Loading summary
Transcript36 lines
- [00:01]
A
All right. Good morning, everybody. Welcome to the party. We're dealing with a little bit of challenge right now, but wanted to get the show started. Welcome you into the show. Good morning. If you're looking to stay current on the top cyber security news stories of the day while being informed, educated, entertained in all the things all at once, well, then, you're in the right place. Welcome to Simply Cyber's Daily Cyber Threat Brief Podcast. I AM your host, Dr. Gerald Dozier, coming to you live from the Buffer Oer Flow Studio on this glorious Thursday, January 22nd. We are on episode 1 52. Settle in. We might have a little bit off the rails here, but we're going to get it sorted out, I promise you. Get comfortable, get your coffee. Let's get cooking. All right. All right. Well, good morning, everybody. Kind of dealing with a weird, unusual issue today. So my entire Spotify seems to be broken, which is obviously disruptive to everything, considering how much I use the Spotify for the show. You'll notice that there's no background music right now. I cannot play the actual podcast itself, but we're gonna turn it off and on again here really quickly, so terminating Kill all Dash nine on Spotify. If you know, you know. Good morning, everybody. Hey, listen. Every single episode of the Daily Cyber Threat Brief, even ones that start off a little bit rocky, is worth a half a cpe. So as we're getting sorted out here, do me a favor. Get. Get in chat, Drop a hashtag, you know, cpe, Grab a screenshot. There we go. It looks like we are back up now. The old turn it off and on again. It 101. There we go. Oh, that feels right. Good morning. What's up? Cube is in the house. All right, guys. Yes. So every episode's worth half a cpe, and this one's no different. So go ahead, say what's up in chat. Grab a screenshot. Make sure that you have the title of the show and the Episode individual number the 22nd, 1052. The reason is, if you ever get audited for your CPE submissions to your cyber security certification bodies that evidence, those screenshots will be what you have to send over there, because otherwise, you would have to go back to every single episode and find where you said what's up? In chat. And I just got to tell you, that is gonna be undesirable. And no one's got time for that, right? Especially. Okay, Nobody got time for that. There we go. Ain't nobody got time for that. All right, all right. Hey, Ab's in the house. Good to see you, Port Zero, Mr. Roswell UK. All right, now you can play it directly from the website Roswell uk. However, it becomes problematic because when you stop it and hit start again, it. It tends to start over the podcast. So then you have to scrub it a whole bunch. All right, first cup of coffee coming at you, boy. Here we go. If today's your first episode, I do appreciate you hanging out and checking us out. I typically do start the show without any issues. So this is a bit of an anomaly. But the cool thing is we got it sorted out. It is Thursday, which means only one thing. This guy right here, Dan Reardon, the haircut fish, produces a piping hot one of one custom meme every single Thursday for us. He's got a banger today. If you like to play the game. We have, like, a little silly game that we play in here. Elliot Matice definitely likes to play it. If you want to guess kind of what the theme is of the meme, it is something that's relevant to what happened because very, very nuanced element of part of the show this week. So it's a very. I would call this like an expert level meme guess if you get it. All right, guys, so if you're. If you're here for the first time, though, drop a hashtag first timer in chat. Exploit Forge says it's his first live or her first live. Exploit Forge. Welcome to the party, pal. Welcome to the party. Hold on one second. I want, I want to. I want. I'm gonna shut the music off. I want you to get a nice, crystal clear welcome to the party, pal, from my friend, Exploit Forge. Welcome to the party. Yes, sir. Yes, sir. I love it. All right, guys, we are gonna go through eight stories. I. I literally, literally, literally have no clue what they are because I don't research or prep for the show. Ain't nobody got time for that and I don't even know, like, what they are today. I haven't even gotten the tabs open, so let me do that. You can see how the. The cough. The coffee's made. Oh, my God. You can see how the sausage is made. All right, I do have a programming note for everybody. This coming Monday, January 26th, you will have a guest host. 1. Tyler Ramsby will be your simply Cyber Daily Cyber threat brief podcast host. I have a medical procedure that needs. That I need to do that's going to take me out of action for the entire day. Hey, what's up, Guervin WESH 8445. First time live. Welcome to the party, pal. Welcome to the party. Great to have you here. And Ron Rao. Knock. Narula. Ben lurking. First time live. For real. Hey, if you're a lurker, welcome to the party, pal. You can lurk all you want, but if you feel like taking the next step, drop a hashtag. First timer in chat. Make it the only thing you ever chat. But we got you covered, guys. Every single episode of the Daily Cyber Threat Brief is bringing you eight stories. I go beyond the headlines. I have 20 plus years of experience. You can read the headlines yourself. So there's no additional value if I just did that. So what I like to do is rip the lid off the top of the story, go deep down the rabbit hole, and give you additional insights and values that you can apply at work or helps people. I gotta tell you guys really quickly, I have been getting like several. Like, I get these periodically, but in the last, like month, I've probably gotten much more, you know, like five, six of them. People telling me that, you know, they got a job in cyber or they've worked in cyber for a few years now. But simply cyber was how they initially got exposed to cyber security and, and learned the acronyms, learned the lingo, understood how things pieced together, and ultimately gave them the confidence and support to continue forward, striving to get a career in cyber and then ultimately getting it. So super excited to hear that we as a community, because it's definitely beyond me, we as a community are having a positive impact on people. We don't even know that we're helping. We have another first timer. I have a system. Welcome to the party, pal. Welcome to the party. Yes. And exploit Forge. Dropping the hashtag. So that's good stuff. Good stuff, baby. All right, so every single episode of the Daily Cyber Threat Brief, including this one, has sponsors because they enabled me to bring this show to you. Marcus Kyler, Blue Badge, 37 months. Looking good on you, dude. Very kind of you, Marcus, to welcome the first timers. Guys, let me tell you really quickly about the show sponsors. As always, there are links in the description below. Feel free to support the channel and the show if you enjoy it by clicking on those links and checking them out to see if it, you know, to check it out, see what it's all about. Let me tell you about area first, guys. Everybody's got to be familiar with this problem, right? Your leadership team is banging on the desk. Give me some AI automation right now. I saw that Leonardo DiCaprio, Wolf of Wall street meme, where it's like, sell me this pen. And then the next slide in the meme is. Is the guy saying it's AI powered now. Like, lol. All right, so everybody's asking for it, people are using it. I use it, you use it. AI is being used all over the place. Even if the tools aren't approved. You've got shadow AI sprawling across your entire network, creating security risk all over the place. Your sales team's using it, your marketing team's using it. I don't know why I went full Boston right there. But it. It, it leads to exposure, man. Right? One slip up and you've got a security breach. One issue. You got IP theft, you, regulatory fines. But what if I told you. Okay. Oh, we got a wrecking ball. Wait a minute. What? Who is the wrecking ball? Give me. Oh, The Indefinite Scholar. I just broke into my first cyber role trying to keep up with cyber news. Oh, yeah. Well done. Well done. Congratulations, Indefinite Scholars. Super pumped for you. Go crush it, dude. All right. What? Listen, guys. What if I told you AI could be an advantage instead of your biggest risk? Oh, say more. What if your team could innovate while staying protected? That's what Area does. That's why I partnered with them. It's a unified platform that combines AI security, governance and orchestration. So you don't have to choose between innovation and and protection. Take control today. Turn your AI stress into success. If you're ready to get started, go to Simply Cyber IO Area now and check it out. Simply Cyber IO Area. It's a problem. Guys. You can't just stick your head in the sand and pretend that AI is not going to be a problem because it is. Also want to say holler it to Anti Siphon training. Guys. You. If you're in the active defense and cyber deception course, you're finishing that up today. I hope you've been enjoying it. Did you go to Michelle Khan's osint? Like a hacker training? Let me know. They got mad, mad things coming up. And what do we got here? Oh my God. I. I was just on a call with this guy yesterday. Guys, next week you can register for this Anti cast. It's a one hour free seminar. Effective AI for practical SecOps workflows with Hayden Covington. This guy is a meteor like meteoric talent. He's younger than you think. He's incredibly talented, very organized, pretty humble dude. And he's going to be talking about how to use AI effectively for your workflows. Also, if you want to get, get after it. He is. He is going to also be on Simply Cyber. Check this out. Did you know like I've asked several content create several people in our industry if they want to partner with Simply Cyber to produce content. Right. So the produce videos coming out on Simply Cyber. Yes, sir. The same guy, Hayden Covington is going to be talking about AI and blue team reality checks that's coming out in just a few weeks. So get your, get your, your, your chops ready for that. But this one, come check out this webcast with Hayden Covington. Love this guy. If you want to work in a sock, this is where you need to check out. All right? So go check that out. Thank you very much. Of course, I will be at Zero Trust World in March alongside Kimberly can Fix it and Kathy Chambers. But for Threat Locker is putting that on. They're doing a whole bunch of stuff. Let's hear from Threat Locker really quick. I'll be in chat chatting you guys up and then we're gonna get into the news. I want to give some love to the daily Cyber threat brief sponsor, Threat Locker do zero day exploits and supply chain attacks. Keep you up at night. Worry no more. You can harden your security with Threat Locker. Worldwide companies like JetBlue Trust Threat Locker to secure their data and keep their business operations flying high. Threatlocker takes a deny by default approach to cybersecurity and provides a full audit of every action allowed or blocked for risk management and compliance. Onboarding and operation is fully supported by their US based Cyber Hero support team. Get a free 30 day trial and learn more about how ThreatLocker can help prevent ransomware and ensure compliance. Visit threatlocker.com DailyCyber. For sure. For sure. Thank you, Threat Locker. Hey, really quick note number one. All the people in chat who attended Michelle Khan's training yesterday saying they love it. I told you guys, I will not steer you wrong. Okay, that's not what my bag is. My bag is to tell you about all the cool stuff. So I'm glad you guys enjoyed that. Secondly, I just talked about Hayden Covington and I said he's having a meteoric career. Like a meteor flying through space. Meteoric. You know, like when a meteor comes into our atmosphere and it's like burning super bright and you're like, whoa, look at that meteor. That's what Hayden Covington is. He is super bright and moving very quickly. He is not mediocre. So if you think I said mediocre, it's just because I, I, I butchered the English language. He Is he is superstar. Okay, let's, let's do that one.
- [13:39]
B
All right.
- [13:40]
A
Now do me a favor, everybody sit back, relax and let's let the cool sounds of the hot news wash over all of us in an awesome wave. I will see each of you at the mid roll.
- [13:56]
C
From the CISO series, it's cyber security headlines.
- [13:59]
B
Foreign.
- [14:02]
C
These are the cyber security headlines for Thursday, January 22, 2026. I'm Sarah Lane. Tesla hacked zero days at PWN to own automotive security Researchers at PWN to own Automotive 2026 demonstrated 37 zero day exploits across EV chargers and infotainment systems, earning $516,500 in day one. Awards Synactive gained root access to Tesla's infotainment system via chained flaws. Teams also compromised chargers from Alpatronic, Autel, ChargePoint and others. Vendors have 90 days to develop and release security fixes before Trend Micro's zero day initiative publicly discloses them. Everest.
- [14:52]
A
All right, so a couple things here, all right, like everybody's tearing up this meteoric, like let, let me just say it plain. Hayden Covington is a super talent. If you got, if you had to pick partners for a class project, you are knocking people over to get to Hayden to be his partner in the project because you're, you're gonna get an A. All right? All right. So pona own happening again. I did not know that pwn to own had an automotive variant of it. Pwn to own has long been known as to me as like the Olympics of security, you know, hacking or security research. They of hardware. It was originally called pwn to own. My understanding goes that if you hacked it, you got to keep it, right? So that, that's where the two own piece comes from. And it would be like the new iPhone. It hasn't even come out yet. And then you know, you'd be able to hack it, get rude or jailbreak it or whatever. And then you'd walk home with a new iPhone. That's like pre release, right? It's like getting that lore when eclipse pre release you got, you got that sick bloom tender before anyone else on the strip, right? That's what pwn to own is. And it usually causes the like some of the best security researchers to come out of the woodwork because it's, you know, it's cool. I guess there's an automotive dimension now. This thing's been around for like, I don't know, 10 years, 12 years. And they hacked a Tesla. Now everybody knows Tesla. Elon Musk is a very polarizing, you know, richest person on the planet, right? So he's. Everybody knows Tesla. Hacking through the infotainment system is pretty cool. They got root access on it. If you don't. If you are interested in hacking cars, it it to me it seems that the infotainment system is like where you start, right? Because the brain of the car kind of operates here. You can control all the things. There's like a, a cam bus going on in there. The one thing that I find interesting is how low the prizes are usually pone to own. It's like hundreds of thousands of dollars. So like Tesla given 35 grand to hack the. The infotainment system seems kind of low. Yeah. You can see here they made a half a million dollars yesterday. Oh my God. Can you imagine make a half a million dollars in one day? Jeepers Man, 37, 0 days. CVE. You get a CVE, you get a CVE all over the place. So I'll just tell you this, like this is great. I honestly believe bug bounties and this is a variant of a bug bounty program. I think bug bounties are the greatest thing ever because from a business perspective you're only paying when legit findings happen, right? Things that need to be fixed. And as a researcher, you know, obviously you can. It. It sucks if you work a lot and then don't find anything, but it's rewarding when you do find something because you are going to get paid and get that notoriety and stuff like that. So I just think for the overall health of like society and all the technology we're using that bug bounty programs are the best if you are interested. The only, the only thing as far as like a call to action here, like this is interesting. The only thing is if there's someone in chat who's particularly interested in hardware hacking PWN to own should be like on your vision board like that, that should be like one of the ladder rungs near the top of the ladder that you should be striving for. Again, they don't just show up. It this isn't the wizard with Fred Savage where like you show up and you find out you're going to play Super Mario Brothers 3 in the finals. Like they're given the tech in advance and they, they get to screw around with it and then they show up for PWN to own and then execute on fresh tech like, like freshly. You know, it's the same tech they've been screwing with, but it's like a clean instance of it. Okay, so that's what's Up. Also, if you didn't know, we have a drinking game here. If I make an 80s or 90s reference drink, I saw the wizard in. In. In the movie theater. Remember the Power Glove? The guy with the Power Glove who was so cool? Actually, Haircut Fish has a meme of my face on that guy. It's actually kind of disturbing.
- [19:18]
C
Sitting on Under Armour data. The Everest ransomware group allegedly stole data from 72.7 million Under Armour customer accounts in November, then posted it online on January 18. This includes names, emails, dates of birth, genders, locations, and purchase history, with claims that phone numbers, addresses, loyalty details, and preferred stores were also exposed. Everest, active since 2020, uses double extortion, network access, sales, and insider recruitment to generate revenue while keeping a low profile purple.
- [19:57]
A
All right, so that's pretty clever. So. All right, so here's the value on this story. Everest ransomware. I haven't heard of them, but, you know, I guess they're. You know, they hit Under Armour, which is like, you know, Coke or is the Pepsi to Nike's Coke. So Under Armour is, like, legit. So 72 million customer accounts affected what? You know, to me, it depends on what data they got, right? If they got my email and my name and, like, the fact that I bought Under Armour sweatpants four years ago, I'm okay with that. They got my credit card or my password, which I don't even have an account with Under Armour, but it's legit. I. I actually am excited to, like, talk about what this story tells me. Here we go. Name, email, date of birth, gender, geographic location, previous purchases. All right. Of course, Under Armour is so big and successful that they haven't acknowledged the alleged leak yet. Like, it didn't happen. All right, I got two things for you. Here we go. All right, so class action lawsuit against Under Armour has been filed. I'm sure the lawyers will make millions of dollars, and you and I will get a, you know, like, whatever, a voucher for $0.87 off our next Under Armour purchase of $50 or more. Okay, so here's the deal on this one. We got two things. Number one, and not acknowledging that you've been in a. In a. A data breach or a cyber attack. You should. Listen, you should get your ducks in a row and be able to respond publicly if there is an incident. Okay. I'm not saying, like, while you're still trying to figure out what's going on or if the threat actor's still in the environment and you're trying to contain it, that you go on Twitter and say, oh, we're dealing with an active incident. Everybody's data is probably stolen. I'm not saying that. I'm saying once the dust is settled, you've gone back to known good state and you're picking up the pieces from the hurricane that just hit you. You do have to acknowledge it. Doing what Under Armour is doing here and not acknowledging it's ridiculous when there's a class action lawsuit already been filed against you. Like, Under Armour, Like, I. I don't know, like, is. It makes me think of a child playing hide and seek, where they're like, you can't see me. We didn't have a data breach. Like, what are you doing, dude? Like, everybody, you. Okay, the second thing worth noting, and this is probably the most important thing, is that this particular ransomware threat actor group is recruiting internal people. So if you work at Under Armour, they are interested in targeting you. Not. Not Under Armour now, because they already own them. But, like, my point is, like, your business. Listen, if a threat actor gets access to the environment, it's. It's not that difficult to get in and drop ransomware, okay? The access is, you know, not the biggest hurdle, but a big hurdle for them. So if they're able to get someone internally to help them out, that solves one of the biggest problems. And think about it for a second. Like, whatever. Like, let's just pretend for a second that you work at the water department up in the, you know, I don't know, in the Midlands. Just. I'm randomly picking items here. Let's say you work at the water department in the Midlands and you're making, I don't know, let's say 50 grand a year. 60. Hey, you know what? Let's give you a. A promotion. You make 80 grand a year. Okay, but, you know, you're starting your life. Maybe you're, you know, gonna buy a home, gonna get married, gonna start a family, gonna buy a car, you're gonna upgrade to a van, you're gonna put a little in retirement, right? All of a sudden, that 80 grand doesn't go very far. Okay? Now this guy comes out of nowhere is like, listen, bro, I'll give you half a million dollars, no questions asked. All you got to do is give me your credentials. That's very appealing. Okay? So for me, all I got to say is, I. This is an interesting. This has always been a concern, insider threat. But now when ransomware actors are actively recruiting internal people. And by the way, thank you, LinkedIn. It's very easy to Find. It's very, it's very easy to find where you work. Right. I like. Who do I want to target today? I want to target Tesla. Well, I'll just go on LinkedIn and see everybody that works at Tesla. Then sort by, you know, like position and go find someone who's got, you know, works in it. But maybe they just started there or works in IT and they've been there a long time. Actually, that'd be a good one. Find someone who works in IT that's been there a long time. So they probably have access to all the things. And then look at their job history. Have they had the same job for more than five years? Well, then it sounds like somebody's not getting promoted. It sounds like someone's not being appreciated at that company. Sounds like someone that you can come on in and be like, you know what? You deserve more money. All you got to do is hook me up, brother. Right. So just be mindful of that. Of course. Least privilege. AC6. Hold on. AC6. NIST853. GRC mafia. Yes, sir. All right, all right. For those, for those who are new here, I live and breathe NIST and I spent many, many years like embedded in NIST 853. So anytime a control comes up, I like to guess the control number. And if I get it right, I feel good about myself. And if I get it wrong, I feel terrible. It's. It's not healthy what I do anyways. Least privilege zero trust architecture. Disable accounts when people are getting laid off, fired, terminated. Rift Non. Voluntarily terminated. Voluntarily terminating. Shut it all down. Okay. Also, conditional access, meaning like if it's coming from Cambodia, but you know, they live in Mount Pleasant. It's probably fake.
- [26:05]
C
Bravo campaign targeted IP addresses via fake jobs recorded futures. Insect Group says North Korea linked Purple. Bravo used fake developer job interviews to target 3136 IP addresses and 20 organizations across AI, crypto, financial services, IT and software sectors. From August 2024 through September 2025, candidates were tricked into running malicious code during coding tests on company devices and exposing employers and creating supply chain risk. Insect Group links the activity to the broader contagious interview cluster and notes overlap with North Korean IT worker espionage and financial theft operations.
- [26:55]
A
All right, so do, do, do, do. All right, so IP addresses are easy to replace. So the takeaway here is that there are scams going on and this has been going on for quite some time of threat actors doing malicious interviews. Now, if you caught MOD is modern Rogan Chat. Modern Rogue did like a I like basically deep fake with me stream yesterday. And, and that was. That's like a double meaning because it was a deep fake of me, Gerald Ozier, but also it was like, hey, like, let me share my screen and you can deep. Learn to deep fake with me. Deep fakes are all over the place. I actually. So that's what these fake job interviews are. The, the. These 3000 IP addresses, whatever. Like, you can't block these. I mean, you could, but it'd be stupid because it's trivial for them to replace them. People are using LinkedIn to appear to be recruiters and target people for fake interviews or pretending to be top talents and get with people. I saw this this morning. Hold on one second. Hold on one second. Jason Rebels. Jason Rebels was my guest. What the hell? Why?
- [28:10]
B
Why?
- [28:12]
A
Jason was my guest on Simply Cyber Firesides the other day and I saw him post this this morning. Look at this. And Jason. R, E B H O L Z. If you're listening, not watching, but look at this. This is like an active video. He recorded this. This is him in the corner. This is a guy. Like this whole post right here is about how he got like pressured yesterday on LinkedIn to like get on the call with this guy and it's a. It's like an active deep fake. And he like points it out. He actually has a friend who owns a deep fake detection technology company. So he sent it over there. Very interesting. But let me. I'm gonna copy a link to this post. Go. Like, seriously, go check this out. Okay. Deep fake post. I. Oh, shoot. I can't. Hold on. I can't. The. The URL is too long. Give me one second because this is valuable for y'. All. Here we go. There we go. If you can check that out. So here's the deal. This is a news story about how North Korea and other Southeast Asian groups are using fake job interviews to get North Koreans fake it or North Koreans I T Jobs. We've seen that. To get. To trick people into installing malware on their computer to do a technical evaluation of their skills. Right? So like I'm some superstar developer who works at Open AI or works at, you know, friggin Google or something. And then North Korea sends them a message and says, hey, I'm a recruiter for Facebook or Microsoft or Apple, like whatever. Choose your adventure. And we love what you're doing. We're. We're willing to double your salary. Do you want to talk? Of course I want to talk. Double my salary. Let's go. And they're like, all right, before we hire you, we do need you to do a technical evaluation, install this piece of software and do the challenge. And you're really installing like, you know, Trojan and of course it's a problem and now it's on your company machine possibly, or at least a machine that's connected. So this is the story of it, but this is like literally yesterday it happening. So if you want to see the visceral reality of this, not just read about it like in some ivory tower as an academic. Check it out. Jason rebels doing a community service here by offering this up. Very cool stuff.
- [30:43]
C
Talk Canada can continue to operate. A federal court has overturned The Canadian government's 2024 order to shutter TikTok Canada's business operations over national security concerns, letting the company keep its offices open while the industry minister reconsiders the case. TikTok Canada says keeping its team in place preserves hundreds of jobs and ongoing investment. The wind down order wouldn't have banned the app for the more than 14 million Canadians who use it, but would have forced the company to exit its Canadian business footprint.
- [31:21]
A
Okay, for the sake of time, you can continue to use TikTok in Canada.
- [31:30]
C
Huge thanks to our sponsor, Drop Zone AI. Quick tip for soc optimizing the human. Optimize what the human has to do. Drop Zone AI handles the investigation legwork autonomously, correlating alerts, gathering evidence, documenting findings. Your analysts only engage when it actually matters. The results are investigations that took hours now take under 10 minutes with much better accuracy of up to 30% and analysts who can finally focus.
- [32:06]
A
Oh my God, bro.
- [32:08]
C
Proven at over 300 enterprises who have deployed Drop Zone AI. See the data for yourself at DropZone AI God Fortinet.
- [32:19]
A
All right, I'm feeling it. I'm feeling it today.
- [32:35]
B
W.
- [32:40]
A
Oh yeah, let that wash over you. All right everybody. Holla, holla. Halah hala. Thank you all so much for being here. Definitely appreciate you guys. Thanks to the stream sponsors Threat Locker Anti siphon as Zack Hill it career questions comes into the chat welcoming him into the chat area and Flair guys, only a couple days left before we have our watch party go to Simply Cyber IO Flair. You're gonna. This is gonna be sick, dude. Hold on one second. Simply Cyber IO Flare they are hosting a two hour I I know, I know. I I'm not gonna play this all the time. I just. I love it. Syndicate inside the life of a ransomware operator Guys, if you want to get two hours of straight heat on what it's like in The CD underbelly of the cyber criminal underground as ransomware operators live. Then come on down. I'm hosting a watch party. Like, unofficially. I just decided. I just decided I was hosting a watch party and then informed Flair I was doing it. They seem to be cool with it. They are supportive. So come on down. It's free to register. It's two hours. It's January 29, 11am it's one week from today. I'm gonna have to haul butt back from the Citadel. I might even. I might even end school, end class early so I can get back here. Oh, yeah. It's so good. So every single day. Thank you. Go to Simply Cyber IO Flair. Every single day of the week has a special meme, a special activity, and Thursdays is Simply Cyber. What's your meme Thursday? Now, some of you may or may not remember earlier this week, like, randomly, I. I had, like, a Napoleon Dynamite like, event where I was like, oh, gosh. Oh, this is perfect. I didn't even realize this. All right, so check it out. This is your meme of the week. I'm so glad Zach is here. Ladies and gentlemen, Japoleon Dynamite. We've got the whole team here, so if you don't know if you're new here or you just don't recognize the faces, this is Dan Reardon on the left. That's me in the middle as Napoleon. And then, yes, that's our very own Zach Hill. I t career questions in the meme. No one. No one is safe from Dan Reardon's meme capabilities. So, yes, there we go. Three levels of awesomeness. Dan, me, and Zachel. This. This has got to get put on a coffee mug or something. Dude, for reals. All right, here we go. Get ready to let this wash over you. You know the words? La, la la la. Hey, if you. If you don't want to get down with it, go grab a coffee, come back. Takes about 30 seconds. Otherwise, just let this wash through you. It is perfect. It's a vibe. Get ready. Alpha Sierra lead us off. Marcus Kyler knows the words. Martin Rogue. Welcome to the party.
- [36:27]
B
La.
- [36:39]
A
Oh, my God. It just hits different, doesn't it? It's just so. It's so good. All right, we're not gonna play it every day, but if I'm feeling it, we're gonna do it.
- [36:48]
C
Internet reports patched, ported gate firewalls, hacked admins running fortigate firewalls report that attackers are still exploiting the forticloud vulnerability, which started back in November by using a Patch bypass.
- [37:03]
A
Real Bilbo is going to appear to.
- [37:05]
C
Have confirmed that version 7.4.10 did not fully fix the flaw and are preparing further updates. CISA listed the bug as actively exploited and told agencies to patch within a week. Shadow Server recently counted more than 11,000 devices still exposed online. Phishing and spoof.
- [37:26]
A
All right, all right, so let's see. Fortinet, you know, I don't want to say regularly has a problem, but there is attackers that are actively exploiting. Okay, so that's a problem that increases our likelihood value in our risk formula. There are attackers actively exploiting a patch bypass for a previously fixed critical authentic. So CVE 2020 559-718 had you patched it? Ah, you gotta patch it. Threat actors are still going to get past it, so patching it you should do, but it's not going to stop them. It's not a full patch, it's just more of a band aid. Admins are advised to temporarily disable the vulnerability for the cloud. So remember guys, really quickly, in the world of grc, which is a glorious world when it comes to risk, you got four options. That's it. You can transfer the risk, right? Like have someone else handle it. Insurance you can avoid. Well, you can mitigate the risk down, patch the system. In this case, that's not going to work. You can mitigate it. You can like, what is it? Mitigate, avoid, transfer. And there's a fourth one. Like I don't want to get mitigate and remediate down but well, I guess you can remediate it. So you patch it. You can mitigate it by like, you know, putting a firewall in front of it or having this not go to anything sensitive. You can transfer it by getting insurance, which is not a great fit in this particular instance, or you can avoid it, which is just eliminating the thing altogether, which is what they're suggesting you do here in your environment. So the solution is to disable the Forta Cloud login feature. So if you don't have it, the threat actors can exploit it. Makes sense. Right, but, but like if you're not, if you don't go to the bar, then you have zero chance of, you know, driving home under the influence of alcohol. Right? So that's what they're saying the problem is. The problem is if you rely on for to cloud in order to like do business, well then what your choices are, stop doing business or accept the risk. I guess that's another option. You can accept the risk. So not good. I will Say if you are a Forta Cloud, Fortinet. If you're an MSP supporting multiple clients and you, you deploy Fortinet for those clients, you might want to take a look at this and just help them out. Is this shodan? No. So there's 25,000. When is this? December 19th. So as of December 19th, there were 25, 000 exposed devices that could be exploited. Threat actors can find these devices very, very easily. They're Internet facing, they have a fingerprint it. Listen, I wouldn't screw around with this. Like if you have a vulnerable system either here, I guess, here's your options. If you have a vulnerable system, disable it until they have the full patch. Right? Especially if it's not mission critical. If it's mission critical, your only option is to keep it up but increase logging and detections all around that system. And I'm, I'm sorry, but you're going to have to, you know, man the wall, right? You're going to have to keep an eye on it because it's a risk, right? It's like, it's like, it's like working in like a really dangerous part of town. Okay? This is, I love analogies. They. They just come to me sometimes. I don't even know what I'm gonna say. Listen, this is like working in a really scary part of town, okay? If you take the train in, there's zero chance your car is going to get broken into, right? But if the train doesn't go to your work and you have to go to work because getting paid is mission critical to you, funding your family, then you got to drive in. So what you need to do is you're worried your car is going to get broken into. You put an alarm on it. You put the, the, you know, the club, if you're old enough to remember the club where you put it on the steering wheel so they can't do that. You put an alarm so it goes off. Maybe you put low jack on it, Maybe you have OnStar on it. Maybe you park it so you can see it out the window of your office. Like you increase the security around it for the situation. Same thing here.
- [41:54]
C
Sites are Olympics and report. Palo Alto Networks reports that phishing and spoofed websites remain the top entry points for attackers targeting the Milano Cortina 2026 Winter Games. Highlighting how criminal groups, state backed actors and hacktivists exploit large sporting events. Drawing on prior Olympics WI fi disruptions at Pyeongchang 2018 Russian linked interference before Tokyo 2021 and phishing and DDoS spikes at Paris 2024. Business email compromise is said to drive 76% of observed phishing attacks, while ransomware groups, espionage actors, and hacktivists target ticketing, payments, and event systems.
- [42:41]
A
All right, this is. This is definitely one of those ones where, like, if you're new to cyber security, you may not know this, but if you're old, like me or DJ B sec, right? If you got gray somewhere in your hair, then you know this. Okay? But for everybody, let's talk about this. Fishing and spoofed sites are going to be used by threat actors because they're incredibly effective and they're going to be relevant to whatever. Whatever is current at the moment. So in this instance, the Olympics are coming. So just treat it like a variable insert Olympics. I promise you. I promise you that. Like, when the FIFA World cup comes to Atlanta in. Or America, in whatever, next year or the year after, whenever it's coming, there's going to be fishing and spoof sites for the World cup, when the Masters comes around in April, or whatever it is. Fishing in spoof sites. When there's a presidential election, when Covid happens, when there's stimulus checks, like, whatever it is, whatever. The thing is that people are talking about, that's where the threat actors are going to go. Because it would be so stupid to create a phishing email that goes to a spoof site talking about, you know, haberdasheries, right? Oh, like, did you see the. The latest in men's headwear? Check out haberdashi.com like, no one gives a damn about it, okay? People care about the Olympics. People are gonna fall for these things. It's current media, right? So when you educate your end users, you gotta, like, just make them aware of, like, yes, in this instance, hey, whatever. There's gonna be an uptick in activity. Watch out for these things. But if you get them so geeked up on Olympic phishing emails, they can see the one tree, but the entire forest they are blind to. All right, picking up what I'm putting down. You smell what I'm stepping in? Let's go.
- [44:51]
C
Pass. Create backup link. Deemed a scam. A phishing campaign is spoofing LastPass maintenance notices and urging users to create backup within 24 hours in order to steal master passwords. Clicking the link sends victims to a fake LastPass site designed to harvest vault credentials. LastPass issued an advisory saying it never asks users to backup vaults or reveal master passwords and listed malicious domains and indicators. The company hasn't responded to questions from the register about how many customers received or fell for the scam.
- [45:31]
A
That sucks, man. All right, so pretty savvy move by threat actors again. This is a great GRC day. Educate your end users. Like, listen, if you have convinced them to get on a password vault solution like LastPass, you know, congratulations. That's like half the battle. Wait, yo, Joe. Like, way to go, GI Joe. Knowing's half the battle. The other half of the battle is getting people to install password vaults and start using them. So. But the problem is all your secrets are in that vault. So if a threat actor gets the password, they are going to. They're going to get in there. Unless you have mfa, which, by the way, like, your password vault is an incredibly valuable, incredibly sensitive system. You have to have multi factor authentication on it. It is not a option. Okay? It's not a nice to have. It's not a luxury put on mfa. Every single password vault that I'm aware of offers MFA options. Okay, so what does this thing do here? Like, I want to know what they like. So if you. The thing is, like, if. What's the email do? Like, oh, run a backup. Like, what is it doing? All right, here we go. All right. It redirects the victim to this website, which, by the way, like group dash content do gen 2s3. Oh, yeah, this is like, come on, man. And then mail loss, pass.com. so what does it do though? Okay, Hand over the master password. Yeah, so it's just password stealer. Okay? This is why you got to have MFA on guys. Like, freaking step one. Mfa. By the way, Modern rogue deep faked me yesterday. And the deep fake has me saying that MFA is like, silly and not necessary. Oh, they have a. Hold on, where's the code? Brew is saying that they have a picture of the email over at LastPass. Right? So LastPass phishing email. I'll see if I can find it really quickly. Here we go. Oh, yeah, there's some good IOCs over here. So, hey, if you are, say you're working at a small to mid sized business and you got access to the. The email server and you can do some things like go take a sniff, dude, we got IP addresses, header information on who the sender is, right? Subject lines you can look for. You could look for this if you have like, if you have the time, but if you have a junior analyst on your team, this is great. Like grunt, grunt work. Hey, go look through the email server and look for emails with these subject lines. Okay? You could. I mean, you could literally if, if you find these in your environment, you could then look through the SIM log to see if endpoints, you know, users who received this if then went to that IP address which was like mail-pass or whatever, mail-lastpass.com right here. See if they went there. I mean you could show up at their desk and be like, oh listen bro, I don't know if you gave up your LastPass master password, but you, you were a victim of a fishing attack. You want to talk about having somebody remember A who you are and B what fishing is when you get hit. Now this, this was a couple days ago. So you know, the damage is already done. But please, please get your, get your MFAs in place. Thanks a lot code brew for that.
- [49:32]
C
In Lit Bugs let hackers breach cloud environments Two critical vulnerabilities in the chainlit AI framework dubbed Chain Leak can let attackers read any file on a server and exfiltrate internal data. One allows arbitrary file reads via the project element endpoint. The other is an SSRF flaw affecting SQL alchemy backed deployments. Together they allow full system compromise and lateral movement in cloud environments. Saffron Labs reported the issues back in November. They were fixed in chain lit 2.9.4 on December 24th and organizations are urged to upgrade immediately.
- [50:17]
A
Yeah, you can put this is pretty serious guy. So first of all, Chain lit, it's so hot right now that Hansel so hot right now it's lit. All right. So chainlit, it's I guess it's a framework that allows you to write conversational AI apps like little chat bots or whatever. Fine. The problem is the bug allows anyone to read any file on the server that the bot is hosted on. So obviously this is basically a data leak issue. It's not super. I mean here's the thing. If the AI bot is. And maybe I'm misunderstanding this, but like if you have a dedicated application server for this thing, what files are they really going to be getting after? Unless there's like secrets like API keys and stuff for the AI bot to interface with. I could see that it can be explained without user interaction. Spoiler alert, there is it means the victim interaction, like the attacker has to interact with it and it impacts Internet facing AI systems that are deployed across multiple industries for sure. So if you're using Chain lit, here's the thing, you may not even know if you're using Chain lit in your environment because you got some eager beaver engineer who on the weekend built this thing in order to, you know, be A second brain so he can query his own notes or something. Or you know, the sales team is like, oh geez, I, I wrote this little bot using chain lit. Now I can, you know, I can have a sales guy 24, 7. By the way, just as a quick aside, I actually read a research paper the other day about AI for sales in cyber security and it was not good for humans. Something like the, the AI sales bots were selling like 47% more than the humans. Mostly because they don't sleep, eat, have personal hobbies. It was, it was like nuts. It was nuts. I'll see if I can find that article really quickly. But here's the deal. Number one, here are the two bugs and you have to chain them together. So I, I will say that this is not trivial, right? Like this, this isn't a script kitty getting in there. This is, this would require a little bit of knowledge and effort. This first bug, CVS, excuse me, CVE 2020 622-2183. Hundreds of, of 1% of a chance of getting breached in the next 30 days. And then the other one was 2 219. Let me see really quickly. Four hundredths of a percent. So the likelihood that you're going to get popped is not high. However, it is an Internet facing system which means, you know, you have a great, great exposure. I think this has a lower chance of exploitation simply because, you know, it's not, it's not trivial, right? It's, you have to know what you're doing. And also whatever's on that server is what's at risk only, right? So yeah, here they say API keys, account creds, source code, etc. So great work by the Zafran Labs people definitely appreciate that. There's only one option here. Ah, you gotta patch it, you gotta patch it. The problem is you may not know that you have this in your environment. So I don't know man, if you, if you don't have a good relationship with the kind of the developers, the engineers, the researchers at your work or the organization you're responsible for and I know it's hard at large organizations, you, you know, try, try. I, I will tell you. When I worked at musc, the medical university, I mean this is like, this is like a multi state, multi facility, you know, 8, 900 bed hospital, like it very large, right? And there's like a university component, a foundation component, a physicians group component. There's a lot, right? So finding, finding people that are using this is difficult at large organizations and I know that Let me just leave you with this. So one thing that I did do and, and I established, and I'm very happy to hear that it's still being done, is every month I would host a cyber security forum and it was open to anyone at the, at the MUSC to come, and we would share some information kind of like this and allow anyone to ask any questions. No judgment, no, no, you know, none of that. It was all open. But that allowed us to get things out like this, where it's like, hey, really quickly, you know, I don't know who's using AI and chatbots and frameworks and stuff like that, but there are some definite issues here. So if you in your work are using this or you come across it in your work, just be aware that, you know, these things need to be maintained and patched and all that. And it, it gave me like a secondary set of eyes and ears out into the environment to get in front of these things. And again, it's all about risk mitigation, so definitely worth doing. Yes. And we did do Krispy Kreme donuts occasionally. I would get, you know, some extra budget and I would do bagels, like an absolute legend. So don't sleep on that. That's. I called it Cyber Security Forum Invitation to everybody. And honestly, a lot of people, it's surprising how many people are very interested in cyber security and wanting to get answers and stuff like that. So don't, don't, don't be like the guy who's like, no one knows and you're just like a myth. Like, oh, you don't want Jerry to call you. That means you clicked on something bad. No, no, be like the face of Infosec. All right, let's cook. Guys, I want to say thank you so very much for being here today. We got just a couple minutes. I'm Jerry from Simply Cyber. I do have to go teach at the Citadel Military College, but that doesn't mean that the party stops on Thursdays. On Thursdays, we've got Zach Hill, IT career questions coming on to do jawjacking, the 30 minute AMA session. Now, if you're not sure who Zach Hill is, he's this guy right here. This is Zach Hill. This is your. This will be your Jawjacking host for the next 30 minutes. Lo. Oh, it's so good. But for real, guys, I definitely appreciate you. I hope you got value from the show. If you were a first timer, please, you know, if you enjoyed yourself, come back. If you did not enjoy yourself, I'm sorry. I wasted your time, but I secretly suspect you did. Enjoy yourself. All right, guys, I'm Jerry from Simply Cyber. Normally I just do a hot handoff to the. To the jawjacking guy. Well, I am still gonna do that. Oh, his camera's not on. All right, hold on. We're having camera issues here from a man, Zach Hill. Guys, also, hey, you're not gonna want to miss this. Today at 4:30pm Eastern Time, Bryson Bort. If you don't know who Bryson is. Oh, I'm super pumped to introduce you to him. Bryson Bort, founder of Scythe and Grim. He is a very accomplished, talented cyber practitioner. He's going to be my guest on Simply Cyber Firesides. And we're going to be talking about starting and running a bit your own business. If you have even a. An inkling or a sniff around wanting to do your own thing, you're gonna want to catch this. Remember, you can always go to Simply Cyber schedule to see the upcoming. To see all the upcoming talks and such. And the best thing is you can go there and get it put on your calendar. It costs nothing to attend. It'll put a little calendar invite on your system and then you won't miss it. It'll remind you, hey, you got this thing coming up. All right, guys. For real though, thanks for being a great audience, a great community. Nicholas Vincent, first timer, welcome to the party. All right, guys, I leave you in the capable hands of my good friend and fellow mentor, Zach Hill. Ladies and gentlemen, enjoy the Jawjack and I'll catch you at 4:30 on firesides. Ever wonder what it takes to break into cyber security? Join us every weekday for Jawjacking, where industry experts answer your burning questions about the cyber security field live, unfiltered and totally free. Let's level up together. It's time for some Jawjacking. Yo.
- [59:46]
B
Let's go chat. Right? Isn't that what all the kids these days say? All The. The real YouTubers. As my. My children would like to tell me, that's what. That's what all the real YouTubers say. Let's go chat. How y' all doing today? Hope you are doing wonderful and amazing. So beautiful cold Thursday here, but I hope it's at least comfortable, enjoyable, wherever you're at in the world. I am Zach Hill. I come to you from it. Career questions and anti siphon training. Oh, I got their. I have their shirt on today. I'm here to answer all of your questions or try to answer all of your questions. Welcome to Jawjacking. If you have questions, please put them into the chat and I will do my absolute best that I can to answer them. If I don't have the answers, I'll reach out to you in the chat, somebody, somebody in the chat who might have the answers. Pocket Pixie. So what section of Simply Cyber is this? So on Thursdays, on some of the days after Jerry talks about all the news and things like that, they do Jawjacking, which is about a half hour show where either Jerry or a guest will come on and basically do like an ask me anything or ask us anything. Sometimes there is a panel, but it's just for the audience to ask questions to people who are working in information technology, cyber security and you know, get answers to their questions. So maybe you're somebody out there who's looking to get into security, looking to get into grc, maybe you're just looking to get into it and you have questions about getting started or questions about certifications. That's what we're here for. We're here to help. So if you have questions, we're here. I'm here, I'm here, here to help you out. So here we go. Pocket Pixie. If you finish a certificate on Hack the box will enable you to at least be a mid level to sen. Pen tester. No, no, I don't think there is any certification that exists that would qualify you to be any level of anything. Quite honestly, until you maybe you get down like the lines of like the, you know, CCIE or something. Is that one, that one like very much sticks out as a certification that would put you in a certain level or even like a ccnp. Those certifications may put, may put you in a certain level, but honestly at the end of the day a, anybody can go out and take any of these certifications. It doesn't necessarily qualify them for any, any role. It doesn't qualify them to meet any type of tier level. If you would sort of, you know, just because somebody goes out and takes their CISSP doesn't mean that they are, you know, mid level to senior level anything. It just means that they've achieved, achieved a certification, which is fantastic. Certifications are great ways to help verify and validate a lot of your knowledge, but they're not, they're not anything that guarantees you anything, if that makes sense. But yeah, achieving a certification is just a really a checkbox for most organizations. Achieving a certification really at the end of the day should be for you. It's a way to help really validate for yourself that you've Learned the skills that you just spent X amount of time trying to obtain and learn. So certifications have a lot of good use. I'll scroll through, try to get all of the questions that I can. Cryptic roses. Good to see you. How you doing? Did I ever hear back about the security plus job thing? I did not. I did not hear about that. It was when I was on the treadmill. If I could, I'll go back. Let me send a message to Brett and I'll see if I can go back and watch that video and then see who it was. Inserts do not equal experience. So, yeah, if y' all have questions, please throw them in the chat here to help y' all out today. Yesterday, OSINT was crazy with Khan. Yep. Michelle Khan came and did a webcast with us yesterday. Shared his OSINT knowledge, which he is phenomenal. Pocket Pixie. How long does it take to become a pen tester and defense tester? That's. That's such a hard question to answer quite honestly because everybody's journey into this world of information technology and security is so completely different from one another. Everybody learns differently. Everybody learns at a different pace. Some people, you know, can sit down and read books and learn everything they need to know. Some people need to watch videos, Some people need to get hands on and follow along. And as you're going through and trying to learn all these things, you might have to piece some of those things together so that you have the best learning journey possible for you. And that might take more time than somebody else. And so. Excuse me, sorry. Like, one thing to that's really important to know and understand about making your way through it and cyber security is that it's not a race. You shouldn't be trying to race anybody else. Shouldn't be trying to put pressure on yourself to do this as fast as possible. Because at the end of the day, it, cyber security is growing constantly. It's evolving constantly, if you will. And part of that is you'll be learning constantly. So don't pressure yourself into thinking you need to know all of the things right away. Take your time because, yeah, throughout your journey of it, you'll always be learning something new. It's a great time, it's fun. If, if you like learning stuff, you'll, you'll love it. Berlin Dab how to address the gap in employment on the resume and should you include all of your 20 plus years of work experience or should you only include work experience that is related to the job you are applying for? That's a great Question I would only include, like your most recent work experience, you know, trying to keep your resume. Again, this is, this is my advice. If you ask a hundred different people the same question, you're going to get so many different answers, right? Especially when it comes to resumes and things like that. Even when you reach out to like resume writing experts, each of those experts are often going to have like, very different, like this is the best way to do it, right? Just I say this because they're at the end of the day, like there's not an absolute, like, best, right? I don't think that, like, you're going to find what the absolute best, like a resume formatting is and things like that. I think it's best to keep it down to about one or two pages if you can. And definitely including your most recent experience is going to be really your best, best bet here. And then going back and trying to look at some of that past experience and pulling out like, any, any duties, tasks, things that you may have done that may somewhat relate to it. And if you have trouble doing this, some of you might be upset with me saying this, but ChatGPT is a really amazing tool for things just like this, where you could say, hey, in my past careers I did these things right? And you can literally like map it out for, for the chat GPT say like, these are all the tasks that I did in this job for all of your different jobs that you've had. And then ask ChatGPT, how do these relate to it? Right? And it will, it'll come through for you. It'll definitely come through and say, hey, here's all the different things that you may have done that somewhat relate to it. And as it pieces that together for you, you're going to have a really, you're going to have so much better of an understanding of where all of like the, the, all of your past experience can be beneficial for you in the future. So that's one thing that I wanted to kind of address with, with your question that you maybe necessarily didn't ask, but I provided a little bit more advice for you. But yeah, I would include most recent. If you have a gap in your employment, that's, it's okay, it's going to happen. I think people stress out about that more, more than they should. You may get asked about that gap, you may not. It's none of their business at the end of the day why there was a gap. And, and you could be blatantly honest with them and say you had personal issues. You had to take time off of work because of those issues. And if an employee, if like an employer is a good and decent employer, they will leave it at that. Right? It would be a red flag to me if an employer were, you know, giving you a hard time about a gap in your employment, right? Like if they are sitting there really kind of like just drilled, focused in on this gap, that's a huge red flag for you. Like there's, there's no need for that. Everybody's lives are different. So many things, you know, happen. I've never been a person to really question a gap and being, you know, in a negative type of way. So many things could happen in somebody's life that are just outside of work, right. And so yeah, good employees or good employers will not care. They will not care at all. They may ask you about it and you can be as honest about it as you want, but good employers will not care at all. If you have a gap though, and you utilize that gap in your employment to learn things, you know, to teach yourself IT cyber security, that's a great opportunity to bring that up as part of that. Hopefully that helps. And I'm scrolling through the chat looking for questions. I'll try to get as many as I possibly can. Gabrielle Jaeger what strengths should I lean into to make yourself marketable for GRC roles? Coming from a career in education and teaching, computer science, cyber security. The strengths Communication all day, all day, every day from your past experience and education and teaching, communication is going to be huge. I don't, I think a lot of people don't understand the weight that really good communication and people skills, soft skills bring to the table in the entire world of it. You will go very, very far in this field if you have really great communication soft skills. That's what I would lean into 100% if you were, you're an educator so you're more than likely organized, right? To be an educator, I feel like you have to be pretty organized with like your day to day teaching students and grading and all of those things, you know, coming up with curriculum and things like that. Those are going to be amazing strengths and skills to, to have in any type of GRC roles. Those are going to be the things again for me that stick out significantly. Especially like just yeah, any type of it security role for sure. Thank you, thank you for asking and good luck to you also. Have a good day. The Kyle Kyle Phil Stafford says Chachi ChatGPT4 was amazing for this. You find that 5 has trouble keeping your Voice instead of sounding like itself. Interesting. I'll have to. I actually have to try that. See, I, I does it. Eyes. Easy, easy. Easy does it. I used to stress about your gap, but now you're grateful to have a had time to focus on your family and freedom to spend time on other ways you wanted to grow. For sure. Yeah, I think a lot of people stress out about the gaps. And again, it's a good employer just will not. They won't care at all. Questionable employers will make it very apparent that they care. That's very much a red flag, Ludy. I am terrible with names, by the way, so if I butcher your names, I apologize. I will, I'll do my best though. But, Ludy, do you have any advice or resources on how you can get better at speaking in a more technical and professional way during interviews? Yes and no. That's a hard one because it requires you going out of your comfort zone. It's really what it boils down to. You're never going to get good at speaking until you speak more. Right. Like, I know that sounds like, terrible to say, but that's really what it boils down to. I, it's probably weird coming from me potentially, because here I am sitting in front of you all, and there's 200 plus of you watching right now or listening right now. I am a huge introvert. Like, incredibly huge introvert. When you see me in person, I would say I'm. I'm much different than, than how I would maybe potentially act in front of a camera. Right? Unless I've talked to you, you know, a bunch of times. You know, I may act a little bit, like, at ease and things like that, but at the end of the day, I'm just an introvert. Okay? And as I was first coming through, you know, and finding like, my way throughout this field. So looking back 20 years ago now, because I'm old, I'm unk status, if you will, for all you youngins out there. But yeah, 20 years ago, like, I could not talk to anybody. I had a just terrible time trying to have a conversation with anybody. I would always walk away from a conversation just feeling like a complete idiot and like, saying to myself, like, why did I say that? Why. Why did you say that? Zach? You are, you are just xyz, right? I, I remember those days. And the only thing that I can, like, really tell you at this point in time is like, as I look back, I don't think it took as long as maybe I think, but it was definitely like years of working through it and working with people on a day to day basis where I had no choice but to talk to them, where my communication skills just kept getting better and better and better. And one of the things I think that helped me out the most, that's not necessarily like, goes to the speaking portion of it more because we're not always going to have an opportunity to speak, right? Like that's one of the things about just life in general. Like we might not always, you know, go out and put ourselves in an opportunity where we can actually have a conversation or speak to another human being. Right. The best advice I have for this is to listen to other people. And for some of you it might be a little bit creepy and I don't mean this from a creepy perspective at all. But like one of the things that I, I still like to do is just listen to conversations and it's not because I'm trying to listen and really I, I have an interest in what these people are talking about. I'm trying to understand like the dialect, I'm trying to understand like the tone in which these people are talking to one another. So whether I'm out like at a mall, I'm out at like a, a bar or, or I'm, you know, at a cafeteria or I'm, you know, at a Walmart or something, you know, and I'm listening to like co workers talk to one another. I'm just listening and understanding like how those conversations unfold and how like an employee talks to another employee, how an employee talks to a manager. The, the tone in which they're, they're, they're conversing with one another, you know, their facial expressions. You know, there's a lot that you can gain from, from observing these types of things time and time again. Like the more you observe like these different conversations and things like that, the more you'll hopefully eventually kind of learn, understand how you can adapt your conversations and your like your experiences to be a little bit better for you. You know, it's just literally learning from other people and then trying to apply some of that to like your day to day. Because again like you're just not going to have an opportunity to just to speak all the time, right? So that's my long winded, super long winded. I apologize. Answer to your question. The only other thing, suggestion, advice I would give to you for this is honestly like record yourself speaking. Write up a talk or something, a 10 minute, 20 minute talk and record yourself. Just take out your phone, you know, hit, hit the record button and practice over and over and over again. That's. That's honestly the best. Hopefully that helps. Hope I think I answered that question. Cryptic roses have I had time to review Hack Smarter Labs by Tyler Ramsby? I have not. I have not had time to review those so I probably couldn't answer the rest of your question. What are your thoughts on the web dev pen testing content? Whether it's worth pursuing for skills and career growth? I know Tyler Ramsby. He's a friend of mine. He's part of the Simply Cyber family. I'm sure the content is amazing. I'm sure it's very relevant. That's something that I know that he pushes but I've never gone through any of the content. Maybe we should change that. Waiting through logs. How are you doing buddy? Soft skills made you. That's right. I'm like probably really behind in the chat so I apologize. Limb lamb, you just got black. Probably black hat bash book. It looks very probably solid. Do we still use books for learning or as an index? Yeah, a lot of people still read books to learn things. It's really all up to. To you as an individual human being and the best way you learn and absorb material. Me personally, I could not read a book and learn anything. I. My ADHD is way too bad to read a book and try to comprehend anything from it. I am the type of person, if I want to learn something, I have to be very hands on. I have to follow along. So I. I gravitate more towards videos and more specifically towards videos that are going to actually get my hands on the keyboard where I'm following along with everything that they're doing. That's my jam. That's what I. I can get down to all day for learning. I cannot read a book and follow along at all. Like it just. It does. It. Yeah. Does not happen. I am old and I've learned along the way that that is just not a possibility. And that's okay, right? Like that is. That is completely okay. I do love audiobooks though. So while I don't. I can't sit down and read anything and comprehend it. I can do the audio portion of it. So I wonder if maybe I could do like some. I should try that with some type of a book where it's like more of a. The supposed to be like a learning book. Sorry, I'm like thinking about this now. Like if I listen to the audio version, would that make any difference? And I don't think so. Like I still feel like I need to be looking at something in order for my brain to process it the best. So. Ah, sorry. Just thinking about that. Yan. Hello. So basically you're a cyber student. You're finding jobs and internships is hard even for help. Desk. So is front desk at hospitals or office assistance a good way to start at the least? I mean, that's outside of the realm of it. If you're looking at just like a front desk or like an office assistant type of position. The good thing about those types of positions is they're customer service focused and you're going to get a lot of experience in that area. But it doesn't necessarily lend its hand to it. Exactly. But overall, everybody is having a difficult time right now finding jobs as a whole. It's not just it and cyber security. Although, like that's. That's one area that is. I don't want to say questionable. Like questionable is not the right word I want to use. We're just going through a very weird time right now. Thanks. AI, Right. Just kidding. It's not. It's not just AI. It's partly AI. But we're. We will be hiring people again for sure. I personally feel like.
- [82:08]
A
Anyway.
- [82:12]
B
Dramatic full cast audio keeps you hooked on things. Thank you. Thank you. Great. Elder unknown. You're welcome to share that with my kids. That's gonna be hilarious. Thank you. All right, I think I'm caught up with the chat. We got about another five minutes or so of jawjacking, so if you all have any questions at all, you can throw them in the chat. And I am here to help the best that I possibly can. Jay Gold says a lot of people still actually read books. And he doesn't just mean audio books. Yeah, I know a lot of people still read books. I can't do it. It's hard for you. You scan rooms and listen and profile everyone places you go. Just PTSD kicking in. Talk about referencing where my. My advice about listening to conversations. Yeah, I don't know. Like, again, I. I don't mean that in a creepy way. I don't. I know it sounds kind of creepy, but gosh, like, just hearing people talk to one another, like, especially just like as many different locations and like diverse as possible is so, so incredibly important and to your communication skills. Here's a couple questions, though. Oh, hey, Bruising hacks. How you doing? Yeah, Zach, personally, you retain things best when you have the computer do TTS and read at the same time. Yep. D Prim. Good morning. How are you? Hope I'm having a fantastic week. And thanks for all I do. Thank you. You're welcome. And I hope you're having a good week too. What's your take on using a VM in a lab to to fall for a deep fake interview and download malicious files? What? What's my take on using a VM in a lab to fall for deep fake interview and download malicious files? So you were you wound up in a deep fake interview and downloaded malicious files. What's going on? I. I'm not sure I'm understanding this question entirely. Could you reword possibly? Is it me just not understanding? I apologize. Could just be me Alpha Nerd Given some advice here. As a hiring manager, I can say do not inflate your experience on your resume. Be honest. But also don't sell yourself short. Don't say you're an email admin just because you use emails 100%. I think that is great advice. Definitely never inflate anything on your resume. Don't ever lie on your resume. Typically like I a lot of times I would say managers, directors and things as they're going through interviews, they at times will use your resume to like look at and see like what you have listed and they may ask you something about one of those things. Right. So if you do list on there that you know you're an email admin because you use emails and then you get asked a question on like how does email get routed through blah blah blah blah blah or how do you set up like an exchange blah blah blah blah blah. Right. Like if you don't know those things like that could be an issue. Yeah, don't lie on your resume. Captive Grosses Are there any niche or reliable places to buy tech and lab gear beyond ebay? With good value and buyer protection given the platforms like Facebook markets, place can feel risky. I know like Mac sales.com is like a site that I've used a bunch of times to buy used MacBooks and Mac products. It also helps that they're like an hour away from me. So if there was an issue I would just drive there. But other than that, like my best my best advice is always going to be Facebook, Craigslist and things like that because you're often going to get you off. You'll get crazy good deals, right? And you most oftentimes won't find a better deal than those sites and things like that unless you want to spend a lot more money is the biggest issue there. Bruising hacks, you said. I don't think people watching advice is creepy at all. I Think that's a masterful way to learn how to talk differently to different people. Code switching is a skill, not a reason to outcast for sure. Thank you. Yeah, that's a, a way to look at it for sure. It was like that's a game changer for me. I don't know what is one threat or vector you are keeping my eye on AI. Honestly, it's AI. That's, that's my biggest concern. My biggest concern with AI though is from more of a, I guess like security awareness perspective of it and oh gosh, like mainly that. And then my words are failing me right now. But social engineering, that's. That's the other. That's that probably my, my absolute biggest concern with AI is that once like all of the scammers who, you know, love to scam and do all the things really unders, like get a, a feel out of like what AI can do for them, the capabilities that AI will have for them and scaling what they are doing with scamming and things like that, that scares me. It terrifies me. It absolutely terrifies me. So things like 11 labs, you know, where you can clone people's voices and things like that and now with like you know, AI video and all of that becoming much, much better, that scares me. That's where my concerns are. That's where I think that the biggest threat is personally. We've got a couple. We're about time. I'll answer another question or two here. Cryptic roses. What should you do when your laptop is nearing end of life with performance and keyboard issues? And is there an affordable brand or model you would recommend for a grad on a limited budget? Oh man, I, I put out a video not too long ago. It was actually like a year or two ago I think, but it's going to be still relevant to this day type of computer for. I feel like it was on the TCM security channel though, so I'd have to find that. I can't find the video. Let's see, hang on, let me type in TCM security. I still can't find the video. All right, so when it comes to laptops, I said this even in this video, like for sure. And this was a couple years ago. But the most important thing that you really need to have for a laptop is ram. If you're looking to be an it, prioritize RAM all day, every day, prioritize the ram. That is going to be the biggest part of your budget probably these days. Unless you want to do like gaming and things like that which you. That just significantly increases the price of whatever laptop you're going to get. Prioritize ram. Everything outside of that does not really matter too much. Go with like, some of the better. Like, not better. I go with more popular brands, if you will. I mean, Asus is fine. And Acer, like Dell, Lenovo, like, they're all fine, right? It's just like you have to unfortunately spend a little bit more money to have a little bit better quality product in your hands. Like, no matter what. Like, that's what any type of computer. At the end of the day, the more money you spend, typically the better quality of hardware that you're going to get. But if your laptop is nearing the end of life and you're having keyboard issues, that's going to be a great opportunity to use that laptop as a home lab, potentially, because you could, if you could still plug in a keyboard, like an external keyboard to that thing and just spin up that laptop as a, you know, like a, a Proxmox server or something. You know, throw a bunch of VMs on there, spin up Linux, like, have fun with it. Break it, Hide nothing. There we go. All right. The RAM is so expensive right now. All right, y', all, I think we're at the time for today for jaw jacking. So thank you all so much for joining. I really do appreciate it. Huge shout out to Jerry and then the whole Simply Cyber crew and team. Thank you all. Make sure you guys check out Flare I.O. and Jerry's going to be doing his what Watch party. I know on that soon. Check out anti siphon training. That's. That's where I. I come from. We do good things over there. We like to teach people. Who else is sponsoring Simply Cyber Barricade Cyber Solutions, all those things. Go check out Tyler Ramsby's course. Go check out the Simply Cyber Academy if you need to learn more about GRC and all of those things. But come back next Thursday if you want more AMA from me, from Zach, or you can come visit me on Tuesdays on Discord. I do amas there as well. You can always reach out to me on the LinkedIn. I'll put a link for that in the chat. LinkedIn.com n I am nerdy is my LinkedIn URL because I am nerdy. All right, y', all, hope you have a good day and a good rest of your week and a good weekend. Take care and see you all later. Bye bye.