Micah Sargent (15:48)
Yeah, absolutely. All right, we're going to take a quick little break and believe it or not, we're talking about some cybersecurity. And then we will be back with my story of the week. Bringing you this episode of Tech News Weekly is Threat Locker. Harden your security with Threat Locker and never have to worry about zero day exploits and supply chain attacks. Again worldwide, companies like JetBlue Trust Threat Locker to secure the data and keep the business operations flying high. Imagine taking a proactive deny by default approach to cybersecurity. So you're blocking every action, you're blocking every process, every user, unless they're actually authorized by your team. Threat Locker helps you do this and provides a full audit of every action for risk management and compliance. It's 24. 7 US based support team, fully supports onboarding and beyond so you can stop the exploitation of trusted applications within your organization and keep your business secure and protected from ransomware. Organizations across any industry can benefit from Threat Locker's ring fencing by isolating critical and trusted applications from unintended uses or weaponization and limiting attackers lateral movement within the network. And ThreatLocker works for Macs as well. Get unprecedented visibility and control of your cybersecurity quickly, easily and cost effectively with Threat Locker's Zero Trust Endpoint Protection Platform. Get a free 30 day trial and learn more about how ThreatLocker can help mitigate unknown threats and ensure compliance. Visit threatlocker.com that's threatlocker.com and by the way, for a limited time you can visit 0TrustWorld.threatlocker.com and use the special code we have ZTW Twitch 25 to save $200 off registration for Zero Trust World 2025. So that's ZTW Zero Trust World Twitch 25. Get access to all sessions, hands on hacking labs, meals and an after party. The most interactive hands on cybersecurity learning event I think those folks we were just talking about need to attend this of the year is happening February 19th through the 21st in Caribe Royale, Orlando, Florida. Be sure to register with code ZTWIT25. And thank you ThreatLocker for sponsoring this week's episode of Tech News Weekly. All right, we are back from the break and continuing on with talk of cybersecurity. This story ended up kind of making me drop my jaw a little bit because humans are a problem. Yeah, look, I know computers are also a mistake at times, but humans are just the weakest link in so many cases. So. All right, let's, let's start this from the beginning. First and foremost, it's important to understand there is kind of, in my opinion, cool group of hackers who are solely focused on not solely focused, but very focused rather on cars and kind of automotive industry exploits and looking at and exposing the different systems that these cars use and the exploits that are possible with them. And one of these individuals is Sam Curry who is a security researcher. And Curry said, mom, I'm going to buy you a car, but here's the deal. If I buy You a car, then you need to let me try to hack it it. And Curry's mom said yeah. And so Sam Curry bought his mom a Subaru and just was able to get around to attempting to hack it in November while visiting for Thanksgiving. This is in the Wired piece and basically was looking at different ways to go about exploiting it. So what Curry and Curry's friend did or colleague did was they kind of, you know, poked around looking at different systems within the vehicle and used Subaru's sort of emergency access technology, but also just sort of the car's inbuilt system called Starlink, not to be confused with the other Starlink, but Starlink, which is part of Subaru, and discovered that when using Starlink, the system reached out to a website, subarucs.com so they went to subaruscs.com and started looking at how the site worked and what it was. And it turned out to be kind of an admin database. And when they went there, they figured out that all they needed to do to reset an employee password was to type in an employee email. And let me be clear with what I'm about to, with what I'm saying here. It wasn't the standard thing where I go to a site, I type, I click the forgot my password, I type in my email and they send me an email to reset my password. No, you just needed to have the employee pass or the employee's email. Okay. And then there's a little bit more that's involved and I'll explain that in just a moment. But all they needed to do was go to LinkedIn and find one of these Subaru employees who had listed their Subaru email. And then they typed that in. And then you go, okay, Micah, but here's the thing. They're not going to be able to gain access because Subaru cs. Don't you worry. The site makes you type in the answers to security questions. So. Well, they're stuck there, right? They type in goof troop97subaru.com and hit enter. And then there are two security questions. What's my favorite flower? And how do I like my eggs? Oh, can't get in. No, they can get in because the website literally they just use practically right click and choose show page Source. The website checked the answer of the security question with plain text responses that were stored in the code. So tulip and scrambled were. Remember that was what's my favorite flower? And I'm following, I'm following. Were in the website's code right there available to them, at which point they pop into the admin site where they are able to get a bunch of information about the individual who purchased the vehicle. You know, the standard kind of information, get access to the, I believe even the license plate, get access to the state that they live in, get access to their home address if they put that information in and loads more. But most importantly, and most disturbingly, they were able to gain access to every location that the car pinged while it was in transit. So, or I guess not even while it was in transit, but while it was, while it was, you know, registered with that account. So they were able to look at the mom's Subaru account and see where she went to the doctor, guess who her friends probably were, see where she went to, went to church, and even where she parked, if she parked in the same location every time. They were able to, with this, this access, unlock the car, make the car horn, honk, start the car. And this database, or this, not database, but this, this site was not just because I have my mom's information that I'm able to, to access this. If they had enough information about any other person, they could also access that person's vehicle. So they reached out to Subaru and told Subaru this was up. And Subaru said, right, right, right, that's bad. That's real bad. And they fixed it. But here's what Shaw and Curry, the researchers have said, which is that, sure, they fixed it so that now it's not as easy to hack it, but let's be clear that Subaru employees still have this, what, carte blanche access to all of this data, and that Subaru is storing this data at least up to a year, which was how long the mom had the vehicle. But they, they tried to claim, or they did claim, the company claimed that the reason for this is so that an employee is able to call, you know, emergency services to your location. Sure. Give them live access to my location. If I hit the button and say I need emerg access, don't give them a year's worth of information about where I've been. And the company, of course, said, well, they sign NDAs, they pass these security checks, they do this, they do that. That only matters as long as it matters, because again, humans. So I wanted to hear your take on this. Emily, as someone who is, you know, who knows a lot about cars and especially as we look at electric cars and the ongoing computerification of these electric cars, does this surprise you at all? And of. Yeah. What's your thought? What Are your thoughts?