Cybersecurity Experts BREAK DOWN the shocking OpenAI Spying Incident, Crypto Backdoors, AND MORE

0:00 I didn't understand the context of this. I thought this was a guy, like, detecting that he was getting spied on. I did not realize that this picture was the spy committing the espionage, seeing that he was getting counter-espionage, getting tracked, and it's him detecting the plant. He's like, oh, no, I'm f***ed.

0:25 Good morning, hackers. Welcome back to the lowdown, the best podcast on the internet for hackers. Matt, dude, it's been a week. Life got in the way last week. We were not able to record, but as a shock to nobody, things still happen in cyberspace despite our absence, and some of them are pretty crazy, actually.

0:43 But before we get into that, I saw you gave a keynote recently. How was that? I'm going to redo my pose here. Yeah, I was like pointing at the thing with the logo in the back. Come on, it's a good shot. Josh, please take the photo on LinkedIn, invert it, and have Matt do a finger-to-finger touch a la Da Vinci.

1:01 Please. Oh, it's perfect. Let me get my finger on the screen then. Yes, let's go. Yeah, so Sektor is cool. Black Hat Canada, straight up. Definitely less hacker vibes than Vegas, just FYI, if you ever go, right? But the location's great. You're right there in downtown Toronto. All the buildings around you are all the buildings of like the biggest companies in Canada and all the people at the conference are the security teams from those companies.

1:29 Got to meet, you know, security practitioners and leadership from Canada's biggest telecoms, energy, you know, power companies, insurance and banking sector is really big right there. It's kind of right in financial district. Nice. And so, yeah, I got to do the opening keynote for the AI Summit before the briefing started.

1:50 So it was just pure play AI day, right? Yeah. It was kind of funny. I made this joke in my talk. I made it about 10 minutes into this 25 minute talk when I started talking about the hugging face incident. And I was like, oh, put a dollar in the jar and hey, everyone clap. I made it 10 minutes without saying hugging face.

2:05 I crap you not. Every talk after me did not make it 60 seconds. Really? Like, yeah, yeah, yeah. Like, I'm not even dunking on it. It was just so funny that, like, I sat there the rest of the day and I laughed because I made it 10 minutes and I kind of rolled my eyes at myself. No one else made it 90 seconds.

2:21 Let's be generous, right? So, yeah. Topic du jour was the AI super hackers are here. What are we doing about it? I will say, I will say. And this is, again, not to like dunk on anyone that I met or talked to, but I will say the more I go like out into the real world and conferences and stuff and not like my little bubbles of group chats and things like that and talking to you and whatever, the gap of understanding the current capabilities as it stands with AI is wide, even at the highest levels of our industry.

2:54 Right. So like I said, I'm talking to leadership that are running security departments for large financial energy, whatever institutions. And you can kind of tell that some people made up their mind about AI's capabilities way too long ago, way too long ago. Kind of the phase you were in, right? You were one of these people, right?

3:15 Um, but to your credit, I think you did what a lot of people in our industry should be doing. You stay hands on with this stuff because it changes at such light speed. Right. Right. Um, that, that, yeah. So like, that's, that's what I'm coming away from that with is encouraging anyone who's listening.

3:33 Don't like just have your opinion and be like the AI hater or the AI obsessed. Like there's like a nuance in the middle of like what's really going on. What are things really good at? And I think I'm encouraging people find that out for yourself. Like do your own experimentation, stuff like that. It's super important.

3:51 Yeah, I found that to be the case. Now, again, I came from more of the offensive security consulting world, less the actual CISO in a company world. But I think I've always found that to be the same, where it's people in these higher-up positions, not that they don't understand, it's just the level and depth of understanding is typically a lot more thin, I guess.

4:13 And then on top of that, they develop opinions early, because they have to, it's the nature of their job. But then because of the... position they're in the reputation they have to maintain they don't want to look like a flop and like change their opinion a lot so once they kind of like dig into these early opinions and like you said admittedly i did that for a while i was like no ai is stupid ai can't hack but again i don't work for a fortune 500 company anymore uh and so when i decided i want to change it you know i played around yeah man the models are getting really kind of scary good as we'll go into here in the the rest of the podcast at hacking it's it's pretty bonkers yeah So man, you're putting out banger content on your channel, literally about how good this stuff is at reversing right now.

4:52 Yeah. Not only podcast co-host number one, low-level fan over here, but you know, you're like this stuff is getting scary. Good. The others, like I got pulled into a few other talks because people started to realize that I was in Canada and they were like, well, we can't let you just do 25 minutes on stage.

5:08 So they pulled me up for kind of a second panel and then a third panel during the briefings. Nice. And it does not matter where I was. This is all anyone was talking about. This is it. Like, this is all anyone wanted to talk to me about. This is all anyone wanted to, like, whatever. Like, this was it.

5:24 So even though it was cute that we had this little AI summit, it might as well have been the whole thing, man, because everyone's just trying to figure it out right now. Yeah, I mean, it is weird. Again, I'm not going to try to regurgitate the entire thesis of your talk, but it also is part of the video that I made recently that I want to highlight.

5:40 The reason why I think everyone's talking about it is that it truly has commoditized being a nation state, right? Name of the channel, by the way, where, again, man, I made a video on this. A task that used to take me a week plus is now a 15-minute side quest. right, using GLM-5.3. For people that don't know, I made a video, right, like, reverse-engineered, the firmware of my monitor, right, upstairs in my office in my other part of my house, it ships encrypted.

6:08 Now, it also ships with the DLL that does the decryption. Now, obviously, the key is in there, but the process of reverse-engineering, like, the structure and the format and, like, where the key material is and how it's decrypted and encrypted, you can do that. Anyone can do that if you know how to RE.

6:22 It just takes a minute. But again, now the AIs can just do it for you lickety-split, It's really bonkers. Yeah. You know, there was just a few times where I was like hearing people literally on stage talking and saying, well, yeah, now you got to deal with all these like AI slop code, vibe coded apps filled with vulnerabilities.

6:45 And like, I get it. Like, I do. I like really do get like it. Not to be too AI-pilled, but vulnerabilities have been around a long time. Right. It's not like we were putting out pristine, vuln-free code, organic, handcrafted. Artisanal, yeah. No. And, like, have you used Astra 6 or Opus 5.5? And, like, are you throwing out SQL injection or cross-site scripting vulnerabilities with those things?

7:17 No, I'm not saying we've solved security and software is solved or anything like that. But you can't make up your mind on chatGPT.com version 3 or whatever the heck it was however many years ago and be like, well, look at all the hallucinations and all the stuff that is going on and be like, see, that's it.

7:34 Look, I told you it's so bad. Let me give you a concrete example, you, the audience, of I think how... different things are in terms of, you know, AI code is insecure versus AI code is safe or more secure. Right. So again, I've been using the AI models generate code since like the three, three, five days where I did the primogens tower event.

7:56 And when we did it back then, the models created terrible code, insecure, not maintainable, whatever. But if you look at the models today and you look at an incident like the Citrix net scaler bugs, and I'm going to do a lot of dunking on Citrix here in the next couple of seconds. I'm not trying to like drag them through the mud.

8:12 This is just a very, I think, poignant example of how things could be better, right? A lot of the vulnerabilities in those platforms were literally just like the N value for a field came off the network and was not validated before a mem copy occurred, right? That's like traditional buffer overflow type stuff.

8:30 The models do not produce that pattern. They literally don't anymore. If you were to vibe code, what is it, NSA, AAD, the daemon that does the AAA authentication on the NetScaler, it would not produce that vulnerable path anymore. So we're starting to see a shift where sometimes, at least based on certain companies and their coding practices, AI code may be more secure.

8:53 You know what I mean? They're just not capable, not capable in quotes. We catch a lot of shit for that. They statistically produce less that code pattern. You know what I mean? It's just, it's really interesting. Yeah. Especially on the, like the injection code quality, memory safety, all the, like those syntactical vulnerabilities, right?

9:09 Like we're obviously going to start seeing less and less of that as the models get better. Don't get me wrong. I'm still seeing and still running into like in person on projects that I'm working on more business logic type stuff. Right. more authorization type things, right? More, oh, we didn't actually bound this the right way.

9:28 It should only be accessed from this person, whatever, right? That kind of stuff could still happen for sure. We're not up here being like, hey, problem solved. Everyone go home. But to stand on stage and be like this AI slop code, I'm like, what have we been doing for 20 years if not slop coding things?

9:45 with our little fingers here. You know what I mean? Like I've written a lot of human slop code. I'll tell you that. So anyway, you know, that's what I, when I say the gap, that's what I mean. Right. It's just like, you can kind of tell the people that have like stayed on top of it and are using this stuff.

10:02 And especially, especially, especially with like, modern harnesses, and things like that, right? Like, I always pull up when that Mythos thing happened, Project Glasswing thing happened, the companies that were really transparent about their experience with it, the Cloudflare's, the Mozilla's, the Google's, like, all this kind of stuff, and they start writing blogs about their experience with it, it's like, oh, you could tell.

10:25 You could tell that these are top, top, top tier security departments because they're like, look, I just got a better tool to do a lot of the stuff that I was doing. But look at this crazy harness that I put it into. I already had this like automation flow and I just injected steroids into it. Ta-da-da-da.

10:42 Look at what happens on the other side versus people who didn't have that to begin with and are looking at AI to solve all their problems. And they're not, it's not magically solving all their problems. Yeah. And they're like, well, I don't get it. I don't get how it's so much better. It's like, well, that means you probably weren't doing the right security engineering thing to begin with.

11:01 Like, need to break it to you, right? So anyway, Soapbox, right? It's just like, the more I go into the real world, the more I realize the gap between like the tip of the spear security programs and like people that are kind of reacting to headlines and doing things, you know, the way that they've always done them.

11:18 Yeah, it just boils down to, like, you still have to have a fundamental understanding of, like, what is required to publish secure code to maintain a secure system to have a secure network, right? Like, AI cannot rid you of those requirements, right? I think a lot of companies may be taking the AI pill too far.

11:37 Again, we're going to come off as AI pilled in this podcast. I'm not. It's just you have to acknowledge the benefits and the downsides that the technology offers, right? Yeah. All I'm asking, I'm not like the super AI pill that everything is magic land either. All I'm asking is for if you're listening and you have your mind made up and you haven't touched this stuff in a while, Like, go do some experiments, go see what's going on, try it out.

12:05 This is the only way, I think security people, especially security people, it's more important for us to keep our hands on this stuff as it evolves, to really understand it, to really understand its capabilities, because our devs are going to do it anyway. They're going to do it no matter what. They're going to be using the new tool, right?

12:22 So we have to understand what it's capable of and where we're at. Yeah, and it moves so quick. I mean, you said back when Glasswing happened, bro, that was like five months ago. You know what I mean? Like, that was not that long ago, but it feels that long ago, because that's how fast this industry moves.

12:34 Right. You know what else moves quickly, Matt? My heart rate when I saw that Ledger crypto wallets were getting drained because that's where I may or may not store my troves of 10th Bitcoin. Yeah, man, it's pretty crazy. So if you guys aren't following, there has been a series of backdoors, both in software and physical backdoors.

12:59 put into crypto wallets. A news headline came up. I think it started on Twitter where someone reported that, hey, ledger wallets around the world are just getting drained to zero and no one really knows why. And then a couple days later, a guy came out and he's like, hey, does this look normal to you guys?

13:15 And it was like a physical implant In a wallet that supposedly was sucking out the seed phrase when it got initialized, when you first plug it in and create your wallet. So, you know, talk about supply chain attack, man. We talk a lot about, like, NPM worm type shit. This is like a real-life hardware supply chain attack.

13:36 You know what came to mind for me right away, and it's a little dark, and so I apologize, is those pagers. Yeah, I wasn't going to say it, but it's floating around in my head. Yeah. Well, I mean, it's just like the similarity of the attack itself, right? Like how upstream the threat actors went in order to pull off this attack.

13:57 Obviously, that was a military operation. If you don't know, we're not going to get into it. It's not that kind of podcast. Yeah. military operation pager supply chain. Go have fun reading. Google. Go have fun. We're not going to talk about it. But the similarities here are like, oh, we went and acquired a company and acquired a company to do resale of hardware because then we could intercept these shipments, leech off the trust that this reseller has built being a legitimate reseller for as long as they have.

14:31 What was it called? Crypto bills? Yes. I believe. Yep. And so they were a legitimate, so ledgers, legitimate, crypto bills, legitimate until it wasn't. Right. All of a sudden someone came and acquired crypto bills and was like, okay, now we are going to ride the reputation of this company. We have all of a sudden a warehouse full of hardware that then we can inject.

14:53 Right. are attacking to. Right? And the other kind of interesting part here to me was, well, there's like a side story here we could talk about about non-ledger, other wallets also having some of these similar issues. But on the ledger side, it's... they didn't mess with the hardware itself. And that's part of the draw of a hardware wallet is like, oh, look, it's more secure than like a website.

15:21 If your account gets compromised on like some website, then your crypto is just gone, which we see constantly right now, right? Social engineers, especially. So the hardware wallet is supposed to be a little bit more secure, a little bit more tamper-proof. So if you actually tampered with the hardware itself from Ledger for the actual wallet, that should be detectable or not possible, right?

15:45 Depending on some of the different attacks that would actually go on against this hardware. But they didn't do that. They soldered, they just like used the motherboard that was there to, And soldered their implant. And all their implant did was intercept communications between the actual ledger hardware and the monitor.

16:05 Just that little display screen that came on the wallet. And then guess what the display screen shows while you're setting up your ledger wallet? The recovery key. The secret phrase, right? Yeah. And then the other thing that I thought was really cool here and clever was that they got sell into it in a very, very, very small package.

16:21 You'll notice in this image, too, like there's the eSIM right there. And also they use solder as an antenna. Yeah. Like that thing is an antenna floating in there. It's insane. smart engineering, right? So yeah, the SIM is super small. I saw one of the examples, the SIM itself was like two millimeters.

16:37 But then obviously there's like an antenna and some other stuff going on to actually wind up getting cell service to phone home. So we've got over $100 million in losses. It was 86 when I first made a video about this. Yeah. Over $100 million in losses now, 500 plus addresses. A lot of this stuff was in, it seemed, Southeast Asia to start, which is where I think that reseller was active.

17:01 But then even today, this morning, I saw someone walk into a German store retailer, like on the shelf store. box on the shelf at a legitimate retailer covered in like anti-theft boxes, right? Like at a retailer, pulled that off, opened it up and found the implant in there too. So these things, I feel like we're going to be hearing about this for quite a while.

17:25 It's really hard to walk this back, right? Yeah, so I want to highlight, like, first of all, I'm not a crypto bro. I'm about to sound like one, but I'm not. The phrase, not your keys, not your crypto, is what kind of sets the stage here, right? So the reason why people use hardware wallets is the idea is that, like, if you have your keys on, if you have your crypto on Coinbase, for example, The fact that your crypto is on Coinbase means that Coinbase also has access to your private key and public key because Coinbase has to be able to issue transactions, right?

17:57 It has to be able to sign transactions and put them on the blockchain. So the idea is, like, if Coinbase either gets a government warrant or, like, Coinbase gets compromised, you know, the keys are there, and therefore they can move your crypto around without your consent. So therefore, by migrating your crypto into a hardware wallet, you know, it makes it more secure, which is still the case, by the way.

18:15 I still stand by that. Like you'd be using a hardware security module on the inside of a wallet to store your key. And then keeping your crypto in that wallet is significantly more secure than, you know, any kind of on a market type storage. But that being said, there is an inherent trust you put there with the quality of the hardware.

18:33 And if it's been physically implanted to extract your seed phrase at boot, You're going to have a bad time, right? Now, the question, I guess, is like, what do you do about this? Not going to lie, it's a very hard problem, right? Because not everyone has the tooling, the knowledge, the resources to open up their crypto wallet and examine it for hardware implants, right?

18:56 So I'm not really sure what the average person does here, but it does kind of just highlight the inherent vulnerability of even hardware supply chain trust. Yeah, I think buying direct is like the advice that a lot of people are giving, right? Is like, don't go to a retailer or a reseller at all for some of this hardware.

19:11 Kind of helps you out. But also credit to MG of OMG Cable fame. He's got a really great thread over on Twitter going through all the different hardware. And then also, he's got a crystal ball. I didn't realize he's got a tweet from the year 2021. Decades ago. The year was 2021 in July. And he has a tweet talking about some research he did.

19:38 If you guys don't know, OMG cables. These are like the hardware hacking cables. He makes a lot of hardware pen testing type. So this is his specialty. And yeah, he was talking about Bitcoin stealing ledger implants that are now invisible and don't have a lot of this stuff that we're finding in some of these pictures, even from back then.

19:59 So there are even stealthier attacks possible on this kind of stuff. Going into even stealthier attacks, right? So what we're talking about now is the Ledger wallet, right? The Ledger wallet attack has a physical implant, right? You open up your Ledger wallet, you'll see, like, oh, this other chip that has an eSIM, a cellular module, and, like, an antenna, right?

20:18 Yeah. Later, we also found, not we, but the world, Trezor wallets were also compromised, but not by a physical implant, by a software implant. Now, how would you even do this? How would you pull off a software compromise of the Trezor wallets? If you don't remember, Joe Grand... One of the OG hardware hackers made a video.

20:40 God, it had to have been like eight years ago at this point called like I hacked this crypto wallet and recovered three million dollars. Basically, it was a video showcasing him performing a software glitching fault injection attack on a Trezor wallet to help a gentleman retrieve three million dollars that he locked up and forgot the passkey for the wallet.

21:00 OK, so we did it, got the money out, and I'm sure he got some kind of commission out of that. Good for you, Joe Grant. So if that takes that amount of effort to recover the key or change the software in the Trezor wallet, which was subject to that video, how is it possible that hackers are uploading malicious firmware to these wallets, right?

21:18 Which is what's going on in this attack. Well, what's crazy is they're actually just completely de-soldering the microchip on the Trezor wallet that is locked. The JTAG fuse has been blown on that thing, and they just put a new one down. And because the software for the Trezor wallet is open source, they compile a new Trezor wallet firmware with just compromised seed phrases.

21:41 So the seed phrase is predictable so that they can offline reproduce that wallet and sign transactions from it. insane absolutely crazy when i was reading this i was like this isn't possible it's not possible that they're able to flash new code to a treasure wallet oh no it literally is if you replace the microcontroller completely which is what they've done so kudos to them i guess but also like jesus christ insane Well, the broader part of this here, right, is that a ton of crypto wallet, soft wallet, hard wallet, a ton of crypto companies jumped all over this Ledger story.

22:14 And they were like, come to us. Ledger sucks. Look at that. Like, we're completely immune to this. We're like, we've never had this happen. Right. Trezor was one of them. And like, uh, MG literally says in this thread, like conveniently ignoring Joe grand's research where he found implanted treasure wallets in the wild, not even like theoretically in his research.

22:36 I wasn't aware of that. Okay. So like found in the wild treasure implanted wallets as well. So, yeah, it's like, no, you're not immune to this. A bunch of these other crypto companies. He even says, then you have other competitors shilling their product while having an unspoken list of other problems.

23:00 The crypto space is so sketchy. I agree, MG. I agree. I agree. It is super weird. Such a weird wild west unregulated environment. You know, not that regulations solve everything or don't cause their own problems, but it's just wild here, man. Especially when people are doing this with like their life savings.

23:18 Yeah. You have so many people that are not treating this as like a hobby or like a side store of cash. You have so many people that, you know, lose their crypto and like, that's it. They're ruined. And it's like, oh man, this is rough. This is rough out here. Yeah, and so I don't really know the terminology too well.

23:37 I think a potential solution is like an NFC cold wallet where it's like the key is not really even in an electronic device. It's truly just like the stored crypto key, but you have to like manually enter it somewhere else. I'm not sure if this solves a problem, but the issue here is that you have an electrical device that contains your private key.

23:58 right and like it's going to get hacked that's that's kind of just the whole moral of the story here right is there there is a hack for everything um so you know maybe there aren't solutions to this either way it's uh super interesting for sure yeah and the treasure it's kind of wild the treasure implants that joe grand found in the wild was just in august wasn't even that long ago oh wow Yeah, the issue here, I guess, is that, like, the chip that they're using is so common.

24:22 It's an STM32F. You can go buy those online, and if you have a heat gun, you can just go desolder and resolder, and then suddenly, you know, you've implanted the Trezor wallet. Obviously, you have to build the firmware and stuff, but, I mean, not super complicated. Seems like the similarity is a untrusted third-party reseller.

24:40 Yep. Buy direct. Yeah, buy direct on these. All right, crypto. There's a few weeks in a row. For two non-crypto bros, we wind up covering a lot of these stories. I may not be crypto-pilled, but you know what pilled I am? Maze, the sponsor of today's video. Take it away. Hey, hackers, before we keep going, I want to take a quick break and say a quick thank you to our sponsors.

25:03 Today's Lowdown episode is sponsored by our friends over at Maze. Maze has spent the last couple of years using AI to find and remediate vulnerabilities in the cloud. And now they've released Maze Code, AI agents that find and deeply investigate vulnerabilities in your code. Now, we all know the deal.

25:20 Software composition analysis tools and SaaS toolings are all historically really bad at just making more noise. They find issues that may not actually be real and just create a lot of problems for your engineers to deal with that don't solve real security vulnerabilities. I get it. We've been there.

25:35 Maze code is a really cool tool because Maze code actually knows how your code works. Maze code investigates every finding with the context of how your code is actually deployed. Sure, you're using a version of libxml2 that's vulnerable, but the actual code path to hit that vulnerability is not exposed in your Docker image.

25:54 Maze code can find that and won't show you that that vulnerability is a big deal. Every vulnerability that Maze code reports comes with evidence that it's real and a way to fix it. Check out Maze at go.thelowdownpod.com slash maze. That's go.thelowdownpod.com slash maze. Thanks again, Maze. Let's keep going.

26:15 And we're back. You know, that Maze integration was pretty cool. You know what else is supposed to be cool, Matt, but wasn't? vanilla ice refrigerators ah refrigerators matt they're supposed to be cool but in france where they got all those baguettes and croissants i'm told uh not not a lot of not a lot of cold food over there what happened man i feel like we just need like i need a picture of someone just standing in front of a broken fridge smoking a cigarette it's like yeah i don't know Ah, jacobus.

26:50 I don't know. Jacobus, yeah. I don't know why we're dumping on the French. It's kind of fun. I don't know. It is kind of fun. Sorry for our massive French audience. We're so American. It's crazy. We're really big in France. So yeah, I made a short about this. I had to talk about this. This got me a little ruffled.

27:05 Why are you ruffled, Matt? Ask me why I'm ruffled. Why are you fluffled? Why are you fluffled? The normie media, once again, talking about cybersecurity stuff. Guess what they claimed was going on here? I saw your shorts. I feel like I have insider information, but could it potentially be that an AI superhacker did it?

27:25 The AI super hacker. AI super hacker. Classic. So obviously people are like pointing at, whoa, a hack. And I know one thing that's going on right now is AIs are escaping the lab and hacking everything. Do you know what the actual vulnerability here is, everybody? You're not going to believe it. You're not going to believe it.

27:45 A management portal open on the internet with a really stupid vulnerability. Hooray! The year of 2026 and we're still doing this. Oh, gosh. You know, I guess we could consider the grocery and food supply chain is also critical infrastructure. So here we are. We're a critical infrastructure management interface on the internet.

28:06 And the vulnerability is as dumb as they get. This isn't even like, oh, a CVE. The username is admin and the password automatically changes every day. Really secure, right? Yes. Because we're going to rotate our password. That actually follows NIST guidance. That's perfect. Oh my gosh. To today's date.

28:26 The password is today's date. Damn it. I'm so close. But did you know that today's date, if put into Unix timestamp format, uses numbers and special characters and letters, uppercase and lowercase. Technically, they're following NIST guidance. I had someone, because I went on my soapbox about this, and I had someone in my comments say, well, no, it is actually AI-related, Matt, because now everyone wants to spend money on AI, so they're not spending money on security.

28:55 Brother, we haven't been spending money on security since before you were a glimmer in your parents' eye. We have been fighting for budget forever. No, this has nothing to do with AI. This is just dumb. Yeah. I will say there is potentially an AI edge to this in that... I hate you. Taking apart the software to find this vulnerability, if not previously disclosed, is easier, is now commoditized.

29:21 This is someone that I know recently gave a keynote for. But what's crazy about this is I saw – yeah, I know, drink. I saw this pop off one or two days ago at this point. And I was scrolling LinkedIn, and then I saw Clarity, Team 82, they do a lot of great intel on, or research on, you know, bugs in routers, bugs in OT equipment, operational technology.

29:43 They wrote an article on, wow, you know, being able to hack and defrost food in Dan Frost refrigeration control units. Surely this article came out within the last week or so related to this incident. No, brother, this was a four, no, two-month-old. research paper two months ago they were like hey by the way these bugs exist and on like props everybody in in that like uh in that article because they reported it to dan frost i'm assuming i'm pronouncing that correctly uh and they actually patched the firmware and shipped a release so that bug went away congratulations but also in critical infrastructure fashion we didn't update and we left it facing the internet insane yes matt Yeah.

30:25 Oh, what? And we left it and we didn't patch it? Oh, man. This is completely different than everything that's ever happened. Yeah. Oh, man. It's just the same story, man, in a different shape. Okay. In like seemingly related incident, like unrelated in this exact vulnerability, but for some reason on the same day, a giant like umbrella corp that's over a bunch of different grocery chains was...

30:51 had to take a bunch of their back office systems offline because of a cyber attack that we have not a lot of details about yet. But what are the chances that we've got like a ton of refrigerators at grocery stores going offline due to really dumb cyber attack at the same time as a different chain of grocery suppliers is going off at the same time?

31:16 Not a lot of details on this one, but really it smells like ransomware, right? I mean, I don't want to like claim that too, obviously, but when you see these big retail companies with a very specific subset of their IT systems that are all of a sudden unavailable and then like their point of sale is fine.

31:37 but they're unable to, like, order food. And so it's like, oh, their fresh food is going to suffer for the next couple days. I don't know what the hell's going on. Yeah, it's interesting. I saw a Twitter thread related to this, kind of, like, talking about the before, during, and after era of, like, technology.

31:59 And it's like, okay, before this, we had to all farm our own food and grow our own food because, like, we didn't have the technology to support this kind of system, right? Yeah. And then we were able to with computers and, you know, computers helped automate all of this through farming and delivery and logistics.

32:12 And they put it in the store. Now you can buy it with e-commerce, stuff like that. And then the question is like, OK, with with AI coming online and people being able to like just find vulnerabilities and everything and like act and everyone can act like an APT. Is there a world where like we kind of revert back to the old times where like out of a fear or necessity, you know, everyone's got to have their own farm again.

32:32 You know what I mean? Like, where does this go? Kind of scary. Um, I literally late breaking news, new, new, uh, info on this right now. Uh, some other researchers are going in and looking. It's not just Dan Frost anymore. Uh, there's some other stuff. Uh, there's some other stuff. Copeland and some other vendors.

32:53 And in research now, because we know about these vulnerabilities being exploded in the wild, we have other internet exposed controllers from another vendor that are already compromised by a botnet and have... Crypto miners already installed on them, but in the same kind of attack. So, you know, these same devices, instead of just knocking it to 50 degrees and trolling a whole country's food supply.

33:19 Trolling is not the right word. I'm so sorry. But yeah, just hacking in that regard. Now, all of a sudden, it's crypto miner botnet. Wow, I'll put this link in here too. I do find it kind of funny that like, it seems like no matter what is compromised and like the level of effect they could have on the planet, there's always one actor that's like, and crypto.

33:43 Like, really? You could like do a lot of damage with that. You're just gonna mine Ethereum on this box? Really? Is that all you're gonna do? It's kind of crazy. Yeah, it happens all the time. Is that just North Korea? Is that just them trying to fund their nation? Like, how does that work? No, because I even think they, miners are too inefficient for them.

34:00 They're stealing billions. What are you getting from a miner on a botnet for a little while, right? It's like a rounding error for them at this point. That's true. Yeah, man. So, I mean, I guess we keep talking a lot about like, companies, organizations, states, whatever, leaving infrastructure online, like on the internet.

34:19 One, why does this keep happening? And two, how do we make it not happen? Like, why is this a repeated theme? And it's not like a new thing. This has been going on since like the dawn of time. You would just think that it would end by 2026. Oh man. So there's also a Reddit thread of people, staff working at these grocery stores in the US that are saying that they are hearing and obviously take this with a grain of salt.

34:43 What is, you know, what is actual grocery staff is probably ransomware recovery is probably not there in their scope of work, but they're getting told it's four weeks out from recovery, which puts them right in the middle of Thanksgiving. Yeah. Oh, no. And that they're not going to have inventory. So let's keep an eye on this one to see if a ransomware attack disrupts grocery store shelving inventory during Thanksgiving.

35:11 Would get some attention, wouldn't it? That's how you get some legislation, though. You know, Mitch McConnell can't have his pumpkin pie. We finally get something done about this. Maybe that'd be cool. Can they liquefy pumpkin pie? Not a political podcast, Matt. Stop it. Sorry. Put it out. Yeah, we don't have to talk about politics to make fun of Gerber-eating legislators.

35:34 You know? Like, come on. Jesus Christ. Hey, what? There's another... Isn't the other party the guy just announced for re-election he's going to be 102 years old if he gets elected? I mean, it's just... Is that real? Yeah. That's crazy. It's dumb, man. He just announced... I forget his name. Whatever.

35:49 One of the other old guys. Too much, too much. Okay. You know what else 102-year-olds are really bad at? What's that, Matt? You prefer such a deer. That's so stupid. Why? Our transitions. Oh, man. I'm so sorry. Oh, no. Well, actually, actually, actually, in the era of AI, take a shot every time that I say that.

36:16 They actually could be pretty good at it. Okay, okay. I want to give you – we've gone so far off the rails today. I want to give you just a ton of credit. I know I kind of gave you some kudos. You did this balance that you and I have to strike as like practitioners in cybersecurity and technology for a very long time now, but also content creators.

36:36 And like, we want to talk like really technical stuff. And we have to strike this balance of being able to explain this to people that might not have ever done reverse engineering or might not have ever actually even looked at like a dump of a memory dump or something like that. But then we have to explain it on the internet, right?

36:52 And like get it right. And a lot of times I do this in 90 seconds, right? And so I get a lot of comments that are like, that wasn't quite accurate. I'm like, you do better in 90 seconds. Yeah, if it's so easy, then you do it, please. I swear to God. And so like, whatever, right? But I got to give you kudos.

37:06 We want to do a lot of the technical stuff, right? And sometimes we kind of have to like zoom in and out of that because maybe the most technical stuff doesn't perform very well on these platforms. You seem to have... somehow struck gold with both of your goals. And you made a really technical video that's doing really, really well right now on reverse engineering.

37:25 I watched the whole thing to actually pull up those memory dumps and stuff like that. Super cool. Just kudos, kudos, kudos. I appreciate that. Yeah, what's cool about all this AI stuff, whether you like it or don't like it, is that for me, make this about me. Reverse engineering is like now in vogue, which is kind of cool, which means that like the average person, the normies, if you will, are interested in like, okay, how does software work?

37:50 How do we take it apart and how can we create a new thing? And what's really great about this is it's all originating from a deep, justified, guttural hatred for the Adobe Corporation. Now, what we're seeing is that there's a bunch of new copies of software like the OGs, Photoshop, Premiere Pro, Lightroom popping up that are not one-for-one copies.

38:17 There are a lot of performance issues with them, but they have a lot of the same features, and they are completely vibe-coded. Now, what's happening is there's this new project that is popping off on GitHub. It's called Reverse Engineer Anything. It's literally just an MCP server that uses traditional reverse engineering tooling like Ida, Ghidra, and Hopper to decompile a project.

38:41 and then recompile it from that pseudocode. And it does a really good job. I'll pull a picture of it up here on the podcast, but for the video that I'm working on that goes out tomorrow or the day after, I had it just kind of like do this process on GNOME calculator, kind of like the default calc that pops up there that shifts with Ubuntu.

38:59 And obviously, low level, that's open source, bad idea. Shut up, I know, it was from the compiled version, not the decompiled version, or not from the source code. And it created in 28 minutes a one-for-one copy of a 986K elf. Like, it's really, really good. Now, this does, in my opinion, beg some sort of existential questions about software as a whole and also security, right?

39:22 The big one for this podcast is, like, we talked about supply chain and, like, the Trezor. uh, and ledger scenarios that applies here, right? Like what does Adobe have on the line? If they start to either ship malware intentionally or get compromised and unwittingly unknowingly ship malware, well, then I don't pay them anymore.

39:43 And they, as a corporation cease to exist. Right. But if Joe Schmo who vibe coded Photoshop too, right. If, If they are pushing malware intentionally or don't, there's no downside for them. So the like the model of trust with software is kind of turning where it's like everyone vibe coding everything and sharing it to everyone.

40:01 There's no like root of trust anymore that I can lean on to be like, oh, well, surely Jimmy wouldn't send me malware. Well, no, he totally couldn't. It wouldn't affect him at all. And then also another issue is maintainability, right? Like, who's going to fix the inevitable, I don't know, XML parsing bug in Premiere Pro 2 Vibe Coded if they don't have profit behind it to fund the bug fixes, right?

40:25 This has been a problem for, you know, coming up on 30 years or so in the open source world too, right? Who was incentivized to fix open source software? Well, it's literally just a couple of guys who do it for the love of the game. And that's not like super sustainable in my opinion. So, yeah, man, what are your thoughts on this?

40:41 Yeah, when I think of trust... I think of Adobe because they have not shipped me any bad code in the history of time. And they would never charge me $100 for canceling my subscription early. That'd be crazy. I do get your point. It's just funny to put Adobe up on the trust pedestal due to them being a whatever.

41:05 Anyway, yeah, this one's interesting. I'd say there's like one YouTube channel that I feel... the most scared by existing because they're so good. And it's FireShip. Do you know FireShip? I love FireShip. Yeah, I do too. And that's why I'm scared of them existing because I love them because they're faceless and they could, you know, replicate.

41:29 Like that channel could turn into a fully AI-controlled channel tomorrow if AI was good enough. Just to be clear. That is a rumor that's already happened and he has addressed it and it is not true. But every time he puts a video out, they're like, I'll wait for the Fireship video in the Fireship comments making a joke that it's not actually Jeff anymore.

41:46 It's like an AI bot. Okay, I didn't know that. I didn't know that. And I love his channel. And, but it makes me nervous that it's so good because it's like, who's, you said, Jeff, I didn't know Jeff. I didn't know that his name. I don't, I don't know this person. I have no trust. Like the, the, the thing that you and I are hinging a lot of our time and energy on is that we're building some trust with some audience.

42:08 Yes, correct. You can argue that's really all my business has is trust. It's like that they know us and that they know that we've done this for a career and like they're building this relationship with us. Okay. So he did a video on this and I got to watch him try to use the free... What is it? What's the...

42:28 It's not Final Cut. What's... Oh, Film Cut or Film Now or something. No. What's the Adobe version? Oh, Premiere Pro. Premiere Pro. Sorry. It's called Filmcraft. So he used Filmcraft. He used the free reverse engineered Premiere Pro to try to do one of his videos. And that was going to be his whole thing.

42:47 It's like, hey, I put out a video. I'm using the free one, right? He couldn't do it. Like, it didn't work. Like, so we're not there yet. Just FYI. But things are getting scarily possible. And especially when you're not trying to put out a... one-to-one, like, I'm going to make money on this or like, you know, corporate version of it.

43:10 But as you see in security research, it's good enough already to like be able to do true security research of things that were previously closed source packaged appliances type thing, right? Which is scary in its own right. Actually, you know, I love pulling up my crystal ball, right? Yeah. that we were ahead of the curve on this.

43:31 Well, not we. We shouldn't take credit, but we were on a panel at PlanetScale. Me. Yeah. We were at the Royal We. I was in the room when this was said. So I, therefore, transitive property. We did that panel at PlanetScale. When the hell was that? A couple months ago. Yeah. Time is flat circle. And that guy, Gabe from Sentinel one, we were, we were all chatting like before we even went on stage, uh, about stuff.

43:56 And he was like, Hey, I think the actual risk of all of this is that like, it's going to get way too good at reverse engineering and the economy is going to explode because there's no software moat anymore. Uh, and I was like, Oh man. All right. Like, that's interesting. I hadn't really thought about it a lot at that point.

44:15 And now here we are. And like the cracks are starting to show. Yeah. Well, so if you... Okay, so again, I'm not trying to plug my own channel on this, but I am working on a video where I talk about this. My thoughts on that particular edge of the conversation are, yes, what is it? Like 70% of the S&P is software companies, which is not great.

44:32 I have a lot of money in the S&P. Not a lot of money, but a big percentage. Fuck you guys. Anyway... Not to brag about how much money I have. I don't know, but a lot of my portfolio is in the S&P. What I'm trying to say is that I don't think corporations are going to stop being corporations. And I think they're always going to be profit incentivized.

44:48 And so I think what will happen long term, and we're already seeing this happen in the games industry, where the user is just not going to get the software anymore. Look at games, PS5, a lot of that. What's happening is you don't get Grand Theft Auto 6. I'm making up an example. You get a ticket to Grand Theft Auto 6, you plug it into your PS5, and then you get, like, a cloud view of the game, right?

45:14 You get literally just, like, a VDI, and the VDI lets you do, like, low-latency gaming, and that's it. Because they don't want you to have the media, because the media is kind of, like, their whole trade secret. And if you are a GTA 6, you've dumped, probably at this point, billions of dollars to lit it on fire.

45:27 Okay. Okay. Now, I'm very nervous that software, the average consumer software, not even like games like Microsoft Word and like Photoshop and like this average shit that everyone uses will go the same path because Microsoft is going to need to make money still. Adobe is going to need to make money still.

45:43 And so instead of giving you, you know, Photoshop.exe, they're just going to give you Photoshop remote thin client.exe and you plug into like Adobe servers and you get a view of it. Because otherwise, this is going to be the case for every piece of software. There are no trade secrets anymore if you give the user the trade secret.

46:01 Yeah, I mean, the counterpoint to a lot of this, right? To like kind of not be doomerism about all of our money evaporating because software is not a moat anymore. Yeah. LibreOffice has existed for as long as I've, you know, been around. So it's not like Microsoft Word was Microsoft Word because it's the best at typing words into a square, right?

46:25 Right. Like, The functionality can kind of exist. And we're already seeing it with this Adobe thing. It's like, yeah, you can get like 80% of the way there or whatever, right? The things that people wind up paying for is like the rest of the support and experience of being a customer of a company that's like paid to deliver this outcome to you.

46:46 The outcome of using the Office Suite is, I've got a business that like purrs like a machine and like they're not going to stub their toe on some like random thing, right? that's what people are paying for. When a lot of the AI stuff started to take off, people were like, well, Salesforce is done, right?

47:04 Like, I'm going to just code my own CRM. And it's like, people started to do it. And then you're like, oh, I now realize why I'm paying a company. Yeah, right. Even in our world, right? Like, we work with a bunch of editors. Those editors are... creating themselves more and more AI editor-y tool help to like speed up their job, right?

47:26 I'm not paying them any less because I'm paying for an outcome. I'm paying for a good video on the other side of it. I don't care if you all of a sudden have a tool that does this in an eighth of the time. Like I was paying you for a quality output, right? And if your tool... Does, you know, 70% of a good job as you did, which is I think what we're going to see here for a while with all of this, right?

47:49 I'm still paying you for that 30% that like your experienced human touch is going to be able to cross the finish line with, right? Mm-hmm. So I think for a while, that's going to be the reality, right? Whether or not there's a ceiling on how good all of these models get, I've been wrong a few times before already, right?

48:08 That the capability curve is going to start flattening and harnesses and human experience are still going to be a huge part of it just with a better tool. And then they've blown the roof off of capability. So who knows, right? But I still think there's like... hey, I'm paying a company and a person to handle this for me.

48:24 It's like what I'm paying for, right? Yeah. So I don't know. But to your point, I'm seeing a lot of people come out and say, hey, in defense of SaaS now, this is now a pro for having a web app be your main interface for your software, right? Instead of shipping stuff out. Yeah. Yeah, I think this will actually probably more negatively hurt the gigantic companies and really, really help the midsize companies where there like truly is a person helping you out.

48:53 Because like to counter your counter, like if you get help from Microsoft, Microsoft Word, you're not talking to a person for like eight layers of support. Right. It's just like. So not you, right? But I worked at a very large U.S. bank who was a very large Microsoft customer. I see. Do you know what I mean?

49:11 Yeah, I got you. Do you think the bank was going to be like, actually, for our 330,000 employees, we're going to install LibreOffice? Sure. And like, that's it. Right. It's like a different scale of things. Right. And like, it's like, well, no, you know, I need patches. I need support. I can't have a team of people that make sure that LibreOffice is up to date and supported and new features and security bugs and all this kind of stuff are happening.

49:38 Then now that's my headache. Right. Yeah. This has always been the case, right? Open source is free like a puppy, not free like beer. You got to take care. Here's a free puppy. Oh, I see. I see. That's not the end of that transaction, right? Unlike free like beer, end of transaction. Everyone loves a free beer.

50:00 Trust me. Yeah, yeah, yeah. You've never heard that saying? No, I like that, though. So does user commodity software go away and then just, like, corporate B2B stuff stays around? Are you saying that contract exists everywhere? I don't think anything goes away, right? I think the furthest right, like, oh, this is going to explode everything, is just never going to be true.

50:22 Whether or not growth, like, also, infinite growth forever is not a really good model to base an entire economy on either, but here we are, right? Sure, sure, sure. So... So no, I mean, I don't know about going away or not. I just know like even watching some of this stuff with Adobe, like stuff go on.

50:40 Right. And even in my personal life, I've like tried to replace some things that I use like with free alternatives. And the experience is so much more. we're like harder to get the same outcome that I'm like, all right, I'm going to throw 60 bucks at this. Like, especially like as more money is involved, like just in your life.

51:03 So I'm not even talking about like, oh, as you make more money, right? Because for some people, the 60 bucks or whatever it is for a certain piece of software, that's a significant amount of money for a lot of people. That's not right. It's like, okay, like I spent more at Chili's this Friday, right?

51:17 Right. Um, but for corporations, it's really not right. So like I run a business here, you run a business here. Like there's tons of stuff that I like, do I need to pay for Slack the way that I do? There's free chat alternatives. Right. But you do. And it's just great. Right. Like, you know, there's just these little things where I'm like, well, just pay for it.

51:36 I don't want to think about this. Like, you know, my brain power is better used somewhere else, right? Yeah, what is the opportunity cost of your time to care about that? A hundred percent. Give someone else the problem. That's amplified so much when you're talking about corporations, when they're like, well, I would have to staff a team.

51:52 Yeah, sure. To put this in security context, I'm sorry, I'm like up on a big soapbox now. To put it in a security context, I joined a pretty big security team that was on the Elk stack for a while, right? So free SIM, Elastic, you know, Kibana, like all this kind of stuff. I had like talented security engineers on my team that were spending like a significant percentage of their time being sysadmins, keeping the Elk stack standing.

52:16 It would chip over. It would like... Just things would happen. You have to have sysadmins like managing the stuff. Eventually we were like, I want my security engineers doing security, not sysadmining my sim, right? So it's like, oh, this is why people pay Splunk. Everyone laughs about how much Splunk pays.

52:32 And it's like, well, this turns out it's a really hard problem because you're throwing petabytes of logs at something that you have to index and keep alive. And if it goes down, everything breaks. And it's like, oh, okay, got it. This is why you write a check, right? Yeah. This is the same kind of thing, right?

52:47 Yeah. Yeah, yeah, yeah. All right, Soapbox. No, first of all, for the record, Matt, this podcast is mostly you and I getting on and off Soapboxes, so it's totally cool. No worries. That's true. That's true. That's like our job, right? Yeah, man. Well, sometimes I get a little... I have a few buttons.

53:05 We found one. Sure, sure, sure. All right. So this one's crazy. Can I drive this one? Send it. Yeah, yeah, yeah. All right. This one's nuts because... Man, I have to make a short about this today. I was thinking about it. I was like, oh, I've been meaning to talk about this. I don't think I've... ever seen a less ethical creation of margin and profit margin in my life.

53:29 Not even the Adobe Corporation? Whoa! That's called a callback. It's like a family guy tangent right there. So, okay. I also cannot believe that this happened twice in one week. So we have two... executives of ransomware negotiation firms. So this is like, if you're unaware, if you're a victim of ransomware and hackers have gotten in and encrypted all your sensitive stuff and you get that big, scary screen with skulls, that's like straight out of an NCS clip about hacking, that's like, uh, you're hacked.

54:09 Here's my Bitcoin wallet in order to get your like data back. Well, people panic and they don't know who to call. You can't call Ghostbusters. So they call these ransomware negotiation services or recovery services or however they're marketed to be like, hey, I need some cybersecurity experts to come in and like solve this for me.

54:27 Right. Because I don't know what the hell to do. I have a question. Yes. Matt, the guidance has changed much like children. Do the babies go on their belly or on their back? Do you pay the ransom or do you not pay the ransom? This is a hotly contested topic, but the FBI's official stance, if they hold any credibility left anymore.

54:47 Is that bestiality is okay. Got it. Besides that, dude, I missed that news cycle. And when I talked about the FBI getting hacked, my comments filled up with stuff like that. And I was like, I am missing something. I am very confused and scared. And I had to be very careful with what I Googled to figure out what those comments were about.

55:04 so that I could tell bestiality. Ah, crap. I shouldn't have searched for this. Right. Okay. So, uh, yeah, FBI's guidance is to not pay. Right. For obvious reasons, you're a, you're funding a criminal enterprise. B, uh, these criminals are teenagers for a lot of the times. And if you give them millions of dollars, they tend to just be like, lol, I'm going to disappear.

55:27 They disappear on their own crew. Sometimes they don't, they don't help. they don't care about helping the enterprise get back up if you just handed them like enough money to disappear. Right. So there's like a lot of reasons to not. There's no guarantee you'll actually get your data back. Sure. That being said, this was the whole shiny hunters thing was their PR campaign to be like, we're credible because they want their threats to be paid.

55:50 So they need people to realize that they're actually not that bad. Right. And that they're not exaggerating in their claims, all this kind of stuff. So PR is important to them. Mm hmm. But official guidance is to not pay them. That being said, happens all the time. Happens every day, right? Because people are like, I don't know what the hell to do.

56:07 You ransom a hospital without a security team. And they're like, I don't know. I need to get back online right now. Like, you know, what's the quickest path? Well, the quickest path is to send a bunch of cryptocurrency to that wallet address, right? Hope for the best. But what happened is there's this industry of intermediaries that popped up to help these companies that got hit with this ransomware, have no idea what to do.

56:31 They go and Google, what do I do? And these companies pop up and they come in and try to help people. Well, there's a few of these companies and it turns out, that more than once now, some of these companies have been working both sides, both sides of the ransomware coin. Okay, so this Canadian guy living in Pennsylvania, the FBI picked him up.

56:51 He was a ex-founder of Cypher, is I guess how you would say that, C-Y-P-C-H. F-E-R. Okay. But that's what his LinkedIn says is an ex-founder. Turns out that company, not too happy that he's out there calling himself a founder because they're like, he wasn't a founder. And they're trying to distance themselves from him.

57:10 They're like, he was just a manager director here. Whatever. Right. He's also a published author of a book called Cyber Extortion Strategic Response. That's awesome. A practical manual for leaders on managing coercive events, negotiation, and settling strategies. Love that. I really want a copy of this book to put on my bookshelf here now.

57:34 That's why I should fill this bookshelf with just books from cyber criminals. I'm sure there are plenty. He's gone out and spun up a different company now too. So not Cypher. Cybersteward is the other company. So Cypher, Cybersteward, they're kind of in the limelight on this. But he got picked up for...

57:57 like by the FBI for being in on shiny hunters. So not just like, Oh, working both sides of the ransom coin. We've got this executive at a ransomware company that is all of a sudden in cahoots with shiny hunters. If you're not a long time listener of the show, shiny hunters, we keep talking about, uh, just hacked the FBI.

58:17 Uh, two of their leaders just got, uh, popped by the FBI as well. So it turns out, I think they're getting a lot of information on their investigation. Maybe people are flipping on each other is what I'm assuming is happening. we don't have a ton of detail about like what this guy did. Ed Dubrovsky. We don't have a ton of information about what he was doing with shiny hunters.

58:41 Okay. We have like some press releases. We've got some stuff. We just know that he's in custody and we have that he's in custody in relation to the shiny hunters thing. So we'll let you know when we hear some like more info about like what this guy was doing. Cybersecurity executive. Dude, I covered this.

58:56 I had people DMing me that they worked with him. They were like, I've run into this guy professionally, which is now the second shiny hunters person that I've caught those DMS about. The last guy was a pen tester. The guy that got picked up in the Netherlands or something, right? Yeah. I was a pen test consultant.

59:13 I had people being like, yo, I was a pen tester with that guy a few years ago. Crazy. This guy's a little older. Shout out to VX Underground for what's the exact quote from VX Underground on this is... Dang, I'm going to keep it 100 with you. Never in a million years would I have expected a boomer maple syrup again to be an active member of extortion group named after a Pokemon.

59:37 Crazy. Yeah, so obviously, you know, not truly a boomer, but significantly older than the average shiny hunters slash the calm threat actor. Okay, we were prepping for the show. And I was like, no, we have specifics about this. I read specifics about this guy creating margin on these ransomware deals.

1:00:02 And I was like searching all of the articles about this guy. And I'm like, why are none of them talking about the specifics that I know that I read this week? There was another one this week. There was another executive of a ransomware helper group called Monster Cloud. What's this guy's name? I missed it.

1:00:22 Oh, Zohar Pinhazi. Okay. Also 50. So also like older than your average thought actor. Executive of Monster Cloud. Owned and operated Monster Cloud. which advertised themselves as a ransomware remediation company, that they said that they had tools and decryption techniques for recovering your encrypted data without paying cyber criminals.

1:00:41 Well, let's be very careful here, because Pinhazi very specifically told his employees not to use the word decryption and just proprietary remediation techniques, which include playing the middleman. So it turns out all this guy was doing was paying the threat actors for the decryption key and then charging the customers more.

1:01:04 How much more, Matt? Oh, my God. I had some specifics. I'm pretty sure the number you told me pre-show was like, they paid the ransom group like $8,200 and charged the client like $100,000. $150,000. $150,000. $150,000, which, to be fair, you've been in consulting, right? Yeah, probably. not an unheard of consulting SOW cost, right?

1:01:26 Yeah, but for actual work. Right, right, right. But I'm just saying, you can imagine a company gets a SOW from some sort of cybersecurity expert for... you know, tens of thousands to low hundreds of thousands of dollars. And they're like, yeah, I guess this is what cybersecurity costs, right? Like that's what a pen, like a pen test can run you, you know, 60 to 150 grand for a pen test for a few weeks.

1:01:51 Right. But the fact that all he was doing was paying the freaking cyber criminals a few thousand dollars, right? Uh, in another one, he paid 236,000 and charged the customer about 380,000. So, uh, all in all, he charged clients more than $19 million and paid about 8 million in ransom payments. All right.

1:02:12 So I'm going to get in trouble for asking this question. Um, what did he do that is wrong? Uh, Because to me, no, because to me, it seems like he. Okay. Example. My friend bought a Subaru Outback in 2018. Okay. But he didn't want to buy it himself. He didn't want to negotiate with the car dealership because that's a fucking nightmare.

1:02:36 So he paid Costco to negotiate on his behalf. And then Costco took a cut. This is the same thing. I think it's because he's advertising that he's not doing that, that it's fraud. He didn't advertise that he had decryption. He had proprietary remediation technology, which is not wrong. Which is email.

1:02:59 No, so if you read the article, he was charged with one count of conspiracy to commit wire fraud and two counts of actual wire fraud in connection with an alleged ransomware decryption scheme. So I'm assuming there's evidence somewhere that maybe he was like truly on the inside on the other side, maybe.

1:03:16 Yeah. But without that, I really don't understand what's illegal here. Honestly, the quote right there, as alleged in the indictment, by falsely claiming to decrypt ransomware without paying... Without paying off the ransomware. Yeah. Sorry, let me say it again. As alleged in the indictment by falsely claiming to decrypt ransomware without paying off the ransomware, the defendant re-victimized his clients while extracting a hefty profit for himself.

1:03:41 Re-victimized his clients. Explain that. Yeah, I guess he's saying basically that he's also now ransoming them, is what they're saying, right? If I charge you to negotiate for me, you're not... holding me at gunpoint this is a fee yeah yeah listen man I see your point it's obviously just like he's obviously being a dick I'm just saying like if you zoomed out from this and like didn't call it ransomware and called it like home purchase what's the difference Because I don't think that they're knowingly paying him to just go interface with this.

1:04:15 No, you're right. You're right. You're right. They're paying him to come in, like get them recovered. Right. Yeah. Oh my gosh. Just so wild. Yeah, it is crazy. A big, big prison sentence lingering for him too. It's like 20 years. Yeah. Yeah. Yeah. Anyway, it just seems like there's a pattern here that a lot of these ransomware firms are building closer relationships with the threat actors than they're leading off, including some of them working with them, right?

1:04:43 We have another very, very large insider story. Yeah, seamless transition at a company you probably actually have heard of. Wait, who is it? Oh, OpenAI. Oh, okay, OpenAI. This is the funniest picture. Yeah, this is the best. So I didn't understand the context of this. I thought this was a guy, like, detecting that he was getting spied on.

1:05:05 I did not realize that this picture was the spy committing the espionage seeing that he was getting counter espionage getting tracked and it's him detecting the plant dude it's so funny he's like oh no i'm fucked just so many dumb criminal things here so of course by the way okay let's what what happened let's get to it before we get into the reaction so opening your eye put out a statement that they've been cooperating with the FBI, that they detected that one of their employees that happens to be a Saudi national, planted a listening device in an executive conference room.

1:05:39 Okay. They detected this a few ways. One of which was that he left a bag at the office that had his wallet in it with his ID and the recording device. So it's just like, okay, here's my ID next to my crime, right? Very funny. Then they went and found the device. I guess it was a sting operation to him with this camera, like where he was going to go check on the device and got this really, really funny picture of him going to check on his recording device.

1:06:07 The other bit of evidence that they have is that from his wife's chat GPT account, couldn't even use Claude, couldn't even use Claude to do this, Hold on. I'm not tracking this part. He used chat GPT to spy on open AI. His wife's chat GPT account to ask about recording devices, like all of like the Google search stuff of like, how do I do this crime was on his wife's chat GPT account.

1:06:33 That's incredible. I did not realize that. According to asking the chat bot about building a continuous audio recorder, customizing Wi-Fi connectivity and encrypting the SD card. And so I did notice this felt very off the shelf because the picture of the actual device uses a Seed Studio 2.4 gig antenna, which is like one of the, you know, resellers of like Makerspace Raspberry Pi esque things.

1:06:56 So like, yeah, this is literally a tutorial for baby's first listening device. So, yeah. So this isn't, you know, nation state capability level stuff here. Obviously, the conspiracy theory people are coming out on this one, man. I don't know if... Have you talked about this one publicly yet? No, no, no.

1:07:14 I'm not tracking any conspiracies. So I made some videos about it. So they showed up in my comments, man. They showed up. I've been having to hit the translate button on my Twitter replies a lot. So my tweet has made its way over in that direction, right? Uh, and people are, are calling this, well, this was too easy.

1:07:32 Yeah. Like he would ever be that dumb. Uh, these evidence is all planted. This is, you know, whatever. And now, of course there's pictures of, of this guy with the crown prince of Saudi Arabia. And so like the thread is starting to be pulled a lot on this one. And people are like, yeah, right. Like this is the worst, you know, fake false flag story I've ever heard.

1:07:54 And I'm like, Oh God, I can't, I can't possibly. Dude, it's... No, there's no... It's nonsense. Okay, I'm like, who are they false flagging? What do you mean? Right, yeah, like, just... I don't know. We're just coming up with bad headlines about Saudi stuff. It's also just, like, a damn shame that, like, tweets from, like, three weeks ago from OpenAI, like, corporate are, like...

1:08:14 profiling him as like their only Saudi employee. And they're like, look at this, like, you know, putting him up on a pedestal and it's like, oh, fast forward. You're probably wondering how I got here. You know, like is in FBI custody, like literally three weeks after they were like pedestaling him for all this stuff.

1:08:33 So this one's gnarly, obviously. You know, this is part of... We talked about that whole LG story with the TVs having microphones. And one of the actual threats there, instead of advertisers listening to you in your living room, is the TVs with microphones in executive boardrooms that have remote code execution in them.

1:08:54 And like... A threat actor could compromise and tap into that microphone. Well, here you go, right? Here's like someone actually trying to tap into the audio of an executive conference room via a TV just behind it, right? Yep. With an external device. I mean, this is exactly what we were talking about.

1:09:11 I think the other... Like picture here. And we were talking about a little bit as we were getting ready. I've run and you have some opinions. I'm actually interested in. I've run a lot of my like mental math on building security programs geared towards being able to catch insider threats. Because if you are... Not that you don't trust the adults that you hire or anything like that, right?

1:09:36 I'm a firm believer in trusting the people that you hire and treating them like adults and letting them do stuff and not micromanaging and all this kind of stuff. But when it comes to security of things, and when I come to monitoring behavior on my cloud, my network, my code, whatever it is, my mental model is what if...

1:09:57 insider, then now I'm watching this behavior. So it's not just like, oh, that account is my super senior cloud guy. So whatever he's doing is probably fine. No. Right. What's the context? What's going on? Why is that account running those weird commands in prod? All these kinds of things. Right. And so I think that it's kind of an unspoken thing in the industry until these stories pop up is that this stuff is pretty prevalent.

1:10:22 Like there are lots of spies working in Silicon Valley companies, you know, whether or not they all get caught in such a headline grabbing way or not is, is, is one thing. But I've talked to CISOs out there and they just kind of have it in their head that like a certain percentage of people that work for these big tech companies, uh, might be sending whatever information they can get, uh, to, you know, another country.

1:10:47 Yeah, no, I'm with you. I don't think we diverge at all on that. I completely agree. And I think we mentioned this before. Like when you are on a private network that is owned by another corporation, you lose all of your constitutional rights, right? Like you are getting spied on. You cannot do the things you want to do because, you know, the company is trying to make sure that you're not going to, you know, implant the device of the CEO and spy on their communications.

1:11:08 I'm cool with that. I think my reluctance to completely agree with like this attitude is that sometimes that posture, I think, bleeds into network policy and infrastructure policy that makes the execution of your job very painful. And it damages employee morale and that you don't feel like you're trusted as an adult.

1:11:33 You're not able to do your job because the network is too tight because, oh, it's not you. It's the insider. And it's like, okay, bro, but like fucking who am I? You know what I mean? So I'm with you. I don't think they diverge that far. I'm very sensitive about that mentality going too far in one direction of that.

1:11:51 Yeah, I've worked places that it's really hard to get your job done because it's like you're just... Oh, you want a pip install? I don't know about that. We talk a lot about supply chains like H.E.R.D., but mirrors exist? I don't know. It's complicated. I was the head of security for a fintech company that was a small company here in Austin that got bought by Goldman Sachs.

1:12:11 It took us weeks to get back into prod post-acquisition because it was like every command we ran on like... the Kubernetes command line. It was like, oh, you run kubectl and like a bunch of stuff happens. All of it was blocked. And so it's like, oh, you hit a wall. You had to like submit a ticket. Be like, oh, can you unblock this thing?

1:12:31 No, we can't unblock this thing. Google Cloud is obviously not allowed. It's like, well, you just bought a company that's hosted on Google Cloud. And like, can you escalate this? Okay, yeah, escalated. Forgot these guys in Austin have approval for that. But then they would just approve that one URL. And then you'd run the command again and you'd hit the next URL.

1:12:47 And it's like, no, I need this domain. And then you're just playing for a game. You're playing ticket Olympics to get the guy at the sock and the knock to approve your shit. And then again, they're treating you adversarially, unintentionally. It comes off as like you're the bad guy. You have to justify everything.

1:13:01 And then it's like when a cop is following you and you've done nothing wrong. And it's like, do I have cocaine in the car? You know what I mean? It just makes me feel like that. It sucks. I can't relate to that last one. Sorry. I don't know. I'm just kidding. But yeah. I don't do cocaine. It's an analogy.

1:13:18 But yeah, I get it, right? But in terms of like when I'm building a security program and monitoring is like my detection is my goal. Yeah. Gearing towards insider threat as a detection mindset is really smart in my opinion. No, I totally agree. I have no issue with that. All right, man, we went long.

1:13:37 There's one last story we could touch on really quick. You and I are not iOS experts, but there's some drama in iOS jailbreak land. So we wanted to bring it up because it seems like it's some crazy exploits. We do not have the exploit details. So we can't really make like a fun segment on it. But it seems like people on iPhone 18 Pro Maxes on iOS 27.2 have been able to figure out some ways to install some side-loaded stuff on their devices.

1:14:04 But it seems like it's not reliable. Maybe there's some... They're not commercializing it is what they're getting at. And so, like, we can't go look at it. It exists. Yeah. Go read the research if you're into iOS stuff. We'll keep an eye on it if we get any more info on these. And, like, there's actual exploits.

1:14:22 The exploits seem to be server-side, though, which is really, really interesting. Yeah. The deal we are here is that, like, jailbreaks in iOS land, or really in any land, relies on a bug in the kernel or the hypervisor in, like, an enclave system that allows you to run code at the most privileged level so you can take over the rest of the device.

1:14:41 What's interesting about this jailbreak is that it's not actually a vulnerability in, like, the kernel of your device or a secure enclave of your device. It's actually – it was a vulnerability in the way that Apple's developer program does signing on code when you're doing development. And something about it they didn't whitelist.

1:15:00 what things they would sign and allow them effectively to ship a firmware update that got them control over privileged devices within the iPhone. I think like the, like the hardware enclave or like the iOS architecture is very segmented and has a lot of different trust layers, which is good. But I can't speak intelligently about it because to understand this article, you have to be like a 10-year iOS insider, which I am not.

1:15:28 So anyway, if you want to read it, we'll put it in the link for the show. Really interesting stuff. Also very long. So I'm trying my best to like boil it down, but doing a poor job. But yeah, pretty neat research it looks like. So there you go. Yeah, man. All right. So, cool thing about our next episode.

1:15:44 Mm-hmm. We get to do it in person. It's true. I get to, like... We will be... What? Touch you. I get to smell you. I get to, like... No, I don't know. Sorry. That was weird. That was weird, Matt. Um, well, we'll be in Vegas to be at one con. Uh, we have a coupon code to get the one con for a little cheaper.

1:16:01 I believe it's still active. If it is, put it here. And if not, Josh, we'll cut this out of the show. Uh, but yeah, come hang out with us at one con and, uh, you know, we're gonna have some good interviews with some of the people over there at Sutton, the one, some of the presenters and talk about the future of security in the era of AI.

1:16:14 Take a shot every time I say that. But in the meantime, guys, do us a favor. If you're watching this, if you're listening to this, it really does help the show. If you like, comment, subscribe on YouTube, if you rate us five stars on Spotify, we're actually getting discovered natively in the Spotify algorithm, according to some of my friends, which is pretty cool.

1:16:29 And that only happens if you rate the show. And then also best way to help the show out in total is check out the sponsor of the show, Maze, good partner of the show. They really are out there trying to make the internet a safer place with all these AI super hackers taking over. So as usual, guys, thank you for listening.

1:16:44 We appreciate it. And we'll see you. In the next one. Toodaloo. Peace.