Loading summary

Transcript248 lines

[00:01]
A
Thank you for attending another webcast edition of bhis. Talking about news as always, we are joined by Monopixel, Dale, myself Ralph and Ryan the shootist. We have some interesting stories. Today we'll be talking about ransomware because I promised that we wouldn't. But now here we are talking about ransomware.
[00:19]
B
We're going to be talking the name of the show, I guess.
[00:22]
A
Yeah, it's just talking about ransomware.
[00:24]
C
Talking about ransomware.
[00:25]
A
Talking about ransomware. To be talking about Texas moms pretending to be 13 year old girls, which is what I thought that a lot of moms were trying to do anyway by. By listening to a lot of SoundCloud rap. And then we'll talking about ransomware and containers and whether or not password managers are safe. So, Ryan, do you want to take us into the intro?
[00:43]
C
S.
[01:00]
A
I'm in a different studio today because that's what I do is I go to different studios, but all of my gear is on its way to Wild West Hacking Fest in Reno or Way West Hacking Fest. So I have to use the backup. Backup backup studio, which is the office upstairs. And yes, I have no ceiling and I'm perfectly aware of that. I appreciate it. What is the first news story that we have for the day? What do we want to talk about here, guys?
[01:24]
C
Here we go.
[01:25]
A
So start off, Ryan, do you want to tell us a little bit about the reason why you want to throw this one in? Because I disagreed and you had a point. I'm like, you know what? He's right. He's right.
[01:33]
B
Well, it reminded me of some Darknet Diaries episode I heard once upon a time about, you know, breaking into physical locations. And it occurred to me reading this article that this woman was physically pen testing this school. She just did not have authorization to do so.
[01:54]
So maybe she has a future career change in mind.
[01:57]
A
I don't know.
[01:58]
B
But I just thought. I thought it was kind of a funny story just because of that angle.
[02:02]
A
So. And that was the reason whenever you brought that up, I was like, that's probably a really good point as just kind of a point of reference to anybody that's listening to this and they're thinking, you know, what I want to do is I want to hack someplace to prove it's insecure or I want to break into someplace to prove it's insecure. Don't do that if you don't have permission. It's called trespassing. And that is illegal, even though the point itself may be valid. And somebody once explained it to me, me, for like physical pen testing. If you're like, well, I just wanted to prove that I could get there. How would you feel if somebody just showed up into your house and started walking around? It's always possible to gain ingress in most places, right? It is. You can come in through a window, you can come in through doors. Locks are not that hard to bypass. I'm not talking about picking, I'm talking about kicking them open. There's a number of ways that you can actually gain access to places. And the point is, it doesn't prove anything at all. And the quote on this one that I hate is the but the children quote. You know, this is about our children and the safety of our children. That's all I'm trying to do is prevent another mass shooting. She didn't prove anything. And that also gets into like the idea of a threat model. As much as I hate that phrase in the industry, you cannot develop a threat model that can deal with somebody that's showing up with like semi automatic weapons and pipe bombs and things like that. There's always going to be damage that's going to be done. You can set up proper reactions. You can do a number of different things. But in what possible scenario would the school have enough security to actually stop someone who's heavily armed from entering and creating some level of damage? So really she didn't prove anything other than she's just kind of. Kind of dumb, I guess. So what are you guys thoughts on this?
[03:40]
D
The part I found interesting with this one is that it's not like she was in there for like 10 minutes or 15 minutes. No, she was in there for like the entire day. And she actually said hi to the principal, I believe, talked to some of the teachers. She was scolded by one of the teachers for using her phone in class. So it's not like it was a short term thing where the security guard caught her 20ft away after she entered the door. This was an entire school desk.
[04:02]
C
So she did this just to prove the point that she could.
[04:05]
A
Yeah, that she could walk in basically.
[04:07]
C
All right, yeah. Cool, cool. That's about as far as that goes. Right. If we all just took that and be like, I wonder if I could do this, we'd all be in jail for something. That was a stupid idea.
[04:18]
A
Yeah.
[04:19]
E
Realistically, being from Iowa, even if you are authorized, apparently you can sometimes possibly wind up in jail for breaking into buildings even with proper authorization. So you definitely don't want to be doing it without proper authorization.
[04:32]
A
The thing that I'm Wondering is. Let's say it went different. Let's say that she was walking around the school and they called in a tactical SWAT team to tackle her, like, handcuff her, drag her out of the building. Would she have been, like, showed up in court or been interviewed and been like, you know what I went through? And I was testing the school security, and I just want to say really good. Really good. Good job, guys. I was. I was impressed. No, this strikes me as the type of person that, if that happened, would be like, oh, this is police brutality and abuse of power.
[05:09]
It just. Yeah, it just sounds like that this is someone who is looking for attention and she got it, and we're giving it to her.
[05:15]
C
I always think it's interesting, too, because when you are doing assessments and you do find something that's, like, egregious or bad, you're like, oh, I can't believe this. How could they, Right? This is ridiculous. And then when you are doing something and they did something right, you're like, oh, okay. Well, I guess that's just one thing they did right. You know, like, you tend to, like, highlight the things that they're doing wrong and quietly remember the things they're doing right. And, you know, sometimes I have to catch myself in those moments. Like, no, no. That really is something that I should be talking about or, like, emphasizing, like, this is. You should continue this road as opposed to just looking at stuff and just being like, I can't believe you did that right then. That's your point about, like, her, how she would respond. She'd be like, well, I was still able to get in, even though they tackled me and beat me up.
[05:54]
A
Because she's got to find a win situation. Yeah.
[05:56]
C
She's got to find a fallback.
[05:58]
A
Yeah. You know, this is what I was trying to do. I don't know. I just think that it sounds like a bad movie with Zac Efron or something. Lindsay Lohan in.
[06:10]
Done by Disney. And Jack. Jack Black brings us all together with song at the end. And we.
[06:15]
C
Let's.
[06:16]
A
Let's pass on this story and never talk of this lady again.
[06:19]
C
I think you should totally be in charge of casting for that movie, though. You got it.
[06:23]
A
I've got the cast already. We're set up. We're set up. You know.
[06:26]
C
Awesome.
[06:26]
A
So how about we do the world's first malware targeting Windows containers? I don't know who put this one together.
[06:32]
C
Oh, containers are bad. Don't use them. Everyone just let go. Just. We.
[06:36]
E
It's.
[06:36]
C
It's All. It's all bad.
[06:38]
A
Oh, do tell.
[06:40]
E
Bare metal is the only way to go.
[06:42]
C
Yeah. No, I mean containers are coming, right? And whether you want to accept that or not, I think it's irrelevant. Right? There's a lot of use and demand to put containers in environments and continuous integration and DevOps and all this other fun stuff. So they're here. But how you do that and how fast and how it affects security is going to be a continual cycle, Right? It looks like in this article is about kubernetes and the fact that they're running containers on Windows and then being able to gain access to the host os. I mean, everyone, if you don't know when you're running a container, it's just kind of like an isolated process. Like it's not really. It's not a security construct, okay? This isn't, you know, running in a container is not how you secure things, okay. This is actually just how you manage operating or software dependencies. Think of it like that, like containers aren't security, they're just to help you run software dependencies and allow you to work around that. Now, you can implement some things, but if you. We all have to get around this idea that containers create security, they don't.
[07:44]
A
The other thing that's interesting for me on this one is step one is the attacker achieves remote code execution through a vulnerability, right? So it's not that. The point of the story isn't that these vulnerabilities exist, because we know that they exist. The point of this story is to basically articulate a lot of the code execution and impersonating other services, establishing command and control, basically going through and checking compromised nodes, checking the privileges. A lot of the things that we would normally do are also present in containers. And I think that that kind of speaks to what you were just talking about, Ralph, where people think if they just move to the cloud, they're secure. And we've seen this again and again. People were like, well, we're going to run Linux and we're magically secure, right? It's like somehow they believe that just by adopting a specific technology, be it cloud, be it container, be it Linux, be it virtualization, all the way back to using a fricking firewall. Every time something like this comes up, the entire industry says, well, this is the way forward and this is what we need to do for security. And I mean, even all the way from Biden and the White House released a statement talking about computer security in the government and where we need to go. They were really big on Zero Trust and they were really big on cloud. Both of which are things that I absolutely agree with. But I don't think that those things are secure just in and of themselves. Like, you actually have to have a plan. You need to have the technology, need to have the architecture, need to have the process and procedures to support that, to actually make it secure. So kick it back over.
[09:17]
E
Yeah. And I would also say you have to know how to properly configure it.
[09:20]
C
I mean, with.
[09:21]
E
With my experience of Kubernetes, I mean, one of the most common vulnerabilities that I've seen and I don't pen test Kubernetes clusters much, full disclosure.
[09:31]
I've tried to set them up and then I try to break them, but most of the time the stuff I see is just stuff saying, oh, it was poorly configured from the get go, and this says it right there in that second paragraph, that its main goal is to go through poorly configured Kubernetes clusters. So configuration is big. I mean, it goes to the cloud as well. If you don't actually know how to configure your cloud services, you have no business being in the cloud right now.
[09:55]
C
Yeah, Kubernetes is a monster. Right. It is a complex machine that you really have to dive in and understand how it's working to properly secure it. If you don't know how it works, you can't secure it. That's how that works. Right. It's big. It has a lot of interfaces, the web management interface, all of this stuff. The other thing too, with just Docker containers in general, most of them run as root. The user is ran as root. That's how they design the container. Because it was the simplest way to make sure it had the permissions on the file system you share. I mean, that's another way too that you break out quickly out of Docker container is that your. The container process has the ability to write some files to a folder as the user root. Right. So it's just. I mean, there's a lot of that.
[10:40]
A
But yeah, Yep, absolutely. Okay. Is it. Is it time for the. The show to transition to ransomware?
[10:48]
C
And that's it. That's the whole show?
[10:49]
A
That's the whole show. We're done. Oh, my God.
[10:52]
C
This isn't even the only one too, that's happened recently.
[10:54]
A
No, no, there's so many. And that's why we're doing an emergency webcast on this tomorrow. I kind of want to talk about how we got to the place that we're at and who we can actually blame. Hint, it's going to be management.
[11:08]
But there's. There's a bunch of things like, I can't remember who got. There's like a Japanese company, and then you had the JBS Foods. And then there was another company that just got hit today. And news stations, News stations are getting hit. And then now they're going after schools to the chagrin of hardly anybody. Like, kids are like, school shut down because of ransomware.
[11:28]
C
Okay, cool. And they're like, you owe us somewhere. Yeah, you owe us millions of dollars. Like, we could hardly afford the teachers. Dude, come on. What do you want from us?
[11:36]
E
All right. She guys here on Tuesdays and Thursdays.
[11:39]
C
Yeah, exactly.
[11:42]
So.
[11:43]
A
So this is interesting, this threat post article, because they're talking about the Revil, or Revil Weevil, whatever. Ransomware re evil. But there's. We're missing an E there.
[11:56]
C
I know, I know.
[11:57]
A
And basically they were talking about their kind of thoughts on the state of ransomware as it exists today.
[12:03]
E
Right.
[12:04]
A
So with this, you. You know, they're talking about the recent attack impacting JBS Foods was originally directed at a Brazilian entity. And I think for any of us that do pen testing, we're like, yeah, yeah, we totally. We totally can see how that would happen. You know, where you exploit one organization and then you end up in another organization. Because all these organizations are connected. So.
[12:24]
C
But it.
[12:24]
E
That's.
[12:25]
A
That's kind of funny, you know, a ransomware group and like, yeah, we didn't originally go after these guys, but it just fell in our lap.
[12:30]
C
It was a Bogo event. Right?
[12:31]
A
It was Bogo.
[12:36]
They also don't know why the United States has intervened in this case, which I think is hilarious. You know, they're sitting around, why. Why are governments getting involved with our illegal activities? This is a mystery to us.
[12:47]
C
I don't understand. This is a job.
[12:50]
A
I think that that's because they're Russians and. And I think that they're used to the mafia getting involved. So, you know, if you're from Revil, just so you know. You know, for you, it's the mafia. For us, it's the FBI. So just letting you know how that kind of works out. So hopefully it'll be like, oh, yes, I get it. There we go.
[13:08]
C
The Mafia got involved.
[13:09]
A
Now they were talking about U.S. legislation, and there's a number of states and lawmakers that are talking about trying to pass laws that would restrict ransomware victims from paying the ransom.
[13:22]
I kind of think that that's a bad idea. I would like to get you guys all opinion on this because, you know, the conventional wisdom for ransomware is you should never pay the ransom because you're just going to make the problem worse. And it's like, yes, so my company is just going to roll over, go out of business, and I'm just going to go to my dying hole and die for the greater good.
[13:45]
C
So.
[13:45]
A
And I like their approach was it's not going to stop the attackers, right. They're not gonna be like, well, they passed the law, so we're not going to attack the United States anymore. Because what you're going to have at that point is a lot of organizations that quietly, hey. And that's going to shove this whole issue underground again. So I don't know, what are you guys thoughts on this too?
[14:04]
C
That's a sticky question because I think you just brought up all the points, right? Like that it would cause people to go underground and to pay. If you had this law, it's obviously, businesses want to stay alive. That is their goal. So if paying the ransom allows them to continue to operate, you know, obviously that's something that is in their best interest. Right. Like they're weighing their pros and cons.
[14:27]
B
And how fast can they get back if they hear the reward, if they.
[14:31]
C
Yeah, but on the flip side, right, the other side of that, I kind of feel like, well, if we just stop paying them, then the business model stack starts to really suffer. And, you know, you don't have people devoting what they think as a career and building ransomware. Right.
[14:47]
A
But if you look at. But if you look at the history of this, the idea of protection rackets, like in the 50s in New York City comes in is like, this is a really nice bakery. It'd be a shame if somebody were to come in here and mess it up. Yeah, yeah. That this has been a racket that has been around for literally a couple of thousand years. Right. I mean, it's just a new variation of it, and you can absolutely make it illegal all that you want, but it's not actually going to solve that problem. I really wish the attackers would go back to just crypto mining.
[15:19]
E
Yeah.
[15:19]
C
No, I mean, you're totally right, though. Like, making it illegal is not going to stop it. And I don't believe that in any way, shape or form. It's. It's just not going to stop the attacks. Right. I honestly feel like paying them is the wrong idea too. But I totally understand when you're in that moment, you're like, well, I woulda, shoulda, coulda. But right now I have one decision, and that is how do I get out of this situation?
[15:40]
D
From a business owner standpoint, if you're hit with ransomware and you're faced with do I, you know, do I break the law and pay the ransomware? Now, who's holding me ransom here? Is it the business, the company who, or, sorry, the, the, the criminals who are trying to get ransom from me, or is it my own government who's saying, I can't pay this? Either way, I'm out of business?
[15:59]
E
Yeah, it just creates the rock in the hard place.
[16:03]
A
Yeah, it's like, and there's awesome president in governments setting up laws to punish victims. That always works. Every, every single time. Good history on that too. But no, I don't think that there's a clean answer for this. Right. Other than organizations starting to secure their crap. And, and I think with the heart of a lot of ransomware attacks, you're going to see a consistent theme where every organization has security vulnerabilities. Right. But you're going to see a certain theme where some of the vulnerabilities the attackers are taking advantage of are relatively easy vulnerabilities to take care of. And that's going to be one of the things I'm going to talk about on the webcast tomorrow is why is it that you have organizations that we do pen tests for year after year after year after year where we go in and we're like, hey, you know, you got a seven character password and it's bad. And they're like, well, PCI tells us it's okay. We come back the next year, it's like still bad. Actually worse than it was the year before. Or if you look at organizations that have old out of date software or all of these different things that we talk about, like the intro class using two factor authentication, long, strong passwords. A lot of these aren't rocket science to take care of. So what is the reticence? Why do you get the pushback in organizations for that?
[17:18]
C
Maybe as well, Maybe this will be the, you know, the push that people need to actually fix it. I mean, because us telling obviously is not enough sometimes. Right?
[17:30]
A
And I agree with you. You know what? I absolutely agree with you. I, I think that the ransomware is going to be the push. It's going to be the kick that.
[17:36]
C
Organizations needed because it's either this change that password policy, for example. Right. Or go out of business possibly like that. That's kind of like A, you know.
[17:47]
A
But a lot of times they're buying. They're buying into the third option, which is they can buy themselves security, right? So if you. If you look at the industry as a whole, and I'm kind of talking about, I guess the webcast is on Wednesday, if you look at the industry as a whole, you have all these different competing factions trying to get attention and trying to get money, right? So if you're looking at an executive and that executive is looking at all these options and who's telling them their options? You have their security team, which is a bunch of tech geeks wearing black T shirts and jeans, and they use weird phrases all the time like, you know, you know, link local multicast name resolution. They talk about metasploit and they talk about all these different types of vulnerabilities and what the hell is a kubernetes anyway? And then you have the idea that, well, here's a company, a salesman shows up and he's wearing the same suit I do, the same shoes I do, the same watch I do, and telling me, hey, we can actually secure your entire organization for just a low, low price of hundreds of thousands of dollars per year. You're going to gravitate towards those people because they're selling you an easy solution, snake oil in some situations, sometimes it's not. And they look and act and walk like you do. So that's kind of where you're going to gravitate towards. That's the way it's been for a long time, I think with ransomware. We're now seeing that hit where they're like, well, I bought the shiny object from the guy that had the Maserati and it didn't work. Maybe I need to listen to the geeks. And I want you all, if you're listening to this. This webcast, I want you all to think about it. Listening to you, it security people is their last possible choice that they want to choose.
[19:19]
C
Really don't like him, because heaven forbid.
[19:22]
D
The guys who operate and build the.
[19:24]
B
Stuff should know what they're doing, know what they're doing, right?
[19:27]
D
And in some cases they don't, but clearly.
[19:29]
E
But, well.
[19:32]
A
And Dale, you've been part of this, right? I mean, you've been right in the belly of the beast where you have this new technology that's foisted upon you, where they're like, dale, we need to secure this by next week. You're like, why did. Why didn't you talk to me before this? You know, we've had These conversations.
[19:48]
E
Yeah.
[19:48]
D
I've not experienced that more than once or twice a month.
[19:52]
A
For years. Right.
[19:54]
C
Well.
[19:54]
E
And then after that, you have to hire a consultant to come in and say it, so that way they'll listen to you.
[20:01]
C
Well, look to the bright side, guys. This would be the last ransomware we have to talk about. You know, this is it.
[20:05]
A
Yeah, that's true for this week.
[20:07]
E
Yeah.
[20:08]
D
There's a moratorium. There's no more ransomware after this week.
[20:10]
A
I'm solving this on Wednesday, by the way. Yeah. It's going to take me two webcasts, but I'm going to nail this thing down. We've got solutions to all these things, but, folks, I have to jump off. I've, you know.
[20:22]
C
All right.
[20:22]
A
Car accidents and things like that that I got to help take care of. So you guys carry on without me.
[20:27]
C
We will carry the torch. John.
[20:31]
B
Catch you later.
[20:32]
C
All right, Later, John.
[20:34]
B
I thought it was just going to walk off screen and leave the camera running.
[20:37]
C
Yeah, just like.
[20:39]
Takes his mic off the stand and drops it.
[20:42]
B
There we go.
[20:43]
D
I for sure thought he was going to do the down into the basement thing.
[20:46]
C
Yeah.
[20:48]
D
Room with no ceiling.
[20:50]
B
We have to make that a requirement next time we. Anybody tags off the webcast mid show, we gotta walk down the stairs.
[20:59]
Okay, maybe not.
[21:00]
C
All right, no more ransomware. It's been solved.
[21:03]
A
Here we go.
[21:04]
E
I do want to say just real quick.
[21:07]
B
Okay. Bringing it back. I'm sorry, we can't just get away from the ransomware. Every time we try, they bring us back in.
[21:15]
E
It just. It just. The one thing that grates against me with this whole thing is this is also. This conversation could also be applied to your phishing testing as well. Just a little bit. I mean, if you management are watching this and you're saying, like, oh, this isn't fair. If they do this, I might have to consider going underground and not telling people. If you're one of those people who, like, forces your employees to do terrible things after they fail a phishing assessment, you're just as bad. This is. This is the exact same conversation in that sense. I've always been more of a believer that you reward the employees that do well versus punish the employees that don't do as well.
[21:51]
A
Anyhow, I'm done.
[21:52]
D
Think about, like, training a dog. You reward the good behavior and ignore the bad.
[21:56]
C
Well, don't ignore it.
[21:57]
E
Or you make a mean dog by beating it every time it does something bad.
[22:02]
C
And then that.
[22:02]
E
That gets a mean dog who doesn't like you. And that's what happens. So, yeah, that's all. I just had to get that off my chest so we can go to the next step.
[22:10]
D
And realistically, if you just keep punishing them, eventually they just don't tell you about it anymore.
[22:13]
C
Right.
[22:17]
E
Just saying, like in this one instance, the management's kind of getting a taste of that medicine. And if you're one of those managers or one of those people writing those policies, don't do that. It's not good.
[22:27]
B
Van Buren. Who knows about Van Buren, But I.
[22:30]
D
Had another thought about the ransomware.
[22:32]
B
Oh, of course, of course. Van Buren is a victory against overboard interpretations of the CFAA and protect security researchers. So we had a little bit of a discussion about this earlier. Who wants to re summarize that?
[22:48]
C
I think this is about the exceeding authorized access in the Computer Fraud and Abuse Act.
[22:55]
B
Get your hand out of your face.
[22:56]
C
Yes. Can't hear you. Sorry.
[23:00]
Yeah. So this gets down to kind of the sticky of security researching and stuff like that and how that gets put up in the law. Right. And how it gets interpreted and whether we're allowed to do it or not because we got access or not or what.
[23:17]
B
That's sort of related to the Texas lady in a way. In the roundabout way, in a way, kind of.
[23:25]
C
Yeah, yeah.
[23:27]
B
It really.
[23:28]
E
It sums up to just like how, like I said, in some senses, even if you have all the law on your side and you're doing a physical test, like, you don't you want to make sure you have the law on your side and in this case, like, helping spell out where the law is. And I'm telling you, you don't want to ride up, like, right on the edge of this line because that line.
[23:46]
C
Still is very gray.
[23:48]
B
So get all the lawyers involved if you have to.
[23:52]
E
If you have to.
[23:53]
C
Yeah. I think we're going to keep going back and forth on this. And it sounds like in the article that there was some wins here, wasn't all bad. But the idea of how we sum up what we can and can't do and whether that was authorized and stuff like that. And I think as the years have gone by and more of this is more security researching, more vulnerabilities, more ransomware, all this other stuff. Right. How we define that law, where the line is. Right. And who's allowed to do it and how I think is we're going to see more of that. Right. The EFF is obviously kind of at the forefront of some of this stuff. Right. So pushing for these legislations.
[24:32]
E
Yeah. And I think also if you ever find yourself on the wrong side of that line, you can actually contact the EFF and they'll help you get a lawyer. So just as a note.
[24:41]
C
Yeah, for sure.
[24:43]
B
Microsoft is getting better security as they should end to end encryption for voice calls.
[24:51]
C
This was like my first thing that I hated about teams when it first came out. I was like, there's no end to end encryption. It's just like it's wide open. It's just. I mean, it's Skype but in an electron app. Really.
[25:03]
B
But it's Skype but different.
[25:06]
C
Yeah, it's Skype, but very different. Skype never left though. I'm immediately going to go up and just say like, how much encryption did we get here? I know Zoom kind of gotten caught up, caught up in that one about end to end encrypted and stuff. But all of our chat platforms should be moving to some kind of end to end encrypted. That should be their goal. Right. That's the ultimate kind of at least, you know, getting to some level of privacy where you're not just saying we are a secure company who does regular security test. And that's why you should trust us.
[25:41]
E
Right.
[25:41]
C
You know, encryption we. In encryption we trust kind of thing. Yeah. End to end encrypted is probably like the first thing you should be doing. And then there's a lot of other. I mean, we have a bunch of other chat platforms that have came out and you know, like Keybase is one that does end in encrypted and that was from the very Get Go Telegram. Even though I kind of not totally trust their rolling their own crypto type thing. But still it's out there. But yeah, a lot of the platforms have moved to this, so it's not surprising that Microsoft would be moving to that. But yeah. What do you guys think?
[26:13]
E
I just think it's funny. I had it in a time where I was talking to someone, they're like, oh no, we're going to leave Zoom because they don't have end to end encryption. We're going to go to Teams because they just. There's like a large number of people who thought teams already had this technology.
[26:28]
C
SSL is not end to end encryption. That's not how that works. Okay.
[26:34]
E
For those who don't know, yeah, like.
[26:37]
C
Ssl, it's just a bulk. Like SSL is just bulk encryption of the traffic and has nothing to do with the message inside. Meaning all of the message inside can be read by.
[26:48]
The service provider you're using. They can read all your messages, mine them, do whatever the hell they want with them, make them endlessly searching. I'll give you a couple examples, like the prime examples of those that are doing this right now. Slack, for example, Discord is another one. None of that stuff you should ever send any like, or expect any level of necessarily privacy from those platforms. I'm not saying that they're bad or they're out to get you. I'm just saying that all of that is searchable by their platform and they can use that for whatever you, whatever they want. And think about it, both of those platforms are pretty much free until you get into like large groups or large amounts of traffic. Right.
[27:26]
E
That's.
[27:26]
B
No, that's kind of a feature of the platform too, is that you can search back the history. So.
[27:33]
C
Yes, yes.
[27:34]
B
And if you don't want to, you know, kick the dead horse sort of things, you can go see if anybody else is talking about it.
[27:40]
A
It's like.
[27:40]
B
And catch yourself up.
[27:42]
C
Yeah. There is a real use for public conversation. Right?
[27:48]
B
Yeah.
[27:48]
C
Everything doesn't need to be like, you know, when we, when we communicate. Right. You know, some of that is meant to be in the public. I, I said this and I will share it with anybody who wants to read it. Please, you know, reply to me and you can share your message with anyone else who wants to read it. There is a place for that and there is a very good use for it. There's other communication though, that you expect or would hope that you have some level of privacy in.
[28:12]
E
Yeah.
[28:12]
B
So you just got to be smart about what you say in what channel.
[28:17]
C
Yeah.
[28:17]
B
And also common sense sort of thing.
[28:20]
C
Yeah. In the end to end encrypted platforms like Keybase and other ones, you can pretty much still search those platforms because you can decrypt all the messages that were sent to you because you shared the key and so on and so forth. So, you know, there is still search in those platforms. So encryption does not mean the end of search. But I will admit that it does complex or make, make it more complex to implement some of those things or to do some of the other things like predictive or like, you know, how it predicts what you might be doing or, you know, other kinds of AI. I'm going to use in air quotes here.
[28:51]
B
Bots, you know.
[28:52]
C
Yeah, bots. Yeah. So in Keybase, the way that they did bots is that bots can only see messages once they get keyword that the bot would get interacted off of. Right. All the other messages, it actually can't decrypt. So then that way a third party can create a bot and you know, it actually can't see any of the chat except for when it's been flagged.
[29:10]
D
So before everyone goes and gets too excited about it, there is a couple caveats with this. Implement with teams implementation of this as well. First one being that it's only for one to one voice calls. So no calls, no video calls. And also the other thing is if you're, if you're running teams, like the web version of teams, it's not Cryptid. It's only available on desktop, mobile, iOS and Android. As of right now. Well, as of when they roll it out later.
[29:36]
A
July.
[29:36]
C
July, yeah, yeah, that's usually how it goes. As soon as they have, they're like Indian encrypted, only for one to one phone calls, only for one to one messages and that, you know. Yeah.
[29:47]
D
And the example they gave in one of the many articles about it was specifically for when it folks are sharing passwords with users. Sharing their default password or whatever. Which is great, but surely there's other ways you can get them their password than sending it over at chat.
[30:06]
B
Like email.
[30:07]
C
Yeah. The only way you send sensitive information now is only through email.
[30:11]
B
It's through email.
[30:11]
C
Yeah. It's like faxes, very secure.
[30:14]
B
Only a fax might be very secure.
[30:16]
E
Right now if I want to send something super encrypted, I'll send it PGP over carrier pigeon.
[30:22]
C
Yeah, there you go. One time pass, man. One time pass. You can't crack me, hack me.
[30:27]
E
You have to intercept my carrier pigeon first.
[30:29]
B
Speaking of passwords.
[30:31]
C
Oh, yes.
[30:33]
B
Post or whatever it is about password manager.
[30:36]
A
Yeah.
[30:36]
C
So this is. Yeah, so.
[30:40]
Tavis wrote a R in there. No, there is not wrote a blog about password managers. And so I have a sneaky suspicion that he's probably doing some research on password managers and kind of wanted to get it out there. His opinion on it. He kind of goes over, you know, one of his big things is that he hates it when people. One of the. One of the most popular things to say is hey, you know, just get a password manager. And he kind of goes into the fact that that's kind of like a broad statement and it doesn't necessarily cover all the angles. He also gets into a lot of the browser implementations of password managers and how they kind of break sandboxing and other things like that. The too long didn't read would be that he recommends that you just use the password manager that is built in something like Chrome or Firefox. As opposed to a third party password manager. And you know, one of his other big gripes is that obviously anyone who could compromise that company or any of the servers in between there, they would be able to read your passwords. Right? How much of that comes out to be true? This is kind of going back and forth and then the bigger question that goes along with this is when a lot of people say, hey, you should be using a password manager, I think what they really mean to say is stop using the same password. But his point is that some of these password managers don't necessarily bring as much security as you may think.
[32:08]
D
I guess the beef I would have with this is that one of the allures of a password manager, like you said, is not so much just about making sure people aren't using the same password, but being able to synchronize those across multiple devices. So if I've got a 26 character password of random letters and numbers on my computer, that's all great, but when I gotta type that into my phone, that's a pain in the ass. Which is where the password manager really.
[32:29]
B
On your TV helps.
[32:32]
D
And that's where one of the areas where the password manager really comes into play. I mean it's multi feature multifaceted I guess. But I can see where it's coming from though. But there's got to be a usability factor.
[32:43]
E
Yeah, I do. Question is, what if this still applies when considering. Okay, so let's say I use Chrome, Chrome's built in password storage and I link that to my Gmail account and then I sign into that from my Android phone. Is that still considered better than using something like LastPass or something like that?
[33:02]
C
In the article he says that they have better security teams. Pretty much. She was saying browser implementations are better. The other thing is that they don't break any of the sandboxing models, which extensions kind of do. In the sense of how the cities password managers work. They do break out of the sandbox. It's not, it's, it's interesting. It's a pretty short blog for the statements that he's making. I'm pretty sure that he also probably has some vulnerabilities that he is going to either release or disclose with some of these password managers.
[33:37]
B
He's leading up to something then.
[33:39]
C
That's, that's my guess. I mean maybe he doesn't, maybe he doesn't want to go through this disclosure process because it's a pain in the butt and I'm sure he does it all the Time, I don't know if he necessarily was out to kick down password managers. I think he was just trying to talk like general, that they're not the end all be all from security and that they can have some of their own vulnerabilities as well. We all tend to kind of think, and I know me personally, that it's still good to use a password manager because of all the other benefits like you said, the syncing, all the. A lot of those things and in any security model there's no 100%, you know, certain and all this other stuff. In addition, in any of those like password manager models, anything that's very secure, you should also be using some other type of authentication. So that two factor authentication model where you're using some not cellular based but. Or when I say not cellular, not SMS based but some other kind of authenticator app on your phone to get push notifications, other things like that, that kind of helps to alleviate some of that. But I don't know. It's tough, right?
[34:38]
E
I like the conversation piece for sure. My biggest thought is that I just don't. I question, I question it a little bit and solely for this one scenario, I guess. But. So let's say I use Chrome with my. And I link it with my Google account and then I linked out my Android phone and I also use Google single sign on to TikTok and authorize OAuth tokens to my Google account and then I do that for everything else that will let me use a Google+OAuth token. Like is it really more secure at that point? Like I don't, I find that harder to believe. I don't feel like people are super secure with their Gmail in general, if that makes sense. Like I feel like that. Like the nice thing I can say is that to an extent if I know someone's using a password manager, that account is usually separated in a sense. Yeah. And by the way. What? I don't actually use TikTok. That was just the first thing that came to my mind.
[35:33]
C
Forget password managers, you use TikTok.
[35:36]
E
This conversation is digressed.
[35:40]
C
How old are you? Jesus.
[35:41]
E
No, I'm 12 actually.
[35:44]
C
Yeah. Yeah. Let me show me your TikTok dance you've been working on, man.
[35:49]
B
It's actually a great way to share some security tips and get an audience to be on TikTok.
[35:55]
C
Yeah.
[35:56]
B
That's so hot right now.
[35:58]
C
That's. That sounds like a dumpster fire. But.
[36:03]
Gosh.
[36:03]
E
First security tip for those on TikTok, stop using TikTok.
[36:06]
B
Yeah, there you go.
[36:07]
C
Don't do that. He did say in the article that he still recommended things like Keepass and Keepass X, which I thought is super funny when I read that because. All right, so check this out. One thing that I've done on plenty assessments is that there are a couple different public frameworks for extracting the master key from keepass. Right. And the thing is, this is actually not anything to do with keepass particularly, but whenever you unlock one of your password vaults, the key to unlock that vault is in memory. If you know where it is in memory, you can extract that and then you can use that to gain back access to that keepass. Right. And so a lot of engagements I'd be on, I'd find someone who was using keepass, I'd wait for them to open it, I would extract the key from memory, and then I would download the Keepass file and get access to all their passwords. Right. Because it's on disk and all this other fun stuff. So it really does depend on your threat model. What I did think was funny is that some of the other password managers, like One Pass, lastpass and other stuff like that, there's not any public ways to extract the key. Even though I'm not saying you couldn't do it. And in fact, functionally, I'm sure you could. I just thought it was funny because keepass has a pretty big public one because of the way it functions and the way that, you know, the passwords are saved onto a disk and, you know, being able to stretch it from memory.
[37:28]
E
Yeah.
[37:29]
C
What's your. What's your threat model, man?
[37:31]
E
Both of those, actually. You can exploit DP API and get the key out of them.
[37:36]
C
Oh, yeah, Chrome. You could just extract all the passwords out of Chrome, like just straight in memory. So what is your threat model? Right. Is it someone on your system? Is that what you're protecting against? Because does using the browser password manager protect you from someone compromising your system? System. Right. And extracting it from memory? It does not. I can tell you that for a fact. But that's not what this was about. Right. And so where are you down the line? Like, how screwed are you? And how would they continue on? And I don't know if necessarily the Chrome one would help you that much more.
[38:09]
E
Yeah, there's a point in which you just start writing all your passwords in a little book and against your side locked in a box.
[38:15]
C
Yeah. And that's also when we want to talk about password managers and just passwords in General, that's when we started. That's why we use a lot of authentication one time authentication systems, the second factor, the third factor, whatever, so that we can control that in a time period. So it's not like you get this and then you have access forever. So. And that's why those authentication methods work or, you know, are implemented so that you can that password can be compromised but still not allow for immediate access. Right. I keep all my passwords in Excel, but I password protect it with super Secret password. It's password1. But this is not important for everyone who wants to just either rament about the fact that you write your passwords on a notepad or be upset that you use a password manager and Tavis doesn't approve. Go read that article.
[39:04]
B
And that's the last leak we got.
[39:06]
C
Oh, that is it.
[39:08]
B
Do we want to add anything?
[39:10]
C
Oh, no, I didn't have anything else. Did you guys have anything else you want to talk about? More ransomware, possibly. Just to really drive it home, I guess.
[39:17]
E
One thing to say about Excel is I once knew a guy who protected his Excel document full of passwords by spelling password backwards and storing it as that. So there's a cool trick for those who don't know.
[39:29]
C
Oh, yeah, yeah. Keyboard logs. Yeah. I was on engagement once speaking of Excel, and they had like sent some Excel document to each other via email and we got access to that Excel document and they had password protected it. Dude, I threw Hashcat at the thing for like a week, dude. And I still couldn't get that password, man. So I have no idea what they did. But it was good. I have like 10 billion password word lists, right? And then with permutations and rules and all the other stuff, I have no idea how many guesses I made at that. But anyways, it works.
[40:01]
E
Maybe that was your problem, though. Maybe you had too many passwords and the password was really just password1, which is @ the bottom of your.
[40:06]
C
List. No, trust me, I tried that one. Probably all permutations of password1.
[40:12]
All right, well, if that is it, thank you everybody for joining us for Black Girls Information Security. Talking about news and we'll be back on.
[40:22]
B
Monday. No, we.
[40:23]
C
Won'T. Whoa. Oh, we keep switching it up. So it's just like.
[40:27]
B
Roulette. Next week is.
[40:29]
C
Reno. So we're gonna be there. I should be flying.
[40:32]
B
So. But we won't have a newscast next week because we have our Reno Way west event. So the following week we will be back on.
[40:40]
C
Monday. We'll be back. Well, definitely check out the.
[40:45]
B
Wildlife. No news will happen all next week, I.
[40:48]
C
Promise. No, no, it'll be like three more.
[40:51]
D
Ransomwares. Well, yeah, John's fixing malware ransomware this week, so there shouldn't be.
[40:56]
C
Anymore. That's right. That's right. So everyone show up to the webcast. Is it Thursday or.
[41:01]
D
Wednesday?
[41:01]
E
Wednesday.
[41:02]
C
Wednesday. Yeah, show up on Wednesday. I'll be there. I'm gonna take notes. And we're. We're gonna fix. We're fixing ransomware.
[41:08]
E
Again. I actually think we'll all be there. Yeah, I know that me and Dale were also on the.
[41:11]
D
List. Yeah, I'll be there as.
[41:12]
C
Well. Perfect. Well, everybody have a good week and a half. And hopefully no more.
[41:18]
B
Ransomware. Not. Yeah, none. We have a.
[41:22]
C
Quarter. All right, let's take it.
[41:24]
B
Out.
[41:42]
I stopped hearing everybody. I think my Firefox broke. I'm just gonna leave.

Summary6 min read

Podcast Summary: Talkin' Bout [Infosec] News – June 7, 2021

Host: Black Hills Information Security Team (John/“A”, Monopixel/"C", Dale/"D", Ralph/"B", Ryan/"E")

Overview

This episode brings the BHIS team together for their weekly roundtable on the latest infosec news and topics. Highlights include humorous (and serious) takes on ransomware (despite promising not to dwell on it), a bizarre story of a mom "pen testing" a school, the state of containers security, end-to-end encrypted messaging, password manager debates, and a legal development affecting security research. The discussion is lively, practical, and peppered with both industry insight and banter.

Key Discussion Points & Insights

1. “Pen Testing” Without Permission: The Texas Mom Incident

[01:24–06:26]

Story Recap: A Texas woman posed as her 13-year-old child and spent a whole day at her daughter’s middle school – unauthorized, under the premise of “testing security.”
Takeaways:
- Physical pen testing without permission is illegal and just trespassing.
- Having a point about insecurity doesn't pardon illegal entry; proving a school isn't safe by breaking in doesn't provide new insights, as physical ingress is almost always possible.
- The damage from determined attackers can’t always be prevented — proper reaction/response is more realistic goals.
- The podcast team jokes about how the woman might have reacted if the school had forcibly removed her (turning the story to “police brutality”).
- “This is someone who is looking for attention, and she got it, and we're giving it to her.” — John (A) [05:08]
Security Industry Reflection: Even with authorization, misunderstandings of intent or law can land testers in trouble — always get thorough sign-offs.

2. First Malware Targeting Windows Containers

[06:26–10:40]

Headline: Malware is now targeting Windows containers—compromising Kubernetes and exploiting misconfigurations.
Insights:
- Containers, especially Kubernetes, are not security barriers — they're for managing dependencies, not inherently for security.
  - "When you're running a container, it's just kind of like an isolated process. Like it's not really. It's not a security construct, okay?" — Monopixel (C) [07:08]
- Most container risks come down to bad configuration, particularly permissions (many Docker containers run as root).
- The issue isn't new vulnerabilities, but old practices: attackers use familiar post-exploitation steps inside containers, just as on regular hosts.
- There’s a recurring myth that new tech—cloud, Linux, virtualization—equals better security by default. It doesn’t.
  - "You actually have to have a plan. You need to have the technology, need to have the architecture, need to have the process and procedures to support that, to actually make it secure." — John (A) [08:45]

3. Ransomware: Why We’re Still Talking About It

[10:40–22:27]

Context: Multiple organizations hit in recent headlines (JBS Foods, unidentified news stations, etc.).
Team’s Perspective:
- Ransomware now targets “soft” targets (schools, small municipalities), not just corporations.
- Even attackers sometimes “land” on high-value targets by accident, due to interconnected networks.
  - “It was a Bogo event, right?” — Monopixel (C) [12:29]
- The hosts mock attackers’ dismay at government intervention: "Why are governments getting involved with our illegal activities? This is a mystery to us."—John (A) [12:36]
On Proposed Legislation Banning Ransom Payments:
- The team agrees that outlawing ransom payments is unlikely to deter attackers, and would push things underground or make victims doubly trapped.
  - “Now, who's holding me ransom here? Is it...the criminals...or is it my own government...saying I can't pay this? Either way, I'm out of business.” — Dale (D) [15:39]
  - “There's awesome precedent in governments setting up laws to punish victims. That always works.” — John (A) [16:02]
- The real solution is for organizations to start implementing security basics (strong passwords, two-factor authentication, patching, etc.).
  - “A lot of these [mitigations] aren’t rocket science to take care of.” — John (A) [16:11]
- Security teams often ignored in favor of flashy vendor solutions; ransomware could be the “kick” that forces change.

4. Legal News: The Van Buren CFAA Ruling

[22:27–24:41]

Summary: The Van Buren Supreme Court decision narrows the scope of the Computer Fraud and Abuse Act (CFAA) to protect some security research.
- “Van Buren is a victory against overboard interpretations of the CFAA and protects security researchers.” — Ralph (B) [22:32]
Takeaways:
- Security researchers still need to be cautious, as laws remain “gray” and local interpretations/charges may differ.
- EFF is available to help if you run into legal issues as a researcher.

5. Microsoft Teams Adds End-to-End Encryption

[24:43–29:36]

News: Teams will soon offer end-to-end encryption for 1:1 voice calls (not group/video calls yet, and only on desktop/mobile, not web).
Background: Many users mistakenly believed Teams already had end-to-end encryption.
- “SSL is not end-to-end encryption. That's not how that works.” — Monopixel (C) [26:27]
- Service providers (Slack, Discord, Teams, etc.) can read/search your messages unless real end-to-end encryption is implemented.
Caveats:
- Features are limited vs other secure chat apps like Keybase, Telegram, etc.
- End-to-end encryption doesn’t end usability features, but complicates bots/search/predictive features.
- “Just be smart about what you say in what channel.” — Ralph (B) [28:12]

6. Are Password Managers Safe? — Blog Debated

[29:35–38:15]

Background: Discussion about Tavis Ormandy's blog, which questions the security of many password managers, especially third-party options.
Highlights:
- Tavis seems to hint at forthcoming vulnerabilities.
- He suggests built-in browser managers (e.g. Chrome, Firefox) are at least as secure, if not safer than third-party ones, due to stricter sandboxing and stronger security teams.
- Major convenience of password managers: device sync, unique and long passwords.
- All password stores are vulnerable if your machine is compromised; browser managers and tools like KeePass can be compromised via extracting secrets from memory.
Notable Quotes:
- “What is your threat model, right? Is it someone on your system?...Because does using the browser password manager protect you from someone compromising your system?...It does not. I can tell you that for a fact.” — Monopixel (C) [37:35]
- "You just start writing all your passwords in a little book...locked in a box." — Ryan (E) [38:08]
Practical Advice:
- No 100% solution—best practices still apply (unique, long passwords; 2FA; careful with browser sync; know your own risk model).
- Even recommended tools like KeePass have well-known master-key extraction methods.

Notable & Humorous Moments

On why management ignores internal security:
- “Listening to you, IT security people, is their last possible choice that they want to choose.” — John (A) [19:03]
Password-sharing security best practices:
- "Right now if I want to send something super encrypted, I'll send it PGP over carrier pigeon." — Ryan (E) [30:16]
On password manager paranoia:
- “Forget password managers, you use TikTok.” — Monopixel (C) [35:36]

Timestamps for Important Segments

| Segment | Topic/Insight | Timestamp | |-----------------------------------|----------------------------------------------|--------------| | Texas Mom “Pen Test” Incident | Physical security, legal/ethical boundaries | 01:24–06:26 | | Windows Containers Malware | Technical deep-dive, mythbusting containers | 06:26–10:40 | | Ransomware Discussion | Attacks, legislation, root causes | 10:40–22:27 | | Van Buren CFAA Ruling | Impact for security researchers | 22:27–24:41 | | Teams End-to-End Encryption | Messaging security, user misconceptions | 24:43–29:36 | | Password Manager Debate | Security models, practical recommendations | 29:35–38:15 |

Final Thoughts

The hosts anticipate further ransomware discussion (“we’re going to fix ransomware this week!” [41:01]) and sign off with their trademark blend of biting honesty and humor.
Next episode will follow the Reno Way West Hacking Fest, with a brief hiatus in the weekly schedule.

Summary produced by Podcast Summarizer AI — capturing the practical infosec wisdom and wit you missed, so you don’t have to listen at 1.5x!

Loading summary

Transcript248 lines

[00:01]
A
Thank you for attending another webcast edition of bhis. Talking about news as always, we are joined by Monopixel, Dale, myself Ralph and Ryan the shootist. We have some interesting stories. Today we'll be talking about ransomware because I promised that we wouldn't. But now here we are talking about ransomware.
[00:19]
B
We're going to be talking the name of the show, I guess.
[00:22]
A
Yeah, it's just talking about ransomware.
[00:24]
C
Talking about ransomware.
[00:25]
A
Talking about ransomware. To be talking about Texas moms pretending to be 13 year old girls, which is what I thought that a lot of moms were trying to do anyway by. By listening to a lot of SoundCloud rap. And then we'll talking about ransomware and containers and whether or not password managers are safe. So, Ryan, do you want to take us into the intro?
[00:43]
C
S.
[01:00]
A
I'm in a different studio today because that's what I do is I go to different studios, but all of my gear is on its way to Wild West Hacking Fest in Reno or Way West Hacking Fest. So I have to use the backup. Backup backup studio, which is the office upstairs. And yes, I have no ceiling and I'm perfectly aware of that. I appreciate it. What is the first news story that we have for the day? What do we want to talk about here, guys?
[01:24]
C
Here we go.
[01:25]
A
So start off, Ryan, do you want to tell us a little bit about the reason why you want to throw this one in? Because I disagreed and you had a point. I'm like, you know what? He's right. He's right.
[01:33]
B
Well, it reminded me of some Darknet Diaries episode I heard once upon a time about, you know, breaking into physical locations. And it occurred to me reading this article that this woman was physically pen testing this school. She just did not have authorization to do so.
[01:54]
So maybe she has a future career change in mind.
[01:57]
A
I don't know.
[01:58]
B
But I just thought. I thought it was kind of a funny story just because of that angle.
[02:02]
A
So. And that was the reason whenever you brought that up, I was like, that's probably a really good point as just kind of a point of reference to anybody that's listening to this and they're thinking, you know, what I want to do is I want to hack someplace to prove it's insecure or I want to break into someplace to prove it's insecure. Don't do that if you don't have permission. It's called trespassing. And that is illegal, even though the point itself may be valid. And somebody once explained it to me, me, for like physical pen testing. If you're like, well, I just wanted to prove that I could get there. How would you feel if somebody just showed up into your house and started walking around? It's always possible to gain ingress in most places, right? It is. You can come in through a window, you can come in through doors. Locks are not that hard to bypass. I'm not talking about picking, I'm talking about kicking them open. There's a number of ways that you can actually gain access to places. And the point is, it doesn't prove anything at all. And the quote on this one that I hate is the but the children quote. You know, this is about our children and the safety of our children. That's all I'm trying to do is prevent another mass shooting. She didn't prove anything. And that also gets into like the idea of a threat model. As much as I hate that phrase in the industry, you cannot develop a threat model that can deal with somebody that's showing up with like semi automatic weapons and pipe bombs and things like that. There's always going to be damage that's going to be done. You can set up proper reactions. You can do a number of different things. But in what possible scenario would the school have enough security to actually stop someone who's heavily armed from entering and creating some level of damage? So really she didn't prove anything other than she's just kind of. Kind of dumb, I guess. So what are you guys thoughts on this?
[03:40]
D
The part I found interesting with this one is that it's not like she was in there for like 10 minutes or 15 minutes. No, she was in there for like the entire day. And she actually said hi to the principal, I believe, talked to some of the teachers. She was scolded by one of the teachers for using her phone in class. So it's not like it was a short term thing where the security guard caught her 20ft away after she entered the door. This was an entire school desk.
[04:02]
C
So she did this just to prove the point that she could.
[04:05]
A
Yeah, that she could walk in basically.
[04:07]
C
All right, yeah. Cool, cool. That's about as far as that goes. Right. If we all just took that and be like, I wonder if I could do this, we'd all be in jail for something. That was a stupid idea.
[04:18]
A
Yeah.
[04:19]
E
Realistically, being from Iowa, even if you are authorized, apparently you can sometimes possibly wind up in jail for breaking into buildings even with proper authorization. So you definitely don't want to be doing it without proper authorization.
[04:32]
A
The thing that I'm Wondering is. Let's say it went different. Let's say that she was walking around the school and they called in a tactical SWAT team to tackle her, like, handcuff her, drag her out of the building. Would she have been, like, showed up in court or been interviewed and been like, you know what I went through? And I was testing the school security, and I just want to say really good. Really good. Good job, guys. I was. I was impressed. No, this strikes me as the type of person that, if that happened, would be like, oh, this is police brutality and abuse of power.
[05:09]
It just. Yeah, it just sounds like that this is someone who is looking for attention and she got it, and we're giving it to her.
[05:15]
C
I always think it's interesting, too, because when you are doing assessments and you do find something that's, like, egregious or bad, you're like, oh, I can't believe this. How could they, Right? This is ridiculous. And then when you are doing something and they did something right, you're like, oh, okay. Well, I guess that's just one thing they did right. You know, like, you tend to, like, highlight the things that they're doing wrong and quietly remember the things they're doing right. And, you know, sometimes I have to catch myself in those moments. Like, no, no. That really is something that I should be talking about or, like, emphasizing, like, this is. You should continue this road as opposed to just looking at stuff and just being like, I can't believe you did that right then. That's your point about, like, her, how she would respond. She'd be like, well, I was still able to get in, even though they tackled me and beat me up.
[05:54]
A
Because she's got to find a win situation. Yeah.
[05:56]
C
She's got to find a fallback.
[05:58]
A
Yeah. You know, this is what I was trying to do. I don't know. I just think that it sounds like a bad movie with Zac Efron or something. Lindsay Lohan in.
[06:10]
Done by Disney. And Jack. Jack Black brings us all together with song at the end. And we.
[06:15]
C
Let's.
[06:16]
A
Let's pass on this story and never talk of this lady again.
[06:19]
C
I think you should totally be in charge of casting for that movie, though. You got it.
[06:23]
A
I've got the cast already. We're set up. We're set up. You know.
[06:26]
C
Awesome.
[06:26]
A
So how about we do the world's first malware targeting Windows containers? I don't know who put this one together.
[06:32]
C
Oh, containers are bad. Don't use them. Everyone just let go. Just. We.
[06:36]
E
It's.
[06:36]
C
It's All. It's all bad.
[06:38]
A
Oh, do tell.
[06:40]
E
Bare metal is the only way to go.
[06:42]
C
Yeah. No, I mean containers are coming, right? And whether you want to accept that or not, I think it's irrelevant. Right? There's a lot of use and demand to put containers in environments and continuous integration and DevOps and all this other fun stuff. So they're here. But how you do that and how fast and how it affects security is going to be a continual cycle, Right? It looks like in this article is about kubernetes and the fact that they're running containers on Windows and then being able to gain access to the host os. I mean, everyone, if you don't know when you're running a container, it's just kind of like an isolated process. Like it's not really. It's not a security construct, okay? This isn't, you know, running in a container is not how you secure things, okay. This is actually just how you manage operating or software dependencies. Think of it like that, like containers aren't security, they're just to help you run software dependencies and allow you to work around that. Now, you can implement some things, but if you. We all have to get around this idea that containers create security, they don't.
[07:44]
A
The other thing that's interesting for me on this one is step one is the attacker achieves remote code execution through a vulnerability, right? So it's not that. The point of the story isn't that these vulnerabilities exist, because we know that they exist. The point of this story is to basically articulate a lot of the code execution and impersonating other services, establishing command and control, basically going through and checking compromised nodes, checking the privileges. A lot of the things that we would normally do are also present in containers. And I think that that kind of speaks to what you were just talking about, Ralph, where people think if they just move to the cloud, they're secure. And we've seen this again and again. People were like, well, we're going to run Linux and we're magically secure, right? It's like somehow they believe that just by adopting a specific technology, be it cloud, be it container, be it Linux, be it virtualization, all the way back to using a fricking firewall. Every time something like this comes up, the entire industry says, well, this is the way forward and this is what we need to do for security. And I mean, even all the way from Biden and the White House released a statement talking about computer security in the government and where we need to go. They were really big on Zero Trust and they were really big on cloud. Both of which are things that I absolutely agree with. But I don't think that those things are secure just in and of themselves. Like, you actually have to have a plan. You need to have the technology, need to have the architecture, need to have the process and procedures to support that, to actually make it secure. So kick it back over.
[09:17]
E
Yeah. And I would also say you have to know how to properly configure it.
[09:20]
C
I mean, with.
[09:21]
E
With my experience of Kubernetes, I mean, one of the most common vulnerabilities that I've seen and I don't pen test Kubernetes clusters much, full disclosure.
[09:31]
I've tried to set them up and then I try to break them, but most of the time the stuff I see is just stuff saying, oh, it was poorly configured from the get go, and this says it right there in that second paragraph, that its main goal is to go through poorly configured Kubernetes clusters. So configuration is big. I mean, it goes to the cloud as well. If you don't actually know how to configure your cloud services, you have no business being in the cloud right now.
[09:55]
C
Yeah, Kubernetes is a monster. Right. It is a complex machine that you really have to dive in and understand how it's working to properly secure it. If you don't know how it works, you can't secure it. That's how that works. Right. It's big. It has a lot of interfaces, the web management interface, all of this stuff. The other thing too, with just Docker containers in general, most of them run as root. The user is ran as root. That's how they design the container. Because it was the simplest way to make sure it had the permissions on the file system you share. I mean, that's another way too that you break out quickly out of Docker container is that your. The container process has the ability to write some files to a folder as the user root. Right. So it's just. I mean, there's a lot of that.
[10:40]
A
But yeah, Yep, absolutely. Okay. Is it. Is it time for the. The show to transition to ransomware?
[10:48]
C
And that's it. That's the whole show?
[10:49]
A
That's the whole show. We're done. Oh, my God.
[10:52]
C
This isn't even the only one too, that's happened recently.
[10:54]
A
No, no, there's so many. And that's why we're doing an emergency webcast on this tomorrow. I kind of want to talk about how we got to the place that we're at and who we can actually blame. Hint, it's going to be management.
[11:08]
But there's. There's a bunch of things like, I can't remember who got. There's like a Japanese company, and then you had the JBS Foods. And then there was another company that just got hit today. And news stations, News stations are getting hit. And then now they're going after schools to the chagrin of hardly anybody. Like, kids are like, school shut down because of ransomware.
[11:28]
C
Okay, cool. And they're like, you owe us somewhere. Yeah, you owe us millions of dollars. Like, we could hardly afford the teachers. Dude, come on. What do you want from us?
[11:36]
E
All right. She guys here on Tuesdays and Thursdays.
[11:39]
C
Yeah, exactly.
[11:42]
So.
[11:43]
A
So this is interesting, this threat post article, because they're talking about the Revil, or Revil Weevil, whatever. Ransomware re evil. But there's. We're missing an E there.
[11:56]
C
I know, I know.
[11:57]
A
And basically they were talking about their kind of thoughts on the state of ransomware as it exists today.
[12:03]
E
Right.
[12:04]
A
So with this, you. You know, they're talking about the recent attack impacting JBS Foods was originally directed at a Brazilian entity. And I think for any of us that do pen testing, we're like, yeah, yeah, we totally. We totally can see how that would happen. You know, where you exploit one organization and then you end up in another organization. Because all these organizations are connected. So.
[12:24]
C
But it.
[12:24]
E
That's.
[12:25]
A
That's kind of funny, you know, a ransomware group and like, yeah, we didn't originally go after these guys, but it just fell in our lap.
[12:30]
C
It was a Bogo event. Right?
[12:31]
A
It was Bogo.
[12:36]
They also don't know why the United States has intervened in this case, which I think is hilarious. You know, they're sitting around, why. Why are governments getting involved with our illegal activities? This is a mystery to us.
[12:47]
C
I don't understand. This is a job.
[12:50]
A
I think that that's because they're Russians and. And I think that they're used to the mafia getting involved. So, you know, if you're from Revil, just so you know. You know, for you, it's the mafia. For us, it's the FBI. So just letting you know how that kind of works out. So hopefully it'll be like, oh, yes, I get it. There we go.
[13:08]
C
The Mafia got involved.
[13:09]
A
Now they were talking about U.S. legislation, and there's a number of states and lawmakers that are talking about trying to pass laws that would restrict ransomware victims from paying the ransom.
[13:22]
I kind of think that that's a bad idea. I would like to get you guys all opinion on this because, you know, the conventional wisdom for ransomware is you should never pay the ransom because you're just going to make the problem worse. And it's like, yes, so my company is just going to roll over, go out of business, and I'm just going to go to my dying hole and die for the greater good.
[13:45]
C
So.
[13:45]
A
And I like their approach was it's not going to stop the attackers, right. They're not gonna be like, well, they passed the law, so we're not going to attack the United States anymore. Because what you're going to have at that point is a lot of organizations that quietly, hey. And that's going to shove this whole issue underground again. So I don't know, what are you guys thoughts on this too?
[14:04]
C
That's a sticky question because I think you just brought up all the points, right? Like that it would cause people to go underground and to pay. If you had this law, it's obviously, businesses want to stay alive. That is their goal. So if paying the ransom allows them to continue to operate, you know, obviously that's something that is in their best interest. Right. Like they're weighing their pros and cons.
[14:27]
B
And how fast can they get back if they hear the reward, if they.
[14:31]
C
Yeah, but on the flip side, right, the other side of that, I kind of feel like, well, if we just stop paying them, then the business model stack starts to really suffer. And, you know, you don't have people devoting what they think as a career and building ransomware. Right.
[14:47]
A
But if you look at. But if you look at the history of this, the idea of protection rackets, like in the 50s in New York City comes in is like, this is a really nice bakery. It'd be a shame if somebody were to come in here and mess it up. Yeah, yeah. That this has been a racket that has been around for literally a couple of thousand years. Right. I mean, it's just a new variation of it, and you can absolutely make it illegal all that you want, but it's not actually going to solve that problem. I really wish the attackers would go back to just crypto mining.
[15:19]
E
Yeah.
[15:19]
C
No, I mean, you're totally right, though. Like, making it illegal is not going to stop it. And I don't believe that in any way, shape or form. It's. It's just not going to stop the attacks. Right. I honestly feel like paying them is the wrong idea too. But I totally understand when you're in that moment, you're like, well, I woulda, shoulda, coulda. But right now I have one decision, and that is how do I get out of this situation?
[15:40]
D
From a business owner standpoint, if you're hit with ransomware and you're faced with do I, you know, do I break the law and pay the ransomware? Now, who's holding me ransom here? Is it the business, the company who, or, sorry, the, the, the criminals who are trying to get ransom from me, or is it my own government who's saying, I can't pay this? Either way, I'm out of business?
[15:59]
E
Yeah, it just creates the rock in the hard place.
[16:03]
A
Yeah, it's like, and there's awesome president in governments setting up laws to punish victims. That always works. Every, every single time. Good history on that too. But no, I don't think that there's a clean answer for this. Right. Other than organizations starting to secure their crap. And, and I think with the heart of a lot of ransomware attacks, you're going to see a consistent theme where every organization has security vulnerabilities. Right. But you're going to see a certain theme where some of the vulnerabilities the attackers are taking advantage of are relatively easy vulnerabilities to take care of. And that's going to be one of the things I'm going to talk about on the webcast tomorrow is why is it that you have organizations that we do pen tests for year after year after year after year where we go in and we're like, hey, you know, you got a seven character password and it's bad. And they're like, well, PCI tells us it's okay. We come back the next year, it's like still bad. Actually worse than it was the year before. Or if you look at organizations that have old out of date software or all of these different things that we talk about, like the intro class using two factor authentication, long, strong passwords. A lot of these aren't rocket science to take care of. So what is the reticence? Why do you get the pushback in organizations for that?
[17:18]
C
Maybe as well, Maybe this will be the, you know, the push that people need to actually fix it. I mean, because us telling obviously is not enough sometimes. Right?
[17:30]
A
And I agree with you. You know what? I absolutely agree with you. I, I think that the ransomware is going to be the push. It's going to be the kick that.
[17:36]
C
Organizations needed because it's either this change that password policy, for example. Right. Or go out of business possibly like that. That's kind of like A, you know.
[17:47]
A
But a lot of times they're buying. They're buying into the third option, which is they can buy themselves security, right? So if you. If you look at the industry as a whole, and I'm kind of talking about, I guess the webcast is on Wednesday, if you look at the industry as a whole, you have all these different competing factions trying to get attention and trying to get money, right? So if you're looking at an executive and that executive is looking at all these options and who's telling them their options? You have their security team, which is a bunch of tech geeks wearing black T shirts and jeans, and they use weird phrases all the time like, you know, you know, link local multicast name resolution. They talk about metasploit and they talk about all these different types of vulnerabilities and what the hell is a kubernetes anyway? And then you have the idea that, well, here's a company, a salesman shows up and he's wearing the same suit I do, the same shoes I do, the same watch I do, and telling me, hey, we can actually secure your entire organization for just a low, low price of hundreds of thousands of dollars per year. You're going to gravitate towards those people because they're selling you an easy solution, snake oil in some situations, sometimes it's not. And they look and act and walk like you do. So that's kind of where you're going to gravitate towards. That's the way it's been for a long time, I think with ransomware. We're now seeing that hit where they're like, well, I bought the shiny object from the guy that had the Maserati and it didn't work. Maybe I need to listen to the geeks. And I want you all, if you're listening to this. This webcast, I want you all to think about it. Listening to you, it security people is their last possible choice that they want to choose.
[19:19]
C
Really don't like him, because heaven forbid.
[19:22]
D
The guys who operate and build the.
[19:24]
B
Stuff should know what they're doing, know what they're doing, right?
[19:27]
D
And in some cases they don't, but clearly.
[19:29]
E
But, well.
[19:32]
A
And Dale, you've been part of this, right? I mean, you've been right in the belly of the beast where you have this new technology that's foisted upon you, where they're like, dale, we need to secure this by next week. You're like, why did. Why didn't you talk to me before this? You know, we've had These conversations.
[19:48]
E
Yeah.
[19:48]
D
I've not experienced that more than once or twice a month.
[19:52]
A
For years. Right.
[19:54]
C
Well.
[19:54]
E
And then after that, you have to hire a consultant to come in and say it, so that way they'll listen to you.
[20:01]
C
Well, look to the bright side, guys. This would be the last ransomware we have to talk about. You know, this is it.
[20:05]
A
Yeah, that's true for this week.
[20:07]
E
Yeah.
[20:08]
D
There's a moratorium. There's no more ransomware after this week.
[20:10]
A
I'm solving this on Wednesday, by the way. Yeah. It's going to take me two webcasts, but I'm going to nail this thing down. We've got solutions to all these things, but, folks, I have to jump off. I've, you know.
[20:22]
C
All right.
[20:22]
A
Car accidents and things like that that I got to help take care of. So you guys carry on without me.
[20:27]
C
We will carry the torch. John.
[20:31]
B
Catch you later.
[20:32]
C
All right, Later, John.
[20:34]
B
I thought it was just going to walk off screen and leave the camera running.
[20:37]
C
Yeah, just like.
[20:39]
Takes his mic off the stand and drops it.
[20:42]
B
There we go.
[20:43]
D
I for sure thought he was going to do the down into the basement thing.
[20:46]
C
Yeah.
[20:48]
D
Room with no ceiling.
[20:50]
B
We have to make that a requirement next time we. Anybody tags off the webcast mid show, we gotta walk down the stairs.
[20:59]
Okay, maybe not.
[21:00]
C
All right, no more ransomware. It's been solved.
[21:03]
A
Here we go.
[21:04]
E
I do want to say just real quick.
[21:07]
B
Okay. Bringing it back. I'm sorry, we can't just get away from the ransomware. Every time we try, they bring us back in.
[21:15]
E
It just. It just. The one thing that grates against me with this whole thing is this is also. This conversation could also be applied to your phishing testing as well. Just a little bit. I mean, if you management are watching this and you're saying, like, oh, this isn't fair. If they do this, I might have to consider going underground and not telling people. If you're one of those people who, like, forces your employees to do terrible things after they fail a phishing assessment, you're just as bad. This is. This is the exact same conversation in that sense. I've always been more of a believer that you reward the employees that do well versus punish the employees that don't do as well.
[21:51]
A
Anyhow, I'm done.
[21:52]
D
Think about, like, training a dog. You reward the good behavior and ignore the bad.
[21:56]
C
Well, don't ignore it.
[21:57]
E
Or you make a mean dog by beating it every time it does something bad.
[22:02]
C
And then that.
[22:02]
E
That gets a mean dog who doesn't like you. And that's what happens. So, yeah, that's all. I just had to get that off my chest so we can go to the next step.
[22:10]
D
And realistically, if you just keep punishing them, eventually they just don't tell you about it anymore.
[22:13]
C
Right.
[22:17]
E
Just saying, like in this one instance, the management's kind of getting a taste of that medicine. And if you're one of those managers or one of those people writing those policies, don't do that. It's not good.
[22:27]
B
Van Buren. Who knows about Van Buren, But I.
[22:30]
D
Had another thought about the ransomware.
[22:32]
B
Oh, of course, of course. Van Buren is a victory against overboard interpretations of the CFAA and protect security researchers. So we had a little bit of a discussion about this earlier. Who wants to re summarize that?
[22:48]
C
I think this is about the exceeding authorized access in the Computer Fraud and Abuse Act.
[22:55]
B
Get your hand out of your face.
[22:56]
C
Yes. Can't hear you. Sorry.
[23:00]
Yeah. So this gets down to kind of the sticky of security researching and stuff like that and how that gets put up in the law. Right. And how it gets interpreted and whether we're allowed to do it or not because we got access or not or what.
[23:17]
B
That's sort of related to the Texas lady in a way. In the roundabout way, in a way, kind of.
[23:25]
C
Yeah, yeah.
[23:27]
B
It really.
[23:28]
E
It sums up to just like how, like I said, in some senses, even if you have all the law on your side and you're doing a physical test, like, you don't you want to make sure you have the law on your side and in this case, like, helping spell out where the law is. And I'm telling you, you don't want to ride up, like, right on the edge of this line because that line.
[23:46]
C
Still is very gray.
[23:48]
B
So get all the lawyers involved if you have to.
[23:52]
E
If you have to.
[23:53]
C
Yeah. I think we're going to keep going back and forth on this. And it sounds like in the article that there was some wins here, wasn't all bad. But the idea of how we sum up what we can and can't do and whether that was authorized and stuff like that. And I think as the years have gone by and more of this is more security researching, more vulnerabilities, more ransomware, all this other stuff. Right. How we define that law, where the line is. Right. And who's allowed to do it and how I think is we're going to see more of that. Right. The EFF is obviously kind of at the forefront of some of this stuff. Right. So pushing for these legislations.
[24:32]
E
Yeah. And I think also if you ever find yourself on the wrong side of that line, you can actually contact the EFF and they'll help you get a lawyer. So just as a note.
[24:41]
C
Yeah, for sure.
[24:43]
B
Microsoft is getting better security as they should end to end encryption for voice calls.
[24:51]
C
This was like my first thing that I hated about teams when it first came out. I was like, there's no end to end encryption. It's just like it's wide open. It's just. I mean, it's Skype but in an electron app. Really.
[25:03]
B
But it's Skype but different.
[25:06]
C
Yeah, it's Skype, but very different. Skype never left though. I'm immediately going to go up and just say like, how much encryption did we get here? I know Zoom kind of gotten caught up, caught up in that one about end to end encrypted and stuff. But all of our chat platforms should be moving to some kind of end to end encrypted. That should be their goal. Right. That's the ultimate kind of at least, you know, getting to some level of privacy where you're not just saying we are a secure company who does regular security test. And that's why you should trust us.
[25:41]
E
Right.
[25:41]
C
You know, encryption we. In encryption we trust kind of thing. Yeah. End to end encrypted is probably like the first thing you should be doing. And then there's a lot of other. I mean, we have a bunch of other chat platforms that have came out and you know, like Keybase is one that does end in encrypted and that was from the very Get Go Telegram. Even though I kind of not totally trust their rolling their own crypto type thing. But still it's out there. But yeah, a lot of the platforms have moved to this, so it's not surprising that Microsoft would be moving to that. But yeah. What do you guys think?
[26:13]
E
I just think it's funny. I had it in a time where I was talking to someone, they're like, oh no, we're going to leave Zoom because they don't have end to end encryption. We're going to go to Teams because they just. There's like a large number of people who thought teams already had this technology.
[26:28]
C
SSL is not end to end encryption. That's not how that works. Okay.
[26:34]
E
For those who don't know, yeah, like.
[26:37]
C
Ssl, it's just a bulk. Like SSL is just bulk encryption of the traffic and has nothing to do with the message inside. Meaning all of the message inside can be read by.
[26:48]
The service provider you're using. They can read all your messages, mine them, do whatever the hell they want with them, make them endlessly searching. I'll give you a couple examples, like the prime examples of those that are doing this right now. Slack, for example, Discord is another one. None of that stuff you should ever send any like, or expect any level of necessarily privacy from those platforms. I'm not saying that they're bad or they're out to get you. I'm just saying that all of that is searchable by their platform and they can use that for whatever you, whatever they want. And think about it, both of those platforms are pretty much free until you get into like large groups or large amounts of traffic. Right.
[27:26]
E
That's.
[27:26]
B
No, that's kind of a feature of the platform too, is that you can search back the history. So.
[27:33]
C
Yes, yes.
[27:34]
B
And if you don't want to, you know, kick the dead horse sort of things, you can go see if anybody else is talking about it.
[27:40]
A
It's like.
[27:40]
B
And catch yourself up.
[27:42]
C
Yeah. There is a real use for public conversation. Right?
[27:48]
B
Yeah.
[27:48]
C
Everything doesn't need to be like, you know, when we, when we communicate. Right. You know, some of that is meant to be in the public. I, I said this and I will share it with anybody who wants to read it. Please, you know, reply to me and you can share your message with anyone else who wants to read it. There is a place for that and there is a very good use for it. There's other communication though, that you expect or would hope that you have some level of privacy in.
[28:12]
E
Yeah.
[28:12]
B
So you just got to be smart about what you say in what channel.
[28:17]
C
Yeah.
[28:17]
B
And also common sense sort of thing.
[28:20]
C
Yeah. In the end to end encrypted platforms like Keybase and other ones, you can pretty much still search those platforms because you can decrypt all the messages that were sent to you because you shared the key and so on and so forth. So, you know, there is still search in those platforms. So encryption does not mean the end of search. But I will admit that it does complex or make, make it more complex to implement some of those things or to do some of the other things like predictive or like, you know, how it predicts what you might be doing or, you know, other kinds of AI. I'm going to use in air quotes here.
[28:51]
B
Bots, you know.
[28:52]
C
Yeah, bots. Yeah. So in Keybase, the way that they did bots is that bots can only see messages once they get keyword that the bot would get interacted off of. Right. All the other messages, it actually can't decrypt. So then that way a third party can create a bot and you know, it actually can't see any of the chat except for when it's been flagged.
[29:10]
D
So before everyone goes and gets too excited about it, there is a couple caveats with this. Implement with teams implementation of this as well. First one being that it's only for one to one voice calls. So no calls, no video calls. And also the other thing is if you're, if you're running teams, like the web version of teams, it's not Cryptid. It's only available on desktop, mobile, iOS and Android. As of right now. Well, as of when they roll it out later.
[29:36]
A
July.
[29:36]
C
July, yeah, yeah, that's usually how it goes. As soon as they have, they're like Indian encrypted, only for one to one phone calls, only for one to one messages and that, you know. Yeah.
[29:47]
D
And the example they gave in one of the many articles about it was specifically for when it folks are sharing passwords with users. Sharing their default password or whatever. Which is great, but surely there's other ways you can get them their password than sending it over at chat.
[30:06]
B
Like email.
[30:07]
C
Yeah. The only way you send sensitive information now is only through email.
[30:11]
B
It's through email.
[30:11]
C
Yeah. It's like faxes, very secure.
[30:14]
B
Only a fax might be very secure.
[30:16]
E
Right now if I want to send something super encrypted, I'll send it PGP over carrier pigeon.
[30:22]
C
Yeah, there you go. One time pass, man. One time pass. You can't crack me, hack me.
[30:27]
E
You have to intercept my carrier pigeon first.
[30:29]
B
Speaking of passwords.
[30:31]
C
Oh, yes.
[30:33]
B
Post or whatever it is about password manager.
[30:36]
A
Yeah.
[30:36]
C
So this is. Yeah, so.
[30:40]
Tavis wrote a R in there. No, there is not wrote a blog about password managers. And so I have a sneaky suspicion that he's probably doing some research on password managers and kind of wanted to get it out there. His opinion on it. He kind of goes over, you know, one of his big things is that he hates it when people. One of the. One of the most popular things to say is hey, you know, just get a password manager. And he kind of goes into the fact that that's kind of like a broad statement and it doesn't necessarily cover all the angles. He also gets into a lot of the browser implementations of password managers and how they kind of break sandboxing and other things like that. The too long didn't read would be that he recommends that you just use the password manager that is built in something like Chrome or Firefox. As opposed to a third party password manager. And you know, one of his other big gripes is that obviously anyone who could compromise that company or any of the servers in between there, they would be able to read your passwords. Right? How much of that comes out to be true? This is kind of going back and forth and then the bigger question that goes along with this is when a lot of people say, hey, you should be using a password manager, I think what they really mean to say is stop using the same password. But his point is that some of these password managers don't necessarily bring as much security as you may think.
[32:08]
D
I guess the beef I would have with this is that one of the allures of a password manager, like you said, is not so much just about making sure people aren't using the same password, but being able to synchronize those across multiple devices. So if I've got a 26 character password of random letters and numbers on my computer, that's all great, but when I gotta type that into my phone, that's a pain in the ass. Which is where the password manager really.
[32:29]
B
On your TV helps.
[32:32]
D
And that's where one of the areas where the password manager really comes into play. I mean it's multi feature multifaceted I guess. But I can see where it's coming from though. But there's got to be a usability factor.
[32:43]
E
Yeah, I do. Question is, what if this still applies when considering. Okay, so let's say I use Chrome, Chrome's built in password storage and I link that to my Gmail account and then I sign into that from my Android phone. Is that still considered better than using something like LastPass or something like that?
[33:02]
C
In the article he says that they have better security teams. Pretty much. She was saying browser implementations are better. The other thing is that they don't break any of the sandboxing models, which extensions kind of do. In the sense of how the cities password managers work. They do break out of the sandbox. It's not, it's, it's interesting. It's a pretty short blog for the statements that he's making. I'm pretty sure that he also probably has some vulnerabilities that he is going to either release or disclose with some of these password managers.
[33:37]
B
He's leading up to something then.
[33:39]
C
That's, that's my guess. I mean maybe he doesn't, maybe he doesn't want to go through this disclosure process because it's a pain in the butt and I'm sure he does it all the Time, I don't know if he necessarily was out to kick down password managers. I think he was just trying to talk like general, that they're not the end all be all from security and that they can have some of their own vulnerabilities as well. We all tend to kind of think, and I know me personally, that it's still good to use a password manager because of all the other benefits like you said, the syncing, all the. A lot of those things and in any security model there's no 100%, you know, certain and all this other stuff. In addition, in any of those like password manager models, anything that's very secure, you should also be using some other type of authentication. So that two factor authentication model where you're using some not cellular based but. Or when I say not cellular, not SMS based but some other kind of authenticator app on your phone to get push notifications, other things like that, that kind of helps to alleviate some of that. But I don't know. It's tough, right?
[34:38]
E
I like the conversation piece for sure. My biggest thought is that I just don't. I question, I question it a little bit and solely for this one scenario, I guess. But. So let's say I use Chrome with my. And I link it with my Google account and then I linked out my Android phone and I also use Google single sign on to TikTok and authorize OAuth tokens to my Google account and then I do that for everything else that will let me use a Google+OAuth token. Like is it really more secure at that point? Like I don't, I find that harder to believe. I don't feel like people are super secure with their Gmail in general, if that makes sense. Like I feel like that. Like the nice thing I can say is that to an extent if I know someone's using a password manager, that account is usually separated in a sense. Yeah. And by the way. What? I don't actually use TikTok. That was just the first thing that came to my mind.
[35:33]
C
Forget password managers, you use TikTok.
[35:36]
E
This conversation is digressed.
[35:40]
C
How old are you? Jesus.
[35:41]
E
No, I'm 12 actually.
[35:44]
C
Yeah. Yeah. Let me show me your TikTok dance you've been working on, man.
[35:49]
B
It's actually a great way to share some security tips and get an audience to be on TikTok.
[35:55]
C
Yeah.
[35:56]
B
That's so hot right now.
[35:58]
C
That's. That sounds like a dumpster fire. But.
[36:03]
Gosh.
[36:03]
E
First security tip for those on TikTok, stop using TikTok.
[36:06]
B
Yeah, there you go.
[36:07]
C
Don't do that. He did say in the article that he still recommended things like Keepass and Keepass X, which I thought is super funny when I read that because. All right, so check this out. One thing that I've done on plenty assessments is that there are a couple different public frameworks for extracting the master key from keepass. Right. And the thing is, this is actually not anything to do with keepass particularly, but whenever you unlock one of your password vaults, the key to unlock that vault is in memory. If you know where it is in memory, you can extract that and then you can use that to gain back access to that keepass. Right. And so a lot of engagements I'd be on, I'd find someone who was using keepass, I'd wait for them to open it, I would extract the key from memory, and then I would download the Keepass file and get access to all their passwords. Right. Because it's on disk and all this other fun stuff. So it really does depend on your threat model. What I did think was funny is that some of the other password managers, like One Pass, lastpass and other stuff like that, there's not any public ways to extract the key. Even though I'm not saying you couldn't do it. And in fact, functionally, I'm sure you could. I just thought it was funny because keepass has a pretty big public one because of the way it functions and the way that, you know, the passwords are saved onto a disk and, you know, being able to stretch it from memory.
[37:28]
E
Yeah.
[37:29]
C
What's your. What's your threat model, man?
[37:31]
E
Both of those, actually. You can exploit DP API and get the key out of them.
[37:36]
C
Oh, yeah, Chrome. You could just extract all the passwords out of Chrome, like just straight in memory. So what is your threat model? Right. Is it someone on your system? Is that what you're protecting against? Because does using the browser password manager protect you from someone compromising your system? System. Right. And extracting it from memory? It does not. I can tell you that for a fact. But that's not what this was about. Right. And so where are you down the line? Like, how screwed are you? And how would they continue on? And I don't know if necessarily the Chrome one would help you that much more.
[38:09]
E
Yeah, there's a point in which you just start writing all your passwords in a little book and against your side locked in a box.
[38:15]
C
Yeah. And that's also when we want to talk about password managers and just passwords in General, that's when we started. That's why we use a lot of authentication one time authentication systems, the second factor, the third factor, whatever, so that we can control that in a time period. So it's not like you get this and then you have access forever. So. And that's why those authentication methods work or, you know, are implemented so that you can that password can be compromised but still not allow for immediate access. Right. I keep all my passwords in Excel, but I password protect it with super Secret password. It's password1. But this is not important for everyone who wants to just either rament about the fact that you write your passwords on a notepad or be upset that you use a password manager and Tavis doesn't approve. Go read that article.
[39:04]
B
And that's the last leak we got.
[39:06]
C
Oh, that is it.
[39:08]
B
Do we want to add anything?
[39:10]
C
Oh, no, I didn't have anything else. Did you guys have anything else you want to talk about? More ransomware, possibly. Just to really drive it home, I guess.
[39:17]
E
One thing to say about Excel is I once knew a guy who protected his Excel document full of passwords by spelling password backwards and storing it as that. So there's a cool trick for those who don't know.
[39:29]
C
Oh, yeah, yeah. Keyboard logs. Yeah. I was on engagement once speaking of Excel, and they had like sent some Excel document to each other via email and we got access to that Excel document and they had password protected it. Dude, I threw Hashcat at the thing for like a week, dude. And I still couldn't get that password, man. So I have no idea what they did. But it was good. I have like 10 billion password word lists, right? And then with permutations and rules and all the other stuff, I have no idea how many guesses I made at that. But anyways, it works.
[40:01]
E
Maybe that was your problem, though. Maybe you had too many passwords and the password was really just password1, which is @ the bottom of your.
[40:06]
C
List. No, trust me, I tried that one. Probably all permutations of password1.
[40:12]
All right, well, if that is it, thank you everybody for joining us for Black Girls Information Security. Talking about news and we'll be back on.
[40:22]
B
Monday. No, we.
[40:23]
C
Won'T. Whoa. Oh, we keep switching it up. So it's just like.
[40:27]
B
Roulette. Next week is.
[40:29]
C
Reno. So we're gonna be there. I should be flying.
[40:32]
B
So. But we won't have a newscast next week because we have our Reno Way west event. So the following week we will be back on.
[40:40]
C
Monday. We'll be back. Well, definitely check out the.
[40:45]
B
Wildlife. No news will happen all next week, I.
[40:48]
C
Promise. No, no, it'll be like three more.
[40:51]
D
Ransomwares. Well, yeah, John's fixing malware ransomware this week, so there shouldn't be.
[40:56]
C
Anymore. That's right. That's right. So everyone show up to the webcast. Is it Thursday or.
[41:01]
D
Wednesday?
[41:01]
E
Wednesday.
[41:02]
C
Wednesday. Yeah, show up on Wednesday. I'll be there. I'm gonna take notes. And we're. We're gonna fix. We're fixing ransomware.
[41:08]
E
Again. I actually think we'll all be there. Yeah, I know that me and Dale were also on the.
[41:11]
D
List. Yeah, I'll be there as.
[41:12]
C
Well. Perfect. Well, everybody have a good week and a half. And hopefully no more.
[41:18]
B
Ransomware. Not. Yeah, none. We have a.
[41:22]
C
Quarter. All right, let's take it.
[41:24]
B
Out.
[41:42]
I stopped hearing everybody. I think my Firefox broke. I'm just gonna leave.

Talkin' About Infosec News - 6/7/2021

Talkin' About Infosec News - 6/7/2021

Podcast Summary: Talkin' Bout [Infosec] News – June 7, 2021

Host: Black Hills Information Security Team (John/“A”, Monopixel/"C", Dale/"D", Ralph/"B", Ryan/"E")

Overview

Key Discussion Points & Insights

1. “Pen Testing” Without Permission: The Texas Mom Incident

2. First Malware Targeting Windows Containers

3. Ransomware: Why We’re Still Talking About It

4. Legal News: The Van Buren CFAA Ruling

5. Microsoft Teams Adds End-to-End Encryption

6. Are Password Managers Safe? — Blog Debated

Notable & Humorous Moments

Timestamps for Important Segments

Final Thoughts

Podcast Summary: Talkin' Bout [Infosec] News – June 7, 2021

Host: Black Hills Information Security Team (John/“A”, Monopixel/"C", Dale/"D", Ralph/"B", Ryan/"E")

Overview

Key Discussion Points & Insights

1. “Pen Testing” Without Permission: The Texas Mom Incident

2. First Malware Targeting Windows Containers

3. Ransomware: Why We’re Still Talking About It

4. Legal News: The Van Buren CFAA Ruling

5. Microsoft Teams Adds End-to-End Encryption

6. Are Password Managers Safe? — Blog Debated

Notable & Humorous Moments

Timestamps for Important Segments

Final Thoughts