WEBVTT 00:03.389 --> 00:16.288 [SPEAKER_04]: I had my data stolen once-grammed from a governmental organization I worked at, and they were selling it online for the Bitcoin equivalent of $50 Canadian Dollars, and that made me feel very humiliated. 00:17.430 --> 00:19.693 [SPEAKER_02]: Well, you're like, please, please sell it for more. 00:20.134 --> 00:22.377 [SPEAKER_02]: I know, I was like, aren't we worth more than that? 00:29.461 --> 00:32.204 [SPEAKER_00]: smashing security, episode 463. 00:32.925 --> 00:36.069 [SPEAKER_00]: This AI company leaked its own code. 00:36.089 --> 00:37.931 [SPEAKER_00]: It's also built something terrifying. 00:38.272 --> 00:41.035 [SPEAKER_00]: With Graham, Kluely, and Special Guest, Tanya Janker. 00:41.896 --> 00:45.180 [SPEAKER_03]: Hello, hello and welcome to smashing security episode 463. 00:45.500 --> 00:46.802 [SPEAKER_03]: My name's Graham Kluely. 00:47.463 --> 00:48.464 [SPEAKER_04]: In Amtanya Janker. 00:49.325 --> 00:52.549 [SPEAKER_03]: Tanya Janker, first time on smashing security. 00:52.969 --> 00:55.232 [SPEAKER_03]: Hello, how the flipper you? 00:56.326 --> 00:58.310 [SPEAKER_03]: I am wonderful Graham, how are you? 00:58.370 --> 00:59.853 [SPEAKER_03]: I'm gorgeous. 01:00.033 --> 01:04.381 [SPEAKER_03]: Now you are dialing in today from the beautiful Canadian. 01:04.802 --> 01:06.265 [SPEAKER_03]: Thank you very much for doing that. 01:06.565 --> 01:08.710 [SPEAKER_03]: Now you are a famous name, right? 01:08.730 --> 01:11.535 [SPEAKER_03]: You're a pretty big deal in the world of cyber security. 01:11.615 --> 01:17.406 [SPEAKER_03]: So if people haven't heard of you, how can you describe what you do and what you're all about? 01:17.572 --> 01:26.467 [SPEAKER_04]: So I am a software developer turned application security expert who really likes to write and now has written a bunch of books. 01:26.748 --> 01:27.910 [SPEAKER_04]: I know tons of blogs. 01:28.030 --> 01:28.811 [SPEAKER_04]: I really like to speak. 01:28.972 --> 01:39.510 [SPEAKER_04]: I speak at conferences and right now I'm giving secure coding training to large organizations and then kind of just doing contracts here and there helping people change their applications security program. 01:39.550 --> 01:41.233 [SPEAKER_04]: So it's more AI aware. 01:41.213 --> 01:52.709 [SPEAKER_03]: Okay, so you're going into organisations and you're helping those developers code more securely, which is a pretty good idea, I think, because we don't want software, which is full of security holes, let's Swiss cheese. 01:53.250 --> 01:56.254 [SPEAKER_04]: Well, we have a lot of that right now all over the internet. 01:56.775 --> 02:00.620 [SPEAKER_04]: Right now that is a giant problem, and especially not on the internet. 02:00.920 --> 02:10.714 [SPEAKER_04]: Like embedded devices, you know, you're going to an emergency room in the hospital, like all of those places, the security's usually much worse than it is on the internet, and it's not great on the internet. 02:10.778 --> 02:24.842 [SPEAKER_03]: Now, a little birdie tells me, Tanya, that you have recently set up a rival podcast to smash into security, and you are basically thinking that you can come in here and tell everyone about your podcast, it's that correct. 02:25.884 --> 02:28.568 [SPEAKER_04]: It's an underficent correct, right? 02:29.797 --> 02:32.002 [SPEAKER_04]: my completely different topic podcast. 02:33.585 --> 02:40.521 [SPEAKER_04]: It's called Dev Sex Station, and it's five to ten minute, many lessons for software developers about security. 02:40.741 --> 02:48.278 [SPEAKER_04]: So this month I'm covering the supply chain and how to secure the supply chain and how software developers they're target now. 02:48.258 --> 02:53.785 [SPEAKER_04]: Most of the actors are actually targeting the actual developer like the human, and they need to know. 02:54.206 --> 02:55.668 [SPEAKER_03]: That's interesting actually, isn't it? 02:55.708 --> 03:01.375 [SPEAKER_03]: Because of course, it's easy to imagine how hackers could target people who work in the finance department, for instance. 03:01.916 --> 03:16.695 [SPEAKER_03]: But if they're targeting the developers themselves, the idea I presume is to try to implant code within the code which these developers are writing because eventually it will roll out to many, many organisations and 03:16.793 --> 03:17.554 [SPEAKER_04]: Absolutely. 03:17.934 --> 03:23.819 [SPEAKER_04]: So often, like, the past couple years, people will say, oh, there was a software supply chain breach. 03:23.839 --> 03:28.784 [SPEAKER_04]: But if we look at maybe half of those, it was actually the software developer that was compromised. 03:28.864 --> 03:42.136 [SPEAKER_04]: And then as a result, multiple parts of the supply chain was breached, because they have superpowers, because they can control the CI and they control, you know, their IDE and they control the repo and they can go to prod and and. 03:42.316 --> 03:46.800 [SPEAKER_04]: And so you get the developers 03:46.780 --> 03:47.200 [SPEAKER_04]: everything. 03:47.321 --> 03:52.566 [SPEAKER_04]: And then on top of that, with some of the malicious actors have been doing crime, is then they rob the developer as well. 03:53.087 --> 03:58.252 [SPEAKER_04]: So they go and they try to empty their crypto wallets, because why not we just kick people while we're down? 03:58.312 --> 04:02.576 [SPEAKER_03]: Developers are the kind of people equal from who to have crypto wallets when they can. 04:02.596 --> 04:07.341 [SPEAKER_03]: And so they understand the technology and so they may have a few thousand dollars or perhaps more. 04:07.762 --> 04:11.826 [SPEAKER_04]: They'd be significantly more likely to have a crypto wallet than the average person. 04:12.008 --> 04:18.557 [SPEAKER_03]: And I'm also thinking that, um, I mean, my background is I used to be a developer many years going straight and he very software. 04:18.577 --> 04:30.293 [SPEAKER_03]: And I remember from way back then that the programmers are also the kind of people who would demand to have admin privileges on their computers because they feel like they have God-like capabilities anyway. 04:30.673 --> 04:32.636 [SPEAKER_03]: And so they would be arguing with the IT team. 04:32.656 --> 04:34.819 [SPEAKER_03]: Well, I need all of these rights. 04:35.139 --> 04:37.763 [SPEAKER_03]: And that could be a security threat in itself, couldn't it? 04:38.047 --> 04:39.068 [SPEAKER_04]: Oh yeah, for sure, Graham. 04:39.108 --> 04:42.593 [SPEAKER_04]: And I was a software developer longer than I've worked in security. 04:42.613 --> 04:44.595 [SPEAKER_04]: I was that person for sure. 04:47.019 --> 05:03.700 [SPEAKER_04]: And on top of having admin rights and being the Lord of their workstation, I think a lot of people when we think of the CICD, we think of it as a thing that publishes code and we don't think about how it's a thing that talks to the outside, does downloads, tells us if everything's okay. 05:03.680 --> 05:23.106 [SPEAKER_04]: Hey, you're not decides to log or not log certain security things, and very few organizations are currently logging or alerting, for instance, if a new admin gets added, or if a new workflow gets added, I worked at a place, I was contracting there, and we're playing around with their CI because I'm going to add some stuff to it. 05:23.086 --> 05:29.901 [SPEAKER_03]: I don't, I don't, I don't, look, you've been developing code more recently than me, and I recognize that it's a lot of listeners who may not work in the programming world. 05:30.302 --> 05:32.827 [SPEAKER_03]: You're giving me some acronyms here, like CI. 05:32.867 --> 05:35.773 [SPEAKER_03]: And no, no, no, it's all right, but what is that? 05:35.793 --> 05:37.517 [SPEAKER_03]: What is that that you're talking about? 05:37.835 --> 05:42.221 [SPEAKER_04]: So a CICD continues integration continuous delivery pipeline. 05:42.521 --> 05:46.647 [SPEAKER_04]: It's a piece of software that the software developers will put their code into. 05:46.687 --> 05:49.070 [SPEAKER_04]: And then it will run lots of tests. 05:49.090 --> 05:51.213 [SPEAKER_04]: It will go and get things off the internet for them. 05:51.273 --> 05:52.414 [SPEAKER_04]: It'll add some updates. 05:52.755 --> 05:54.517 [SPEAKER_04]: It can log things at consent alerts. 05:54.817 --> 05:59.864 [SPEAKER_04]: And then it will put a copy of whatever the thing is they're building onto maybe a development server. 05:59.964 --> 06:02.307 [SPEAKER_04]: So they can play with it and look at it and do more tests. 06:02.287 --> 06:05.711 [SPEAKER_04]: And then if all those tests pass, it's like, boom, that seemed pretty good. 06:05.731 --> 06:07.974 [SPEAKER_04]: Let's put on another server and let another team see it. 06:08.194 --> 06:12.600 [SPEAKER_04]: And it goes from environment to environment automatically, automatically, even. 06:13.301 --> 06:22.653 [SPEAKER_04]: And then by the end, assuming it passes all the tests, and the humans like it, it goes out into production, which is where you and I am most of us humans live. 06:23.093 --> 06:27.719 [SPEAKER_04]: So if you're a customer and you're using software, you don't know, but that's called production. 06:27.739 --> 06:30.943 [SPEAKER_04]: That's like the place where the magic happens, where the users are. 06:30.923 --> 06:36.651 [SPEAKER_04]: But there's all these other environments below that where we're playing around with things and making sure things are okay and making sure they're safe. 06:37.032 --> 06:42.620 [SPEAKER_04]: And so this system is usually the most powerful software system in an organization. 06:42.680 --> 06:45.043 [SPEAKER_04]: It can go to the internet and download things. 06:45.123 --> 06:46.085 [SPEAKER_04]: It can install things. 06:46.165 --> 06:47.086 [SPEAKER_04]: It can delete things. 06:47.206 --> 06:48.007 [SPEAKER_04]: It can decide. 06:48.348 --> 06:51.773 [SPEAKER_04]: This code's not good enough and it's not going anywhere on my watch. 06:52.253 --> 06:56.239 [SPEAKER_04]: And it does most of this quite automatically without human intervention. 06:56.219 --> 06:58.783 [SPEAKER_04]: And now, imagine a malicious actor takes that over. 06:58.823 --> 07:05.453 [SPEAKER_04]: They could literally put code in that's bad and put it out into your product and release it to all your customers without you knowing. 07:05.754 --> 07:07.476 [SPEAKER_04]: And it's happened a bunch of times. 07:07.937 --> 07:10.181 [SPEAKER_04]: And we're not protecting the systems very well. 07:10.421 --> 07:11.983 [SPEAKER_04]: And so I'm talking about it. 07:12.524 --> 07:13.426 [SPEAKER_03]: Well, you know what? 07:13.626 --> 07:21.338 [SPEAKER_03]: I think more people need to tune into DevSex Station, the brand new podcast, something that competitors are smashing security. 07:21.999 --> 07:23.982 [SPEAKER_03]: To learn more about this. 07:23.962 --> 07:26.024 [SPEAKER_03]: And right, great to have you here, Tanya. 07:26.424 --> 07:33.671 [SPEAKER_03]: Before we kick off, let's thank this week's wonderful sponsors meter, Corview, and Vanta were be hearing more about them later on in the podcast. 07:36.975 --> 07:38.596 [SPEAKER_00]: This week on smashing security. 07:39.157 --> 07:43.301 [SPEAKER_03]: We won't be talking about how hackers have breached travel site booking.com. 07:43.681 --> 07:47.264 [SPEAKER_03]: Stealing names addresses phone numbers and information shared with hotels. 07:49.687 --> 07:50.948 [SPEAKER_03]: You'll hear no discussion of. 07:51.130 --> 07:56.096 [SPEAKER_03]: How Rockstar Games, the makers of Grand Theft Auto, have been hacked for the second time in three years. 07:58.318 --> 07:59.500 [SPEAKER_03]: Then we won't even mention. 07:59.760 --> 08:08.230 [SPEAKER_03]: How meta is blocking lawyers from running ads on Facebook and Instagram to recruit clients who say that they've been harmed by social media. 08:11.013 --> 08:14.117 [SPEAKER_03]: So, Tanya, what are you going to be talking about this week? 08:14.367 --> 08:25.280 [SPEAKER_04]: I am going to talk about how Anthropic accidentally leaked their code for Claude Code CLI, and then I'm also going to talk about mythos, the new model that is terrifying. 08:26.722 --> 08:31.348 [SPEAKER_03]: And I'm going to be talking about how Venetians are getting themselves in a world about hackers. 08:31.368 --> 08:35.633 [SPEAKER_03]: All this and much more come up on this episode of Smashin Security. 08:37.115 --> 08:41.073 [SPEAKER_03]: Well, we've got time now to talk about one of today's sponsors VATTER. 08:41.716 --> 08:44.509 [SPEAKER_03]: Joe, what keeps you up at 2 o'clock in the morning? 08:44.894 --> 08:46.397 [SPEAKER_01]: the dog next door mostly. 08:46.417 --> 08:49.823 [SPEAKER_01]: Alright, well, yeah, but I'm talking professionally what keeps you up. 08:50.565 --> 08:58.479 [SPEAKER_01]: Oh, whether we've got the right security controls in place, whether our vendors are sick or how to escape the nightmare of outdated tools and endless manual processes. 08:58.940 --> 09:02.126 [SPEAKER_01]: Exactly, which is where today's sponsor comes in. 09:02.487 --> 09:03.288 [SPEAKER_01]: It's Vanta. 09:03.809 --> 09:05.973 [SPEAKER_01]: Vanta, the Fizzy Orange drink. 09:05.993 --> 09:07.476 [SPEAKER_01]: How can this possibly be true? 09:07.456 --> 09:14.291 [SPEAKER_03]: No, Joe, it's a Vanta with a V, it's a trust management platform, it's not a drink full of sugar. 09:14.993 --> 09:26.038 [SPEAKER_03]: It automates all of that tedious manual compliance work, so you can stop drowning in spreadsheets, chasing all the evidence and filling out questionnaire after questionnaire. 09:26.018 --> 09:27.761 [SPEAKER_03]: Lush, I hate questionnaires. 09:28.041 --> 09:28.742 [SPEAKER_03]: Well, who doesn't? 09:29.223 --> 09:33.730 [SPEAKER_03]: Vanta continuously monitors your systems, it centralizes your security data. 09:33.750 --> 09:35.633 [SPEAKER_03]: It keeps your program audit ready. 09:36.354 --> 09:42.022 [SPEAKER_03]: All of the time it also uses AI to streamline evidence collection and flag risks. 09:42.463 --> 09:49.714 [SPEAKER_03]: It automates compliance for SOC 2, ISO 27,01, 09:49.694 --> 09:53.698 [SPEAKER_01]: So basically it handles the boring stuff so we can focus on the interesting stuff. 09:54.119 --> 09:55.881 [SPEAKER_03]: Exactly, precisely that. 09:55.941 --> 09:59.725 [SPEAKER_03]: And for a limited time, new customers can get a thousand dollars off. 10:00.306 --> 10:01.167 [SPEAKER_03]: A thousand dollars? 10:01.487 --> 10:02.708 [SPEAKER_03]: Yep, a thousand dollars. 10:03.029 --> 10:05.691 [SPEAKER_03]: Head to venta.com slash smashing. 10:05.711 --> 10:12.239 [SPEAKER_03]: That's V-A-N-T-A dot com slash smashing and get started today. 10:12.899 --> 10:14.861 [SPEAKER_01]: And maybe get a decent night's sleep for once. 10:15.582 --> 10:19.026 [SPEAKER_01]: Oh, and unlike fizzy drinks, fan tourism platform for you. 10:19.006 --> 10:22.089 [SPEAKER_01]: That's a fruit twist. 10:22.109 --> 10:26.954 [SPEAKER_03]: Now, Chums, Chums, I want you to picture this, you are a tourist in Venice. 10:27.234 --> 10:29.657 [SPEAKER_03]: It's a warm spring morning. 10:29.677 --> 10:39.146 [SPEAKER_03]: You've just paid 12 euros for a cappuccino, and you're standing in Piacsa San Marco watching the pigeons do their thing. 10:39.546 --> 10:46.313 [SPEAKER_03]: And what you don't realize is one of your there in that beautiful setting that somewhere on a dark 10:46.293 --> 11:00.897 [SPEAKER_03]: telegram channel, a hacking group is claiming that they could at the press of the button send water flooding across the very stones that you are standing on, which would of course solve the pigeon problem in Venice at least temporarily. 11:01.237 --> 11:03.601 [SPEAKER_03]: Now, Tania, have you ever been to Venice? 11:03.721 --> 11:04.863 [SPEAKER_03]: Does this make you want to go? 11:04.883 --> 11:10.292 [SPEAKER_04]: So I haven't been to Venice and I still want to go, wet feeder okay with me. 11:10.272 --> 11:12.114 [SPEAKER_03]: Where feed are all right, pack your flippers? 11:12.475 --> 11:16.820 [SPEAKER_03]: Well, a hacking group called the infrastructure destruction squad. 11:17.281 --> 11:30.998 [SPEAKER_03]: They announced in early April that they had broken into the hydraulic pump system that protects Pietza San Marco in Venice from the notorious high tides of Venice. 11:31.458 --> 11:36.304 [SPEAKER_03]: They said that they accessed the system's control interface on the 26th of March. 11:36.344 --> 11:38.507 [SPEAKER_03]: They spent about 10 days. 11:38.487 --> 11:57.154 [SPEAKER_03]: quietly poking around at a little rummage and then on the seventh of April they began what they called the disclosure phase and the disclosure phase that's hacker speak for bragging about it on telegram right yeah because you can't be a hacker these days without a bit of bragging they were sharing screenshots 11:57.134 --> 12:10.389 [SPEAKER_03]: of control panels and valve states and systemet, and then they offered to sell full root access to one of Italy's most iconic pieces of critical infrastructure. 12:10.409 --> 12:10.830 [SPEAKER_03]: That's scary. 12:11.571 --> 12:12.852 [SPEAKER_03]: How much do you think they could charge? 12:13.092 --> 12:14.894 [SPEAKER_03]: Um, a million dollars? 12:15.195 --> 12:16.696 [SPEAKER_03]: I mean, that is plausible, isn't it? 12:16.716 --> 12:17.437 [SPEAKER_03]: They could try that. 12:18.018 --> 12:19.800 [SPEAKER_03]: How about $600? 12:22.615 --> 12:33.025 [SPEAKER_03]: No, 6,600, which is about the price of a mid-range Android phone, or if you're in Venice, run about 50 cappuccinos. 12:33.045 --> 12:36.588 [SPEAKER_04]: Yeah, 50 cappuccinos, that sounds nice though, 50 cappuccinos sounds nice. 12:37.048 --> 12:40.211 [SPEAKER_03]: You'd be high as anything, Tani, you can't drink 50 cappuccinos. 12:40.231 --> 12:43.835 [SPEAKER_04]: If you're there for a month gram, you could have 50 cappuccinos. 12:44.555 --> 12:50.421 [SPEAKER_03]: I suppose over a month you could, I was thinking it would all be consumed in one day, which case you'd be desperate for the loot, wouldn't you? 12:50.441 --> 12:51.762 [SPEAKER_04]: Yeah, that'd be awful. 12:51.843 --> 12:55.710 [SPEAKER_03]: Now, you live in the world of application security tanya. 12:55.730 --> 13:00.358 [SPEAKER_03]: It says we're about software code, we're about saw that CICD nonsense. 13:00.659 --> 13:08.733 [SPEAKER_03]: And that when you hear $600 to access flood defense infrastructure, is that a surprising number to you? 13:08.813 --> 13:13.482 [SPEAKER_03]: Or is it just depressingly familiar for critical system security? 13:13.522 --> 13:14.323 [SPEAKER_03]: What's your feeling? 13:14.472 --> 13:16.295 [SPEAKER_04]: So my first thought is that it's very low. 13:16.375 --> 13:20.622 [SPEAKER_04]: However, I had my data stolen once Graham from a governmental organization. 13:20.762 --> 13:27.313 [SPEAKER_04]: I worked at, and they were selling it online for the Bitcoin equivalent of $50 Canadian dollars. 13:27.814 --> 13:30.338 [SPEAKER_04]: And that made me feel very humiliated. 13:30.318 --> 13:33.104 [SPEAKER_02]: Well, you like, please, please sell it for more. 13:33.665 --> 13:35.569 [SPEAKER_02]: I know, I was like, aren't we worth more than that? 13:35.790 --> 13:37.814 [SPEAKER_02]: It's such a slapping the face, isn't it? 13:37.914 --> 13:41.863 [SPEAKER_04]: Right, right, but you could just scrape the stuff off our website. 13:41.883 --> 13:44.529 [SPEAKER_04]: None of it was private, it was publicly available data. 13:44.589 --> 13:45.711 [SPEAKER_04]: So I was like, well, 13:45.691 --> 13:49.599 [SPEAKER_04]: I mean, maybe what they're paying for is the convenience of it being in an Excel spreadsheet. 13:49.980 --> 14:00.901 [SPEAKER_04]: Instead of having to scrape it, but I feel like $600 seems like they don't actually have access and they are just like a kid in a basement being like, well, $600 Euro, that would be amazing. 14:01.062 --> 14:03.767 [SPEAKER_04]: We could have $50 coverage. 14:03.747 --> 14:05.190 [SPEAKER_03]: It's a strange old thing, isn't it? 14:05.210 --> 14:06.914 [SPEAKER_03]: So they were posting up on telegram. 14:06.954 --> 14:10.902 [SPEAKER_03]: This thing said, you know, you can have access to this too as well for such a small amount of money. 14:11.143 --> 14:14.189 [SPEAKER_03]: And their telegram post, which was really in Chinese. 14:14.851 --> 14:15.973 [SPEAKER_03]: I don't speak Chinese. 14:16.013 --> 14:20.643 [SPEAKER_03]: I don't read Chinese, but thankfully the internet can do all that for me. 14:21.084 --> 14:22.808 [SPEAKER_03]: This is what it was saying in English. 14:22.828 --> 14:23.730 [SPEAKER_03]: It says, 14:23.710 --> 14:28.421 [SPEAKER_03]: Yes, you conducted new checks after the attack in late March. 14:28.982 --> 14:37.943 [SPEAKER_03]: Yes, equipment tests came back positive after east in other words, they were tracking the remediation efforts been made by the organization trying to clean up afterwards. 14:38.183 --> 14:42.934 [SPEAKER_03]: They were done this in real time, while telegram posts were being written about it. 14:42.914 --> 14:43.755 [SPEAKER_03]: and they continued. 14:44.056 --> 14:50.926 [SPEAKER_03]: But what you haven't understood is that we have refused to completely shut down the flood defense system. 14:51.147 --> 14:54.031 [SPEAKER_03]: So they're trying to make Venice basically say, all thank you very much. 14:54.111 --> 14:54.852 [SPEAKER_03]: It's very good of you. 14:54.893 --> 14:55.654 [SPEAKER_03]: We're very grateful. 14:56.034 --> 14:58.278 [SPEAKER_03]: They said, we are not here to destroy you. 14:58.678 --> 15:01.002 [SPEAKER_03]: We are simply here to deliver a message. 15:01.523 --> 15:02.965 [SPEAKER_03]: We can do it. 15:02.945 --> 15:05.149 [SPEAKER_03]: And we are still inside your network. 15:05.630 --> 15:09.097 [SPEAKER_03]: No tests conducted by your security teams can drive us away. 15:09.498 --> 15:11.422 [SPEAKER_03]: No system updates can express. 15:11.742 --> 15:15.370 [SPEAKER_03]: We've been here for months and will remain here for months to come. 15:15.770 --> 15:18.676 [SPEAKER_03]: Which is fairly aggressive kind of spooky talk, isn't it? 15:19.157 --> 15:19.578 [SPEAKER_04]: It is. 15:19.598 --> 15:20.299 [SPEAKER_04]: It is. 15:20.359 --> 15:25.189 [SPEAKER_04]: It makes me wonder if they have persistence on the network where that is. 15:25.169 --> 15:27.694 [SPEAKER_03]: Yeah, I wonder how they're managing it. 15:28.075 --> 15:29.298 [SPEAKER_03]: It'd be interesting to know, wouldn't it? 15:29.799 --> 15:30.581 [SPEAKER_03]: And they carried on. 15:30.601 --> 15:32.465 [SPEAKER_03]: They had a message for the press as well. 15:32.485 --> 15:38.458 [SPEAKER_03]: They said to any newspaper that disseminates this news without understanding the truth. 15:39.179 --> 15:41.464 [SPEAKER_03]: Prepare for a devastating attack. 15:41.484 --> 15:45.152 [SPEAKER_03]: I mean, to be honest, at this point, I'm beginning to think this is most likely a 14-year-old. 15:45.132 --> 15:45.512 [SPEAKER_04]: Yeah. 15:45.532 --> 15:48.116 [SPEAKER_03]: There's a lot of bravado going on here, isn't there? 15:48.616 --> 15:48.756 [SPEAKER_03]: Mm-hmm. 15:48.917 --> 15:59.109 [SPEAKER_03]: But to recap, these hackers broken, refusing to leave threatening journalists, but they're only charging $600 the privilege of having access yourself. 15:59.389 --> 16:03.134 [SPEAKER_03]: So, you could imagine if someone had a problem with Venice. 16:03.574 --> 16:09.942 [SPEAKER_03]: I don't know, maybe you were in charge of IT at a rival, European tourist destination. 16:09.922 --> 16:23.845 [SPEAKER_03]: Maybe if you thought, ah, Venice is beaten us once again with all of their gondoliers and cornetos, if only we could access their flood defense system, and basically when that next high tide comes, we could ensure that they get flooded. 16:24.205 --> 16:26.629 [SPEAKER_03]: So you could imagine there would be people who think, oh yeah, $600. 16:26.649 --> 16:28.372 [SPEAKER_03]: That's going to be worth it for us. 16:28.753 --> 16:31.117 [SPEAKER_04]: I can't really see someone being that interested in it. 16:31.357 --> 16:31.778 [SPEAKER_04]: I don't know. 16:32.179 --> 16:33.501 [SPEAKER_04]: I don't want to cause distraction. 16:33.601 --> 16:34.883 [SPEAKER_04]: Maybe I'm weird. 16:35.335 --> 16:40.703 [SPEAKER_03]: your Canadian of course you're not destructive, you know, you just unbelievably pleasant all the time. 16:40.823 --> 16:42.506 [SPEAKER_03]: I mean, but there are. 16:42.586 --> 16:46.092 [SPEAKER_03]: Now this may come as a shock to you as a Canadian, but there are countries. 16:46.132 --> 16:55.927 [SPEAKER_03]: I'm not going to name any countries, particularly to you, a Canadian, but there are countries which are perhaps a little bit more interested sometimes, some elements of them in destruction. 16:55.947 --> 16:57.089 [SPEAKER_03]: I'm just saying it's possible. 16:57.469 --> 17:01.275 [SPEAKER_03]: But of course lots of activist groups may be interested, and 17:01.255 --> 17:08.552 [SPEAKER_03]: A lot of the early malware which we saw was purely destructive, it would wipe drives or delete files, you know, there was no point to it. 17:08.572 --> 17:10.416 [SPEAKER_03]: There was no financial incentive. 17:10.757 --> 17:13.924 [SPEAKER_03]: It was about just being mindless, really, in a way. 17:14.425 --> 17:19.737 [SPEAKER_04]: I feel like there's a certain, I need to prove that I am cool. 17:19.717 --> 17:45.694 [SPEAKER_04]: sort of thing especially like when we are coming of age like teenagers like I need my peers to see I'm cool I need people to think I'm powerful and then hopefully like that sort of just like wears off when we mature and we're like actually I could just achieve things and be awesome and I could prove I'm amazing by actually doing positive good contributions to the world rather than negative ones but I feel like sometimes people get lost. 17:46.015 --> 17:46.315 [SPEAKER_05]: Yeah. 17:46.295 --> 17:52.190 [SPEAKER_04]: And maybe they don't see that there are good things that they could do to prove how awesome they are, rather than bad things. 17:52.731 --> 17:54.737 [SPEAKER_03]: Do you think it's a bit of low self-esteem? 17:54.877 --> 17:57.564 [SPEAKER_03]: Do you think is it that they simply don't have girlfriends? 17:57.784 --> 17:59.890 [SPEAKER_03]: Boyfriends or whatever it is that they're after. 18:00.411 --> 18:02.717 [SPEAKER_03]: Maybe there's something missing in their lives. 18:02.697 --> 18:20.335 [SPEAKER_04]: Yeah, I often joke like they just need to go get a life and maybe they need to dog, think about it that they're not finding this purpose in their life, this thing that brings them joy and they're angry and so they're taking it out on people and I feel like if we could find a way, when we do the pick of the week we're gonna 18:21.935 --> 18:26.041 [SPEAKER_04]: Oh, maybe this, but I feel like you're really on to something that I've crammed. 18:26.362 --> 18:39.842 [SPEAKER_04]: I've said things like this before, where I'm just like, I'm gonna wire people doing this, like, maybe we need to find a focus to give them where they could show their brilliance show, like their determination and be successful, but like in a positive way. 18:39.822 --> 18:40.864 [SPEAKER_03]: Yeah, absolutely. 18:41.144 --> 18:44.070 [SPEAKER_03]: So this claim they make about still being on the network. 18:44.090 --> 18:47.095 [SPEAKER_03]: That's interesting to me and this no updates can expel us. 18:47.636 --> 18:53.587 [SPEAKER_03]: In your world, when someone says they've got that kind of persistent access, do you take that seriously? 18:53.647 --> 18:54.769 [SPEAKER_03]: Is that a technical claim? 18:54.789 --> 18:56.953 [SPEAKER_03]: Do you think or do 18:56.933 --> 19:01.779 [SPEAKER_04]: So I do software, and that's definitely an infrastructure network thing, but yeah, absolutely. 19:01.819 --> 19:03.721 [SPEAKER_04]: They could potentially still have access. 19:03.801 --> 19:14.973 [SPEAKER_04]: There's an incident a few years ago where I remember the malicious actor was posting images of the Slack channel that the incident responders and security team was using. 19:15.034 --> 19:22.542 [SPEAKER_04]: So they could actually see the Slack channel and the discussions of the security incident and then they were posting it to Twitter mocking them. 19:22.802 --> 19:23.363 [SPEAKER_04]: Oh, boy. 19:23.343 --> 19:25.447 [SPEAKER_04]: made me feel so bad for that team. 19:25.727 --> 19:32.460 [SPEAKER_04]: And this is why we need to have a way to talk to each other that's I call it out of bound, like a different separate way. 19:32.480 --> 19:36.448 [SPEAKER_04]: So like maybe there's a signal chat where you talk or telegram if that's your jam. 19:36.888 --> 19:42.499 [SPEAKER_04]: And you have this separate space where you can discuss things and where you can double check things. 19:42.479 --> 19:50.928 [SPEAKER_03]: You've given the example of that slack channel, it reminded me of a story from, oh my goodness, years and years ago, there was a hacking group in the UK. 19:51.429 --> 19:53.251 [SPEAKER_03]: I think it was the Lullseck hacking gang. 19:53.611 --> 20:00.058 [SPEAKER_03]: The place in the States, the place in the UK, set up a conference called to discuss this particular hacking group. 20:00.078 --> 20:10.630 [SPEAKER_03]: And one of the participants in that call, a British police officer, was accessing the call from his private email account, or he'd forwarded the login 20:10.610 --> 20:29.091 [SPEAKER_03]: What he didn't know was that a member of that particular hacking group had hacked his personal email and they were actually able to tune in to the conference call and hear the police discuss in the investigation into them themselves so these things can really badly backfire. 20:29.206 --> 20:34.255 [SPEAKER_04]: Yeah, the comms are really important during an incident when I teach software developers. 20:34.295 --> 20:37.240 [SPEAKER_04]: I like this little section about like what a security incident is. 20:37.280 --> 20:40.846 [SPEAKER_04]: What it looks like, how you should call this security team and what not to do. 20:41.307 --> 20:46.676 [SPEAKER_04]: Because I've had so many software developers attempt to help me and always from a good place just to be clear. 20:46.936 --> 20:50.482 [SPEAKER_04]: Then burning the chain of custody, effing up all my evidence. 20:50.763 --> 20:52.145 [SPEAKER_04]: You know, don't worry, I erased it. 20:52.165 --> 20:53.307 [SPEAKER_04]: I must say, oh my god. 20:53.287 --> 21:14.265 [SPEAKER_04]: Yeah, I feel like this security team needs to communicate better to the entire rest of the organization like the processes that they should follow so that if there is an emergency everyone knows what to do because a helpful person can sometimes completely ruin everything. 21:14.245 --> 21:18.636 [SPEAKER_03]: It's not your email server, it's not a web application necessarily, it's not a customer database. 21:18.977 --> 21:22.966 [SPEAKER_03]: This is all about the physical world of pumps and valves and sensors. 21:23.447 --> 21:26.595 [SPEAKER_03]: This means that when it goes wrong, it's not your data that's being leaked. 21:27.157 --> 21:29.402 [SPEAKER_03]: It could mean water's going everywhere. 21:29.483 --> 21:39.119 [SPEAKER_03]: I know your world is very much the software side of things, Tanya, but OT security and application security, they are converging in some ways, aren't they? 21:39.680 --> 21:47.273 [SPEAKER_04]: Software runs everything, you can't know OT without any software, and I would say in this case it sounds like it's critical infrastructure, because 21:47.253 --> 21:50.178 [SPEAKER_04]: At first, if you were describing it, you're like, oh, you'll get your feet wet. 21:50.198 --> 21:53.042 [SPEAKER_04]: And I was like, whatever, I'm British Columbia, and we're always wet. 21:53.563 --> 21:58.390 [SPEAKER_04]: It would actually flood people could be harmed and stuff it, it becomes critical in infrastructure if that makes sense. 21:58.611 --> 22:00.954 [SPEAKER_04]: And so, software runs literally everything. 22:01.034 --> 22:01.415 [SPEAKER_03]: That's true. 22:01.615 --> 22:08.967 [SPEAKER_03]: And the problem is that OT systems, these operational technology systems, they were built for longevity and reliability and uptime. 22:08.987 --> 22:11.190 [SPEAKER_03]: I mean, the important thing was that they need to always work. 22:11.571 --> 22:15.657 [SPEAKER_03]: And this was long before people were thinking about connecting them to anything. 22:15.637 --> 22:27.434 [SPEAKER_03]: Once they were networked for convenience, maybe or remote maintenance, suddenly this decades-old infrastructure is perhaps accessible via the public internet and may have very weak security. 22:27.734 --> 22:36.126 [SPEAKER_04]: I find Graham quite frankly that a lot of the security industry focuses on the internet and web, but that's like the tip of 22:36.106 --> 22:46.928 [SPEAKER_04]: They iceberg of all the software that we have like in December is working with this company that does embedded medical devices and then they do operating systems and emergency room systems. 22:46.948 --> 22:50.255 [SPEAKER_04]: Like all of the devices that are in there, they write the software for that. 22:50.676 --> 22:53.642 [SPEAKER_04]: And obviously the security is pretty important. 22:53.622 --> 23:19.950 [SPEAKER_04]: like say safety and security and privacy pretty darn important right and we worked together and it was like a really cool project but I feel like a lot of organizations they're like oh well we're not on the internet so it's not that important so when we did a threat model of all the things that could happen and how easy it would be they're really shocked and hospitals get hit with ransomware all the time but it be so easy to hit 23:19.930 --> 23:23.677 [SPEAKER_03]: It's a big problem and we're living in this world of web apps. 23:23.697 --> 23:27.945 [SPEAKER_03]: People build them, they work and then they think, oh, maybe we should add security later. 23:28.065 --> 23:30.089 [SPEAKER_03]: If you're lucky, they have that part of the conversation. 23:30.310 --> 23:36.842 [SPEAKER_03]: But do you think the software world is actually learning that lesson to integrate security earlier on in the process? 23:36.822 --> 23:40.792 [SPEAKER_04]: I think new software is having security added significantly more often. 23:40.832 --> 23:44.801 [SPEAKER_04]: However, we couldn't have a podcast episode without talking about AI. 23:45.463 --> 23:52.941 [SPEAKER_04]: So everyone right now is using Claude, which we're going to talk about in a bit, and co-pilot etc to write code for them. 23:52.921 --> 23:56.491 [SPEAKER_04]: and the quality of code coming out of those is not very good right now. 23:57.153 --> 24:01.244 [SPEAKER_04]: And I am seeing it improve, but not the speed that I dream of. 24:01.685 --> 24:04.392 [SPEAKER_04]: Creme, it sounds weird, but I want to be put out of a job, right? 24:04.412 --> 24:08.263 [SPEAKER_04]: Like I would like to not need to teach secure coding anymore, because we've got this. 24:08.243 --> 24:08.884 [SPEAKER_04]: that's what I want. 24:09.265 --> 24:11.109 [SPEAKER_04]: And the AI's not doing it for us. 24:11.149 --> 24:19.066 [SPEAKER_04]: So what's happening now is that we have developers with varying levels of how to create secure software and varying level of prioritization on that. 24:19.307 --> 24:25.560 [SPEAKER_04]: And then now they're being told develop software at 10 times the speed or we're going to fire you and hire someone else. 24:25.540 --> 24:29.508 [SPEAKER_04]: So they're using the AI, the AI is changing tons and tons of things they don't fully understand. 24:29.528 --> 24:30.750 [SPEAKER_04]: They don't have time to review it. 24:30.830 --> 24:34.457 [SPEAKER_04]: They're just pressing the commit button, and that is my fear for new software. 24:34.497 --> 24:37.062 [SPEAKER_04]: For old software, it's that, oh, it's always worked. 24:37.102 --> 24:37.964 [SPEAKER_04]: Why would we update it? 24:38.104 --> 24:39.827 [SPEAKER_04]: We'd have to re-architect it to fix that. 24:39.867 --> 24:40.769 [SPEAKER_04]: We don't have money for that. 24:40.809 --> 24:41.450 [SPEAKER_04]: We'll just leave it. 24:41.651 --> 24:44.296 [SPEAKER_04]: Yeah, a lot of legacy is in a bad shape. 24:44.316 --> 24:48.544 [SPEAKER_04]: And by legacy, I mean software that's already out in production that's been out one or more years. 24:48.524 --> 25:07.498 [SPEAKER_03]: Well, whether you believe every word that infrastructure destruction squad has said about Venice or not, doesn't really matter because the next group that finds their way into a system like that, they might not be interested in writing threatening telegram posts or asking for the mighty sum of $600. 25:08.480 --> 25:13.148 [SPEAKER_03]: They might just want to open the bells and cause mayhem that way. 25:14.782 --> 25:17.345 [SPEAKER_03]: What time now to talk about one of our sponsors, Mieter? 25:17.465 --> 25:20.208 [SPEAKER_03]: Joe, have you ever had to set up a network for a new office? 25:21.129 --> 25:23.272 [SPEAKER_03]: Once, I've since sought therapy. 25:23.792 --> 25:24.353 [SPEAKER_03]: Ah, right. 25:24.553 --> 25:28.237 [SPEAKER_03]: Well, Mieter exists to make all of that someone else's problem. 25:28.618 --> 25:33.023 [SPEAKER_03]: They are a network as a service company, but a proper end to end one. 25:33.343 --> 25:35.305 [SPEAKER_03]: You hand them a physical address, a floor plan. 25:35.586 --> 25:37.588 [SPEAKER_03]: They handle everything they saw at the ISP. 25:37.648 --> 25:39.110 [SPEAKER_03]: They decided to deploy the network. 25:39.150 --> 25:40.171 [SPEAKER_03]: They turn up on the site. 25:40.231 --> 25:41.953 [SPEAKER_03]: They rack their own hardware. 25:41.933 --> 25:47.327 [SPEAKER_03]: Kits that they've actually designed themselves, not just rebranded someone else's guppins. 25:48.269 --> 25:54.846 [SPEAKER_01]: So I don't have to spend 45 minutes on halt with the telepcom's company, only to be told they've misspelled our company name on the contract. 25:54.877 --> 25:57.060 [SPEAKER_03]: right, yeah, not a single minute of that. 25:57.381 --> 26:05.895 [SPEAKER_03]: And once you're up and running, you get one dashboard for monitoring security, the lands, firewall, DNS security, the whole works. 26:06.315 --> 26:10.061 [SPEAKER_03]: We'll control without any of the sole destroying groundwork. 26:10.722 --> 26:12.665 [SPEAKER_03]: This begs the question, what's the catch? 26:13.186 --> 26:14.729 [SPEAKER_03]: Genuinely, no catch. 26:14.849 --> 26:16.952 [SPEAKER_03]: It's a straightforward subscription model. 26:17.233 --> 26:22.521 [SPEAKER_03]: They even have a hardware buyback program if you've already blown the budget on equipment from another vendor. 26:23.007 --> 26:26.231 [SPEAKER_01]: So I'll take away the evidence of my previous terrible decisions. 26:26.651 --> 26:27.773 [SPEAKER_03]: Right, basically, yes! 26:28.173 --> 26:32.178 [SPEAKER_03]: So find out more at meta.com slash smashing. 26:32.478 --> 26:37.184 [SPEAKER_03]: That's meth.com slash smashing. 26:37.664 --> 26:39.426 [SPEAKER_03]: And thanks to meta for supporting the show. 26:41.369 --> 26:44.172 [SPEAKER_03]: Tania, what's the story of you got for us this week? 26:44.540 --> 26:53.154 [SPEAKER_04]: Okay, so I wanted to talk about how Anthropic accidentally leaked the full source code for Claude code CLI. 26:53.194 --> 26:54.316 [SPEAKER_04]: So, sorry. 26:54.596 --> 26:56.840 [SPEAKER_04]: Isn't it Claude rather than Claude? 26:57.461 --> 26:59.083 [SPEAKER_04]: Oh, she's powerful, I say. 26:59.103 --> 27:00.826 [SPEAKER_04]: I'm Canadian, a sweet French, so. 27:01.367 --> 27:04.472 [SPEAKER_03]: Uh, Mary's, son, they're monkey, one, two, I'd be on a song. 27:04.452 --> 27:05.473 [SPEAKER_03]: Sorry, I'm pretty new. 27:05.834 --> 27:11.720 [SPEAKER_04]: Basically, when we publish code to production, the magical place where the users are, yes. 27:12.181 --> 27:20.470 [SPEAKER_04]: Software developers are supposed to turn off debug mode, which is like a nerdy thing that we use so that we can find problems and fix things. 27:20.730 --> 27:27.878 [SPEAKER_04]: And then we also usually have something called an ignore file, which means like, don't put all of those files up there. 27:28.359 --> 27:29.940 [SPEAKER_04]: These are just for us files. 27:30.221 --> 27:32.383 [SPEAKER_04]: And both of those things didn't happen. 27:32.363 --> 27:39.916 [SPEAKER_04]: And so then they published this file, it's called a source map file and it can be opened like a present and inside was the code. 27:40.236 --> 27:41.659 [SPEAKER_03]: What actually got leaked here? 27:41.679 --> 27:44.624 [SPEAKER_03]: This was anthropic, the big AI company, which did this. 27:44.644 --> 27:44.844 [SPEAKER_03]: Yeah. 27:45.205 --> 27:47.068 [SPEAKER_03]: They leaked the code for Claude. 27:47.409 --> 27:47.970 [SPEAKER_03]: Is that right? 27:48.491 --> 27:50.434 [SPEAKER_03]: The thing they spent billions on, right? 27:50.714 --> 27:53.479 [SPEAKER_04]: So they accidentally leaked all the intellectual property. 27:53.519 --> 27:58.067 [SPEAKER_04]: This would be a data spill because they did it themselves. 27:58.047 --> 28:03.234 [SPEAKER_04]: I can't imagine being the software developer that did that because they're probably pretty upset with themselves. 28:03.854 --> 28:05.777 [SPEAKER_04]: So it wasn't a hack, it was a human error. 28:06.338 --> 28:26.063 [SPEAKER_04]: And the reason why this is a really big deal is, so first of all, like they spilled their intellectual property, and as a person who has made most of her income off of her intellectual property her whole life, because when I was younger, I was a professional musician, then I was a software developer writing code, 28:26.043 --> 28:35.335 [SPEAKER_04]: So that's one thing, but the other thing is that then the internet got a hold of it and analyzed it for vulnerabilities and start writing exploits for it so that they could take advantage of clothing. 28:35.555 --> 28:44.266 [SPEAKER_04]: And so people can dissect all of its defenses and come up with better attacks and all of the other AI companies now are stealing it. 28:44.386 --> 28:51.095 [SPEAKER_04]: And basically, so someone rather than seeing that and reporting it immediately to anthropic, the person's like, you know what I'm going to do? 28:51.175 --> 28:55.240 [SPEAKER_04]: I'm going to copy it to my own GitHub repo and start distributing it. 28:55.220 --> 28:55.841 [SPEAKER_04]: sad. 28:56.182 --> 28:59.748 [SPEAKER_04]: And I know that like it's cool thing to find out be really excited too. 29:00.310 --> 29:03.916 [SPEAKER_03]: The thing is, yes, obviously that's naughty, right? 29:03.936 --> 29:06.641 [SPEAKER_03]: Because it's anthropics code, right? 29:07.082 --> 29:13.414 [SPEAKER_03]: But let's not forget what anthropic and the other AI companies have been doing for years. 29:13.394 --> 29:20.490 [SPEAKER_03]: which is they've been stealing everyone else's content without permission in order to train their AI models, right? 29:20.891 --> 29:24.118 [SPEAKER_03]: So, isn't this just actually a case of, they're getting their just desert? 29:24.399 --> 29:28.047 [SPEAKER_03]: They have spilt their coat and now it's in the hands of everybody. 29:28.328 --> 29:29.310 [SPEAKER_04]: So, I would say, 29:29.290 --> 29:30.532 [SPEAKER_04]: Yes to that part. 29:31.012 --> 29:49.898 [SPEAKER_04]: So I've written two books and my second book came out last year and it is fairly sold and the theory is is because 29:49.878 --> 29:50.219 [SPEAKER_05]: Yeah. 29:50.239 --> 29:59.558 [SPEAKER_04]: And so before people will Google things and it'd be like, oh, you want to know it, pushing leftes or you want to know what security drift is or whatever, the many things that I have defined throughout my entire career. 29:59.618 --> 30:05.490 [SPEAKER_04]: And then instead of it bringing you to the blog post where I'll explain that to you, it now just tells you the answer. 30:05.470 --> 30:08.554 [SPEAKER_03]: So you're not even getting the web traffic, is the truth, right? 30:08.794 --> 30:09.015 [SPEAKER_03]: No. 30:09.215 --> 30:13.700 [SPEAKER_04]: So there's a place where I write articles for them that I'm not going to name because I like them. 30:13.961 --> 30:18.927 [SPEAKER_04]: And I used to write articles for them and they'd get a couple hundred thousand reads and now they're getting like two thousand reads. 30:19.348 --> 30:27.678 [SPEAKER_04]: It gets it's that different because the AI reads it and then now it knows everything, Tanya just spent weeks researching to write that article. 30:28.039 --> 30:35.308 [SPEAKER_04]: And so this is a huge problem for those of us that do research and release research because immediately it's taken from us. 30:35.288 --> 30:35.789 [SPEAKER_04]: it sucks. 30:36.269 --> 30:36.450 [SPEAKER_04]: Yeah. 30:36.770 --> 30:41.196 [SPEAKER_04]: I know what's supposed to do when I wrote a call by kind of wanted to do too because they're related is mythos. 30:41.777 --> 30:47.906 [SPEAKER_04]: So anthropic also announced but did not publicly release a new model called mythos. 30:48.306 --> 30:50.930 [SPEAKER_04]: And what mythos does, it's quite dangerous. 30:51.090 --> 30:58.240 [SPEAKER_04]: So it finds vulnerabilities in applications and chains them together into exploits. 30:58.481 --> 31:03.548 [SPEAKER_04]: And it has been finding novel new kinds of things that humans haven't been able to find before. 31:03.608 --> 31:05.110 [SPEAKER_04]: And it's been finding them 31:05.090 --> 31:08.234 [SPEAKER_04]: so so so so terribly fast. 31:08.815 --> 31:11.298 [SPEAKER_04]: It's absolutely completely terrifying. 31:11.338 --> 31:20.249 [SPEAKER_04]: So for instance they found I can't even remember just how many bugs in open SSL but heart bleed level terrifying bugs. 31:20.349 --> 31:30.422 [SPEAKER_04]: For those of you that don't know, heart bleed was a bug found in open SSL where you could just send a specially crafted call and then it would just tell you all the secret sauce. 31:31.145 --> 31:37.294 [SPEAKER_03]: Yeah, it would spit back what should have been confidential, encrypted information, things which no one should ever have been able to see. 31:38.075 --> 31:40.999 [SPEAKER_04]: And, and traffic are not publicly releasing it. 31:41.039 --> 31:47.949 [SPEAKER_04]: They're just working with a couple trusted organizations for now, but they've openly admitted that they can't fully control it or understand it. 31:48.290 --> 31:51.955 [SPEAKER_04]: And I would really not like to see Mithos on the internet. 31:51.935 --> 31:52.896 [SPEAKER_03]: Oh, okay. 31:53.156 --> 31:55.619 [SPEAKER_03]: So let's just backtrack for one second. 31:55.999 --> 32:00.003 [SPEAKER_03]: So we've got this company Anthropic, which is just goofed up. 32:00.023 --> 32:01.285 [SPEAKER_03]: They called it a human error. 32:01.305 --> 32:04.908 [SPEAKER_03]: They said it was a release packaging issue rather than a security breach. 32:05.489 --> 32:09.793 [SPEAKER_03]: And they said, oh, it doesn't matter because no customer data or credentials were involved. 32:09.833 --> 32:10.874 [SPEAKER_03]: And technically that's right. 32:11.295 --> 32:12.176 [SPEAKER_03]: It's their code. 32:12.436 --> 32:13.677 [SPEAKER_03]: It's not somebody else's. 32:14.058 --> 32:15.920 [SPEAKER_03]: But you know, they were leaking their source code. 32:16.020 --> 32:17.301 [SPEAKER_03]: They were careless. 32:17.281 --> 32:18.563 [SPEAKER_04]: It's still a data spill. 32:18.743 --> 32:20.065 [SPEAKER_04]: It's their data and they spilled it. 32:20.245 --> 32:23.170 [SPEAKER_04]: And it was private confidential data at the time of you. 32:23.430 --> 32:23.650 [SPEAKER_03]: Yeah. 32:23.991 --> 32:41.797 [SPEAKER_03]: And meanwhile, they've just publicized this new technology they built called Mythos, which can do something which could be very useful for many people in terms of secure in their systems because it can find vulnerabilities and you could find flaws in software and you could hopefully patch them and fix those bugs. 32:42.217 --> 32:44.841 [SPEAKER_03]: But if that fell into the wrong hand, 32:44.821 --> 33:00.298 [SPEAKER_03]: If they had a release packaging issue and they've spilted out like they've just built out something, that's horrendous because anybody could use something like mythos to hack all kinds of systems and software couldn't they? 33:00.278 --> 33:05.223 [SPEAKER_04]: It's a little bit like when HDMore released MetaSupply so many years ago. 33:05.283 --> 33:11.528 [SPEAKER_04]: So MetaSupply is a tool that you can point at a web app or a piece of online infrastructure. 33:11.568 --> 33:12.509 [SPEAKER_04]: So it needs to be webby. 33:13.010 --> 33:19.315 [SPEAKER_04]: And it will go and try to exploit a list of known CVEs, so common vulnerability and numerator. 33:19.375 --> 33:24.580 [SPEAKER_04]: So vulnerabilities that are publicly known in software that you can buy. 33:24.700 --> 33:27.703 [SPEAKER_04]: So not custom software, but you know, I have 33:27.683 --> 33:32.933 [SPEAKER_04]: version XYZ of Apache web server, and it's known to have that vulnerability. 33:32.953 --> 33:38.765 [SPEAKER_04]: Until you point my display at it, and if it has that vulnerability, it'll go and it'll open up a whole layer and exploit it. 33:39.225 --> 33:42.772 [SPEAKER_04]: And in the wrong hands, you can use that to hurt people. 33:43.073 --> 33:45.277 [SPEAKER_04]: Just the same as if you give a scalpel to someone. 33:45.397 --> 33:46.259 [SPEAKER_04]: They can cut themselves. 33:46.279 --> 33:47.802 [SPEAKER_04]: They can cut someone else. 33:47.782 --> 33:51.086 [SPEAKER_04]: But this tool, it's kind of like handing someone an atomic bomb. 33:51.466 --> 34:01.277 [SPEAKER_04]: And so if you're like, you know, for instance, let's say a big company, like Microsoft or Netflix or whatever, some big software company, they get a license to use it internally. 34:01.297 --> 34:02.518 [SPEAKER_04]: They find all their own bugs. 34:02.738 --> 34:11.067 [SPEAKER_04]: They have time because they are not publicly exposing, you know, when else knows, but them and they're fixing it, it would be like the ultimate pen test, right? 34:11.408 --> 34:12.148 [SPEAKER_04]: That could be great. 34:12.549 --> 34:17.434 [SPEAKER_04]: Except for what if one of those employees 34:17.414 --> 34:21.604 [SPEAKER_04]: You know what I mean or they take it and then they point it at something they're not supposed to, right? 34:21.644 --> 34:28.340 [SPEAKER_04]: Because it's so powerful and it's so fast and it's finding apparently like very novel unique things that humans haven't been able to see before. 34:28.380 --> 34:31.828 [SPEAKER_04]: It's quite disconcerting or I think so. 34:31.960 --> 34:36.567 [SPEAKER_03]: And there have been AI powered bug hunting solutions in the part. 34:36.587 --> 34:45.679 [SPEAKER_03]: I mean, I believe if you look at the hacker one league table right now, the number one bug hunter is an AI powered bug hunting solution at the moment. 34:45.780 --> 34:49.845 [SPEAKER_03]: Yeah, but the other thing which worries me is that, okay, so anthropicus had this data spill. 34:49.865 --> 34:52.669 [SPEAKER_03]: We're worried that maybe it could happen with mythos as well. 34:52.689 --> 34:53.771 [SPEAKER_03]: Patentially it could. 34:54.091 --> 34:55.994 [SPEAKER_03]: The thing which I think changes the story a bit. 34:56.335 --> 35:01.562 [SPEAKER_03]: This isn't even the first time anthropicus had a data leak like this. 35:01.542 --> 35:08.016 [SPEAKER_03]: earlier versions of the same packaging 2025, also shipped with full source maps before being pulled. 35:08.036 --> 35:09.779 [SPEAKER_03]: So this isn't a one-off slit. 35:10.160 --> 35:17.155 [SPEAKER_03]: It seems to almost be a pattern which has happened and who's to say couldn't happen again and maybe it could happen with mythos. 35:17.422 --> 35:18.244 [SPEAKER_04]: You know what, Graham? 35:18.384 --> 35:22.312 [SPEAKER_04]: I had no idea that they'd previously accidentally leaked their map. 35:22.332 --> 35:22.913 [SPEAKER_04]: Oh my gosh. 35:23.213 --> 35:24.616 [SPEAKER_04]: This is completely shocking. 35:24.857 --> 35:32.973 [SPEAKER_04]: I don't mean to sound insulting, but I can't believe that they could make the same mistake again because that would be so painful the first time. 35:33.354 --> 35:35.959 [SPEAKER_03]: So anthropics says this is a human era. 35:36.039 --> 35:36.139 [SPEAKER_03]: Yeah. 35:36.119 --> 35:42.168 [SPEAKER_03]: But should it be possible for a single human error to publish source code that should never have been made public? 35:42.468 --> 35:43.810 [SPEAKER_03]: Is that a process failure? 35:43.850 --> 35:45.012 [SPEAKER_03]: Is it a tool in failure? 35:45.132 --> 35:48.497 [SPEAKER_03]: Do we just have to sort of shrug and say, oh well, that's like these things happen. 35:48.878 --> 35:57.710 [SPEAKER_04]: So first of all, in get, so get as um, a tool that you can use to hold your source code and take care of it and manage it and store it. 35:58.111 --> 36:03.679 [SPEAKER_04]: There's this setting that you can do called get ignore and you list all these files to say basically 36:03.659 --> 36:06.122 [SPEAKER_04]: No matter what I say, don't upload this. 36:06.222 --> 36:08.584 [SPEAKER_03]: Yes, overwrite my own stupidity. 36:08.804 --> 36:09.025 [SPEAKER_03]: Yes. 36:09.465 --> 36:10.326 [SPEAKER_04]: Yeah, exactly. 36:10.426 --> 36:12.228 [SPEAKER_04]: And I take advantage of that all the time. 36:13.449 --> 36:17.153 [SPEAKER_04]: So there should be a default for every org and it should include those map files. 36:17.773 --> 36:22.358 [SPEAKER_04]: So that's step one is that we want to have the ignore file things set up properly. 36:22.719 --> 36:26.462 [SPEAKER_04]: And then we always know we're not supposed to have debug mode and production, right? 36:26.502 --> 36:31.928 [SPEAKER_04]: So we know that we should have on the build server, these settings turned off. 36:31.908 --> 36:42.398 [SPEAKER_04]: And so, basically, this is like security misconfiguration happening twice, which is on the new OOS Top 10, 2025, as a top risk to web apps. 36:42.718 --> 36:47.823 [SPEAKER_04]: Basically, they didn't configure the build server correctly, and then they didn't configure it correctly. 36:48.083 --> 36:51.146 [SPEAKER_04]: And then they don't have a processor or a checklist to check that. 36:51.486 --> 36:53.288 [SPEAKER_04]: So, I would love to see those three things. 36:53.888 --> 36:56.030 [SPEAKER_04]: I teach supply chain security. 36:56.070 --> 36:59.333 [SPEAKER_04]: I'm expanding and expanding that class all the time. 36:59.313 --> 37:15.786 [SPEAKER_04]: because there's more and more that we're doing wrong there and I feel like my organizations had to checklists and they had, you know, a heartening of these things that they're using there prior to their supply chain like we talked about earlier if we properly 37:15.766 --> 37:28.146 [SPEAKER_04]: So the CI, CD, and Build Server, those are usually synonymous, they're usually the same thing, or you have a Build Server, and then you have a pipeline and you connect the two, but usually it's all one big thing. 37:28.647 --> 37:34.737 [SPEAKER_04]: And so if we're properly hardening that, we're checking it at least once a year, if we analyze two, you know, 37:34.717 --> 37:39.583 [SPEAKER_04]: There's an alert, oh my gosh, there's a new administrator who's that, why do we have a new administrator? 37:40.124 --> 37:41.005 [SPEAKER_04]: We could do a lot better. 37:41.025 --> 37:49.056 [SPEAKER_04]: It is a human error, but the human error happened because we didn't have processes to protect that human from making that error. 37:49.096 --> 37:52.180 [SPEAKER_04]: And I don't like to blame like Alice or Bob. 37:52.200 --> 37:56.045 [SPEAKER_04]: I like to look at, do we train Alice or Bob on this? 37:56.466 --> 37:56.686 [SPEAKER_05]: Yeah. 37:56.706 --> 37:56.986 [SPEAKER_04]: Did we? 37:57.307 --> 37:57.467 [SPEAKER_05]: Yeah. 37:57.447 --> 38:00.851 [SPEAKER_04]: Right, did we have a safe guard to stop them from making this error? 38:00.871 --> 38:06.557 [SPEAKER_04]: Did we have a policy or did we just assume they knew because when we assume we're let down a lot. 38:07.257 --> 38:18.749 [SPEAKER_03]: So what we have here, Tanya is an AI company which has leaked the source code of its AI code in assistant by a packaging mistake, which is kind of ironic. 38:19.130 --> 38:22.153 [SPEAKER_03]: I'm going to give you a little bit of silver lining on the cloud, right? 38:22.173 --> 38:24.315 [SPEAKER_03]: Because this has all been a bit depressing. 38:24.295 --> 38:37.887 [SPEAKER_03]: Okay, which is this, if maybe this will give you a little bit of comfort, you do you get any comfort at all from the thought that the people building these tools are still fundamentally human and therefore fundamentally fallible. 38:37.927 --> 38:40.693 [SPEAKER_03]: Thank goodness, it's not the AI, right? 38:40.713 --> 38:41.916 [SPEAKER_03]: It's his human error. 38:41.896 --> 38:48.549 [SPEAKER_03]: Hey, yes, us humans, haven't we done great because we've really cocked up on this occasion by leaking the source code? 38:48.649 --> 38:55.322 [SPEAKER_03]: I think we should feel good about that, rather than it being an AI which screwed up, which surely is only a short way away. 38:55.763 --> 38:56.845 [SPEAKER_04]: But we don't know that. 38:57.025 --> 39:00.732 [SPEAKER_03]: That's true actually, that is true. 39:00.712 --> 39:01.112 [SPEAKER_04]: right? 39:01.152 --> 39:03.475 [SPEAKER_04]: Have you heard this term dark factory? 39:03.495 --> 39:04.716 [SPEAKER_02]: Oh, hello. 39:05.216 --> 39:07.899 [SPEAKER_04]: So we don't know if anthropic is becoming a dark factory. 39:08.059 --> 39:25.096 [SPEAKER_04]: So in manufacturing it means we just have robots so we don't need light, but there's software dark factories being built now where you don't have a single software developer anymore and literally every single part is only written by the AI and wouldn't you think the AI company might be most likely to do something like that? 39:25.176 --> 39:25.757 [SPEAKER_04]: I don't know. 39:25.737 --> 39:27.119 [SPEAKER_03]: Well, thank you very much, Tony. 39:27.159 --> 39:31.847 [SPEAKER_03]: There I was trying to be optimistic and cheer everybody up, and you've just made it all do me in gloomy again. 39:31.947 --> 39:32.488 [SPEAKER_03]: Great. 39:32.508 --> 39:34.250 [SPEAKER_03]: That's great. 39:34.270 --> 39:34.471 [SPEAKER_01]: Thank you. 39:34.491 --> 39:38.116 [SPEAKER_01]: This episode of Smashing Security is brought to you with support from Corvue. 39:38.637 --> 39:39.619 [SPEAKER_01]: Now, Joe, quick question. 39:39.919 --> 39:50.095 [SPEAKER_03]: If someone broke into your Microsoft 365 tenant right now, and quietly disabled your conditional access policies grabbed, global admin rights turned off Defender. 39:50.476 --> 39:51.998 [SPEAKER_03]: Would you even notice? 39:52.838 --> 39:54.480 [SPEAKER_03]: I'd like to say yes. 39:54.860 --> 39:55.982 [SPEAKER_03]: Well, that's the Spirit Joe. 39:56.002 --> 39:56.382 [SPEAKER_03]: Good job. 39:56.623 --> 39:58.285 [SPEAKER_03]: But here's the uncomfortable reality. 39:58.665 --> 40:02.290 [SPEAKER_03]: 63% of Microsoft 365 tenants. 40:02.810 --> 40:04.072 [SPEAKER_03]: Handout admin, right? 40:04.492 --> 40:05.453 [SPEAKER_03]: Let's go now, a fashion. 40:05.914 --> 40:10.500 [SPEAKER_03]: One compromised account and a attacker can quietly reshape your entire tenant. 40:10.980 --> 40:18.289 [SPEAKER_03]: No alerts, no noise, just someone, systematically dismantling your defenses while you're 40:18.539 --> 40:21.464 [SPEAKER_01]: So, wait, restore from backup doesn't fix that? 40:21.985 --> 40:24.229 [SPEAKER_01]: No, no, no, backups protect your data. 40:24.509 --> 40:27.434 [SPEAKER_03]: They don't restore tenant-level configurations. 40:27.715 --> 40:29.738 [SPEAKER_03]: There's no native rollback for that. 40:30.099 --> 40:33.845 [SPEAKER_03]: You could be rebuilding your tenant settings from scratch, for weeks. 40:34.546 --> 40:35.468 [SPEAKER_03]: And who's doing that? 40:35.448 --> 40:37.071 [SPEAKER_03]: Exactly, who wants to do that? 40:37.332 --> 40:42.061 [SPEAKER_03]: Well, core view have written a white paper called Total Tenant Takeover. 40:42.401 --> 40:45.327 [SPEAKER_03]: The Microsoft 365 disaster no one's ready for. 40:45.888 --> 40:47.992 [SPEAKER_03]: It's actually a really practical read. 40:48.473 --> 40:58.131 [SPEAKER_03]: It covers how these attacks unfold step by step where you're existing tools are leaving gaps and what it actually takes to recover control once it's been lost. 40:58.111 --> 41:03.017 [SPEAKER_01]: So, let's detect and panic more here's how to actually get your tenant back. 41:03.337 --> 41:04.578 [SPEAKER_01]: That's it, exactly. 41:04.919 --> 41:07.682 [SPEAKER_03]: And you can download this paper for free right now. 41:07.702 --> 41:16.873 [SPEAKER_03]: You can learn more at smashingsecurity.com slash core view, and maybe do it before someone else does something bad to your organisation. 41:17.313 --> 41:22.279 [SPEAKER_01]: That's smashingsecurity.com slash core view, and thanks to core view for supporting the show. 41:23.778 --> 41:28.562 [SPEAKER_03]: And welcome back in the join us at our favourite part of the show, the part of the show that we like to call, pick of the week. 41:31.244 --> 41:35.328 [SPEAKER_03]: Pick of the week. 41:35.348 --> 41:41.974 [SPEAKER_03]: Pick of the week is the part of the show where everyone chooses time but like could be a funny story about because they've read a TV show movie or record a podcast or website or an app. 41:42.074 --> 41:45.737 [SPEAKER_03]: Whatever they wish, it doesn't have to be security-related necessarily. 41:46.197 --> 41:49.941 [SPEAKER_03]: Well, my pick the week this week is actually security-related. 41:50.501 --> 41:52.823 [SPEAKER_03]: In fact, my pick the week this week. 41:52.803 --> 41:54.425 [SPEAKER_03]: And this is going to get very, very meta. 41:54.465 --> 42:03.279 [SPEAKER_03]: No, in a Mark Zuckerberg kind of way, because my pick of the week this week is actually about the smashing security podcast, because I've been busy doing a bit of vibe coding. 42:03.719 --> 42:04.921 [SPEAKER_03]: But I know very dangerous. 42:05.382 --> 42:09.568 [SPEAKER_03]: I've been exploring the world of podcast transcripts. 42:09.588 --> 42:14.355 [SPEAKER_03]: Ladies and gentlemen, I think it must be in about nine years ago when I first got an email from a listener. 42:14.335 --> 42:16.878 [SPEAKER_03]: saying, why don't you have a transcript? 42:16.958 --> 42:19.782 [SPEAKER_03]: I'd much rather read rather than listen to you. 42:20.322 --> 42:23.266 [SPEAKER_03]: And I said, well, you know, it's very hard putting a very transcript. 42:23.306 --> 42:32.657 [SPEAKER_03]: I'd be up all hours typing my non-sensical words into a word processor rod, get some computer system to try and transcribe me into a written English. 42:32.697 --> 42:36.462 [SPEAKER_03]: And you know, the quality is going to be diabolical anyway. 42:36.442 --> 42:53.299 [SPEAKER_03]: After quite a lot of work involved in largely pipe cleaners and pots of treacle by school chains, I have got together Heath Robinson type solution, which now has I believe acceptable transcripts this show. 42:53.319 --> 42:54.602 [SPEAKER_03]: Now my podcast host. 42:54.582 --> 42:57.025 [SPEAKER_03]: does create automated transcripts. 42:57.045 --> 43:05.076 [SPEAKER_03]: So if you go into your favorite podcast app at the moment and look at transcripts, it is sports that you will see a very, very bad transcript of the show. 43:05.257 --> 43:19.436 [SPEAKER_03]: My intention is to replace all of those and if you go to my website or to the smashing security website right now, you will find a much better transcript and in fact, it will even display the words as they are being said. 43:20.638 --> 43:23.762 [SPEAKER_03]: So you can 43:23.742 --> 43:26.185 [SPEAKER_03]: reasonably well most of the time. 43:26.225 --> 43:28.728 [SPEAKER_03]: Sometimes it makes them a stake for goodness. 43:28.908 --> 43:29.709 [SPEAKER_03]: Yes, I know. 43:29.770 --> 43:33.815 [SPEAKER_03]: Sometimes it all mix up my name with someone else's or something will go wrong. 43:33.835 --> 43:36.979 [SPEAKER_03]: But most of the time, I think it's pretty darn impressive. 43:37.019 --> 43:42.786 [SPEAKER_03]: So my pick of the week, rather self-referentially, is the new transcripts on the Smash and Security Podcast. 43:42.806 --> 43:44.468 [SPEAKER_03]: Go to Smash and Security.com. 43:44.448 --> 43:57.284 [SPEAKER_03]: or go and check out my articles on GrahamCluely.com and you will be able to see the transcripts in all of their glory there and tell me that it doesn't work and then I have to try and work out what the code's doing and try and fix it. 43:57.304 --> 43:57.745 [SPEAKER_04]: Whoa! 43:57.765 --> 43:59.149 [SPEAKER_04]: Thanks my pick of the week! 44:00.968 --> 44:02.290 [SPEAKER_04]: I like your pick of the week grant. 44:02.310 --> 44:02.991 [SPEAKER_03]: Thank you very much. 44:03.011 --> 44:03.472 [SPEAKER_04]: That was awesome. 44:03.512 --> 44:03.953 [SPEAKER_04]: Well done. 44:03.973 --> 44:07.178 [SPEAKER_03]: Do you have a pick of the week, Tanya? 44:07.738 --> 44:08.219 [SPEAKER_04]: I do. 44:08.500 --> 44:13.267 [SPEAKER_04]: So my pick of the week is a television show on Apple TV called Shrinking. 44:13.307 --> 44:21.660 [SPEAKER_04]: And it is about three psychologists that are friends that are all grieving because one of the psychologists has waivedite. 44:21.640 --> 44:32.068 [SPEAKER_04]: And it shows how he grieves, how his daughter grieves, how the two other psychologists grieve, and they teach all these different psychology lessons, essentially, in the show. 44:32.268 --> 44:38.164 [SPEAKER_04]: And last year I did a talk about the psychology of bad code and applying 44:38.144 --> 44:52.306 [SPEAKER_04]: economic behavior types of concepts to our security programs and how if we do that we can get better results because just yelling at software developers actually doesn't improve the quality at all as it turns out just being mean to them doesn't work. 44:52.326 --> 44:55.832 [SPEAKER_04]: We've tried that for two decades so I was like what if instead we did something different. 44:55.812 --> 45:00.757 [SPEAKER_03]: Have you tried the old cricket bat trick of taking a cricket back on just popping them on the back of a head? 45:00.897 --> 45:02.098 [SPEAKER_03]: Does that, does that, does that help at all? 45:02.419 --> 45:04.741 [SPEAKER_04]: My old boss was like, have you tried violence, Tanya? 45:04.781 --> 45:07.263 [SPEAKER_04]: And I was like, you haven't. 45:07.284 --> 45:13.249 [SPEAKER_04]: And he's like, you did, you're just, you're not really trying to problem solve it all, are you? 45:13.270 --> 45:17.494 [SPEAKER_03]: Oh, so I've just realized why your show is called shrinking because of his shrinks. 45:17.954 --> 45:18.194 [SPEAKER_03]: Yeah. 45:18.335 --> 45:19.996 [SPEAKER_03]: I'm so stupid sometimes. 45:20.096 --> 45:22.899 [SPEAKER_03]: It's, it's, take me this lump to work it out. 45:23.660 --> 45:23.760 [UNKNOWN]: Okay. 45:24.027 --> 45:30.717 [SPEAKER_04]: No, but so I'm fascinated by the reason that people do things and why people react the way they do. 45:30.757 --> 45:35.905 [SPEAKER_04]: I've always been like really curious about things like that, and so also that I could get better results, right? 45:35.925 --> 45:39.330 [SPEAKER_04]: Like, if someone blows up at me, it's like, why did they blow up at me? 45:39.450 --> 45:44.357 [SPEAKER_04]: And often it's not because of something I did, it's because they feel insecure or afraid or whatever, right? 45:44.377 --> 45:44.938 [SPEAKER_04]: And so... 45:44.918 --> 45:57.914 [SPEAKER_04]: In the show they're always explaining these different concepts, and I keep seeing them pop up in my life, I think whether it be at work or personally, and so most shows aren't very educational, Graham, most of them are a kind of garbage. 45:58.075 --> 46:01.259 [SPEAKER_03]: I really, I've never noticed. 46:01.279 --> 46:07.146 [SPEAKER_03]: I just been watching Meredith first sight Australia, so I thought all of them are really high quality, personally. 46:08.307 --> 46:13.735 [SPEAKER_04]: But so this one teaches lots of psychology lessons and why people do the things they do. 46:13.855 --> 46:16.118 [SPEAKER_04]: But in an entertaining way, so I don't know. 46:16.138 --> 46:16.619 [SPEAKER_04]: I like that. 46:16.639 --> 46:20.925 [SPEAKER_04]: I think if people are curious about why people do the things they do, they might like this. 46:21.386 --> 46:24.350 [SPEAKER_03]: And this is a drawbar or documentary, what is it? 46:24.591 --> 46:27.054 [SPEAKER_04]: So it's sort of a drama and it's sort of a comedy. 46:27.134 --> 46:29.358 [SPEAKER_04]: So I think they call them dramaties. 46:29.678 --> 46:32.182 [SPEAKER_03]: I think that's what you call a one-humped camera latches. 46:32.422 --> 46:33.744 [SPEAKER_03]: So anyway, yes, carry on. 46:33.824 --> 46:35.226 [SPEAKER_03]: So a drama dairy, right? 46:36.944 --> 46:47.321 [SPEAKER_04]: Basically, there's a bunch of parts that are sad, and then there's a bunch of parts that are funny, and so I think they call it a drama comedy, which they literally put on Apple TV drama. 46:47.702 --> 46:49.245 [SPEAKER_03]: Oh, I don't know if I like that word. 46:49.505 --> 46:50.106 [SPEAKER_03]: Yeah. 46:50.126 --> 46:51.388 [SPEAKER_03]: I'm not, I'm not so sure about that. 46:51.408 --> 46:53.071 [SPEAKER_03]: You're like, no, I do not accept. 46:53.492 --> 46:57.679 [SPEAKER_03]: Anyway, okay, so your pick of the week is the TV show shrinking. 46:58.200 --> 46:58.480 [SPEAKER_03]: Yep. 46:59.455 --> 47:02.499 [SPEAKER_03]: Well, that just about wraps up the show for this week. 47:02.539 --> 47:04.682 [SPEAKER_03]: Thank you so much, Tarno, for joining us. 47:05.062 --> 47:06.665 [SPEAKER_03]: I think you've been absolutely smashing. 47:06.745 --> 47:13.694 [SPEAKER_03]: I'm sure lots of our listeners would love to find out what you're up to and follow you online or listen to your podcast, of course, or the best way to do that. 47:13.814 --> 47:16.378 [SPEAKER_04]: So they should go to shehackspurple.ca. 47:16.738 --> 47:20.944 [SPEAKER_04]: And if you sign up for my newsletter, which is free, you'll get invades to everywhere I speak. 47:21.104 --> 47:27.272 [SPEAKER_04]: You'll see all my new content every month, you'll get the episode of the podcast, and you'll get at least one meme. 47:27.553 --> 47:29.395 [SPEAKER_04]: And memes are important, guys. 47:30.910 --> 47:33.453 [SPEAKER_03]: Yes, that's what we need more of is more memes. 47:33.553 --> 47:33.973 [SPEAKER_03]: We do. 47:34.053 --> 47:36.836 [SPEAKER_03]: That Nemoji is an animated GIFs. 47:36.856 --> 47:40.100 [SPEAKER_03]: And of course, smashing securities on social media as well. 47:40.180 --> 47:45.706 [SPEAKER_03]: You can find me grand clearly on LinkedIn or you can follow smashing security on Reddit or Blue Sky or Mastodon. 47:45.846 --> 47:48.009 [SPEAKER_03]: And don't forget to ensure you never miss another episode. 47:48.169 --> 47:54.876 [SPEAKER_03]: Follow smashing security in your favorite podcast app, such as Apple Podcasts, Spotify, and Pocketcasts, episode show notes. 47:54.856 --> 48:00.431 [SPEAKER_03]: sponsorship info, guest lists, and the entire back catalogue of 463 episodes. 48:00.792 --> 48:04.462 [SPEAKER_03]: Check out smashingsecurity.com until next time. 48:04.843 --> 48:06.167 [SPEAKER_03]: Cheerio, bye bye! 48:06.488 --> 48:07.009 [SPEAKER_04]: PAY! 48:18.599 --> 48:33.432 [SPEAKER_03]: You've been listening to smashing security with me grand clearly, and I am, of course, very grateful to Tanya for joining us this week, and this episode sponsors Corview Vanta and Mita, and of course to all of our fabulous supporters by Patreon. 48:33.953 --> 48:35.516 [SPEAKER_03]: This week we're pulling out of the hat. 48:35.797 --> 48:37.300 [SPEAKER_03]: Watson Burnie! 48:37.280 --> 48:43.212 [SPEAKER_03]: Sounds like a 19th-century detective who probably solves crimes exclusively by monocle. 48:44.615 --> 48:51.909 [SPEAKER_03]: Example name, now I strongly suspect he's a Patreon onboard inform that's gained sentience and signed up. 48:52.931 --> 48:54.394 [SPEAKER_03]: Kenneth Ingham? 48:54.374 --> 49:09.826 [SPEAKER_03]: Dan H, just for letter H, because apparently everything after H is classified, Yuri Taraday, who has tremendous energy, we're very glad that he's on our side, Ragnar Carlson, of course, was arriving by longship, we're not going to argue with them. 49:10.287 --> 49:13.935 [SPEAKER_03]: Jay, just the letter Jay, not to be confused with Matt H, sure. 49:13.915 --> 49:28.881 [SPEAKER_03]: John W. or Dan H, this is just the letter J on its own, unadorned, magnificent Ted Wilkinson sounds like a crookter, Govinda, charria, Travis West, who sounds like you should be presenting a true crime podcast of his own. 49:28.961 --> 49:34.911 [SPEAKER_03]: Thank you all so much, you are wonderful every single one of you and those are just a few. 49:34.891 --> 49:45.268 [SPEAKER_03]: of the folks who are supporting us fast smashing security plus, which means that they get episodes ad-free earlier than the general public and can be pulled out of random to have their names mocked. 49:45.788 --> 49:50.977 [SPEAKER_03]: At the end of the show, if you would like that, we got to do is join us at smashing security plus. 49:51.137 --> 49:58.148 [SPEAKER_03]: Head over to smashingscurity.com slash plus, but all of the details and YouTube can become a patron. 49:58.128 --> 50:14.614 [SPEAKER_03]: But there are also ways you can support the show, which don't involve spending a penny, that you can like, subscribe, leave a five-star review where you listen to your friends about the show, spread the word, every little bit helps, and it really does make all the effort worthwhile. 50:14.874 --> 50:16.557 [SPEAKER_03]: Well, thank you so much, Blissnith. 50:16.917 --> 50:18.740 [SPEAKER_03]: Well done for last in this long- into the show. 50:18.780 --> 50:23.688 [SPEAKER_03]: Not everyone, she's this much, you deserve a little badge for a pat on the back butt. 50:24.028 --> 50:25.671 [SPEAKER_03]: Until next time! 50:25.651 --> 50:28.630 [SPEAKER_03]: Take it easy, take care, stay secure my friends. 50:28.952 --> 50:30.784 [SPEAKER_03]: Tudaloo and bye-bye.