Latest / Privacy Please / S6, E259 - Patch Tool Turns Predator

Transcript

S6, E259 - Patch Tool Turns Predator · Privacy Please

• 0:00
  SPEAKER_01: Alrighty then, ladies and gentlemen, welcome back to another episode of Privacy Please.
• 0:06
  SPEAKER_01: I'm your host, Norman Ivy.
• 0:08
  SPEAKER_01: Flying solo this week.
• 0:10
  SPEAKER_01: I got some juicy news for you.
• 0:12
  SPEAKER_01: So sit back, relax.
• 0:16
  SPEAKER_01: Let's dig into the chaos, shall we?
• 0:20
  SPEAKER_01: No, seriously.
• 0:23
  SPEAKER_01: You might want to embrace yourselves if you haven't heard this yet.
• 0:26
  SPEAKER_01: So if you've been feeling a little paranoid lately, well, I have some bad news.
• 0:31
  SPEAKER_01: The stories this week are the kind that keeps security engineers up at night.
• 0:35
  SPEAKER_01: So if I have any security engineers on here, maybe this isn't news to you, but we have uh trusted tools turning malicious, universities leaking, donors net worth, and a sci-fi worm that just won't die.
• 0:51
  SPEAKER_01: Sounds like some kind of a horror sci-fi movie.
• 0:56
  SPEAKER_01: Anyways, let's dig into the chaos, shall we?
• 1:02
  SPEAKER_01: So, first up, the story that is still dominating every IT Slack channel right now.
• 1:07
  SPEAKER_01: It broke late last month, uh, but the fallout is still going on.
• 1:13
  SPEAKER_01: Uh, we all know you have you have to have a patch for your systems, right?
• 1:18
  SPEAKER_01: It's security 101.
• 1:20
  SPEAKER_01: But what happens when the tool you use to patch is the very thing that infects you?
• 1:26
  SPEAKER_01: That's a major problem, right?
• 1:28
  SPEAKER_01: So we're talking about Microsoft's WSUS.
• 1:32
  SPEAKER_01: So that stands for Windows Server Update Service.
• 1:36
  SPEAKER_01: For those who don't know, this is basically the traffic controller for your updates inside a big company.
• 1:43
  SPEAKER_01: It downloads the official patches from Microsoft once and then pushes them to thousands of employees.
• 1:49
  SPEAKER_01: It is arguably one of the most trusted servers on any network.
• 1:54
  SPEAKER_01: So here's the one flaw: a critical 9.8 out of 10 bug was found that lets hackers take over this server remotely without a password.
• 2:05
  SPEAKER_01: So the terrifying part that Mass Media missed, once attackers are in, they aren't just stopping updates.
• 2:13
  SPEAKER_01: They are using WSUS to push downgrade attacks.
• 2:17
  SPEAKER_01: They're forcing company computers to uninstall recent security patches, effectively rolling back time to make them vulnerable again before they hit them with ransomware.
• 2:29
  SPEAKER_01: That's a huge, huge issue.
• 2:32
  SPEAKER_01: So right now, the current status is the CISA has sounded the alarm.
• 2:38
  SPEAKER_01: So ransomware cartels are actively scanning for this.
• 2:41
  SPEAKER_01: If you are an IT admin, listen, listen, come in close.
• 2:48
  SPEAKER_00: I got something to tell you.
• 2:50
  SPEAKER_00: If you're an IT admin and you haven't patched your WSUS server yet, stop listening to this podcast and go do it right now.
• 2:58
  SPEAKER_00: Please.
• 3:00
  SPEAKER_00: Thank you.
• 3:00
  SPEAKER_01: And moving on.
• 3:04
  SPEAKER_01: So next up, we're talking about some breaking news that happened this week.
• 3:09
  SPEAKER_01: Yes.
• 3:10
  SPEAKER_01: So a massive data breach at the University of Pennsylvania just happened this week.
• 3:15
  SPEAKER_01: I think it was on the 4th.
• 3:17
  SPEAKER_01: So UPenn confirmed a breach affecting 1.2 million people.
• 3:21
  SPEAKER_01: So very likely yourself, possibly.
• 3:24
  SPEAKER_01: This includes current students, tons of alumni, and crucially major donors.
• 3:29
  SPEAKER_01: So let's dig into the details just a little bit here.
• 3:32
  SPEAKER_01: This isn't your standard email and password leak.
• 3:35
  SPEAKER_01: Before it hit the donor relations database, the stolen data includes what they call wealth screenings.
• 3:43
  SPEAKER_01: So these are detailed profiles estimating the alumni's net worth, their property values, and their capacity to give.
• 3:51
  SPEAKER_01: It also includes highly insensitive demographic data, religious affallations, political leanings, and sexual orientation.
• 4:00
  SPEAKER_01: So they use these for targeted uh fundraising, stuff like that.
• 4:04
  SPEAKER_01: Let's talk about how it happened.
• 4:07
  SPEAKER_01: They didn't hack the mainframe.
• 4:09
  SPEAKER_01: It was a classic supply chain attack.
• 4:11
  SPEAKER_01: A third-party vendor that handles their alumni engagement got fished.
• 4:15
  SPEAKER_01: Classic.
• 4:16
  SPEAKER_01: Uh, one employee at one vendor clicked the wrong link, and 1.2 million people are exposed.
• 4:22
  SPEAKER_01: It's that easy.
• 4:24
  SPEAKER_01: It's that easy.
• 4:27
  SPEAKER_00: It's that easy.
• 4:29
  SPEAKER_00: Oh my god.
• 4:30
  SPEAKER_01: But seriously, the takeaway here is this data is radioactive, so attackers can now use those wealth ratings to conduct hyper-targeted whaling attacks.
• 4:43
  SPEAKER_01: Frickin' whale on it.
• 4:44
  SPEAKER_01: So they're fishing designed specifically for high net worth individuals that's fishing with a pH.
• 4:51
  SPEAKER_01: We are not fishing for sea bass.
• 4:58
  SPEAKER_01: If you're with me.
• 4:59
  SPEAKER_01: If you're a UPen alum, check your inbox or watch it very closely.
• 5:04
  SPEAKER_01: So we'll keep tabs on that.
• 5:06
  SPEAKER_01: To close out here with another story, I have to share the wildest, nerdiest piece of malware we've seen in a long time, in many years.
• 5:14
  SPEAKER_01: So this one is called Glassworm.
• 5:17
  SPEAKER_01: If you're not familiar with it, so let's talk about this a little bit.
• 5:20
  SPEAKER_01: It's hunting software developers by infecting Visual Studio Code.
• 5:25
  SPEAKER_01: So the digital workbench where most of the world's software is written.
• 5:30
  SPEAKER_01: So here's the crazy part.
• 5:32
  SPEAKER_01: Usually, when malware phones home for instructions, security teams can see that traffic and block the server, right?
• 5:40
  SPEAKER_01: Glassworm is different.
• 5:42
  SPEAKER_01: It uses an unkillable command system.
• 5:46
  SPEAKER_01: And this is kind of how it works.
• 5:48
  SPEAKER_01: It reads public transaction memos on the Solona blockchain to get its orders.
• 5:53
  SPEAKER_01: So you can't block the blockchain without breaking half the internet.
• 5:57
  SPEAKER_01: As a backup, it checks a public Google Calendar event.
• 6:02
  SPEAKER_01: Think about standard corporate firewalls.
• 6:06
  SPEAKER_01: They trust traffic going to Google.com by hiding its commands inside of Google Calendar.
• 6:12
  SPEAKER_01: This worm's traffic looks completely legitimate to most security tools.
• 6:17
  SPEAKER_01: It's hiding in plain sight, basically.
• 6:19
  SPEAKER_01: Here's the reality: the hackers have built a decentralized, unkillable beast.
• 6:26
  SPEAKER_01: It's a massive leap in sophistication, and it's aimed right at the people building our software.
• 6:32
  SPEAKER_01: It's pretty scary, if you think about it.
• 6:35
  SPEAKER_01: To quickly recap from everything this week, the security patch is trying to downgrade you.
• 6:42
  SPEAKER_01: The university just leaked your net worth to the dark web, and the virus is checking Google Calendar for its next target.
• 6:50
  SPEAKER_01: Just a normal week in 2025.
• 6:53
  SPEAKER_01: Getting closer to the end there.
• 6:54
  SPEAKER_01: So perfect for Q4.
• 6:56
  SPEAKER_01: Good job.
• 6:57
  SPEAKER_01: All right.
• 6:58
  SPEAKER_01: Fantastic.
• 6:59
  SPEAKER_01: Well, this was just a quick update for all of our listeners out there.
• 7:02
  SPEAKER_01: I just want to say, as always, thank you so much for listening to Privacy Please.
• 7:07
  SPEAKER_01: We got a lot of big things coming in the new year.
• 7:10
  SPEAKER_01: Q4 has been really crazy just on our normal jobs and things like that.
• 7:14
  SPEAKER_01: So thank you so much for your patience and for continuing to stay with us.
• 7:18
  SPEAKER_01: I will continue to push out episodes as much as I can.
• 7:22
  SPEAKER_01: Um, so thank you for the patience and just be ready for 2026 because we got a lot.
• 7:26
  SPEAKER_01: And if you haven't checked out the website, go check it out the problemlounge.com.
• 7:31
  SPEAKER_01: That is theproblemlounge.com.
• 7:34
  SPEAKER_01: That's our network.
• 7:35
  SPEAKER_01: Um, so we have the new problem lounge podcast coming out in the new year as well, and another show to come along with it with some surprises.
• 7:44
  SPEAKER_01: So thank you again for the support.
• 7:47
  SPEAKER_01: We'll see you guys soon.
• 7:49
  SPEAKER_01: Definitely next week.
• 7:50
  SPEAKER_01: I'm Cameron Ivy, as always.
• 7:52
  SPEAKER_01: Thank you for listening to Privacy Please.
• 7:55
  SPEAKER_01: Lock your shit down, stay safe, and enjoy some nice fall weather if you have it.
• 8:00
  SPEAKER_01: If you don't, I don't know what to tell you.
• 8:03
  SPEAKER_01: But we'll see y'all next week.
• 8:05
  SPEAKER_01: Cameron Ivy, over and out.