Podcast Summary: "Fake Australian" | Talkin' About [Infosec] News, Powered by Black Hills Information Security

Release Date: January 29, 2025
Episode: 2025-01-27 - Fake Australian
Host/Author: Black Hills Information Security

Black Hills Information Security presents their engaging weekly infosec podcast, where a team of experienced penetration testers and ethical hackers dissect the latest cyber attacks, breaches, and technological vulnerabilities. In the episode titled "Fake Australian," released on January 29, 2025, the hosts delve into groundbreaking developments in AI, significant cybersecurity incidents, and the evolving landscape of tech investments.

1. Introduction and Banter

The episode kicks off with the hosts exchanging light-hearted remarks, setting a casual and collegial tone. Corey jokes about hosting styles and engages in playful banter with John, Brian, and Ralph, establishing a friendly atmosphere.

**2. Breakthrough in AI: Chinese LLM deep seek R1

Timestamp: [04:34 – 09:44]

The primary focus of the episode revolves around deep seek R1, a new Large Language Model (LLM) developed by a Chinese company. This model is noteworthy for its efficiency, requiring significantly less computational power than its Western counterparts like OpenAI's ChatGPT-01.

• Technical Insights:

  • Deep seek R1 is a 7 billion parameter model, fine-tuned from a base similar to the Llama model.
  • It's lauded for its energy efficiency, enabling deployment on more accessible hardware platforms, including standard laptops.

• Political and Economic Implications:

  • The U.S. government had imposed restrictions on the fastest AI chips to curb China's AI advancements. However, deep seek R1 bypassed these limitations, challenging U.S. tech dominance.
  • John Strand posits, “[...] if you can do it with less power, you can do it with fewer GPUs and you can kick all these things out. That effectively kicks the entire IT stock market... [08:21]”

• Impact on Nvidia and IT Infrastructure:

  • The model's efficiency threatens companies like Nvidia, whose GPUs are integral to AI training and inference. A decrease in demand could lead to significant financial repercussions for GPU manufacturers.
  • Brian notes, “Nvidia took a 17% hit on the stock market today... [09:44]”

3. The AI Investment Bubble and Stock Market Dynamics

Timestamp: [09:44 – 22:35]

The hosts discuss the ramifications of deep seek R1 on venture capital (VC) investments and the broader stock market, particularly focusing on Nvidia’s financial vulnerability.

• VC Funding Concerns:

  • The advent of efficient AI models like deep seek R1 disrupts traditional investment strategies, making heavy investments riskier as models can rapidly become obsolete.
  • John Strand warns, “[...] it's entirely possible that you could sink billions of dollars into something that's completely wiped out... [23:22]”

• Stock Market Reactions:

  • Nvidia’s stock plummeted by 17%, reflecting investor anxiety over potential declines in GPU demand.
  • Ralph emphasizes, “Nvidia is trading at a 56 times forward price... [10:06]”

• Transformation of AI Accessibility:

  • The democratization of AI enables smaller firms and individual researchers to compete with tech giants, potentially redistributing market power.
  • Brian highlights, “AI is now much more accessible for companies like BHIS to compete with AI models... [08:21]”

4. Ransomware Attack on UnitedHealthcare

Timestamp: [43:38 – 52:42]

A detailed examination of the ransomware attack on UnitedHealthcare reveals the complexities and challenges in cybersecurity defenses.

• Attack Details:

  • Black Cat ransomware group compromised UnitedHealthcare, acquiring six terabytes of data.
  • UnitedHealthcare paid a ransom of approximately $22 million, intending to split it between affiliates and operators. However, Black Cat retained the entire amount, reneging on the agreement.
  • John Strand describes the scenario: “[...] Group A hacks UnitedHealthcare... Black Cat suddenly shut down and kept the entire ransom for themselves. [51:07]”

• Implications for Cybersecurity Practices:

  • The incident underscores the fragility of trust within cybercriminal networks and the devastating financial impacts on targeted organizations.
  • Corey reflects, “This is the whole no honor among thieves thing... [51:18]”

• Lessons Learned:

  • Organizations must bolster their defenses and develop robust incident response strategies to navigate ransom demands and potential breaches effectively.

5. Subaru API Vulnerability

Timestamp: [54:13 – 58:58]

The hosts discuss a significant vulnerability discovered in the Subaru app, highlighting the importance of thorough API security testing.

• Vulnerability Breakdown:

  • Security researchers identified an API flaw that allowed unauthorized users to take control of Subaru accounts, enabling actions such as tracking locations and unlocking doors.
  • Corey praises the swift response: “Subaru fixed it in like very short time. It was like the next day they fixed it. [54:55]”

• Technical Insights:

  • The issue revolved around the password reset function, which lacked proper token validation, allowing attackers to bypass authentication checks.
  • Ralph explains, “They just skipped confirming the token. You're like, no, I already got the token. [56:52]”

• Security Implications:

  • This case serves as a critical reminder of the necessity for comprehensive API security measures, including proper authentication and encryption protocols.

6. European Power Grid Hack

Timestamp: [58:56 – 62:30]

A concerning incident involving the European power grid showcases vulnerabilities in legacy operational technology (OT) and Supervisory Control and Data Acquisition (SCADA) systems.

• Attack Methodology:

  • Hackers in Berlin exploited unencrypted RF communications used for power grid management, manipulating signals to shed electrical load.
  • Corey narrates, “They replayed them and realized, oh, so this just shuts off some stuff on the power grid. [60:01]”

• Security Shortcomings:

  • The lack of encryption and authentication in critical infrastructure communications exposes significant risks, potentially threatening regional stability.
  • John Strand remarks, “We're just going to see another reason for people to ban Flipper Zeros. [61:18]”

• Preventative Measures:

  • Enhancing security protocols in OT environments is imperative to safeguard essential services against similar future attacks.

7. Quick Hits: Additional Infosec Stories

Timestamp: [42:23 – 61:38]

The hosts briefly cover several other cybersecurity anecdotes, providing swift insights into diverse topics:

• Cloudflare Geolocation Exploit:

  • A security researcher discovered a method to infer a user’s geographic location by analyzing cached images in Cloudflare’s CDN.
  • Corey finds it amusing yet concerning, saying, “It's kind of like a mini docs. It's like you don't live in China, you just hit this from New York City... [54:13]”

• API Testing and Penetration Testing:

  • Discussions around common vulnerabilities found during API pen tests, stressing the importance of rigorous security assessments.
  • Corey emphasizes, “If you're an API tester, you're going to be like, yeah, I did this on the last six pen tests. [55:12]”

• European Power Grid RDH Vulnerability:

  • An elaboration on how legacy systems in critical infrastructure remain vulnerable due to outdated security measures.
  • John Strand comments, “Problem solved... back them in a corner, they might find a way out. [61:33]”

8. Conclusion and Final Thoughts

The episode wraps up with reflections on the rapid advancements in AI and their broader implications for technology, security, and investments. The hosts underscore the transformative nature of current technological trends and the necessity for robust security frameworks to navigate the evolving threat landscape.

• John Strand sums it up, “A lot of the chaos out there right now is chaos as a ladder. And when we're looking at offensive security, we're looking at just general security. There's a lot of chaos out there right now. [46:07]”

• Brian adds, “The broader societal context... this is a transformative change. [41:36]”

The hosts encourage listeners to stay informed and proactive in their cybersecurity practices, emphasizing the importance of understanding and adapting to the fast-paced changes within the infosec domain.

Notable Quotes:

• John Strand [08:21]: “If you can do it with less power, you can do it with fewer GPUs and you can kick all these things out. That effectively kicks the entire IT stock market...”

• Brian [09:44]: “Nvidia took a 17% hit on the stock market today...”

• Corey [51:18]: “This is the whole no honor among thieves thing...”

• Ralph [56:52]: “They just skipped confirming the token. You're like, no, I already got the token.”

Final Remarks:

"Fake Australian" provides a comprehensive examination of pivotal events shaping the cybersecurity and AI landscapes. The hosts at Black Hills Information Security deliver insightful analysis, blending technical expertise with engaging dialogue, making complex topics accessible and compelling for both seasoned professionals and newcomers to the field.

For more in-depth discussions and the latest in infosec news, tune into subsequent episodes of Talkin' About [Infosec] News.