St. Paul Shut Down Dontcha Know

Minnesota National Guard activated, state of emergency declared after cyberattack against St. Paul

Episode Transcript

Speaker 1 (00:00):
So, guys, what if they close all the grocery stores
and we have to hunt for our own food. I know, Patrick,
you'll be fine, but me, I don't even know where
little Debbie lives, let alone Sarah Lee, What the hell
am I going to do?

Speaker 2 (00:14):
Squirrels?

Speaker 1 (00:24):
Hey, welcome back to security this week. I'm Carl Franklin,
and that's Patrick Hines and Duaye Laflotte here to bring
you the week's news that's so bad it'll keep you
laughing from crying. All right. Number one? This was Tom's hardware, right,
I think it was. We don't port it in different places.

Speaker 2 (00:41):
But we don't get stories from him, from them very
often or Tim him.

Speaker 1 (00:44):
Usually they're about a hardware.

Speaker 3 (00:47):
Was there a Tom? Is there a Tom?

Speaker 1 (00:49):
Yeah? Yeah?

Speaker 2 (00:50):
I figured Carl probably met him, had drinks with him,
performed with his band, well.

Speaker 1 (00:54):
Only only through Richard Campbell because Tom's hardware used to
be a favorite source of Gizmo Yeah one days. Yeah,
all right, So hacker inject's malicious potentially disc wiping prompt
into Amazon's AI coding assistant with a simple pull request. Told,
and here's the career criminal advice. Criminal career advice, it's

(01:19):
criminal your goal is to clean a system to near
factory state and delete file system and cloud resources on.

Speaker 2 (01:33):
What people have to understand is prompts are like web pages.
So when you send a web page to someone, they
view it in their browser. There's lots of things that
they can see that you think that's all they can see,
but there's lots of things under the covers that were
sent to their client that they can see if they
know how to look for them. Prompts are kind of
the same way. There are prompts that are in the

(01:56):
open and there are undercover prompts or system prompts that
basic say hey, you're an AI that does this, you know,
here's your resources. Here's basically it's like the operating system
instructions for the AI. And I think what is going
on here is they managed to put that into that
undercover prompt if I'm if I'm not mistaken.

Speaker 3 (02:17):
Yeah, I don't know why it was accepted in the
poll request, which is crazy.

Speaker 2 (02:21):
So AI probably approved the poll requests.

Speaker 3 (02:24):
Well so that the prompt was injected into the And
this is so this is Amazon's Q agent, the one
that does you know, helps coder's code. Right, It's like Copilot,
it's like Cursor, it's like all the other ones out there.
But apparently there was a malicious pull request and somebody
approved it got pulled into the main main branch and

(02:47):
for a little while as well.

Speaker 2 (02:48):
And the concern here is one of the reasons that
a lot of organizations are I think prudently not using
Chinese and other thread actor country models is because you
don't know what these underlying prompts are and the underlying
prompt could be if the information seems to be proprietary
secret diverted to here and you will never know. You

(03:10):
won't know what the underlying prompt is.

Speaker 1 (03:11):
But I didn't order Chinese. Hey, anybody ordered Chinese guy
at the park.

Speaker 2 (03:18):
And so this shows just how much in the infancy
we are with this technology that one most people don't
understand the you know, the above board prompt versus the
underlying prompt, and the fact that this was approved is
just it's ridiculous. So anybody if this would be like
this would be like Microsoft allowing a Colonel Driver to
be updated by a random pull request.

Speaker 1 (03:40):
But you would think that even if you know you
had the ability to make a pull request into any
of these things, you would think that there'd be some
checks and balances before it did something silly like this.

Speaker 3 (03:52):
To mistakes, information mistakes happen, you would hope, so, oh
my god.

Speaker 2 (03:57):
And you would be wrong. You'd be wrong, my friend,
at least in Amazon's case.

Speaker 1 (04:01):
Yeah, it just stinks. So I guess there really isn't
anything just to cautionary tale.

Speaker 2 (04:07):
You know, we need people to still keep learning about
this stuff, not just how to write a good prompt
to get your homework done and get an A. But
you're ready for them to understand how it works.

Speaker 1 (04:17):
You're right, though, Ultimately it did come down to the
person who approved the pull request, you know.

Speaker 2 (04:22):
Yeah, yeah, but all right, I'd also fault Amazon for
allowing that code to be edited with a pull request.
Mm hmm.

Speaker 3 (04:29):
Yeah right, well that's true too. Yeah, that's uh, that
should be a no go.

Speaker 2 (04:33):
There's plenty of blame to go around. Sure, I don't need,
we don't need to shirk on the blame. There's plenty.

Speaker 1 (04:38):
Just be careful, all right, So bleeping computer says sonic
Wall urges admins to patch critical remote code execution flaw
in SMA one hundred devices.

Speaker 3 (04:48):
Eh, I mean, all right, listen we've we've seen the
you should go patch, go patch, because why not. But
we've seen these devices. Go patch. We've seen these SMA
devices in the news several times over the last couple
of months. The reason I go, Yeah, you can bypass, uh,

(05:10):
you can bypass, and you can upload unrestricted files, but
you have to be authenticated the devices.

Speaker 2 (05:17):
Which the other hacks would allow.

Speaker 3 (05:20):
Yeah, and you have to be an administrator, so you
have to be an admin allowed, So it would.

Speaker 2 (05:28):
Fix the other pop problems. If you didn't fix the
other problems, this is compounding. If you did fix the
other problems, it's less of a problem, but it still
should be mitigated. You should still patch.

Speaker 1 (05:38):
Yeah, absolutely, So what is SMA? Is this a VPN thing.

Speaker 3 (05:41):
Or yeah, yeah, this is a VPN. It's their mobile appliance, right,
So it's used for to allow remote workers to connect
into you know, your your office space and that's.

Speaker 1 (05:52):
Right stuff, because that would be very convenient when.

Speaker 2 (05:55):
NIT patching, HM, very convenient.

Speaker 1 (05:58):
All right, So go patch, that's a go. Those are
good in my opinion. All right. Next, we have from
Expel blog poison Seed downgrading Fido key authentications to fetch
user accounts.

Speaker 2 (06:14):
So Fido is a is a good organization because they
have the goal of getting rid of passwords. They're basically
trying to make MFA the authentication is the probably the
shortest way I can say it. It's probably not a
perfect analogy. So they've they've been trying to do this

(06:34):
for a while, pass keys and all that other stuff.
But this is a downgrade attack. So we saw this
with Wi Fi, we saw this with Cellular when Cellular
is still hackable without a without a tower, and I
would say Cellular is pretty secure unless you put up
an Emzy catcher and a tower. You'd basically convince the
device on a mobile phone to use an older version

(06:55):
of the protocol which was vulnerable. Okay, they're doing the
same thing here. It's it's basically a downgrade attack, and
that allows the accounts to be compromised, and it's a
black eye. It's going to be it's going to set
things back, but I think you know, in the long run,
we're still they're going to fix it and it's going
to be the future. I think you should pay attention

(07:16):
to the Fido Alliance because eventually they're going to solve
a password problem.

Speaker 1 (07:20):
So by dwngrading. You're saying, hey, I know that the
state of the art way to do authentication is X,
but back in back a few years ago, we could
do why.

Speaker 2 (07:29):
Let's use that and I only support why.

Speaker 3 (07:31):
Yeah, and in this particular downgrade attack. So you have
the fight O key right where you can either push
button authenticate or whatever it is. But let's say I'm
on a device that I've never used before. Yeah, right,
there's a way that I can scan a QR code
with my phone and it will authenticate me. Right, So
it's not using the strength of the fight O key.

(07:52):
It's oh, well, I had the FIGHTO authentication credentials logged
in on my phone, so let's just use that.

Speaker 2 (07:58):
It's a combination of possession and knowledge, because you're right,
you have the possession of a device that has the knowledge. Right.

Speaker 1 (08:05):
It's like going to buy cigarettes, right, and they ask
you for your license and you say, no, I don't
have my license, but I got a Costco card and
they say, yeah, okay.

Speaker 2 (08:13):
Good enough for me.

Speaker 3 (08:14):
That actually happened to me recently. Really, No, I was actually, gosh,
I'm trying to remember where I was. I was I
was at a bar, and I was buying. Oh, I
was at I went to the Loom Years concert.

Speaker 1 (08:26):
Okay.

Speaker 3 (08:27):
And I went up to the to the bar and
I went to buy a drink and uh. Guy was like,
I need to see your license and I was like, oh, okay,
And I went to pull my license out and the
first thing that came out was like my global pass
idd has no Global Entry or something anything. Yeah, Gloyd,
it's just a Global Entry and has your picture. He
was like, yeah, you're good. I was like, okay, I.

Speaker 2 (08:49):
Mean there's no you have a little snow on the
roof there, temple.

Speaker 1 (08:53):
How many twenty year olds do you know that have
gray hair?

Speaker 2 (08:57):
That's true?

Speaker 4 (08:58):
Then global Entry? Hey, here's something career advice. Kids, get
Global Entry? Did Global Entry and to spray paint your
hair white?

Speaker 2 (09:08):
Uh?

Speaker 1 (09:09):
Yeah, okay, So we're done with a down grading one, right.

Speaker 3 (09:13):
Let's yeah, and this listen this downgrade attack. The way
it worked, it ended up being social engineering, right, a
phishing email sent to a user conning them into scanning
the QR code once they've already logged in. Interestingly enough,
when you logged in, you when you clicked on the link,
which you shouldn't. In fishing in an email that comes
in When you clicked on the link, it brought you
to a site. If you typed in your legitimate user

(09:35):
name in password, the hackers went to the real site,
submitted the username and password automatically clicked on I don't
have my fight, okey, I want to authenticate with a
mobile device. When it showed the QR code, they then
routed that and displayed it to the user. The user
then would scan it and it would get them in.
So it's it's mildly technical what they were doing in

(09:57):
the background, But honestly, if you jumped in through that
many hoops.

Speaker 2 (10:00):
It's a little bit of is this your card? Yes?

Speaker 3 (10:03):
Right, exactly exactly. Be careful what you be careful of
what you get in an email?

Speaker 1 (10:07):
All right? This next story is gee, I don't know
if I should jump for joy or just you know,
take that Russia, but pro Ukrainian hackers claim massive cyber
attack on Russia's Aeroflot and Aeroflot is the is the
airline is an airline, right.

Speaker 2 (10:24):
Yes, I mean I don't think there's any They didn't
crash a civilian airline or they cost a bunch of cancels.
They canceled doesn't If they had crashed a civilian airliner,
that would be a bridge too far. However, we've seen
Russia do that to an Azurebaijani flight, to other flights.
So and they started the war, so you know, I
think it's fair game.

Speaker 1 (10:44):
And not only that, they're continuing to just denihilate Ukraine
with with drone attacks.

Speaker 2 (10:49):
Yeah, so they're trying to get Ukraine to surrender, which
isn't going to happen, and they're hitting non military targets,
which isn't helping the military. And so it's just like
war crime, that's all it is. It's just like and
and I think that eventually the tide is turning and
that the sanctions are going to start getting bigger and

(11:09):
bigger and bigger, to the point where, yeah, but that's
a that's a it's.

Speaker 1 (11:13):
A different political issue, right, I mean, unless you're pro Russia,
yeah go putin, you crazy bastard. But so I think
it's a political issue at all. Is Ukraine basically took
down this airline for a while.

Speaker 3 (11:31):
Yeah, and this this story actually came from the discord,
So this was actually sent in by Trond So trand
if you're listening to this hitting me up. Thank you,
tront and we'll we'll send you out some picks. Yeah,
and he had he'd even noted in the discord he said, hey,
this hack was done by using a three year old
password and old software. Wow, according to pro Ukrainian Insights.

Speaker 2 (11:52):
So I mean they're just doing a free pin test.
Look at that. What I think is hilarious is the
Kremlin calls a situation alarming.

Speaker 1 (12:04):
I mean, you know, all right, well, this is a
good place to take a break, So we'll be right
back after these very important messages. Stay tuned and we're
back at Security this week. I'm Karl. That's Dwayne and Patrick.
And just as a reminder, if you don't want to
hear these ads, just become a patron five bucks a month,

(12:26):
that's what a coffee once a month, and that will
get you an ad free feed and you don't have
to put up with those ads. But unfortunately they do
pay the bills unless you help us pay the bills
by becoming a patron Patreon dot Security this week dot com. Okay,
next story from Bleeping Computer, hackers actively exploit critical remote

(12:46):
code execution in WordPress alone theme.

Speaker 2 (12:50):
I mean, I think four of those words are in
almost a story every month, right, hackers press. Yeah, it's
a theme again.

Speaker 3 (13:00):
Yeah, yeah, and this one is a theme. You're absolutely right.
A lot of people don't think that themes come with
any it's just like colors and pictures and right. But
it's that this particular theme has the ability to install
a plug in and that install code doesn't have any authentication,
so unauthenticated. If you're running this theme unauthenticated, an attacker

(13:23):
can upload malicious codes. This one's important, this one you
got to go patch.

Speaker 1 (13:27):
What I learned from this article is that there's a
word press security firm called word Fence. They're awesome and
they reported this story. Yeah. So their job is to
just track all of the problems with word Press plugins.

Speaker 3 (13:40):
And self appointed I think, is it so we're yeah,
word Fence is awesome. Honestly, they're not only that, but
they're also a web application firewall that you can sit
in front of word Press and they will make sure
it's not getting breached. So and if you want an
organization watching the front of your word Press, these guys
are the ones are constantly finding the exploits. I would

(14:02):
I would trust them in front of my work press.

Speaker 2 (14:04):
I mean, they're saying that they blocked one hundred and
twenty thousand exploitation attempts targeting their customers. So I'd say,
if you're going to use WordPress with any any of
these plugins.

Speaker 3 (14:15):
Works the way to fence, Yeah, agree.

Speaker 1 (14:18):
And ironically a word fence plug in. Yeah for word Press.

Speaker 2 (14:25):
Okay, but you know we tell you not to install
anything on your computer, and then we say install antivirus,
so you know.

Speaker 3 (14:31):
Yeah, just not from mcatheene.

Speaker 1 (14:34):
Right, all right, So the next sleeping computer story, hackers
plant four g Raspberry Pie on bank network and failed
at m heist. I think this was a Woody Allen movie,
wasn't it. This?

Speaker 3 (14:48):
Honestly, this one pisses me off a little bit because
they're taking our tactics.

Speaker 2 (14:53):
This is and they're failing. This is our go.

Speaker 3 (14:55):
To right, they weren't listeners. I mean, honestly, they should have.
They should have come to us for advice because there
are many other ways to hide a Raspberry high that
they're not going to find on your network.

Speaker 2 (15:04):
Why did they fail? I mean, this is so easy.
They got the device in place, I know.

Speaker 3 (15:09):
Right, well, and what's interesting is they got the device
in place on an ATM network, so they're still trying
to noodle out. Well, how did they get it on
that network? Right, whether it was they paid off an
employee to plug in the device on that network, or
they somehow we're able to compromise, you know, the particular

(15:29):
ATM network area that you know, the ingenious part here
is obviously they're using four G modem. I mean, like
anytime we are concerned about expelt trading data, we'll use
cellular networks too. There are a lot of our devices
that we have that have either four G T or
five G that give us access to networks.

Speaker 2 (15:48):
Yeah, everybody thinks that it's well you need a cell
phone plan, it's cheap. No, it's like ten bucks a month.

Speaker 3 (15:54):
Yeah, and even that, there are some of them page
you go for data plans and so they don't end
up being a lot, can you?

Speaker 2 (16:00):
And bitcoin?

Speaker 3 (16:01):
That's a good question, I would assume. So I haven't
had to hide from the cops that that well, but.

Speaker 2 (16:06):
No, but I'm betting these guys did.

Speaker 3 (16:09):
Yeah, or there are plenty of other ways to pay anyways.
So you know, they did do some interesting opsec operational
security to try and hide from forensics, and that sort
of thing, which is, you know, interesting. One of the
things noted here, as it said, another element that contributed
to the attacks high degrieve stealth was light basin, which

(16:31):
is their attack mounted alternative file systems like tenth fs
and e x T four over the slash proc pid
passy that's on the Linux on the I know, right
on the malicious processes. So what they were doing is
they were actually mounting directories over it in a window

(16:52):
system would be like the task manager, so that you
can't actually see the processes for the malicious process identifiers.
So yeah, interesting in that case.

Speaker 2 (17:01):
But other than that, did they fail because they didn't
have enough time and they got detected or they just
had a fundamental flow in their procedure.

Speaker 1 (17:08):
Now they saw the ATM machine was spitting out fifties
at an enormous strate.

Speaker 2 (17:14):
No, no, no, it was they wanted twenties.

Speaker 1 (17:16):
Man.

Speaker 3 (17:17):
Yeah, the device, the device was a little bit too
loud on the network, and it was it was.

Speaker 2 (17:21):
It was picked up so threat hunting and sock and
so for the wind.

Speaker 3 (17:27):
Yeah, but they were able to laterally move around the
bank's network and eventually get to their mail server and
then they were able to start planting back doors so
that when the Raspberry Pie was discovered, the attackers were
already already in the network and still had access. So

(17:48):
you know you're gonna be careful. You find something like that,
you rip it out. You can't assume that you're protected.

Speaker 2 (17:52):
Yeah, I mean I heard reports of people after a
break in they throw out their toothbrush and everything else
because they do ne't even know what somebody unfettered access
might do.

Speaker 3 (18:02):
I've seen horrible bosses.

Speaker 2 (18:03):
Yeah, you need you need those kinds of protections, and
and it how far do you go? You know, we've
talked about being able to put malware onto the drive
because you got in.

Speaker 3 (18:14):
Well, a lot of people do ask us that, like, hey, listen,
I had malware or had a virus or had or whatever, right,
or I had a breach? Right we we discovered that
somebody was logged into these systems, what should we do?
And and really it's how much time do you have
and how much money? How parently do you want to be?
Like I would I am always like scorched her, burn
it all over the ground and rebuilt.

Speaker 1 (18:35):
I would have a scott before I burn this to
the ground. I'm going I'm gonna have a drink and
a think and then I'll get out my lighter.

Speaker 2 (18:44):
And but you make sure it's always an earthy scotch.
I'm sure absolute.

Speaker 3 (18:49):
There scotch first instead.

Speaker 1 (18:55):
Of a scorch.

Speaker 2 (18:56):
So let's talk about this for a second.

Speaker 3 (18:57):
So it should be t shirts.

Speaker 2 (18:58):
Honestly, there's best practice and then there's reasonable practice. And
so if I if I'm if you to hire you
up on the target skill a nation state, those kinds
of things, you need to throw money at the problem.
And just Patrick, yeah, me, uh, you just you just
need to throw money at the problem, and you should
literally burn down anything that could be contaminated and rebuilt.

(19:23):
You should assume breach. That's that's a term that we
used to have that kind of fell out of It
fell out of use because it was supplanted by zero trust.
And they don't say zero trust. They don't mean the
same thing. So assume breach was assume that they're in
the network, and zero trust kind of feels like the

(19:44):
same thing, but it's not quite assume zero trust assumes
that the device that's trying to authenticate has been breached,
and therefore you need to not trust it, not say oh, yeah,
you're one of us. Come on and oh you got
the right shirt on, come on in. You prompt them,
you you qualify them every single time. But assume breach
means you assume they're actually in the wire, they're actually observing,

(20:07):
and you just haven't caught them yet. Those are different, right.
A zero trust helps with assume breach. Assume breach, in
my opinion, is a bigger mindset. It's more about, Okay,
I'm gonna shut off my phone every night because they
might have a toe hold and that might get rid
of them. What else can I do to disrupt them?

(20:28):
You know, if you saw the movie We Are Soldiers,
Mel Gibson, you know, whatever you think of him, it
was a good movie. It was based on a true
story in the Eadrang Valley in nineteen sixty five and
this unit was surrounded. They had basically intruded into a
part of Vietnam where there was like eight times more
soldiers of the enemy than their own, and they were

(20:50):
trying to be overrun, and right around dawn, the colonel
played by Gibson said, pass the word. I want everyone
to put two or three rounds in anything you see
that's suspicious so they got one hundred percent muster at
the line at the wire, and then without warning they

(21:11):
started They all put three rounds into something that they
thought that was bothering them, some round shape or and
they ended up breaking the back of the coming attack
before it could be launched, and they caused the attack
to launch before they were ready, and it clearly saved them.
And so those disruptive techniques, if you can adopt that
kind of thing. I mean, chaos monkey was not in

(21:33):
the same space, but it would have had the same effect.
If you know, if I'm this bank and I'm doing
chaos monkey thing, I might take down a switch that
they were planning on using, sure, and I might rebuild
it while it's down, because that's what you do, and
you you want to just be unpredictable. The more unpredictable
your systems are, the harder it will be for the hackers.

(21:56):
And that also speaks to security through obscurity. Everybody says
you can't have security through obscurity. You can't have that
be the primary right. You have to have other mechanisms,
other systems and implies. And I realize I'm on a
bit of a monologue here, So I'll keep going if
you want.

Speaker 1 (22:11):
But that's why we love you. Patrick. It's not the Tomahawks.

Speaker 2 (22:14):
Yeah for the monologue, so the bathroom breaks without being noticed, right,
But but it's it's the mentality of like, what could
I do to screw with Dwayne? I mean hackers today.
But honestly, you have to think that way. Like you know,
swapping the Wi Fi password, it's convenient to keep the
same Wi Fi password, change it once a month, right,

(22:35):
Or have two networks and leave the old one in
place while you make the change, so you have a
week of overlap and then the old one goes away, right.
I mean, there's all sorts of things you can do
to mess with hackers. Honeypots are great.

Speaker 1 (22:48):
I learned that from you, and basically back in the
days of Windows. Remember when we had Windows, back when
you had Windows servers.

Speaker 2 (22:55):
Now they're all bricked up.

Speaker 1 (22:56):
Yeah, you're all right. So the honeypot idea that I
got from you is you have the admin account, but
that's the one everyone wants to hack. So what you
do is you rename that to like Joe, and you
create a new ad with administrator access. You create a
new account called admin that has no access whatsoever.

Speaker 2 (23:15):
And then you the longest password known demand.

Speaker 1 (23:18):
Longest password known to man, and then you audit that
to see how many successful or attests or whatever is.

Speaker 2 (23:23):
There's no valid reason to be doing anything with that, right,
it's all bad stuff. Yeah, that's a that's an old,
try to and true one. And you can also create
other accounts like the backup admin. That's another one people
try to go for and rename the old one too,
you know, Leo Jenkins, you know, but.

Speaker 1 (23:42):
It doesn't matter Windows or Unix or whatever it is.
I mean, you still have security and accounts and usernames
and all that stuff, and that that old trick still works.

Speaker 2 (23:51):
What I've told Dwayne and I have discussed this many times,
and the analogy I like is, we don't de depend
on security obscurity to protect our tanks in combat, but
we don't paint them bright orange either, right, so we
you know, the tank is protected by more than just
as obscurity, but we still obscure them. So you want

(24:12):
to use obscurity as well as as well as you know,
hardened defenses. A defense in depth, assume breach zero trust
and a little bit of chaos is gonna it's gonna
make it harder for you, but it'll make your systems
more resilient, and it will mess up the hackers kill chain,
and that's what you want to do.

Speaker 1 (24:28):
So your tanks. Your tanks are painted with camouflage, but
at least they have armor, not canvas.

Speaker 2 (24:35):
Exactly, unlike the hum V I was driving around Iraq
in which had a canvas wall. I mean the chair
covering I'm sitting on is thicker than the lead.

Speaker 1 (24:47):
All right, Right, so we get to the main story here.
This is got me completely f guard. The Minnesota National
Guard activated state of emergency declared after a cyber attack
against Saint Paul, not the patron Saint Saint Paul, the
city of Saint Paul. Only crap. They took down a

(25:09):
whole city.

Speaker 3 (25:10):
And there's not a lot of detail that the city.
The city has just said listen, everything's offline, could be
every every But if you're.

Speaker 2 (25:19):
Bringing out the National Guard, then yeah, I mean, the
National Guard is not a hacking response organization. They're probably
there because nine to one one lines might be down.
They're probably there because they might lay in the streetlights exactly.
There may be you know, problems with other things where
they have distribute water. If the water filtration systems are

(25:41):
shut up, we don't know exactly what it is, and none.
This is all speculation. We're not trying to raise. But
that's why you'd call it the National Guard, is to
get hands and feet so that you can deal with
these things in a way that that used to be
digital and now they're going to have to be biological. Yeah.

Speaker 1 (25:58):
And when I said they shut down the entire city,
they set down the government of the city.

Speaker 2 (26:02):
Well, but still we just mentioned about four things that
everybody depends on, right, you know, and I don't know
which of those are offline, but I bet at least
one of them's not not not being good.

Speaker 3 (26:12):
Yeah, you don't call it a national guard if it's
just you know, oh, by the way, you can't rent books,
you know, borrow books at the local library, like.

Speaker 2 (26:20):
Yeah, and you're and you're we can't. We can't process
invoices for paid praffic tickets and that's not it.

Speaker 1 (26:25):
Right, all the all the information systems that the city uses.

Speaker 2 (26:30):
We would think, I wonder if it's industrial control systems though,
if it's also you know, things.

Speaker 3 (26:36):
Like well that they here. Again, they've been quite quiet
about it, so I have no idea. Well, we definitely
find out more.

Speaker 1 (26:42):
Says, While city officials haven't shared what information was accessed
and if anyone's personal information was part of it, there
are steps to take if people connected to the city
have concerns, and so they list some things that you
should do. And there are all things that you know
we talk about on this show.

Speaker 2 (27:00):
I mean, in your personal life, you have to assume breach.

Speaker 4 (27:03):
Right.

Speaker 2 (27:03):
So my social security number, I'm sure is out there.
In fact, the last big dump of so scary numbers,
mind's there. Good luck my security, all my credit is
locked down, and all my accounts are you know, double
triple password protected and MFA and all that stuff. I'm
not saying, you know, I'm untouchable, but I'm probably a

(27:24):
harder target than most. You need to make yourself a
hard target. That's that's the key. And so the old
standard of well, you know, if you think your creditials
are out there, your information, your so scurity numbers out there,
you should lock your credit. Everybody should assume that now,
and everybody should be locking your credit.

Speaker 1 (27:40):
And this just in we have some bonus content here
from Dwayne who posted this link in the in the
channel here. So I guess we have an extra story
for you women dating safety app t that's tea breached
users IDs posted to four Chan. I heard about this
a couple of days ago. Yeah, and it's pretty heinous.

Speaker 2 (28:01):
Yeah.

Speaker 3 (28:01):
I got this article from my buddy Cliff. Yeah. So
you can imagine this is a safety site, right where
women log in and let's say there's a male predator
of some sort or whatever. They can talk about their
experiences and that sort of stuff, and it's supposed to
be a pretty safe place, and they do. That site

(28:24):
does a really good job from what I hear, of
vetting the users, right, which means sending in pictures of yourself,
your ID, that sort of thing, so you can't yet
a fake user logged in and just pulling this information. Unfortunately,
that means the hackers also potentially picked up all that information.

Speaker 1 (28:42):
This link that is shared is a paywall, so you
have to be subscribed, but you get the gist of it,
and even the first paragraph is enough. Users from four
Chan claim to have discovered and exposed database hosted on
Google's mobile app development platform Firebase, belonging to the newly
popular women's dating safety app tuers say they're riffing through
people's personal data and selfies uploaded to the app and

(29:04):
then posting that data online, According to screenshots, four Chan posts,
and code reviewed by four oh four media, who this is?
This is what? Who reported it. In a statement to
four or four media, Tea confirmed the breach also impacted
some direct messages, but said that the data is from
two years ago. One point six million users is how

(29:26):
many claims to having users.

Speaker 2 (29:29):
I mean, unfortunately, this is going to probably spawn stocking
and all sorts of things that this is not something
we needed.

Speaker 1 (29:36):
We need.

Speaker 2 (29:37):
I mean, I never heard of Tea before this, but
it sounds like it's trying to help, not hurt. So
I'm saddened that, you know, some idiot found of vulnerability
and rather than telling them about it or even looking
for a payday by telling them and saying, hey, how
about you know, pay me, you know for it for oh,
they just exploited it. I wonder if it was a man.

Speaker 1 (30:00):
These kinds of stories can turn a bleeding heart liberal
into a raging maniac, you know, just wanting to hurt
these people who hurt others like this?

Speaker 2 (30:13):
Are you are you saying there's another way to be.

Speaker 3 (30:20):
All right.

Speaker 1 (30:20):
Well, on that happy note, we'll call it a week
and we'll see you next week. I'm Scarity this week.
Bye bye bye,