← Security Now (Audio)
Security Now (Audio)
SN 1080: Vulnerability Debt Repayment - Will Mythos Change Cybersecurity Forever?
02:44:01
Will Mythos Change Cybersecurity Forever?
Loading summary
Transcript226 lines
- [00:00]
A
It's time for Security Now. Steve Gibson is here with lots to talk about. Cisco freaking out over Mythos, the amazing results Firefox is getting, finding vulnerabilities with AI, Microsoft's mitigation for the Yellow Key BitLocker bypass and a serious vulnerability in ubiquiti routers. That and a whole lot more coming up next on Security Now.
- [00:27]
B
Podcasts you love from people you trust. This is Twit.
- [00:37]
A
This is Security now with Steve Gibson. Episode 1080, recorded Tuesday, May 26, 2026. Vulnerability, debt repayment. It's time for Security now, the show. We cover the latest in security, privacy, computer use, science fiction, vitamin D and more. And the reason it's so eclectic is because of this guy. He is, he is a man, a renaissance man for our time, Mr. Steve Gibson. Hello.
- [01:07]
B
Ah, yes. Add much? Well, I don't know.
- [01:10]
A
We pretty much stick to security for like 90 of the show. Don't worry.
- [01:14]
B
Well, and they're overwhelmingly, we're getting feedback from people who are engaged in the security implications of AI. I heard from one grumpy listener who said, I'm tired of it here. Every podcast you do now is about AI. It's like, hey, you know, if, sorry, if, if it weren't all about changing the entire complexion of software and security and privacy, then yeah, I would be, I, I would carve out a little piece to just talk about my own interest because I have it. I mean, I've become a user of it. And in fact, something occurred to me that I'm going to share mid podcast that caused me to realize why the, the line I almost used last week was the only way I could imagine somebody doesn't understand is if they're not using it, that is to, you know, if, if you use it, then I don't know how you could not. And then I realized, oh, I do know how you could not. I now I understand what people might not have done that makes all the difference in their experience that converts it from just a search engine into something more. So we'll be talking about that. Yes, I know more AI, but actually this is another, we have another major AI episode because stuff is happening and I actually think that that's going to change in the long term, which is why today's title is Vulnerability Debt Repayment. And if you can imagine that that's about the vulnerability debt that all of our software currently has, there's going to be some pain while we repay that debt. But contrary to what some people think, which, and I'll talk about that one guy from Cisco thinks that the whole CVE system is just, you know, going to be buried forever and unrecoverable. I don't think that's the case. Which is not to say that it doesn't need to get fixed. We're going to talk about some of the changes that need to happen. But anyway, we've got a bunch of fun stuff to talk about. Cisco meets Mythos. Can the aging CVE system survive AI patch deployment latency and what that means in the AI age? Microsoft responds officially to last week's discussion. Well, not our discussion, but the fact of yellow key, which is the bitlocker bypass with a mitigation which is very clean and we learn a little bit more about the nature of it from them. Ubiquiti has patched five serious vulnerabilities. All Ubiquiti users need to make sure that they're current because I'm going to
- [04:15]
A
do that right now. I'll see you later, Steve.
- [04:17]
B
Three are critical, two are serious, but they're bad. Drupal's being attacked by a postgress QL infection, which is caus is, you know, wreaking havoc. Microsoft, the first major company to terminate SMS as a second factor authentication mechanism. So props to them. GitHub. Speaking of Microsoft, GitHub got hacked, lost all of their source code. So whoops. Also it turns out that not our
- [04:55]
A
source code, their source code.
- [04:57]
B
Right, right, right, right. GitHub's own internal like 4000 some repositories of internal stuff. Yikes. And we'll look at how that happened.
- [05:08]
A
Guess it's open, sour,
- [05:12]
B
open, open. Also, after the Ukraine, Russia's attack of Ukraine, their access to Western software was cut off largely. Turns out that's having some interesting consequences. We'll talk about Also I am gonna, as I mentioned, gonna dip into a little bit of my own revelation about AI and why people may not have understood what you and I understand. Leo, I'm going to touch on briefly a new sci fi show that dropped on Thursday on Netflix. And then the biggie is what we have learned from Mozilla's use of Mythos.
- [06:03]
A
Very good.
- [06:04]
B
Course we have a great picture of
- [06:05]
A
the week and of course I'm not going to look at it.
- [06:08]
B
Try not to because this one's got a nice punch on it.
- [06:11]
A
It' of the fun for me is to scroll up. I could see. I could see. And I'll show everybody what I could see right now because I can see the caption that you write. Yes, but I can't see anything below it. So.
- [06:24]
B
Because the previous do not trespass sign was often ignored and ineffective.
- [06:31]
A
I love, you know, so I can look at that and I go, okay, I see where we're going here. This is going to be another weird fence or another. Yeah, I mean we had, this has been a specialty of yours. The, the oddball real world security.
- [06:46]
B
Entirely thanks to our listeners. Entirely thanks. People saying I, I mean, and they're like taking a walk on some trail and they see something and they say, oh, I had to capture this for the podcast, Steve.
- [06:58]
A
Yeah, we'll tell you how you can do that, by the way, later in the show. If you have a picture you'd like to share for the.
- [07:03]
B
If you survive.
- [07:04]
A
If you survive. That's coming up. But first, a word from our sponsor for this segment on security now, Guard Square. Now, this is really aimed for the mobile app developers or people who are thinking about being mobile app developers in the audience today. A great space to be in, right? Okay. Mobile apps are an inescapable part of life. They handle everything. We live on our phones these days and we do everything on them, from financial services to healthcare, retail, of course, entertainment. And the thing is, your users are trusting your apps with their most sensitive personal data. That's why the bad guys are going after you. A recent survey showed 72% of organizations experience a mobile application security incident. Last year, 92% of respondents reported rising threat levels over the last two years. They've seen it. You've probably seen it if you're a mobile app developer. Meanwhile, attackers who want your user's personal data are looking for and constantly finding new ways to attack your mobile app. Here's one way that's devastating. They take the app. Nowadays with AI, it's very easy. Use Ghidra and AI to reverse engineer it, repackage it. It's indistinguishable from the real thing, except they have modified it. They've put malware in it or spyware. Then they distribute the app. The modified app, they do phishing campaigns. Hey, we've got an update. Send out emails, side loading. They go into third party stores. There's all sorts of ways to get to your customers who think they're downloading your app. Instead, they're downloading malware. This is why it's so important you take a proactive approach to mobile app security. You got, that's just one way. Many ways they're attacking you. And you have to stay one step ahead of these attacks because the trust of your users is absolutely vital. That's where Guard Square comes in. Guard Square delivers mobile app security without compromise, providing advanced protections. Both Android and iOS apps combined with automated mobile application security testing. So it helps you find vulnerabilities, which is also nice. That's a very nice feature. And real time threat monitoring so you can see those attacks that are incoming before they bite you. Discover more about how Guard Square provides industry leading security for your mobile apps. You can find out more@guardsquare.com that's guardsquare.com mobile app developers. You need this. Guardsquare.com, we thank them so much for supporting security.
- [09:52]
B
Now, so again, the caption I gave this was because the previous do not trespass sign was often ignored and ineffective.
- [10:04]
A
Okay. And I'm going to scroll up here. Let's see what we can see. Now that's funny.
- [10:16]
B
So the do not trespass sign has been replaced with more of a consequences if you do it says in big bold, all caps, white letters, do not cross this field. And then kind of parenthetically below, unless you can do it in nine seconds because the bull can do it in ten.
- [10:44]
A
Oh lord.
- [10:45]
B
Which of course is the old I don't have to run faster than the bear, I just have to run faster than you.
- [10:50]
A
That's right. That's awesome.
- [10:52]
B
And what I like is over on the left Leo, the, the, the, the center rung looks like it's been bent by somebody standing on it and like going over the fence in that location.
- [11:04]
A
Climbing over. Yeah.
- [11:06]
B
So yeah, it's like. Yeah, they're actually somebody did and you can kind of see us something in the.
- [11:11]
A
You think that's the bull over here?
- [11:13]
B
I think that's the bull way back there. There's some other over to the right of the sign too.
- [11:18]
A
So that's great. You know that is a whole category of witticism is the don't trespass sign. In our rural areas they're always are often very humorous as well as threatening on with the show.
- [11:34]
B
Okay, so I titled this first short note Cisco meets mythos, of course, in honor of that fabulous classic cartoon short which was called Bambi meets Godzilla. Cisco recently short. Very, very short. End to the point. Yes, memorable. Cisco recently produced a slick eight page PDF document titled well, they borrowed a name I'm quite familiar with Shields up. They said guidance for defending in the age of AI enabled attacks. And I'm only going to share the introductory executive summary from this piece, but I wanted to start with it because it nicely serves to introduce us to what Cisco themselves have now realized is about to happen to the industry, the executive summary Sundays. In early April 2026, Anthropic announced that it would be holding back on releasing their new AI model, Mythos. Due to deep concerns around the offensive cyber capability of that model, Anthropic decided to work with select companies, including Cisco, so that those companies could use the model to find and patch security vulnerabilities. Cisco's changing our Cisco is changing our near future threat modeling of AI enabled attackers. In view of our experience with Mythos, that in turn has changed how we defend ourselves and led us to develop a set of defensive recommendations for customers. While the capabilities of Mythos may not be widely available, we do anticipate that this capability and more will become widespread as AI technology advances across the board. This paper lays out what Cisco has seen so far from AI enabled capabilities and what we believe the new threat landscape will look like. Whether these models are wielded by attackers, leveraged by researchers, or operating as agents within your own environment, the security implications are significant. Subject to appropriate safeguards and controls. We will share what we've implemented based on this new understanding and lay out our recommendations for customers. The threat surface is going to change in some ways dramatically. Defenders must take the time to understand what the new normal will look like and evaluate what changes their environment must make to stay secure. Cisco is committed to being a partner through that transformation. So it's pretty clear reading between the lines that Cisco got a wake up call from their experience with Mythos. I have a link in the show notes to Cisco's full report though, you know, it's an eight page glossy sort of thing. You know, I didn't find anything there that was really that interesting or worth sharing. It appears, you know, to be far removed from Cisco's trenches, where Cisco developers appear to have run out of expletives to express their degree of astonishment and concern. So link in the show notes toward the bottom of the second page. But speaking of running out of expletives, Cisco's security blog poses some interesting questions about the future and specifically the practicality of our existing time tested cve, which we are talking about every week. The common vulnerabilities and exposures system and the impact of AI vulnerability discovery on that. Now my own expectation, as I teased earlier, differs from Cisco's. So nevertheless I want to share Cisco's thoughts since they're Cisco's and that matters and they're worth understanding. So under their title When AI Finds Faster than Humans Can Patch When AI Finds faster than humans can. Patch disclosure must evolve, so they write. Project glasswing is an amazing initiative by Anthropic. Cisco is one of the main participants and I writes this author, have been honored to work on it since it started. And then here it is. This is not all caps. This is not hype. Claude Mythos has discovered thousands of now he's not talking about his own stuff because he's, you know, very politic here. Thousands of zero day vulnerabilities across every major operating system and web browser. The CVE program already buckling under 50,000 entries a year, was never designed for this. We need to talk about what comes next before the flood arrives. As you probably have heard from many sources, Claude Mythos Preview found a 27 year old remote crash vulnerability in OpenBSD. It found a 16 year old bug in FFmpeg that survived 5 million automated fuzzing runs. It chained together Linux kernel vulnerabilities to escalate from unprivileged user to full system control with no human guidance. And it did this in days, not decades. Key technology providers are finding and fixing hundreds of vulnerabilities. Participant organizations are also finding thousands of open source vulnerabilities and working on a coordinated disclosure timeline. That is the responsible move. But it also forces an uncomfortable question. What happens when this class of model becomes commonplace? Meaning Mythos? What happens when Mythos level everybody can have it, he says, when the vulnerability discovery rate jumps from thousands per month to hundreds of thousands. Okay, so I'll just pause here to note that the title of today's podcast, Vulnerability Debt Repayment, looks at this at the end of the podcast. And my conclusion is not the same as this author's, as I said. But I thought this was interesting because this guy is on the front line of Cisco meets Mythos.
- [18:35]
A
Yeah, he's scared.
- [18:37]
B
Yeah, he was. Yes, he was obviously deeply affected by by what happened, if you remember Bambi. Well, anyway, since he's an employee of Cisco and obviously wants to keep his job, he's not talking in detail about what they found. But again, how much sleep is he getting, I wonder? It doesn't take much imagination given what we know of Cisco's own rickety past with security. One could just imagine. I mean, it's got to be similar to what Microsoft is going through. Anyway, this guy continues writing. The answer is that every piece of infrastructure between discovery and mediation disclosure norms, the CVE system patching pipelines and the human workflows that connect them will need to be rearchitected, not updated we must rethink how to scale. The problem is that the CVE system was built for a different era. The Common Vulnerabilities and exposures program turns 27 this year. It was designed when the security community measured vulnerability disclosures in the hundreds per year. For example, 321 CVEs were issued throughout all of 1999. By 2023, the number had climbed to nearly 29,000. And a 2026 forecast projects a median of roughly 59,000 CVEs this year, with the realistic upper bound scenarios reaching 100,000. And that forecast was published before Project Glasswing was announced. So 100,000 at the high end. Median estimate around 60,000 before this all happened at RSAC 2026, he writes, CVE board members acknowledged the program needs an overhaul. GitHub reported a 224% increase in vulnerability reports over the last three months alone. Again, that's the current volume before AI scale discovery tools are were going wide. When a single AI model can surface thousands of high severity vulnerabilities in a few weeks of scanning, assigning an individual CVE to each one, enriching it with CVSS scores, routing it through the nvd, the National Vulnerability Database, and waiting for human analysts to triage it becomes illogical, not not wrong in principle, but extremely challenging in practice. The bottleneck is no longer discovery, it's everything that comes after. The CVE system assumes a world where vulnerabilities are found one at a time by human researchers, disclosed individually and patched on human timelines. AI scale discovery breaks every one of those assumptions simultaneously. Individual CVEs may no longer be the right unit. Here's the heretical idea that needs to be said. When a model like Mythos scans a code base and produces 300 findings in a single pass buffer, overflows in some parsing library null pointer dereferences across related system calls use after free conditions in the same memory management subsystem. The 1 CVE per bug model no longer serves defenders. It buries them. Okay, now again we'll notice that this guy never said what's happening we when Cisco's When Cisco met Mythos. But if it had happened, if what we expect happened had, we wouldn't be surprised. He continues. What defenders actually need is a vulnerability summary, a grouped contextualized disclosure that says, quote this code base has a class of memory safety issues concentrated in these five modules with these representative examples and this aggregate severity profile, unquote. In other words, a vulnerability class report, a vcr rather than 300 individual CVE tickets. So it certainly does sound like this may be what exactly happened to him. And if it had, it's understandable, right? He's down in the trenches following the original 27 year old CVE model, which requires that each and every discovered vulnerability be cataloged, described, evaluated, listed and resolved. It's not a big deal when you field one or two, but when 300 drop on you during the first pass scan of just one piece of one's massive code base, what are you supposed to do? Let me really so I do see this guy's point. The existing piecemeal approach becomes immediately impractical. So he writes, this is not about hiding information. Every individual finding should still be documented and available to the maintainer, the CNA and the downstream consumers who need it. But the disclosure unit, the thing that gets published, tracked and acted on by defenders should be the summary, not the avalanche. Think of it as the difference between receiving 400 individual package tracking notifications and receiving a single shipment manifest. The manifest tells you what's coming, how critical it is, and what you need to do. The individual tracking numbers still exist, you just don't need to process them all at once to take action. Here's the stat he writes, that should keep every CISO awake. The median enterprise patch deployment time is approximately 20 days. Okay, the median, that is to say the point where there are just as many quicker as there are slower that that point is 20 days. So at 20 days, half of the patches take longer than 20. The other half take fewer than 20 days, he says. But in March of 2026, right? Two months ago, researchers observed active exploitation of a critical Lang flow vulnerability within 20 hours of its advisory. With no public proof of concept code available, attackers built working exploits directly from the advisory description. 20 days to patch, 20 hours to exploit that gap, he says, is already fatal. AI scale discovery makes it catastrophic the uncomfortable truth is that human driven patch cycles cannot keep pace with AI driven discovery. If models like Mythos are finding vulnerabilities at machine speed, and adversaries with similar models will exploit them at machine speed, then remediation has to move at machine speed too. This means we need to use AI to scale fix and patch. But code changes must be carefully reviewed and tested. This must become a standard part of our lives. It also means organizations need autonomous patch deployment pipelines for the most critical categories. Not quote we'll schedule it for the next maintenance window. No, not it's in the backlog. No automated testing, staged rollout and rollout capabilities that can absorb a continuous stream of patches without human bottlenecks. At every stage the pieces are assembling. What's missing is the operational framework to use them at scale again. I believe that by the end of the podcast I'm going to be able to make a strong case for why, for the thing this guy's missing. But I think that what he says still bears hearing. He says the CVE program must adapt. Let's be direct, he writes. The CVE program in its current form cannot handle what's coming. Not because the concept is flawed, a universal identifier for vulnerabilities is valuable, but because the implementation assumes human speed discovery, human speed enrichment, human speed consumption. All three assumptions are collapsing. The national Vulnerability Database enrichment backlog is already a known problem. CNAs, the CVE numbering authorities are already overwhelmed with submission volume and downstream consumers, the vulnerability scanners, security information and event management systems and risk platforms that ingest the CVE data are already struggling to provide actionable signal rather than noise. Several adaptations are necessary and they need to start now. Machine readable first, human readable second, CVE records need to be designed for automated consumption as the primary use case, with human readable descriptions as a secondary output. This means structured fields for affected components, exploit preconditions, environmental factors and critically machine readable patch references that automated deployment systems can act on now. Okay, actually all those things I agree with completely. Modernizing our 21R 27 year old CVE system to take advantage of everything that's been learned since its original design and the fact that, you know, again, 1999, 321 CVEs, even 2023 was tens of thousands. So even pre AI, just the. The sprawl of software has created a far greater demand. I mean we don't even have Adobe with Flash anymore keeping us busy. So I think it makes a ton of sense to to, you know, revisit the CVE system on under today's world. And that's what the RSA guys were looking at. It should be designed to be deeply automated, to be managed, ingested and digested by machine. Why not? That's overdue already. And as I said, that's what the CVE board members who Met during the 2026 RSA Conference acknowledged about the CVE program needing a complete overhaul. You know, and again, not specifically due to AI or mythos that wasn't that it hadn't happened during RSA 2026 just because we could now do a such a better job of what has become a critical need. So this the Cisco guy considers the shape of some of those changes that we would need, he writes. So should we use hierarchical identifiers, a parent vulnerability class report identifier with child CVE for the individual bugs? Defenders who need to take action at the class level can operate on the parent researchers and tooling that need the granularity can drill down into the children. Scanners and SBOMs software bills and materials can index either level. This gives organizations the ability to respond to quote your TLS library has a family of parsing vulnerabilities rather than individually tracking 47 separate advisories. CVSS, the common vulnerability scoring system, was designed for human assessors making static judgments. EPSs, the exploit prediction scoring system, moved toward probabilistic exploit prediction. The next step is continuous AI updated risk scoring that incorporates real time threat intelligence, proof of concept, availability, attacker tooling trends and the defender's own environment context. So what should defenders do now? He writes. You don't have to wait for the CVE program to reinvent itself. The practical steps for security teams are clear, even if they're painful. Remove and migrate away from end of life software and hardware well, okay. Generic security advice always good. Stop treating every CVE equally. If you're patching by CVSS score alone, you're already behind. Use epss, cisa, kev, you know the commonly or the known exploited vulnerabilities and real time threat intelligence to prioritize by exploitability and environmental relevance. The volume is about to make score based patching physically impossible. Next, know your inventory? Yes, actually know it. You cannot respond to a flood of vulnerability disclosures if you don't know what software you're running, where it runs, and how it was built. Software bills of materials are not a compliance checkbox anymore. You need them. They're the only way to answer does this affect me at machine speed? And finally, invest in autonomous patching infrastructure, automated testing, canary deployments, staged rollouts, and automated rollback. If your patch deployment requires a human to click approve for every single update, your cadence will be measured in weeks. When it needs to be measured in hours. He finishes writing Project Glasswings. Findings will flow through these normal channels as patches land. Your job is to be ready when they arrive and the window is closing. Anthropic chose not to release Mythos Preview publicly. That decision buys the industry time, but not much. Frontier AI capabilities and open weight models will advance substantially within months. The capability to autonomously discover and exploit software vulnerabilities at scale is no longer theoretical. It's only an engineering problem and multiple organizations are solving it simultaneously. The vulnerability disclosure system we built over 27 years was a remarkable achievement for its time. It gave us a shared language, a coordination mechanism, and a way to hold vendors accountable. But it was built for a world where a prolific researcher might find 50 vulnerabilities in a year. We're entering a world where a single AI system can find that many before lunch. The choice is not between perfection and action. It's between adapting now with grouped disclosures, tiered timelines, AI generated patches, federated databases, and autonomous remediation. Okay, so if nothing else, we've just heard the somewhat panicked reaction from someone in inside another major enterprise that obtained early access to Mythos. Though this author was careful to talk about the software security industry at large, it seems pretty clear that it was his own direct experience when Cisco met Mythos that drove this posting. He's essentially saying that there are so many problems that we cannot even count them. So at least for the first pass, we're just going to classify them by generic type because enumerating them individually seems pointless and probably, you know, really sad. So I think the major takeaway from this is that, yes, indeed, it is time to update the industry's aging coordinated vulnerability management system. And while we're at it, since AI has arrived in full force, and it's obviously never going to leave, let's incorporate AI friendliness into the new system. Where I disagree with this author is in the long term effects of AI's involvement. I think it's going to be different. I'll make my case for that once we get to today's main topic.
- [37:06]
A
Nice. And Leo, it strikes me, oh, we'll go. I know you want to do a break, but before we do that, it strikes me that this is just one aspect of how AI is going to change the speed that everything's happening. Right. It's certainly true in vulnerabilities, but it's going to be true in software, it's going to be true in customer service, it's going to be true in government. It's everywhere.
- [37:35]
B
Yes, I, I'm in the process. I, I've talked before about how I purchased some next generation servers for GRC last year. Since one of them has 256 gigabytes of error correcting server memory. I'm glad I bought it then. Yeah, and I'm not having to buy it now. I don't even know you if you can buy it now. And, and this one will be based on Hyper V. You know, Microsoft's you know, class, you know, first class, hypervisor, supervisor and run. Whereas I now have three different machines. They will be three VMs. Anyway, my, the reason I'm saying all this is that I am. What happened was I was in the process of, of adding some additional purchasing methods to GRC's E commerce system to lower purchasing friction because I'm going to be doing some more inexpensive software in the future and I wanted to make it easy just to click a button, you know, like PayPal or Apple Pay or Google Pay or, or Venmo or whatever. Turns out PayPal would refuse to connect to my server because although I support TLS 1.2, I don't support a couple of the later ciphers and I never will. I can't on that, on that server platform. So that's driven me to advance my, my plan of upgrading GRC servers. The point is I'm working with Claude that is basically a massive knowledge base to help me. In the same way that you used it to set up that Linux system from scratch, right? Yes, I could do it myself. You could have done it yourself. But I just, I know what I want and so it's like, okay, how do I do this? How do I do that? What about this? What about that? And I mean again, it is, it has saved hours and hours of time. I could have done it, but now I don't have to because. And think about this, Leo. This is what boggles my mind. All that there is is bazillions of, of parameters in a massive matrix which contains this knowledge. It's astonishing what we have created.
- [39:56]
A
It's read all the manuals, so you don't have to.
- [39:59]
B
Yes, the knowledge. And as I said last week, a book doesn't have understanding itself because it's printed text.
- [40:06]
A
Right?
- [40:07]
B
But it, and it's just, it's a captured, it's captured language. But a book does contain knowledge because when we read it, we get, we obtain that knowledge. And so but it's just, it's just this mass of, of parameters and, and I'm able to ask it questions about.
- [40:27]
A
Kind of remarkable, it is just mind boggling. But his point about the speed with which this is happening, there is a little bit of a, I guess an impedance mismatch because the speed the AI is operating at is a lot faster than the speed we can operate at, you know, which means, I think, and this may be not a good result that we are going to be more and more dependent on AI, for instance, in vulnerability. It's not Merely detection. We're going to rely on the AI for remediation because only the AI can act as quickly as the detection can act. And I think that that's, we're going to have more and more dependency on AI just to keep up. And it isn't. And the main point here is not just in vulnerabilities, it's going to be in every aspect. This is, this is what computing has wrought.
- [41:17]
B
Before the invention of the internal combustion engine. We got on bicycles.
- [41:21]
A
There you go.
- [41:22]
B
And pedaled to where we wanted to go. And we steered the handlebars in order to aim the bicycle and we went somewhere. Now we sit on a throne enclosed and twist a wheel and it just whispers along. We're still driving, we're still steering. Although that's now.
- [41:42]
A
Well, and you know what? The chief danger on the road is assured. It's the human.
- [41:46]
B
Yes, Leo, I love, actually I choose bicycling. I love to ride my bicycle. That's my favorite form of exercise. Because you're actually doing something, you're going somewhere.
- [41:58]
A
So much fun.
- [41:59]
B
I watch people who, on the road now who are clearly staring at their phone or their, their console and they weave around and wander. And I'm thinking, I'm glad I'm not on a bicycle.
- [42:13]
A
I stopped riding bicycles. I really did, for that very, very reason. I just don't feel safe. And bike lanes, you know, it's good to have bike lanes, but if they don't have a concrete barrier between you and the road, it's meaningless. They're going to veer right in that lane as soon as the, you know, the song ends and they got to put another one on. Well, this podcast is not ending, it is continuing. And we're going to get back to the issues at hand with Mr. Steven Steve Gibson in just a moment. But first, a word from our sponsor, Doppel. I love this. You know, I, I, I, I gotta play it again. I have so much fun playing this. This is an example of why you need Doppel. This is a. Well, see if this sounds like me. Hey, Burke, this is definitely not Leo asking you to buy gift cards. But seriously, can you grab me 100 Apple gift cards? Just kidding. This is Anthony testing text to speech. How's it sound? Anthony generated this fake phishing voicemail in about, with about four minutes of my voice on his desktop with a local model. It is now that easy. So you might, you know, get that voicemail message, that urgent message from your CEO. Maybe it is from the CEO or maybe it's A deep fake trying to target your business. Burke, don't mail those Apple gift cards. Okay? That was not me. AI as I mean, I just demonstrated it can impersonate trusted individuals. And that's why you need Doppel. Doppel. And the platform illustrates. They've actually did a test how frequently users fall for these phishing attempts. They did a voice call. Simulation deployments on the Doppel platform targeted users spent on average six minutes conversing with a deepfake.
- [44:06]
B
Yeah, well, yeah.
- [44:07]
A
And 100% of them believed the AI was human. If you got that message from me and it didn't say it, don't, don't do it, you might believe it too. It sounded just like me. You know, the other day you did the story about shiny hunters putting an ad in the paper for a female because they wanted a female voice to do their fishing. Because they had plenty of guys who could do the social engineering. But they needed some ladies. This is a scary world. Doppel is the AI native social engineering defense platform. Doppel strengthens human risk management by training employees to recognize deception. While Doppel's digital risk protection detects and disrupts attacks across every channel. You know I said it's not just CVE's attackers are turning the AI to power increasingly sophisticated strikes. Doppel uses it to fight back. You need AI to fight with automated takedowns, multi channel coverage and AI defenses that build intelligence with every fight. Doppel works relentlessly to protect people, brands and trust. Doppel offers best in class integrations and partnerships to seamlessly integrate into your existing security tech stack. Don't worry. Doppel's industry awards and testimonials speak for themselves. They're recognized as a winter 2026 G2 leader in more than one category. Users most likely to recommend momentum leader and best support join hundreds of companies already using Doppel to protect the brand and people from social engineering attacks. You need it Doppel outpacing what's next in social engineering? Learn more@doppel.com that'S-O-P p e l.com dopple. You know, as in double, as in doppelganger. And that was a doppelganger of me. That was pretty darn credible. O-P-P-E-L.com doppel. You need it. It's terrifying out there. We found out that we got fished in January. They broke into our Google Workspace account. Fortunately, they did very little. And we got a notification from Google the other day. 121 days after they broke in, they had 121 days. But you know what I think is going on? They have so many successful breaches. It's, they are, it's too fast for them. The bad guys can't keep up. So they didn't get around. They did a little sniffing. They, they read some emails and stuff, but they didn't get it. We have all the logs. Thank God they didn't get around to doing anything before we caught them, before Google caught them. We're now running tools to make sure that doesn't happen again. But we're so vulnerable out there, Steve. It's just, it's terrifying. On we go with the show.
- [47:04]
B
Okay, so there remains one massive problem that no one is talking about. And this is particularly worrisome for a company like Cisco. And that problem I'll call Patch deployment latency. It seems very clear that Cisco meets Mythos was a massive wake up call and that Cisco, like probably every other enterprise, any large enterprise, having a major security software presence is now or will soon be undergoing a significant AI driven re engineering of much if not all of their existing code base. But as we all know too well, having chronicled this literally for years, decades now, having fresh, updated and for the first time ever, largely if not completely bug free code ready to deliver is entirely different from having that massively improved and far more now secure code actually installed and running across its entire user base. It should be very clear to everyone that Mythos Daybreak and codename Em Dash Scale improvements are, are going to be sweeping across the entire industry's software and that the result of that will be basically soup to nuts improvements in the operation and security of that software. But getting those improvements into the hands of its users, this remains an unsolved problem for our industry. You know, really what we want to do is we want to remove all traces of the previous software. Because in retrospect, these AI tools have shown us, or are showing us, will be showing us that it should have never been shipped in the first place. But we didn't know any better at the time. We do now. So this is going to be a big problem. As I said, we haven't solved this problem. Only a handful of software suppliers truly have effective software update systems in place. We know Microsoft with Windows Patch Tuesday baby, Apple with their Mac OS and various mobile OSes can do this. I just had the opportunity while I was waiting for the podcast to update one of my phones with a 26.5, I think it is iOS on, on the phone. And since the security of our web Browsers is paramount. And since browsers are by definition connected to the Internet, browsers have long had the ability to keep themselves current. So that's all great, you know. And now, now the major Linux distros are beginning to acquire this ability. So what we've seen is that Microsoft, Apple and the browsers and now Linux is kind of catching up have made it difficult to not remain current. I mean you, basically it's done for you. You have to like actively say no. And I think Windows Update allows you to postpone an update for seven days and then it's, hey, you're getting updated whether you like it or not. So this, this tendency to update autonomously and more or less continuously for these people, it's likely to pay off handsomely I think in the coming months. Well, we already saw Microsoft able to brag that the four critical vulnerabilities in which code name EM dash and I hope they change the name or come up with a good name which it discovered in their TCP IP stack had already been patched by the time of their disclosure last on, on patch Tuesday. But unfortunately these few companies are the exception, right, of like having like being really patch forward. They're not the rule today. Many of this industry's network appliances, which are seriously vulnerable because we keep seeing problem after problem after problem, you know, they, they inherently suffer from an attitude that's a, you know, like a decade ago they if it's not broke, don't fix it philosophy. So I have a feeling that we may be in for a turbulent transition when the, and I would look at it this way, it's the difference in the security between what's running now and what should be running becomes far more significant than, you know, the delta than it ever has been. It's one thing to like patch a problem and say, oh well, you know, this is a double point release because it'd be good to have it, but it's not, you know, house on fire. Like one problem is being fixed. And you could almost understand somebody who's busy, who doesn't want to take the equipment down because it's in use. Like I don't want to fuss around for some problem that is probably not going to affect me. But when this landslide, which is what we can expect to see coming from Cisco when the landslide hits, there's a huge difference, I mean like a huge benefit to patching. And so it's going to be interesting to see what happens. I am really grateful, Leo, that this podcast did not stop at 999 because we're having more fun with Internet security and its implications now with AI than we have for a long time. Last week we talked about the BitLocker bypass, which I was reluctant to label a backdoor, despite a number of security professionals kind of teasing that description. Microsoft was quick to jump on this, even though it's released by the hacker, which we know was calling themselves Nightmare. Eclipse was deliberately timed to leave this exposed for the longest time possible, which is to say until June's patch Tuesday. The bypass of BitLocker now has a CVE. It's 2026.455.85, and Microsoft's executive summary for this explains it this way. Microsoft themselves, now acknowledging the bypass and addressing it with the cve, says Microsoft is aware of a security feature bypass vulnerability in Windows, publicly referred to as yellow key. The proof of concept for this vulnerability has been made public, violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is made available. Okay, so then the executive summary offers a breezy FAQ Q&A which asks and answers, asks, should I leverage the temporary mitigation? And they respond, and I'll be sharing what that is in here in a second. They respond, Microsoft recommends that you consider implementing these mitigations if you are concerned your devices and data are at risk of being compromised or stolen. In other words, yeah, implement it if you think you need to. For example, if your organization's employees take their work devices home or or on business travel. Okay, so maybe if the device is at higher risk, what impact to service availability and management could be caused by implementing the mitigation? They reply, mitigating. Implementing these mitigations will not impact service availability or management operations. Okay, so one could imagine that that'll be part of next patch Tuesday. If there's no downside, do customers need to revert the changes made to mitigate the vulnerability once the security update to protect against this vulnerability is available? Answer no. The security update will maintain the mitigation's behavior once the security update is installed. In other words, this kind of does read like a whoops, we should have not done what we did in the first place and we're not going to undo it even if we fix the underlying problem. And finally they ask, I'm using TPM plus pin. Am I at risk of this vulnerability being exploited? Answer no, if you are using TPM plus pin, the vulnerability is not exploitable. So that's an interesting data point we learn from this that among other things, as I suspected and contrary to what Nightmare Eclipse was claiming last week, there is no PIN bypass possible and anyone who is already using a PIN will be protected. And the CVE description that has another faq, a secondary one, which is a little more interesting question what kind of security feature could be bypassed by successfully exploiting this vulnerability? And they answer, A successful attacker could bypass the BitLocker Drive encryption feature on the system storage device. An attacker with physical access to the target could exploit this vulnerability to gain access to encrypted data. And finally, is there and this leads us to the mitigation. Is there, is there a script that I can copy and paste to implement a mitigation? What do you know? Yes, this script is an interim security fix that helps to reduce the risk of exploitation of the vulnerability. The script is for winre, you know, the recovery environment winre and removes the file auto fstx EXE from the boot execute registry value. Since boot execute runs programs very early in boot, even in recovery mode, removing this entry prevents that executable from running in a high privilege environment, reducing risk. Again, shouldn't have never been there after you run the script. It won't be. It works by mounting the winre image, editing the script the script works by mounting the winre image, editing its offline system registry to remove the entry if present, then safely committing changes and resealing winre so BitLocker Trust remains intact. It's designed to be safe. If the auto fstx EXE entry is not there, it exits without making any changes. So Microsoft has provided a PowerShell script that anyone who might have concerns that a local system might be abused in this way can now run to remove the vulnerability to the hack that Nightmare Eclipse discovered and publicly disclosed to spite Microsoft. This will presumably be more formally fixed by next month's June patch. Tuesday I provided the link to Microsoft's CVE disclosure which contains the script in the show notes at the bottom of page eight, so I didn't think it was worth creating a GRC shortcut. It's right there at the bottom of page eight for anyone who wants it or just Google CVE2026 hyphen 45585 and that will take you to it that contains the script. It's also worth noting that this vulnerability does not appear to be the result, and this is significant of a software flaw of the type that Mythos Daybreak or Microsoft's own codename Dash Vulnerability Discovery System would detect and remediate in other words, this appears to be an architectural design flaw where nightmare Eclipse, while examining the mechanics of Microsoft's deliberate design, cleverly realized that a side effect of one of the system's deliberately designed features could be abused to cause the system's BitLocker drive to be and to remain decrypted following an interrupted recovery boot. So the reason I'm highlighting this point is that while our emerging AI systems very clearly promise, and I would say it's beyond promising, they're delivering, you know, eliminating entire classes of software coding mistakes. Not every security problem that we're going to see is the result of a coding error. So we need to remember that it's very possible for a sufficiently complex system even without outward bugs. That is where the software is doing what the coder intended. It could still exhibit unintended behavior by design. Now, I should also mention that actually, since I wrote the show notes, I've run across some discussion of the next generation of a AI security which addresses this. It says, okay, once we've got all the bugs cleaned up, what about mistakes in design? And so that will be the frontier after the one we're on. And I mean, whoever has a chance even to catch their breath these days. Leo, just.
- [61:52]
A
I know, I know, it's overwhelming.
- [61:54]
B
Oh my goodness. Yeah, I actually have to catch my breath, take a break and then we're going to look at Ubiquiti's five big problems.
- [62:05]
A
I'm here to catch your breath for
- [62:08]
B
you
- [62:10]
A
and I can't. I'm really, I'm sitting here looking at my Ubiquiti dashboard waiting to hear what I need to do because. So this will be. You can bet I'll be paying close attention to the next segment before we get there though. Pay close attention to this, our sponsor for this segment of security now, Cyber Hoot. Man, you need cyberhoot. It's a subscription based security awareness training platform that is the best. We just started using it and I can tell you it is the best. If you've ever rolled out security awareness training and thought, and I know I have, this feels more like a compliance exercise and actually teaching me security. That is very common actually, that kind of feeling. Are we just doing this because we have to? But you should take this seriously because you do have to. We, you know, as I said earlier, we got bit, we got fished and this was before we implemented Cyberhoot. And it's one of the reasons we did implement Cyberhoot because we, and I'm sure you in your business really need to keep an eye on these things. Most training works kind of the same way. You try to catch users making mistakes. So these platforms, they send fake phishing emails to inboxes, they wait for someone to click and then bam, you click and you're gonna get assigned training after the fact. That and it can find honestly, it feels pretty punitive. It is not a good way to learn. It really doesn't change behaviors, it just makes people like mad. That's where Cyberhoot takes a really different approach. Instead of trying to trick your users. Cyberhoots Hootfish. I love the name. The logo is an owl, right? So hoot. Cyberhoots Hootfish focuses on teaching them first, not in their inbox after a mistaken click, but in their browser through a trusted realistic phishing simulation. So you're not trying to catch people and embarrass them and humiliate them and punish them. The goal is simple, to build instinct before the click ever happens. And actually I watched Lisa go through the Cyberhoot process. I looked over her shoulder while she was doing it and I was really impressed. I was really impressed. Cyberhoot is, is is automated training campaigns, reminders, escalation to managers if you need IT reporting, all of that's handled for you. So instead of, you know, chasing users down, you get clear visibility into who has completed what and where your risks are. And here's something interesting. Cyberhoot also adds, and I think this really is cool, a light opt in social layer because you're going to get these little badges right. Users can connect with co workers and actually engage in a friendly competition around training progress. It's not forced gamification, it's just enough and people, I think people really dig it. To increase participation. It's not, you know, we're not building a gotcha system here. We're just making it fun. And it is. G2 review. I've seen people, you know, put their little owl, their little award right there in the slack. G2 reviewers rate Cyberhoot 4.9 out of 5 stars. That's pretty good. That's as good as you get. What do reviewers like? They repeatedly praise ease of use, high participation, brief content, non punitive training, full automation and strong support. If your organization is ready to stop punishing people for being human and start actually building cyber smart employees, head over to cyberhoot.com security now. Now do me a favor, use the code security now at checkout. You're actually doing yourself a favor because you're going to get 20% off your first year. That's cyberhoot C Y B E R H o o t cyberhoot.com/security. Now the promo code. Security now 20% off your first year. Just remember to always laugh, learn and hoot up with cyber Hoot. And you're going to get a little owl. It's so cute. It works. Make it fun. Don't make it. Don't make it a chore. Make it fun. It's. It's good common sense. And I. And I think it works. I do. All right, Steve, back to you.
- [66:34]
B
Okay, Leo, since I know that you and many of our other listeners are users and fans of ubiquity, I'm sitting
- [66:42]
A
on my update page right now waiting to hear what you have to say about this.
- [66:47]
B
So I wanted to make sure, yes, everyone knew that it was once again patch time for ubiquity. Okay, now recall that two months ago in March, Ubiquiti patched a maximum severity flaw affecting the Unifi network application that allowed attackers to take over user accounts as well as another vulnerability that could be exploited to escalate privileges.
- [67:11]
A
Yikes.
- [67:12]
B
Yeah. Since census, the Internet scanner shows that the Internet currently has 100,000 publicly exposed UNIFI OS endpoints with nearly half of them 50,000 IP addresses located in the US any known and unpatched flaws in ubiquity devices will tend to draw bad guys attention and in fact that has been the case and there are some ubiquity focused campaigns so. Well, and it explains why ubiquity products have been targeted by both state backed hacking groups and cyber criminals in recent years. There's a big inventory. They were the. These. The. The hijacked devices were used to build botnets and proxies. So everybody wants to stay current. Last week Ubiquiti released security Updates to Patch 3 maximum severity vulnerabilities in unifi OS that can be exploited by remote attackers without privileges. In other words, as bad as it gets. Yeah. So just to be clear, the UNIFI OS is what powers the unifi consoles and helps manage IT infrastructure, including networking, security and other services as well as unifi applications such as Unifi Network, unifi Protect, Access, Talk and Connect. So the first flaw, which is CVE 2026 34908, enables attackers to make unauthorized changes to targeted systems by exploiting an improper access control weakness that exists in UNIFI OS. The second one, 34909, allows them to access files on the underlying system by abusing a path traversal vulnerability. Can you believe we're still having path traversal Problems, Leo. This could be manipulated to access an underlying account. The third maximum severity vulnerability, that's 34910, makes it possible for malicious actors to launch a command injection attack after gaining access by exploiting an improper input validation vulnerability. So that was earlier in the week. Then on Thursday, another critical command injection flaw. CVE2026 330 00. I guess that'd be easier. I should say 33,000 was patched along with a high severity information disclosure and that's 34911. So all of these affect you, all unifi OS devices. Now there is a piece of good news here. As bad as these are, they are not known to have been exploited in the wild. So these are not zero days, unlike nightmare eclipses. Deliberate campaign of malice against Microsoft and thus sadly, against Microsoft's users. Right, because users are the ones who ultimately, you know, lose. All of these flaws were responsibly discovered and disclosed and reported through Ubiquiti's participation in the HackerOne bug bounty program. So it's not house on fire, you know, the hackers are not out there scanning, but they're going to be doing that. So definitely make sure that if you are a Ubiquiti user that you've updated yourself to whatever is the latest available firmware for your devices.
- [71:03]
A
You know, for a long time, and this is years ago, Ubiquiti had a bad reputation that had put out a few bad updates and the price was, yeah, always. Oh, don't do auto updating on Ubiquiti. But I, they've been fine and I turned on auto updating a few years ago because it is so important and I haven't had any problems at all. So I notice I'm completely up to date and I presume those are all the latest patches. So nice. That's a relief. You know, and I would suggest anybody who remembers those bad days of ubiquitous updates, they've been, they've been very good.
- [71:38]
B
Well, and you know, there are always people behind those, right? I mean, and, and people leave and new people come or heads roll after a problem like that. So, so I mean, it really is the case that, I mean, and look at, I would argue Microsoft Security has been a roller coaster. There have been good times and bad times and good times and bad. We don't, I don't know what determines like why, but it just, it's like
- [72:08]
A
they're so big, right?
- [72:09]
B
The changing of the guard or, or they get a new VP that really understands, you know, how to do something or and then he burns out and leaves and somebody is stuck in there who doesn't. And you know, and, and nothing changes overnight, right? It's always sort of a decay and then, and then a rebuilding. So anyway, for what it's worth, I, I think you're really, you're exactly on point. Leo. We were just talking about, especially with what's coming. Imagine when ubiquity has access to as everybody will, Mythos scale, Daybreak scale. AI finds new problems. They want to find them before the bad guys do and they want their customers to have them. The, the problem is once AI starts creating massive blobs, you know, massive inventories of improvements, that it's one thing for the publisher to have them. They've got get into deployment. And so especially for a device like Ubiquiti that's on, that is Internet facing. Oh yeah, you're right, that's what that is where you want to be.
- [73:17]
A
And they update frequently, more frequently than any router I've experienced before. And seamlessly, you don't even, you're not even aware of the updates happening. And all my Ubiquiti devices have auto updates.
- [73:27]
B
That's the only workable model. I mean, and people go, oh yeah, but what if they make a mistake? Well, so what? So you know, you wake up one morning and you don't have connectivity. That's not the end end of the world. It's much better not to have hackers crawling into your network, you know, because you haven't updated your device.
- [73:44]
A
You may have missed this story. Earlier today HP sent out a BIOS update which bricked their high end laptops through Windows Update. So, and it's things like this that make people turn off updates. And that's, you know, there is one
- [74:02]
B
such person right there on the screen.
- [74:03]
A
Yes, he's damned if he does, damned if he doesn't. This was the high end HP ZBook Ultra G1A and the EliteBook XG1. These are beautiful laptops. These were critical BIOS updates pushed through Windows Update that bricked the computers and apparently it's been very difficult to get it back online. So I understand why people turn off updates, I really do, but not on my router.
- [74:34]
B
I would argue that even acknowledging the possibility that a router could hurt itself, all you are out then is a lack of connectivity until you fix it.
- [74:48]
A
Right?
- [74:49]
B
And that's not again, it's not the end of the world. What is the end is that having your router not updating itself and there being this window of opportunity for the bad guys to crawl in and that could be. That's a big catastrophic.
- [75:05]
A
Yeah, because I mean we have this
- [75:07]
B
thing in our homes known as a fuse and when you plug something bad in, the fuse blows.
- [75:15]
A
Right.
- [75:16]
B
It's like oh darn, electricity is off. Yes. Because would you rather have a fire?
- [75:21]
A
Yeah, that's a really good analogy. Don't put a penny in your fuses so they won't blow. That's a bad idea actually you can't do that anymore but in the old days you could. I don't think pennies are copper anymore.
- [75:36]
B
So consider that having auto update is like having a fuse. Yes, it could malfunction, it could blow and it could be a false positive, but that sure is better than not having it and letting the bad guys crawl in.
- [75:50]
A
Yeah, yeah. Well now I'm reassured and I'm glad I had that ubiquity updates on.
- [75:55]
B
Well, I think all of our listeners, anybody who thinks they're like being fancy by, by turning off auto updates. Not anymore, not in, not now, not when the world is about to hit jet skis with vulnerabilities and it's going to be a contest to see who wins.
- [76:17]
A
Yeah. Now of all the times you need it. Yeah, yeah.
- [76:21]
B
A Google Mandiant security researcher discovered and reported responsibly although it doesn't matter unfortunately because this is open source what's being described as a highly critical SQL injection vulnerability because yes Leo, we're also. Not only have we not solved the path traversal problems but. But SQL injection's never going to go away apparently after receiving and understanding the implications of Mandian's discovery on Monday, May 18th so eight days ago the Drupal project posted a public service announcement a PSA urging. I love this urging admins of its very popular cms they're you know, the Drupal Content Management System to reserve some time like prospectively get ready, get like, you know, get ready for core updates that addressed an issue that threat actors might start exploiting, they said within hours or days. Sadly, that announcement turned out to be prescient since attacks soon followed the publication of the updates that they had warned admins to be ready to apply, which repaired the problem. The vulnerability that was resolved allows specially crafted requests to trigger arbitrary SQL injection on sites using the PostgreSQL SQL Database Engine. So not all Drupal instances if you're not using Postgress ql but many are as we've seen before. One of the mixed blessings of open source is that any repairs to Its published code are trivially reverse engineered. Just you do a diff on the here was the source before, here's the source now, what did the developers change and now you know what the problem was that they fixed. So you know, it makes it instant for them to create an exploit. Once the resolve trouble has been identified, then you know, any online sites that have not yet switched over to the newly released updated code, which as I said is available to the attackers at the same time as everybody else will be vulnerable targets of opportunity. So in this case the flaw is exploitable without authentication and can result in remote code execution, privilege escalation and information disclosure in all the works. So last Friday the Drupal team updated their advisory to confirm that exploitation attempts, you know, and attempts. Well, right, you know, they say attempts, we know what that means, have been detected. Drupal rated the vulnerability as highly critical, assigning it an an internal score of 23 out of 25. So they have their own scale, I guess 10 wasn't high enough, so they go to 25. So you can get really close at 23. And unfortunately it affects a wide range of Drupal versions on basically every support, every still supported branch there. There are so many I didn't enumerate them in the show notes. So I'll just urge anyone using Drupal, you know who you are, to bring whatever version you may be using up to the latest release of that branch. And I'll, and I'll just also note that although those not using Postgress QL may not be immediately vulnerable in their notes they said everybody is urged to update since the latest security updates do also include fixes for other upstream dependencies, including in Symphony and Twig. So one final point is that Drupal's advisory notes that Drupal 8 and 9 are both well past end of life. I think they're in the tens and elevens now with many point release branches of those. Yeah, yeah. So you know, as a, as a consequence, you know, this is so bad that they even tweaked 8 and 9, although they made the comment that we're doing this because, oops, we're really sorry, but the updates are being provided on a best effort basis only because they will still contain other known vulnerabilities that will never be fixed. So Anyone still using 8 and 9, you're doing it on borrowed time. You know, if you, for what, what, whatever reason you cannot move then still update to the newest 8N to fix this because the bad guys are out there scanning for it. And will they? They will, you know, hurt you. Okay. In other news, Microsoft has announced that they will be phasing out the use of SMS for multi factor authentication. Yes, it's amazing. And account recovery for personal Microsoft accounts. It's time to switch to pass keys, they're saying, and so all users will be prompted to add a passkey the next time they log into their accounts. Microsoft says that SMS is a leading source, none, to no one's surprise, of fraud, and that the single mo that it is the single most targeted vector for account takeover for accounts that have, you know, SMS as their additional factor of authentication. And what's more, of course, passkeys allow for higher speed login flows since there's no need to wait for an SMS message to arrive. It also makes for a smoother and much more secure account recovery process since users will no longer be tied to a specific phone number. Even if you weren't using SMS normally, if you do, if you need account recovery, then it's, you know, the only way to do that is by being able to accept an SMS message. So interestingly, this move makes Microsoft the first major platform to completely abandon SMS for multi factor authentication. Other platforms like Google, Facebook and Twitter are pushing their users to stronger mfa, you know, multi factor authentication alternatives, but they do still allow them to use SMS as a last resort. Microsoft says, nope, no more sms. And I'm sure this is not Microsoft's fault. Actually, we actually know what happened. GitHub got hacked. As I said at the top of the show, a Microsoft developer, meaning you know, Microsoft developed because, you know, they own GitHub using their VS code, had the misfortune of installing a rogue extension from Microsoft's own VS code extension library, which is moderated and hosted by Microsoft. The result was that all of GitHub's internal repository, more than 3,800 internal code repositories, have been exfiltrated and are now being offered for sale on a hacking forum. As shown in the screenshot that I put in the show notes, GitHub says it's rotating critical secret tokens to prevent any future access to its assets. The malicious versus code extension was identified as NX console. So in, in the show notes, I had this screenshot. Thank you for putting it up.
- [84:20]
A
I like it. It says hello again, breached. This is obviously a demo, a dummy
- [84:26]
B
account, but yeah, so hello again, breached. Hope everything is doing well. This is the, I think it's the breached forum on the Dark Web. Oh, okay, okay. Yeah, so, so, so it's not a
- [84:41]
A
joke, it's actually the name.
- [84:42]
B
Right, so. So it's posted the. It's posted under the title internal GitHub source code. And the screenshot was made right almost immediately when this posting was only eight minutes old.
- [84:56]
A
Wow.
- [84:56]
B
And so, hello again, Breached, says the poster to the audience. Hope everyone is doing well. We are here today to advise GitHub's source code and internal orgs for sale. I'm sorry, to advertise. We're here today to advertise GitHub's source code and internal orgs for sale. No lowball offers will be accepted. Everything for the main platform is there, and I'm very happy to send samples to interested buyers to verify the absolute authenticity. There's a total of around 4,000repos of private code here. Then he says, here is a a list of all and provides a limewire.com address. And he said, please read these carefully to understand what the breach entails, meaning your eyes are going to bug out because it is like it is GitHub. He said, as always, this is not a ransom. We do not care about extorting GitHub. One buyer, and we shred the data on our end. It looks like our retirement is soon, so if no buyer is found, we will leak it free. In other words, they're saying if somebody is willing to purchase it, then they're making the assertion that that purchaser will be the sole owner of the source for GitHub and nobody else will get it. If they choose not to buy it, then the world will get it. And so whatever value it might have had, having been exclusively purchased by, I don't know, some big state actor maybe, or GitHub or GitHub.
- [86:55]
A
I think that's what the real implication is. If you buy it. Well, I'll destroy it. No one will have to.
- [87:01]
B
Interesting. So, and I guess you're right, because they're saying it's not a ransom, meaning sort of saying to GitHub, we're not ransoming this, but it will leak it. If you don't like to buy it, we will commit to shredding it.
- [87:14]
A
Because honestly, what is the value of buying this to somebody? I don't. Yeah, I could see why I keep it quiet, but.
- [87:22]
B
Well, if you grab the source and then turned an AI bug finder loose.
- [87:28]
A
Right. Then that's true.
- [87:30]
B
You could Potentially penetrate breach GitHub Big time if you do it before they do it and maybe have access to all kinds of other goodies. So the person signs off Saying if you're interested, send your offers to the communications below. We are not interested in under 50k. The best offer will get it.
- [87:54]
A
Huh?
- [87:55]
B
So $50,000, I presume it's us 50k, they wrote.
- [87:59]
A
It's kind of speculative. If you buy it like you think you could make something from it, but you don't know.
- [88:05]
B
Right, Right.
- [88:06]
A
That's why I think the real buyer here is Microsoft is GitHub. Right?
- [88:10]
B
I'll bet you're right, Leo.
- [88:11]
A
That does mean it's worth 50k to them.
- [88:14]
B
Yep.
- [88:14]
A
To make sure it doesn't get leaked to the public. I would say so. By the way, this is why. I don't know if this helps, But I'm glad GitHub has pass keys anyway, because I don't. They don't, you know. Well, I guess it doesn't make any difference.
- [88:31]
B
No. I think that if there are undiscovered, unpatched flaws in GitHub's function, then we're talking about cutting through it like, you know, like butter through a hot knife.
- [88:41]
A
I don't put anything on GitHub other people to see.
- [88:45]
B
Ah, yes.
- [88:46]
A
Yeah, yeah.
- [88:47]
B
That's crazy. So I titled this one to Russia with Love. Russians are continuing to use increasingly outdated software from Western publishers, most of which no longer receive updates or tech support, which can be a mixed blessing, especially when the tsunami of change is coming. Somewhere around one third of all Russian enterprises are continuing to use Software acquired before 2022, when Russia invaded Ukraine. The greatest concentration of Western software is in the corporate email segment, with Microsoft still holding around 50%, so around half of the Russian market, both through Exchange and Microsoft. 365 an interesting thought experiment would be to imagine that codename EM Dash is turned loose on the internally on the exchange and 365 code bases and uncovers a bunch of exploitable vulnerabilities. I mean, we know it's gonna. At this point, it's virtual certainty that that's what would happen. But Russian enterprises don't receive the benefits of these discoveries and updates because they're cut off. I would imagine that there are those within the United States intelligence community who would love to have knowledge of the things Microsoft had already found, fixed and patched. And really what harm could that do? And of course, Russia is likely not alone in being a hostile foreign adversary that's continuing to use software we're in the process of fixing just as fast as we can. So anyway, I just thought. I wanted to just note that Russia is, you know, we're at a time now. I mean this, this is exactly on point of me suggesting to everybody that there's never been a better time to turn on auto updating on of anything that has Internet facing exposure that you can so that that those who are responsible will have the opportunity to get firmware patches out to those devices as soon as they are available.
- [91:09]
A
You think we're headed towards an apocalypse? A mythos fueled apocalypse?
- [91:15]
B
Yes, I. There is. There can be no question. Wait till you hear what happened at Mozilla. Oh baby, we will get there in a second. But I Last week, first I shared my concern over the somewhat surprising consequences of having an AI chatbot learning about me in the furtherance of the illusion that there that you know that there's somebody on the other end of the conversation. And not only that it's someone on the other end, but it's someone who appears to care enough to accurately recall previously shared information. One of the things that I forgot to say was that these observations felt so strong and so self evident to me that as I said at the top of the show, the only way I could imagine that someone might not be totally blown away by the capability of today's AI would be if they had never actually used it like just were just like AI deniers.
- [92:29]
A
Some people have only used it as a chat bot and, and I think sometimes that doesn't give you the best.
- [92:35]
B
Right.
- [92:35]
A
Experience. So exactly.
- [92:37]
B
My, my I feel like to use it would be to understand and be a blown away by it if you really, you know. We also know that this is a little bit of me coming late to the party. Right. I. I wasn't sounding like this. Everybody knows six months ago. So two days after I shared that last Tuesday, I shared it with everybody. On Thursday, I light bulb lit up for me. Then Friday morning I, I posed the following question to Claude. And I will say my Claude because my Claude is different than anybody else's Claude. So here's what I wrote to Claude. I said, when I've been singing AI's praises to other people, I've sometimes been met with blank stares, as if the person I'm talking to wonders whether I've drunk the Kool Aid. What has struck me the most is that when an AI not only answers well, but answers like an attentive friend would, speaking from a growing understanding of me, specifically me, not just some generic human that transforms the interaction from a Q and A into a much richer conversation. And that led me to the revelation that anyone who is just using an AI chatbot without any Account may not have the benefit of that long term history accumulation. So I'm writing to ask is that completely true, since browser cookies could create session continuity? And what exactly are the differences between the use of today's AI chatbots Claude and ChatGPT with and without a paid for account? So that was my question. To that prompt, Claude replied the following your observation cuts right to the heart of what makes AI genuinely useful versus merely impressive in a demo. Let me break this down carefully on the cookie question. Yes, cookies create session continuity, but that's a much narrower thing than it sounds. What a cookie buys you is that returning to the same browser on the same device might reconnect you to the same open conversation. That's not memory, that's just not having closed the window yet. The moment a browser session expires, the cookie becomes irrelevant and there's zero synthesis happening across conversations. So cookies keep a thread alive, they don't build a relationship. Here are the actual tiers of continuity. No account at all. Each conversation is hermetically sealed. The model has no idea who you are, what you care about, or what you talked about five minutes ago in a different tab. Every session is a stranger introducing themselves. This is the experience most casual quote I tried it once people have had, which explains a lot of the underwhelmed reactions or Free account this is where the gap opens up meaningfully. With a Claude account, even free, your conversations are saved. You can read them back, search them, reference them. But more importantly, Both Claude and ChatGPT have memory systems that do active synthesis. They don't just archive. They extract salient facts about you and inject them into future conversations. For Claude, what you're seeing right now in this response is a direct product of that. I know your background, your work on Spinrite and security, now your health interests, the DNS benchmark video project, all of it without you having to reestablish any of it. And finally, Paid account. The memory mechanism itself isn't a paid only feature for either CLAUDE or Chat GPT. What paid buys you is primarily higher usage limits, access to the most capable models, longer context windows, and additional features like deep research or image generation. The relationship building aspect is available at the free tier and the and then it finishes writing. Okay, and again, remember, this is a computer. This is a thing that is producing this text which again, it's like oh holy crap, it finishes the asymmetry. Nobody talks about writing. Here's what I think is the underappreciated insight in what you've identified. The benefit is not linear with use, it's threshold gated. A casual user firing off three questions once a week gets almost nothing from memory because there's not enough signal to synthesize someone like you who uses it heavily and across domains gets a compounding return. Each conversation adds fidelity to the model's understanding of your context, vocabulary, priorities and working style. The person giving you a blank stare has probably only ever experienced the stateless version, which genuinely is just a fancy search box. The analogy that might resonate for your audience. It's the difference between calling a business's general support line versus having a long term relationship with a specific person there who knows your account history, your preferences and how you think. Same underlying capability, completely different experience. So I'm astonished that we have technology that's able to answer my question like that. But I wanted to share it because to those listening who have not already figured out what Leo and I am so enraptured about, if your experience to date has been limited to anonymously asking Chat, GPT or Claude a question from time to time, like any other search engine, what I learned
- [99:41]
A
we should both be drinking that AI Cool right there.
- [99:44]
B
Go ahead. What I learned is that it is not necessary to pay anything to experience what happens over time. Which actually is very clever, right? Because they're sin, they're setting the hook. You know, a free account is sufficient, but it is necessary to create that unpaid free account which will allow the AI to get to know you, which it cannot otherwise do. I believe you'll see that it becomes transformative and as I noted last week, somewhat worrisomely seductive.
- [100:25]
A
Some of us have spent many, many, many, many hours developing memory for our AI. And in fact, that's what agentic AI really is all about, is a memory of previous interactions kind of accumulating. And I'll give you an example right now. Steve. It's funny that you should mention this because earlier today I asked, should I buy SpaceX stock? And my agent, this is of my Hermes agent, said, your own words, boss, Stay away. That's what you told me to put in memory. And nothing in the news changes that. If anything, it reinforces it. Now that's good, because I did in fact at one point say, you know, let me know if, when this, when the IPO happens, because I want to make sure I don't have any. And then it said, then I said to it, oh, you're so smart. And then it says, funny how that happens when I'm just parroting your own good decisions back at you, but thank you. I'll take the compliment. So the personality also has something to do with it, but that's the thing that's probably more a seductive issue and perhaps not having anything to do with intelligence. Well, memory is very, very important.
- [101:34]
B
Oh my God. One of the other things I'm appreciating is, for example, as I'm working with Claude setting up this new Hyper V based multi VM server. I will make a point of, for example, telling it the name I used for one of my VMs because then it knows what I named it. Or I defined three virtual NICs on the hyper V supervisor or the hypervisor gave it the names. Then it just automatically was using those names as we were going through the configuration. It knew what to call them because I took the time to give it that information. I didn't have to. But I'm growing to understand how to use this amazing memory Alpha system.
- [102:29]
A
Yeah.
- [102:30]
B
That we have. Yeah, it's.
- [102:34]
A
I actually have three memory systems running now on my agent to do a variety of different memory, short term, long term, and then semantic memory so that if I ask it a question, it can then query a database, a SQLITE database and say, what have we said about this in the past? Because really all of it's simulated. It has no memory. I mean, that's the thing that's important to remember. It's like a new.
- [103:00]
B
Well, it has no understanding.
- [103:02]
A
Yeah. But also the memory comes because when you first load it, the first thing it does is go out and look at the memory files and go, oh yeah, yeah, yeah. Okay.
- [103:12]
B
Well it has memory.
- [103:13]
A
Like the guy in Memento had memory because he had post it notes everywhere. Right.
- [103:17]
B
Except that also in Claude, I do switch to a previous chat.
- [103:25]
A
Oh yes.
- [103:26]
B
When I want to continue that sessions.
- [103:28]
A
That's right. Yes, it has session memory. Absolutely. Yeah, yeah. But as soon as you start a new session,
- [103:36]
B
right.
- [103:37]
A
It's. It's all gone. Unless you have some sort of mechanism, which we both do, for it to remember previous stuff. That's how it knew that I said, never let me buy any SpaceX stock.
- [103:47]
B
Well, and again. So my takeaway for our skeptical listeners is, first of all, I, and there are a lot of them, yes, I completely understand skepticism. I honor it. You're welcome to it. Your skepticism doesn't hurt me at all. So skeptic away. But if, again, if you're wondering maybe like what you're missing or literally, is there a, you know, a tank of Kool Aid on perch behind me that I've you know, actually been drinking instead of coffee during these, these breaks.
- [104:19]
A
It's delicious, isn't it?
- [104:20]
B
It is. It is. It is transformative when you, when this knowledge of you. I mean, and again, if you, I have things to do. I'm busy, I'm doing work. I'm. So it's useful to me because I'm not sitting around on the veranda, you know, reading news. And so, so you have to have something that you need to work with it on in order for that to start to happen. But again, don't have to pay anything. You do have to create a free account. I would argue, I would urge anybody who still doesn't think that this is real to just try that. I cannot imagine that you could come away not being amazed. And Leo, we're at an hour and a half in. Let's take a break. We have one left after that before our main topic. But then I want to talk about a show that Laurie and I watched since it was its release on Thursday on Netflix. Just touch on it for a while.
- [105:25]
A
Always interested in stuff.
- [105:26]
B
And then we have a bit of feedback.
- [105:27]
A
Good. All right. But before all that, let's talk about our sponsor for this segment on security now, Trusted Tech. If you are managing Microsoft 365 for your company, that's a big job. I know you're responsible for, well, both the cost and whether it's set up correctly. And I hope you know you probably do that. But on July 1, Microsoft's going to raise prices. So now any mistakes in your licensing are about to get more expensive. Most Companies using Microsoft 365 are either over licensed, paying for unused seats and features. It's very easy to do or under licensed, creating compliance and security risks. And sometimes it's both. One department's got too much, one's got too little. But the bottom line is wasting thousands of tens of thousands a year on tools your team doesn't use or I don't know, this might even be worse. Missing critical security features you thought you had, you thought you were paying for. Trusted Tech understands this. They can help businesses understand what they have, what they actually need. And really important right now, how to lock in the right setup before those costs go up. Trusted Tech's team ensures your M365 environment is well supported and aligned with how your business actually operates. And that's one you know, the licensing business is one part of their business. But also they do great certified support services. So Trusted Tech also offers reactive support for your Microsoft environment through those certified support services. They do both. Microsoft licensing can be challenging. It's always changing. You got E3 versus E5 versus business premium add ons, the new E7. It's confusing and it's easy to misconfigure and overpay. And licensing mistakes again don't just cost money. They can create compliance exposure that's going to get more expensive after July 1st. Look, even if you think your license is dialed in, it's worth a second look. It's worth going to some experts. People, this is what they do day in, day out. They understand it, they know it, and they can really help you tune it. It's just like it's getting a second opinion. And if you want an opinion, ask Kevin Turner, former Microsoft coo. I mean, who better to ask about this? This is what he said. He was talking to Trusted Tech. He said, you guys have an incredible customer reputation. You have to earn that every single day. The relentless focus you guys have on taking care of customers gives them value and differentiates you in the marketplace. He was talking about Trusted tech. Look, after July 1st, you're stuck paying more. This is the last chance. I mean that's like a month and a week away. This is your last chance to fix your licensing before the costs go up. The clock's ticking. Trusted Tech right now offering a free Microsoft 365 licensing consultations. Right now visit trustedtech.teamsecuritynow365 and get a clear data backed view of your current licenses, what you're wasting, and how to lock in savings before the price increase. Go to TrustedTech365 and submit a form to get in contact with Trusted Tech's Microsoft licensing engineers. The clock's ticking. Do it now. TrustedTech Team SecurityNow365 we thank him so much for supporting Steve and the work he's doing at Security now.
- [109:06]
B
Steve okay, so this is just sort of a heads up to people who are looking for something to watch. Time magazine covered this saying Netflix's the Burrows is stranger things Senior, they said, backed by the creators who brought us the Upside Down. Netflix's newest sci fi horror series features an all star cast of senior citizens. Okay, so first of all, let me say I'm not a huge fan of horror, which to me generally feels gratuitous. But that's not at all how I would describe the Burrows. So if you don't like horror, don't let that put you off because there's nothing horrific at all. IMDb gives it a 7 1/2 out of 10. The majority of people are giving it an 8, and the second highest number is a 10 out of 10. So a lot of people are liking it. It's all. All eight episodes became available last Thursday, presumably time for binge watching over the long Memorial Day weekend. And I had run across a tease of it months before. Stuck it on my calendar. So I was, you know, looking for it. So my wife and I, Laurie sat down and began watching it. They do a little immediate reveal, I think, because they realized it has a little bit of a slow start. I was a little worried about it until I got to the end of the second episode. It was like, come on, is it what? You know, okay, fine. We were spending a little too much time looking at it. The whole thing is set in an old folks community. You know, putting the old folks.
- [110:55]
A
It is senior.
- [110:56]
B
It is senior.
- [110:57]
A
Yes.
- [110:57]
B
Stranger things. Senior. But I. I enjoyed it. And there it. There definitely has a theme and a concept, and it holds together nicely.
- [111:09]
A
So the Burrows is like a retirement home.
- [111:12]
B
Yes. Out in some random desert somewhere. And we spend a little more time on, you know, senior infirmity than I think we need to. But. And
- [111:25]
A
this is aimed at seniors. Oh, it's Alfred Molina. I love him. Is this aimed at seniors, or is it aimed at kids making fun?
- [111:33]
B
It's aimed at everybody. It's. It's just, you know, the. The sort of. The. It. It. The. The nature of the mystery.
- [111:42]
A
Davis is in this. Oh, yes. And Alfre Woodard.
- [111:45]
B
No, it's. It's got a really good cast.
- [111:48]
A
Yeah.
- [111:49]
B
So. And you can see there a picture of a weird.
- [111:52]
A
In the oven claw thing.
- [111:54]
B
Yeah. So it's. It's. I think it's worthwhile for people who. I. I wouldn't say go subscribe to Netflix, but if you've got Netflix, you probably want to check it out. And you have to be a little patient. Give it the first two episodes. I mean, you need to watch them. But by that, by the end of the second episode, I think you'll be pretty hooked.
- [112:15]
A
Okay, I'm. Now I'm interested. I love Geena Davis. Yeah.
- [112:19]
B
And she's got a good part.
- [112:21]
A
And Alfred Molina is great. Oh, this will be fun.
- [112:24]
B
Yep.
- [112:24]
A
Alfre Woodard is great. And it's the Duffer Brothers.
- [112:27]
B
Yep, it is.
- [112:28]
A
Yeah. Okay. Okay. There's a guy in a coffin. Okay. Sitting up.
- [112:35]
B
So be careful not to expose yourself.
- [112:38]
A
Don't spoil too much. Okay.
- [112:39]
B
Yes.
- [112:39]
A
I'm gonna stop right here.
- [112:40]
B
It is you. You definitely could get spoiled, but there are some great moments and. And There is an interesting, you know, sort of like broad concept that. So that. That holds.
- [112:52]
A
Yeah, good.
- [112:53]
B
Okay. So. Oh, and you're not left hanging. So by the end of episode eight you get closure. They tease a little bit to their maybe another season. But if so you're not like left waiting. So.
- [113:07]
A
Okay, okay.
- [113:09]
B
Our listener of ours, Dale, who, who his name on his posting or his email to me was Dale Ltl. We'll see why in a second. But he said I want to share an interesting piece of. Well, no, I'm saying I want to share an interesting piece of feedback. He's a longtime listener and a follower. It touches on something we've talked about several times relative to the way some future local AI agent might always be looking over the shoulders of, of computer users, I believe to tremendous advantage. I mean, I am sure this is one of the ways AI is going to manifest. I cannot overstate the value and importance I see for having that eventually chatting with an AI that grows to know you is already of inestimable value. So we already have that. And that capability is only going to grow to become more useful over time. But as I have repeatedly observed here, the overwhelming demonstrated strength of the range of click fix attacks, which as we know is the number one attack technique now in the world where users blindly, I mean it. The, the, the number of those is greater than all other attacks combined. Where users blindly follow on screen instructions which they do not understand that lead them to paste malicious command streams into their PCs. It serves to demonstrate that today's PC users have very little understanding of the way their machines work. I mean, and you can't blame them. These things have gotten ridiculously complex. I mean, have you looked at PowerShell on Windows? It's like, holy. What? What? So that's. That shows no sign of changing. It's not as if users are suddenly going to start reading the manual. That's not going to happen. In fact, they're probably going to use AI to distance themselves even further. But what could change is adding the ability to the PC operating system and or its web browsers to proactively prevent their users from self inflicting harm. Okay. However, notice that I specifically said future local AI, because these services, when they exist in the future, will need to cost nothing. They'll need to be part of the OS or the browser and be able to run on the local machine's AI engine. It's pretty clear to me that future PCs and smartphones will combine local with cloud based AI and future computing engines will have what Some sort of, we can call it a neural processing engine, just as, you know, part of its capabilities. Okay, so here's what our listener Dale shared. He wrote, I very much enjoyed your last podcast, admitting to offering your thanks to your AI of choice. I also thank Google Gemini, my current AI of choice, least until it becomes another killed by Google Project. I would like to offer a way of using AI that I haven't heard anyone speak about. Determining whether or not an email is phishing. My wife and I have several websites and corresponding social accounts online. Mine is mostly YouTube with almost 12,000 subscriptions and hers is a mostly Facebook and Instagram to boost her real world sales. As such, we get a huge amount of spam and phishing emails collectively. I've attached a screenshot of a recent scary email my wife received through her business email. It doesn't have any of the obvious spam phishing email indicators like an email address of, you know, random letters and numbers@scammingyou.com and so Dale attached the image of the email, but since it contained identifying information, I've reaper I just, I've reproduced the relevant text to give everyone a sense for it. So here's what this email that his wife received says. It says, we're contacting you regarding content associated with your account that has been identified during a recent intellectual property verification process. Our review indicates that certain materials may contain copyrighted content protected under United States law, including Digital Millennium Copyright act dmca. These materials may have been published or shared without documented authorization from the applicable rights holder. To assist with your review, we've attached a document containing the relevant content, references and supporting information. Then there's a PDF icon and a link with the text. Evidence of copyright infringement PDF, it goes on. We kindly ask that you review the attached file and verify whether the referenced materials are being used with proper authorization if necessary. Please update, remove or restrict access to the identified content across websites, social media platforms and other distribution channels. Okay, well, as we know, AI can now be employed to write highly convincing English. And you know, we've been expecting to see an increase in the apparent veracity of spam. This is likely an example of that. I mean, this reads very well written, very authoritative, doesn't. I mean, we know in advance, right, that it's spam. But if you received this and if you were a person with on with like a website and lots of content, there's nothing obvious that tips this as being bogus. So, you know, I have to say that anyone who didn't have their guard up could be excused for falling for this. And even if someone who was being cautious, you know it evidences none of the common telltale signs we've all been comfortably able to use until now to quickly identify junk email Dale's note continues. He wrote so I asked Gemini. My prompt was email of copyright content from Shady Records. Email says from noreplypsheet.com legit or phishing. Gemini replied with quote this is 100% a phishing scam. Do not click any links, download any attachments, or reply to the email.
- [120:40]
A
Good.
- [120:41]
B
Here is exactly what is happening, writes Gemini and why it looks so convincing. First, the legitimate sender address no reply@appsheet.com Gemini says AppSheet is a legitimate no code application development platform owned by Google. Cybercriminals have figured out a loophole where they can create a throwaway app on the platform and use its automated workflows to send emails. Because the email physically originates from Google's infrastructure, it easily passes security checks like spf, dkim, and dmarc and lands directly in your main inbox instead of your spam folder. While the email address noreplypsheet.com is real, the content inside it was written by a scammer. 2. The shady records Scare Tactic Scammers frequently use urgent legal threats like copyright, trademark, or intellectual property violations to trigger panic. They want you to act quickly, without thinking, so you'll click their link to quote, view the evidence unquote or quote dispute the claim unquote. If you click the link provided in that email, it will likely lead to a fake login page designed to steal your credentials, a malicious download like a zip or. Doc file that could infect your system with malware. And then he he he he finishes writing. Dale does says so after fussing at Gemini for parent company Google, knowing about this and doing nothing about it, he says, I followed up with a heartfelt thank you Gemini. I also have no doubts that the PDF link was hotwired to a nasty little payload, and I'm glad we didn't get it. Thank you. And then, then he says to us, thank you for all you do. Mr. Steve and Mr. Leo. Been a fan since early 2000s. Call for help and the tech guy on my 12 foot mesh satellite dish. Oh, signed off Dale Low Tech Linux at Tech Linux Everywhere Open Sui, Tumblewood, Tumbleweed, KDE Plasma Fanboy.
- [123:05]
A
Nice.
- [123:05]
B
So Dale was clearly annoyed that Google allowed this crap to be generated and sent from their own domain while their own Gemini AI knew all about it in detail it's like, oh yeah, our service is being abused like that. And this is an example of it. So the good news is more broadly, I think another huge aspect of our lives which AI has the promise to improve are all those aspects of phishing and spoofing and generally unwanted conduct which bad guys have been getting away with for the past several decades. I think that the widespread use of AI Agency for crime prevention is going to be one of, for cybercrime prevention, one of the biggest things that that's yet to happen. And given the speed at which all this is moving, we may not have long to wait.
- [124:02]
A
That's a really good tip to pass it through to an AI, have it examine it.
- [124:07]
B
Yes. And why don't we have AI right now doing that?
- [124:12]
A
Yeah, well, there are plenty of companies offering this kind of scanning. Yeah, yeah, this is a very hot area right now.
- [124:20]
B
Okay, so we're going to talk about our main topic, vulnerability, debt repayment. We're a little early for our final. But let's take our final break and then I'm going to talk about Firefox 151 and what I learned from their announcement update.
- [124:38]
A
Somebody is pointing out, and I think this is true, that probably all of the LLMs have been trained on all 10, 80 episodes of security now, so they at least know that much. They've learned everything you can possibly learn from this show. You know, from day one, we've long before we even considered AI might ingest our content, we've made our content Creative Commons and allowed people to, you know, ingest it and encourage that. And I'm glad, you know, I think that's really great. I'm glad that there's hundreds of thousands of hours of great, some of it dated technology information on the, on our, on our pages. Let's talk about our sponsor and then we'll talk about vulnerability, debt repayment. I'm dying to know what that means. Steve will explain. But first a word from Xbow. Xbow, like bow and arrow, right? Expo AI has changed the pace. We were just talking about this. Of everything from how fast software gets developed to how quickly it gets attacked. And engineering teams are moving faster than ever, creating more and more applications, but security has not been able to keep up. This is exactly what we were just talking about. Pen testing is still one of the most trusted ways to understand real exploitable risk. The problem is in an AI driven world with everything happens so fast, pen testing can be a bottleneck. Security teams are forced to choose between slowing down, developed to stay secure or moving fast and accepting that they're going to be gaps in coverage. They don't have to be because Expo eliminates that trade off. Expo. This is exactly what we were just talking about. Steve is an autonomous offensive security platform that runs continuous AI driven pen testing at the speed of AI mirroring real world attacks, hammering on your vulnerabilities. Expo doesn't just scan for vulnerabilities, it discovers, it exploits and it validates them. So you know you're only dealing with issues that actually matter. Real exploits. That means dramatically fewer false positives. Because we humans, you know, we don't want to waste time, right? And a clear view into real attack pads. This is exactly the kind of pen testing everybody needs. With Expo tests run in hours, not weeks. You get complete visibility into how an attacker would move through your systems and the ability to uncover issues that traditional tools miss, including zero days and novel attack paths. XBO's results speak for themselves. Just ask the application security lead at saysnam cz. He says even right now, after a year, I don't know any other company that is at least close to Expo in terms of agentic pen testing. They've pioneered this. They're the leaders here. The result? Predictable cost, consistent quality and stronger security without slowing down your engineers. Expo helps security teams keep pace with innovation and and cover more apps more often with the resources they already have. Xbow.com and you know the heritage of this company is pretty impressive. Was founded by the team behind Microsoft Copilot. It's already trusted by companies ranging from fast growing startups to Fortune 500 enterprises. You're probably already seeing articles and news about Expo. They're quickly becoming a mission criteria critical layer in modern security stacks. So to keep up with the speed of vulnerabilities, you need the speed of AI pen testing from Expo. Go to Xbow.com to start a pen test today. That's Expo.com I didn't plan it, but that's exactly what you're talking about, Stephen. This is exactly the way it's going to have to be solved, right? The speed of AI hitting these vulnerabilities as fast as they can be discovered.
- [128:50]
B
Well, and we have a perfect case in point. When I fired up my PC and then Firefox 151, I was greeted with a your Firefox has been updated notice with a bunch of new features being called out. The top of the new stuff list was their promotion of Firefox's newish VPN feature as a means of Geo relocating its users under the banner of your VPN has places to be. We're told our free built in VPN now lets you set your browsing location, giving you more privacy and control when you're away from home or office. Now I'm just sharing that because I thought that was interesting and I knew that that would be of interest to our listeners. I understand Mozilla's motivation for promoting Firefox's new free VPN as an easy to use geo relocation capability, but at the same time I was also taken a bit of back since VPNs are already in the crosshairs of politicians who have been rattling their sabers over the idea of and we're not sure how, but somehow preventing their use of and even outlawing them for accessing age restricted websites. Now again how exactly that's going to work no one knows. So this seems like needlessly rubbing our politicians faces in the issue to make a point of saying oh look, you get to choose from a drop down list. Canada, France, Germany, the U.K. or the U.S. but okay, you know, making georelocation much easier and more accessible promises to increase its use, right? And make its issue unfortunately even more prominent. So anyway, since any attempt to curtail VPN use is going to create another big mess, it would be nice if we could just kind of let this one slide by. But on the same page was another section titled A New Era of Firefox Security. With the note, Firefox used advanced AI to uncover and fix hundreds of hidden security vulnerabilities before they could become threats. Now that note linked to a Mozilla post made last Thursday with the great title the Zero Days Are Numbered. Love that. What we learned from Mozilla is kind of amazing, they write. Since February, the Firefox team has been working around the clock using frontier AI models to find and fix latent security vulnerabilities in the browser. We wrote previously about our collaboration with Anthropic to scan Firefox with Opus 4.6 which led to fixes for 22 security sensitive bugs in Firefox 148. Okay, now let's just pause for a moment. They used opus anthropics opus 4.6 to and gave it Firefox's source and it found identified 22 security sensitive bugs in Fire and which and it Fixed in Firefox 148. Okay, Opus 4.6 they continue. As part of our continued collaboration with Anthropic, we had the opportunity to apply an early version of Claude Mythos preview to Firefox. Okay, now this is the same Firefox which a couple of months before had found 22 vulnerabilities looked clean then, right? Problem solved, they wrote. This Week's release of Firefox 150 includes fixes for 271 vulnerabilities identified during this initial evaluation, they write. As these capabilities reach the hands of more defenders, many other teams are now experiencing the same vertigo we did when the findings first came into focus. For a hardened target, just one such bug would have been red alert in 2025 and so many at once makes you stop to wonder whether it's even possible to keep up. Our experience is a hopeful one for teams who shake off the vertigo and get to work. You may need to reprioritize everything else to bring relentless and single minded focus to the task, but there is light at the end of the tunnel. We are extremely proud of how our team rose to meet this challenge, and others will too. Our work is not finished, but we've turned the corner and can glimpse a future much better than just keeping up. Defenders finally have a chance to win decisively. Okay, there's, there is so much here, but the phrase that caught my attention was you may need to reprioritize everything else to bring relentless and single minded focus to the task. This is very interesting because what we've been hearing more broadly and with generalization was that the arrival of this new vulnerability capability vulnerability discovery capability was likely to stun development teams who would be thrown from complacency into overdrive. And over time, Mozilla continues writing. Until now, the industry has largely fought security to a draw. Vendors of critical Internet exposed software like Firefox take security extremely seriously and have teams of people who get out of bed every morning thinking about how to keep users safe. Nevertheless, we've all long, quietly acknowledged that bringing exploits to zero was an unrealistic goal. Instead, we aimed to make them so expensive that only actors with functionally unlimited budgets can afford them, and that the cost of burning such an expensive asset disincentivizes those actors against their casual use. This is because security to date has been offensively dominant. The attack surface is not infinite, but it's large enough to be difficult to defend comprehensively with the tools we've had available. This gives attackers an asymmetric advantage, since they only need to find one chink in the armor. We use defense in depth to apply multiple layers of overlapping defenses, but no layer is bulletproof. Firefox runs each website in a separate process sandbox, but Attackers try to combine bugs in the rendering code with bugs in the sandbox to escape to a more privileged context. We've led the industry in building and adopting Rust, but we still cannot afford to stop everything to rewrite decades of C code. Especially since Rust only mitigates certain very common classes of vulnerabilities. We pair defense in depth engineering with an internal red team tasked with staying on the leading edge of automated analysis techniques. Until recently, these have largely been dynamic analysis techniques like fuzzing. Fuzzing is quite fruitful in practice, but some parts of the code are harder to fuzz than others, leading to uneven coverage. Elite security researchers find bugs that fuzzers cannot largely by reasoning through the source code. This is effective, but time consuming and bottlenecked on scarce human expertise. Here it is. Listen to this. Computers were completely incapable of doing this a few months ago and now they excel at it.
- [138:09]
A
Wow.
- [138:09]
B
We have many years of experience picking apart the work of the world's best security researchers and Mythos Preview is every bit as capable. So far we have found no category or complexity of vulnerability that humans can find that this model cannot. This can feel terrifying in the immediate term, but it's ultimately great news for defenders. A gap between machine discoverable and human discoverable bugs favors the attacker who can concentrate many months of costly human effort to find a single bug. Closing this gap erodes the attackers long term advantage by making all discoveries cheap. Encouragingly, we also have not encountered any bugs that could not have been found by an elite human researcher. Some commentators predict that future AI models will unearth entirely new forms of vulnerabilities that defy our current comprehension. But we don't think so. Software like Firefox is designed in a modular way for humans to be able to reason about its correctness. It is complex, but not arbitrarily complex. Defects are finite and we are entering a world where we can finally find them all. And all I have to say here is wow. I hope everyone understands how much it means for Mozilla to be feeling the way they obviously do after their close encounter with Mythos. Firefox is already hyper secure. I mean, its security is its byword. It, it is about security. 271 previously unknown vulnerabilities discovered during their initial evaluation. And this is in Firefox's deeply scrutinized code base which so far as they knew had not a single vulnerability. I think this is the most significant statement made from the front lines of the security battle that we have seen to date. No one should make the mistake of assuming that Anthropics Mythos Preview has some magic fairy dust that no one else has. There's no reason to believe that anyone has magic fairy dust or that it's even possible to have it. This is why I think the whole idea of regulating AI is a fool's errand. It's the politician's knee jerk reaction to change and it could not be more wrong headed. We've often noted that it's not possible to regulate the use of cryptography since the knowledge of it has previously escaped. There's no longer any mystery about how to do crypto. Exactly the same is true of large language model technology. It's spread all over YouTube, it's all over GitHub, it's already everywhere. At this point, all we can do is be as prepared as possible for whatever comes next. And Mozilla's statement of optimism contains what I was hoping and expecting to hear. They clearly understand that this new tool has for the first time ever given them a true advantage over the bad guys. They alone decide when to release new code to their user base. Nothing forces them to do that. This means that now, armed with AI enabled pre release vulnerability discovery, no discoverable vulnerabilities ever again need to be released to the public. I want to highlight another aspect of this just to put a fine point on it. Mozilla wrote computers were completely incapable of doing this a few months ago and now they excel at it. We have many years of experience picking apart the work of the world's best security researchers and Mythos Preview is every bit as capable. So far we have found no category or complexity of vulnerability that humans can find that this model cannot. So again, so far we have found no category or complexity of vulnerability that we can find that this model cannot. Now I understand that this is attempting to prove a negative, right? This does not say that there is no category or complexity of vulnerability that a human could find that the Claude Mythos preview cannot. Only that so far they've never found one all by itself. That's a hugely significant statement. But what's also significant is that this is not anthropic. Saying this about their own.
- [143:36]
A
This is not marketing. Right?
- [143:37]
B
Right. This statement from Mozilla, this is. This is. It's a. From Mozilla about Firefox is as much from the front lines of of mission critical vulnerability discovery as it gets.
- [143:51]
A
You know, it's interesting about this. The other capability that's really key with Mythos we're getting back to memory is that it Is able. It has such a large context, apparently. We don't know the details. We haven't seen the system card, but it's clear from the output because it can chain exploits. And the thing that's been holding previous models back is they could come up with individual exploits, but they didn't have sufficient context to say, okay, now I got this. Then what? Then what? And they're able by that means it has enough memory and enough context to chain those exploits. And I think that's one of the key capabilities of Mythos. Just reading between the lines a little bit.
- [144:28]
B
Right?
- [144:29]
A
It's very interesting.
- [144:31]
B
So for what it's worth, six weeks ago, during our April 14th podcast, number 1074, I noted that my first working title for that podcast was Mythos Marketing or Mayhem? But once I brought myself up to speed, it was obvious to me that this was not marketing hype, despite what jaded cynics who were claiming without ever taking the time to inform their opinions with facts. You know, it was like, ah, well, they're about to have an ipo, blah, blah, blah. Anyway, once I understood it, the podcast got the title what Mythos means. And now, just a scant six weeks later, we're seeing the consequences of its application in one of the places it matters most in a modern web browser. So is it going to be a tsunami? There's something I see missing from some of the public disclosure over automated AI vulnerability discovery, like this guy from Cisco, for example, at the end of that recent posting by the Cisco guy about the strain AI vulnerability discovery is placing on the aging CVE system, right? We all remember what I said. I, I, I'm repeating it here for some reason, you know that, you know, he was saying that they chose not to release it publicly. 27 years of remarkable achievement in the CVE system. But you know, we, it's going to be completely overwhelmed and wiped away. You know, we need something completely different. But Mozilla turned Mythos loose on their Firefox code base. And yes, uncovered 271 previously completely unknown or unsuspected vulnerabilities. This blew their minds. But they recovered from what they described as the vertigo that this introduced. Brewed fresh pots of coffee, called, called their significant others to explain that they would be working late and early and got to work. Once they had caught up with Mythos, they shipped Firefox 150 with those newly discovered problems all resolved. So here's my point. What's going to happen now the next time they turn Mythos loose on Firefox's code base. Perhaps a big nothing, maybe something. But it won't be much. It's not as if those 271 vulnerabilities will need to be rediscovered each time. There were hundreds of previously unknown problems with Firefox's code base, which it had acquired acquired over its entire lifetime. All of those are gone now. And while mistakes and regressions can happen, they're not going to suddenly come back overnight. The way to phrase this is to say that Mozilla's Firefox code base had a previously unrealized large amount of technical debt to repay. The Claude Mythos preview revealed the exact nature of that debt, to which the Mozilla team, having recovered from the shock, got down to the work of repaying those years of debt. And now they have, the ledger is balanced and all they need to do now going forward is deal with whatever occasional mistake they might make. With prudent use of AI to check their work, they might never ship anything again with a discoverable vulnerability. As the guy from mozilla himself said, a00 flaws future is now possible. We know that Microsoft must now be facing an even more daunting challenge since their code base is far more massive, just as old and seemingly less well maintained than Mozilla's. The fact that every single month sees a hundred or so bugs resolved in Windows and Microsoft's other software suggests to me that they are likely facing a great many thousands, tens of thousands of newly discovered problems. We know that thanks to their early access to Anthropics project glasswing, they had access to Claude's Mythos preview and also to their perhaps even dramatically more powerful code name EM Dash system. Can you imagine what a catastrophic disaster they must be discovering for themselves? They shared the critical vulnerabilities discovered and resolved in the first and most obvious place they looked, which was Windows TCP IP networking stack, a critical component that likely received a lot of prior attention. As far as they knew, just like Firefox, they thought the TCPI stack was bulletproof problem free. 4 critical remotely exploitable problems found. So those networking stack bugs, which were somewhat obscure, I mean like I worried do I have a problem because I'm using Windows Server? No, I'm not using any of the weird stuff that, you know, the edge cases that, that, that could have leveraged and. But even so, they were all zapped two weeks ago with this much this month's patch cycle. So they too are gone and put to rest. There's no doubt that Microsoft would have immediately aimed codename M dash at it at its next target, whatever that is. I'm sure that's what they're doing right now and that they got to work. And here's the interesting bit of psychology that's at play as a developer in charge of security. As long as you do not know that there are any problems, you get to sleep soundly through the night. But once you've been handed an extensive list of vulnerabilities and realizes that the software you believed was secure is actually and provably Swiss cheese, it will be quite difficult to get any sleep until every one of those problems have been resolved. Because any one of them could be exploited at any moment. The source of all this angst is the awareness that especially for an open source project like Firefox or Linux or Chrome, with Chromium and to some degree Android, the bad guys also have the same access to the same code. And if they do not yet have vulnerability discovery tools of equal strength and power, we can be absolutely certain that they're working as hard and fast as they can to develop them. So there's an almost, there's almost a certainty of a very limited window of opportunity to, to get those problems resolved, to push updates out into the field and into users hands so that the flaws are pushed out of their hands before malicious actors have the chance to attack. So the bottom line is LLM technology has already driven a massive change in the practice of software security. Almost overnight it has revealed the size of the software security debt, which many of us adjacent to the industry have long sensed with a dull ache. And we are now in the midst of an industry wide rush to pay that debt down. Using LLM technology to locate and repair each and every problem before it can be used against us by others who will doubtless be attempting to leverage the same technology against us. But the crucial point to appreciate is that this will be a transient event. Once that debt has been repaid, just as Mozilla did, the entire industry will again settle down to a new, hopefully boring norm. With the world never being the way it has always been until now, it will never again be the same because our software will finally be working the way we always intended and hoped it was. It was just too complex and thus too expensive to make perfect. That's what has been forever changed. As Mozilla themselves explained, LLM technology dramatically reduces the cost of problem discovery. This means that we can and will now afford to fix and will find and then fix all of the long standing problems. And we must afford it since it will soon be just as inexpensive for the bad guys to find and abuse any problems that remain. Everyone listening to this podcast has heard me use the analogy of a sponge to describe our industry's somewhat sad state of software security. I've said that that that all of the objective evidence shows that security is porous and that the more pressure that's put toward penetrating that security, the more penetration will occur. The application of this new LLM technology will finally put this analogy to rest. Other non software vulnerability problems will certainly remain. Spoofing and phishing and social engineering attacks will not go away. Or at least they will require a different form of AI aided remediation, which I spoke about before. But the exploitation of vulnerable software finally has the chance to come to a well deserved end. We are entering, we are in a
- [155:08]
A
new era and I love this notion that it isn't going to be this way forever. We are eventually going to perfect this stuff.
- [155:18]
B
Firefox is fixed, Leo. It's done. It's fixed.
- [155:22]
A
Really?
- [155:24]
B
Yeah.
- [155:24]
A
Wow. And I think the choice, I mean admittedly as they said, Rust doesn't fix everything, but the choice of tools that don't allow buffer overflows and some of the dumber obvious mistakes type miscasting and stuff will really help as well. Right. We're going to use better tools now,
- [155:41]
B
so certainly, you know, engineering using prudent known systems is a good thing. But as they said, we've got decades of C+plus. We can't rewrite it. There's just too much there.
- [155:58]
A
Right.
- [155:58]
B
So they turned Mythos loose on it and it said, guys, you know, here's 271 problems. I'm sure they fell off their chairs. I mean they thought, they thought there was, it was fine. They like no problems. We, we, we shipped out 148, we fixed 22 things that Opus 4.6 found. We shipped out 149, fixed a few more things, then along comes mythos and wham. 271.
- [156:28]
A
It is amazing. It is.
- [156:30]
B
And, and if in fact Microsoft has further advanced the state of the art sounds to me, based on what we talked about last week, that codename EM Dash. And I hope they give it a good name. I don't care what they call it, but just not, don't make me say codename Em Dash every time.
- [156:49]
A
Ethos is a good name. It's a little.
- [156:50]
B
Oh, it's a great name.
- [156:52]
A
Yeah, that's wonderful. Maybe Microsoft called Zeus or something.
- [156:57]
B
And so far Daybreak is just a daydream.
- [157:00]
A
Yeah.
- [157:01]
B
So it's like OpenAI got caught with their AI pants down.
- [157:05]
A
But I think what's really going to happen by the end of this year is that all the frontier models will be good enough to do this kind of stuff. Yeah. And so then it won't be anything special. It'll just be at the rate we
- [157:16]
B
are running and the amount of resources that are being poured into this, it's going to be astonishing. But this really, this is the thing that has the chance to end software vulnerabilities. That doesn't mean you can't leave a management port open on your. On your.
- [157:38]
A
Still human error.
- [157:39]
B
Yes.
- [157:39]
A
There's also still things like Rowhammer. Right. There's hardware flaws that.
- [157:43]
B
Absolutely. Yeah, absolutely. So this is just. I mean, it's not like we need to say, okay, well, we did the Security now podcast until there was no more problems.
- [157:53]
A
No, we'll still be doing the show.
- [157:54]
B
We got plenty left to do. But. But it won't be like some random buffer overflow or authentication bypass where you do something the developer never expected and, you know, cause a problem somewhere. Flip some state and then inject a file and now you're in.
- [158:13]
A
That's an important way distinction because when we first were talking about Mythos, that was right about the same time that the Claude source code got accidentally released. And Paris said, well, wait a minute, if Mythos is so good, how come that happened? I said, well, you can't fix stupid. I mean, you got. You're going to still have humans in the loop. There's nothing Mythos can do about that, unfortunately. Really good stuff as always, Steve. I love this show. We look forward to it every Tuesday. I know all the geeks are going, yep, Tuesday's here. It's time for Steve. We do the show security now every Tuesday roundabout, right after Mac break weekly. So that's round about 1:30 Pacific, 4:30pm East Coast Time, 20:30 UTC. We do stream it live if you want to really be get the latest, freshest version if you're in the club, and I hope you are because the club supports this effort. We have advertising yet, but it doesn't cover all the costs, only about 70% of the costs, maybe less. So it's very important to us that people join the club and support us. If you're not a member, please Twit TV club. Twit members are in the Discord right now. They can watch in the Discord. They can chat with us in the Discord. That's one of the benefits. You can get ad free versions of the shows as well. And you won't get this plug either. If you are not in the club, there are still live streams you can watch because I'm not a big paywall kind of guy. As much as possible, we want to make sure everything is available to everybody for free. It's just we ask if you like it, to support it, if you can, if you can afford it. We stream this on YouTube, Twitch, X dot com, Facebook, LinkedIn and Kik. After the fact, there are on demand versions of the show because it is after all a podcast. Steve's got unique versions of the show at his website, GRC.com he's got a 16 kilobit audio version. Doesn't sound great, but is small. 64 kilobit, that's full audio fidelity. He also has transcripts written by an actual human, Elaine Ferris. Those take a few days after the show, but they are really good and they are very detailed. A great way to read along or to search. He also makes his show notes available. 20 pages, 22 pages usually of all the stuff we talk about. Links, images, everything. Those are all@grc.com now if you want to get the show notes ahead of time, Steve usually emails them out on a Sunday or a Monday. Go to GRC.com email give Steve your email address. That does two things. Remember I said earlier in the show that if you wanted to send Steve pictures of the weekend, you could do that. This is how GRC.comemail give him your email address. Once he whitelists it, you can send him email. And then at the bottom below that, there are two boxes unchecked for those newsletters. One is the show notes. The other is just an announcement newsletter that goes out never when Steve has. Well, very rarely when Steve has new software. His software though really is something you want to keep up on. Spinrite, which has been around for how many, 20 some years now, right?
- [161:14]
B
Long time, no way before the podcast, since late 80s. So 89.
- [161:20]
A
Let's put it this way, it was so good that Norton copied it because
- [161:30]
B
I declined to let to sell it to him. So he said okay and he sent a coder home with a copy.
- [161:36]
A
Wasn't as good, wasn't as good, wasn't as good. So. But of course much updated since then. In fact version 6.1 is really amazing. That's available@grc.com as well as the DNS Benchmark Pro, which allows you to figure out which DNS server is best for your particular situation. It's different for everybody. It's very Useful tool. It's only 9.99. You'll get them both@grc.com plus a lot of other stuff that he gives away for free, like, as he mentioned, shields up, which is, you know, I don't set up a network without testing it with shields Up. So many other great utilities. GRC.com we have copies of the show at our website as well. We have unique versions for some reason. A 128 kilobit version, which is more bits than anyone should ever have, but that's how many you get. We also have video, which is even bigger, but you get to see Steve's mustache in action, and that's worth, I think, the price of admission. Both of Those are at TWiT TV, SN. There's also a YouTube channel dedicated to security. Now, we do that for a couple of reasons. One, because YouTube's where, you know, everybody goes. And we want to make sure we spread the word about, you know, security. So, you know, we make sure that show is there. But also it's great for sharing clips. And I know a lot of IT professionals are listening and thinking, I got to send this information to my boss or my, my, you know, my family needs to know about this ubiquity issue. Whatever. Easy to do that with YouTube. You can start the video right where you want it to be. You can send it as a link. Everybody can see. YouTube makes it really easy. And then finally, the best way to get it really is subscribe. You could subscribe to the audio or the video in whatever podcast client you like, and that way you'll get it automatically the minute it's available. Steve, I will see you next Tuesday. And I'm going to watch the Burrows tonight. Thank you.
- [163:26]
B
I think you'll, I, I, I think it's, you'll like it. It's not, I mean, it's not unbelievably amazing, but it is really fun to watch these actors. I mean, they're, it's a great, a great cast.
- [163:38]
A
Yeah.
- [163:39]
B
And there's, there's a solid storyline behind it.
- [163:42]
A
I will watch anything with Gina Davis in it. That's, that's, that's a given. Thanks, Steve. Have a wonderful week. We'll see you next time on Security Now. Bye. Security.
- [164:01]
B
When you manage procurement for multiple facilities, every order matters. But when it's for a hospital system, they matter even more. Grainger gets it and knows there's no time for managing multiple suppliers and no room for shipping delays. That's why Grainger offers millions of products in fast dependable delivery so you can keep your finger facility stocked, safe and running smoothly. Call 1-800-GRAINGER click granger.com or just stop by Granger for the ones who get it done.