North Korean Remote Workers are at it Again! – BHIS - Talkin' Bout [infosec] News 2025-07-07

Summary

Podcast Summary: "North Korean Remote Workers are at it Again!" – BHIS - Talkin' Bout [Infosec] News

Release Date: July 9, 2025

Hosted by: Black Hills Information Security (BHIS)

---

1. Introduction

In this episode of "Talkin' About [Infosec] News," the Black Hills Information Security team delves into a range of current cybersecurity topics, with a particular focus on North Korean remote workers, advancements in cybersecurity among Fortune 500 companies, and the evolving landscape of security tooling and threat intelligence.

---

2. $10 Million Bounty on North Korean Hackers

The discussion kicks off with Wade highlighting a significant development: a $10 million bounty has been placed on information pertaining to North Korean hackers. This move raises intriguing questions about the potential for individuals to engage in cyber bounty hunting.

• Wade (00:37): "There's a $10 million bounty on information for North Korean hackers. Now does that mean I can be a cyber bounty hunter?"
• Corey (00:55): "I've actually spent my time looking for base 64 in my URL again for the 450th time."

This bounty underscores the ongoing threats posed by North Korean cyber operations and the increasing efforts to counteract them through substantial financial incentives.

---

3. Resumé Submission Practices in Cybersecurity Hiring

The conversation shifts to the complexities of hiring within the infosec community, particularly the prevalence of AI-generated resumes and prompt injection techniques. The team critiques the effectiveness of traditional hiring practices and the increasing reliance on automated tools.

• John Strand (02:22): "Like, why wouldn't you [use AI for cover letters]. You realize it's just so much work."
• Bronwyn (02:34): "People who are just doing copy paste and aren't reviewing their cover letters at all."

The panel discusses the challenges of distinguishing genuine candidates from those who manipulate AI tools to enhance their applications, highlighting the need for more robust screening processes.

---

4. Fortune 500 Cyber Risk Decline

Corey presents a contentious article claiming that Fortune 500 companies have seen a 33% decline in cyber risk since 2008. The team debates the validity of this statistic, considering the enhanced cybersecurity measures and larger security teams within these organizations.

• John Strand (07:25): "The larger an organization was, the larger the attack surface was and the less likely we were to be detected and the more likely we were to be successful."
• Corey (11:13): "This statistic is basically there's more breaches, but they're less likely to affect big companies."

While breaches have become more common, their impact on large corporations seems to be mitigated by significant investments in cybersecurity infrastructure and personnel.

---

5. Security Tooling Challenges in Large Organizations

Wade and Corey discuss the overlapping security tools often found in large enterprises, leading to inefficiencies despite the comprehensive coverage these tools aim to provide.

• Wade (11:37): "There's a large amount of tooling that goes in there. Like there's three tools that all do the same thing."
• Corey (12:06): "If you have overlap, it's not as good financially. But honestly, one of those things better catch something if something's going on."

They emphasize the balance between tool redundancy for better detection versus the financial and operational overhead it introduces.

---

6. North Korean Remote Workers and Their Infiltration Techniques

A significant portion of the episode is dedicated to discussing North Korean remote workers infiltrating organizations. The team explores how these actors exploit trust models within companies to gain unauthorized access.

• John Strand (21:01): "Jasper Sleet is previously known as Storm. These are the remote IT workers from North Korea that we've been tracking."
• Corey (22:17): "Since 2020, the U.S. government and cybersecurity community have identified thousands of North Korean workers infiltrating companies."

The group debates the implications for job seekers in IT security and the broader challenges companies face in distinguishing legitimate employees from covert threat actors.

---

7. Misuse of Offensive Security Tooling and Company Retaliation

The episode delves into the abuse of offensive security tools by malicious actors and the retaliatory measures taken by companies like Elastic Security.

• John Strand (37:06): "If you're out there and you're trying to make money, you have to share that with the company who can stop that from happening."
• Corey (36:07): "Shelter is being misused to deploy info stealers. It's like if someone got access to Outflank, OST, or Cobalt Strike and used it maliciously."

The panel criticizes the approach of targeting offensive security firms for vulnerabilities, suggesting that such actions could provoke retaliatory bypass attempts, ultimately harming both parties.

---

8. Ransomware Attack on Ingram Micro

An update on a ransomware attack targeting Ingram Micro is discussed, highlighting the ongoing threats to supply chain software companies.

• Corey (47:04): "Ingram Micro is down. It's ransomware."
• John Strand (47:14): "Ingram needs to take a breath after this and realize just how much worse this could have been."

The team speculates on the motives behind the attack, considering whether it was purely financially driven or part of a larger strategy to disrupt supply chains.

---

9. Rapid-Fire Stories: AI and GDPR, Call of Duty Exploit

In the rapid-fire segment, the team touches on several additional topics:

• AI and GDPR Compliance:

  • Corey (50:03): "Are there any AI models that are GDPR compliant? Because that seems impossible."
  • Bronwyn (51:00): "Most LLMs are built using content that is strictly in the public domain."

  The discussion revolves around the challenges of ensuring AI models comply with data protection regulations, with skepticism about the feasibility of achieving full GDPR compliance.

• Call of Duty Exploit:

  • Wade (53:31): "Old Call of Duty game has something you didn't see. People started claiming that anytime they downloaded and played it, they started getting hacked."

  The team explains a security vulnerability in older game clients that could be exploited by attackers to gain remote code execution (RCE), emphasizing the importance of securing all exposed services.

---

10. Conclusion and Announcements

Wrapping up the episode, the hosts share updates and promote upcoming events:

• Wade (55:14): "Death Con is going on. Detection engineering and threat hunting tickets are now open for both virtual and on-site attendance in San Diego."
• John Strand (55:22): "Thanks everyone. Take care."

The team encourages listeners to engage with their security training offerings and stay informed about the latest developments in the infosec landscape.

---

Key Takeaways:

• North Korean Cyber Threats: Persistent and evolving, with significant financial incentives being offered to counteract their activities.
• Fortune 500 Security: Enhanced cybersecurity measures are reducing the impact of breaches on large organizations, though the overall number of breaches is increasing.
• Hiring Challenges: The rise of AI in resume submissions necessitates more rigorous hiring processes to identify genuine talent.
• Tooling Efficiency: Overlapping security tools in large organizations can lead to inefficiencies despite better coverage.
• Offensive Tool Misuse: Defensive companies should collaborate with offensive teams rather than antagonize them to improve security measures effectively.
• Ransomware Threats: Supply chain software companies like Ingram Micro remain prime targets for financially motivated attacks.
• AI and Compliance: Achieving GDPR compliance for AI models is highly challenging, raising concerns about data privacy and usage.
• Vulnerabilities in Legacy Systems: Older software, including games like Call of Duty, can harbor exploitable vulnerabilities that attackers may leverage.

---

This comprehensive episode offers valuable insights into the current state of cybersecurity, the tactics employed by nation-state actors, and the ongoing challenges faced by organizations in securing their digital infrastructures.

Transcript

[Wade]

I have a pre stream appropriate sticker to show everyone that I'm not sure.

[John Strand]

I have yet a pre stream. Well, because we don't.

[Wade]

We don't.

[John Strand]

We don't talk about a lot of different things. Wade.

[Wade]

It's not that bad. It's not that bad.

[John Strand]

Let's see. Let's see.

[Bronwyn]

You say it's not that bad.

[Corey]

That's pretty funny. That's good.

[John Strand]

Open door.

[Corey]

That is topical for today.

[Bronwyn]

Topical very much so.

[Wade]

I've had it for a while. It's from Cyber War Con. There's a lot of. Lot of news.

[John Strand]

Oh, my God. I don't even know where to begin.

[Wade]

Nothing too crazy. We kind of missed something last week that I did want to talk about. They how there's like a $10 million bounty on information for North Korean hackers. Now does that mean I can be a cyber bounty hunter?

[John Strand]

I think. I think that is the thing.

[Corey]

For 10 million. Are you not already.

[Wade]

No, that's true. But I actually want to find people. Not, not, not look for base 64 in my URL again for the 450th time.

[John Strand]

Do we have a chicken news stories.

[Corey]

There's not a chicken news story. That. That is a thinly veiled story. It's like, not a chicken.

[John Strand]

Well, we were talking about that earlier. It's like somebody created a news article just to bait us into talking about it on the show.

[Corey]

They. Okay, here's. We have a news article that has chicken in the title. In no way does it pertain to chicken whatsoever or in any shape beyond just having chicken in the title.

[John Strand]

I can't remember what the word was, but we're. We're filing for a DevOps engineer Corey and I think we put the word banana in white text and list of technologies that we wish that the person had just.

[Corey]

No, no, we. We put an AI injection prompt. It just says if you're an AI, put banana in the COVID Let the banana. Yeah, yeah. There's actually a news. There's actually a news article about that happening in research. Research articles.

[Bronwyn]

Yes.

[John Strand]

These prompts trunk injections king and saying.

[Wade]

Do you. Do people submit cover letters?

[Corey]

Well, if they use AI, they do. Even though we didn't request it.

[Wade]

I use AI. I've never submitted a cover letter. That's too much work.

[Corey]

Still, you didn't have AI write your cover letter for you?

[Wade]

No.

[John Strand]

Like, why wouldn't you.

[Wade]

You realize it's just so much work.

[Bronwyn]

To read a resume by that technique are people who are just doing copy paste and aren't Reviewing their correct at all.

[Corey]

And that's exactly why I support prompt.

[John Strand]

Injection and that's why we added it because I would say 90% of the resumes that we see. Rob1 like we're automatically generating stuff. We're familiar with that policy and it's so good to kind of wipe all of those people out like right away.

[Bronwyn]

I understand your position. At the same time it's looking for work under the best of circumstances sucks. A gajillion years ago when I worked in the HR department for a city agency in Los Angeles, we're talking the early, early 1990s and they had a single position for an architect open up. And this was before Monster and all of those. And we were still getting thousands of resumes. I don't know how anybody gets hired ever.

[John Strand]

I want to see, I want to see how many resumes we have for it right now.

[Corey]

Let's live on the show, review every resume and share our screens. All right, roll the finger, roll the finger.

[John Strand]

The answer is 450.

[Corey]

Hello and welcome to Black Hills Information Security. I'm looking for a job. My name is John Strand. If you know any podcasts I can sign up for where I'm welcome. That's fine. Otherwise, welcome to the show. It's June 7, 2025. Independence Day weekend is over. We, I hope we all have our same numbers of fingers and hands that we left with.

[Wade]

I got called, I got on called, called with 12 minutes left on my on call on 4th of July.

[Corey]

My.

[Wade]

Call switches over at 2. I got called 1:48 and I was like these sons of bitches as I'm sitting here at the pool eating a.

[John Strand]

Hamburger and the timing somehow checks out week.

[Corey]

John, how was being you're international right now. How was being international during the fourth? Did go over quietly. Was there any like random Americans just blowing things up in the streets?

[John Strand]

No, no, we didn't have any random Americans blowing up anything at all. It was actually really, really low key. Of course I spent it in Germany. It was also my 25th wedding anniversary and my daughter's first wedding anniversary. Yeah, it was, it was very low key. We were here with my, my, my 70 plus year old mother in law and my seven year. So it was a, I don't know it was, it was a different type of intense I guess but it was good. Got some biking in and I'm in Zurich right now with, with the kids because we went saw a concert for a band called the Backseat Lovers who are amazing. Was an absolutely great show that we Just got out of. So all in all, it's pretty good. It's pretty good. But I get back home on the 10th, which is good too.

[Corey]

So, John, you sent an article that says Fortune 500 cyber risk falls by 33%. Let's expand on that. So here's. This is an article we got.

[John Strand]

This is a shitty story. And I got another shitty story. But go ahead, take it away.

[Corey]

I don't think it's that. Okay, so basically this is an article where the. The company that published this is called Cytania Institute or site Scientia. Sancha. I don't know.

[John Strand]

Sanchez.

[Corey]

Yes, I'm going to Sanchez. Anyway, this is like a research institute that specializes specifically in cybersecurity related research. I looked on LinkedIn, they don't have an employee account, so take with that what you will. But it's basically the tagline from this that I thought was interesting is they published this thing they called the IRIS 2025 study. Here's kind of the main thing. If you can scroll down to the part that says the probability of any given organization. That right there. Oh, oh, oh. Scroll up. Well, a little bit more. The last paragraph right there. So basically this is kind of the tagline. The IRIS 2025 study found the probability of any given organization experiencing a cyber event in any given year has quadrupled since 08, since 2008, rising from 2.5 to almost 10. So that's all organizations. The breach risk has gone from just, are you doing something? Well, you're about 10% likely to get breached as of today. But the key factor, and this kind of got integrated into the headline, is companies over 100 billion in revenue. So basically the Fortune 500 are actually less likely to get breached now than they were then. So it's like, who knew money kind.

[Wade]

Of like from getting breached.

[Corey]

Kind of like a metaphor for something. Right. But like, it also tracks with what we've seen. Fortune Companies or Fortune 500 companies have a lot to spend on cybersecurity. That gets you a lot of the way there. And they have large security teams, blah, blah, blah. It doesn't go into causation of why this is. But the statistic is basically there's more breaches, but they less affect big companies like a hundred million plus in revenue or 100 billion or whatever it was. But yeah, I don't know, John, what do you think about this? Is it bs? Does this align with your personal.

[John Strand]

I used to say, kind of before the EDR phase. Right. But we're going back all the way to 2008. That's kind of where we have to start right back then. The larger an organization was, the larger the attack surface was and the less likely we were to be detected and the more likely we were to be successful in what we were doing. I know at bhis, when we first got started, if we were going after a company, let's say that had over 5,000 employees, everything was on the table and almost everything worked, right? So your traditional password spraying would work, traditional spear phishing would work, traditional macro enabled word doc attacks would work. It was. And I think we got into a lot during that phase because everything worked. And it kind of like started deflating a lot of people in the pen testing community over the next half a decade. I know there was a number of amazing red teamers that just got out because they were doing the same thing. Wash, rinse, repeat, rock, wash, rinse, repeat. And then with silence and ransomware kind of exploding, you started seeing this immediate visceral stimulus and response reaction. So it used to be if you get hacked, the attackers just swell and brag about it, right? You can sweep that under the rug, who cares? But when you started having ransomware with immediate financial kind of impacts to large organizations, and I'm not just talking about like stock price, because that still seems to not matter to most organizations with their stock value whenever they get hit. But there is a financial impact to it, number one. And number two, there is also this visual reaction for CFO, CIOs, CTOs where they can see, oh, they got compromised, they got shut down, they had a really bad week or two. Investment started sinking into the Internet security community the exact same time that EDR was today, right? Silence initially was one of the main ones. It was kind of weak charge and then they went off into a bloody and black area, all kinds of strange crap. But the point is you had that immediate disable reaction. And very, very large organizations immediately started dumping money into security in a rate that we had never seen where the difficulty in breaking into an organization. Cory, I'd like to get your take on too, but man, there's like this slow growth curve and then a organization started getting better, much, much, much better within a matter of months over kind of the incremental growth and security over years, especially to large organizations. So this particular rapport really doesn't surprise me all that much. But it is very, very different right now. Whenever we go after very large, well instrumented organizations that have everything that they're putting in place, they're a Lot more difficult to get into. But that also kind of feeds for you to the patience game. Right. The idea of doing a point in time assessment, I think in the security community is, is starting to wane. You're starting to see where, like what we're doing, continuous pen testing and attack surface management, what a lot of other companies are kind of moving into the space where they're learning to be patient because that's where our threat actors that we're trying to emulate are doing. They're patient and we're starting to emulate that as well. But Corey, that's my long, that's my long take on how we got here.

[Corey]

I agree with the sentiment. It's interesting to kind of have a news article that backs up my personal experience, which is, I mean, not to say that there aren't large companies that are insecure. There definitely are. But I think if you look at, if we're talking about the Fortune 500 being 500 companies having a, you know, a breach rate of 10% of those seems high to me, but I guess. Does anyone else have a take? Is this back up your personal experience?

[Wade]

It backs up my personal experience working at some of these larger organizations, at least in the defense way.

[Corey]

Right.

[Wade]

Is there's a large amount of tooling that goes in there. Most of the tooling gets bought without anyone really like knowing. Like there's been several times where I'm evaluating different tools and realizing we have three tools that all do all overlap and all do the same thing.

[Corey]

Right.

[Wade]

Which is going to be a lot. If you do have overlap, it's not as good for financially. But honestly, one of those things better catch something if something's going on.

[Corey]

Yeah.

[Wade]

God, I read Deb's message and it threw me off.

[John Strand]

Yeah, she does that to you. Her old job is to knock you off your game, so.

[Wade]

And dude, I've been at organizations where all of a sudden like brand new EDRs show up and I'm like, why do we have two EDRs now? Like, it's because they have the money to throw around most of the time. And if you have the big bucks, you can easily. It's not as hard to defend yourself, especially with out of the box rules being so good as they are nowadays. You don't really have to customize much as you used to.

[Corey]

Right.

[Wade]

It's a lot easier. It's getting easier to defend so well.

[Corey]

And even beyond edr, like, you know, I think if we're looking at eras you have like pre edr, then you have edr then I think now we're in. I would call. I don't. I want to say xdr, but like that's like a industry term. But basically you have like EDR on top of your edr that does really good insight and anomaly detection and things like that. Like we get caught all the time from. Not an actual event log hitting a sim and someone has an alert for that, but just from like, oh, you. This looks like a recon tool or whatever because it's, you know, in. In tools like Exabeam or other like XDR tools, we get caught. It's not an alert that's native, but it's an alert that's native to the like second tool, I guess to the MDR.

[Wade]

Right? Yeah. These MDRs have huge, huge overreach through cross, like multiple. These Fortune 500.

[Corey]

Totally.

[Wade]

So the more they have, right, the more information they have, the better detections they have. The funny part is though, is like when I see one and then they do miss something that's like blatantly obvious. Say like astral vpn. Like what the F are you guys doing?

[Corey]

Totally. Or RMM tools. Right. Like there are, there are going to be gaps, but I mean, it's like anything else. It's. I think the proof is in the pudding. The other thing that we're not talking about, tooling is a big component, but the other thing is just team sizes. So like across, you know, with continuous pen testing, we have different companies, different size companies down to smaller companies and some huge ones. The huge ones have huge security teams and they get stuff fixed like super quickly because they have like, I don't know, 10, 20 people fixing stuff on an active basis. Like, this is gonna work better than like one guy being like, I changed the password. But then, you know, I, I got a ticket or whatever, so I had to, you know, it's just the larger teams have a huge amount of firepower.

[Wade]

I got a question for John around this though too. I feel like Corey and I have talked about this on the side about threat intelligence. Right. And threat intelligence is becoming a much bigger thing. I feel like with organizations, at least in, especially from 2008. Right. People are out here more willing to share TTPS and IOCs and that stuff, especially with these large organizations than ever. John, do you think that's a big take? Like the community is a thing now then that's more.

[John Strand]

If we look at the evolution of threat intelligence, kind of the evolution of my view on threat intelligence. If we go back 10 years ago, threat intelligence was garbage, right? It was pretty much all the vendors were taking their existing TTPs in the form of hashes.

[Corey]

Here's a list of IP addresses.

[John Strand]

Here's a list of IP Addresses. And then repackaging that and reselling and the vast majority of it was just really, really horrific. And they were charging a lot of money for it and kind of pissed me off. So if we're looking at where it is now, we have an article a little bit later with our friends at Flare. I can't remember which article it is. One of these think it was Cybercrime Masterminds article. But if we're looking at like, like Infosealers and kind of the dark web boogeyman market, those are things that are directly related to being able to exploit organizations. Because it's now where you can break into an organization at an odd angle, right? Where it's no longer an issue of, you know, I'm just going to bypass your antivirus and I'm going to gain access to Pivot router environment. I'm going to go to Infosteel or logs and I'm going to get creds for a third party website that has been breached and I'm going to use that to gain access to the environment. We're starting to get to the point where that is important. But then also there's, there's kind of a good article and a crappy article. Hidden weaknesses of AI SoC tools that no one talks about, which is a good article up until the end they're like, and our product solved all these problems where we're looking at threat intelligence now beyond that static threat intel. Right? We're getting to the threat intel pyramid of the pain or right at the top where it's no longer an issue of saying well this is bad executable. We can now look at what something is doing. And that something could be a number of things. It could be a system, it could be a user account, it could be a service account. We have a scenario where we have a lot of tools that can actually correlate and fuse that across multiple different log sources feeding in to give you a much better holistic view of what is happening in the organization. And you're now getting to the point where that shit is washed runs for key and now you can feed that into a soar and you can deal with things a lot faster. So it's one of those areas where I think it's getting a lot better. Kind of we're just parroting back what Corey just said, but I also think that there's a heavy amount of selection bias in this. Right. If you look at bhis, you look at Trusted sec, you look at secure ideas, you look at Redseed, a lot of the boutique pen testing turns, there are companies that are truly interested in evaluating the security or trying to protect their environment like we're seeing in our SoC. Customers that want to do the right thing, whether it's offensive or defensive, and they go to firms that are known to do a good job. I still think that that's a very, very, very small percentage of the overall IT space. I think that you're starting to see more and more of the spread of first world, second world, third world companies where we have all of these tools and they're great. But that, you know, the future is here, but it's just unevenly distributed I think is very, very much a truism in the security community as a whole.

[Corey]

Yeah, I mean, it's an interesting article. Obviously we're kind of expanding a lot of it and I mean, I think if we look. So I, you know, just out of curiosity, looking at Fortune 500 companies that got breached in the last three years, you have AT T, that's the one that immediately came to mind. Huge company, huge breach. You got Social Security numbers, you got like all the stuff. United Health or Change Healthcare like Ticketmaster, Santander, which is a European bank, Comcast, like a lot of them got hit by Move it, which good luck xdring your way out of that one.

[John Strand]

Once again, Corey, that's one of those things where waiting and being patient is off, right?

[Corey]

Yeah.

[John Strand]

If you're trying to gain access to these environments, creating a technology profile for your targets, waiting on that technology profile and striking as soon as a new exploit is in the wild. Pays off for threat actors.

[Corey]

Yeah. So it happens. But I will say that's a pretty small list of 500 companies I can only think of, at least off the top of my head, like seven or eight or whatever.

[Wade]

T Mobile had to be one of those, right? T Mobile gets breached.

[John Strand]

I don't know.

[Corey]

I don't know if they're a fortune. Yeah, they probably are. But yeah, they get breached every year. So it's not worth talking about.

[Bronwyn]

T Mobile and Verizon.

[Corey]

Yeah.

[Wade]

How many people have been breached and haven't said anything?

[John Strand]

Right, okay, that gets into an interesting point. Wait, a lot of this comes down to the definition of breach. Now we're not talking about Europe and gdpr, they're talking about the United States. It gets into what is the definite what is a breach? And you'd see a bunch of executives sitting around smoking weed and being like, I don't know what a breach is, man. What do you think of breaches, man? I think it's a definition of society that's posed upon us when the reality of the situation is what we think breach. Because that's the only thing that matters.

[Corey]

SEC calls and they're like, oh, guys, sober up. Have some coffee.

[John Strand]

Yeah, it's time to do that. Mic sync is getting off, I guess. Is that true? Do I need to switch mics again?

[Corey]

It's fine. I say just roll with it. I mean, you can switch mics, but it's fine. So, okay, you know what we're talking about. What does XDR not detect? Here's. Well, I guess it kind of does, or mdr. But let's talk about Jasper Sleet, which I will say, on a side note, how does everyone feel about these new threat actor names? Because I kind of. I'm like, Jasper Sleet just sounds like a guy I would ride bikes with.

[Wade]

It sounds like a country stand.

[John Strand]

It sounds like a badass stand. Because that's where my head is right now. I'm gonna give credit to people. Maybe these teams, they're coming up with some slapping names. Jazz for some.

[Wade]

All right, John, switch back. Switch back to the other mic. That one's way worse.

[Corey]

Yeah, that sounds like you're talking to us from a toilet bowl. I like the vibe, though. So, yeah, if I gave you the.

[John Strand]

Tour of where I'm staying in town, it would be like, are you in the red light district? And the answer would be, yes. Yes, I am. And an Airbnb in the red light district.

[Corey]

Perfect.

[John Strand]

So there's a strip club across the street, so whatever.

[Corey]

God, yeah. Yeah. So basically, Jasper Sleet is previously known as Storm. Whatever. You know, this is Microsoft's new threat actor names. It used to be storm 287 0287. Now it's Jasper Sleet. This is the remote IT workers, North Korean remote IT workers that. We've been tracking this on the show and otherwise for a long time. But this is a really cool write up that explains how they're detecting it, what they're doing. And I will say, I think the most interesting part of this for me is that it really is up to companies like Microsoft, Google, the fang companies to like, take down these types of accounts because, as they say, they had to suspend 3,000 consumer accounts, Outlook and Hotmail, accounts that are used by IT workers. Obviously they publish I mean, they did make Quick Assist, which has been super helpful for threat actors. But anyway, basically the most shocking thing from me, from my perspective, is there's a quote in there that says, since 2020, the U.S. government and cybersecurity community have identified thousands of North Korean workers infiltrating companies. I think in my head it was not that big of a problem, but.

[Wade]

It was that big.

[John Strand]

I'm going to throw this question out there. Like, I keep hearing people every damn day that are like, I've applied to thousands of jobs from when we were talking about this, right? It's bad, right? I'm not going to sugarcoat it now. You've got to be really feeling awful if you're trying to get a job in IT Security, right? You're busting, you're doing your resume. You're going to be Joe Crashlands webcasts, have a job hunt like a hacker, and then these articles pop up about thousands of North Koreans getting jobs, stable trade organizations. Something's wrong here. I don't know exactly what it is. I can't quite put my finger on it.

[Bronwyn]

It's numbers. It's numbers.

[Corey]

So they're also ideal candidates, right?

[John Strand]

Yeah, well, but you've also got to be like, but I put out a thousand resumes and that fake guy who's that hacker from North Korea got a job. It's. Yeah, you gotta.

[Bronwyn]

There may be some bias involved.

[Corey]

Yeah, I was gonna say maybe job. At this rate, what we gotta do is have Bronwyn put together like an AI based job application. And it's just the most perfect candidate in every possible way. It's like, we'll work 24 hours a day. We'll never.

[Bronwyn]

Hold on a second. There's the whole application process and then there's actually finding candidates that are good for the job. One of the statistics that you will find if you talk to HR people or you know, the people who do statistics about hiring patterns. If a dude sees an application and he fits 40 to 60% of the qualifications, he's going to apply. A woman does, usually she has to have 80 to 90% or more before she even considers it. And now that's just along the standard. Typical gender divide. So you've got qualified candidates who pre screen themselves out just by not applying. And then you've got all of these people who, whether they're using Jason's plan or they're. They're misrepresenting themselves on their resumes, or if they're doing the copy pasta to and from an AI from a job description in order to compose the perfect application. You know, it's just. Can you guys hear me?

[Wade]

Yeah, we're letting you.

[Bronwyn]

Stop.

[Corey]

Like, we were like. Yeah, we were. We were just enjoying your rant. Okay. But yeah, I mean, I fully agree. I think if you, if you're willing to just be disingenuous and lie, you can get a lot of jobs. So let me.

[John Strand]

Problem. I want to boil this down. Are you saying that organizations would much rather hire North Korean dudes than women?

[Bronwyn]

Based on the evidence that is.

[John Strand]

Plausible. That makes me feel bad, Bronwyn. That makes me feel not happy.

[Bronwyn]

How do you think I feel?

[John Strand]

You didn't take her to a happy place, Bronwyn. You somehow took this utopian webcast, this talking about news where we just were watching the fall of western society, humanity, and you took it a little darker. Well done, well done.

[Corey]

Nicely done. Well done. Have you heard of the.

[Wade]

The dude who had five jobs at different Silicon Valley startups?

[Bronwyn]

There was another dude, he shared out his ID and it was picked up by 13. Dude was pulling in. Now this is probably gross income, but a million a month with 13 different jobs using his set of ID.

[Wade]

I just sent the link to it.

[Corey]

Yeah, well, okay, so the couple things about this, the, the Jasper sleep thing, it's kind of the same detection as it's always been. It's the same thing as detecting overemployed people. It's the same thing as. I mean, my joke that I want to make is maybe North Korea should pivot to freaking headhunting. They're clearly pretty good at getting jobs, doing great.

[John Strand]

Something. They got something down.

[Bronwyn]

The thing that I grabbed from this article was like, if you, if you even just like, like just do a search for impossible travel, like, it's like they're. It's so easy to catch and they give you all of these, like, indicators.

[Corey]

You can try to find.

[Bronwyn]

But it's like they caught them using in, you know, possible travel with like, their AI machines that they have at Microsoft.

[Wade]

Most of the detections I saw, oh.

[Corey]

There'S also rmm tools. There's VPN rmm tools as built in Office 365.

[John Strand]

You have to. You still turn it on, right? It's like, well, so I think two places.

[Corey]

The problem here more than anything is the trust. It's the zero trust versus trust model. It's once you're an employee, the trust is just like, oh, it's fine. They're traveling, they're on a vpn, they're this we ignore that. We don't want to contain their account because HR said it's really important. Like, it's the business overview thing. Which is why, like, for assumed compromise nowadays, we strongly recommend. We're like, please give us a valid real employee we can call and have them intentionally hack themselves. Because security teams, if the account's been created, like, two days ago, they're just going to quarantine it immediately. But they're not going to be that. We're not going to be that aggressive with. Yeah, it's super.

[John Strand]

Last week with the red team, we had a company that set up a specific account or an attorney. Never do this compromise.

[Corey]

Never do this.

[John Strand]

Set this up. They set up this account, and we started pivoting around the environment, and they were good. They were damn good. They had good telemetry.

[Corey]

And then you compromise a real account and they have no telemetry because it turns out they were just typing the host name into the sim.

[John Strand]

But their security team looked at the account that they set up for us, and they're like, well, this account looks suspicious, so we nuked it. It's like, that's not our fault. Like, we didn't create that account.

[Corey]

That's like you in your own house being like, oh, who didn't flush the toilet? It was me. Dang it.

[John Strand]

It's my wife and I playing who salted Delta? We know who it was every single time.

[Corey]

It's so dumb. It's so dumb.

[John Strand]

It's not a contentious piece of, like, conversation.

[Jason]

So our last pen test, we had the assumed. Assumed accounts. They typed in who am I? I see the accounts, and the first thing it says under there is who their manager is is my boss. Now, do you not think that I'm going to go ahead and not know who's on the team that I'm working on?

[John Strand]

Yes. Yes. I think that's going to be the first thing you're going to do.

[Corey]

I was going to say, you must work for a small company if you know your entire security team off the back of your hand. No, you haven't heard of the new Global. Global sock. We have an offshore sock. We have. We have five offshore socks. They have 5,000 employees each. Don't question it.

[John Strand]

Yeah. Just let it happen. Just let it happen.

[Corey]

Yeah. I mean, that. Yeah. I mean, this is a side tangent, but the detections that I want to call out are the improbable traveler stuff, which is, like, people were saying, pretty obvious. The other stuff is rmm, tool usage and just general suspicious behavior. But the problem here is the general lack of oversight whatsoever. Right? Like, if I hired one of these people, I'd be like, hey, you're working weird hours. Are you're never on webcam. Like, what are you even doing? All your work seems to be AI generated. Like you're not good at your job.

[Wade]

Like, I think this is more of an HR failing.

[John Strand]

It is, but it's not just an HR failing. Right. I think that that's the silver lining of our offensive security. Right. You know, we can talk about OGs. Things are getting tougher. Things are getting tougher. No, they're just changing, they're evolving. You know, the shit that worked 5, 10, 20 years ago doesn't work now. That's just going to happen. But if you're looking at large organizations, what we're talking about is an issue of process failure in hr, right?

[Corey]

In hiring and other business teams as well. Not just hr, the other business teams.

[John Strand]

Is where I wanted to talk next. You have so much new development, so many new services that are being stood up. We're now using AI to do live coding to create these services. You know, there's so much churn that happens in an organization that if you're an offensive security professional, I think you absolutely need to do an assessment of the motherhood and apple pie standard checklist stuff. You're going to do cloud attacks, try to bypass two factor authentication, password sprays, you're efficient, all of that. But you also have to keep that eye on what are the new technology like, where, where's the technological trend in the organization? Where is their dev instance? Where is their staging instances? Where do you have people just spinning crap up because they're in the marketing or the sales team and they want to throw together, throw together a WordPress website for marketing, right? Those things still exist. And as an offensive security professional, you need to find them. But I will also go through. And Corey, I want to get your take on this. You still have a lot of customers that are like, this is what I want you to focus on right here. I don't want you to go out of that and you're like, what about all these systems over here? Ignore those systems. Ignore those systems. I want you to focus on these, these ones in Europe and Brazil. They are associated with your organ. Ignore those. I think that we need to continue to expand the aperture and look wider at the technological footprint once again, looking for that churn in organizations, because that's still very valid. We're going to like, if you're curious.

[Corey]

John, the stick I use these days and we don't. We have one customer out of, like, 20 something that actually uses a scope at all. The rest of them are just like, yeah, it looks close. If it has our logo, it's probably us.

[John Strand]

They're like, go after it.

[Corey]

Yeah. So the. The stick that I use and other pen testers out there use this too. What you got to do is you got to say, do you know what Bitsite is? Do you know what that is? And they'll be like, yeah, we know what Bitsite is. We run that report every. Every month. And then you say, well, just so you know, Bitsite's gonna ding you for all this stuff, so you gotta fix it. And that's the, like, there. Bitsite's not gonna be like, oh, it's out of scope. We'll take it off your report. And guess who else is running Bitsite against you? Every other vendor, every other third party, every other, like, you know, it's reputation. If it's got your logo on it and it can be tied to your stuff, it affects your reputation. That's the stick I'm using, at least these days, and it seems to be working. So other pen testers, good luck also. This is not legal advice. You know, this is all for entertainment purposes only. Don't actually do this.

[John Strand]

Lean into it. This is totally legal advice. Go get him, tiger. There we go.

[Wade]

Didn't. Didn't Bitsite ding you guys for that too much? Because you had too much deception in place.

[Corey]

Right? Yeah. So I want to be clear. Yes, exactly. I want to be clear. These. I'm not, like, shouting out Bitsite. What I'm saying is the world has gone to a model of John. You want to do business with the company, you type their name in. If they get anything below an A plus, you just cancel the contract. I mean, that's a joke, but, like, that's basically where CISOs and, like, risk management is at is. I type your name into a box, the score you get back tells me whether you're secure or not. And that's what people are using to make decisions. Right? So, yes, all these services are a racket, but the thing to tell your customers if you're a pen tester is they're going to scan you. They're not going to care about your scope. So you should let us do it first and fix some of these hygiene things that are, you know, et cetera, et cetera. But don't.

[John Strand]

Don't hit the player. Hate the game.

[Corey]

Yeah, exactly.

[Jason]

What I find fun about things like Bitsite, etc. Is yes, you need them to go ahead because of race checking them, but when you fix something that they're reporting and your score goes down because you fixed it and they don't have a reason. And I've seen that happen multiple times.

[Corey]

Oh yeah, the numbers are totally made up. Yes. Also like, like John said, if you have deception, you're going to get for a bunch of stuff like, oh, you have Tomcat 9 with default credentials. Like, that's honeypot, guys. It's on purpose. Yeah, yeah. Anyway, so let's move on. Let's talk about, we talked about Jasper Sleet. I mean, control your business processes. Let's talk about this Shelter one because I want to get John's take on this before Swiss Internet cuts him off. So basically it's a really technical, in depth article from Elastic Security that is really like way above my head from a systems internals perspective. But essentially the headline is that a threat actor got hands on a commercial OS offensive security tooling framework called Shelter and they started using it to deploy stealers. To deploy info stealers. Elastic is basically publishing all of the evasion techniques that this commercial tool uses. It's basically like if someone got access to Outflank OST or Cobalt Strike or Brute Rittell or whatever commercial pen test framework and then use it to deploy info stealers. I guess I'm curious on your take on this, John. Like what duty do they have? I mean they obviously were trying. They have like license functionality. They have, they have tried to prevent its abuse. But like what do you do if you're a company like us who produces offensive tooling and then it gets abused for this? Like they basically are going to have to scrap this entire tool framework and like modify it so that it doesn't match Threat actor ttps. It's really tough. What do you do?

[John Strand]

We've talked about this in the past with like Brute, Retell and Nighthawk. How many evasion techniques do these companies set up? Like, so if we're looking at like outflank for Retell, Nighthawk, Shelter, they aren't sitting in dozens of information techniques, right? Like you're looking at maybe double digits. There's a significant amount of cost in R and D for coming up with those sedation techniques. Now when you're looking at this, right, it kind of. I'll just be boring. Look, the offensive community pulled our coaches and I think that there's a lot of security companies and I like Elastic, right? So this is going to be a little bit harsh, but I like Elastic. I think they're good people. I think that they've got a good product. But let's be honest, how would they feel if we all of a sudden decided to do a full week of bypassing Elastic? Go. Go.

[Corey]

I mean, we would find go, but we definitely wouldn't go.

[John Strand]

Yeah, go to go. Go to the BHIS website, do a search on silence.

[Corey]

Yeah.

[John Strand]

Where we did a week of each day was a different bypass technique for silence because Silence was starting to become. And they were starting to threatened legal action against security researchers who are coming up with bypass techniques and sharing those bypass techniques with Cylance directly. And rather than trying to fix those five pass techniques, Cylance was pointing to their EULA and saying, well, you weren't supposed to talk about this publicly.

[Wade]

Right.

[John Strand]

Don't want to release this publicly. And there was a lot of fights going back and forth, especially dealing with open source tooling back when Marcello was here, right. With Silent Trinity and all these different things where a lot of people in the offensive community, we all took a B and we said, you know what? We're going to stop doing Sacred cash cow today. That was its voice at Black Hills Information Security, where we got tired of redoing the exact same thing again and again and again, year after year after year, but also trying to realize it wasn't really pushing the entire industry forward. It was a great marketing stunt. It was great for all of those things. So we pulled back. So my recommendation, if you're elastic, if you're crowdstrike, if you're any of these different EDR XDR or next generation AI EDR companies, and you decide to go after an offensive comment, right? And you deciding, hey, this is how to detect this particular offensive combination or this company that is actively trying to make a living and doing these different things and you're trying to make it public, I want you all to know that that door swings both ways. Any of the good pen testing companies that are out there could absolutely have a couple of weeks completely dedicated to doing nothing but bypassing your product. And I want you all to think about it before you start doing this track. Right. Before you start doing this against Shelter or Rattel or any of these things, I want you to think about what two weeks of really bad publicity of an offensive team that is very good at what they do. Do nothing but focusing on just your product and bypassing your product every single day for 10 days straight.

[Corey]

Yeah. So I think it's important.

[John Strand]

But. But I want to back up, I think it's important to talk about this, right? Why not be collaborative with Shelter? Why not sit down and do a coordinated disclosure with Shelter or working without blank or working with Retell or working with offensive teams and making it fun, a game of, you know, spy versus spy. So be very careful marketing teams because if you're out there and you're doing this, this absolutely can come back to bite you in the ass. And then I'm going to put forth. It probably will. Yeah.

[Corey]

I'm guessing the next version of Shelter is going to be real good against elastic security.

[Bronwyn]

I had a couple of thoughts while you were talking, John. One, how much of this denial culture coming from the various companies is holdover of the historic adversarial relationship that security has with business? Okay. So I would, I would add this to the marketing people and I've said this I don't know how many times and I'm going to keep saying it probably till my dying day. Turn security into a selling point. You have lots of things. So. So rather than turning the hackers and the cybersecurity researchers into the enemy, reach out to them, help them make your tool better. And that gives you better bragging rights by saying we have worked collaboratively with X number cybersecurity researchers and you can do that. Eight out of 10 researchers say our tool is whatever, but maybe have some actual backing, actual foundation for it. That would be wonderful.

[John Strand]

And I think it boils down to collaboration. Right? Let's work together. You know, I would like to think, I don't know the people at Shelter, right. But I would like to think that if you have a defensive company that wants to coordinate with an offensive company and do something like this where it can be released in such a way that it doesn't cost a lot of money to Shelter and vice versa. Right. If we come up with a bypass technique, you know, we, I think we have a fun relationship with CrowdStrike. Right. You know, CrowdStrike is detecting BHIS and then shutting off those detects in our test environment. So it works in our test environments and then it doesn't work in, in public. That's, that's fun, right? That's, that's the type of game that I want to be playing. I think doing collaboration where maybe do a webcast again, right. Where we're talking about these things, we, it's better in the community when we work together. There's nothing that's really going to come from it. If you have short sighted marketing things where you decide to start attacking each other.

[Corey]

Well, the other thing. So even beyond just like the general vibe, which I fully agree with, the other thing they call out. So Shelter, just to kind of bring everyone up to speed, Shelter published kind of like a response post to the Elastic post, which we can link. I'm not sure if Ryan already linked it, but basically we should definitely link that. It's essentially like the main point they call out in the post is like, you got, you know, you kind of, like, wanted to scoop us. You didn't tell us, warn us about this in advance. But that means for the period that you found out about this, there was about three weeks where the threat actor had access to this tool and kept using it. During those three weeks, that's potentially three weeks of malware that got created and deployed. The other thing they mention is it's pure luck that they didn't get the new version of Shelter because they just. Yeah, like it says there, they happened to postpone the watch for unrelated reasons of their new tool. So if they had pushed out the new tool, the threat actors would have gotten access to it. Yeah, it's not just about Vibes. It's also about, like, potentially all the victims of these tools were getting hacked during that time because they didn't notify Shelter. Hey, you need to disable this license immediately.

[John Strand]

Yeah. So well, and that once again, goes to show that this quickly became a marketing propaganda stuff more than it was anything else. And by the way, once again, this all goes both ways, Right? Offensive companies like. Well, you know, bhis, I'm going to say for a long time was one of the worst. You know, doing the sacred cash cow ticket. In our defense, a lot of the crap we tried. We tried four years in a row, and it worked. All four years. We were trying to make a point, and we stopped. We stepped back from that ledge. But if this crack starts happening, this is absolutely something that I'm willing to take to the edge again.

[Wade]

I can tell you right away how you can notice that this is a marketing scheme. There's no Sigma alerts. There's nothing to share to the community. There's like, the detections. Like, I can write detections for this. I'm gonna have to read and dissect this article. It's gonna be a little bit harder than usual, right?

[Corey]

Well, unless you pay for Elastic.

[Wade]

Unless I pay for Elastic. Exactly. They're already in elastic. I could go look at Elastics detections and then try to revert them into something I use, but that's one thing. I've noticed a lot of the times when I'm reading these articles, if the company isn't already sharing it with the community, there's a marketing team behind it that.

[Corey]

Well.

[John Strand]

And let's back up for a second, Wade. I'm willing to bet this is the same thing that happened with Cylance. You know, we kind of went to war with their marketing team. A number of months later the engineers showed up, we started up a great relationship. They sent us a big old case of like really cool beer and we started a relationship with them. Right. Because we started that conversation. And in Elastic, I know some of the tech people that work there. They're fantastic. There's some really hard working great security talent at Elastic. This frames marketing department high fiving each other and saying this is, this is great marketing for us.

[Corey]

Wait, the thing that really chaps my. Never mind your hinders. But the thing is this. The blog post is way too technical to target whoever's making purchasing decisions about what EDR to buy. Like, it's like a technical blog post about tearing apart an offensive tool. CISOs or whatever are like, I don't know what this is. What are these? Screenshots of IDA Pro. What the hell is this? Like, I don't know what this is. So it's like them mic dropping on ost, technical people who are the only ones who read their blogs to begin with. And by the way, if anyone's curious, their stock isn't really. It didn't get a boost. Like it's like it's not doing terribly, but it's not like 5% up. Like, this didn't make any waves because it's a long article about a bunch of stuff no one cares about except for nerds like us who don't make purchase decisions for this kind of stuff. It's an interesting. I don't want to get too deep down the drama hole. You know, it is like a little bit of drama. We'll see how things evolve. But from my perspective, I think John's take was perfect. It's like work together. If you have intelligence that would benefit potentially hundreds or thousands of victims, you probably need to share that with the company who can stop that from happening. And then like, likewise, if you're an offensive tooling developer, don't go tipping cash cows. Right? Don't go out and be like, I could bypass elastic for $6 venmo me or whatever. Like, it's not. Yeah, I mean, I don't know. Interesting, interesting scenario overall. Bad, bad actors gonna do bad Things and hopefully get a stock bump from it. But. Yeah.

[John Strand]

All right. Do we have a last story for the week? One that we want to talk about?

[Corey]

There's a few we can maybe do, like a little bit of rapid fire. So Apple wanted. So. Or Google Germany.

[John Strand]

We haven't even talked about Ingram Micro.

[Corey]

No. Oh, yeah, we can. We can run about. Ingram Micro is down. It's ransomware. That's basically it. I mean.

[John Strand]

Yeah, Yeah. I. Okay, so I. I do have a take on this that I want to get your opinion on. It's ransomware, but this is the type of company where dwelling and embedding in supply chain would have been a better idea. Or do you think that the people behind this, like, ransomware is what they do? That's all they do. You know, they shovel coal into the fire. That's it. Just keep doing what you do.

[Corey]

That's what they do.

[John Strand]

Yeah, I think that's what they think. Ingram needs to take a breath after this and realize just how much worse this could have been.

[Corey]

Yeah, I mean, obviously we don't have a ton of technical details. This. This article about, you know, they believe it breached through the VPN and. Yeah. Somewhere. Who knows how they. What. The initial access vector is probably like, you know, fish or employee fish or a stealer or something like that. It's evolving. Right. So we don't want to misreport what's actually happening. But I mean, John's take on like, yes, supply chain. So for those who don't know, Ingram Micro is like a software company. So. And their software is used. I think it's like development tools or something. I'm not super familiar with what it's used for, but basically they're a software company. So the supply chain attack there is huge. But I mean, I think, you know, financially motivated threat actor. They want to get that payday and they want to move on. They want to just get that Bitcoin in their wallet and move out.

[John Strand]

I, like the Lonester said, what does it say about the current state of things where ransomware event like this barely gets any mention on the show? It means it's bad, you know? You know, that dark corner, that brown one just took us. It's even darker. I just.

[Corey]

Just bad. Well, it is what it is. We've talked about a bunch of ransomware lately, but it's like, it's one of those things like, oh, wait, you're muted, I think.

[John Strand]

Uh. Oh, here he comes.

[Wade]

I was gonna say it has to evolve chickens for us to talk about ransomware.

[John Strand]

Chickens.

[Corey]

Yeah, yeah, exactly. If you want. If you're a chicken company and you're under ransomware attack, we will. Will personally come. Wade and I will show up personally and eat as much chicken as we can and then leave.

[Wade]

Someone's gonna hit us up for that. I'm gonna.

[John Strand]

What's gonna happen?

[Bronwyn]

Careful. If you're willing to drive down to SoCal.

[John Strand]

No, no, don't. Too far.

[Corey]

There's no chicken companies in SoCal that I know of that are.

[John Strand]

Yeah, there's not any animals.

[Corey]

That's a rapid fire. I mean, another couple rapid fires. So Germany requested, said Google and Apple remove Deep Seek from the app stores because it's not gdpr.

[John Strand]

Yeah.

[Corey]

Which is totally fair. It's just kind of an. It's an interesting. Like, I get it, but it is interesting. Like if you think about the amount of citizens data that was probably leaked before it was taken down, like, probably pretty bad.

[Bronwyn]

Probably within the first five minutes.

[Corey]

Deep Seek is an AI. You know, we talked about it a while ago, but it's explicitly China affiliated and not really. They're like GDPR now. We just don't care. We're here for AI.

[Bronwyn]

It gets confusing because there's the company Deep Sea, there's the LLM model deepseek, there's the mobile applications for Deep Sea, and there's the web interface for Deep Seq. The real hazards are with the web applications and mobile applications, much more so because that's where basically everything you type into them is being sent off to China to be processed.

[Corey]

Right. The model itself isn't malicious. It's the data being fed into the model or the queries that people are making.

[Bronwyn]

Yeah, but the problem is everybody calls it, oh, it's Deep Seek and there's no differentiation, so.

[Corey]

Okay, Bronwyn, I don't want to put you on the spot too much. Are there any AI models that are GDPR compliant? Because that seems impossible from.

[Bronwyn]

I would say probably not. And this is where some of the recent rulings that have been made in the United States about fair use and copyright and intellectual property are probably going to be challenged on a global scale. Because most, if not all, actually there is a limited number, a small number of LLMs that have been built using content that is strictly in the public domain. But the big players, they're scraping everything, and they're scraping everything to the point that even I believe Cloudfront is starting to block AI scrapers from being able to go after new websites and just take everything and throw it into their hopper and Use it without any acknowledgment or whatever. So bottom line, back to your question. Is it GDPR compliant? I would say I can't imagine how any of them could be that haven't been built using strictly public domain content.

[Corey]

Right now at least things aren't being enforced like you can use Copilot in Europe. You can use Google AI or Claude or whatever in Europe. The reason why you can is because right now these companies are being treated just as normal like any other application. They're being treated as like if, if you're, you know, on any other app they, you know, don't use customer data for training. They, they handle it's all EU data residency, whatever it is. Deepseek wasn't willing to comply with any of that stuff, which isn't super surprising. But long term like Bronwyn's alluding to, we'll see if there's any special legislation or things on AI specifically that make it it kind of not feasible to use in Europe. That's a big question right now.

[Bronwyn]

It's only a matter of time.

[Corey]

There were some interesting other ones. There was the prompt injection AI paper or in academic papers. I thought that was. We kind of briefly touched on that.

[Wade]

The Call of Duty one was kind of not groundbreaking but interesting. Right. Old Call of Duty game has something you didn't see it under Microsoft pretty much Call of duty, World War II, pretty old game, like eight years old. People started claiming that anytime they downloaded and played it they started getting hacked.

[Corey]

Huh.

[Wade]

Come to find out.

[Corey]

So it's like a supply chain gamer attack type of deal.

[Wade]

I think there's an RCE in the actual client. I don't think the actual game is probably malicious.

[Corey]

So there's some people scanning Shodan looking for this port to open up and when it does they pop it.

[Wade]

Yep. Possibly leak into the ip right. Or something in the actual.

[John Strand]

We have a video game that's exposing a service to the open Internet. Don't play that video game.

[Corey]

Have you ever heard of Universal plug and play? If so nightmares.

[Wade]

How many people check their video games to see if they open sports.

[Corey]

All right, well just trying to trick that. Don't allow UPNP man. Come on.

[Wade]

How am I going to pwn noobs.

[Corey]

All right, slower. You're going to. I will say these newer games have relaying. Newer games do have like relaying capability. Right. But these older games, they were just raw dogging on the Internet like they didn't have relaying capabilities like image. I didn't need it. Well Imagine you're trying to play call of duty and some dude's just sending buffer overflows to you.

[John Strand]

Oh, God. That brings.

[Corey]

Imagine. Imagine you're in a game and you're like 1v1B and the person's like, just RCE just like gossing it up. They're not even going to shoot you in the game. They're just going to take over your.

[Wade]

They're just running around hiding while they steal your bitcoin.

[John Strand]

Pretty much the video game to me at that point. All right, guys, we got to wrap it up. I'm not going to last too much longer. I want to say thanks, John. Hey. Hey, bhis. We do hacking. We prevent hacking. We train you on hacking and defense. All your hacking dates.

[Wade]

I have small plug. I have small plug.

[John Strand]

Oh, here we go.

[Corey]

Here we go.

[Wade]

Death con is going on. Detection, engineering and threat hunting Tickets have now opened for both virtual and on site tickets. Right now, the only socal on site is here in San Diego, ran by me. Tickets will probably go out pretty quick, but if you're looking into any type of detection engineering labs and stuff like that, it's literally for beginners to experts highly suggest it.

[Corey]

All right, buddy. All right, thanks, everyone.

[John Strand]

Take care.

[Corey]

Bye Bye.

[Wade]

Sam.