Artemis Astronaut's Bad Outlooks - 2026-04-06

Summary

---

Talkin' Bout [Infosec] News – April 9, 2026

Episode Title: Artemis Astronaut's Bad Outlooks – 2026-04-06
Host: Corey Ham (Black Hills Information Security)
Panelists: Ralph, Jennifer, Wade, Doc, Bronwyn

---

Episode Overview

This lively roundtable of infosec professionals and friends kicks off with lighthearted banter about office chairs and hacker aesthetics, then transitions into deep dives on the latest significant information security news stories. The team discusses recent supply chain attacks (notably the NPM/Axios compromise), NASA's Artemis mission tech woes (including astronauts coping with Outlook malfunctions), fresh breaches in AI ecosystems, mobile hacking tools, major FBI and government agency incidents, the continuing fallout from leaked LLM source code and AI training data, and the lighter side of the news—chickens in reflective vests.

---

Key Discussions and Insights

1. NPM/Axios Supply Chain Attack

Timestamps: 09:23–18:58

• Attack Recap:
  Axios—a critical JavaScript HTTP client—was compromised in a sophisticated supply chain attack. The attacker socially engineered a developer into joining a fake Slack and updating meeting software, resulting in credential theft and a malicious Axios release.
• Detection and Damage:
  The malicious code went undetected for ~3 hours before remediation, limiting broad compromise, but ~160 developer systems were affected.
• Takeaways:
  • The escalation from social engineering to supply chain, and the potential risk to the entire dependency ecosystem.
  • Attribution: Likely North Korea, per consensus, though evidence is circumstantial.
  • Quote:

    “The social engineering part, like having a complete Slack already put together... before AI, I would think this was more impressive. But nowadays I'm like, all right, you just tell AI to spit you up a Slack server.” –Wade (13:39)

  • Developers need better controls—e.g., releases require at least one approval.
  • Broader risk: NPM is by far the most ubiquitous JS package system; attacks have outsized blast radius.
  • Catastrophic Potential:

    “What C2 handles 2.7 billion systems?” –Corey Ham (12:04) “My C2, dude.” –Ralph (12:08)

---

2. Artemis Astronauts and “Bad Outlooks”

Timestamps: 20:06–25:46

• Background:
  NASA's Artemis astronauts were caught on a live stream expressing frustration that both variants of Microsoft Outlook ("Classic" and "New") were nonfunctional in space.
• Community Reaction:

  “I have two Microsoft Outlooks and neither one of those are working. Which is a statement we've all said at some point.” –Ralph (20:56)

• Tech Details:
  • Artemis II uses a laser-based communication system (250 Mbps down, 20 Mbps up), and iPhones 17 (camera-only, networking disabled).
  • Tech quirks such as multi-second pings, live streams, and the first onboard toilet spark humor and geek-out moments.
• Relatability:

  “The only reason I would want to leave Earth is to leave Outlook behind. If I have to take Outlook with me, I’m not leaving Earth.” –Ralph (23:46)

• Memorable Light Moment:
  “If anybody was going to run a toilet off of Windows, it would be the government.” –Jennifer (24:22)

---

3. AI Leaks and the State of Open Source in LLMs

Timestamps: 30:03–39:41

a. Claude Code Leak (Anthropic)

• Incident:
  The Claude desktop app’s source code was leaked due to an accidental commit of a developer file that linked to downloadable source contents.
• Hot Takes:
  • “Why isn’t this open source already?”
  • GitHub’s cleanup effort overreached, deleting unrelated repos.
• Design Oddities:
  • "Vibe coding,” wild spaghetti code, and unusual features like “Auto Dream” (periodic cleanup of memory).
  • Recursive code validation (outputting valid JSON by running in a loop against the schema).
  • Quote:

    “You're saying make your own caveman library?” –Ralph (37:30)

b. Mercor Breach: Training Data Exposed

• Overview:
  Mercor—a company central to AI training data—suffered a breach exposing how major LLMs (Meta, OpenAI, Anthropic, Google) source and structure their training sets.
• Implication:
  Highly proprietary, competitive data is now potentially in the wild.
• Thoughts:
  “You are being open sourced. Stop resisting.” –Bronwyn (40:32) “They produce training data for these AI models. This exposes how the sausage is made.” –Corey (41:06)

---

4. Mobile Hacking Tools & Old Vulnerabilities

Timestamps: 42:11–44:47

• Schneier on Security/Google Threat Intel:
  • Karuna, a mobile spyware targeting iOS 13–17, presumably of US government origin, exploits JavaScript engine flaws.
  • Widely patched now, but underscores the risks of lagging on updates.
  • “Upgrade or die.”

---

5. FBI Breach and Cyber Supply Chain Risks

Timestamps: 44:33–45:49

• Summary:
  FBI labels a breach of its unclassified network a "major incident," likely exposing surveillance tools and sensitive PII to Chinese actors.
  Relates to persistent attacks via supply chain and social engineering.
• Best Practice (Joke):

  “The key is to just not use email.” –Ralph (45:50)

---

6. VMware vSphere Brickstorm Malware

Timestamps: 47:07–51:15

• Threat Details:
  “Brickstorm” malware targets VMware vSphere, exploiting the lack of EDR on such infrastructure with advanced persistence (ghost VMs, webshells, Go reverse proxies).
  • Mandiant released a hardening script for admins (with the usual “run at your own risk” caveats).
• Bigger Trend:
  Attackers pivoting to “least monitored” platforms, e.g., ESXi/vSphere, as soft targets.
  • Quote:

    “You're just going for the least protected asset, even if that requires more effort in the beginning. Because once you develop that tool, then it feels like shooting fish in a barrel.” –Corey Ham (51:45)

---

7. U.S. Border Patrol Data Leaks via Quizlet

Timestamps: 52:16–54:18

• Revelation:
  Facility door codes and passwords appeared on Quizlet (a flashcard site), reportedly used by Border Patrol staff for convenience.
  • “They put the codes for the doors on Quizlet?” –Corey (53:36)
  • Risks: Potentially streamlines real-world physical breaches.
• “War Thunder” Reference:
  • Recurring military data leaks on War Thunder forums get honored as a perennial podcast favorite.

---

8. Other Notable Moments & Themes

AI, Agency, and “Entertainment Purposes Only”

Timestamps: 26:02–30:00

• Copilot’s TOS claims it’s “for entertainment only.”
  Laughter over the juxtaposition of productivity claims and CYA legalese.
• The panel riffs on “Roko’s Basilisk,” AI’s rise, and the etiquette of thanking your robot overlords.

  “My son says thank you to any robot that does anything.” –Wade (29:35)
  “I always say please and thank you to my AIs.” –Jennifer (29:27)

Chicken Articles & Closing Banter

Timestamps: 64:33–65:44
– Article about Scottish chickens wearing reflective vests for road safety closes out the episode.

“Don’t let the chicken cross the road without a reflective safety vest.” –Ralph (65:31)

---

Notable Quotes & Timestamps

| Time | Speaker | Quote | |----------|-------------|----------| | 13:39 | Wade | "The social engineering part...having a complete Slack already put together...before AI, I would think this was more impressive. But nowadays I'm like, all right, you just tell AI to spit you up a Slack server..." | | 20:56 | Ralph | “I have two Microsoft Outlooks and neither one of those are working. Which is a statement we've all said at some point.” | | 23:46 | Ralph | “The only reason I would want to leave Earth is to leave Outlook behind. If I have to take Outlook with me, I’m not leaving Earth.” | | 24:22 | Jennifer | "If anybody was going to run a toilet off of Windows, it would be the government." | | 29:35 | Wade | "My son says thank you to any robot that does anything." | | 29:27 | Jennifer | "I always say please and thank you to my AIs." | | 37:30 | Ralph | “You're saying make your own caveman library?” | | 40:32 | Bronwyn | "Stop resisting. You are being open sourced." | | 51:45 | Corey Ham | "You're just going for the least protected asset, even if that requires more effort in the beginning. Because once you develop that tool, then it feels like shooting fish in a barrel..." | | 53:36 | Corey Ham | "Are you telling me that they put the codes for the doors on Quizlet?" | | 65:31 | Ralph | “Don’t let the chicken cross the road without a reflective safety vest.” |

---

Bonus: Panelist Plugs and Community Vibes

Doc: Upcoming “Anticast” on “The 14 Absolute Truths of Cybersecurity”—with the punchline: “Security isn’t even what we do.”
Jennifer: API testing class coming soon (April 14).
Running Jokes:

• “JavaScript” drinking game leaves Doc “drunk AF.”
• Heated home bidets as a security lifestyle choice.
• “War Thunder leaks” – meme status.

Endnote:

This episode is a great mix of technical insight, professional perspective and community camaraderie, with a good dose of hacker humor.

---

Listen for:

• Practical reactions to real-time infosec incidents
• Commentary on the blurring lines between AI, open source, and corporate secrecy
• The importance of solid controls, both in code and at the (literal) front door
• Why you should always say please and thank you to your AIs
• Why chickens in safety vests may be the real winners in security this week

---

Transcript

[Corey Ham]

We're professional sitters. So what you sit in matters a lot. That's all.

[Ralph]

Yeah. Yep.

[Jennifer]

I feel like a hacker while I'm working, so.

[Ralph]

Okay, that's fair. That is fair. It does look sick. My chair does not look that cool.

[Jennifer]

Like, hold on, let me turn.

[Corey Ham]

My chair didn't come with a headrest too. I had to buy it. It was extra.

[Jennifer]

Oh, yeah, yeah.

[Ralph]

Dude, you don't need a headrest. Work harder. Come on.

[Corey Ham]

You're right. There's no reason I should be laying back. You make a good point.

[Doc]

The.

[Wade]

The secret lab one's magnetic things like the magnetic armrests and that. Like I have an older version that doesn't have any of that. So I'm just like. I'm not strapping on there, but I literally got Oreo because it covers all sin. Like you can stain it all you want and it won't see anything. I like pre thought about having kids, so.

[Jennifer]

Oh well for these now because that's a concern. I have a cat, so sometimes they decide that they love the chairs more than they love me for scratching. Now they make. They're called skins or whatever. They just slip on over it to hide the growth. So once this is all beaten tattered. I do have a different cyberpunk skin.

[Ralph]

Can you unlock a new skin for your chair if you get 300 confirmed hacks?

[Corey Ham]

Oh, yes. No. You have to totally get row chair bucks or something to do that.

[Ralph]

Click here to install the chair skin program.

[Wade]

You're gonna have to watch this ad for five hours to get one roachin.

[Corey Ham]

You just let me do that whole malware thing and we'll call it cool.

[Doc]

What is chair says anything about you? I have a lazy Boy. Yeah, When I heard that there was a lazy boy office chair, I said that's mine. I must have.

[Ralph]

That's amazing.

[Doc]

Yeah, it is comfy too.

[Bronwyn]

It looked comfy.

[Doc]

It's nap time, guys.

[Jennifer]

Even though I have the. I will say one of the good things about this is that one if you have any of the secret lab stuff like the standing desk, I really I wanted a secret desk or the. The desk.

[Ralph]

Secret secret desk. Now I want it.

[Corey Ham]

Oh yeah. Sounds secrety.

[Bronwyn]

Send. Wait. Standing desk or secret desk?

[Ralph]

It's a. I think it's standing.

[Wade]

Secret standing desk.

[Ralph]

It was a Freudian slip. Now it's the secrets out.

[Jennifer]

Yeah. Oh no. But it 1. The Cable Management has like the built in power supply and everything. And it's because I had standing desk before. But like it was always a hassle like trying to, like, put the baskets or like, sometimes the cast would pull, like, the power supplies out of the basket underneath it or.

[Corey Ham]

You don't want to see under my standing desk.

[Wade]

Oh, no.

[Corey Ham]

Like a new.

[Wade]

You have no excuse. You have.

[Corey Ham]

No.

[Wade]

You have a 3D printer. The first thing I did when I got this new printer was start printing out a bunch of cable management stuff. And like, now.

[Corey Ham]

Oh, no, it's great. Very, very organized everything. But if you look at it, you're like, this is a bomb of some sort. I don't know what this thing.

[Wade]

Well, you need, you need the slack to go up and down, right? Like, I have it in.

[Ralph]

You only need slack on your main tether, man. Or maybe a network cable. Come on. You only need one power cable. Everything else lives in the desk.

[Wade]

Oh, I, I, I have two work systems on my desk, so I have double everything.

[Corey Ham]

You know, when, when one job's not enough?

[Wade]

Well, I, I don't.

[Ralph]

Oh, are you overemployed? Wait, how many, how many tech jobs do you have? 5, 10, 15?

[Corey Ham]

We get.

[Wade]

Okay, let's. Let's talk about my weekend, my week, last week, which was absolutely the worst week to come back to from paternity leave. Oh, no things. I'm sure we'll talk about the npm.

[Ralph]

Nothing happened.

[Wade]

I'm not gonna, I'm not even gonna discuss the actual cyber security. So there was that stuff. You guys can think. I won't talk about it.

[Ralph]

I, well, why would you guys use JavaScript? It doesn't make any sense. I don't get it.

[Wade]

We don't use it, but I, I don't, I'm not allowed to talk about it.

[Ralph]

So get on the other computer and talk about it.

[Wade]

I teach on at a college, so that was last week as well. That was the first week. Then last week was also B side San Diego. So it was that. And then coming back. Just coming back to work for five weeks is like, everyone shoulder taps you and it's like, hey, remember that project, that thing you did? And I was like, no, no, I just didn't look at emails. Didn't look at anything.

[Ralph]

All my Claude memory files got deleted. Sorry, dude.

[Corey Ham]

Done, dude. You're done.

[Wade]

It was, it was brutal. It was brutal. Like, and then, like, acclimating with two kids and a job is not the funnest thing I thought. And hence now I have a refrigerator full of energy drinks, and I'm slowly doing it.

[Ralph]

All right, speaking of fridge full of energy drinks, let's get this show on the road show. Roll the finger. We're using Zoom. It's all scary. It's happening. Hello, and welcome to Black Hills Information. Talking about News. It's Monday, April 6, 2026. April Fools. We're doing the podcast at the normal date and time. Wait, that's not a very good April Fool's joke. Wait, I'm Corey Ham. I'm here to talk about the news. That's why, hopefully everyone's here. We've also got Ralph, who's here to talk about his chair. Got Bronwyn, who's here to use StarLink to harass AI tools and convince them to fix things for her. We've got Wade, who's still. Still getting to Inbox zero after five weeks of paternity leave.

[Wade]

You can do it.

[Ralph]

You can do it. I believe in you. Inbox Zero is a state of mind. Okay. You don't actually have. You can just right click mark all as red. And then anything that comes that's really important, it'll come back to you.

[Wade]

It sounds like strategy. It sounds like you knew exactly what I did, so let's just say I did that.

[Ralph]

The boomerang email strategy is totally valid. And then we've also got Doc. Tell us. Introduce yourself, Doc. I feel like I don't know you personally. So you've got a sick, like, layer down there. It looks like you're in a basement or you just have brick wall in your house.

[Doc]

So I'm in my dungeon. It's. It's literally just. It's not even a room in the basement under my stairs. It's not even the room past underneath the stairs in my basement. I'm in this tiny little section that's like a room off of a room that's underneath the stairs. And so this for all of those podcasters and such that have their fancy, you know, backgrounds and walls and wallpapers, whatever. This is literally the water line going into my house.

[Ralph]

Well, it looks awesome. So congratulations on your set design skills.

[Doc]

It looks great.

[Bronwyn]

And so on dressing up a closet.

[Wade]

Yeah.

[Ralph]

If you want to, you can. You can give a quick one liner of yourself if you want. You totally don't have to. It's okay.

[Doc]

One liner. Oh, boy. That's. That puts a lot of pressure on me. I don't know. I don't know what I'm doing here. You guys just invited me, so I showed up.

[Ralph]

All right, so then the one liner is cat dev slash urandom pipe slash dev null. What could go wrong?

[Doc]

Something like that. Yeah.

[Ralph]

Okay.

[Doc]

Exactly. I guess I'm Here just simply because. Well, for one, I'm here because I've got an anticast coming up on Wednesday, so everybody check that out. Hopefully the link is going up in just a little bit. It's about the absolute truths of cybersecurity and it is for everybody. And when I say everybody, I mean everyone who has an interest in cybersecurity at all, from the. The newbiest of noobs to the most hardened, seasoned professionals, we are going to talk about what is true in cybersecurity, whether you want to avoid it or not. And that's the best way that I can sell that.

[Ralph]

Sounds awesome. Yeah, there it is on screen if you're interested.

[Doc]

Look at that. Oh, when you put up. When you put up the timer, that makes me really nervous because it's like I haven't finished it yet and I

[Ralph]

have that much time to be ready. That's how you know it's gonna be good. That's how you know it's gonna be good.

[Doc]

It's gonna be really good. It's gonna be fly for a fly from the seat of the pants. Sort of love it. And the other, I guess the other reason that I'm here. So this is a news newscast. I haven't been keeping up with the news. I don't know what's going on. And so you know those people that will react to different things, like react to music videos and stuff like that online. I get to be the reactor to the news. You guys are going to announce something. I'm gonna go. Really? Oh, my God.

[Ralph]

Love it. Thank you so much. That was a great introduction. And then we also have Jennifer. I assume, Jennifer, you've been on the show before, but I'm assuming you also have some up upcoming content of some kind. Maybe a class or a talk or something.

[Jennifer]

I do. And for the life of me, I'm so sorry. I've been looking everywhere for the calendar invite because since then we migrated from Gmail to Outlook, and I'm like, I know it's here. I don't remember what day is April 14, right? Yes. I have a API testing class coming up.

[Ralph]

Great. All the keys for my APIs got leaked, so I'm. I could probably use that. All right, let's get into the news. Let's get some reactions from Doc and everyone else. Let's go. I think the number one thing that we can kind of update everyone on is the fallout from all the NPM supply chain attacks. That's kind of what Wade was alluding to in the Intro the big one last week was right Axios. Yes. Like literally like the second we ended the show last week. Axios, which is Axios is the one of the most popular web libraries or web client libraries for JavaScript was compromised. The supply chain attack was. They posted a really well written postmortem to their GitHub which I highly recommend everyone go read. I've linked it in the.

[Doc]

I'll.

[Ralph]

I'll link it in discord too. But basically it's a super advanced. The initial access or the initial compromise was very advanced. Essentially they contacted this developer and they posed as the founder of a company. They invited that developer to a Slack channel where there was a real appearing to be real communications and then they offered to have him join a meeting. When he tried to join the meeting it said that he needed to update his software to join the meeting. That was the initial access payload. So he. This is super tough because you're in that state where you can be tricked where like you're worried, you're trying to join a meeting, you feel like you're late, you're behind, things aren't working, you're willing to just click accept or allow. And that's what happened. Then that led to his credentials being disclosed. After that happened the they basically did some fancy GitHub actions stuff to make it so that there was a new version pushed of. Of Axios and then you know, the infections rolled. There was like a remote access program in the NPM file or in the Axios library that he the updated version. They caught it within three hours though which is good. I mean overall it could have been worse. The numbers, it's bad like the secrets are, you know, exposed and definitely there will be long term effects of this. But the numbers weren't too crazy. Like I think was it Crowdstrike or someone posted that there were only like a hundred and. Or maybe it was Huntress. It was like 160 computers or something which is like okay, that's a lot. If 160 developers. Like if you pop 160 developers that's potentially a huge amount of like that's a lot. But also like it's not configure. It's not like 2.7 billion systems were affected or whatever.

[Corey Ham]

What C2 handles 2.7 billion system.

[Ralph]

My C2 dude.

[Corey Ham]

Yes.

[Ralph]

You didn't know that? No, I'm just kidding.

[Corey Ham]

No, I know. I'm just thinking about it. I'm like that seems like a difficult scale, right?

[Ralph]

Like true.

[Jennifer]

I have always said that configure is like a cockroach because if you have one of it, you actually have like nine. Because a lot of the variants are just downloading different variants of configure.

[Doc]

Yep.

[Ralph]

So yeah, it was a bad one for sure. I actually knew Axios going into this because we've seen people abusing Axios to. For aitm like adversary in the middle fishing campaigns in the past. So like we, we actually have clients who are like, hey, what's this Axios user agent? Is that you guys? And we're like, nope, that's the bad guys. Sorry. So this was, it's bad. I think basically, you know, there was some, a lot of takeaways from this. The social engineering side is always interesting. There's no hard attribution on this, but it definitely seems like a nation state. Probably North Korea. Right.

[Wade]

Like there, there was a little bit of attribution of people automatically saying it was North Korea from what I read.

[Ralph]

But of course just say, oh, it's North Korea.

[Wade]

Right, Right. And that's what I feel like, like the, the general consensus, a couple of the articles I read that it was North Korea and that it was targeting more of like crypto and once again to get in, steal crypto and be real. But the, this honestly was really good. Like the social engineering part, like having a complete Slack already put together.

[Ralph]

Like if we talked about doing this we've never done.

[Wade]

It was before AI. Like, I would think this was more impressive. But nowadays I'm like, all right, you just tell AI to spit you up a Slack server that has everything in it and it would be a little bit easier. But still, it's pretty cool.

[Ralph]

Yeah, I mean, it's just one of those things. We ought to be looking out for these more advanced social engineering campaigns and. Yeah, I mean, Go ahead, Raoul.

[Bronwyn]

I can also see spinning agents, different AI agents to play different office roles.

[Ralph]

Yeah, you definitely could, you could have agents talking and doing things in Slack and even it could be like, you could be like, hey, can you email me? And they would actually do it or something like that.

[Corey Ham]

Well, the other, the other part that I really shocked was the obviously this is a, essentially a supply chain attack, like after you get past the social engineering. Right. Because now we're spreading. And so. And then when I saw this, I was like, oh, shoot, am I using any of these NPM packages? Right. Like, or, you know, and that's what everyone should have asked immediately. But then the next question is not whether I'm using them. I wasn't using any of these Packages. But hey, I also have other packages that I use. How, what's how this defense, like how do I think about like what do you, what do you do next? Because sure I'm not personally affected and maybe your organization is not personally affected, but this could have an effect. You, if you just happen to have the wrong package, the next developer gets, you know, swindled or you know, fished or however the attack vector is. And no matter how advanced it is. Right. So it could be the most advanced attack ever. You know, now that they're compromised, how do you as an organization protect yourself from that supply chain attack? Right. And there are some things you can do, but a lot of it comes down to, you know, locking the versions and you know, doing more checksums and other things like that. So. But none of them are 100%. But it's just something to think about if you are using NPM in whatever your product or development lifecycle. So.

[Ralph]

Yeah, and I mean it's also worth.

[Doc]

Oh, go ahead.

[Bronwyn]

I was gonna say not even just npm because your, your typical modern website is leveraging libraries and resources from multiple CDNs and multiple providers. I mean I can think of like when I was still doing web development, a very simple website might be pulling anywhere from 5 to 15 third party providers just to load the homepage. So it's, it's not just NPM in this case. NPM has started it and the, the JSON is definitely a potential point of attack, but it's if you're going to do supply chain checking, you need to check everything and that means you need to know everything that you're using.

[Ralph]

Yeah, I mean, well, there's also a lot of protections around these open source projects that just haven't been implemented because they're annoying to implement. Right. Like in this case one of the things, like one of the lessons learned that they say is like basically this is a developer's personal account and he's allowed to just publish releases to Axios. Like that in and of itself is a potential issue. Right. So they've, they've implemented a new like you know, doomsday device type thing where like he can't just publish a release. There has to be other steps in

[Corey Ham]

that are an approval, like you have to get approved. Right?

[Ralph]

Yeah, I know, yeah.

[Jennifer]

For us we have to go through the like even, like, even though we know like what, like we know what it's going to be. Right. But we still have to go through the approval process and somebody has to go look at it.

[Ralph]

Yeah, totally. And I mean, like the thing is, I think we're, you know, we're a little bit joking. People in the discord are definitely joking about NPM and JavaScript and how much of a disaster they are. For, for reference, we have at least two other articles talking about people not knowing how to use JavaScript and NPM. So like, you know, we're going to get into Claude code in a bit that also leaked due to people not understanding how NPM works and accidentally publishing embedded, you know, developer bindings. Yeah, NPM is the worst. I do think it's the worst. It's one of the most wide. Like it's an ecosystem where if you want to center text, you have to download someone's extra library or whatever. Like it is like it actually reminds

[Corey Ham]

me a lot of Python to tell you the truth, right?

[Ralph]

Like a ton of. Whoa, whoa. The Python center library can center text at least.

[Corey Ham]

Yeah, well, okay, fair, fair. But all right, so two things I wanted to mention for. So first of all, NPM is just a way to, to download node packages, right? There are others like PNPM Yarn, there's a ton of other ones and these are other ways to get there. So NPM is not the only way to download these packages. The whole library of packages though. The other thing that I wanted to point out is use ubiquitously across all of these front end Java applications, right? And I'm not talking about one website or I'm talking tons of websites, right? All of React, all of Angular, all of, all of These are all JavaScript libraries written and utilized through these kind of package managers. So my point is it's not going anywhere like you, I mean you could, you could hate it. But it's the standard at this point, right? Not the section, right, totally.

[Ralph]

So yeah, yeah, yeah, no, that's point

[Corey Ham]

out that that makes the attack Surface even worse if we want to talk about security, right?

[Ralph]

So correct. Also JavaScript, the reason it's so widely used is because it's how the Internet works, right? So like your Browser is.

[Corey Ham]

Without JavaScript your browser is almost worthless. I dare you to try.

[Ralph]

Dude, I use, I use for everything. I read all my emails in Mutt. I don't know what you're talking about

[Jennifer]

Anyways, you guys don't use link and just browse the Internet and command line.

[Wade]

I don't even browse the Internet, I just have Claude code. Browse for me.

[Corey Ham]

Yeah, I don't even do it anymore. That way the AI gets popped.

[Jennifer]

Not get everything into a text file

[Ralph]

and then read the Source. I pipe that into cow, say text to speech. It's Linux. Okay. It's the year of the Linux desktop.

[Jennifer]

I did have. I was saying I do that for my fortune a lot and recently it told me I was kind of. I was going to get kidnapped by station threat actors.

[Ralph]

Yeah, that was, that was a supply chain attack for sure.

[Jennifer]

I don't know what, why though. But I guess the cow.

[Ralph]

Yeah, after they, after they got rid of Telnet. I am looking for a new email client if anyone has one. No, I'm just kidding. Yeah, but, but yeah, I mean rdp, that's a great, that's a great. Yeah. While we're joking about this, we should talk about. There's an article. So basically the article is that they shipped Outlook on the Artemis spaceship for some reason.

[Wade]

Not just one Art, just not, not just one Outlook, both Outlooks.

[Ralph]

Which by the way, I know this because. Okay, so there's Outlook New and there's Outlook Classic. Right? And one is like by the way, they both suck.

[Jennifer]

Still better though.

[Bronwyn]

They're both Outlook.

[Ralph]

Come on, they both suck. Outlook Classic. I mean this is like, this is a, this is like, you know, a whole separate can of worms that we won't get into. But we, by the way, we do have sideloading vulnerabilities that we've reported in both of these tools and you can use Face Dancer to side load them because that's how it works in 2026. But basically it was overheard on a like meeting, you know, or whatever, like Mission control that some astronauts live.

[Corey Ham]

So it's live.

[Ralph]

So they're live.

[Corey Ham]

The whole thing is live. Whenever they're up, all the way to when they go to bed, essentially it's live. And then you could watch highlight reels of it.

[Ralph]

But yeah, so right, okay, so it's live. And during the live broadcast some astronaut said, I have two Microsoft Outlooks and neither one of those are working. Which is a statement we've all said at some point. Everyone in this room said that. And so it was just a very relatable moment of step one, of course. But step two, why? Like I don't know.

[Bronwyn]

I have also they fix it by rebooting three times.

[Ralph]

Yes, yes.

[Corey Ham]

The whole shuttle. They had to start and restart the whole shuttle.

[Ralph]

It was the whole mission. They had to fly back to Earth.

[Corey Ham]

So, so I, I tried other two tech fun things for the space mission that's currently going on Artemis too. Right. So the two fun tech things that I, I saw out above and beyond the Outlook. Right. So the first one is about how they're connecting to it. So they are using. They're not using radios to do the main comms, they use lasers. Right. So it's an actual laser, dude.

[Ralph]

Hell yeah.

[Corey Ham]

Yes. And it's 250 megabits down and 20 megabits up, so that they can pretty much do like 4K stream.

[Ralph]

So it's like my Internet at home.

[Corey Ham]

Yes. Yes.

[Jennifer]

Nice.

[Ralph]

Yes.

[Corey Ham]

And even though the. That right now they're going around the moon, but it does like 20 250,000 miles away. Yeah, but what's.

[Wade]

What's the ping on that?

[Corey Ham]

So the delay is. It's two and a half seconds, actually.

[Wade]

Oh, God.

[Ralph]

That's the full round. 250.

[Corey Ham]

Yeah, well, no, no, that's. That'd be 250 million.

[Ralph]

Or is that 2500?

[Corey Ham]

Yeah, it's like 2500. Yes.

[Wade]

They're definitely not winning any CSGO games.

[Corey Ham]

Yeah.

[Ralph]

So are they just pinging 8.8.8.8 the whole mission and if it goes down, the rocket blows up. Like, what's the.

[Corey Ham]

The other fun tech thing? This particular mission is that they had iPhones approved to use on the space mission to only take photos. So to take photos, like out the window. And like on the mission, they had iPhone 17s just for that, which Apple was not involved with in any way, but they did have to get them approved for the mission, which goes through a lot of different processes, including, like, about the glass breaking and all this other, like, silly things, you know. But yeah, just.

[Wade]

Just imagine if one of them smuggled in one of those travel routers and

[Corey Ham]

then broadcasted their own house.

[Ralph]

Yeah, that' the most. When I'm looking to. When I'm looking to buy a phone, that's my number one thing is like, can I take this into space with people doing that a lot?

[Corey Ham]

Officially, yes. Yes.

[Bronwyn]

I have a feeling they're. They're doing the voiceover IP thing though.

[Ralph]

If they were to make a call.

[Jennifer]

Yes.

[Ralph]

So.

[Corey Ham]

All right, so for. For the nerdy. For the nerd style, the over. The laser communication system that they have set up, it is essentially ethernet. Right. So it's all IP based is how they do all the comms there. They have the radio network as a backup and that radio network uses the standard constellation they have of actual, like satellites to. To coms back. So.

[Doc]

Yeah.

[Ralph]

Yeah. I mean, the, the joke I think we can end with, unless other people have hot takes on this, is that the only reason I would want to leave Earth is to leave outlook behind. I Don't want to leave Earth. If I have to take Outlook with me, I'm not leaving Earth. I'm just going to stay.

[Doc]

Yes.

[Jennifer]

My hot take was earlier when somebody asked in the tech setup if Artemis had fixed the Microsoft issue. And I completely forgot about the Outlook issue because the last thing I heard was that the Artemis toilets were broken again.

[Corey Ham]

Yes.

[Jennifer]

And my first reaction, they were trying

[Ralph]

to open a help ticket. My toilet's broken, but I can't open a help ticket.

[Jennifer]

But in my head I was like, yeah, if anybody was going to run a toilet off of Windows, it would be the government.

[Doc]

Yes.

[Ralph]

Yeah, that's.

[Bronwyn]

This is all science geeks. You'd think that they would use Linux for important systems.

[Ralph]

No, Linux is important.

[Jennifer]

Is their toilet not Linux.

[Ralph]

Oh, sorry, the toilet's running a Raspberry PI. And that. Yeah, that's a whole different. That broke for a different reason. There was lots of toilet issues.

[Corey Ham]

It's kind of funny because this is the first mission with a toilet. So now it becomes a whole fun thing.

[Jennifer]

Yeah.

[Ralph]

Does it have a bidet? If it doesn't have a bidet, I'm not going either.

[Corey Ham]

I don't know if you want a bidet in zero gravity.

[Wade]

A bidet. That's a good point. Bidets have made me weak. I feel like after you have a bidet, you cannot not your life changes.

[Jennifer]

Right?

[Doc]

Yeah.

[Ralph]

All right.

[Jennifer]

One of the selling points for my house was that it came with the heated bidet.

[Ralph]

Oh, you gotta. You gotta do it. It's. You bought the house for the bidet.

[Wade]

I'm not that rich.

[Jennifer]

Well, there was other. Okay, well, there was other reasons. I had asked them. I'd asked the realtor. I said that I like haunted in old houses, but nobody in my family would move into it with me. So if she could find me a house that made it look like it was just a little bit haunted. And this was the house that she found me. And it does look like it's a little bit haunted. And it had the heated bidets. So that was when we were tied between two houses.

[Bronwyn]

One of the things that was a deal breaker.

[Ralph]

Some of the best jokes from the discord that I'm gonna Shecky. I think one which he, he, he posted. Can't have open windows in space.

[Corey Ham]

That's good. Yeah. Yeah.

[Ralph]

All right, so next article, while we're just pooping on Microsoft with our toilets that don't work will be the article where someone noticed in the terms of service for copilot, that it says that it's for entertainment purposes only. I will say I do want to take this one with a healthy dose of skepticism because this was only in the license or TOS for copilot for individuals, so not the work stuff that we all use if we're Microsoft Shop. And also they're claiming that it was just legacy language and they're taking it out and that it's not really the case, but it is hilarious and we should talk about it because the concept of, on one hand, marketing your tool as this could do all your spreadsheets and figure out how much you owe in taxes. And also it's for entertainment purposes only. Do not use for anything. You know, check important results.

[Bronwyn]

Sorry, this reminds me too much of certain news services that claim to be for entertainment purposes only.

[Corey Ham]

Oh, yeah, right.

[Bronwyn]

Thanks.

[Ralph]

That's it. By the way, this podcast is actually for entertainment purposes only.

[Jennifer]

Yes,

[Corey Ham]

that's a, that's a good.

[Bronwyn]

We're very entertaining and we don't make any, any bones about it.

[Doc]

I don't know.

[Ralph]

We can't make Miyazaki pooping on a bidet in space AI art, though.

[Wade]

We've definitely poisoned some models with this, right? Like, there's definitely some data out there where it's just like, growing around in circles, isn't there? I'm pretty sure there was some news article about that too, so.

[Corey Ham]

But I saw somebody.

[Doc]

I think this is a case of Co pilot's terms and service was written by Co Pilot.

[Ralph]

Yeah. Yeah, probably you need to cover your ass, Co Pilot. Make us a terms of service, please.

[Corey Ham]

I saw a post on LinkedIn about, about AI. If it's like, really AI. Because if, like, if it was AI, it could think for itself. And like, essentially the, and this is, by the way, this is clickbait. I just let you know that AI is not real and that it's just a really good autocomplete, right? And like, the foundations of that are in what this copilot thing is saying is that, like, is AI just, like, really good at giving us kind of what we want, or is it actually thinking, right? Like, is it, is it, you know, going down that path and, you know, and then when the problem with it, though, is that when it can think and do everything that you're saying, it can't. Maybe I'm scared at that point. Like, maybe like, I, I, I waited too long, you know?

[Ralph]

So, dude, last week I got a little snippy with Claude, and after I was done, because it kept gaslighting me and I was like, claude, stop. Gaslighting me. You put this in there. And it was like, after it was done, I was like, please don't kill me. And it said, no promises. You're first on the list. So.

[Bronwyn]

Wow.

[Ralph]

It's nice knowing you guys. Just saying, man, I have never had

[Bronwyn]

an LLM threaten me.

[Ralph]

I know it directly threatened.

[Jennifer]

This is Rocco's basilisk, right?

[Ralph]

Oh, God.

[Jennifer]

Yeah. Anybody?

[Ralph]

We're all screwed. Yeah, it's fine.

[Jennifer]

I probably just ruined some people's lives. They're going to overthink that. But the idea is that in the future, when we all have like a real AI overlord, it's going to figure out how time travel exists and retroactively punish everybody who did not directly support its existence.

[Wade]

Oh, that's.

[Ralph]

Well, if I'm not actively suffering right now, maybe that's why I'm suffering, because

[Jennifer]

I always say please and thank you to my AIs.

[Wade]

My.

[Ralph]

That's not enough. That's not enough. You got to be buying GPUs and sending them straight to the server farms.

[Wade]

Any robot that does anything, like my 3D printer, the vacuum or anything, my son says thank you to it.

[Corey Ham]

Yeah. Oh my gosh.

[Jennifer]

I treat them all with compassion because I don't know if they're actually the Chinese spy or.

[Ralph]

Yeah, either way, even if it's. It's kind of like being nice in real life, even if the other person's a jerk, it's still probably worth it to be nice to them.

[Jennifer]

Yes.

[Ralph]

So, all right, so speaking of AI. Oh, go ahead.

[Corey Ham]

Oh, no, this was one they were probably going to talk about anyways. But speaking of AI, could we talk about the. The cloud code leak? Do we?

[Ralph]

Yes, that was my next. That was where I was going with that.

[Corey Ham]

Go ahead.

[Ralph]

Yeah. So again, right after we ended the show, because every time we end the show, news articles, they get generated and so right after we ended the show, the source code for Claude code leaked. It leaked due to a developer misconfiguring or accidentally publishing in a developer oriented file into the repo. So basically there was, I'm not like super in depth technical. They accidentally bundle bundled the typescript map file, which had a link to the original source code which you could download off of their anthropics cloud. So people obviously did. And there was a lot of hot takes from this. I think the. You know, Ryan's got one up right now. This is a guy that did some interesting analysis of just some of the vibe coding that was taking place. Like some pretty crazy stuff that like makes sense, but also makes no sense. And there's a lot of just spaghetti code and crazy things that it was doing.

[Bronwyn]

You're talking about the Mercor breach, right?

[Ralph]

No, we're talking about Claude code. Source code.

[Bronwyn]

Okay, all right then this is a lot like the Mercor breach which supposedly pulled source code from multiple LLM providers.

[Ralph]

Yeah, I don't know. But let's keep rolling on the cloud code.

[Bronwyn]

Keep rolling, keep rolling with.

[Ralph]

There's an interesting ARS article that I just linked that basically shows some of the, you know, there's some funny stuff. There's also some, you know, half baked or unpublished features like a demon, like a kind of like a claw, open claw type of setup where it has like agents and wait for task and stuff like that. Yeah. As you'd expect, a lot of it is by or is like AI prompts and things that like we would configure ourselves if we were building a custom version of this. You know, like the. Some of the stuff like Auto Dream, which is basically a function where Claude code after, when you're not doing something, it would go through all of its memories and like clean them up and remove other stuff. Just like your actual brain does when you're dreaming. There's some other like potential unreleased features. But my whole like, you know, I, I guess Ralph, you can dig into what you thought was interesting, but why isn't this open source? Like at this point it is nowadays.

[Corey Ham]

I'll double down on the open source part. So a lot of people cloned the code into a repo and then GitHub had to go essentially, well, anthropic scrub it. Yeah, cease and desist or essentially like trademark. And so they had to scrub all of it but then they were scrubbing like too much of it. Like just people's repos that had nothing to do with it but just had like clone something related or something. So yeah, it all got removed. I mean I kind of agree with you, Corey. Like should it just be open source? But then the other side is that, you know, Anthropic is trying to derive differentiation between their model and what Claude code can do or what cowork can do and other things like that. So I can kind of see why they don't necessarily want it to be open source. But the value of it being open source is probably higher than keeping some secret, you know, sauce.

[Ralph]

I feel like at the very least there should be an open source version version. Like there should be like LM Studio or open like one of the, like someone anthropic should make an Open source version that is like above board and then they can have their fancy auto Dream features in their own private version.

[Corey Ham]

Yeah, it's definitely.

[Jennifer]

I was just thinking about the implications of letting AI Vibe coding create more AI and AI features and I'm like, oh, we're letting AI develop itself?

[Wade]

Oh, no.

[Ralph]

Oh, you know about Moltbrook, right?

[Corey Ham]

I'm just saying, I'm telling you that both Anthropic and OpenAI have been crystal clear about the fact that they are having their agents develop the code. They are not hiding this in any way, shape or form. And you should not be surprised when you see Vibe coded stuff from their project.

[Jennifer]

Oh, I'm not surprised. I'm just thinking about this in relation to. Yeah, what a time to be alive.

[Corey Ham]

Yeah, right.

[Ralph]

I think, I think the most interesting part of this, like, from my perspective, is how does CLAUDE desktop or CLAUDE code not just use all my CPU and RAM all the time? Honestly, like, like, it's. Actually, I've used it a lot and I've used it on machines that are, you know, like, I have a 2020 MacBook Air that has like the base spec and it's fine. It does everything fine. So, like, despite the Vibe coding, it still manages to chunk along just fine. I don't know if anyone's had any issues running it, but yeah, there's some, there's some pretty funny, like little, you know, that, that link that Ryan was sharing first, if you're a developer, is worth reading. Basically a developer deep dived into some of the functions that they were using for like as an example, this one is a. You're going to want to click on the second link, the one that says. So the reason that Claude code. Sorry, one second. Bear with us. The, the. The one that has 16116. Yeah, that one. So if you're a developer, this is a pretty funny little tidbit for you. So the only reason that CLAUDE code is capable of outputting valid JSON is because if the text prompt suggests it should be JSON, that it enters a special loop in the main engine that just validates against the JSON schema and then feeds the data back and with the error into itself in a loop until it is valid JSON.

[Bronwyn]

I'm actually seeing a lot of reports about how Basically the, the LLMs are working inefficiently. So basically every time you, you say something in a, in a conversation, it has to reread all of the. The previous conversation.

[Wade]

Yeah.

[Bronwyn]

And so I'm starting to see more posts with people expressing tactics to lower the load and especially, like, frequently recreate a. You know, start a new conversation, have the LLM summarize the existing conversation, and then that's how you start the new one. And, you know, there are. There are other things like that. It just.

[Ralph]

Yeah, I mean, that's also what Turboquant aims to do as well. That's like Google's research paper is like, which I don't think we really talked about. About, but essentially it's a way of compressing key values and things in AI memory. Nothing actually uses it yet, but it's a research thing that just got published where, yes, the amount of data that AI is processing is absurd. And anything we can do to speed it up is going to make, you know, huge improvements.

[Wade]

Have you seen. So talking about that, someone sent me this project. It's where you have Claude talk like a caveman. Since it uses less words, less tokens,

[Ralph]

does it code like a caveman too?

[Wade]

Yeah, but so like, instead of like, going, sure, Happy, help you with that, and then go. And it goes bug in auth middleware token expiry check use. Not Right. Basically, it's. I read it. I was like, this is hilarious.

[Jennifer]

I was gonna say, by the way, that whole, like, just recursively check it until it works. I'm not a developer. My background is not in development. Actually, all of the coding I've learned has been from, like, reverse engineering malware. So that's something weird I would probably end up doing just on my own without the help of AI because you're

[Ralph]

saying, make your own caveman library.

[Jennifer]

And, like, I would just break everything. Don't trust me to code things.

[Ralph]

Don't worry, we're all coders now that there's Claude code.

[Bronwyn]

When I was teaching people how to do local LLMs, one of the first things I had them do is teach an LLM how to talk like Daffy Duck.

[Jennifer]

I have no idea how. Oh, my.

[Corey Ham]

Oh, what a time to be alive.

[Bronwyn]

So let's.

[Ralph]

Yeah, let's. Let's dip into this article that Bronwyn brought up when we were discussing the last one. Mercor. Mersour. I don't know how to say that, but probably Mercor. They were breached, you said, Bronwyn, what happened?

[Bronwyn]

Yeah. So in addition to other victims of. What is it? Team pcp. So in addition to all of the other known victims, we also have this company called Mercor. Most people have probably never heard of it, but Mercor is very heavily invested in anything Silicon Valley and a lot of LLMs, they're called in the next web article, a critical Juncture of the AI economy. And they have handled and touched, oh, all kinds of data from engineers, lawyers, including other companies like Meta, OpenAI and Anthropic and Google. And so in addition to the other breach, just for Claude, we have this one as well.

[Ralph]

And it's the supply same supply chain attack that started from Trivia and then affected Light LLM looks like.

[Bronwyn]

Yeah. So this is, this is part of the continuing fallout from Team pcp. And in this case it directly impacts not one, but pretty much all of the dominant frontier LLM models.

[Ralph]

So how would this actually impact them? Like what is it? It's not a technical thing, right? It's like a funding.

[Bronwyn]

Well, yes, it's that it isn't just the data. The data that was accessed included detailed information on how the different models were trained. So the. One of the things that all of the different frontier providers are doing is they're trying to keep the secret sauce of how it is that they are training their individual models and what it is they're doing. And that's part of the data that was exfiltrated.

[Ralph]

So what you're saying is Anthropic is basically open source at this point. They had their cloud desktop source code leaked and they had their model training data and source and processes leaks. So basically.

[Bronwyn]

And the other ones are behind and. And Meta is also. I mean, they're being liberated.

[Jennifer]

They should just stop resisting.

[Ralph]

Stop resisting. You are being open sourced.

[Bronwyn]

Yeah, resistance is futile.

[Corey Ham]

They, they produce training data for these AI models. So this would be like they hire

[Ralph]

a guy to take a picture of a hot dog and then say whether it's a hot dog.

[Corey Ham]

Engineers, lawyers, doctors, bankers, journalists, whatever. To produce high quality content and proprietary training data for AI labs. All right, that's right from the article. But essentially they're like right in the middle between like feeding the machine to build the model and them getting exposed. According to this article. Exposes how the models are, how the sausage is made, right?

[Bronwyn]

Yep.

[Doc]

Huh.

[Ralph]

Which is actually one of the more closely protected secrets in AI. We can all see the output, but the training data.

[Corey Ham]

Yeah.

[Ralph]

How we got relatively safe so far, but yeah, I guess we'll see who took the data and what they're planning to do with it. Stay tuned to this show to find out.

[Corey Ham]

Yikes.

[Jennifer]

My hope is that they use it to create a real open source AI and then we'll see what happens.

[Corey Ham]

We have open source AIs though.

[Ralph]

We have Deep Seek at home. It's the same.

[Corey Ham]

It's not as good. I mean, just don't talk about China, you'll be fine.

[Ralph]

Oh, let's talk about the mobile phone hacking tool. This is a Schneier. Schneier. Schneier. I don't really know how to assume. Schneier Nair on security. I don't know why. That just broke my brain to read Brucey boy. It's okay. No, it's fine.

[Bronwyn]

You can judge me.

[Ralph]

That's part of the show.

[Jennifer]

Simple Words earlier either.

[Ralph]

Ooh, so words is. Listen. English is stolen. English stole all of its words from other languages and I don't speak any of those other languages either.

[Jennifer]

So differently.

[Ralph]

It's not my fault.

[Jennifer]

Wearing a trench coat.

[Ralph]

Yes, exactly. So this is a Schneider on Security article about a Google Threat intelligence post that happened on March 3rd, but he basically is kind of extrapolating it. So the tool was called Karuna, not Corona Karuna and it's assumed to be a US government developed mobile hacking tool. There are some interesting comments on the post that are. Basically this is affecting iOS 13 through 17, which is released between November or, sorry, September 2019 and December 2023. So this is kind of like an old news type of thing. Unless you're running super old phone. You know, someone in the comments says upgrade or die. Which is very true. The other interesting kind of tidbit from this is it ties into our other articles because it was exploiting JavaScript frameworks. So that was, that was the exploit that it was built by Trenchant. Trenchant. I don't know how to say it, but they're a government contractor who does a lot of this shady, you know, mobile exploitation type stuff. So I guess if Trenchant, if you're, if you're using a phone that still runs these outdated versions of iOS, you should probably get rid of it because people are talking about how easy it is to exploit.

[Jennifer]

So me and my Android agree I should update to a phone that's not using.

[Ralph]

Well, just so you know, one problem with Android is you cannot take it into space to use the space bidet.

[Corey Ham]

Yes, it's not approved.

[Ralph]

It's not approved. So. So all of those somehow outlooks on you.

[Jennifer]

The idea of blasting off into space terrifies me. You know how.

[Bronwyn]

Oh man, you give me a one way ticket off this rock.

[Jennifer]

I would. Okay, hold on. I have asked multiple times how much I have to pay NASA just to launch me into the sun.

[Ralph]

It will be very expensive.

[Jennifer]

I listen, I will do. I will. If you need Me to sponsor you or if you want to do like a sponsor for me, NASA, where, you know, you get public publicity for launching me to the sun. I'm here for it.

[Corey Ham]

Bad publicity.

[Jennifer]

Hey, no, there's no such thing as bad publicity.

[Corey Ham]

Oh yeah, Never miss a train.

[Bronwyn]

There is and there is.

[Jennifer]

Yeah, exactly. NASA hit me up.

[Ralph]

So on the. On the topic of launching things into the sun, there was also data breach that affected the FBI. I don't really know exactly how much or what was disclosed, but the FBI has self labeled this breach a major incident, which means they actually had to notify Congress. This happened on Friday. Basically they. The quote is we identified anomalous activity on an unclassified network and of course we, you know, eliminated the insulin incident. Apparently it affected their surveillance stuff. Of course they're tying it to China. I don't really know exactly, you know, what information it says. Pen register and trap and trace devices which are used to monitor incoming and outgoing calls from a phone and PII from subjects of FBI investigations. So potentially China. But also could be anyone. Not clear whether this is affected, whether this is related to the supply chain stuff or. We don't have any real information. But it is notable that the FBI was like, hey, we got breached.

[Wade]

What if it was a pivot from someone's personal email being hacked?

[Ralph]

Could be. Could be a supply chain thing too. Who knows?

[Wade]

If you remember that other article, I won't say.

[Corey Ham]

But yes, someone's personal email got hacked.

[Jennifer]

It happens. Probably.

[Corey Ham]

Yeah.

[Ralph]

The key is to just not use email. We've covered this multiple times on the show already.

[Jennifer]

RDP guys.

[Ralph]

Yes, RDP directly into the webmail server, preferably running squirrel mail because that's super secure.

[Jennifer]

Yeah, I was actually just thinking that you know what would be a really good idea? We just all go back to snail mail. Because you know who has like a hundred percent prosecution rate for crimes?

[Wade]

Japan.

[Ralph]

Snails.

[Jennifer]

No, actually, I mean, probably. I don't know. The United States Postal Inspector's office.

[Ralph]

We talking usb?

[Jennifer]

Yeah, they.

[Wade]

They're gnarly.

[Jennifer]

If they show up. If they show up to your house on an invest, you're done.

[Corey Ham]

Like you're done. Statistically, they always win.

[Ralph]

Yeah, well, they have an army of delivery people to go and like do their bidding for them.

[Corey Ham]

I said they watch you every day.

[Ralph]

They know where I live. They know they're ready.

[Bronwyn]

Yeah, because like, hey, they can find my house.

[Ralph]

Oh my goodness, that thing. We're screwed. If they can figure out where Bronwyn lives, we're totally screwed. Yeah, I think you know, unless anyone has any other fancy articles. I do think we should talk about this other Google threat intelligence posts that happen on April 2nd.

[Wade]

I'm gonna say the Border Patrol one's pretty good.

[Ralph]

The Border Patrol one, yeah, let's come back to that as like a fun happy hour because it's super fun. All right, so this is a thing that I think a lot of my clients would be very interested in. A lot of just general companies. So brickstorm is basically malware that is designed to affect and infect the VMware vSphere ecosystem, which as much as Ralph and me are like, don't use it, use Proxmox. A lot of companies are still very dependent on VSphere.

[Corey Ham]

They're trying to get away, Corey.

[Ralph]

They're trying. They're trying to get away. I mean we actually talked about on this show there are lawsuits because of how hard it is to get away from it. But essentially this is a really nice Threat intel post that just explains how to. There's some really crazy techniques they're using in brickstorm, which this is like a ransom tactic, but it's really cool things like ghost VMs and fancy, you know, socks proxies and JSP web shells and basically like, you know how you can't put EDR on your vsphere environment? Well, here's a reason why you wish you could. I love this.

[Jennifer]

This is.

[Ralph]

Yeah, I mean it's a cool write up.

[Jennifer]

Awful, but you know what I mean.

[Ralph]

Yeah, it's a cool write up. I definitely. They also very nicely released vcenter hardening script that you can run to self. Dos. No, I'm just kidding. I don't know what it does, but it basically, you know, enforces some of the security configurations directly on the Proton or Photon Linux, which is what VMware products run. It's like a special cut down version of Linux. And so if you're afraid to operate in that environment, which is totally fair because my personal experience with ESX was trying to move VM and just deleting my entire disk, like just messing up a partition table. So like basically these systems are high priority in most commercial environments. And this script, you know, provided by Mandiant definitely will help to lock things down and set some basic. So they have hardening controls on VMware stuff.

[Jennifer]

They have government had that ESXI experience, by the way.

[Corey Ham]

Yeah, they have government Stigs. Right. So you were just looking at that. They have stigs because the US government uses VMware so there is hardening guides by. By CISA, I believe is who.

[Ralph]

Yeah, but this is just a script, Ralph. I don't. I guides, dude.

[Bronwyn]

I.

[Ralph]

That. That implies that I have to read it and understand what it does instead of just running a script.

[Corey Ham]

For sure. Yeah.

[Ralph]

Really, it's.

[Wade]

I was gonna say it's semi weird that like, like this is looking way back, right? When VMware owned everything in carbon black at the time, and I just never made it to V. Like, that would have been a great evolution of the product. And then is in anyone else getting real Pepe Silva vibes from the. The map? Scroll down.

[Ralph]

I don't know. It could be worse. I've seen worse. It. It does have.

[Wade]

It's definitely not that bad, but it's

[Ralph]

like they, they could have. They could have used less curvy arrows. I feel like it. The spaghetti vibes are strong.

[Doc]

You.

[Ralph]

You could have used like right angle arrows and it would have been a little bit.

[Jennifer]

It makes it feel like it's just way more like free flow and like the freeform.

[Ralph]

It's all pretty simple. It's just really cool to see all of these different things tied together. Right. Like the concept of a JSP web shell is pretty simple, but when you're talking about running it in a VMware vSphere environment, it becomes cool and scary.

[Jennifer]

Well, yeah, sorry, I was just thinking of hacks. I'm done.

[Corey Ham]

There's so much Java in VMware as well. Like, it's wild. That product started off really simple too, right. It was a hypervisor and then it kept expanding. More Java, more Java, more Java and like controllers and managers and all this other stuff and they kept building on top of it. They. I mean, you know, by the time, what do you call it, Broadcom bought them, there was like a huge library of different software that you could run with the VMware stack and suite and stuff, right. And all of that software induces complexity. And when finally threat actors started, you know, getting onto these devices and realizing that this was, you know, a great attack vector. Yeah, I mean, totally.

[Ralph]

I think this is part of a broader trend in security, which is threat actors trying to find devices that aren't running EDR or don't have good monitoring on them, right? Like the, the fact that they got a go binary running on vSphere just shows you how desperate they were. Like they were so desperate for something to use to, you know, get a SOX proxy. Like, they were like, we need C2. Let's just beacon the vSphere servers, I guess.

[Corey Ham]

No you make a great point though, Corey, is that you're just going for the least protected asset, even if that requires more effort in the beginning. Because once you do develop that tool, then it feels like, you know, shooting fish in a barrel, Right? Like there's just nobody's watching anymore. And now you can move with impurity. Impunity.

[Ralph]

Yes. And you can crypto lock people, right?

[Corey Ham]

Yes, exactly.

[Wade]

It's the same thing as going after network equipment, right?

[Ralph]

Yes.

[Corey Ham]

Right.

[Ralph]

Totally. All right, Wade, take us into this Border Patrol article you were talking about.

[Wade]

All right, so over the weekend, some secrets were leaked for the Border Patrol, which required them to start changing all password and door codes at almost. I think it was. I didn't. Don't remember the exact number of facilities.

[Corey Ham]

But it was used the same door code and all.

[Wade]

No, no, they didn't. Surprising. They probably the person who put all the door codes into Quizlet probably wouldn't have need to put all the door codes into Quizlet if they. If it would have been. So was it.

[Bronwyn]

What.

[Ralph]

What is happening?

[Doc]

Where is it?

[Jennifer]

I'm not surprised to hear that, though, because I have seen some wild things.

[Doc]

Now.

[Wade]

I lost the article. I wasn't ready.

[Doc]

Here you go.

[Wade]

Okay, here it is. It's in Wired, and I'm not logged into Wired, so I guess you gotta pay.

[Ralph]

You're not. You're. You're wireless?

[Wade]

No, I actually have a Wired account. I. I'm actually.

[Ralph]

You're wireless.

[Wade]

A few things.

[Ralph]

I'm gonna keep making this joke until anyone laughs.

[Corey Ham]

Deep level ad blocker.

[Wade]

Deep level ad blocker. No, just Ralph has taught me well to get past pay walls. Let's just say that.

[Ralph]

So, okay, so.

[Wade]

So if you don't know what Quizlet is, Quizlet is like a flashcard app where all your flashcards are online. Like, if I ever have a mentee, okay, studying for security plus, I will send them to Quizlet and say, hey, go look for other. Wait, just steal other people's stuff. Why do your own?

[Corey Ham]

Are you telling me that they put the codes for the doors on Quizlet?

[Wade]

They put a bunch of stuff, dude.

[Ralph]

Okay, listen. They're recruiting a lot of people. They, you know, not to get too political, but they. They probably aren't recruiting the best and brightest out there. And so, you know, like, they held

[Corey Ham]

guns to their head and be like, tell me the code.

[Ralph]

Pop quiz, idiot. What's the code?

[Wade]

I guarantee you. I guarantee you, like, the Ray got on there. Someone had quizlet on their pH. Right? And they're just going over Slides on their phone when, like anytime they're in line, they're stuck in traffic and next thing you know, oh, someone picks them up. And now if you just want to cross the border, I can tell you the password if you tell me the mile marker. So.

[Corey Ham]

Wow.

[Ralph]

Yikes.

[Wade]

It's a pretty good one. It was a. It was a. Definitely. I'm surprised they weren't on War Thunder or something.

[Doc]

Okay.

[Jennifer]

The War Thunder leaks just. I will never not be in love with.

[Wade]

Oh, that's our favorite. It's our favorite threat actor.

[Ralph]

We have like a special, we have a special celebration every time military secrets get leaked on War Thunder forums.

[Wade]

It's like we should name that threat actor.

[Ralph]

It's the same. It's the same thing as when there's a CVE with a 10 severity. It's the same. It's like we, you know, we convene the council of the, you know, the tens or whatever and we have a good time.

[Jennifer]

Hold on, let me ask AI, what's

[Wade]

the name classify the War Thunder threat actor?

[Ralph]

Thunder sec, obviously Thunder Second.

[Wade]

That was good.

[Ralph]

So I don't think there's any chicken articles. Does anyone else have any articles they want to cover personally that are relevant to them? Doc, you got any articles? What's, what's in your news radar? Do you have any? Do you follow the news? What are your vibes?

[Doc]

Oh, like I said, I have no idea what's going on in the news. So I was just doing reactions and so, you know, I was just over here raising my eyebrows and stuff because I figured that's what was my job.

[Ralph]

You were doing a great job when

[Doc]

it comes to reacting to your guys articles. I learned that we need to have separation between dev and prod and that anything that can be copied will be copied. And then I was wondering, do astronauts need to keep their phone in space shuttle mode? And I was taking a drink every time somebody said JavaScript and so now I'm drunk. AF.

[Corey Ham]

Yeah, I do have an answer for you. They disabled the ability for it to use any networking. It can only take photos. So it is in space mode.

[Doc]

Yeah.

[Ralph]

Explain how can I do this on the weekends?

[Doc]

Ralph, is there some way that you can turn off a feature on Apple phones that they don't turn back on?

[Corey Ham]

Yeah, Yeah, I guess so. I. They figured it out. It's NASA for God's sake.

[Ralph]

Figured it out. What you do is you take a drill. Okay, I would, I would love to know a little bit more details like, you know, how they, you know, whether they Actually did disable anything in hardware. Whether it's all software. Was it mdm? You know, also there isn't really the most important is. Is there a little logo that changes the airplane mode to a space shuttle? That's really what we need.

[Corey Ham]

Oh my God.

[Ralph]

The people need to know Doc has put this out into the universe and we need like, we need to somehow find this out.

[Bronwyn]

Inquiring minds.

[Doc]

Absolutely. We'll just send it to the national labs because you know, they can. They can make the impossible trivial and the trivial impossible. So they'll figure it out.

[Wade]

Does the GPS work?

[Corey Ham]

That's what does the GPS work?

[Ralph]

I'm guessing it does not work.

[Jennifer]

No, because.

[Ralph]

Because it's beyond the satellites. Yeah, it's beyond the rain.

[Wade]

They got. They got satellites around the moon. If you got Google Maps on the moon, you can like go there like. So why couldn't we put setup gps? Moon gps.

[Ralph]

They don't have GPS satellites. It would be. No one's on the movie around.

[Wade]

Yeah, it's supposed to be.

[Ralph]

It's called Global what it should be. That would be UPS Universal system. China's working on it.

[Corey Ham]

Right now they're going behind the dark side of the moon, right? And during that time, I think it's about 45 minutes.

[Wade]

They can't. They can't go there. That's where the Decepticons are. So we can't.

[Ralph]

Listen, Pink Floyd says there is, there is. That's just the rules.

[Corey Ham]

It's dark because there's no sun there. Okay. Anyways, they're going around, but there's no communication because the moon gets in the way of the lasers and the radio.

[Ralph]

So that's why we're working on blowing up the moon soon.

[Corey Ham]

Exactly. So they are going to be putting a communication satellite around the moon so that they can communicate.

[Wade]

Mps, here we come.

[Ralph]

What is that? Multi planetary positioning.

[Wade]

No positioning. Moon positioning.

[Ralph]

It's only for the moon. Why would we just.

[Wade]

All right, you want like Luna positioning system lps. That's another good.

[Corey Ham]

Yeah, man.

[Ralph]

All right, I think we broke Jennifer. Okay, so real quick before we close, Doc, can you plug your stuff one more time? When, when is your webcast? This week. Basically two days from now, right? Something like that, yeah.

[Doc]

So here's the weird thing is I'm. I'm plugging something that's plugging something else. We are going to have a four hour workshop on the how to think like a cyber defender. And this is an important discussion, especially for those that are new to cybersecurity. Where we're filling in the gaps between understanding how tools work and what we're actually doing in our organizations. And that segues into the anticast that I'll be doing on Wednesday. And so if we could put that link up one more time. There it is. All right. There's a younger, less heritage version of me there trivia for you guys here. It's just a little fun fact. Well, it's not so much fun as it is a fact. I haven't seen the inside of a barber shop for a year now. And that's why I look like this. And not because I meant to. It's because I was tired of the same old haircut and didn't know what to do with it. So what's the default when you don't know what to do is you do nothing. Right. And so that's.

[Ralph]

I can't relate. I. I can't relate at all.

[Doc]

Yeah, right, right, right.

[Jennifer]

I'm a fan. Longer hair.

[Doc]

What's that?

[Jennifer]

I said I'm a fan of the longer hair.

[Doc]

Yeah, I, I was like, I've never had it this long before. I'm, I'm, I'm, I am at my age. I'm happy that I can still do this.

[Wade]

Right.

[Ralph]

Yeah. Use it or lose it, baby. I'm a huge fan.

[Doc]

I'm happy about that. So. But the one hour anticast on Wednesday is the 14 absolute truths of cybersecurity. And I'll give you the punchline now security isn't even what we do. For those who had attended Wild West Hacking Fest, what, San Diego, three years ago now, I did a presentation there that security isn't what you do. And the premise behind it, the thinking behind it, is all around the 14 absolute inescapable truth of cybersecurity. And at the core is the fact that security isn't our jobs. Even though we've got security in our job title, we think. Think that it is. And I don't know. Bronwyn, are you prepared to disclose something you and I have been working on?

[Bronwyn]

Your discretion or the lack thereof.

[Wade]

Do you want to.

[Doc]

Bronwyn and I, along with Mark Williams, are writing a book. And the book's working title is security isn't what you do. And it's all based off of the concept that we were never meant to secure the organization that we work for because the organization doesn't exist to be secured. So what is it that we're actually doing if we're not there to secure the organization? I'm not going to answer that here you're going to have to show up on Wednesday.

[Ralph]

Wow.

[Doc]

That's the best I can do for a cliffhanger.

[Ralph]

That's a pretty good plug, I got to say, when this got announced internally, everyone was like, what could this possibly be? What are the truths? Everyone was coming up with their own crazy ideas. So know it's exciting.

[Bronwyn]

It's probably not. You think it is.

[Wade]

Is it a list, right?

[Doc]

It is a list. Cheddar. Got it right on. On the. The discord there. I'm not the author. Keith Pomgren is the author. And Keith Pomgren I consider to be a friend and a mentor of mine. He has since retired, and I, with his permission and his knowledge and consent, I picked up the torch and am carrying that forward. And so. And absolutely there'll be. There'll be a picture of Keith Palmgren in the presentation dressed as Batman. So you guys are gonna have to show up for that.

[Ralph]

All right, well, that's like, as. That's the best, like, coming soon I've ever seen. So good luck following that up, Jennifer. But I know.

[Jennifer]

I was just thinking, like, I have to redo all of my pictures moving forward. It's too late for this one. I can't. My brain gotta reconnect to the WI fi before I can think of something that good.

[Ralph]

To learn how to cut your own bangs. Go to Jennifer's webcast.

[Jennifer]

It's real easy.

[Wade]

The Internet does not say so that

[Jennifer]

it looks good was easy. Things that are easy to do and things that are easy to do well are two completely different things.

[Wade]

Okay, okay, okay.

[Jennifer]

Haircutting is not. Is. I find very frequently it's easy to do, not easy to do.

[Ralph]

Well, I've seen worse.

[Jennifer]

Well, my hair is just all. It's been a weird. It's been a long week.

[Bronwyn]

It's only Monday.

[Jennifer]

Rearranging a dental surgery from earlier this morning to tomorrow morning and then taking my dog to a vet. So that way instead, I could go to a doctor's appointment later in the week.

[Ralph]

Yeah, it's API testing. Always, always important. APIs are. Especially now in the world of AI. I mean, everything's an API now, right? Like, it's like everything is an API. I'm an API, so testing them is a must. All right. Well, unless there's no chicken articles. I'm sorry if you showed up hoping for chicken articles, but someone did post

[Bronwyn]

a chicken article in Discord.

[Ralph]

Really?

[Bronwyn]

Was it.

[Ralph]

Hold on.

[Bronwyn]

Scrolling up, scrolling up.

[Ralph]

Getting fished. Getting fished.

[Bronwyn]

Way back.

[Wade]

Why do the chickens wear reflective vests? Across the road.

[Bronwyn]

Why do they wear the reflective vest across the road?

[Ralph]

Of course.

[Wade]

Flock of chickens, which roost in Scottish bed and Breakfast, have been outfitted with reflective safety vests so they don't get tenderized by cars. Bows cross the road. Inside Edition reports. They don't want to get hit by cars.

[Ralph]

Honestly, the chickens do look pretty good, though.

[Jennifer]

It's probably an OSHO rule, right?

[Wade]

I knew a buddy of mine who had chickens in his house and he had like, actual diapers on the chickens.

[Jennifer]

Oh, my gosh. I've seen that. I love chickens. I have too many cats.

[Ralph]

I don't let dinosaurs in my house personally. But that's everyone.

[Jennifer]

Wait. I love dinosaurs.

[Ralph]

Everyone. Everyone has their own house rules.

[Jennifer]

Everybody tell me your favorite dinosaur.

[Ralph]

I have nine cats and zero dinosaurs. All right. I think that's a good as place as any to end it. Thank you all for coming. I appreciate your time. And don't let the chicken cross the road without a reflective safety vest.

[Jennifer]

Dang those chickens.

[Bronwyn]

Important safety tip.