1 00:00:00,388 --> 00:00:04,468 You found the backup wrap up your go-to podcast for all things 2 00:00:04,468 --> 00:00:07,018 backup recovery and cyber recovery. 3 00:00:07,708 --> 00:00:11,188 In this episode, we talk about a real nightmare scenario. 4 00:00:11,338 --> 00:00:17,758 It was a hack of an app called Arc, GIS, and it went undetected for 12 months. 5 00:00:18,118 --> 00:00:19,978 That's right an entire year. 6 00:00:20,458 --> 00:00:24,358 The threat group was called Flax Typhoon, and they compromised an arc 7 00:00:24,358 --> 00:00:27,958 GIS server, and turned a legitimate Java extension into a web shell. 8 00:00:29,233 --> 00:00:32,473 And every time the customer backed up their system, they were actually 9 00:00:32,473 --> 00:00:33,913 backing up the malware too. 10 00:00:34,633 --> 00:00:38,653 Uh, we talk about how this happened and why traditional security tools 11 00:00:38,653 --> 00:00:43,453 completely missed it, and what you could do most importantly to prevent 12 00:00:43,573 --> 00:00:45,103 something like this from happening to you. 13 00:00:45,823 --> 00:00:49,753 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 14 00:00:49,753 --> 00:00:50,233 Backup. 15 00:00:50,503 --> 00:00:53,503 And I've been passionate about backup and recovery and now 16 00:00:53,503 --> 00:00:56,173 cyber recovery for over 30 years. 17 00:00:56,383 --> 00:00:56,833 Ever since. 18 00:00:56,833 --> 00:01:00,583 I had to tell my boss that we had no backups of the production 19 00:01:00,583 --> 00:01:02,023 database that we just lost. 20 00:01:02,443 --> 00:01:04,003 I don't want that to happen to you. 21 00:01:04,183 --> 00:01:05,563 That's why I do this. 22 00:01:05,803 --> 00:01:10,543 On this podcast, we turn unappreciated admins into Cyber Recovery Heroes. 23 00:01:10,843 --> 00:01:12,973 This is the backup wrap up. 24 00:01:26,415 --> 00:01:27,435 Welcome to the show. 25 00:01:27,945 --> 00:01:32,295 Hi, I am w Curtis Preston, AKA, Mr. Backup, and I have with me a guy that 26 00:01:32,295 --> 00:01:37,035 started poking around in my software Prasanna Malaiyandi, How's it going? 27 00:01:37,035 --> 00:01:37,555 Prasanna, 28 00:01:37,990 --> 00:01:38,280 Good. 29 00:01:38,280 --> 00:01:39,915 Curtis, how are you doing? 30 00:01:39,975 --> 00:01:40,995 do, doing okay. 31 00:01:40,995 --> 00:01:45,315 You can't just go into my thing and make changes and not tell me. 32 00:01:46,230 --> 00:01:49,530 Well, this is 'cause you complained that I don't do enough stuff. 33 00:01:49,530 --> 00:01:51,960 So I started doing stuff and now you complain the other way. 34 00:01:52,455 --> 00:01:54,165 You just gotta, you just gotta tell me. 35 00:01:54,225 --> 00:01:57,675 I, I mean, we're researching, in this show, we're talking about 36 00:01:57,975 --> 00:02:01,215 software that you use all the time, being used against you. 37 00:02:01,215 --> 00:02:03,555 And I log in and I, there were changes. 38 00:02:04,455 --> 00:02:05,775 I didn't, I didn't know there were changes. 39 00:02:05,775 --> 00:02:06,375 I got scared. 40 00:02:06,465 --> 00:02:10,635 I thought, I, I thought that the, that our show about being hacked had been hacked. 41 00:02:13,710 --> 00:02:18,840 So, so let's, uh, let's, let's jump in this thing, this story. 42 00:02:18,870 --> 00:02:22,680 Uh, and by the way, for our listeners, we're actually gonna try something new. 43 00:02:22,860 --> 00:02:25,200 We're gonna try not to talk so dang much. 44 00:02:25,470 --> 00:02:29,250 Um, our, our shows have typically gone 30 to 40 minutes. 45 00:02:29,250 --> 00:02:33,000 We're gonna try to keep 'em a little shorter, uh, see how that works. 46 00:02:33,180 --> 00:02:35,190 I think the primary problem with that is me. 47 00:02:35,700 --> 00:02:36,690 But, um. 48 00:02:36,705 --> 00:02:37,155 to talk? 49 00:02:37,470 --> 00:02:38,430 I do like to talk. 50 00:02:38,430 --> 00:02:38,730 Yeah. 51 00:02:38,810 --> 00:02:38,890 Hmm. 52 00:02:39,210 --> 00:02:47,010 So, uh, we're gonna talk about this, um, this story of a customer of arc. Arc. 53 00:02:47,070 --> 00:02:51,000 Is it Arc, GISI guess Is that somebody that, that, that would be pronounced? 54 00:02:51,270 --> 00:02:55,320 So, so this is a geographic information service? 55 00:02:55,320 --> 00:02:56,850 Is that, what, is that what that's called? 56 00:02:57,390 --> 00:02:58,260 I've heard about this. 57 00:02:58,260 --> 00:03:02,220 You can use it for like data analytics and other things about 58 00:03:02,220 --> 00:03:06,600 different areas and gather different statistics based off of it, 59 00:03:06,940 --> 00:03:07,320 Yeah. 60 00:03:07,350 --> 00:03:11,130 so it helps you do analysis of a lot of different data 61 00:03:11,520 --> 00:03:15,870 And what it appears is that it was an actual piece of software that was 62 00:03:15,870 --> 00:03:23,850 installed on a server, and it turned out that a group called Flax Typhoon, 63 00:03:24,060 --> 00:03:24,810 That's a new one. 64 00:03:25,020 --> 00:03:25,290 Yeah. 65 00:03:25,350 --> 00:03:26,850 It's, I I hadn't heard of it. 66 00:03:26,850 --> 00:03:27,240 Yeah. 67 00:03:27,270 --> 00:03:33,255 Uh, and they're a, a China based, uh, a PT. Threat group or a PT group, right. 68 00:03:33,255 --> 00:03:34,695 Advanced persistent threat. 69 00:03:35,265 --> 00:03:41,475 Uh, and they had managed to, um, what, what would you call it? 70 00:03:41,535 --> 00:03:43,725 Um, well hack it. 71 00:03:43,725 --> 00:03:45,015 I guess we, we'll just call it. 72 00:03:45,105 --> 00:03:45,345 Well, 73 00:03:45,345 --> 00:03:46,095 Yeah, 74 00:03:46,275 --> 00:03:46,545 did 75 00:03:46,575 --> 00:03:46,735 go ahead. 76 00:03:46,875 --> 00:03:48,405 they hacked it, right? 77 00:03:48,405 --> 00:03:52,365 They found administrator credentials to the software. 78 00:03:52,695 --> 00:03:57,615 They accessed it, and then they basically deployed an extension 79 00:03:58,500 --> 00:03:59,280 Yeah. 80 00:03:59,340 --> 00:03:59,790 Yeah. 81 00:03:59,790 --> 00:04:02,970 J they call it the Java server object Extension. 82 00:04:03,000 --> 00:04:03,570 SOE. 83 00:04:03,570 --> 00:04:03,900 Yeah. 84 00:04:04,005 --> 00:04:09,555 Yeah, and they used that as sort of a backdoor into the system and gained 85 00:04:09,555 --> 00:04:11,145 access into the network and other things. 86 00:04:11,145 --> 00:04:12,675 And it all just looked normal. 87 00:04:12,675 --> 00:04:17,295 And I think one of the big things was, you know how we always talk about, 88 00:04:17,295 --> 00:04:20,445 okay, the best way to recover from ransomware is to have a backup that you 89 00:04:20,490 --> 00:04:21,990 Right, right. 90 00:04:22,015 --> 00:04:26,005 this case, because of how these extensions work, people were 91 00:04:26,005 --> 00:04:27,865 actually backing up the extension. 92 00:04:27,865 --> 00:04:31,285 So if you ever tried to restore from your backups, which is 93 00:04:31,385 --> 00:04:32,985 Yeah, yeah, 94 00:04:33,205 --> 00:04:35,665 restore the extension and therefore the malware. 95 00:04:36,225 --> 00:04:36,465 yeah. 96 00:04:36,465 --> 00:04:40,365 And so basically they turned this SOE into a functioning web shell 97 00:04:40,545 --> 00:04:41,985 that could do whatever they want. 98 00:04:42,165 --> 00:04:45,615 I think my favorite part of the story is that they put a password. 99 00:04:46,095 --> 00:04:47,565 In their hack. 100 00:04:47,865 --> 00:04:50,805 So they had this back door that could do whatever they want, and then 101 00:04:50,805 --> 00:04:52,455 they went and put a password on it. 102 00:04:52,965 --> 00:04:55,935 That, that basically said, only we can use the hack. 103 00:04:56,685 --> 00:04:57,525 exactly. 104 00:04:58,365 --> 00:05:03,105 Um, and, and how long, how long Prasanna were they in this customer's 105 00:05:03,105 --> 00:05:04,635 environment before they were discovered or 106 00:05:04,880 --> 00:05:06,100 months, I wanna say. 107 00:05:06,135 --> 00:05:08,070 12? Months, 108 00:05:08,130 --> 00:05:08,350 Yep. 109 00:05:08,910 --> 00:05:10,980 let that sit with our listeners. 110 00:05:10,980 --> 00:05:13,140 They were in their environment for 12 months. 111 00:05:13,200 --> 00:05:18,720 Now, I just want to say it appears that nothing that none of this, this 112 00:05:18,720 --> 00:05:22,170 was not Arc C, arc GIS was not hacked. 113 00:05:22,530 --> 00:05:22,920 Right? 114 00:05:22,920 --> 00:05:27,090 This was not a vulnerability of Arc G. Arc GIS. 115 00:05:27,360 --> 00:05:28,770 Um, this was. 116 00:05:29,265 --> 00:05:34,395 This was a compromise, uh, but a compromise that was made 117 00:05:34,395 --> 00:05:40,425 possible in my professional opinion based on, uh, user error. 118 00:05:40,665 --> 00:05:41,025 Right? 119 00:05:41,025 --> 00:05:45,285 User, user misconfiguration, uh, and then also, uh, and we're 120 00:05:45,285 --> 00:05:46,605 gonna, we're gonna talk about that. 121 00:05:46,965 --> 00:05:52,665 Um, basically, and, and also it was the reason it was allowed to stay 122 00:05:52,665 --> 00:05:58,185 so long is because of, I think the inherent trust that people put in. 123 00:05:58,860 --> 00:06:00,875 Stuff that they install and they use all the time. 124 00:06:01,110 --> 00:06:06,330 And just to add one more thing to this is the way Arc GIS is deployed 125 00:06:06,330 --> 00:06:09,450 in this environment is you sort of had a public facing thing. 126 00:06:09,935 --> 00:06:10,285 Right. 127 00:06:10,395 --> 00:06:14,775 then they also had an internal arc, GIS instance, which would kind of do all 128 00:06:14,775 --> 00:06:20,295 the work, but the public one would proxy request to the internal one, and so 129 00:06:20,295 --> 00:06:22,275 they also compromised things that way. 130 00:06:22,275 --> 00:06:25,125 So they were able to get access to the internal network because of 131 00:06:25,125 --> 00:06:26,775 that public facing arc, GIS server. 132 00:06:27,390 --> 00:06:27,900 Yeah. 133 00:06:28,110 --> 00:06:28,560 Yeah. 134 00:06:28,770 --> 00:06:29,580 Good times. 135 00:06:30,060 --> 00:06:34,200 Uh, and so what it, what it appears is that they got, uh, they, they 136 00:06:34,200 --> 00:06:39,300 somehow got a password from a, uh, an administrative account. 137 00:06:39,750 --> 00:06:45,095 And then I do think it's funny that it does show in the article that they then. 138 00:06:45,780 --> 00:06:50,760 Um, changed the password of the administrative account, uh, 139 00:06:50,760 --> 00:06:52,410 which, which I find interesting. 140 00:06:52,410 --> 00:06:56,190 Like nobody, does nobody ever log into the admin account, 141 00:06:56,430 --> 00:06:56,730 Like 142 00:06:56,760 --> 00:06:57,180 know? 143 00:06:57,240 --> 00:06:59,160 it up and running, it's like why bother going? 144 00:06:59,160 --> 00:07:02,340 It may not be one of those systems you're constantly checking and monitoring 145 00:07:02,490 --> 00:07:03,630 Yeah, yeah. 146 00:07:04,080 --> 00:07:06,930 Uh, so basically they had, they had this web shell that could do 147 00:07:06,990 --> 00:07:08,700 literally whatever they wanted. 148 00:07:09,090 --> 00:07:11,130 Uh, they poked around the customer's environment. 149 00:07:11,130 --> 00:07:13,770 They tried to go after a couple of different workstations. 150 00:07:14,220 --> 00:07:15,720 It was it workstations. 151 00:07:15,720 --> 00:07:18,450 'cause they wanted to be able to get other credentials and 152 00:07:18,450 --> 00:07:19,620 access to other resources too. 153 00:07:20,430 --> 00:07:21,570 Yeah, yeah. 154 00:07:22,110 --> 00:07:26,100 And you know, and I, I, so the first thing I want to talk about is the, 155 00:07:26,100 --> 00:07:27,990 the, the backup issue that you stated. 156 00:07:28,440 --> 00:07:33,540 So while, while you're right, we do always recommend, uh, 157 00:07:33,570 --> 00:07:35,460 backups of, of everything, right? 158 00:07:35,460 --> 00:07:38,580 I, and, and, and I tell people, even though I do think that you 159 00:07:38,580 --> 00:07:42,150 should be restoring data and apps and, and the os like differently, 160 00:07:42,600 --> 00:07:44,040 uh, just, just back it all up. 161 00:07:44,185 --> 00:07:45,295 Right, just back up everything. 162 00:07:45,295 --> 00:07:48,655 I'd much rather you just back up everything and have wasted space than, 163 00:07:48,655 --> 00:07:53,515 than to selectively select things and, uh, and accidentally miss something important. 164 00:07:53,995 --> 00:07:58,855 But I do think that, uh, if they were trying to selectively restore 165 00:07:58,885 --> 00:08:05,335 this environment, um, it doesn't quite go the way I would think that 166 00:08:05,335 --> 00:08:07,640 you should if you think you have. 167 00:08:08,280 --> 00:08:13,950 If you've suspected an attack, um, at least, at least I know in the upcoming 168 00:08:13,950 --> 00:08:18,570 book, uh, that would be learning ransomware response and Recovery. 169 00:08:18,780 --> 00:08:23,160 We do recommend that for the operating system and for applications, you should 170 00:08:23,160 --> 00:08:27,600 be, you should be restoring this as I make quotes in the air from, uh, 171 00:08:27,600 --> 00:08:30,390 a golden image, not from a backup. 172 00:08:30,690 --> 00:08:34,500 You know, that was taken anytime, anytime recently. 173 00:08:34,500 --> 00:08:34,770 Right. 174 00:08:35,160 --> 00:08:37,830 And, and that, I think if they had done that. 175 00:08:38,220 --> 00:08:41,760 If they had restored it from a golden image, then I think perhaps 176 00:08:41,760 --> 00:08:43,500 I would've addressed this issue. 177 00:08:43,920 --> 00:08:47,190 Having said that, there is, there is that concern that you talked about if 178 00:08:47,190 --> 00:08:51,660 they were actually backing up these, these extensions as something like 179 00:08:51,660 --> 00:08:55,980 extra, then that might have been, they still might have reinfected themselves. 180 00:08:56,280 --> 00:08:57,000 Ex. Yeah. 181 00:08:57,180 --> 00:09:02,550 And also in the article that they, I think we'll post a link in the show description 182 00:09:02,550 --> 00:09:07,740 from this article, but they also mentioned that the only way, so this company 183 00:09:07,740 --> 00:09:09,600 or this customer got attacked, right? 184 00:09:09,630 --> 00:09:12,060 And then they brought in this other company security company 185 00:09:12,060 --> 00:09:13,440 to do the investigation. 186 00:09:13,770 --> 00:09:15,150 I think they're called ReliaQuest. 187 00:09:16,095 --> 00:09:16,305 Yeah. 188 00:09:16,305 --> 00:09:17,085 I rely a quest. 189 00:09:17,085 --> 00:09:17,175 Yeah. 190 00:09:17,925 --> 00:09:18,615 Rely Quest. 191 00:09:18,645 --> 00:09:22,665 And so one of the things they talked about is they actually went through to 192 00:09:22,665 --> 00:09:26,865 try to figure out like which extensions are valid and which ones are not, because 193 00:09:26,865 --> 00:09:27,015 Mm-hmm. 194 00:09:27,585 --> 00:09:30,465 didn't even know like which ones were supposed to be on 195 00:09:30,465 --> 00:09:31,605 this server to start with. 196 00:09:31,935 --> 00:09:32,445 Interesting. 197 00:09:32,880 --> 00:09:34,920 And so I think that becomes a challenge. 198 00:09:34,920 --> 00:09:37,560 Just to what you were saying, Curtis, it's you restore it. 199 00:09:37,560 --> 00:09:40,260 How do you know what was supposed to be there and what wasn't? 200 00:09:40,260 --> 00:09:45,180 It's if you don't know what those are and what seems to be legitimate traffic 201 00:09:45,405 --> 00:09:45,855 Right. 202 00:09:46,170 --> 00:09:49,710 behavior from the application versus what is anomalous. 203 00:09:49,950 --> 00:09:53,820 And, and the closest analogy that I have to, that is, you know, 204 00:09:53,820 --> 00:09:55,770 I use, uh, WordPress, right? 205 00:09:55,770 --> 00:09:57,060 For the website. 206 00:09:57,160 --> 00:09:59,020 And WordPress has extensions. 207 00:09:59,660 --> 00:10:00,050 Right. 208 00:10:00,290 --> 00:10:02,900 And the, and, and it's very easy to install. 209 00:10:03,020 --> 00:10:05,090 Install, and, you know, activate. 210 00:10:05,090 --> 00:10:06,470 It's like, it tastes like two clicks. 211 00:10:06,620 --> 00:10:07,520 Install and activate. 212 00:10:07,520 --> 00:10:08,420 Install and activate. 213 00:10:08,870 --> 00:10:13,640 And it's very common for you to install it, activate, play with it 214 00:10:13,640 --> 00:10:16,730 for a little bit, decide not to use it, and then just leave it there. 215 00:10:16,945 --> 00:10:17,155 Yep. 216 00:10:17,305 --> 00:10:18,595 Bad juju, right? 217 00:10:18,595 --> 00:10:21,655 Because you do not want the problem that they had. 218 00:10:21,865 --> 00:10:24,775 You wanna know what, you wanna know, what your system inventory is. 219 00:10:24,775 --> 00:10:28,405 You wanna know what any, uh, extensions, applications, et cetera, 220 00:10:28,645 --> 00:10:30,175 that are running in your environment. 221 00:10:30,415 --> 00:10:33,110 And ones that are ones that are not. 222 00:10:34,030 --> 00:10:36,640 Actively being used should be either removed, like you 223 00:10:36,640 --> 00:10:37,930 said, and and also patched. 224 00:10:37,930 --> 00:10:38,200 Yes. 225 00:10:38,200 --> 00:10:39,130 Actively patched. 226 00:10:39,580 --> 00:10:39,910 Yeah. 227 00:10:40,480 --> 00:10:46,900 Um, and, um, so they did ultimately get, uh, they did 228 00:10:46,900 --> 00:10:48,880 ultimately get rid of this problem. 229 00:10:49,090 --> 00:10:52,030 I don't know, did they talk in the article? 230 00:10:52,030 --> 00:10:55,690 I didn't see, did they figure out what damage was done? 231 00:10:56,410 --> 00:10:59,860 Uh, they looked to see the spread, but they didn't find 232 00:11:00,070 --> 00:11:01,330 Yeah. 233 00:11:01,330 --> 00:11:01,780 Okay. 234 00:11:01,840 --> 00:11:04,900 Um, they don't, they don't really know, I guess is what that is. 235 00:11:05,380 --> 00:11:05,650 Yeah, 236 00:11:05,770 --> 00:11:06,640 Yeah, yeah. 237 00:11:06,820 --> 00:11:13,720 warn that just given the behavior of, what's it called, flax, typhoon. 238 00:11:14,440 --> 00:11:14,860 Yeah. 239 00:11:15,595 --> 00:11:20,365 Given the behavior of flax typhoon, it's one of these groups that plans 240 00:11:20,605 --> 00:11:22,885 methodically before attacking. 241 00:11:23,365 --> 00:11:27,565 So they were mentioning that they've probably also already figured out what 242 00:11:27,565 --> 00:11:30,475 they're going to do next, and it's just a matter of time before they act. 243 00:11:31,000 --> 00:11:31,480 Hmm. 244 00:11:31,630 --> 00:11:32,140 Yay. 245 00:11:32,665 --> 00:11:33,205 Yay. 246 00:11:33,880 --> 00:11:37,810 so let's talk about what they could have done, uh, differently. 247 00:11:38,020 --> 00:11:41,080 And of course this is this, this article that we're reading is a blog 248 00:11:41,080 --> 00:11:45,190 post by ReliaQuest, and of course one of ReliaQuest is strategies. 249 00:11:45,685 --> 00:11:49,645 Uh, is to use, uh, ReliaQuest, uh, software, right? 250 00:11:49,825 --> 00:11:52,345 Um, one of which is called Ag Agentic ai. 251 00:11:52,465 --> 00:11:56,125 And, and you know, not necessarily that, but I agree with their 252 00:11:56,125 --> 00:11:58,285 recommendation in that. 253 00:11:58,435 --> 00:12:03,235 The problem here was that the, the tools that they were using were 254 00:12:03,535 --> 00:12:07,015 typically, uh, hunting for IOCs. 255 00:12:07,015 --> 00:12:08,305 You want to talk about what that is, 256 00:12:08,470 --> 00:12:11,830 Yeah, this is in indications of compromise, 257 00:12:11,905 --> 00:12:12,325 right? 258 00:12:12,610 --> 00:12:17,290 that help you understand, okay, I was compromised because I might see a log file 259 00:12:17,290 --> 00:12:22,240 or a binary with this sort of signature on it and other things to indicate 260 00:12:22,240 --> 00:12:24,400 that yes, something has attacked me. 261 00:12:25,005 --> 00:12:25,225 Yeah. 262 00:12:25,225 --> 00:12:28,835 And so instead of ho hunting for known bad software, you can hunt 263 00:12:28,835 --> 00:12:31,205 for unknown behavior, right? 264 00:12:31,205 --> 00:12:35,735 So it is, this is this, because the problem is this was 265 00:12:36,005 --> 00:12:37,715 essentially custom software. 266 00:12:37,790 --> 00:12:38,060 Yep. 267 00:12:38,195 --> 00:12:41,675 so, so anything that's hunting for known signatures is not 268 00:12:41,675 --> 00:12:42,965 gonna find anything wrong. 269 00:12:43,445 --> 00:12:49,055 But if they had been watching the activity of what this thing was doing, 270 00:12:49,325 --> 00:12:54,095 then they would've seen these odd, uh, requests and they, they go ahead. 271 00:12:54,995 --> 00:12:59,135 But one thing though that, and I don't know, maybe the customer didn't have 272 00:12:59,135 --> 00:13:04,895 the best tools in place, but they were doing things like creating services on 273 00:13:04,895 --> 00:13:09,920 startups, seeing if it failed, restarting, like all of these things, which I would 274 00:13:09,920 --> 00:13:13,120 assume you would flag regardless as, 275 00:13:13,370 --> 00:13:13,700 Right. 276 00:13:13,840 --> 00:13:15,480 this is some bad behavior. 277 00:13:16,445 --> 00:13:17,615 I should go look at it. 278 00:13:17,935 --> 00:13:18,155 If. 279 00:13:18,215 --> 00:13:19,925 almost sort of like your basics, right? 280 00:13:20,240 --> 00:13:22,310 If you're watching for that sort of thing, right? 281 00:13:22,310 --> 00:13:26,060 A lot of people, especially people that are not, not cyber, 282 00:13:26,265 --> 00:13:26,555 Yeah. 283 00:13:26,570 --> 00:13:30,320 don't know, savvy, not terribly cyber savvy, but they talked about that they 284 00:13:30,320 --> 00:13:34,820 had the ability to do, uh, automated response playbooks and at the first time 285 00:13:35,150 --> 00:13:37,550 the this command started running weird. 286 00:13:37,550 --> 00:13:38,115 Who am I? 287 00:13:38,555 --> 00:13:38,845 Yeah. 288 00:13:38,960 --> 00:13:41,210 like who runs a who am I, uh, command? 289 00:13:41,210 --> 00:13:41,420 Right. 290 00:13:41,420 --> 00:13:44,360 As soon as they did that, they said they would've quarantined that server. 291 00:13:44,630 --> 00:13:46,730 It wouldn't have been able to talk to other people. 292 00:13:46,880 --> 00:13:51,410 Also, as soon as it started talking to C two servers, what are C two servers? 293 00:13:51,530 --> 00:13:52,360 Uh, Prasanna. 294 00:13:52,430 --> 00:13:54,710 Command and control servers. 295 00:13:54,830 --> 00:13:54,980 Yeah. 296 00:13:54,980 --> 00:13:55,190 Yeah. 297 00:13:55,460 --> 00:14:00,050 think of it as servers out there on the internet that these malicious actors 298 00:14:00,050 --> 00:14:05,190 control, that send commands to these end points telling it what to do. 299 00:14:05,595 --> 00:14:05,885 Yeah. 300 00:14:05,895 --> 00:14:06,195 Yeah. 301 00:14:06,255 --> 00:14:06,615 Yeah. 302 00:14:06,675 --> 00:14:10,875 And so as soon as it saw that it was talking to, uh, uh, command and 303 00:14:10,875 --> 00:14:14,115 control servers, it would've, it would've basically blocked that ip. 304 00:14:14,475 --> 00:14:18,945 So there, there, so basically, and we've talked about this, I recommend 305 00:14:18,945 --> 00:14:21,035 the, the, you know, it, it, it's, it's. 306 00:14:21,560 --> 00:14:25,520 AI is not the silver bullet for everything, but this is one thing where AI 307 00:14:25,520 --> 00:14:29,600 and machine learning can be very helpful, where you can watch how applications 308 00:14:29,600 --> 00:14:32,990 typically behave and then when they start doing stuff that they're not normally 309 00:14:32,990 --> 00:14:37,280 doing, uh, you can flag it and you can go, maybe you do auto, maybe you do 310 00:14:37,280 --> 00:14:38,930 it automatically, but maybe you don't. 311 00:14:39,320 --> 00:14:41,360 Uh, but, but at least you flag it. 312 00:14:41,360 --> 00:14:41,630 Right. 313 00:14:41,630 --> 00:14:43,670 And, and at least they wouldn't have been there for a year. 314 00:14:43,860 --> 00:14:45,060 Can I add something to 315 00:14:45,230 --> 00:14:45,585 Yeah, sure. 316 00:14:46,380 --> 00:14:50,490 Uh, not directly related to what ReliaQuest talked about, but I think 317 00:14:50,490 --> 00:14:54,150 periodically you should be going and doing an inventory of your systems. 318 00:14:54,865 --> 00:14:55,185 Yeah. 319 00:14:55,635 --> 00:14:57,615 And figuring out what's running. 320 00:14:57,615 --> 00:14:59,835 Do I have just like patch management, right? 321 00:14:59,865 --> 00:15:00,135 Do I 322 00:15:00,135 --> 00:15:00,495 Right. 323 00:15:00,555 --> 00:15:01,905 patches on all the systems? 324 00:15:02,145 --> 00:15:03,975 Are people using these extensions? 325 00:15:04,305 --> 00:15:07,515 Do the right people have access to the systems that need access? 326 00:15:07,515 --> 00:15:09,885 Are there people I should be kicking off? 327 00:15:09,885 --> 00:15:10,155 Right? 328 00:15:10,155 --> 00:15:10,455 Yeah. 329 00:15:10,515 --> 00:15:13,305 these other things should be sort of like 330 00:15:15,375 --> 00:15:15,765 like 331 00:15:15,930 --> 00:15:16,560 hygiene. 332 00:15:16,605 --> 00:15:17,415 Yeah, cyber hygiene. 333 00:15:17,445 --> 00:15:17,655 Thank 334 00:15:17,790 --> 00:15:18,210 Yeah. 335 00:15:18,300 --> 00:15:18,690 Yeah. 336 00:15:18,795 --> 00:15:21,465 people should be doing that could have prevented some of these things. 337 00:15:21,615 --> 00:15:21,795 Like 338 00:15:21,840 --> 00:15:22,470 I may, 339 00:15:22,575 --> 00:15:23,235 is a long time. 340 00:15:23,850 --> 00:15:28,170 I may or may not have been recently editing a. A, a chapter that 341 00:15:28,170 --> 00:15:29,550 used to phrase cyber hygiene. 342 00:15:29,550 --> 00:15:30,180 So I had it right. 343 00:15:30,180 --> 00:15:31,230 I had it right at the ready. 344 00:15:31,800 --> 00:15:35,430 So, uh, so they've got an action plan here of four things. 345 00:15:35,430 --> 00:15:38,520 And I, you know, I, I couldn't, couldn't agree with, couldn't 346 00:15:38,520 --> 00:15:40,080 agree more with, with all of them. 347 00:15:40,080 --> 00:15:40,410 Right. 348 00:15:40,920 --> 00:15:41,700 Uh, although. 349 00:15:42,900 --> 00:15:46,080 Well, they just have, they just, they use bigger words than I would use. 350 00:15:46,080 --> 00:15:49,920 So they talk about audit and hardening public facing applications. 351 00:15:49,920 --> 00:15:54,630 So if you have an application that is talking to the internet, uh, this 352 00:15:54,630 --> 00:15:58,890 is one that you really need to be, uh, locking down that server and 353 00:15:58,890 --> 00:16:02,820 that application as much as you can, more so than a server that simply 354 00:16:02,820 --> 00:16:04,410 runs inside your IT environment. 355 00:16:04,470 --> 00:16:08,760 And today, what isn't a public facing application, that's what I want to say, 356 00:16:08,985 --> 00:16:13,485 well, I think in this case they're also talking about things that are 357 00:16:13,485 --> 00:16:18,555 visible from the internet rather than things that might need internet access. 358 00:16:18,930 --> 00:16:23,520 Well, what I'm saying though is like everybody uses SaaS apps, so like all 359 00:16:23,520 --> 00:16:25,590 SaaS apps are public facing applications. 360 00:16:25,590 --> 00:16:26,220 That's what I'm saying. 361 00:16:26,220 --> 00:16:30,990 Like the, the days of we've got, we've got, you know, three apps in 362 00:16:30,990 --> 00:16:35,340 the cloud and or, or three apps that are public facing and the rest of our 363 00:16:35,340 --> 00:16:37,080 apps are just inside the data center. 364 00:16:37,260 --> 00:16:38,430 It's like, what's a data center? 365 00:16:38,685 --> 00:16:38,895 Yeah, 366 00:16:38,940 --> 00:16:39,300 Right. 367 00:16:39,300 --> 00:16:42,540 So I'm saying everything seems to be public facing, but go ahead. 368 00:16:42,795 --> 00:16:43,515 but yes. 369 00:16:43,515 --> 00:16:44,535 SaaS apps, I agree. 370 00:16:44,535 --> 00:16:47,925 But I would say from a customer perspective, the SaaS 371 00:16:47,925 --> 00:16:49,035 apps are not their problem. 372 00:16:51,240 --> 00:16:52,680 But I'm gonna have, I'm gonna have 373 00:16:52,905 --> 00:16:56,775 vendor's problem minus basic access controls and other things they should be 374 00:16:57,115 --> 00:16:57,990 ag Agreed. 375 00:16:58,050 --> 00:16:58,590 Agreed. 376 00:16:58,755 --> 00:17:02,175 but there's very little that they can control in a SaaS app's case 377 00:17:02,490 --> 00:17:03,570 A Yes. 378 00:17:03,630 --> 00:17:04,020 Agreed. 379 00:17:04,020 --> 00:17:07,950 I I guess what they're saying is if you do have actual apps running in 380 00:17:07,950 --> 00:17:11,730 your data center, uh, that are public facing, then, then you really should 381 00:17:11,730 --> 00:17:13,950 be, um, you know, auditing and harting. 382 00:17:13,950 --> 00:17:14,370 Yes. 383 00:17:14,445 --> 00:17:15,315 and blah, blah, blah. 384 00:17:15,315 --> 00:17:15,615 Right. 385 00:17:16,050 --> 00:17:16,410 Yeah. 386 00:17:16,650 --> 00:17:18,930 They, we talked about it already, but they talked about moving 387 00:17:18,930 --> 00:17:20,760 beyond IOC based detection. 388 00:17:21,510 --> 00:17:24,960 You need to be looking at behavioral based detection at this point. 389 00:17:25,020 --> 00:17:25,380 Right. 390 00:17:25,485 --> 00:17:25,635 I 391 00:17:25,650 --> 00:17:26,220 And, and 392 00:17:26,325 --> 00:17:26,550 you. 393 00:17:26,790 --> 00:17:27,450 yeah, sure 394 00:17:27,610 --> 00:17:29,295 Does your book cover any of this? 395 00:17:29,520 --> 00:17:29,670 it does. 396 00:17:30,405 --> 00:17:30,945 Okay. 397 00:17:31,455 --> 00:17:31,845 Yeah. 398 00:17:32,535 --> 00:17:33,855 Uh, I, I think so. 399 00:17:34,605 --> 00:17:34,725 Hmm. 400 00:17:34,725 --> 00:17:34,755 I. 401 00:17:36,945 --> 00:17:39,495 It's all up in my head, like, you know, going through all this stuff. 402 00:17:39,735 --> 00:17:39,975 Yeah. 403 00:17:39,975 --> 00:17:48,345 I mean, we talked about, um, we do talk about, um, well, I'll just say this. 404 00:17:49,275 --> 00:17:53,775 The book is focused on an assumed breach standpoint. 405 00:17:54,075 --> 00:17:55,575 The focus of the book is not. 406 00:17:55,920 --> 00:17:57,630 How to stop all ransomware, right? 407 00:17:57,630 --> 00:17:59,850 The focus of the book is you're probably gonna get ransomware, 408 00:18:00,480 --> 00:18:01,620 so here's how to stop it. 409 00:18:01,800 --> 00:18:04,890 There is one chapter in the book that says, look, you 410 00:18:04,890 --> 00:18:06,390 really need to do these things. 411 00:18:06,780 --> 00:18:08,070 And we do, we do. 412 00:18:08,130 --> 00:18:10,710 In that chapter, and I, it was literally that chapter I was 413 00:18:10,710 --> 00:18:12,240 just editing in that chapter. 414 00:18:12,750 --> 00:18:13,380 Um. 415 00:18:13,785 --> 00:18:16,965 We do talk about like the things that you absolutely have to do, 416 00:18:16,965 --> 00:18:20,835 and one of them is this next one, which is strong credential hygiene. 417 00:18:21,135 --> 00:18:21,555 Right. 418 00:18:22,275 --> 00:18:27,825 Uh, I pulled, I just pulled a, a recent copy of this, 419 00:18:27,885 --> 00:18:32,025 um, of this, um, the, from a, 420 00:18:32,135 --> 00:18:32,495 not good. 421 00:18:34,365 --> 00:18:34,545 yeah. 422 00:18:34,875 --> 00:18:39,765 So it, it's uh, from a company called HI Systems and they have a password. 423 00:18:40,140 --> 00:18:43,560 Length guessing time table, right? 424 00:18:43,980 --> 00:18:53,730 And, um, the, if you have a password length of, um, if you just have letters, 425 00:18:54,720 --> 00:19:00,510 um, you know that they've got like a password length of 12 is 27,000 years. 426 00:19:00,510 --> 00:19:05,460 But, uh, the, the, the, the key here is that length, length 427 00:19:05,460 --> 00:19:06,840 is better than complexity. 428 00:19:07,260 --> 00:19:07,650 Right. 429 00:19:08,040 --> 00:19:12,090 Um, so like for example, if you've got numbers, upper and lowercase 430 00:19:12,090 --> 00:19:17,700 letters and symbols, and your password length is six characters long. 431 00:19:17,880 --> 00:19:22,020 So it's says complex as it could possibly be, and it's six characters long. 432 00:19:22,170 --> 00:19:23,730 How long do you think it takes to guess that 433 00:19:24,340 --> 00:19:24,760 One year 434 00:19:25,560 --> 00:19:26,220 two weeks? 435 00:19:28,605 --> 00:19:32,325 If it's seven characters long, it's two years, right? 436 00:19:32,685 --> 00:19:34,815 At eight now it's 164 years. 437 00:19:34,905 --> 00:19:35,295 Right? 438 00:19:35,505 --> 00:19:37,425 So the, the real key is like, 439 00:19:37,430 --> 00:19:37,650 can 440 00:19:38,025 --> 00:19:39,885 length is better than complexity. 441 00:19:40,875 --> 00:19:41,415 So, yeah. 442 00:19:41,415 --> 00:19:43,305 So if, if, here's, here's the beautiful thing. 443 00:19:43,635 --> 00:19:46,365 If all I do is have a long password, 444 00:19:46,650 --> 00:19:46,810 Yeah. 445 00:19:46,905 --> 00:19:53,565 12 character password, and all I do is use lowercase letters. 446 00:19:54,735 --> 00:19:56,415 So 12 character password. 447 00:19:56,475 --> 00:19:59,295 Now mind you, over there we had a six character password, but it was 448 00:19:59,295 --> 00:20:01,695 as complex as it could possibly be. 449 00:20:01,905 --> 00:20:02,775 That was two weeks. 450 00:20:03,435 --> 00:20:08,235 I'm gonna have a 12 character password and it's lowercase letters only. 451 00:20:08,475 --> 00:20:08,805 Mm-hmm. 452 00:20:08,865 --> 00:20:09,855 long do you think it takes? 453 00:20:10,680 --> 00:20:13,350 Uh, 172 years. 454 00:20:14,085 --> 00:20:15,945 27,000 years. 455 00:20:18,915 --> 00:20:20,415 So what have we learned? 456 00:20:20,535 --> 00:20:22,695 Length is better than complexity, right? 457 00:20:23,040 --> 00:20:23,250 yeah. 458 00:20:23,565 --> 00:20:24,855 So, um, 459 00:20:24,960 --> 00:20:25,500 a single word. 460 00:20:25,500 --> 00:20:26,400 It could be a sentence, 461 00:20:26,625 --> 00:20:28,215 yes, it can, yes. 462 00:20:28,425 --> 00:20:30,135 Like Prasanna is awesome. 463 00:20:30,585 --> 00:20:31,125 That's one. 464 00:20:31,785 --> 00:20:33,075 But, but yeah. 465 00:20:33,255 --> 00:20:38,415 But yeah, so that's the thing is like you, you need, so they had a, 466 00:20:38,445 --> 00:20:42,765 they had a guessable password, or they stole password, and then what? 467 00:20:43,575 --> 00:20:45,015 So they got a password. 468 00:20:45,330 --> 00:20:46,710 What did they also not have? 469 00:20:46,805 --> 00:20:51,005 If they had had this thing, they would've stopped this password that they guessed. 470 00:20:51,365 --> 00:20:51,755 Yes. 471 00:20:51,755 --> 00:20:52,175 Thank you. 472 00:20:53,225 --> 00:20:56,585 MFA, please, for the love of God, everybody, can you please, if you're 473 00:20:56,585 --> 00:20:59,915 still using passwords, please put MFA on everything that matters. 474 00:21:00,065 --> 00:21:01,235 How hard is this? 475 00:21:02,405 --> 00:21:03,545 It's, it is just killing me. 476 00:21:03,725 --> 00:21:04,175 Right? 477 00:21:04,625 --> 00:21:06,785 Um, you know, look at PAs keys. 478 00:21:06,815 --> 00:21:11,405 If you can't do PAs keys, at least put on an MFA and if your ap, if, 479 00:21:11,435 --> 00:21:15,425 if your app, the response from your support from your app is like, what? 480 00:21:15,425 --> 00:21:17,765 It's MFA time to get a new app, right? 481 00:21:18,845 --> 00:21:21,065 But, um, and it, so, yeah. 482 00:21:21,095 --> 00:21:23,975 So if, if they, if you got password management and MFA, 483 00:21:24,665 --> 00:21:28,175 uh, then this would've, this, if they had just turned on MFA, that 484 00:21:28,175 --> 00:21:29,405 would've, uh, solved this problem. 485 00:21:30,485 --> 00:21:32,765 And then also, yes, patch management, right? 486 00:21:32,975 --> 00:21:39,905 Um, potentially if the, if this, uh, SOE was part of the overall package. 487 00:21:40,370 --> 00:21:43,970 Perhaps if they had updated, uh, the, the package, it would've 488 00:21:43,970 --> 00:21:46,100 actually overwritten the, the SOE. 489 00:21:47,090 --> 00:21:49,790 Um, don't, don't actually know that much about that thing, but, 490 00:21:49,875 --> 00:21:50,165 Yeah, 491 00:21:50,180 --> 00:21:52,010 but, um, yeah, I, I don't know. 492 00:21:52,010 --> 00:21:56,180 So basically, uh, get better passwords, uh, turn MFA on for 493 00:21:56,180 --> 00:21:58,910 anything that matters and investigate. 494 00:21:58,940 --> 00:22:00,710 Those are the things you, you have to do. 495 00:22:00,920 --> 00:22:01,250 Right? 496 00:22:01,490 --> 00:22:06,230 Investigate behavioral based detection that IOC based detection is. 497 00:22:06,230 --> 00:22:08,255 So, uh, last year. 498 00:22:08,525 --> 00:22:08,765 Yeah. 499 00:22:08,915 --> 00:22:14,375 And well, and I think the other thing that I took away from the article is not just. 500 00:22:15,875 --> 00:22:20,315 Don't expect that someone is just gonna have a malware EXE file running somewhere. 501 00:22:20,695 --> 00:22:20,985 Yeah, 502 00:22:21,125 --> 00:22:24,335 could be part of your normal software stack and tools that 503 00:22:24,335 --> 00:22:25,505 you have out there that look 504 00:22:25,565 --> 00:22:25,805 absolutely. 505 00:22:26,035 --> 00:22:26,325 Yeah. 506 00:22:26,405 --> 00:22:27,695 that they've compromised, so, 507 00:22:27,860 --> 00:22:28,850 And don't trust them. 508 00:22:29,120 --> 00:22:29,570 Right. 509 00:22:29,720 --> 00:22:32,660 Just, uh, you should be watching to see what they normally do. 510 00:22:32,900 --> 00:22:34,940 And then see when they do weird things 511 00:22:34,960 --> 00:22:35,180 Yep. 512 00:22:35,390 --> 00:22:37,700 and when they do weird things, I go, whoop, whoop. 513 00:22:37,700 --> 00:22:39,050 But off the clocks on alert. 514 00:22:39,980 --> 00:22:42,450 All right, well this has been fun, Prasanna. 515 00:22:42,875 --> 00:22:45,635 Likewise, Curtis, although I do miss your stories, 516 00:22:47,345 --> 00:22:48,230 I just didn't have it. 517 00:22:48,230 --> 00:22:49,430 I just didn't have any this time. 518 00:22:49,670 --> 00:22:52,160 We'll see, you know, we're working on this new format. 519 00:22:52,497 --> 00:22:53,392 let us know what you think. 520 00:22:54,357 --> 00:22:55,167 this was good. 521 00:22:55,377 --> 00:23:00,447 It, it was a really complex topic to cover in, in a shorter format. 522 00:23:00,597 --> 00:23:04,887 It would've been a lot easier to talk about this for 40 minutes, but I'm trying 523 00:23:05,127 --> 00:23:06,417 listeners, if you like this 524 00:23:06,657 --> 00:23:07,107 Yeah. 525 00:23:07,227 --> 00:23:11,547 don't like, leave us a comment on your favorite pod catcher. 526 00:23:11,697 --> 00:23:12,747 We have YouTube videos. 527 00:23:12,747 --> 00:23:14,487 You can look at our gorgeous faces, 528 00:23:14,787 --> 00:23:15,207 Yeah. 529 00:23:15,417 --> 00:23:15,867 YouTube. 530 00:23:15,867 --> 00:23:16,887 So leave us a comment there. 531 00:23:16,887 --> 00:23:19,107 We love to hear from you, but let us know what you think of this. 532 00:23:19,857 --> 00:23:21,297 One of us has a gorgeous face. 533 00:23:21,417 --> 00:23:22,437 The other has long hair. 534 00:23:23,247 --> 00:23:23,727 All right. 535 00:23:24,027 --> 00:23:26,587 Thank you very much, Prasanna. 536 00:23:26,607 --> 00:23:27,387 It's been fun. 537 00:23:27,927 --> 00:23:29,582 Likewise, Curtis, you have a good one. 538 00:23:30,147 --> 00:23:31,227 And thanks listeners. 539 00:23:31,227 --> 00:23:32,842 You know you're, why we do this? 540 00:23:33,032 --> 00:23:33,962 That is a wrap.