 00:51:25,852
like there's going to be something tomorrow that

1448
00:51:25,852 --> 00:51:27,607
you wake up and you go, hey, good

1449
00:51:27,607 --> 00:51:29,282
news. We added Ai to the thing that

1450
00:51:29,282 --> 00:51:31,694
you use and everybody wants to collectively yell

1451
00:51:31,694 --> 00:51:31,934
no.

1452
00:51:32,574 --> 00:51:34,335
But it's going to happen on, like, a

1453
00:51:34,335 --> 00:51:36,014
day by day, week, by week basis that

1454
00:51:36,014 --> 00:51:38,183
it's like, okay. You know, this product now

1455
00:51:38,183 --> 00:51:40,010
with Ai, now with more Ai.

1456
00:51:40,726 --> 00:51:42,179
So there would be that

1457
00:51:42,554 --> 00:51:43,054
concern

1458
00:51:43,428 --> 00:51:45,494
for Well, hey, is this being secure because

1459
00:51:45,494 --> 00:51:47,500
now you've just you put Ai into my

1460
00:51:47,500 --> 00:51:49,971
television now, You put Ai into, you know,

1461
00:51:50,050 --> 00:51:52,202
like I have an Ai enabled coffee mug

1462
00:51:52,202 --> 00:51:54,608
apparently, like, why who asked for that? And

1463
00:51:54,608 --> 00:51:56,834
it it seems like it's the era, like,

1464
00:51:56,993 --> 00:51:59,379
adding Bluetooth and Wifi Into all sorts of

1465
00:51:59,379 --> 00:52:01,367
things like, why does my why does my

1466
00:52:01,367 --> 00:52:02,401
water bottle only Bluetooth?

1467
00:52:02,892 --> 00:52:05,116
So having Ai injected into a bunch of

1468
00:52:05,116 --> 00:52:06,625
thing consumers are going to sit there and

1469
00:52:06,625 --> 00:52:06,942
say,

1470
00:52:07,577 --> 00:52:07,816
well,

1471
00:52:08,848 --> 00:52:11,324
is anybody like, thinking this through, what... What's

1472
00:52:11,324 --> 00:52:13,229
the security What's the privacy around this? What,

1473
00:52:13,388 --> 00:52:15,237
you know, how does this impact me? Because

1474
00:52:15,531 --> 00:52:17,833
I I don't wanna start using a product

1475
00:52:17,833 --> 00:52:18,492
that has,

1476
00:52:18,944 --> 00:52:19,262
you know,

1477
00:52:19,914 --> 00:52:20,793
unregulated Ai.

1478
00:52:21,512 --> 00:52:21,992
That question.

1479
00:52:22,551 --> 00:52:24,309
If we've got Bluetooth and Ai in our

1480
00:52:24,309 --> 00:52:26,228
coffee bugs, how come we have a put

1481
00:52:26,228 --> 00:52:28,785
bluetooth on our toilet paper rolls when they're

1482
00:52:28,785 --> 00:52:28,865
empty?

1483
00:52:29,679 --> 00:52:32,872
Exactly. I'm gonna... When after this call, it's

1484
00:52:32,872 --> 00:52:34,788
it's gonna get past... Gonna happen. I'm gonna

1485
00:52:34,788 --> 00:52:36,384
look at that off after this call? It

1486
00:52:36,384 --> 00:52:38,401
be like, are there Bluetooth enabled

1487
00:52:38,795 --> 00:52:39,614
toilet roll

1488
00:52:41,275 --> 00:52:43,914
You can always tell sensor there. Yeah. You

1489
00:52:43,914 --> 00:52:45,994
can somewhere about 45 minutes in when these

1490
00:52:45,994 --> 00:52:48,001
are the ideas start tapping a new conversation.

1491
00:52:48,796 --> 00:52:51,021
I mean, that's a that's a brilliant idea

1492
00:52:51,021 --> 00:52:52,952
if you could, you know, kind of know

1493
00:52:53,008 --> 00:52:54,280
how much of the role is left in

1494
00:52:54,280 --> 00:52:55,472
a dashboard of some kind.

1495
00:52:56,123 --> 00:52:58,430
Oh, my god. Great. Safe. You just have

1496
00:52:58,430 --> 00:53:00,657
like a full dashboard on Tv. Oh my

1497
00:53:00,657 --> 00:53:02,885
god. Alright. Big think of how much housekeeping...

1498
00:53:03,059 --> 00:53:04,735
Per time, you would save it like a

1499
00:53:04,735 --> 00:53:07,368
marriott, if you could know whether or not

1500
00:53:07,368 --> 00:53:08,405
you need to go in the bathroom in

1501
00:53:08,405 --> 00:53:10,001
the first place to replace a toilet paper

1502
00:53:10,001 --> 00:53:10,161
roll.

1503
00:53:10,974 --> 00:53:12,561
Let's go something we're serious. How about we

1504
00:53:12,561 --> 00:53:16,475
talk about midnight blizzard maybe. Midnight. Look... I

1505
00:53:16,531 --> 00:53:18,436
the, but the headline looked interesting. I saw

1506
00:53:18,436 --> 00:53:20,199
it... Has anyone actually got the full details

1507
00:53:20,199 --> 00:53:21,471
us, so I know this was the hack

1508
00:53:21,471 --> 00:53:22,527
from back in January

1509
00:53:22,981 --> 00:53:24,650
that pre this, and we had

1510
00:53:25,286 --> 00:53:27,671
midnight lizard monkey around in Microsoft with emails.

1511
00:53:28,083 --> 00:53:29,436
It sounds like there's more to it now.

1512
00:53:29,595 --> 00:53:31,265
And is that kind of... Yeah. We're we're

1513
00:53:31,265 --> 00:53:32,777
kinda just seeing the the fallout out of

1514
00:53:32,777 --> 00:53:34,686
midnight blizzard still kind of move through government.

1515
00:53:35,099 --> 00:53:36,857
And I think that's the interesting thing about

1516
00:53:36,857 --> 00:53:38,775
this is that, you know, we said, I...

1517
00:53:39,014 --> 00:53:41,172
Probably a dozen episodes ago. You know, we're

1518
00:53:41,172 --> 00:53:42,610
we're gonna hear about this for a long

1519
00:53:42,610 --> 00:53:42,770
time.

1520
00:53:43,502 --> 00:53:45,963
And we still certainly are. Is this

1521
00:53:46,835 --> 00:53:49,637
is this article about them going after the

1522
00:53:50,090 --> 00:53:51,757
Us department, veterans affairs?

1523
00:53:52,410 --> 00:53:53,869
Correct. For impacted

1524
00:53:54,250 --> 00:53:56,969
organizations. Right? Yep. Yeah. Some of these some

1525
00:53:56,969 --> 00:53:59,289
of these attacks, especially this 1, yeah. You're

1526
00:53:59,289 --> 00:54:00,972
gonna like you said, see the fallout for

1527
00:54:00,972 --> 00:54:02,953
a long time. Right? It just feels like...

1528
00:54:03,111 --> 00:54:04,220
And the other thing too is that I

1529
00:54:04,220 --> 00:54:06,280
feel like some information gets kept close to

1530
00:54:06,280 --> 00:54:08,285
the chest. So we don't get it until

1531
00:54:08,285 --> 00:54:09,880
it's much later even though it's been known.

1532
00:54:10,039 --> 00:54:11,395
Right? Yep. But I think this is gonna

1533
00:54:11,395 --> 00:54:13,069
be kind of the theme of 20 24

1534
00:54:13,069 --> 00:54:14,744
as we saw all these, you know, sort

1535
00:54:14,744 --> 00:54:16,155
of non production based

1536
00:54:17,232 --> 00:54:18,190
initial access vectors.

1537
00:54:18,749 --> 00:54:20,585
And now we're sort of seeing and play

1538
00:54:20,585 --> 00:54:22,261
out over the rest of the year. But

1539
00:54:22,261 --> 00:54:24,177
non production is continues to be a big

1540
00:54:24,177 --> 00:54:25,030
theme for 20 20

1541
00:54:26,507 --> 00:54:28,685
His non production isn't really non production most

1542
00:54:28,824 --> 00:54:29,943
organizations when you get down end into it.

1543
00:54:30,502 --> 00:54:30,901
Yeah.

1544
00:54:31,381 --> 00:54:32,911
That's kind of like the anything from, like,

1545
00:54:32,990 --> 00:54:36,012
a security model. It... It's, like, pre production.

1546
00:54:36,251 --> 00:54:37,841
I I think maybe that's what they should

1547
00:54:37,841 --> 00:54:39,750
be saying because they... You know, they're using

1548
00:54:39,750 --> 00:54:42,237
it like production, and then they're just

1549
00:54:42,548 --> 00:54:44,383
moving the same code over, but it sounds

1550
00:54:44,383 --> 00:54:45,760
like those secrets are not

1551
00:54:46,297 --> 00:54:48,052
necessarily separated as much as you would think.

1552
00:54:48,531 --> 00:54:49,966
And especially when you get into this really

1553
00:54:49,966 --> 00:54:52,120
large organizations like Microsoft, for example,

1554
00:54:53,012 --> 00:54:55,164
who values your security and privacy very highly.

1555
00:54:55,324 --> 00:54:57,237
You're gonna run into issues that, you know,

1556
00:54:57,954 --> 00:54:59,230
there might be some bleed over, which is

1557
00:54:59,230 --> 00:55:00,800
what happened. Right? I mean, just give it

1558
00:55:00,919 --> 00:55:03,074
some time for, you know, a nation state

1559
00:55:03,074 --> 00:55:06,105
to find out what you don't want other

1560
00:55:06,105 --> 00:55:08,020
people that know. So... Yep. The other thing

1561
00:55:08,020 --> 00:55:10,128
with That size as you get the the

1562
00:55:10,265 --> 00:55:12,255
localization problem. Right? Where you have the different

1563
00:55:12,255 --> 00:55:13,847
pockets of the organization operate in different ways.

1564
00:55:14,086 --> 00:55:15,838
So even if an Org as a whole

1565
00:55:15,838 --> 00:55:17,369
is in a good spot. You will find

1566
00:55:17,369 --> 00:55:18,809
the local spot where we've got, you know,

1567
00:55:19,289 --> 00:55:21,690
the the rogue resources, you know, from that

1568
00:55:21,690 --> 00:55:23,609
last dev exercise we did sitting over there

1569
00:55:23,609 --> 00:55:25,929
on... That's be vulnerable and waiting to get

1570
00:55:25,929 --> 00:55:26,089
popped.

1571
00:55:28,090 --> 00:55:30,155
Good. So, oh, I was just summit...

1572
00:55:31,583 --> 00:55:33,409
Brian brought the the Japan,

1573
00:55:34,203 --> 00:55:36,523
winning the war against flat. Or Bagel? Excellent.

1574
00:55:36,761 --> 00:55:38,828
Sorry, Bro. Yeah. I'll got jump in on

1575
00:55:38,828 --> 00:55:41,134
it. So... Yeah. I I saw the article

1576
00:55:41,134 --> 00:55:41,690
in our list,

1577
00:55:42,565 --> 00:55:44,871
Japan's good government finally stops using floppy disc.

1578
00:55:45,682 --> 00:55:47,778
And there's this a funny quote and it

1579
00:55:48,155 --> 00:55:51,186
they finally, quote won the war on floppy

1580
00:55:51,186 --> 00:55:52,382
discs. Because I did not know there was

1581
00:55:52,382 --> 00:55:54,137
a war on floppy discs going on in

1582
00:55:54,376 --> 00:55:57,424
Japan. Mean a cold war. Just they won.

1583
00:55:57,903 --> 00:55:59,340
So congratulations to Japan.

1584
00:56:01,416 --> 00:56:03,651
The considerations to club having ventures.

1585
00:56:04,383 --> 00:56:06,290
Having lived in Japan 20 years ago at

1586
00:56:06,290 --> 00:56:08,674
a time when 24 hour Atms, this is

1587
00:56:08,674 --> 00:56:10,184
20 years ago, we're talking, like, you know,

1588
00:56:10,422 --> 00:56:12,027
like, around 2024

1589
00:56:12,027 --> 00:56:14,334
hour Atms were a new innovation. It doesn't

1590
00:56:14,334 --> 00:56:15,845
shock me to see this story at all.

1591
00:56:16,720 --> 00:56:18,550
I I feel like floppy disk like a...

1592
00:56:18,804 --> 00:56:21,041
Security feature at this point. You know? Well

1593
00:56:21,041 --> 00:56:21,681
many people. Yeah.

1594
00:56:22,480 --> 00:56:24,078
3 and a half or a 5 and

1595
00:56:24,078 --> 00:56:26,395
a quarter, even read a floppy disc. Right?

1596
00:56:26,889 --> 00:56:28,403
I mean, I mean, I wanna even plug

1597
00:56:28,403 --> 00:56:29,838
that anxious even know what a floppy disc

1598
00:56:29,838 --> 00:56:31,034
is. Wow. You... Even...

1599
00:56:33,345 --> 00:56:35,853
It's not a floppy disk it's the save

1600
00:56:35,990 --> 00:56:36,468
icon. Yeah.

1601
00:56:37,264 --> 00:56:37,764
Say.

1602
00:56:38,698 --> 00:56:40,769
Why do you have save icon. Yep. Even

1603
00:56:40,769 --> 00:56:42,920
though optical disks are in security feature at

1604
00:56:42,920 --> 00:56:43,637
this point. I mean,

1605
00:56:45,486 --> 00:56:47,082
I I've bumped into so many people that

1606
00:56:47,161 --> 00:56:49,156
I've been meant mentor and that that they

1607
00:56:49,156 --> 00:56:50,672
they don't have a floppy drive and they've

1608
00:56:50,672 --> 00:56:51,470
never even used 1.

1609
00:56:52,440 --> 00:56:54,982
0 not, an optical drive. Yeah. And then

1610
00:56:54,982 --> 00:56:57,921
it's, dvd, blu ray, all of it. It's

1611
00:56:57,921 --> 00:56:59,529
kind of book. K. Going in the way.

1612
00:56:59,768 --> 00:57:01,367
You can get that on a playstation. Right?

1613
00:57:01,607 --> 00:57:03,125
It's got a slot in the side that

1614
00:57:03,125 --> 00:57:04,004
you. Yeah yeah.

1615
00:57:04,883 --> 00:57:06,721
Sounds like the 5 year old model. The

1616
00:57:06,721 --> 00:57:08,375
new model, they pulled that 1

1617
00:57:09,527 --> 00:57:11,513
Is that right? There's no Dvd drive on

1618
00:57:11,513 --> 00:57:15,406
a new playstation? Yeah. I brothers. So you

1619
00:57:15,406 --> 00:57:17,884
don't get an either either flavor. Yeah. Oh.

1620
00:57:18,122 --> 00:57:19,893
Did so this this floppy

1621
00:57:20,505 --> 00:57:23,761
feature or this floppy article? Didn't the nuclear

1622
00:57:23,761 --> 00:57:25,111
arsenal of the Us just...

1623
00:57:26,405 --> 00:57:26,724
Finally,

1624
00:57:27,204 --> 00:57:28,405
end of like... 20 19.

1625
00:57:28,885 --> 00:57:28,965
Yeah.

1626
00:57:29,765 --> 00:57:31,284
Yeah. Yeah. Mean they actually mentioned in the

1627
00:57:31,284 --> 00:57:32,905
article. Yeah. Mh.

1628
00:57:33,537 --> 00:57:35,840
That... They actually touted it as a security

1629
00:57:35,840 --> 00:57:38,302
feature, though, why they were holding onto to

1630
00:57:38,302 --> 00:57:40,843
it. So I I don't know if that's

1631
00:57:40,843 --> 00:57:42,871
actually. A good use case. But

1632
00:57:43,329 --> 00:57:43,409
anyhow,

1633
00:57:44,207 --> 00:57:45,244
now. Media is dead.

1634
00:57:46,042 --> 00:57:47,239
It's all digital now.

1635
00:57:48,835 --> 00:57:48,969
A

1636
00:57:49,726 --> 00:57:51,875
So apparently, there is really a smart toilet

1637
00:57:51,875 --> 00:57:52,671
paper monitor. Yeah.

1638
00:57:55,615 --> 00:57:57,765
When everyone else is Googling this right now,

1639
00:57:58,163 --> 00:57:58,561
literally.

1640
00:58:01,371 --> 00:58:02,511
Where 1.

1641
00:58:02,890 --> 00:58:05,208
We chatted the research for us. Oh. That

1642
00:58:05,208 --> 00:58:06,886
was what's the second 1. Yeah. Because I

1643
00:58:06,886 --> 00:58:07,925
we my phone 1 earlier.

1644
00:58:08,498 --> 00:58:10,166
We all work in security, so unless we're

1645
00:58:10,166 --> 00:58:11,516
doing research on it. None of us are

1646
00:58:11,516 --> 00:58:13,343
gonna have this in our house. Right? Yes.

1647
00:58:14,058 --> 00:58:16,362
Yes. I I just wanna hack this so

1648
00:58:16,521 --> 00:58:18,444
I can find out really how much toilet

1649
00:58:18,444 --> 00:58:20,282
paper you're using. Right? Like, I just wanna

1650
00:58:20,282 --> 00:58:22,119
play doom I wouldn't play doom on it.

1651
00:58:23,557 --> 00:58:25,235
But if you can get it to report

1652
00:58:25,235 --> 00:58:26,709
back, like, false positive

1653
00:58:27,241 --> 00:58:29,703
data, You could potentially dust somebody with toilet

1654
00:58:29,703 --> 00:58:30,101
paper.

1655
00:58:32,245 --> 00:58:33,992
Oh, denial of that super time.

1656
00:58:34,563 --> 00:58:36,786
That's you. This goes back to the seinfeld

1657
00:58:36,786 --> 00:58:39,248
filled episode of Elaine asking, can you Spare

1658
00:58:39,248 --> 00:58:39,724
a square?

1659
00:58:40,439 --> 00:58:40,916
Yes.

1660
00:58:41,551 --> 00:58:42,186
Very important.

1661
00:58:43,236 --> 00:58:44,670
Speak to the things that are as old

1662
00:58:44,670 --> 00:58:45,467
as the floppy.

1663
00:58:47,619 --> 00:58:47,938
True.

1664
00:58:49,292 --> 00:58:51,853
Oh my gosh. Did do did we talk

1665
00:58:52,251 --> 00:58:52,989
last week

1666
00:58:53,603 --> 00:58:55,216
about the the Trello

1667
00:58:55,671 --> 00:58:56,807
auth 2 factor

1668
00:58:58,469 --> 00:58:59,185
phone number breach?

1669
00:59:00,298 --> 00:59:01,571
This 1 was kinda mid.

1670
00:59:02,287 --> 00:59:05,071
Yeah. I happened between the 2. What's up?

1671
00:59:05,643 --> 00:59:07,871
I think it happened in in between last

1672
00:59:07,871 --> 00:59:08,587
month now.

1673
00:59:09,304 --> 00:59:10,019
Talk about it, Ralph.

1674
00:59:11,293 --> 00:59:13,535
Yeah. So, I guess, Trello,

1675
00:59:15,363 --> 00:59:16,657
lost a bunch of phone numbers

1676
00:59:17,429 --> 00:59:19,677
for their 2 factor app our... So

1677
00:59:20,052 --> 00:59:21,744
Trello has this

1678
00:59:22,054 --> 00:59:23,883
2 factor app called Auth,

1679
00:59:24,440 --> 00:59:26,372
and it's kind of like their own rollout

1680
00:59:26,429 --> 00:59:28,896
of, you know, 1 time password, you know,

1681
00:59:29,229 --> 00:59:31,776
similar to the Google authenticator. Right? I'm pretty

1682
00:59:31,776 --> 00:59:33,607
sure it's compliant so you can add those

1683
00:59:34,483 --> 00:59:36,552
1 time passwords inside of this application.

1684
00:59:37,204 --> 00:59:39,029
But it uses phone numbers inside of it

1685
00:59:39,029 --> 00:59:41,965
to do the authentication process as well, and,

1686
00:59:42,996 --> 00:59:46,429
attackers manage to access those accounts and,

1687
00:59:46,908 --> 00:59:49,384
a bunch of off the accounts. And then

1688
00:59:49,384 --> 00:59:51,302
in turn, they ended up getting a lot

1689
00:59:51,302 --> 00:59:51,541
of,

1690
00:59:52,340 --> 00:59:52,660
phone number.

1691
00:59:53,551 --> 00:59:53,710
Yeah,

1692
00:59:54,506 --> 00:59:55,939
So I think it was like, 33000000?

1693
00:59:56,337 --> 00:59:57,611
Yeah. I think it was it was around

1694
00:59:57,611 --> 00:59:58,907
that, and they also

1695
00:59:59,283 --> 00:59:59,783
specifically

1696
01:00:00,318 --> 01:00:02,246
were I built, identify the ones that used

1697
01:00:02,246 --> 01:00:03,522
I'll be if I remember correctly.

1698
01:00:04,001 --> 01:00:06,713
Yeah. Yeah. So kind of interesting. Phone number

1699
01:00:06,713 --> 01:00:08,627
is also pretty powerful too and you're like,

1700
01:00:08,786 --> 01:00:10,860
what? Why? It's because they can be using

1701
01:00:10,860 --> 01:00:13,185
the social engineering, like, a attack chain. Right?

1702
01:00:13,424 --> 01:00:15,496
Getting someone on the phone, having some information

1703
01:00:15,496 --> 01:00:17,089
about them, being able to connect the person

1704
01:00:17,089 --> 01:00:19,738
with the phone number, and then, possibly with

1705
01:00:19,738 --> 01:00:21,656
their 2 factor application or 2, you know,

1706
01:00:21,736 --> 01:00:23,894
auth or whatever it is. Right? These also

1707
01:00:23,894 --> 01:00:26,291
can be used in more sophisticated attack chains

1708
01:00:26,291 --> 01:00:29,421
to gain access to accounts. So... Yep. And

1709
01:00:29,421 --> 01:00:31,496
and and scams and all kinds of things.

1710
01:00:31,735 --> 01:00:33,571
Oh, yeah. The list goes on and on

1711
01:00:33,571 --> 01:00:35,965
and on, but auth encourage you to have

1712
01:00:35,965 --> 01:00:39,005
a. Heighten awareness around text that you are

1713
01:00:39,005 --> 01:00:39,402
receiving.

1714
01:00:39,880 --> 01:00:42,267
Or maybe you just don't use Sms for

1715
01:00:42,267 --> 01:00:44,495
2 fa if care. Yes. And can we

1716
01:00:44,495 --> 01:00:47,954
just talk about that every website that has

1717
01:00:48,011 --> 01:00:51,035
only Sms for authentication is bad.

1718
01:00:51,671 --> 01:00:55,188
Additionally, every website that only has email for

1719
01:00:55,188 --> 01:00:57,422
your 2 factor, that's not 2 factor. Like,

1720
01:00:57,661 --> 01:01:00,532
that's, like, you... You're... If I have access

1721
01:01:00,532 --> 01:01:01,889
to your email, then I have access to,

1722
01:01:01,968 --> 01:01:03,585
like, everything then. It's it's

1723
01:01:04,521 --> 01:01:07,160
else? I'm mostly doing on that, although, if

1724
01:01:07,160 --> 01:01:08,988
you if you had to have them have

1725
01:01:09,306 --> 01:01:10,021
Sms or nothing.

1726
01:01:10,657 --> 01:01:12,485
I'd still take the Sms. It's still something.

1727
01:01:12,899 --> 01:01:14,731
Yeah. Yeah. And so because you're... You know,

1728
01:01:14,890 --> 01:01:16,325
you know the way most companies would react

1729
01:01:16,325 --> 01:01:17,838
if we all just said Sms is worthless,

1730
01:01:17,918 --> 01:01:19,273
so they would just drop Sms and not

1731
01:01:19,273 --> 01:01:19,830
replace with anything.

1732
01:01:20,403 --> 01:01:20,903
Yeah

1733
01:01:21,839 --> 01:01:23,355
You know, It's just too... It's too different

1734
01:01:23,355 --> 01:01:25,668
say We've lost it. Yes. We've lost it.

1735
01:01:26,067 --> 01:01:28,140
Ask can I wanna are really making headway?

1736
01:01:28,300 --> 01:01:30,149
So, like, pas keys are the answer. To

1737
01:01:30,149 --> 01:01:32,855
this. The answer to the democrat amortization problem

1738
01:01:32,935 --> 01:01:35,164
And. What if I can't afford a smartphone

1739
01:01:35,164 --> 01:01:37,711
problem. So so, yes. The past keys, I

1740
01:01:37,711 --> 01:01:40,274
think are the answer, and they might be

1741
01:01:40,274 --> 01:01:42,345
the answer to kinda of the password in

1742
01:01:42,345 --> 01:01:45,053
general. Right? But they do have a couple

1743
01:01:45,053 --> 01:01:46,725
little nuances for people who haven't set this

1744
01:01:46,725 --> 01:01:48,567
up. 1 is that the security feature of

1745
01:01:48,567 --> 01:01:50,551
rap pas is you can't make a copy

1746
01:01:50,551 --> 01:01:52,377
of a past. Right? So you can't actually

1747
01:01:52,377 --> 01:01:54,361
move a pas from 1 account to another

1748
01:01:54,361 --> 01:01:57,184
account or another device or whatever. So the

1749
01:01:57,244 --> 01:01:58,925
solution is you just add more pass keys

1750
01:01:58,925 --> 01:01:59,804
to your account.

1751
01:02:00,204 --> 01:02:01,484
So you just, you know, put it on

1752
01:02:01,484 --> 01:02:03,496
a bunch of different devices. Right? But the

1753
01:02:03,496 --> 01:02:05,883
benefit is, obviously, there's no password. Right? And

1754
01:02:05,883 --> 01:02:08,110
it's associated with your account. So technically, a

1755
01:02:08,110 --> 01:02:09,883
website can just ask for a pass

1756
01:02:10,195 --> 01:02:12,994
And when you respond back in that, challenge

1757
01:02:12,994 --> 01:02:15,235
response, it'll know which account it belongs to

1758
01:02:15,235 --> 01:02:16,675
because no 2 people can have a same

1759
01:02:16,675 --> 01:02:17,369
capacity. So

1760
01:02:17,967 --> 01:02:20,517
wasn't there... And I I might be remembering

1761
01:02:20,517 --> 01:02:22,589
something wrong, but weren't some of the dealer

1762
01:02:22,589 --> 01:02:23,567
logs actually

1763
01:02:24,182 --> 01:02:24,682
intercept

1764
01:02:25,154 --> 01:02:28,264
the the pesky transmissions and and being able

1765
01:02:28,264 --> 01:02:28,764
to

1766
01:02:29,221 --> 01:02:31,215
basically compromise accounts through that?

1767
01:02:32,012 --> 01:02:34,006
I am not aware of that. So the

1768
01:02:34,006 --> 01:02:37,123
way the past keys work is that it's

1769
01:02:37,123 --> 01:02:40,064
pretty much a challenge and response. It it's

1770
01:02:40,064 --> 01:02:41,018
it's equivalent of, like,

1771
01:02:41,892 --> 01:02:44,296
certificate Right? And it's a bit more complex

1772
01:02:44,296 --> 01:02:45,730
than that, So I'm not gonna, like, sugar

1773
01:02:45,730 --> 01:02:47,164
coat it that I know every single detail.

1774
01:02:47,403 --> 01:02:50,111
But the 1 detail that I know about

1775
01:02:50,111 --> 01:02:52,757
their functionality is that you can't man in

1776
01:02:52,757 --> 01:02:55,150
the middle these. Okay? So you can't capture

1777
01:02:55,150 --> 01:02:57,065
the traffic or replay that traffic in the

1778
01:02:57,065 --> 01:02:59,632
middle, be able to compromise the key. Right?

1779
01:02:59,871 --> 01:03:01,143
The 1 device that signed it is the

1780
01:03:01,143 --> 01:03:03,371
only device that can utilize it, which is

1781
01:03:03,371 --> 01:03:05,302
why you can't transfer these keys to other

1782
01:03:05,439 --> 01:03:07,688
devices. Like, you can add a pass key

1783
01:03:07,688 --> 01:03:09,765
on your phone and then move that to

1784
01:03:09,765 --> 01:03:12,241
a different kind of device that supports pass

1785
01:03:12,241 --> 01:03:14,330
keys if that makes sense. Right? Yep. Is

1786
01:03:14,330 --> 01:03:16,955
the is the past key used for every

1787
01:03:16,955 --> 01:03:20,057
single transaction that happens. So every... Like, I'll...

1788
01:03:20,217 --> 01:03:22,046
You know, you sign to a web application?

1789
01:03:22,460 --> 01:03:25,096
And your browser is assigned a session cookie

1790
01:03:25,096 --> 01:03:27,413
or a session token. And then that token

1791
01:03:27,413 --> 01:03:29,650
goes back and forth in every request. So

1792
01:03:29,730 --> 01:03:32,058
Yeah. Is the past key used in every

1793
01:03:32,058 --> 01:03:33,971
single request? Or are you still getting a

1794
01:03:33,971 --> 01:03:36,284
session token you're... That you... On Hold on.

1795
01:03:36,443 --> 01:03:37,798
So the... Wait thing is. You will get

1796
01:03:37,798 --> 01:03:40,304
a session token. But the problem is your

1797
01:03:40,758 --> 01:03:43,144
authentication will fail if someone's in the middle

1798
01:03:43,144 --> 01:03:46,324
to intercept that session token. Right? But but

1799
01:03:46,324 --> 01:03:48,733
your cookie could still be stolen by a

1800
01:03:48,964 --> 01:03:51,279
steal or some other form of malware. Right?

1801
01:03:51,518 --> 01:03:53,275
I'm already logged in or you had a

1802
01:03:53,275 --> 01:03:56,787
valid session on that site, then yes. The

1803
01:03:56,787 --> 01:03:58,876
pass would not protect you. What it does

1804
01:03:58,876 --> 01:04:00,311
protect you is is if you try to

1805
01:04:00,311 --> 01:04:02,464
get in the middle to wait until that

1806
01:04:02,464 --> 01:04:05,175
session token gets involved when they send that

1807
01:04:05,175 --> 01:04:07,979
pas, it won't authenticate. Got you. So it's

1808
01:04:07,979 --> 01:04:10,048
a solution to say things like adversary in

1809
01:04:10,048 --> 01:04:12,674
the middle, but not necessarily a think a

1810
01:04:12,674 --> 01:04:15,473
solution to steal malware. Yeah. Well, yeah. Because

1811
01:04:15,473 --> 01:04:16,984
still malware where if you're already logged in

1812
01:04:16,984 --> 01:04:18,813
and that and that session token, that Hvac

1813
01:04:18,813 --> 01:04:20,801
is on your on your device or whatever,

1814
01:04:21,438 --> 01:04:23,982
other authentication mechanism they're using it most likely

1815
01:04:23,982 --> 01:04:24,141
cookie.

1816
01:04:24,873 --> 01:04:26,465
Yeah. They're they're gonna have access to that.

1817
01:04:26,624 --> 01:04:28,694
So... Yeah. Gotcha. Just just think of Pass

1818
01:04:28,694 --> 01:04:30,446
keys is it's, like, a T pm backed

1819
01:04:30,446 --> 01:04:30,946
hardware

1820
01:04:31,402 --> 01:04:33,985
implementation of a web then dongle, like a

1821
01:04:34,041 --> 01:04:36,105
key or something. So these are words. Sure.

1822
01:04:36,264 --> 01:04:38,328
It is. But it but it's digital. So

1823
01:04:38,328 --> 01:04:39,701
it you don't need

1824
01:04:40,154 --> 01:04:42,034
a key to do past

1825
01:04:42,474 --> 01:04:44,391
Right? Like, you it's not... You don't need

1826
01:04:44,391 --> 01:04:45,670
that third party device. You don't have to

1827
01:04:45,670 --> 01:04:48,467
go buy a device, which allows more people

1828
01:04:48,467 --> 01:04:51,353
to get into it without having to go

1829
01:04:51,353 --> 01:04:53,421
buy a U key or whatever other, you

1830
01:04:53,421 --> 01:04:56,147
know, 2 factors. It's it's. It's democrat

1831
01:04:56,601 --> 01:04:59,862
the... Yes. The the improved second factor dance.

1832
01:05:00,434 --> 01:05:00,911
Mh.

1833
01:05:01,547 --> 01:05:03,775
I I just... I personally wish Shoe keys

1834
01:05:03,775 --> 01:05:07,138
were more readily available and and more... And

1835
01:05:07,449 --> 01:05:08,906
more affordable and and

1836
01:05:09,363 --> 01:05:10,661
accessible the the general

1837
01:05:11,277 --> 01:05:13,909
non tech population. Mean, that... That's the legislation

1838
01:05:13,909 --> 01:05:15,983
that we need Is it or and every

1839
01:05:15,983 --> 01:05:17,753
time you pay your justices. Like, when you

1840
01:05:17,753 --> 01:05:19,349
turn in your federal return and they just...

1841
01:05:19,828 --> 01:05:20,328
Data

1842
01:05:20,786 --> 01:05:22,940
mail you these things. They're actually... You know

1843
01:05:22,940 --> 01:05:25,188
what? Here. I've I've got the solution. Got

1844
01:05:25,188 --> 01:05:27,973
a solution. To do your taxes, you have

1845
01:05:27,973 --> 01:05:30,042
to add a u key. Now when will

1846
01:05:30,042 --> 01:05:30,838
pay their taxes.

1847
01:05:32,031 --> 01:05:32,429
Although,

1848
01:05:33,623 --> 01:05:36,112
you're you're your male. I just got a

1849
01:05:36,112 --> 01:05:37,071
key chain pulling.

1850
01:05:38,589 --> 01:05:40,747
We we had talked about bandwidth poverty on

1851
01:05:40,747 --> 01:05:42,265
the show and there really is, like, second

1852
01:05:42,265 --> 01:05:44,754
factor. Poverty, which is what's driving. A lot

1853
01:05:44,754 --> 01:05:47,228
of, these companies to keep it On. Just

1854
01:05:47,228 --> 01:05:48,664
to bring it full circle back to the

1855
01:05:48,664 --> 01:05:48,983
article.

1856
01:05:49,542 --> 01:05:51,073
It's really just that there's there's a ton

1857
01:05:51,073 --> 01:05:52,529
of devices out there globally

1858
01:05:52,905 --> 01:05:54,977
that are are very, very old in Mh.

1859
01:05:55,614 --> 01:05:57,765
Economies where people just can't do anything else.

1860
01:05:58,257 --> 01:05:58,813
Yep. Yes.

1861
01:05:59,606 --> 01:06:02,089
Yeah. No definitely bandwidth poor

1862
01:06:02,462 --> 01:06:05,080
password 2 factor poor, all these things. I

1863
01:06:05,080 --> 01:06:07,160
mean, they all cost money too. Whether for

1864
01:06:07,160 --> 01:06:09,068
the organization or the person in general. So...

1865
01:06:09,704 --> 01:06:12,168
Yeah. Absolutely. And and even if it's just

1866
01:06:12,168 --> 01:06:13,758
for the for the for the customers in

1867
01:06:13,758 --> 01:06:16,396
general, the organization needs to adapt for their

1868
01:06:16,396 --> 01:06:16,872
customers.

1869
01:06:17,269 --> 01:06:19,889
So they might they might adopt the lower

1870
01:06:19,889 --> 01:06:21,319
security posture because of that.

1871
01:06:22,272 --> 01:06:22,510
Yeah.

1872
01:06:23,701 --> 01:06:25,233
But, yes. Sms

1873
01:06:26,180 --> 01:06:26,817
authentication is bad,

1874
01:06:27,533 --> 01:06:29,204
plenty of different articles and,

1875
01:06:29,841 --> 01:06:32,149
not just articles, but examples of attacks, the

1876
01:06:32,149 --> 01:06:34,298
sims swapping, all the other fun stuff. And

1877
01:06:34,696 --> 01:06:36,865
you know, auth. I will say 1 last

1878
01:06:36,865 --> 01:06:38,541
thing with this particular thing is that if

1879
01:06:38,541 --> 01:06:41,254
you've ever used Twilio, the actual you know,

1880
01:06:43,263 --> 01:06:44,694
What is it service that you can use

1881
01:06:44,694 --> 01:06:46,364
for cellular and phone and all the other

1882
01:06:46,364 --> 01:06:49,648
fun up? They make you use all the

1883
01:06:49,784 --> 01:06:50,840
with that service

1884
01:06:51,215 --> 01:06:52,408
to today? Yes.

1885
01:06:53,139 --> 01:06:56,326
Oh, yeah. I believe this is the... Also

1886
01:06:56,326 --> 01:06:58,158
the second time this year that Twilio has

1887
01:06:58,158 --> 01:06:59,034
had a major breach.

1888
01:07:00,563 --> 01:07:02,476
I think the I think there was 1

1889
01:07:02,476 --> 01:07:03,034
last year.

1890
01:07:03,911 --> 01:07:06,301
Or it... It might the... It was... It

1891
01:07:06,301 --> 01:07:07,497
wasn't... It was within...

1892
01:07:08,388 --> 01:07:10,295
Within the time frame last year over the

1893
01:07:10,295 --> 01:07:13,076
last 12 months, yep. Twilio had another major

1894
01:07:13,076 --> 01:07:14,188
breach. So... Mh.

1895
01:07:14,983 --> 01:07:17,232
You know, I I noticed a trend. Some

1896
01:07:17,232 --> 01:07:20,108
companies really kinda hit the dart a lot.

1897
01:07:20,347 --> 01:07:22,105
Like, they hit the board often. Right?

1898
01:07:23,236 --> 01:07:26,419
We need Bingo cards. Bingo cards. Yes. Have

1899
01:07:26,419 --> 01:07:28,170
you been breached again this year? No.

1900
01:07:29,284 --> 01:07:29,840
You're doing it?

1901
01:07:31,208 --> 01:07:31,367
Alright.

1902
01:07:32,400 --> 01:07:34,229
I think that is about it.

1903
01:07:35,184 --> 01:07:37,967
Thank you, everyone, for joining, and thanks everyone

1904
01:07:37,967 --> 01:07:41,168
for listening to us. Rant. And we will

1905
01:07:41,168 --> 01:07:41,987
see you guys

1906
01:07:42,366 --> 01:07:44,364
next week with the same,

1907
01:07:45,162 --> 01:07:46,441
cast or a new cast or who knows?

1908
01:07:46,681 --> 01:07:48,922
You never know. But again, everyone, thank you

1909
01:07:48,922 --> 01:07:50,590
for jumping on, and we will see you

1910
01:07:50,590 --> 01:07:51,225
guys next.