Latest / Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors. / 031520_Ukranian-Hacker-Group

Transcript

031520_Ukranian-Hacker-Group · Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors.

• 0:14
  Blake: Seems like everything is Russia, Russia,
• 0:16
  Craig: Russia.
• 0:17
  Craig: Yeah.
• 0:17
  Craig: One thing I read that might be interesting is that, there's a, hacking group that was started that's recruited?
• 0:23
  Craig: 300,000.
• 0:24
  Craig: Hackers to support Ukraine
• 0:26
  Blake: I saw, Russia revoked all the anti-piracy laws.
• 0:29
  Blake: Did you hear about that?
• 0:30
  Blake: So now people can pirate, movies and music and all that.
• 0:33
  Blake: Legally.
• 0:33
  Craig: That's crazy Yeah.
• 0:36
  Craig: This was on the guardian, 300,000 volunteer hackers come together to fight Russia.
• 0:41
  Craig: Yeah.
• 0:42
  Craig: So apparently there's this big, recruitment on the, telegram chat app and it's called the it army of Ukraine.
• 0:50
  Craig: It says through which participants are assigned tasks designed to take the fight to Putin and try to level the playing field between one or two of the world's superpowers.
• 0:59
  Craig: And Ukraine is a faceless bombardment and innovation.
• 1:02
  Blake: This was an interesting one.
• 1:03
  Blake: So yesterday apple released 39, fixes for security defects and iOS.
• 1:10
  Blake: I've got O S Mac oh S cause they found security vulnerabilities in all of their operating systems.
• 1:17
  Blake: Macko has Catalina VIX or Monterey T V O S watcher west iTunes in X code 39.
• 1:22
  Blake: Documented vulnerabilities.
• 1:24
  Blake: I could have.
• 1:25
  Blake: Lead to a remote code execution attacks.
• 1:27
  Blake: If an iPhone user opens a malicious PDF file or views malicious web content.
• 1:32
  Craig: Geez.
• 1:32
  Craig: That's a big one.
• 1:33
  Blake: Yeah.
• 1:34
  Craig: Yeah, so definitely update your iPhone and your Mac.
• 1:37
  Craig: here's a good one.
• 1:38
  Craig: nearly 34 ransomware variants observed and hundreds of cyber attacks in
• 1:43
  Nobody: quarter four of 21.
• 1:45
  Craig: Oh, happy Tuesday, I guess it is patch Tuesday.
• 1:47
  Craig: Isn't it.
• 1:48
  Craig: So launch off with patch Tuesday and the, huge, 39 documented iOS and iPad vulnerabilities that are patched in iOS 15.4, iPad iOS 15.4, as well as Macco S so basically update, update, reboot, and update again.
• 2:04
  Nobody: That's a big one.
• 2:05
  Craig: I think the 300,000 volunteer hackers is interesting too.
• 2:09
  Craig: So the there's a 300,000 volunteers that have signed up on the telegram channel to support Ukraine and fight Russia.
• 2:18
  Craig: In the guardian this morning,
• 2:19
  Erin: So let's topic today.
• 2:21
  Craig: I think it's, more cyber headlines of the day.
• 2:23
  Craig: I don't think there's a singular topic.
• 2:25
  Craig: BJ.
• 2:26
  Craig: Did you figure anything out today?
• 2:28
  BJ: just that thing I sent about the government visiting the whole topic of cloud security and, people doing their part.
• 2:34
  BJ: the wording was government anxiety returns about the clouds.
• 2:37
  Craig: I think the big thing was the 300,000 volunteer hackers supporting Ukraine.
• 2:42
  BJ: I think that, that I didn't even see.
• 2:44
  BJ: So that is a really big deal that ties into what you were talking about yesterday, Craig, about the people doing something and that's actually a nonviolent way.
• 2:50
  BJ: So
• 2:51
  Craig: yeah, if it attacks.
• 2:53
  Craig: Scotto, what happened with Stuxnet?
• 2:55
  Craig: They could be pretty devastating, I guess.
• 2:57
  Craig: I don't know what the, orchestration of that is, but it's certainly, for the good, ultimately
• 3:02
  Erin: So tell us what happened.
• 3:03
  Erin: Again.
• 3:04
  Craig: 300,000 hackers have banded together to help support Ukraine, defend and fight against Russia.
• 3:12
  Erin: Well, that's cool.
• 3:12
  Erin: And how are they doing that?
• 3:13
  Erin: Exactly.
• 3:15
  Craig: They set up, a telegram channel for the recruitment and this was published in the guardian.
• 3:21
  BJ: Do you know the origins of it?
• 3:22
  Craig: they're kind of anonymizing some of it for obvious reasons, but I could tell you that it's called the it army of Ukraine.
• 3:29
  BJ: Oh, wow.
• 3:29
  BJ: Really?
• 3:31
  BJ: That's quite a name.
• 3:32
  Craig: they said that there have already been successful in disrupting Russian web services.
• 3:36
  Craig: According to net blocks.
• 3:38
  Craig: So since the availability of websites of the Kremlin and Duma Russia's lower house of parliament have been intermittent since the invasion started state owned media services, several banks in the energy giant Gazprom have also been targeted.
• 3:51
  Craig: So it's basically crowdsourcing cyber attacks.
• 3:55
  Nobody: Wow.
• 3:56
  BJ: Organized anonymous, cyber attacks.
• 3:58
  Craig: Yeah, there's a guy, on Twitter in this article, I don't know how to say his name.
• 4:04
  Craig: M Y K H a I L O.
• 4:07
  Craig: Is that how you say it?
• 4:07
  Craig: And the Kelly L Federoff, F E D O R O V.
• 4:11
  BJ: And what's his name?
• 4:12
  Craig: he's just the one that, tweeted this.
• 4:15
  Craig: His tweet says we are creating an it army.
• 4:18
  Craig: We need digital talent.
• 4:20
  Craig: All operational tasks will be given here.
• 4:22
  Craig: And he links to the telegram link of it.
• 4:25
  Craig: Army of.
• 4:26
  Craig: There will be tasks for everyone.
• 4:28
  Craig: We continue to fight on the cyber front.
• 4:29
  Craig: The first task is on channel for cyber specialist.
• 4:33
  BJ: just for argument's sake, if they deployed an XDR, this it army of Ukraine, just for an example, if they deployed an XDR tool amongst their escape status systems and stuff like that, couldn't they have it programmed to block.
• 4:47
  BJ: Russian traffic just to be on the safe side.
• 4:49
  BJ: it wasn't that possible.
• 4:50
  Craig: some scatter systems are, have to be air gapped or disconnected.
• 4:53
  Craig: they're networking.
• 4:54
  Craig: Sometimes isn't the same as a typical PC.
• 4:56
  Craig: So it really depends on what protocols it supports and how modern scatter system is, would depend on what capabilities it could have, but oftentimes SCADA system.
• 5:07
  Craig: Use dated or outdated Microsoft, windows operating systems, for example, where yes, the next type tool would definitely be able to help an unpatched monitor a block and stop and unpatched sit pinpoint.
• 5:22
  Nobody: Wow.
• 5:22
  Craig: Yeah.
• 5:22
  Craig: So that was a big, big post this morning.
• 5:25
  BJ: That's a pretty big deal.
• 5:26
  BJ: that's a lot of people to crowdsource that quick.
• 5:29
  BJ: I mean, I guess maybe it's not that quickly.
• 5:30
  BJ: They're just announcing now maybe it's been in the works since the beginning of the invasion, but still that's, quite a number to organize.
• 5:36
  Craig: Yeah.
• 5:36
  Craig: it's probably bigger now
• 5:37
  BJ: now that it's got publicity, right?
• 5:39
  Craig: Yeah.
• 5:39
  Craig: This was just published.
• 5:41
  Craig: this was six in the morning, Eastern.
• 5:44
  Nobody: Wow.
• 5:45
  BJ: we've come across people just in our line of work that, you remember?
• 5:48
  BJ: I won't name them, but some of the people that do pen testing and stuff that are like, white hat, hackers and stuff didn't really have a cause, but with a cause, there's quite a few of them out there, right?
• 5:58
  Craig: Yeah, absolutely.
• 5:59
  BJ: Some of them are very highly skilled.
• 6:01
  BJ: We ran into a few ourselves Twitter and LinkedIn and stuff that were obviously very highly skilled.
• 6:06
  Nobody: That's
• 6:07
  BJ: interesting.
• 6:08
  Craig: Yeah,
• 6:08
  BJ: for sure.
• 6:09
  BJ: I saw a headline last night.
• 6:10
  BJ: I don't know if you guys saw this yet, I'm not really too familiar with Microsoft Craig, I'm sure you are.
• 6:14
  Craig: Yeah, it's just basically their cloud, offering similar to Amazon, AWS.
• 6:19
  BJ: Oh, okay.
• 6:20
  BJ: So that's interesting then.
• 6:21
  BJ: I didn't know that what it was.
• 6:22
  BJ: I never really looked into it as viewer, but because Amazon has its quantum center.
• 6:26
  BJ: Now they have Amazon bracket for quantum computing and then now they have a Zoomer quantum.
• 6:31
  BJ: they're letting people onboard to Azure.
• 6:33
  BJ: Quantum.
• 6:34
  BJ: Now I saw that last.
• 6:35
  Craig: Yeah, that doesn't surprise me.
• 6:36
  Craig: I would think that all the big players like that would be wanting to support those kinds of efforts
• 6:42
  BJ: That's interesting.
• 6:43
  BJ: Well, that's a major development then 300,000 people.
• 6:46
  BJ: would venture to say that parties are involved in this crisis we're not accounting for something like that to develop.
• 6:52
  Craig: Yup.
• 6:52
  Craig: And I think the other thing that Blake found too, with 30 plus patches for, pretty much all apple devices today is ironically patched Tuesday.
• 7:01
  Craig: So I'm sure Microsoft has their, treasure trove of patches, announced for the day they usually come out every Tuesday of the week.
• 7:08
  Craig: And then if there's.
• 7:08
  Craig: a rush patch or a patch that needs to be put on mid-week because of a high vulnerability than That'll be announced as well, but definitely want to make sure that you're updating all of your end points and devices, especially at this time with all the stuff going on,
• 7:23
  BJ: were there pretty major apple patches announced.
• 7:26
  BJ: Yeah.
• 7:27
  Craig: There's a new iOS for iPhone iPad iOS as well as.
• 7:32
  Blake: And apple watch.
• 7:33
  Blake: Yeah.
• 7:33
  Blake: every operating system, iOS.
• 7:36
  Blake: So there's corruption, flaws, and Mac and iPads and, my
• 7:40
  BJ: bones.
• 7:41
  BJ: What does that mean?
• 7:42
  BJ: What's the corruption?
• 7:43
  Blake: I guess whenever a software writes to that memory, it creates some type of corrupted data or something.
• 7:50
  Blake: It says iPad, iOS updates, fixes memory, corruption, flaws, and multiple iOS software components, including Abe video and coder for media based time.
• 8:00
  Blake: You drivers, iTunes, Colonel sandbox, Syrian software updates.
• 8:04
  Blake: 39 documented iPad iOS vulnerabilities, which also included patches to Catalina, big Sur Monterey TBOs watch your res iTunes and X code, which is the software that you used to write apps, the flaws could expose users to remote code execution, attacks, whatever
• 8:24
  Nobody: that is.
• 8:25
  Craig: Yeah.
• 8:25
  BJ: that was the log for J wasn't it Craig that was the risk with that was that it exposed them to remote code execution.
• 8:31
  BJ: Yeah.
• 8:31
  Craig: Similar where, you open a link or you open a, PDF file or something.
• 8:35
  Craig: And then there could be cross site scripting or access us or remote code execution where, a bad actor could remotely drop the bad, payload of some sort, some type of malware, key logger, et cetera.
• 8:47
  Craig: This was just 40 minutes ago where banks are on alert for the Russian reprisal, It says big banks, fear that swift faces a growing threat of Russian cyber attacks.
• 8:56
  Craig: After seven of the countries, lenders were kicked off the global payments messaging system over the.
• 9:01
  BJ: seven of the Russian banks that were planned to be kicked off, or are we talking about seven attacks that caused banks to be kicked off?
• 9:09
  Craig: So seven of the country's lenders were kicked off the swift global payment messaging system over the weekend.
• 9:16
  BJ: which country?
• 9:16
  BJ: Russia or United States?
• 9:18
  Craig: Big banks, fear that swift faces a growing threat of Russian cyber attacks.
• 9:23
  Craig: After seven of the country's lenders were kicked off the global payment messaging system over the weekend says VTV Russia's second biggest bank, which finances Russia's war machine or among the lenders removed on Saturday from swift as part of the west sanctions campaign against Moscow in response to its invasion of Ukraine.
• 9:44
  Craig: So swift is like a.
• 9:45
  Craig: standard to wire money for international payments and things like that.
• 9:50
  Craig: And it looks like there were sanctions in post to kick off and sanction and punish Russia.
• 9:56
  Craig: So they're saying that because that happens because seven of the country's lenders were kicked off this with system, they can't make, payments and exchanges.
• 10:05
  Craig: Now they're fearing that Russia will retaliate with cyber attacks.
• 10:09
  BJ: and you said that one of those lenders that was kicked off, the wording that they used was that it funds the war machine.
• 10:15
  Craig: well, swift system does not fund the war machine, but Russia,
• 10:18
  BJ: will not directly anywhere.
• 10:19
  Craig: people that are in support, how did they get money to Russia?
• 10:22
  Craig: That was a way would use the Swiss system to wire money to Russia.
• 10:25
  Craig: And it just cut off that tie Here's another headline says Russian cyber attacks have been well-tested on us.
• 10:32
  Craig: This was posted four hours ago, Russian based cyber attacks against us targets have been well tested.
• 10:37
  Craig: As the work with Ukraine continues.
• 10:40
  Craig: Cyber professionals have warned about possibility of Russian cyber capabilities being used on the U S Russia already has a proven ability to infiltrate us systems.
• 10:49
  Nobody: It says they've demonstrated
• 10:51
  Craig: be it, the solar winds or colonial pipeline issue and energy across the board.
• 10:56
  Craig: They have evidenced the capability.
• 10:58
  Craig: Everybody should be pretty much on a high alert
• 11:00
  BJ: and make sure that the updates you're doing are verified official.
• 11:04
  BJ: Cause here's one headline about a fake antivirus update, launching cobalt strike malware in Ukraine.
• 11:10
  Craig: Yeah.
• 11:11
  Craig: never click on a link.
• 11:12
  Craig: Always go direct to the manufacturer.
• 11:14
  BJ: That's very good advice.
• 11:16
  BJ: Don't click the link.
• 11:17
  BJ: Yeah, type it yourself.
• 11:18
  Craig: I don't know if you guys have seen, but I've noticed that a large increase in phishing email, X across the board of all different kinds of companies obviously verify the sender.
• 11:27
  Craig: Don't click on links.
• 11:29
  BJ: interestingly in addition to all that is if there's not enough going on in the world right now, right.
• 11:33
  BJ: I guess, if we're going to have a climax, it's going to be all inclusive, right?
• 11:36
  BJ: from another perspective, you know how there's a lot of the internet cables, right?
• 11:39
  BJ: Now we have the global satellite internet up in space, but then we also have the internet cables on the opposite end of the spectrum in the deepest part of the oceans.
• 11:47
  BJ: there's news now just recently holds the size of city blocks are forming in the Arctic C4.
• 11:54
  BJ: An ice shelf that was blocking the flow from Antarctica in three days has basically split apart sea ice that slowed the flow of Antarctic glacier abruptly shatters in three days.
• 12:06
  BJ: There's an odd connection to where some of this is manmade.
• 12:09
  BJ: Like the crisis.
• 12:10
  BJ: And the war is manmade, but then you have scientific stuff, converging at the same time of an epic steel as well.
• 12:18
  Craig: Yeah,
• 12:18
  BJ: you know how they're always talking about asteroids recently and but this one's gonna miss earth that one's gonna miss her.
• 12:23
  BJ: not to be alarm me, but there was a headline about this one that was a near hit it says asteroid discovered only two hours before earth impact.
• 12:31
  BJ: to spin it in a positive way, the encouraging side is only development with the quantum stuff, because that opens up a whole new realm of early detection possibilities.
• 12:41
  Blake: Russia just announced that they're putting sanctions on Joe Biden and Jen Psaki and Hillary Clinton and hunter Biden and all this random people.
• 12:50
  Blake: And if they have any assets in Russia, they're freezing those assets and they're preventing them from traveling to Russia, scary
• 12:57
  BJ: stuff, or the elites all turning on each other.
• 13:00
  Blake: I doubt any of you have assets in
• 13:01
  BJ: Russia.
• 13:02
  BJ: Yeah, probably not, but whatever the framework is that they all work from when they do these things, it seems like they're all trying to kind of follow the same protocol.
• 13:12
  BJ: But it kind of seems like they're starting to spin out of control a little bit.
• 13:15
  BJ: starting to seem a little bit absurd.
• 13:17
  BJ: Yeah.
• 13:18
  Craig: Well, one thing I just dug up that was interesting.
• 13:20
  Craig: It says Russia, who paid 3.5 million to Biden's brother, hunter Biden, was paid 3.5 million by a Russian oligarch.
• 13:28
  Blake: I saw a meme of Eric Trump, like, oh yeah if my dad was president and my dad understands boudin and Ms KGB.
• 13:34
  Blake: And he realized that my dad's a strong person and all this stuff and then he goes on to brag that we get all the funding we need from Russia, dah, dah, dah.
• 13:41
  Blake: You know, even though when Trump was in white house, they were denying that they were getting funds from Russia.
• 13:45
  Blake: And then he goes on to say that,
• 13:46
  BJ: well, there's growth in other areas like the people uniting whatever, cause they're uniting.
• 13:52
  BJ: And then on the flip side, it seems like there's a bit of chaos and suing with the upper echelons.
• 13:58
  Erin: I think a hunter Biden worked for a firm that Yeah, but they raise funds, right?
• 14:05
  Erin: Hedge fund or something like that.
• 14:07
  Blake: he was on the board of directors for our Ukrainian company.
• 14:10
  BJ: it's safe to say that there seems to be a lot of connections between all of the politicians at the high levels.
• 14:15
  BJ: They all seem to share some connections at the high levels.
• 14:18
  Nobody: Yeah.
• 14:19
  BJ: But good thing it looks like the people sharing some connections too.
• 14:22
  BJ: So that's good news.