The Host Unknown Podcast - Episode 182 - The Tallest & Shortest Episode

Episode Date: February 5, 2024

This week in InfoSec  (08:19)With content liberated from the “today in infosec” twitter account and further afield31st Jan 2011 (13 years ago): Chris Russo reported a vulnerability to dating website PlentyOfFish's CEO Markus Frind's wife. Yada yada yada Markus Frind then accused Russo of extortion and emailed Russo's mother.  https://techcrunch.com/2011/01/31/plentyoffish-ceo-we-were-hacked-almost-extorted-so-i-emailed-the-hackers-mom/https://krebsonsecurity.com/2011/01/plentyoffish-com-hacked-blames-messenger/ Rant of the Week (13:56)The TikTok Hearing Revealed That Congress Is the ProblemFor some, the job on Thursday was casting the hearing's only witness, TikTok CEO Shou Zi Chew, as a stand-in for the Chinese government—in some cases, for communism itself—and then belting him like a side of beef. More than a few of the questions lawmakers put to Chew were vague, speculative, and immaterial to the allegations against his company. But the members of Congress asking those questions feigned little interest in Chew’s responses anyway. Attempts by Chew, a 40-year-old former Goldman Sachs banker, to elaborate on TikTok’s business practices were frequently interrupted, and his requests to remark on matters supposedly of considerable interest to members of Congress were blocked and occasionally ignored. These opportunities to get the CEO on record, while under oath, were repeatedly blown in the name of expediency and for mostly theatrical reasons. Chew, in contrast, was the portrait of patience, even when he was being talked over. Even when some lawmakers began asking and, without pause, answering their own questions.The hearing might’ve been a flop, had lawmakers planned to dig up new dirt on TikTok, which is owned by China-based ByteDance, or even hash out what the company could do next to allay their concerns. But that wasn't the aim. The House Energy and Commerce Committee was gathered, it said, to investigate “how Congress can safeguard American data privacy and protect children from online harms.” And on that, the hearing revealed plenty. Billy Big Balls of the Week (23:41)ICBC Partners Wary to Resume Trading With Bank After Cyberattack Industrial & Commercial Bank of China Ltd., the world’s largest lender by assets, has been unable to convince some market participants that it’s safe to reconnect their computer networks to the bank’s US unit after a ransomware attack disrupted its systems, according to people familiar with the matter.The attack, which was claimed by the Russia-linked LockBit cybercrime and extortion gang earlier this month, impeded trading in the $26 billion Treasury market and, the people said, it has left users of the bank’s US arm skittish about trading with the bank.For its part, ICBC has told users that its US division is back online and operational, the people said. One person familiar with the hack and investigation said a reason the bank could get back online quickly was that a key part of its trading system was unaffected by the attack — a server that was more than 20 years old, made by now-defunct IT equipment maker Novell Inc.. That server contained much of the bank’s trading data and capabilities and is so old that LockBit’s ransomware didn’t work on it, the person said. Industry News (35:28)US Agencies Failure to Oversee Ransomware Protections Threaten White House GoalsUS Thwarts Volt Typhoon Cyber Espionage Campaign Through Router DisruptionInterpol-Led Initiative Targets 1300 Suspicious IPsIvanti Releases Zero-Day Patches and Reveals Two New BugsPump-and-Dump Schemes Make Crypto Fraudsters $240mGoogle’s Bazel Exposed to Command Injection Threat Tweet of the Week (41:51)https://x.com/MikeIrvo/status/1752123455125016839?s=20 Come on! Like and bloody well subscribe!

Who's Andy? I don't know. You know what he's like, he's very committed, so he's probably deep into something right now. Yeah, I know, he's, you know, like you said, committed. He is. You're listening to the Host Unknown Podcast. Welcome to the Host unknown episode. It's a lot simpler, though, isn't it, without him? I have to say. Although the show notes this week were a little thin on the ground, weren't they?

No, they were perfect. They were perfect. I think this is the right amount of show notes. Although we did start with saying, oh, we'll remove remove this and remove that we'll make it nice and quick and then we basically flushed out everything which is just and andy if you're listening we've used all the right fonts in the show notes and we've made the right parts bold and you know we've made it all neat and tidy just like you you know, because we know how anal you get about this sort of thing. He is so anal. He's the most anal person I know about this.

He is. He is, absolutely. And he's also, he's quite pernickety about things as well. Hmm. He is. He is. Anyway, talking about unhealthy acts, Jav, how are you? is anyway talking about uh unhealthy acts jav how are you i am a model of health and fitness are you so you know are you really i mean you sent us a picture of you in the gym last night i have

to say yeah yeah yeah it's like uh who was the famous sculptor? They say, they saw a block of marble and I say, yeah, you know, the sculpture's already there. I just need to bring it out. And that's the phase that I'm in. Chip all the bits away that aren't part of the sculpture. Yes, yes. So, you know, the model of health and fitness is here. I just need to chip away all the algae and the and the and the ivy that's grown up and

like you know yes yes things like that so you know just a few things and i'll be right up there with sam sulica or sebum who and sebum yeah chris bumstead he's a He's a bodybuilder. He's like one of the world's best bodybuilders at the moment. Oh, that's right. I forget you and Andy like to watch semi-naked men flexing and wrestling. No, this is not wrestling. This is bodybuilding. This is like, you know. Yeah, flexing.

This is the flexing part. Yeah. Yeah, flexing part. And one day I hope to be a model of fitness so that I can oil up my body, go out and other men can compliment me and want to touch my muscles. So, you know, it's it's a simple dream. There's not much to ask. Right. I know. I know. But yes, but I did also receive very good news this week that my workshop has been accepted for RSA. I say my workshop, but it's actually a joint workshop. Oh, that's really good.

Yeah, thank you. It's with Perry Carpenter, my colleague, and Dr Jessica Barker. Friend of the show. Friend of the show. So we shall be at RSA this year, hopefully. That's really good. Because, well, we both know how difficult it is to be accepted into RSA anyway, right? But, yeah, it's a good excuse to get out there as well.

Really good excuse to get out there. It is. It is, indeed. So what's the workshop about? How have things been with you, Tom? Well, yes, not bad. It's a little bit, well, running around like headless chickens at the moment. But, you know, I've got a weekend coming up.

Just got to get through today. And, yeah, it's it's it's okay uh i i what i will say is i had some uh waterstones vouchers that i i've collected over the last few months uh and over christmas and so i've i've basically spent almost all of them on uh comic books which i'm really looking forward to reading so uh it's part part of the miller world series mark miller so he's the guy who did kick ass um jupiter's jupiter's legacy on netflix and in fact netflix have bought miller world his his production company uh and are producing even more um and in fact on netflix there's a show called superoks, which is an animated one based on one of his comic books.

And it's really very, very good. Well worth watching. So, yes, I've got a rather large stack of comic books to get through. On top of the vast stack of regular books, I've still got to get through as well. So we shall see. Yeah. We shall see. Looking forward to it.

Help me with this. Are you a physical book, comic book, or read on a Kindle or iPad kind of person? Both. I'm both, I have to say. So these. Sweet ways. Yeah, absolutely.

We've known that. These are physical books, but as you probably know i'm a fan of 2000 ad and judge dread and all that stuff so i get that exclusively on the uh on the ipad um partly in fact mainly because of space there's you know they they do a weekly comic and then a monthly bigger one and you know i would just run out of space so so so much um so yeah i get i get a few things on in on books um you know in physical format and i i also do read a huge amount through the various app stores and stuff like that as well um much better for

when you're traveling or you know all that sort of. But the physical book is still pretty primo when it comes to comic books as well. Yeah. And if you've just joined us, welcome to Comic World by Host Unknown. No, I was just saying, you know, a few years ago I went through a phase of like, I thought, okay, let's just go completely digital.

I don't reread books many times. Like a lot of the books are just like you know whatever and you know they take up space like you said and like oh wouldn't it be great to have a massive library just on your digital device but um I don't know um uh the the a few weeks ago I I had to go up somewhere Manchester I think I was on the train at At the train station, as you do, you're wandering around the WX Smith bookstore. And I picked up a couple of physical books and I was like, oh, this is so nice, you know, just sitting there without a bright screen or something.

And, you know, it's just... When you ruffle your pages with your nose in it as well, to smell the pages. Yeah, yeah. Well, I don't go that far in it as well, to smell the pages. Yeah, yeah. Well, I don't go that far. Oh, God, I do. Every time. I just thought, you know...

OK, enough of your kinks. What have you got coming up on... Let's ruffle your nose through what's coming up on this week's show. Yeah, hang on. You're taking my parts away from me. You can't do that. And talking of kinks and ruffling your nose through things, shall we see what we've got coming up for you this week?

This week in InfoSec goes Crying to Mummy. Rant of the Week is about asking all the right questions at the wrong time and to the wrong people. Billy Big Balls proves that old is gold. Industry News is the latest and greatest security news stories from around the world, and Tweet of the Week is, well, simply horrific. So, let's move on to our favourite part of the show, the part of the show that we like to call...

This Week in InfoSec Hello and welcome to This Week in InfoSec with content liberated from the Today in InfoSec Twitter account and further afield. We've only got one story for you today because i just could not do that much i couldn't be bothered uh it comes on the 31st of january 2011 a mere 13 years ago uh some of you who were around using the internet back in the you know the early 2000s might remember a dating site called plenty of fish uh and that's fish with not with a PH, as it probably would be these days. Plenty of Fish with a PH is like a hack or one or something like that. Yeah, yeah.

So it was a dating website. And like many websites back then then it had some vulnerabilities and what have you. Chris Russo was he claims he's a security researcher and I say claims because I don't know you know back then everyone was like a hacker until they got caught. And then they were a security researcher. So we don't know. But let's say dabbling in the great, a great hat, let's call him that. And he found a vulnerability on plenty of fish website. He actually went on the Pirate Bay, I believe, and he found that there was already people allegedly that had downloaded a lot of information from there. So of about 30 million users. Oof.

So and this included their names, their email addresses, their passwords, because, yeah, like, you know, who needs to hash their passwords? Their personal preferences, desires, and wishes for the future. Yes. Even their PayPal accounts. So there's a lot of he said this and he said this, but the big summary of this is that Chris Russo tried to report it to the CEO, Marcus Frind. Frind? Frind.

Frind. And he wasn't able to get through to Marcus. So he waited a few days and he didn't get a response. And then he reported it to Marcus Frinn's wife. How? What? Why? I don't know. Apparently he asked for a contact and he was given the contact of his wife. Seems a little bit weird. It is.

Marcus then said that, I'm being extorted here. I spoke to Chris. He said that, you know, if you want to see the vulnerabilities, you have to pay us some money, you know, what have you, this, that, the other. So, Marcus' friend, who was the CEO, after accusing Rousseau of extortion and posting many rambly blogs, he also emailed Rousseau's mother to complain about her son's behaviour. Really bizarre. Were all of these contacts in Plenty of Fish, maybe? Maybe that's how they got hold of all of these details. Maybe, Who knows?

How would you even know the email address? I mean, in 2011 as well. I mean, it's... Yeah. Maybe it's through Facebook or something like that. You never know. No, Facebook wasn't around then. Wasn't it? Yes, it was.

Must have been. Oh, yeah, it probably was, yeah. It wasn't Andy. We need Andy to tafty-tafty-tap and find out for us. Yeah, yeah. But we respect our listeners far too much to do that. We know they're perfectly capable of tafty-tafting themselves and finding out the answer.

It's called crowdsourcing, people. Yeah, look it up. But this is really bizarre. I know, I know. Thankfully, I do have your mother contact. You do, you do, actually, in fairness. But then again, I'm not emailing your wife. No, you're not.

Bizarre. Yeah, that is an odd one. That is an odd one. Anyway, thank you. That was this week's... This week in InfoSoul. You're listening to the Host Unknown Podcast.

Bubblegum for the brain. I had to open the door. Yeah, no worries. Okay, go on mute, catch your breath, and I'll crack on. Yeah, the model of fitness and health will go on mute. ethanol crackle yeah the model of fitness and health will go and mute right let's move on shall we to the next part the uh slightly angry ranty part it is otherwise known as listen up rant of the week it's time to mother rage we're going to be talking about our favourite people in many, many different senses, the Americans and TikTok. So as you know, in case you've been living under

a rock, the Congress in America has set up some hearings to talk about the impact of social media and children etc and they've had a few people on on the on the stand as it were one of them is tiktok obviously they also had facebook as well um but uh they had tiktok and they had ceo shu jichu uh who was effectively according to congress the stand-in for the Chinese government and possibly for communism itself. Basically, really trying to sort of thrash him for information about, you know, how awful and dreadful China and communism are. The interesting part of this, and perhaps the most ranty part of this,

is that Xu Zhichu is in fact Singaporean and is a natural-born Singaporean resident and also happens to be CEO of ByteDance, which I think is the holding company of TikTok. Now, there were some scenes which were just plain ridiculous. I don't know who the senator was, but basically asking if Xu Zhichu, was he Chinese? No no i'm a natural born resident on and uh citizen and resident of of singapore have you ever been chinese no i as i've just said i'm singaporean uh have you ever been to china uh and lived in china well yes obviously but okay have you

do you consider yourself Chinese? No, no. As I said, I'm Singaporean. Do you have any relations to the Chinese Communist Party? He said, no. As I said, I'm a Singaporean. And it was just, it was, well, frankly, embarrassing, basically. And let's put this into context as well.

Xu is 40 years old. He's a former Goldman Sachs banker as well. This is not somebody who's just come out of nowhere, has got no track record in business in the inverted commas Western world, that sort of thing. So, you know, it seems like if you have anything to do with China or maybe Iran or maybe, well, if you're American, anything to do with Gaza maybe, then you are the bad person and that it doesn't matter what you say or where you come from or what you do what actions you have or where you live or anything like that it all comes down to if you are someone's you know brothers cousins uh twice removed um auntie's um veterinarian's doctor, then frankly, you're being tarred with the same brush. It's utterly, utterly bizarre. The way that the questioning was, was very much looking at trying to sort of beat them into a corner.

He was asked, would he let his children, because it was all about the children, would he let his children use TikTok? And he said, no, he doesn't let, his children don't use TikTok. And it was almost like, ah, why is that? If you can't, if you don't let your children use it why why are you pushing it on ours he said well in singapore uh it's you know even the junior version of tiktok is is not available um but if i was in

america i would let them use the junior version but it's not available for them to have under singapore and also every single time they tried to sort of catch him out, they just made it worse. He also made a comment, they were talking about the use of data that's gathered by TikTok, and he actually did come back and say, well, let's face it, American companies have not got a great track record on this if you look at Meta and the use of Cambridge Analytica, for instance, Well, let's face it, American companies have not got a great track record on this. If you look at Meta and the use of Cambridge Analytica, for instance,

which I thought was a decent body blow and return. But it feels like, and maybe not quite so serious yet, but it feels like McCarthyism all over in the 50s and the reds under the bed and all that. So I find it absolutely shocking the level of ignorance that is put across to any company that doesn't exist or that exists outside of the USA here. And yes, they were pretty harsh on Zuckerberg. In fact, I think at one point they told him to turn around and apologise to the parents. But then again, he's done some really shady crap as well.

TikTok have not, I mean, as we know, the shady stuff that TikTok have done is out there. For instance, you know, banning me after a week for no reason. But it's... That sounds like a conspiratorial chuckle there, Jav. Were you anything to do with it? I still think you were. But, yeah, it's utterly utterly um shambolic and pretty shameful the way it's

the way he was treated like that um you know and and well that's it that's my rant i've had it you know right go for it go for it jav go on know, to the question as to whether he lets his kids use TikTok, wasn't it like Bill Gates and Steve Jobs famously, like Steve Jobs said in an interview once, he doesn't let his kids use an iPad. And I think Steve Jobs or Bill Gates also said something similar about, you know, this is like normal people that create create this stuff they well they understand it right just because it's there doesn't mean you have to use it

just because it's there doesn't mean you have to give it to your children you know it's exactly it's like saying oh i bought my four-year-old a car and i'm letting him drive it you know privately on private land it's totally legal but you, you wouldn't do that. Why would you do that? No, no. But, you know, as much as it pains me, I'm having to agree with you totally on this one. I saw a clip of the questioning and it was horrendous. Like you said, this is not how you treat people. This is not how you speak to people. This is not like how we, you know, like you said, it's tarred everyone with the same brush. And I, and I get it. I get the need for a boogeyman. I get the need for like, you know, these are the good guys and these are the bad guys. But you know, when

at a nation state level, you can have those things. But when you're like bringing in like individuals and companies and everything like that and you're just like clutching at straws. Yeah. Whilst clutching your pearls. Yes. Yes. That's exactly it. I think it's it's something needs to be done there is a very important conversation about social media their impact on children mental health of not just children as actually even adults and everything and all these social media companies need to be you know um held accountable for their actions but also like we need to like work out well what is the future how do we improve this how do we make it better yeah but simply singling out

some of these companies because they're based in a certain place or what have you it doesn't i don't think it helps the argument i think it just like muddies the water and turns it into a like oh well they're china therefore we don't trust them. And now we're going to let, you know, like Facebook or Meta, whatever, do whatever they want with our data because we trust them. And whereas like the impact on individuals and children is exactly the same, if not worse. Yeah. Yeah.

There you have it. Two weeks in a row, I agree with Tom. I know. I know that rare occurrence is now no longer particularly very rare is it anyway that was this week's rant of the week people who prefer other security podcasts are statistically more likely to eject usb devices safely for those who live life dangerously you're in good company with the award-winning Host Unknown podcast. Right, let's see if you can convince me to agree with you on this one, Jab, or if you're just going to defend the villains.

It is time for... Villainous Affiliates. You know, I'm disappointed, Tom. After that rant, I'd expect better from you to, like, not expect there to be villains and heroes. It's like a world of greys we're living in. But anyway, there's a bank in China called ICbc uh industrial and commercial bank of china limited uh i i saw icbc and i and i was reminded of bcci do you remember that bank back in the

80s 90s there's a big scandal about that yeah what was that all about yeah i don't know i i see i can't even remember what it stood for but i remember reading a headline in in a paper saying bcci bank of cocaine and corruption international so so there's probably some maybe they just rearranged the letters and just relaunched yeah yeah and they sold off one part of theirs to um Mexican branch of HSBC. But anyway, we digress. So ICBC is the world's largest lender by assets. So it's a huge, huge bank. It's an international bank, right? It's not just China, right? it's an international bank right it's not just china right no no it's not it's like royal bank of scotland is an international bank it's not just yes a scottish bank yeah so uh so uh they were hit by uh ransomware which was claimed to be Russian-linked lockpick cybercrime and extortion gang, impeding trading in the $26 billion treasury market.

And, you know, it was – so there's two parts of this. There's two parts of this. One is in a – so I don't know if this is a Billy Big Balls move or this ties into the previous one of China, but many users of – many like partners and U.S. customers are a bit tentative about resuming business with ICBC. They're like, oh, you know, can we really trust you? Should we really reconnect our systems to you?

Should we allow our trading to go through you? And even the US, you know, the bank's own US company, you know, as it were, was questioning whether they should, you know, reconnect and still trade. Yeah, exactly. So it was, it's kind of like a Billy Big Balls move. It's a power move or whatever. I don't know. This is like a strange rebellion move, like against like one of the largest, you know, asset lenders in the world. So I thought that was it. What was really interesting about this story is that although they got hit by ransomware,

they were back online and operational very, very quickly. Any guesses as to why? The hackers didn't know the Chinese language. the hackers didn't know the Chinese language. That's a good one. That would have been probably that. That's a very good one. Wow. Okay.

So I thought you were going to come up with something sarcastic like, oh, they still write everything down in ledgers manually. That's right well is that a key part of their trading system was unaffected by the attack which system is this that can withstand the force of lock bit a server that was more than 20 years old made by now defunct it equipment maker novelle uh and that server contained much of the bank's trading data and capabilities. And it is so old...

They were running a Novell NetWare server? Yes. What? Banking. This reminds me of Star Trek, the motion picture, where there's this massive alien intelligence coming to them called V'ger.

Oh, V'ger, yeah, yeah, yeah. It's really big, all very technical, and they go into the heart of it, and it's the Voyager star, you know, the satellite Voyager that they sent out for exploration. Yeah, Voyager 1. That's what this feels like. You've got this massive bank, global, largest lender, and at the heart of it is a Novell network server.

Like just keeping it all the lights on. And I think that if you still run your entire bank on that, that a true billy big balls move that is like i don't care about updating stuff i don't care about legacy systems what's they this is the the thing that's holding up everything and we will carry on that tradition but you know all i can see is their risk profile over the last 20 years is a huge bell curve because obviously 20 years ago it was up to date and patched and all that sort of thing. Great, not a problem. And then as it stopped going into production, stopped being supported,

that risk rose, an utterly massive risk that it could be attacked. And then eventually that risk would reduce as people basically died because they didn't you know and the older people died and there was nobody left to understand what novell was and how it worked and all or network was and how it worked and then so you've got this bizarre um it's a bit like mainframe systems as well, to a certain extent. You've got a very limited subset of people who understand and manage mainframe environments. And the average, and even above average, script kiddies and hackers would have no idea how it would operate

because it's not Unix, it's not Linux, it's not a Windows-based system. It's very, yeah, wow. Are there any other operating systems that we might know of that fall into this bracket? I mean, Solaris, maybe? Although that's Unix. Isn't that Unix BSD, though? Yeah, yeah. But, you know, I suppose any older versions of Windows, like Windows XP is probably still out there running a bunch of, like,

ATM machines, I suppose. Well, yeah, it is. But that's a fairly well-known vulnerability. I wonder if something was running DOS. Could DOS even interact with the world? I mean, I remember trying to get networking running on DOS and Windows 3.1, which is basically the same thing. And, yeah, that was troublesome with only 640K base memory.

Windows NT4, I think that was the game changer. There's probably got to be some NT4s out there. And the great thing about that is it didn't support usb so you couldn't yeah so if had iran had the iranian uh nuclear facilities been running at windows nt4 they would have been hit by um stuxnet yeah yeah god well it's i mean this is this isn't just security through obscurity. It's almost through, you know, obfuscation. Yeah, yeah.

Bizarre. This is like, yeah, I know, I know. This is like even if you broke in and you got to the terminal and you had admin access, you would not know what to do with it. Yeah. What? Ah, VaxV vms there you go there's a platform that is just simply doesn't exist anymore remember that no you didn't you didn't dir or change dir you

set def to to even just change directories i remember that as a vaaxVMS operator I've still got my manuals in the attic Wow So did you ever configure a Raptor firewall? Yeah Oh man Yeah is this a Billy Big Balls or is this a

Thank fuck for that Hey look i like to believe someone intentionally made that decision or accepted the risk somewhere that say that like you know yeah at the height of that bell curve he was like fuck it it's gonna be what's the worst that's gonna happen exactly exactly and you know what this this this this like i know it's not a real parallel but you know when maersk got um ransomware the the shipping company yes and yeah they recovered everything from a single ad server in ghana or something somewhere in africa i can't remember where exactly because there was a power outage at the time. So they were disconnected from the internet. So the ransomware didn't hit it.

So I think, you know, this is really interesting because one of the things about, say, like warfare or combat or whatever, martial arts, if you're doing, or war or whatever, is the value or the greatest success chances are when you are unpredictable. If you don't know what your enemy is doing, you are going to spend a lot of resources trying to defend 24-7. If you know, oh, my enemy is going to attack at 3 p.m. from the east over that bridge over there then you can have a

good night's rest you can like chill out what have you the next day you can set up your defenses at five to three just straighten your tie and get ready that's right that's right um and and and that's kind of like how we are with defenses. Everyone follows the same security playbook. And so, you know, if you're following a NIST or an ISO standard and what have you, and everything's all good, all the boxes are ticked with compliance, then as an attacker, you just need to understand that and you can break in. things like ancient relics of operating systems and systems that randomly go offline forget not five nine up times we want just like 33 uptime on these servers you're gonna throw them so far off their game and you will be protected i think that's the rant here the billy big balls of the week is like you know embrace the imperfections and you will be far more secure. Absolutely. Embrace your downtime. Yes.

Thank you very much, Jev, for... Billy Big Balls of the Week. You're listening to the award-winning Host Unknown podcast. Like a real security podcast, but lighter. All right, Jav, it's that time again. What time is it? It's that time of the show where we head over to our news sources over at their InfoSec PA Newswire, who have been very busy bringing us the latest and greatest security news

from around the globe. Industry News US agencies' failure to oversee ransomware protections threaten White House goals. Industry News US thwarts vault typhoon cyber espionage campaign through router disruption Industry News

Interpol-led initiative targets 1,300 suspicious IPs Industry News Ivanti releases zero-day patches and reveals two new bugs Industry News. Ivanti releases zero-day patches and reveals two new bugs. Industry News. Pump and dump schemes make crypto fraudsters $240 million. Industry News.

Google's Bazel exposed to command injection threat. Industry News. And that was this week's... Industry News. This is one of those things where, like, the titles tell us absolutely nothing about most of the stories. Well, I suppose the pump and dump scheme... No, that's right.

Andy's more familiar with those, but, you know... He is. He's not here to explain. It's a shame he's not here to talk about it i think he's he's definitely more dump than pump but uh well so let's see what have we got so avanti releases zero day patches and reveals two new bugs hasn't cisa c-i-S-A, not Certified Information Security Auditor, but the American Cyber Security Agency. Have they not said, they said recently they're going to advise all users of Ivanti's products to shut them down by Saturday. Is that right?

Yeah, their VPN form. That's right. They said just get rid of them. They didn't say... Just get rid of them. They just said get rid of them, throw them out. Yeah. Yeah, the only valid use for these is now as doorstops.

That's pretty... Yeah. That's pretty harsh. I wonder if there's some kind of recompense, because if Vanti is saying, because they've released zero-day patches, reveals two new bugs, etc., if they're saying that they are making good the failures in their systems, they're patching them, etc., but a governmental agency is saying,

stop using them and replace them, is that interfering with, you know, commerce and capitalism and it's a bit like you know if if the government said right stop using windows no more microsoft products in any government agencies would microsoft have something to say about that i find this quite interesting well microsoft too big to fail you know microsoft is uh you know like enron yeah exactly yeah and arthur anderson right too big yeah yeah i i don't too big to fail obviously i don't know about this one because it's like they they released some patches but then mandiant's discovered some new malware on it and

honestly even the update they said like their advice is to factory reset their appliances before applying the patch in order to prevent threat actors from gaining upgrade persistence in their environment so I think it just

might be a very big cluster of issues right now there might already be some environments which csa have thought like they've already got persistent and they they can come back and no matter what you do with patching it's not going to be effective for now and that might be the reason behind it so yeah it's difficult isn't it because security in this in an instance like this has got to you know take a precedence to a certain extent but is avanti going to survive this i mean have they got a broad enough portfolio that they can take this this hit because because it's you know what other companies that use avanti are going to see this advice going out to agencies and go whoa maybe we

should be doing the same maybe we should should be junking our Avanti products and looking at something else. It's not the time to be an Avanti salesperson, is it? No, no, not at all. I'm just trying to look up what they are. They were founded in 1985. Wow. Wow, they're old school as well.

Yeah. It was formed in January 27 by the merger of Landesk and Heat Software, their identity. Okay, no, I said I wasn't going to do an Andy and start clicking and reading stuff while we're on the show and giving giving real context to our listeners I know yes exactly uh well see Interpol targeting 1300 IPs is not it doesn't seem like a lot of IPs, really. No. 1,300 associated with malicious... Addresses all URLs associated with malicious activities. Oh.

Yeah, I think they're trying to target C2 controllers and what have you, but... Whatever. They called it Operation Synergia. Sorry, go on. Huge if true, go on. What? I think these stories are huge if true,

and we've probably exhausted everything we wanted to say about them. Yeah, because we haven't got our researcher on the team at the moment. No, we are in turn back. Exactly. That was this week's Industry News. This is the podcast the King listens to. Although he won't admit it.

Got it right this time. Phew. Let's head into the last part of the show. It is the last part of the show. It is time for... Tweet of the Week. And we always play that one twice. Tweet of the Week.

This is a great one. This is absolutely great. So this is a retweet, effectively, by Michael Irving, and he's retweeted Elon Musk. musk i mean and elon's always good for a tweet of the week because of the utter utter madness he uh he sort of puts out there so michael irving's quote is the audio log you find in a trashed office in a sci-fi horror game so picture the scene you're moving from room to room almost aliens film style you go in trashed papers and there's a there's a there's a you know let's get power to the station

so we can see what logs have been made you know something awful's happened here and musk's tweet is the first human received an implant from Neuralink yesterday and is recovering well. Initial results show promising neuron spike detection. Holy moly! That is exactly like a sci-fi horror game or film. Dear me! It is. I have no idea. Like, it is i have no idea like what i have no idea and thing is it's like this is typical elon he i wouldn't be surprised if this is actually dialogue from a an old game that he's dug up and just like posted out there because there's no details on it there's no nothing no and uh i saw

some really good replies to this this tweet and one guy he's posted a picture and he's got like just below his hairline he's got like a ton of blood and everything and he and he's tweeted like oh i was the one who got the new the neuron implant everything's good i can't eat solids for six weeks and i have to have this weird battery acid but it's all good you know something like that it was just like hilarious bizarre but you know i'm the actual technology side of things i have to admit i'm quite excited by but i would fucked if i didn't have anything to do with elon Elon Musk being in control of any of it not going to do it at all yeah yeah he he's just such a charlatan and a fraud

yeah yeah it's one of those things I think a bit like how Tesla um the cars themselves I I I personally wouldn't ever buy a Tesla I've heard too many stories about their unreliability build quality delivery build quality but what it does did is it pushed the industry to make some really high quality electric vehicles or hybrids and and that kind of stuff so i think you know this is kind of like elon's like a kind of like a beta tester for or like you know a massive massive beta product like you know let's just see is him is there demand can is this feasible whatever and um i think if it is right and then some proper medical people can look at the thing and like use it for for like to help people like with paralysis or, you know, what have you. I think that would be absolutely amazing.

But, you know, we're still many years away from it. Yeah, absolutely. But I think I think as a brand, I think Elon Musk is a little bit more toxic now than it ever was. Yeah, it's a weird one. He kind of relishes playing the cartoon villain as well. But then he gets more and more unhinged every day and his descent into right-wing anarchy is just horrendous it's a bit like i think when trump first announced he was going to run from president like many years ago it was kind of seen as a joke a bit and it was like what have you but then it stopped being funny and they started real consequences it did stop being funny absolutely Absolutely. Yeah. Oh, dear. But nonetheless,

this tweet is, however, rather funny. Tweet of the Week. Right. That is... Well, that's it. We've got to the end of the show. We struggled.

We held each other up as we crossed the finishing line. We just about made it, I think. So, Jav, thank you very much for your time today ah you're welcome as always and uh thank you there's something missing isn't there it's bizarre stay secure whatever all right see you next week you've been listening to the host unknown podcast if you enjoyed what you heard comment and subscribe if you hated it please leave your best insults on our reddit channel worst episode ever r slash smashing security

and here you were worried that we wouldn't be able to fill up the whole time we did with our awkward silences i know i know just a little bit right just a little bit yeah this this uh this rather long episode will be cut down to about 20 minutes i hope so yeah