Off The Hook - 2020-12-16

[00:00.000 --> 00:02.540]  [SPEAKER_01]: News on Wednesdays at 6.30 p.m.
[00:03.140 --> 00:06.420]  [SPEAKER_01]: Stay tuned for Off The Hook coming up in this hour.
[00:06.960 --> 00:13.160]  [SPEAKER_01]: This is WBAI New York 99.5 FM and WBAI.org online.
[00:13.620 --> 00:14.100]  [SPEAKER_01]: Stay tuned.
[00:16.100 --> 00:18.660]  [SPEAKER_04]: And you are tuned in to WBAI New York.
[00:18.820 --> 00:22.440]  [SPEAKER_04]: It's 7 o'clock time for Off The Hook.
[00:33.500 --> 00:35.320]  [SPEAKER_00]: I've got myself all shaving.
[00:35.820 --> 00:37.920]  [SPEAKER_00]: Now I can't make a cut.
[00:38.660 --> 00:40.620]  [SPEAKER_00]: We couldn't get much worse.
[00:41.320 --> 00:43.200]  [SPEAKER_01]: But if they could, they would.
[00:43.440 --> 00:46.100]  [SPEAKER_01]: For me, if I'm for the best, it's made from worse.
[00:46.760 --> 00:48.600]  [SPEAKER_01]: I hope that's understood.
[00:48.920 --> 00:49.620]  [SPEAKER_01]: But really, no!
[01:59.110 --> 02:00.650]  [SPEAKER_04]: And a very good evening to everybody.
[02:01.030 --> 02:03.830]  [SPEAKER_04]: The program is Off The Hook.
[02:05.330 --> 02:06.650]  [SPEAKER_04]: Emmanuel Goldstein here with you.
[02:06.870 --> 02:08.270]  [SPEAKER_04]: Joined tonight by Kyle.
[02:08.270 --> 02:08.370]  [SPEAKER_04]: Kyle.
[02:08.970 --> 02:09.450]  [SPEAKER_08]: Hi.
[02:09.650 --> 02:11.370]  [SPEAKER_08]: Coming in loud and clear over here.
[02:11.570 --> 02:11.870]  [SPEAKER_04]: Yeah.
[02:12.150 --> 02:12.850]  [SPEAKER_04]: A bit flustered.
[02:13.030 --> 02:14.010]  [SPEAKER_04]: A lot going on.
[02:14.250 --> 02:14.890]  [SPEAKER_04]: Let's see.
[02:15.070 --> 02:17.270]  [SPEAKER_04]: Let's open up the Skype lines here.
[02:18.510 --> 02:20.290]  [SPEAKER_04]: And joining us is Alex.
[02:21.490 --> 02:23.910]  [SPEAKER_07]: Hello from the snowy Pocono Mountains.
[02:24.350 --> 02:26.410]  [SPEAKER_04]: You went out to Pennsylvania in this weather.
[02:27.230 --> 02:29.130]  [SPEAKER_07]: Well, I went out very early this morning.
[02:29.310 --> 02:29.530]  [SPEAKER_04]: Wow.
[02:29.670 --> 02:29.870]  [SPEAKER_04]: Okay.
[02:30.390 --> 02:32.770]  [SPEAKER_04]: And Rob is joining us as well.
[02:33.630 --> 02:36.110]  [SPEAKER_06]: Good evening from snowy Queens, New York.
[02:36.350 --> 02:38.110]  [SPEAKER_04]: Anguilla, who's sitting right next to him.
[02:38.770 --> 02:39.350]  [SPEAKER_03]: I am.
[02:40.210 --> 02:42.170]  [SPEAKER_03]: It's still snowy Queens, New York.
[02:42.390 --> 02:47.350]  [SPEAKER_04]: And it's snowy out here on Long Island, where we expect to lose power any moment.
[02:47.370 --> 02:48.650]  [SPEAKER_04]: And that's going to be a lot of fun.
[02:49.130 --> 02:50.870]  [SPEAKER_04]: It's a blizzard.
[02:51.070 --> 02:52.110]  [SPEAKER_04]: It's snowing outside.
[02:52.310 --> 02:53.170]  [SPEAKER_04]: It's snowing in December.
[02:53.170 --> 02:53.930]  [SPEAKER_04]: I'm happy.
[02:54.110 --> 02:56.170]  [SPEAKER_04]: And it's another reason to stay indoors.
[02:56.170 --> 02:58.870]  [SPEAKER_04]: If we need more reasons to stay inside, here's another one.
[03:00.430 --> 03:06.770]  [SPEAKER_04]: And we have an hour of technological talk from the world of hackers.
[03:07.370 --> 03:12.670]  [SPEAKER_04]: And at 8 o'clock, we'll be doing overtime again on our YouTube channel, Channel2600.
[03:13.290 --> 03:18.810]  [SPEAKER_04]: And you can call us and speak to us, as callers did last week, which is neat.
[03:19.010 --> 03:20.970]  [SPEAKER_04]: We heard from people all over the place.
[03:22.190 --> 03:25.850]  [SPEAKER_04]: So, everybody safe and dry?
[03:26.210 --> 03:29.650]  [SPEAKER_04]: Alex, I'm especially worried about you being out there in the tundra.
[03:31.290 --> 03:33.190]  [SPEAKER_07]: Yeah, it's freezing here.
[03:33.190 --> 03:34.310]  [SPEAKER_07]: It's about 15 degrees.
[03:34.490 --> 03:35.730]  [SPEAKER_07]: It is...
[03:36.650 --> 03:38.730]  [SPEAKER_07]: It's been snowing since about 1 p.m.
[03:40.250 --> 03:42.070]  [SPEAKER_07]: And it's really incredible out there.
[03:42.170 --> 03:43.350]  [SPEAKER_07]: I mean, it's whiteout conditions.
[03:44.350 --> 03:48.650]  [SPEAKER_07]: And, you know, not the kind of stuff that you want to go out and drive in, I would think.
[03:48.650 --> 03:53.990]  [SPEAKER_07]: So, hopefully by tomorrow, when I'm due to head back to New York in the afternoon...
[03:55.370 --> 03:57.610]  [SPEAKER_04]: You think you're going back to New York in the afternoon?
[03:57.810 --> 03:58.950]  [SPEAKER_04]: I'm sorry, that's funny.
[04:00.270 --> 04:02.110]  [SPEAKER_04]: No, you're going to be there for a while, I think.
[04:02.250 --> 04:04.830]  [SPEAKER_04]: It's going to be 18 inches, they're saying.
[04:06.150 --> 04:07.990]  [SPEAKER_04]: It's not going to stop until tomorrow afternoon.
[04:08.590 --> 04:11.290]  [SPEAKER_07]: No, I've got a Volkswagen and I can just drive right through.
[04:11.350 --> 04:12.510]  [SPEAKER_04]: Oh, you've got a Volkswagen.
[04:12.750 --> 04:13.930]  [SPEAKER_04]: Okay, never mind then.
[04:13.930 --> 04:14.750]  [SPEAKER_04]: You can get through anything.
[04:15.590 --> 04:16.230]  [SPEAKER_04]: All right.
[04:18.290 --> 04:20.070]  [SPEAKER_04]: Rob, you're safe there in Queens, right?
[04:21.230 --> 04:22.430]  [SPEAKER_03]: We are safe.
[04:23.230 --> 04:27.350]  [SPEAKER_03]: We were out of the apartment earlier this afternoon and it was amazing.
[04:27.350 --> 04:29.190]  [SPEAKER_03]: We had a thing to go to when we went.
[04:29.190 --> 04:37.630]  [SPEAKER_03]: It was completely dry and while we were there, the snow started and we walked out into an absolute snow globe.
[04:37.730 --> 04:38.290]  [SPEAKER_03]: It was amazing.
[04:38.630 --> 04:38.850]  [SPEAKER_04]: Uh-huh.
[04:39.110 --> 04:41.370]  [SPEAKER_04]: This is what winter should be, you know?
[04:41.370 --> 04:44.170]  [SPEAKER_04]: And don't listen to people who complain about it.
[04:44.450 --> 04:46.030]  [SPEAKER_04]: Diversity, that's the spice of life.
[04:46.210 --> 04:49.490]  [SPEAKER_04]: And having four seasons in a year is a good thing.
[04:49.490 --> 04:51.990]  [SPEAKER_04]: And here in New York, we savor that.
[04:52.190 --> 04:54.090]  [SPEAKER_04]: So I'm glad we're getting some cold weather.
[04:54.210 --> 04:55.250]  [SPEAKER_04]: I'm glad we're getting some snow.
[04:56.230 --> 04:57.650]  [SPEAKER_04]: Climate change is still a thing.
[04:57.650 --> 05:03.150]  [SPEAKER_04]: So don't listen to Trump if he shows you a snowball or something and says, yeah, everything is fixed.
[05:03.150 --> 05:04.630]  [SPEAKER_04]: No, that's not how it works.
[05:05.610 --> 05:06.930]  [SPEAKER_04]: But please be safe.
[05:07.110 --> 05:09.150]  [SPEAKER_04]: Be safe on the COVID front.
[05:09.290 --> 05:10.610]  [SPEAKER_04]: Be safe on the blizzard front.
[05:12.070 --> 05:13.370]  [SPEAKER_04]: And listen to the radio.
[05:13.590 --> 05:15.070]  [SPEAKER_04]: Nothing better than listening to the radio.
[05:16.250 --> 05:18.250]  [SPEAKER_04]: Well, actually, there is something better than listening to the radio.
[05:18.250 --> 05:22.950]  [SPEAKER_04]: And that's listening to old voice BBS recordings from 25 years ago.
[05:23.510 --> 05:24.870]  [SPEAKER_04]: We went through a couple more.
[05:25.150 --> 05:28.090]  [SPEAKER_04]: Not very many this week because we've been extremely busy.
[05:28.650 --> 05:38.050]  [SPEAKER_04]: But I just wanted to play a couple that I think they come from 1996, if I'm going to guess.
[05:38.650 --> 05:41.990]  [SPEAKER_04]: Let's listen to a couple of rescued voice files.
[05:41.990 --> 05:51.190]  [SPEAKER_04]: Thanks to a couple of our listeners who really helped us figure out how to convert the files and get the playback just right.
[05:51.890 --> 06:00.330]  [SPEAKER_04]: Let's listen to the voice of a hacker from many years ago who might actually hear his voice today and be shocked.
[06:00.630 --> 06:02.250]  [SPEAKER_10]: Yes, this is William Tell.
[06:02.250 --> 06:12.890]  [SPEAKER_10]: And I wanted to leave something for our hacker friends in the United Kingdom, which I had discovered when calling World Premier Customer Service.
[06:13.990 --> 06:16.930]  [SPEAKER_10]: World Link, World Premier, however you want to call them.
[06:17.190 --> 06:22.750]  [SPEAKER_10]: They've just started up a new World Premier card for the United Kingdom.
[06:23.130 --> 06:26.250]  [SPEAKER_10]: The name of it is British Airways card.
[06:26.250 --> 06:38.410]  [SPEAKER_10]: And from the United Kingdom, to activate a British Airways prepaid card, you would call 0800-279-2700.
[06:38.710 --> 06:43.970]  [SPEAKER_10]: Once again, that's 0800-279-2700.
[06:44.190 --> 06:50.230]  [SPEAKER_10]: It works just like the world premieres in the United States, but it's primarily for use in the United Kingdom.
[06:50.950 --> 06:57.230]  [SPEAKER_10]: And I know that sometimes our British friends do call here, so that's one for you guys.
[06:58.510 --> 06:59.350]  [SPEAKER_04]: Isn't that nice?
[06:59.450 --> 07:03.370]  [SPEAKER_04]: Helping out the hackers from all around the planet.
[07:03.550 --> 07:05.290]  [SPEAKER_04]: Alex, do you remember that service at all?
[07:07.710 --> 07:09.430]  [SPEAKER_07]: I think I do, actually.
[07:09.650 --> 07:10.950]  [SPEAKER_07]: Yeah, I think I do.
[07:11.010 --> 07:15.190]  [SPEAKER_07]: And it was very kind of him to share that knowledge, I have to say.
[07:15.290 --> 07:18.630]  [SPEAKER_04]: Yeah, Rob, you looked like you had a note of recognition in your eyes.
[07:19.730 --> 07:21.810]  [SPEAKER_06]: It just sounded very familiar.
[07:21.930 --> 07:27.110]  [SPEAKER_06]: And it's also kind of just generally emblematic of the messages I loved so much on that thing back in its day.
[07:27.310 --> 07:28.750]  [SPEAKER_06]: A lot of the messages...
[07:28.750 --> 07:29.250]  [SPEAKER_06]: People being helpful.
[07:29.470 --> 07:30.290]  [SPEAKER_04]: Yeah, that's true.
[07:30.350 --> 07:37.390]  [SPEAKER_04]: There are a lot of helpful messages, but there are a lot of messages also we can't play on the air, because they don't have that same mood to them.
[07:38.050 --> 07:38.710]  [SPEAKER_04]: They are funny.
[07:38.710 --> 07:39.930]  [SPEAKER_06]: I like those too, but...
[07:39.930 --> 07:41.550]  [SPEAKER_04]: Yeah, they're pretty interesting.
[07:42.430 --> 07:45.310]  [SPEAKER_04]: Well, you have to figure out how to share these, the best way to do it.
[07:45.310 --> 07:48.550]  [SPEAKER_04]: And we're getting all kinds of listener suggestions.
[07:48.770 --> 07:50.650]  [SPEAKER_04]: So if you have suggestions on what we can do with...
[07:50.650 --> 07:52.830]  [SPEAKER_04]: Well, we have over 4,000 files.
[07:52.910 --> 07:58.310]  [SPEAKER_04]: That doesn't mean we have anything near that number of messages, but we definitely have hundreds, if not thousands, of messages.
[07:59.470 --> 08:04.990]  [SPEAKER_04]: Public messages, well, private ones we'll probably keep private, since people had voice mailboxes.
[08:05.110 --> 08:06.270]  [SPEAKER_04]: I don't think we should share those.
[08:07.790 --> 08:15.570]  [SPEAKER_04]: But some of these public ones have information that willfully outdated is still interesting and speaks to the hacker mentality.
[08:15.830 --> 08:26.990]  [SPEAKER_08]: I think that's what's brilliant, and especially making some of the more aggressive ones a little bit funnier, because they're out of context, because it's so much later.
[08:27.190 --> 08:28.610]  [SPEAKER_08]: And it's the same thing with technologies.
[08:28.610 --> 08:36.030]  [SPEAKER_08]: You can still apply and find parallels and glean cool bits and history out.
[08:36.050 --> 08:44.810]  [SPEAKER_04]: Yeah, and somebody listening today can say, Hey, that's my dad, a 13-year-old hacker who is calling in to share information on how to clone a cell phone.
[08:45.190 --> 08:46.690]  [SPEAKER_04]: Okay, we have one more.
[08:47.270 --> 08:50.650]  [SPEAKER_04]: This is from somebody more local, someone from 718.
[08:50.810 --> 08:52.530]  [SPEAKER_04]: So they could actually be listening right now.
[08:53.170 --> 08:55.790]  [SPEAKER_05]: Yes, this is the Jackal from MPA 718.
[08:56.090 --> 08:59.910]  [SPEAKER_05]: I'm just calling because I need some info concerning Juno, the email free service.
[09:00.510 --> 09:12.090]  [SPEAKER_05]: Anyway, I recently set up my account, and then I checked out the modem initiation files to determine the username and the password to get into the system.
[09:12.870 --> 09:24.090]  [SPEAKER_05]: After doing that, I dialed up Juno through my modem directly, and got into the system, entered the username, and tried to enter the password, but the system won't allow me to do it.
[09:24.330 --> 09:30.410]  [SPEAKER_05]: So if anybody could advise me on how I can get the system to me entering the password, I'd appreciate that.
[09:32.010 --> 09:32.690]  [SPEAKER_05]: What else?
[09:32.950 --> 09:34.210]  [SPEAKER_05]: I know it's something simple, though.
[09:34.650 --> 09:35.150]  [SPEAKER_05]: What else?
[09:36.410 --> 09:39.530]  [SPEAKER_05]: Does anybody, I mean, has anybody ever heard of 800 Cheap Talk?
[09:40.030 --> 09:47.310]  [SPEAKER_05]: That's an LDS long-distance service that allows you to dial directly through without a credit card to call long-distance.
[09:48.650 --> 09:56.650]  [SPEAKER_05]: I'm thinking that they probably separately bill, because my long-distance service is blocked, and it still allows me to make a phone call, you know?
[09:57.350 --> 09:58.910]  [SPEAKER_05]: So anybody can give me info on that.
[09:59.010 --> 09:59.730]  [SPEAKER_05]: I'd appreciate that.
[10:00.330 --> 10:01.530]  [SPEAKER_05]: Lastly, what I want to say.
[10:02.050 --> 10:06.830]  [SPEAKER_05]: Oh, it seems to me that there's only a few people on this system that really has useful info.
[10:07.590 --> 10:10.510]  [SPEAKER_05]: And one of them is Intercept.
[10:11.030 --> 10:15.490]  [SPEAKER_05]: I just want to say thanks for calling this line, you know, because there are a lot of people out there that can use your info.
[10:15.830 --> 10:20.650]  [SPEAKER_05]: You know, even if they're lame, at least, you know, they're trying to learn something.
[10:21.050 --> 10:24.230]  [SPEAKER_05]: Why everybody else just wants to preach about who's lame and who's not.
[10:24.670 --> 10:25.170]  [SPEAKER_04]: Peace.
[10:26.710 --> 10:27.210]  Okay.
[10:28.030 --> 10:29.610]  [SPEAKER_04]: Well, a little bit of a lecture there.
[10:30.170 --> 10:30.990]  [SPEAKER_04]: Duly noted.
[10:31.270 --> 10:33.170]  [SPEAKER_04]: I hope we've learned something in 25 years.
[10:33.770 --> 10:35.870]  [SPEAKER_04]: Any tips on Juno?
[10:36.010 --> 10:36.470]  [SPEAKER_04]: Or what was the other one?
[10:36.510 --> 10:37.030]  [SPEAKER_04]: Cheap talk?
[10:37.510 --> 10:38.010]  [SPEAKER_04]: No?
[10:38.790 --> 10:39.210]  [SPEAKER_04]: Alex?
[10:39.870 --> 10:42.430]  [SPEAKER_07]: Yeah, that just brings back so many memories.
[10:42.430 --> 10:48.850]  [SPEAKER_07]: And I think really is emblematic of the fact that this was really a scene.
[10:49.190 --> 10:57.890]  [SPEAKER_07]: What he was talking about at the end was, you know, essentially people gossiping about each other, about who's elite and who's lame and who's got good info and who doesn't.
[10:57.890 --> 11:00.790]  [SPEAKER_07]: And he was interested in some sort of content.
[11:01.410 --> 11:03.110]  [SPEAKER_07]: And I think that's pretty cool.
[11:03.250 --> 11:06.030]  [SPEAKER_07]: And I think that, you know, it really brought back a lot of memories.
[11:06.270 --> 11:18.870]  [SPEAKER_07]: Because, you know, there was, even in the voicemail hacking and the hacker community, any kind of subculture, there's always going to be some form of hierarchy where people think that they're cool and others aren't.
[11:19.010 --> 11:24.730]  [SPEAKER_07]: But, you know, for him, and I think for most hackers, it's always about the information, about sharing that information.
[11:24.730 --> 11:27.190]  [SPEAKER_07]: And I think he captured that spirit really well.
[11:27.330 --> 11:28.390]  [SPEAKER_07]: I think that was a great recording.
[11:29.410 --> 11:30.350]  [SPEAKER_04]: Rob, do you have something to add?
[11:31.610 --> 11:39.990]  [SPEAKER_06]: Yeah, Juno, for those who don't remember, it was basically a dial-up online service, like your America Online CompuServe things that existed back then.
[11:40.150 --> 11:53.310]  [SPEAKER_06]: But they would offer you free access in exchange for, usually they would put a big ad banner somewhere on your screen and make money through showing you the ads, which, you know, seems crazy now that somebody would give you free email in exchange for showing you ads,
[11:53.310 --> 11:56.930]  [SPEAKER_06]: except that's how pretty much the entire Internet ecosystem works now.
[11:57.070 --> 12:02.510]  [SPEAKER_06]: But those were really fun to play with because they were a very... it was very cyberpunk.
[12:02.650 --> 12:08.710]  [SPEAKER_06]: They were a scrappy way to get access if you were, you know, a poor kid out there who couldn't keep making long-distance calls or whatever.
[12:08.990 --> 12:09.130]  [SPEAKER_00]: Right.
[12:09.490 --> 12:20.130]  [SPEAKER_06]: And it was just a lot of fun to find ways around what they were trying to do in order to get direct access to their systems that they were offering without going through having to watch their ads.
[12:20.130 --> 12:25.030]  [SPEAKER_04]: So that was the thing, to get into Juno and not deal with ads.
[12:26.110 --> 12:32.030]  [SPEAKER_04]: And then you have free email, something that we take for granted now, free phone calls, something we also take for granted.
[12:32.270 --> 12:34.710]  [SPEAKER_04]: But why do you think Juno didn't succeed?
[12:34.870 --> 12:37.030]  [SPEAKER_04]: Because isn't that exactly what Gmail does now?
[12:38.030 --> 12:39.130]  [SPEAKER_06]: You would think.
[12:39.490 --> 12:47.410]  [SPEAKER_06]: I think they just might have been a little ahead of the curve with how much people would require free access to email and, in fact, expect that to be a thing.
[12:47.990 --> 12:52.730]  [SPEAKER_06]: You know, the online world in general was people using things like America Online.
[12:52.890 --> 12:54.730]  [SPEAKER_06]: You had to use their clients to dial in.
[12:54.950 --> 13:05.030]  [SPEAKER_06]: And this person was trying to just dial straight in without that client, just making a direct modem-to-modem connection with their own software.
[13:05.210 --> 13:08.390]  [SPEAKER_06]: But, yeah, there were ways to make that happen.
[13:08.610 --> 13:19.290]  [SPEAKER_06]: Sometimes that was, like this person was saying, finding the username and the password that the thing was secretly using to get into the system behind the scenes, as it were.
[13:19.470 --> 13:24.390]  [SPEAKER_04]: Well, the whole concept of dialing in, that's something that I think is alien to so many of our listeners now.
[13:24.510 --> 13:25.130]  [SPEAKER_04]: Yes, go ahead, Alex.
[13:26.450 --> 13:36.770]  [SPEAKER_07]: Building on what Rob said, and I think he's precisely right here, that this was a very early-stage revenue model based entirely on advertising.
[13:36.770 --> 13:46.350]  [SPEAKER_07]: And I think the Junos of the world, if we remember correctly, probably started to go away entirely as Gmail started to rise exponentially.
[13:47.170 --> 14:08.070]  [SPEAKER_07]: And Gmail was very interesting to a lot of people back in the day because in addition to it being a free email service, ostensibly free, again, ad-sponsored, it was also, or rather should be considered, one of the first cloud storage service providers as well because they were giving you about a gig of storage for your emails,
[14:08.210 --> 14:08.850]  [SPEAKER_07]: for your attachments.
[14:09.050 --> 14:12.350]  [SPEAKER_07]: So that made Gmail much more attractive than a service like Juno.
[14:12.950 --> 14:22.950]  [SPEAKER_07]: And then Google became very adept at looking at your email, scanning your emails, finding what the keywords were, and then monetizing that for their advertising base.
[14:22.950 --> 14:26.770]  [SPEAKER_07]: And that's probably something that Juno did not do nearly as effectively.
[14:26.790 --> 14:34.830]  [SPEAKER_07]: And so their revenue model was probably flawed from the outset, or at least, I think, inferior to Google's model.
[14:35.690 --> 14:52.230]  [SPEAKER_08]: I would echo those points and really just elaborate on the fact that the approach and the growth model for Google and a smaller entity like Juno, they emerged on different trajectories in the timeline.
[14:52.530 --> 14:58.830]  [SPEAKER_08]: And you imagine what Juno might have been working with, what computers were they trying to get online?
[14:58.830 --> 15:00.610]  [SPEAKER_08]: What were their costs?
[15:00.850 --> 15:07.290]  [SPEAKER_08]: I mean, there's a lot of, like, business decisions, and then what is the marketplace like?
[15:07.450 --> 15:21.050]  [SPEAKER_08]: And I think a lot of this unique ways to get online was because there really, it was a huge push to attract users and get subscribers to your service.
[15:21.430 --> 15:37.610]  [SPEAKER_08]: Whereas I think Google, a lot more of their trajectory was attracting engineers, attracting talent, and breaking down these services and then approaching each one as they grew from purely search and ads.
[15:37.610 --> 15:45.590]  [SPEAKER_08]: That's a really long way of saying they're just totally different companies at totally different times, I think, or emerged at different rates.
[15:45.710 --> 15:47.810]  [SPEAKER_04]: Do you remember how they did things when they rolled out Gmail?
[15:48.170 --> 15:51.770]  [SPEAKER_04]: They made it something that people couldn't get.
[15:52.530 --> 15:57.290]  [SPEAKER_04]: You had to have an invitation to have a Gmail account and everybody wanted an invitation.
[15:57.790 --> 15:59.670]  [SPEAKER_04]: And only because they did that.
[15:59.930 --> 16:09.110]  [SPEAKER_04]: To me, Gmail, the whole concept was offensive from the start to today where they scan your mail and show you ads based on what you say.
[16:09.290 --> 16:11.010]  [SPEAKER_04]: I just, I can't wrap my head around that.
[16:11.390 --> 16:17.390]  [SPEAKER_04]: And even to this day, I use Gmail not as a primary communication, just as a convenience.
[16:17.910 --> 16:21.470]  [SPEAKER_04]: But I'm getting warnings today that my Gmail account is getting full.
[16:21.630 --> 16:23.390]  [SPEAKER_04]: A Gmail account I don't even use.
[16:23.470 --> 16:25.590]  [SPEAKER_04]: It's completely filled up with their own spam.
[16:25.590 --> 16:32.970]  [SPEAKER_04]: Most of it is from Gmail and it's just they expect me to go through and clear it out and no, I'm not going to do that.
[16:33.210 --> 16:43.270]  [SPEAKER_04]: The other thing that happened only last week when I was forwarding something to a Gmail box, I was told that that Gmail account did not exist.
[16:43.950 --> 16:47.970]  [SPEAKER_04]: And it existed because I cut and pasted and mailed again and it went through.
[16:48.130 --> 16:49.930]  [SPEAKER_04]: But they lose mail.
[16:49.930 --> 16:58.210]  [SPEAKER_04]: And that is something that I never actually saw right in front of me happen like that where it said clearly this account does not exist.
[16:58.470 --> 17:00.030]  [SPEAKER_04]: Have the evidence still.
[17:00.390 --> 17:03.310]  [SPEAKER_04]: And then I just cut and pasted and did it again and it worked.
[17:03.550 --> 17:06.790]  [SPEAKER_04]: So that kind of thing is disturbing to me.
[17:06.890 --> 17:13.710]  [SPEAKER_04]: And plus, just storing things in the cloud, not having physical access yourself in case something disappears.
[17:14.010 --> 17:14.930]  [SPEAKER_04]: Like Yahoo.
[17:15.130 --> 17:16.170]  [SPEAKER_04]: Yahoo news groups.
[17:16.330 --> 17:16.610]  [SPEAKER_04]: They're gone.
[17:16.750 --> 17:17.890]  [SPEAKER_04]: As of yesterday, they disappeared.
[17:18.530 --> 17:20.870]  [SPEAKER_04]: You cannot post in a Yahoo group anymore.
[17:21.490 --> 17:27.910]  [SPEAKER_04]: And I know people at Pacifica and WBAI tearing their hair out because there's probably a hundred different Yahoo groups.
[17:28.270 --> 17:29.590]  [SPEAKER_08]: That reminds me.
[17:29.690 --> 17:31.290]  [SPEAKER_08]: I have to get in touch with a group.
[17:31.790 --> 17:32.270]  [SPEAKER_08]: Thank you for that.
[17:32.270 --> 17:33.490]  [SPEAKER_04]: I don't think you can anymore.
[17:33.650 --> 17:34.190]  [SPEAKER_04]: Well, yeah.
[17:34.310 --> 17:36.690]  [SPEAKER_08]: No, I'm going to have to look into whatever back channel we set up.
[17:36.690 --> 17:37.470]  [SPEAKER_04]: They can change the rules.
[17:37.730 --> 17:40.310]  [SPEAKER_04]: And Google introduces these...
[17:40.310 --> 17:42.530]  [SPEAKER_04]: I remember Google Wave, all kinds of...
[17:42.530 --> 17:45.610]  [SPEAKER_04]: They should write a book about all the failed Google projects.
[17:45.870 --> 17:49.950]  [SPEAKER_04]: They just decide to discontinue them and you're out of luck.
[17:50.170 --> 17:54.070]  [SPEAKER_08]: There's really enormous lists of failed dot-com startups.
[17:54.370 --> 17:55.090]  [SPEAKER_08]: It's hilarious.
[17:55.610 --> 18:04.290]  [SPEAKER_04]: It's bad enough when operating systems change and you can't run your programs as easily as you used to be able to run them.
[18:04.330 --> 18:12.690]  [SPEAKER_04]: I was just bemoaning this yesterday because I have a database in D-Base 2, if you can believe that, from the old MS-DOS days.
[18:12.850 --> 18:13.870]  [SPEAKER_04]: It's my video collection.
[18:14.010 --> 18:14.090]  [SPEAKER_04]: Okay?
[18:14.190 --> 18:15.450]  [SPEAKER_04]: That's how I stored it.
[18:15.550 --> 18:22.350]  [SPEAKER_04]: And finding something today that can read those files and allow you to actually interact with them, it's...
[18:22.350 --> 18:26.550]  [SPEAKER_04]: I mean, it can be done, but it's like the voice BBS all over again.
[18:26.730 --> 18:32.370]  [SPEAKER_04]: And you're basically paying for somebody else changing their mind on how something should work.
[18:32.610 --> 18:35.790]  [SPEAKER_04]: Works fine on a particular machine in a particular environment.
[18:35.790 --> 18:37.030]  [SPEAKER_04]: You should be able to keep that.
[18:37.470 --> 18:46.430]  [SPEAKER_04]: And unfortunately, places like archive.org exist where you can go back to the past and see things as they were and even get things to work.
[18:48.130 --> 18:51.210]  [SPEAKER_04]: So it's good that we communicate this and share this information.
[18:51.330 --> 18:51.770]  [SPEAKER_04]: Rob, go ahead.
[18:52.850 --> 18:58.550]  [SPEAKER_06]: The other thing about like Juno and their like, there was Net Zero, there was Blue Light, which was owned by Kmart, I think.
[18:58.790 --> 19:02.830]  [SPEAKER_06]: There was a whole bunch of them, but all of those had one single problem in front of them.
[19:02.950 --> 19:07.590]  [SPEAKER_06]: They had to provide email service and make the ads profitable enough to cover the cost of that.
[19:07.910 --> 19:19.870]  [SPEAKER_06]: Whereas Google, their main advantage has always been like how big they are and the fact that the email and Google Wave and whatever other little services they give to you, that's not how Google makes their money.
[19:20.010 --> 19:35.210]  [SPEAKER_06]: Google makes their money by bringing you in with these services and then getting your eyeballs on ads and also getting your biometric info, your biometric, your ad watching and clicking info to develop a profile on you, which itself is a very profitable thing to have.
[19:35.450 --> 19:38.370]  [SPEAKER_06]: But they don't have to make the email pay for itself.
[19:38.530 --> 19:43.550]  [SPEAKER_06]: They don't have to make anything they do for you pay for itself because with your eyeballs, you're paying for all of it.
[19:44.190 --> 19:48.790]  [SPEAKER_06]: There's the old saying now that if you're not paying money for a service, you're not the customer.
[19:48.790 --> 19:50.790]  [SPEAKER_06]: You're the product being sold to the customer.
[19:50.990 --> 19:51.170]  [SPEAKER_04]: Absolutely.
[19:51.270 --> 19:55.130]  [SPEAKER_04]: And if I continue my Google rant just a little bit more, they have completely destroyed YouTube.
[19:55.450 --> 19:56.730]  [SPEAKER_04]: They really have.
[19:57.370 --> 20:01.150]  [SPEAKER_04]: They have injected what they call mid-roll ads.
[20:01.270 --> 20:01.750]  [SPEAKER_04]: You know what those are?
[20:01.910 --> 20:05.150]  [SPEAKER_04]: You're watching a video in the middle of the damn video you get an ad.
[20:05.290 --> 20:09.090]  [SPEAKER_04]: Not just at the beginning and at the end, but right in the sometimes in the most important part.
[20:10.090 --> 20:12.530]  [SPEAKER_04]: And that was turned on by default.
[20:12.930 --> 20:19.750]  [SPEAKER_04]: Everybody who puts up YouTube videos has to physically press buttons and opt out of that.
[20:19.890 --> 20:23.590]  [SPEAKER_04]: Otherwise, the default is that there's an ad smack in the middle of your video.
[20:24.230 --> 20:25.210]  [SPEAKER_04]: It's ridiculous.
[20:25.630 --> 20:30.010]  [SPEAKER_04]: There was one incredible example of how horrible this is.
[20:30.190 --> 20:37.190]  [SPEAKER_04]: They have these really, really long videos some people put up that's designed to let you go to sleep.
[20:37.390 --> 20:43.750]  [SPEAKER_04]: It's rain on the roof or the sound of the forest or trains going by, all kinds of things.
[20:44.250 --> 20:50.950]  [SPEAKER_04]: and they're eight hours long, ten hours long, twenty hours long and you're drifting off to sleep.
[20:51.130 --> 21:08.310]  [SPEAKER_04]: You know, you have this nice sound of crickets and maybe an owl or two and the wind in the trees, maybe some rain and then all of a sudden in the middle of it you get this loud advertisement because Google decided to put an ad in the middle of that video and the person who put the video up didn't ask for that.
[21:08.430 --> 21:09.610]  [SPEAKER_04]: They just inserted it.
[21:09.610 --> 21:10.090]  [SPEAKER_04]: So that's...
[21:10.090 --> 21:16.010]  [SPEAKER_04]: when you don't control it, when you don't control it yourself, things like that happen and you find yourself surprised.
[21:16.230 --> 21:16.650]  [SPEAKER_04]: Alex?
[21:17.250 --> 21:37.830]  [SPEAKER_07]: Yeah, I've had that exact same experience with these annoying advertisements but YouTube videos because oftentimes I'll drift off to sleep while I'm listening to some video about cosmology or astronomy for some reason thinking about black holes and event horizons and things expands my mind and puts me right out.
[21:37.950 --> 21:51.710]  [SPEAKER_07]: It basically makes me into a narcolepte or something and then I'll wake up in the middle of a 30-minute advertisement and the headphone will still be in my ear or something and I'll be very confused about what the hell I'm listening to.
[21:52.170 --> 22:12.010]  [SPEAKER_07]: But then the other effect of that too which is let's say you did fall asleep like I often do within two or three minutes of putting on one of these cosmological conundrum videos you are then listening to some advertisement for 30 minutes while you're sleeping and who knows what the hell the effect of that is on you.
[22:12.150 --> 22:23.270]  [SPEAKER_07]: I mean you wake up and it may really make you have some very strange dreams or otherwise subliminally affect you or retarget your tastes while you're sleeping.
[22:23.270 --> 22:24.650]  [SPEAKER_07]: It's a strange thing to me.
[22:24.830 --> 22:28.450]  [SPEAKER_04]: Is it possible that your video just went to another video?
[22:28.750 --> 22:32.170]  [SPEAKER_04]: Is it an ad inside that video or did it go to a second video?
[22:32.710 --> 22:34.410]  [SPEAKER_07]: No, it's an ad inside the video.
[22:34.570 --> 22:36.370]  [SPEAKER_04]: A 30-minute ad inside a video.
[22:36.370 --> 22:37.490]  [SPEAKER_07]: Yeah, that's right.
[22:37.730 --> 22:37.870]  [SPEAKER_07]: Yeah.
[22:38.170 --> 22:38.370]  [SPEAKER_07]: Wow.
[22:38.470 --> 22:38.950]  [SPEAKER_07]: It's incredible.
[22:39.290 --> 22:40.230]  [SPEAKER_04]: That is incredible.
[22:41.250 --> 22:43.690]  [SPEAKER_04]: Okay, well I think we've gotten all our anger.
[22:43.810 --> 22:44.190]  [SPEAKER_04]: Yes, Gila.
[22:44.650 --> 22:46.050]  [SPEAKER_03]: Okay, now I have a question.
[22:46.090 --> 22:46.290]  [SPEAKER_03]: Go ahead.
[22:46.550 --> 22:54.430]  [SPEAKER_03]: Which is, I do wonder if the Google algorithms inside YouTube are related to the ads that you get served.
[22:54.950 --> 22:56.250]  [SPEAKER_03]: I can only imagine.
[22:56.250 --> 22:58.290]  [SPEAKER_03]: I did get one in Spanish yesterday.
[22:59.410 --> 23:03.470]  [SPEAKER_03]: I got a Google Maps ad in YouTube in Spanish.
[23:03.590 --> 23:04.990]  [SPEAKER_03]: I don't know why.
[23:05.190 --> 23:09.150]  [SPEAKER_03]: But yeah, I was listening to some stuff in the background and all of a sudden Spanish.
[23:09.190 --> 23:10.970]  [SPEAKER_03]: And I was thrown.
[23:11.330 --> 23:18.590]  [SPEAKER_03]: But I'm curious if everybody's getting served the same ads in the YouTube or if they're different for different users.
[23:18.590 --> 23:19.750]  [SPEAKER_03]: I'm assuming they are.
[23:20.050 --> 23:22.010]  [SPEAKER_03]: But I can't say one way or the other.
[23:22.130 --> 23:23.910]  [SPEAKER_03]: But I'm still a little confused about the Spanish ad.
[23:23.910 --> 23:24.930]  [SPEAKER_04]: Google News.
[23:25.090 --> 23:29.310]  [SPEAKER_04]: Now, I'm sorry, but I keep thinking of more products and they anger me.
[23:29.710 --> 23:30.450]  [SPEAKER_04]: Google News.
[23:30.590 --> 23:31.170]  [SPEAKER_04]: All right.
[23:31.370 --> 23:32.590]  [SPEAKER_04]: It used to be useful.
[23:32.770 --> 23:35.970]  [SPEAKER_04]: It used to be a good aggregator where you could read stories from different places.
[23:36.090 --> 23:38.710]  [SPEAKER_04]: But now, every time you click on a story, it's a paywall.
[23:39.070 --> 23:41.650]  [SPEAKER_04]: Why list stories that are paywalled?
[23:42.350 --> 23:47.070]  [SPEAKER_04]: Am I supposed to subscribe to every newspaper in existence on the Internet in order to use Google News?
[23:47.370 --> 23:48.330]  [SPEAKER_04]: It's useless.
[23:49.230 --> 23:53.490]  [SPEAKER_04]: It should be free stories that are put on the Internet for you to read.
[23:54.150 --> 23:55.250]  [SPEAKER_04]: and nothing more.
[23:55.430 --> 23:56.830]  [SPEAKER_04]: Otherwise, what's the point?
[23:57.650 --> 23:57.910]  [SPEAKER_04]: All right.
[23:57.990 --> 23:58.750]  [SPEAKER_04]: Yes, Rob, go ahead.
[23:59.790 --> 24:20.290]  [SPEAKER_06]: The unintended side effect of Google News and how they do things is sometimes, I'm not saying this works in all cases, but sometimes if you can manage to make the user agent string of your browser look like the one from Google News' bot, then sometimes the sites will show you the article thinking you're Google's bot spidering their site.
[24:20.290 --> 24:26.850]  [SPEAKER_04]: So Google doesn't have to pay to read the article, but they show it to you and tell you to pay.
[24:27.550 --> 24:29.550]  [SPEAKER_04]: It just doesn't make any sense to me.
[24:30.250 --> 24:31.950]  [SPEAKER_04]: The Internet used to be so much cooler.
[24:32.590 --> 24:34.270]  [SPEAKER_04]: I hope we can bring it back somehow.
[24:34.970 --> 24:37.330]  [SPEAKER_04]: We have some interesting stories that are going on.
[24:37.430 --> 24:38.770]  [SPEAKER_04]: This really leapt out at me.
[24:39.210 --> 24:50.150]  [SPEAKER_04]: An American hacker is claiming to have gained access to both the Canadian and the American emergency alert systems.
[24:50.410 --> 24:51.890]  [SPEAKER_04]: That always piques my interest.
[24:52.290 --> 25:13.890]  [SPEAKER_04]: According to a new report from Input, and I have no idea what Input is, I'm sorry, the hacker who goes by the alias Vertrux says he's able to send a message nationwide using a system he found open on the Internet by scanning for ports utilized by two systems commonly used in emergency alerts.
[25:14.810 --> 25:17.990]  [SPEAKER_04]: Vertrux says he found millions of IP addresses.
[25:17.990 --> 25:26.590]  [SPEAKER_04]: He then scanned through them for a list of keywords likely to be used in such alert systems and narrowed that down to thousands.
[25:27.430 --> 25:36.890]  [SPEAKER_04]: I social engineered some manufacturers of these to give me either the service password or the default password and after trying a few IPs I was in, I was disgusted.
[25:37.030 --> 25:38.190]  [SPEAKER_04]: This is federal infrastructure.
[25:38.470 --> 25:41.250]  [SPEAKER_04]: This isn't a printer left open.
[25:41.790 --> 25:50.050]  [SPEAKER_04]: Vertrux claims that the system access points are available online for use by authorized users but are also easily accessible by those with the technological knowledge.
[25:50.290 --> 25:55.470]  [SPEAKER_04]: You can get whatever you need to gain full access not to all as most are updated but a scary majority.
[25:56.090 --> 25:57.890]  [SPEAKER_04]: This reminds me of the banking systems.
[25:58.030 --> 26:07.330]  [SPEAKER_04]: They run COBOL because they are too lazy and cheap to upgrade to something more secure and we get left with very old people who know how to program COBOL working on the banking and insurance infrastructure.
[26:07.490 --> 26:09.290]  [SPEAKER_04]: Okay, I think a bit harsh there.
[26:09.670 --> 26:18.750]  [SPEAKER_04]: I think the federal government needs to set up proper training for setup and usage of these devices and make it illegal to operate if you have not been trained.
[26:18.950 --> 26:21.270]  [SPEAKER_04]: I'm not exactly sure what he means by that.
[26:21.270 --> 26:22.410]  [SPEAKER_04]: the hack...
[26:22.410 --> 26:24.730]  [SPEAKER_04]: Okay, input refers to him as the hacktivist.
[26:24.850 --> 26:29.890]  [SPEAKER_04]: The hacktivist says he could send whatever he pleases to millions of people.
[26:31.330 --> 26:36.030]  [SPEAKER_04]: Theoretically, I can send anything from a volcano warning to the entire U.S.
[26:36.050 --> 26:37.810]  [SPEAKER_04]: to an amber alert if I really wanted.
[26:38.450 --> 26:40.930]  [SPEAKER_04]: I could send out custom messages too.
[26:41.690 --> 26:43.630]  [SPEAKER_04]: He believes it can do the same in Canada.
[26:43.810 --> 26:44.850]  [SPEAKER_04]: I'm sure the same as possible.
[26:45.050 --> 26:47.370]  [SPEAKER_04]: Custom messages to countrywide levels of emergency.
[26:49.570 --> 26:53.090]  [SPEAKER_04]: In the wrong hands, this can and will only incite panic, he says.
[26:53.230 --> 26:58.430]  [SPEAKER_04]: I wouldn't go as far as to say the wrong message sent out can theoretically start a war, but I don't think it's all that impossible.
[26:58.710 --> 27:05.110]  [SPEAKER_04]: And I'll tell you, Vertrix, it's not impossible because we live in a world where things are decreed by Twitter.
[27:05.850 --> 27:11.830]  [SPEAKER_04]: And a war can be started not only through the emergency alert system, but through a tweet.
[27:12.210 --> 27:13.530]  [SPEAKER_04]: And that is the problem.
[27:13.990 --> 27:35.270]  [SPEAKER_04]: Well, the problem is obviously the fact that so many of these systems aren't kept secure in the first place, but the fact that we take things, we believe whatever we see flash across us on a device, whether it's reading Facebook, whether it's reading an SMS or a tweet,
[27:35.510 --> 27:39.370]  [SPEAKER_04]: or even seeing something that comes across the EAS system.
[27:41.390 --> 28:00.730]  [SPEAKER_04]: We need to do better as far as how we verify the information that we are given because many times we're being lied to or we're seeing something that purports to be something that it's not, whether it's a forged email, some kind of phishing expedition.
[28:00.950 --> 28:03.310]  [SPEAKER_04]: There are so many ways you can be fooled.
[28:03.710 --> 28:12.970]  [SPEAKER_04]: All you have to do is believe what is in front of you as far as text or even audio or video.
[28:13.470 --> 28:17.690]  [SPEAKER_04]: So healthy skepticism I think is a good thing.
[28:17.690 --> 28:21.770]  [SPEAKER_04]: I don't know I'm healthily skeptic about this particular story.
[28:21.930 --> 28:26.870]  [SPEAKER_04]: I'm not sure how true it is but it's certainly I think possible theoretically.
[28:27.230 --> 28:30.130]  [SPEAKER_08]: Should there be fines maybe for default passwords?
[28:30.670 --> 28:32.370]  [SPEAKER_04]: Fines for default passwords?
[28:32.470 --> 28:35.450]  [SPEAKER_04]: That means somebody has to check your password.
[28:35.590 --> 28:36.110]  [SPEAKER_04]: How do they do that?
[28:36.210 --> 28:43.170]  [SPEAKER_08]: Well I mean in the public interest maybe not on a personal router if that's something you really need in your life to default all you want.
[28:43.170 --> 29:08.250]  [SPEAKER_04]: When I was caught back in the 80s I was on a system called Telenet actually a subset of that system called TeleMail and the reason I was able to get hundreds of accounts was because they used the default password of the letter A and it was relatively easy for me to scroll down a list of accounts that were publicly available and simply try the letter A for each one and see how many I could get
[29:08.250 --> 29:08.450]  [SPEAKER_04]: into.
[29:08.570 --> 29:23.810]  [SPEAKER_04]: Now something like that when it's revealed that yeah this person hacked your system and was able to aim nukes and do all kinds of turn off electrical grids and things like that because you used the password A yeah I think there should be a fine for that that's stupid.
[29:24.010 --> 29:29.270]  [SPEAKER_04]: That's extreme but it has to be revealed that they did something incredibly boneheaded like that.
[29:29.470 --> 29:58.310]  [SPEAKER_08]: Well also with a huge push towards new EAS I know just with some of the radio stations and broadcasters in general there's been changes changes and updates to the systems so if you're putting in all this new equipment imagine that every broadcaster everyone that is required and they get pretty serious about the requirement for EAS so why isn't there a requirement on this install instead of
[29:58.310 --> 30:05.950]  [SPEAKER_08]: requiring the install and basically providing this enormous opportunity if defaults are widely kept.
[30:06.150 --> 30:06.970]  [SPEAKER_04]: Yes go ahead Alex.
[30:07.590 --> 30:32.290]  [SPEAKER_07]: I think two points bouncing off both what you and Kyle had said number one I think I would go even further Emmanuel with respect to the severity of this information coming from something like an emergency alert system remember I guess it feels like a different world ago but it was probably about two years ago maybe when we did the tests and had the party for the presidential alert Yes.
[30:33.230 --> 30:35.050]  [SPEAKER_07]: And that was very cool.
[30:35.190 --> 30:36.570]  [SPEAKER_07]: I still have our flyer from that.
[30:36.770 --> 30:37.290]  [SPEAKER_04]: Yeah, that was fun.
[30:37.330 --> 30:39.050]  [SPEAKER_04]: We had something in the commons downstairs.
[30:39.670 --> 30:40.950]  [SPEAKER_07]: Yeah, that's right.
[30:41.030 --> 30:42.570]  [SPEAKER_07]: That's when we did radio in a studio.
[30:42.730 --> 30:44.470]  [SPEAKER_04]: And saw people in person.
[30:44.670 --> 30:44.830]  [SPEAKER_04]: Wow.
[30:45.450 --> 30:45.930]  [SPEAKER_04]: Good old days.
[30:46.330 --> 30:48.330]  [SPEAKER_07]: Yeah, it was a different world.
[30:48.510 --> 30:55.170]  [SPEAKER_07]: But in any event, the point I want to make here is that unlike Twitter, where people are used to seeing garbage, right?
[30:55.370 --> 30:57.450]  [SPEAKER_07]: It's garbage in, garbage out is the old platitude.
[30:57.690 --> 31:00.730]  [SPEAKER_07]: People are used to being skeptical about stories on Twitter.
[31:00.730 --> 31:09.110]  [SPEAKER_07]: And, you know, even seeing the president of the United States' tweets himself being flagged as potentially false or misleading.
[31:09.410 --> 31:11.630]  [SPEAKER_07]: So I think we're getting more used to that.
[31:11.730 --> 31:18.950]  [SPEAKER_07]: But when you see something flash across your phone, whether it's an Amber Alert or something that looks like an official communication, you tend to believe it.
[31:19.070 --> 31:23.450]  [SPEAKER_07]: So if this story is, in fact, true, I see it as extraordinarily dangerous.
[31:23.690 --> 31:28.590]  [SPEAKER_07]: It's something that could be used by a foreign actor to create massive havoc.
[31:28.590 --> 31:35.890]  [SPEAKER_07]: I mean, think about the weather alerts that could be going on, you know, right now, or something that would have related to protests.
[31:36.050 --> 31:38.290]  [SPEAKER_04]: Can I just butt in for a second, Alex?
[31:38.610 --> 31:40.590]  [SPEAKER_04]: There's always this mention of foreign actors.
[31:41.050 --> 31:44.030]  [SPEAKER_04]: Why is it the foreign actors we're most concerned about?
[31:44.130 --> 31:45.590]  [SPEAKER_04]: How about the domestic actors?
[31:45.710 --> 31:52.070]  [SPEAKER_04]: Because there's a whole lot of them causing all kinds of mayhem right now with false information, misleading people.
[31:52.630 --> 31:55.370]  [SPEAKER_04]: You know, I don't think we have to get nationalistic about this.
[31:55.370 --> 32:12.670]  [SPEAKER_04]: I think this is just something where we need to be more educated as far as what is true and what is not true, what is unlikely to be true, how to question, how to check, how to verify, how to access multiple sources of information and not just believe whatever you're told,
[32:12.830 --> 32:17.510]  [SPEAKER_04]: whether it's coming from us or your uncle on Facebook or Newsmax or whatever.
[32:18.550 --> 32:19.650]  [SPEAKER_07]: I agree with that.
[32:19.770 --> 32:21.150]  [SPEAKER_07]: It doesn't have to be a foreign actor.
[32:21.310 --> 32:22.030]  [SPEAKER_07]: It can be domestic.
[32:22.290 --> 32:31.310]  [SPEAKER_07]: Just, you know, a general threat actor could utilize this for extraordinarily malicious purposes, especially when we're in the middle of a global health crisis, for God's sake, right?
[32:31.430 --> 32:33.850]  [SPEAKER_07]: I mean, think about the misinformation that can come across your phone.
[32:33.970 --> 32:36.570]  [SPEAKER_04]: That's your opinion, Alex, that it's a global health crisis.
[32:37.090 --> 32:38.210]  [SPEAKER_04]: Are these things real?
[32:38.210 --> 32:38.890]  [SPEAKER_04]: We don't know.
[32:38.890 --> 32:49.710]  [SPEAKER_07]: But going back to what Kyle had said, too, he raises an interesting point, which is essentially about fines for having horrible security configurations.
[32:50.270 --> 33:04.050]  [SPEAKER_07]: And if you're a regulated entity, let's say you're regulated by the FTC or Health and Human Services and you're not HIPAA compliant, something like that, it is certainly possible to be fined by a regulatory body for having insufficient security practices in place.
[33:04.050 --> 33:12.970]  [SPEAKER_07]: And certain regulated entities are required to undergo enterprise risk assessments to look for things like these, you know, idiotic default passwords that are placed up there.
[33:13.230 --> 33:24.790]  [SPEAKER_07]: But to Kyle's point, though, what's very interesting about this is if the entity that is housing the insecure system is, in fact, the government, then how would you fine them?
[33:25.430 --> 33:27.230]  [SPEAKER_07]: It would be our tax dollars.
[33:27.450 --> 33:29.150]  [SPEAKER_07]: They would pay a fine with our tax dollars.
[33:29.270 --> 33:30.810]  [SPEAKER_07]: That doesn't seem fair, right?
[33:30.810 --> 33:46.290]  [SPEAKER_07]: I mean, at that point, you know, we need to have, I think, better ways of regulating the regulator's systems, better ways of regulating governmental systems and ensuring that, and also having a carrot-and-stick approach there, too, some kind of penalty when it comes to government,
[33:46.490 --> 33:49.590]  [SPEAKER_07]: state, local, or federal, not securing their systems properly.
[33:50.910 --> 33:58.370]  [SPEAKER_08]: I would just feel like there's, this is like a personnel, like accountability, this would be like an HR escalation.
[33:58.550 --> 34:11.850]  [SPEAKER_08]: I mean, if I change the oil in your car and I don't torque your drain plug or whatever, and you need a new motor, like, you're going to come back at me over it and my competency as a technician.
[34:11.850 --> 34:25.250]  [SPEAKER_08]: So if a technician's installing something, either as a contractor or working directly for the government, and their choice is to not go the next step, but I don't know if that's necessarily the first culprit, right?
[34:25.290 --> 34:29.770]  [SPEAKER_08]: I think there's a lot of people operating these systems that may not be a governmental entity.
[34:29.890 --> 34:34.770]  [SPEAKER_08]: But if that's our focus, yeah, I feel like that would come back on whomever the technician was.
[34:34.770 --> 34:38.710]  [SPEAKER_08]: Because maybe that's not a huge fine levied at all.
[34:38.890 --> 34:49.810]  [SPEAKER_08]: Maybe it's more your certification or whatever alleged qualification got you to that point probably would be in question after so long.
[34:49.950 --> 34:54.450]  [SPEAKER_08]: But the contractor or whomever would probably have...
[34:54.450 --> 34:58.030]  [SPEAKER_08]: There was to be some kind of repercussion, maybe not a fine per se.
[34:58.190 --> 34:59.250]  [SPEAKER_08]: But you raise a good point.
[34:59.250 --> 35:05.870]  [SPEAKER_08]: That's a good point because how circular do you want to get with public and bureaucratic policing?
[35:06.190 --> 35:15.270]  [SPEAKER_04]: Yeah, I think it's pretty clear that we're going to have trouble figuring out who is policing whom and who has more authority and more knowledge and things like that.
[35:15.350 --> 35:21.030]  [SPEAKER_04]: But the one thing we can do to help the situation is always have that healthy skepticism.
[35:21.310 --> 35:25.050]  [SPEAKER_04]: Now, healthy skepticism versus unhealthy skepticism.
[35:25.150 --> 35:26.010]  [SPEAKER_04]: How do we differentiate?
[35:26.010 --> 35:35.590]  [SPEAKER_04]: Because if you have a bunch of people refusing to take a vaccine, for instance, because they don't believe they're being told the truth, how do you counter that?
[35:35.710 --> 35:52.170]  [SPEAKER_04]: I think the way is to have as many trusted news sources out there that people can go to to ask questions and to get information and not just simply treat every blog out there as if it's equivalent to the New York Times, because it's not.
[35:52.450 --> 36:02.450]  [SPEAKER_04]: There are people that you can basically rely upon to give you accurate information and there are people who are complete phonies.
[36:02.970 --> 36:06.430]  [SPEAKER_04]: We need to be able to judge for ourselves.
[36:07.470 --> 36:10.090]  [SPEAKER_04]: Who knows what they're talking about and who does not?
[36:10.090 --> 36:25.630]  [SPEAKER_04]: And unfortunately, we're in a society right now where basically a lot of the skilled people are being torn down by very powerful people.
[36:25.790 --> 36:27.010]  [SPEAKER_04]: And that has a price.
[36:27.170 --> 36:35.950]  [SPEAKER_04]: That has a very high price because people stop trusting the very people they should be trusting and start listening to people who don't know what they're talking about.
[36:35.950 --> 36:48.130]  [SPEAKER_04]: Then you have an uneducated, suspicious populace and it becomes really, really hard to get any bit of information out and to not be completely let around by the nose.
[36:50.230 --> 36:53.730]  [SPEAKER_08]: I think it's really hard to pick and choose which emergencies though.
[36:53.830 --> 37:03.370]  [SPEAKER_08]: I mean, with EAS, it's a different sort of thing than like I think what I'm hearing as a wider social misunderstanding.
[37:03.370 --> 37:05.690]  [SPEAKER_08]: In other words, people talking past one another.
[37:06.110 --> 37:10.250]  [SPEAKER_08]: Or another concern I'm hearing that I would imagine in this is confirmation bias.
[37:10.630 --> 37:29.350]  [SPEAKER_08]: Like if somebody's rioting and you're looking for that group to be out rioting and you get some alert about such and such in your neighborhood causing all kinds of havoc, maybe that's what you're looking for and you're going to take up whatever defenses or offensive measures you think are necessary,
[37:29.830 --> 37:31.030]  [SPEAKER_08]: that's a chaotic moment.
[37:31.250 --> 37:44.010]  [SPEAKER_08]: And that is kind of what makes it hard is like, okay, should you be questioning, you know, a launch of some kind of missile, as we saw in Hawaii, like a couple, it wasn't a year ago.
[37:44.250 --> 37:44.510]  [SPEAKER_08]: Yeah, remember that?
[37:44.670 --> 37:48.410]  [SPEAKER_08]: That was a mistake by someone qualified to send these EAS messages.
[37:48.410 --> 37:50.010]  [SPEAKER_04]: That wasn't even something that was fake.
[37:50.010 --> 37:51.090]  [SPEAKER_04]: It was just a mistake.
[37:51.090 --> 37:52.170]  [SPEAKER_04]: And that can happen too.
[37:52.170 --> 37:57.250]  [SPEAKER_08]: How do you categorize like which EAS, okay, like Amber Alerts, ignore all of those.
[37:57.410 --> 37:58.030]  [SPEAKER_08]: Nobody cares.
[37:58.390 --> 38:00.930]  [SPEAKER_08]: You know, I mean, do you really start having that kind of crass skepticism?
[38:00.930 --> 38:03.170]  [SPEAKER_04]: That's not Kyle saying that he's quoting.
[38:03.170 --> 38:03.690]  [SPEAKER_04]: Oh yeah, I'm sorry.
[38:03.850 --> 38:05.450]  [SPEAKER_04]: You're quoting somebody that's saying that.
[38:05.450 --> 38:09.610]  [SPEAKER_08]: I was being facetious, like, yeah, and sarcastic and all of that.
[38:09.710 --> 38:10.690]  [SPEAKER_08]: But yeah, exactly.
[38:10.830 --> 38:18.010]  [SPEAKER_08]: How do you categorize and then wait one emergency alert over another to ignore or pay attention to?
[38:18.010 --> 38:23.750]  [SPEAKER_08]: And let me say, everyone listening to WBAI right now, pay attention to EAS alerts.
[38:24.450 --> 38:31.190]  [SPEAKER_08]: We keep our EAS mechanisms nice and shiny, so you can trust alerts from this radio station.
[38:31.190 --> 38:37.110]  [SPEAKER_04]: But if you notice something doesn't make sense, say so and have a conversation and don't dismiss out of hand.
[38:37.850 --> 38:39.070]  [SPEAKER_04]: Let me just ask you guys a question.
[38:39.570 --> 38:46.430]  [SPEAKER_04]: If you had access, if you could just send a message over EAS, like this guy purports to be able to do, what would you say?
[38:46.630 --> 38:47.410]  [SPEAKER_04]: What would you do?
[38:48.750 --> 38:49.950]  [SPEAKER_04]: Alex, you have an idea?
[38:50.210 --> 38:50.930]  [SPEAKER_04]: Oh, Gila, you have an idea.
[38:51.250 --> 38:51.530]  [SPEAKER_04]: Go ahead.
[38:51.910 --> 38:52.090]  [SPEAKER_03]: Yeah.
[38:52.630 --> 38:57.970]  [SPEAKER_03]: I mean, right now, if I were going to send a message over EAS right now, it would just be stay home.
[38:58.810 --> 38:59.110]  [SPEAKER_04]: Okay.
[38:59.310 --> 38:59.730]  [SPEAKER_04]: Stay home.
[38:59.870 --> 39:00.610]  [SPEAKER_04]: So you're going to...
[39:00.610 --> 39:01.150]  [SPEAKER_04]: Outside is closed.
[39:01.150 --> 39:05.070]  [SPEAKER_04]: You're going to be responsible and you're going to do what the system is designed for.
[39:06.510 --> 39:06.930]  [SPEAKER_04]: Boring.
[39:07.150 --> 39:07.370]  [SPEAKER_04]: Okay.
[39:09.290 --> 39:10.130]  [SPEAKER_04]: That's rude.
[39:10.830 --> 39:14.930]  [SPEAKER_04]: Alex, do you have something a bit more nefarious?
[39:15.190 --> 39:16.370]  [SPEAKER_04]: That's what I'm looking for.
[39:16.950 --> 39:17.730]  [SPEAKER_07]: Sure, sure.
[39:17.890 --> 39:34.950]  [SPEAKER_07]: I mean, I think it would be funny to send out something that says, you know, hello world, you know, the classic first line of, you know, that you learn in every programming language or support WBAI by calling 516-620-3602 and support community radio.
[39:35.070 --> 39:35.390]  [SPEAKER_07]: Something like that.
[39:35.490 --> 39:36.030]  [SPEAKER_07]: Could you imagine?
[39:36.210 --> 39:40.590]  [SPEAKER_04]: Yeah, because hacking the emergency alert system is a surefire way to get support for WBAI.
[39:40.590 --> 39:44.490]  [SPEAKER_04]: Yeah, yeah, I'm sure the feds would love us even more.
[39:44.650 --> 39:44.730]  [SPEAKER_06]: Yeah.
[39:46.050 --> 39:47.110]  [SPEAKER_04]: Rob, do you have an idea?
[39:48.130 --> 39:51.270]  [SPEAKER_06]: Yeah, I might go the responsible disclosure route.
[39:51.430 --> 39:59.350]  [SPEAKER_06]: And my message would be, here's a hint to what you could fix so I'm not able to do this.
[39:59.630 --> 40:00.350]  [SPEAKER_04]: That's good.
[40:00.530 --> 40:05.450]  [SPEAKER_04]: That's, yeah, that's both good and nefarious at the same time.
[40:05.450 --> 40:13.510]  [SPEAKER_08]: Like the IP that was, wait, that could cause havoc, but yeah, the IP, the password, or just maybe the IP and like, you know, change your password.
[40:13.790 --> 40:26.230]  [SPEAKER_04]: What I was thinking was just saying, don't believe anything you see, because this is the fact that you're able to see what I'm writing instead of what is official should prove that you should always question.
[40:26.810 --> 40:28.670]  [SPEAKER_04]: But that's getting a little wordy, I know.
[40:28.790 --> 40:37.830]  [SPEAKER_04]: But at the same time, this is an invaluable service for those times when you do need to hear from somebody, but look at the security holes that you could drive a truck through.
[40:38.830 --> 40:40.170]  [SPEAKER_04]: That's sort of the message.
[40:40.350 --> 40:41.270]  [SPEAKER_04]: Did you have one, Kyle?
[40:42.170 --> 40:43.650]  [SPEAKER_08]: Oh, I can't think of anything.
[40:44.350 --> 40:46.830]  [SPEAKER_08]: I just would say it's a good question.
[40:48.850 --> 40:49.290]  [SPEAKER_08]: Maybe...
[40:49.290 --> 40:53.310]  [SPEAKER_04]: It's like if you have access to Trump's Twitter account, which I don't think should be a crime.
[40:53.310 --> 40:59.610]  [SPEAKER_04]: If you have access to Trump's Twitter account and you tweeted something under his name, it's mischief.
[40:59.810 --> 41:00.550]  [SPEAKER_04]: It's not a crime.
[41:00.550 --> 41:03.790]  [SPEAKER_04]: The fact that you could start a nuclear war over Twitter, that's not your fault.
[41:04.390 --> 41:07.730]  [SPEAKER_04]: That's our fault for believing everything you see on Twitter.
[41:07.970 --> 41:11.450]  [SPEAKER_08]: I'd probably put a quotation out there, or just say, like, don't panic.
[41:11.650 --> 41:12.450]  [SPEAKER_04]: I would say I quit.
[41:12.810 --> 41:15.370]  [SPEAKER_04]: I'm on Trump's Twitter account right now.
[41:15.510 --> 41:16.350]  [SPEAKER_04]: That's what I would do.
[41:16.810 --> 41:17.070]  [SPEAKER_04]: Wow.
[41:17.690 --> 41:18.690]  [SPEAKER_04]: Okay, we need to move on.
[41:18.790 --> 41:19.630]  [SPEAKER_04]: Go ahead, Gila.
[41:20.230 --> 41:21.330]  [SPEAKER_03]: Sir, I'm just going to ask.
[41:21.410 --> 41:21.550]  [SPEAKER_04]: Yeah.
[41:21.690 --> 41:26.810]  [SPEAKER_03]: Trump's Twitter account probably won't be around much after the inauguration.
[41:27.010 --> 41:27.890]  [SPEAKER_04]: It'll be around.
[41:27.890 --> 41:29.730]  [SPEAKER_04]: No, it just will be, it'll be suspended.
[41:30.290 --> 41:31.130]  [SPEAKER_04]: I'm pretty sure.
[41:31.410 --> 41:31.450]  [SPEAKER_04]: It'll be suspended.
[41:31.670 --> 41:31.830]  [SPEAKER_04]: Yeah.
[41:31.850 --> 41:37.130]  [SPEAKER_03]: But I'm not sure if he's going to get permanently banned because he's broken every single Twitter rule.
[41:37.170 --> 41:40.730]  [SPEAKER_03]: And once he's not the president anymore, I think they're going to start enforcing, maybe?
[41:40.990 --> 41:42.370]  [SPEAKER_04]: Yeah, that's the hope.
[41:42.570 --> 41:44.450]  [SPEAKER_03]: I should not believe everything I see.
[41:44.710 --> 41:45.090]  [SPEAKER_04]: No.
[41:45.670 --> 41:46.510]  [SPEAKER_04]: No, you should not.
[41:48.110 --> 41:48.910]  [SPEAKER_04]: Here's something...
[41:48.910 --> 41:49.590]  [SPEAKER_04]: I was hopeful, though.
[41:49.590 --> 41:50.190]  [SPEAKER_04]: Okay, I'm sorry.
[41:50.230 --> 41:50.810]  [SPEAKER_04]: This is my fault.
[41:58.010 --> 42:01.030]  [SPEAKER_04]: One of the tips that we were sent.
[42:01.150 --> 42:01.730]  [SPEAKER_04]: Look for cameras...
[42:01.730 --> 42:03.050]  [SPEAKER_04]: Okay, I don't quite understand.
[42:03.150 --> 42:04.890]  [SPEAKER_04]: Look for cameras before engaging in a fight.
[42:05.350 --> 42:11.070]  [SPEAKER_04]: If you're already in a battle, shoot out any cameras you can see before your overheat bar fills up.
[42:11.490 --> 42:14.250]  [SPEAKER_04]: Cameras can help enemies locate and easily hack you.
[42:15.710 --> 42:21.710]  [SPEAKER_04]: Scanning the area for enemies is also a great preventative measure, as this can tell you which enemy can hack you.
[42:21.770 --> 42:27.030]  [SPEAKER_04]: As soon as you see an enemy, you can quickly take them out before they hack you or do any significant damage.
[42:27.310 --> 42:30.990]  [SPEAKER_04]: Identify enemy netrunners attempting to hack you.
[42:31.110 --> 42:35.790]  [SPEAKER_04]: Once you find the hacker, you can shoot them out before your overheating bar fills.
[42:35.910 --> 42:37.310]  [SPEAKER_04]: What am I talking about here?
[42:38.030 --> 42:39.130]  [SPEAKER_08]: That's crazy talk.
[42:39.310 --> 42:39.990]  [SPEAKER_08]: Is that a letter to the...
[42:39.990 --> 42:42.010]  [SPEAKER_04]: I really wish I had the first page of that article.
[42:42.190 --> 42:42.510]  [SPEAKER_08]: Hang on.
[42:42.670 --> 42:45.570]  [SPEAKER_08]: That must be a letter to oth@2600.
[42:45.570 --> 42:45.650]  [SPEAKER_08]: No, it's not.
[42:45.650 --> 42:46.430]  [SPEAKER_04]: It's a news story.
[42:46.710 --> 42:47.570]  [SPEAKER_04]: This is a news story.
[42:47.830 --> 42:49.570]  [SPEAKER_04]: Google News gave this to me.
[42:49.710 --> 42:50.210]  [SPEAKER_08]: That makes...
[42:50.950 --> 42:52.070]  [SPEAKER_08]: That's really confusing.
[42:52.250 --> 42:53.230]  [SPEAKER_08]: Wait, it's...
[42:53.230 --> 42:54.630]  [SPEAKER_08]: Wait, in the bar?
[42:54.630 --> 42:55.790]  [SPEAKER_08]: What is the bar?
[42:55.950 --> 42:56.210]  [SPEAKER_08]: Oh, wait.
[42:56.270 --> 42:56.770]  [SPEAKER_04]: This must be...
[42:56.770 --> 42:57.630]  [SPEAKER_04]: This page here.
[42:58.630 --> 43:00.690]  [SPEAKER_04]: Overheating in Cyberpunk 2077?
[43:00.690 --> 43:01.370]  [SPEAKER_04]: What is that?
[43:02.490 --> 43:03.390]  [SPEAKER_08]: Oh, wow.
[43:03.550 --> 43:03.750]  [SPEAKER_08]: Okay.
[43:03.850 --> 43:09.330]  [SPEAKER_08]: This was the game title that had a bunch of errors.
[43:09.330 --> 43:10.070]  [SPEAKER_08]: This is a game?
[43:10.250 --> 43:11.430]  [SPEAKER_08]: I believe it is.
[43:11.550 --> 43:11.830]  [SPEAKER_08]: Yeah.
[43:12.210 --> 43:13.170]  [SPEAKER_08]: I heard...
[43:13.170 --> 43:15.030]  [SPEAKER_08]: I think a little bit about this.
[43:15.110 --> 43:17.630]  [SPEAKER_04]: So don't shoot out any cameras unless you're in a game.
[43:18.250 --> 43:18.870]  [SPEAKER_04]: Is that...
[43:18.870 --> 43:19.090]  [SPEAKER_04]: Okay.
[43:19.230 --> 43:19.970]  [SPEAKER_04]: I'm sorry, folks.
[43:19.970 --> 43:25.150]  [SPEAKER_04]: I thought I was giving out some valuable information for people that were going through hard times.
[43:25.770 --> 43:26.570]  [SPEAKER_04]: But no.
[43:26.750 --> 43:27.190]  [SPEAKER_04]: Okay, fine.
[43:27.310 --> 43:28.410]  [SPEAKER_04]: Cyberpunk 2077.
[43:28.570 --> 43:29.690]  [SPEAKER_04]: I have no interest whatsoever.
[43:30.010 --> 43:31.230]  [SPEAKER_08]: Yeah, I don't know much about it.
[43:31.330 --> 43:32.730]  [SPEAKER_08]: I know they were having a lot of problems.
[43:32.830 --> 43:34.590]  [SPEAKER_04]: Cyberpunk 2020 is hard enough.
[43:34.630 --> 43:37.210]  [SPEAKER_08]: They're offering refunds, though, if you're not happy with it.
[43:37.230 --> 43:37.450]  [SPEAKER_08]: Are they?
[43:37.730 --> 43:38.130]  [SPEAKER_08]: Yes.
[43:38.410 --> 43:38.750]  [SPEAKER_08]: All right.
[43:38.750 --> 43:39.130]  [SPEAKER_08]: All right.
[43:39.130 --> 43:41.930]  [SPEAKER_08]: But they want you to stick with them through their first round of updates.
[43:42.710 --> 43:49.950]  [SPEAKER_04]: So, Alex, I want to ask you, there's all this talk about some major systems being hacked.
[43:50.750 --> 43:55.030]  [SPEAKER_04]: I'm seeing talks of something called FireEye.
[43:55.130 --> 43:57.030]  [SPEAKER_04]: I'm seeing talks of something called SolarWinds.
[43:57.330 --> 43:58.630]  [SPEAKER_04]: It's very confusing.
[43:59.170 --> 44:01.590]  [SPEAKER_04]: It has to do with all kinds of U.S.
[44:01.690 --> 44:03.210]  [SPEAKER_04]: agencies, Russian hackers.
[44:05.890 --> 44:07.430]  [SPEAKER_04]: Can you sum this up?
[44:08.690 --> 44:13.570]  [SPEAKER_07]: Yeah, this is a very, very interesting and, I think, a fast-moving story.
[44:13.570 --> 44:20.010]  [SPEAKER_07]: And it involves those pesky foreign actors, again, that we had just discussed a few moments ago.
[44:20.610 --> 44:22.070]  [SPEAKER_07]: So, in short, yeah, you're right.
[44:22.110 --> 44:24.070]  [SPEAKER_07]: This is about FireEye and SolarWinds.
[44:24.190 --> 44:25.170]  [SPEAKER_07]: They're two different companies.
[44:25.330 --> 44:37.790]  [SPEAKER_07]: And so, earlier this month, FireEye, which is a cybersecurity company that focuses on things like incident response, risk management, cyber threat intelligence, as well as penetration testing, found out it had suffered a breach.
[44:37.790 --> 44:39.170]  [SPEAKER_07]: It had been hacked by somebody.
[44:39.290 --> 44:40.470]  [SPEAKER_07]: Now, this was really big news.
[44:40.650 --> 44:57.650]  [SPEAKER_07]: We talked about this a little bit last week with Welton Chang from UN Rights First, because FireEye is a company that engages in penetration testing and had unique toolkits used for probing and possibly compromising its customers' networks legally, right,
[44:57.730 --> 44:59.170]  [SPEAKER_07]: as part of penetration testing.
[44:59.170 --> 45:05.610]  [SPEAKER_07]: So, if FireEye was compromised, then bad actors could use those toolkits for malicious reasons.
[45:05.830 --> 45:23.650]  [SPEAKER_07]: And therefore, if they made their way out into the wild, you could be sure that other sophisticated threat actors, other foreign state actors or organized crime, would use them precisely because it would give them a certain amount of cover, meaning it would be difficult to attribute the attack to any particular group or country.
[45:24.170 --> 45:29.150]  [SPEAKER_07]: But here's where SolarWinds comes in, because the focus of the story has really changed over the last few days.
[45:29.310 --> 45:45.610]  [SPEAKER_07]: Now, while FireEye was investigating its own breach, the breach of its own systems, and looking through apparently 50,000 line-down source codes and other source codes, it found that there was a backdoor within something called Orion SolarWinds.
[45:45.690 --> 45:47.830]  [SPEAKER_07]: Now, Orion is the software.
[45:48.010 --> 45:48.910]  [SPEAKER_07]: It's actually the platform.
[45:48.910 --> 45:54.030]  [SPEAKER_07]: SolarWinds is a Texas-based company that makes the platform Orion.
[45:54.330 --> 46:08.710]  [SPEAKER_07]: And what Orion does, in essence, is allow monitoring and management of complex and often geographically dispersed information technology assets, things that are critical to a business's operations.
[46:08.710 --> 46:21.450]  [SPEAKER_07]: You're going to have this Orion system on so that you can monitor it, make sure that systems and processes are not going out of whack, and you can restart certain things, reboot the machine, and make sure that it's operating effectively.
[46:21.690 --> 46:27.370]  [SPEAKER_07]: So, in order to do that, you're going to have to have certain types of administrator access on that machine.
[46:27.710 --> 46:35.030]  [SPEAKER_07]: Now, the threat actors behind this particular attack are supposedly some elite unit of Russian intelligence.
[46:35.290 --> 46:41.410]  [SPEAKER_07]: And according to others, though, making that attribution may be a little bit premature, and I think that's probably correct.
[46:41.670 --> 46:55.930]  [SPEAKER_07]: But what's critical to understanding how this whole thing happened is that the threat actors, whoever they are, and this is where it gets really interesting, appeared to have compromised SolarWinds' software-build infrastructure.
[46:56.310 --> 47:17.530]  [SPEAKER_07]: So, once inside that infrastructure, once inside SolarWinds' place within their company, where they build their software, where they do their coding, the bad guys then added malicious code, blending in their malware with legitimate code and really stealthy ways to prevent detection by things called YARA rules that are designed to find malware.
[47:18.310 --> 47:26.210]  [SPEAKER_07]: And with that code going undetected, SolarWinds signed their new updates, meaning to all their customers, they appear to be legitimate.
[47:26.450 --> 47:26.470]  [SPEAKER_07]: Oh, wow.
[47:26.470 --> 47:30.010]  [SPEAKER_07]: They used a cryptographic form of signing this software.
[47:30.010 --> 47:41.510]  [SPEAKER_07]: And when new updates were delivered to SolarWinds' client base, which is huge, the malicious code then allowed the threat actors access to the customers' networks through a backdoor.
[47:41.770 --> 47:49.910]  [SPEAKER_07]: And according to the Hacker News Network, the malicious code actually may have been present as far back as October 2009.
[47:49.910 --> 47:51.330]  [SPEAKER_07]: So, we're going over a year.
[47:51.930 --> 47:53.350]  [SPEAKER_04]: 2009 or 2019?
[47:53.730 --> 47:54.050]  [SPEAKER_07]: I'm sorry, 2019.
[47:54.410 --> 47:55.950]  [SPEAKER_07]: We're going over a year, yeah.
[47:56.230 --> 47:58.850]  [SPEAKER_07]: 2009 would have been really precocious to do something like this.
[47:58.850 --> 48:03.730]  [SPEAKER_07]: But, you know, it's not clear how the threat actors obtained access to the built infrastructure.
[48:03.950 --> 48:07.490]  [SPEAKER_07]: This goes back to something Kyle had mentioned earlier.
[48:07.810 --> 48:19.850]  [SPEAKER_07]: But Reuters had actually reported, I think it was today, or I think it was today, actually, that SolarWinds' update server was accessible with the password SolarWinds123.
[48:19.990 --> 48:26.390]  [SPEAKER_07]: And that a security researcher had apprised SolarWinds of that information.
[48:26.390 --> 48:27.610]  [SPEAKER_04]: You see what I mean, Alex?
[48:27.750 --> 48:29.130]  [SPEAKER_04]: We're not getting any more intelligence.
[48:29.490 --> 48:31.370]  [SPEAKER_04]: We keep making the same damn mistakes.
[48:31.710 --> 48:34.490]  [SPEAKER_04]: It's just we keep trusting more and more things.
[48:36.210 --> 48:36.890]  [SPEAKER_04]: SolarWinds123, huh?
[48:37.010 --> 48:38.490]  [SPEAKER_04]: That was their password.
[48:39.090 --> 48:39.350]  [SPEAKER_07]: Yeah.
[48:39.990 --> 48:40.050]  [SPEAKER_07]: Yeah.
[48:40.430 --> 48:41.150]  [SPEAKER_07]: Can you imagine that?
[48:41.150 --> 48:42.230]  [SPEAKER_07]: Look, that password.
[48:42.490 --> 48:43.490]  [SPEAKER_07]: But that's not clear.
[48:43.710 --> 48:48.490]  [SPEAKER_07]: To be fair to SolarWinds, I'm sure they have a very complex IT environment.
[48:48.490 --> 48:49.990]  [SPEAKER_07]: There's probably lots of people.
[48:50.150 --> 48:53.070]  [SPEAKER_07]: Maybe change management could have been more effectively managed.
[48:53.990 --> 48:54.730]  [SPEAKER_04]: SolarWinds123, Alex.
[48:54.730 --> 48:55.450]  [SPEAKER_04]: You can't get past that.
[48:55.450 --> 48:55.830]  [SPEAKER_08]: No, no, no.
[48:55.830 --> 48:56.150]  [SPEAKER_08]: I'm sorry.
[48:56.270 --> 48:59.410]  [SPEAKER_08]: How much billing did they do?
[48:59.550 --> 49:02.130]  [SPEAKER_08]: And we're supposed to give them a break?
[49:02.290 --> 49:05.310]  [SPEAKER_08]: This is classic, you had one job.
[49:05.830 --> 49:06.870]  [SPEAKER_04]: Pretty much.
[49:07.430 --> 49:19.950]  [SPEAKER_07]: However, there's no indication yet that that SolarWinds123 password was used as part of the breach of SolarWinds' build infrastructure and allowed them to get into it.
[49:19.950 --> 49:30.450]  [SPEAKER_07]: It would have allowed people access to the update server, which was part and parcel of how this all got distributed around the world to all of SolarWinds' customers.
[49:30.530 --> 49:31.250]  [SPEAKER_07]: Well, think about that.
[49:31.350 --> 49:32.970]  [SPEAKER_04]: Think of the harm that was caused by that.
[49:34.030 --> 49:36.370]  [SPEAKER_04]: SolarWinds123 basically infected their entire customer base.
[49:37.070 --> 49:37.470]  [SPEAKER_04]: That's correct.
[49:37.470 --> 49:40.190]  [SPEAKER_04]: They did the work of these evil actors.
[49:40.190 --> 49:43.830]  [SPEAKER_04]: I'm putting that in quotes because, honestly, this is the kind of thing the U.S.
[49:43.890 --> 49:49.050]  [SPEAKER_04]: government would do and we'd call them the good guys, you know, for getting into some foreign country's infrastructure.
[49:50.330 --> 49:59.210]  [SPEAKER_04]: You know, I'm fascinated by this type of thing and I think it's something that we need to learn from and we have to expect it.
[49:59.410 --> 50:06.370]  [SPEAKER_04]: It's not, you know, do you see this as an act of war or some kind of heavily punishable crime?
[50:06.470 --> 50:13.230]  [SPEAKER_04]: I see it as a system being tested for what it's worth and finding out that it's not worth all that much.
[50:14.170 --> 50:17.330]  [SPEAKER_07]: Well, that's a good point and I think it's an excellent question, too.
[50:17.410 --> 50:32.610]  [SPEAKER_07]: And you look at the targets, the entities that we know to have been compromised by this particular incident involving SolarWinds' Orion platform and there are a lot of governmental entities that relate to the federal government of the United States, like the Department of Commerce,
[50:32.890 --> 50:34.670]  [SPEAKER_07]: Department of Homeland Security, Treasury.
[50:34.830 --> 50:36.770]  [SPEAKER_07]: There's likely to be a whole bunch of others.
[50:36.850 --> 50:48.110]  [SPEAKER_07]: In fact, there was a federal directive that came out instructing any agency or component of the federal government that was utilizing SolarWinds' Orion platform to disconnect it.
[50:48.650 --> 50:58.190]  [SPEAKER_07]: And if this was Russian intelligence or if it was any other intelligence operation and they were targeting U.S.
[50:58.210 --> 51:08.170]  [SPEAKER_07]: entities and governmental entities, well then that to me, sure, it would violate our criminal laws, but that's just bog standard practice when it comes to the collection of intelligence.
[51:08.170 --> 51:10.390]  [SPEAKER_07]: That's what we do, that's what every country does.
[51:10.630 --> 51:31.590]  [SPEAKER_07]: If they use this to steal trade secrets, to steal intellectual property, to compromise the private networks of America's critical infrastructure that is involved in the private sector, then I think, you know, then we're crossing into a line that certainly involves criminality and theft and has gone beyond ordinary intelligence.
[51:31.850 --> 51:38.090]  [SPEAKER_04]: But because of the action, because of what they stole, I'm fascinated by doing it for the sake of just showing you can do it.
[51:38.730 --> 51:39.370]  [SPEAKER_07]: Oh, certainly.
[51:39.750 --> 51:40.430]  [SPEAKER_07]: And quietly.
[51:40.810 --> 51:41.230]  [SPEAKER_04]: Quietly, yeah.
[51:41.890 --> 51:42.090]  [SPEAKER_07]: Yeah.
[51:42.230 --> 51:53.610]  [SPEAKER_07]: And this was an absolutely amazing way to compromise so many people that are geographically dispersed, you know, as widely as their own IT assets are geographically dispersed.
[51:54.070 --> 52:00.910]  [SPEAKER_07]: Because you're piggybacking on something that already has what is essentially super user access to a whole bunch of these systems.
[52:00.910 --> 52:06.850]  [SPEAKER_07]: You're just riding in, you know, with, with this, you know, this bus that's authorized to get into the compound.
[52:07.270 --> 52:08.750]  [SPEAKER_07]: And, and that's what they did.
[52:08.750 --> 52:10.390]  [SPEAKER_07]: And they got away with it for a long time.
[52:10.550 --> 52:27.410]  [SPEAKER_07]: And a lot of people are, are hypothesizing that the reason why they got away with this for so long, when our intelligence community has this defending forward mentality where we're out there hunting for this type of activity is because we were so focused on the security of the election infrastructure,
[52:27.430 --> 52:29.290]  [SPEAKER_07]: that we missed something like this.
[52:29.510 --> 52:30.950]  [SPEAKER_07]: And that's quite possible.
[52:31.110 --> 52:48.790]  [SPEAKER_07]: But, you know, look, the elegance of this type of attack, I think is something, you know, to be commented on and to be, you know, commended, quite frankly, it is, it is really, I think, a fantastically effective way of getting into the networks of a massive client base.
[52:48.930 --> 52:50.590]  [SPEAKER_04]: Yeah, you have to realize it's a game.
[52:50.830 --> 52:53.210]  [SPEAKER_04]: And whoever this is, they won this game.
[52:53.330 --> 52:54.670]  [SPEAKER_04]: They deserve respect for that.
[52:55.150 --> 52:58.230]  [SPEAKER_04]: And whether crimes are committed after that, that's a different subject.
[52:58.230 --> 53:01.510]  [SPEAKER_04]: But this, this, to me, is a work of art.
[53:01.850 --> 53:04.090]  [SPEAKER_04]: That's, that's how you, that's how you pull off a hack.
[53:04.230 --> 53:05.530]  [SPEAKER_04]: And they seem to have done it really well.
[53:06.170 --> 53:13.730]  [SPEAKER_04]: Guys, I don't want to cut this short, but I do want to mention that Overtime is starting at eight o'clock on Channel2600 on YouTube.
[53:14.410 --> 53:20.430]  [SPEAKER_04]: And you can call us and be on that stream and archive as well.
[53:20.430 --> 53:24.770]  [SPEAKER_04]: Our phone number is 802-321-HACK.
[53:24.870 --> 53:28.430]  [SPEAKER_04]: That's 802-321-4225.
[53:29.230 --> 53:34.170]  [SPEAKER_04]: We will be opening up the stream eight o'clock, Channel2600 on YouTube.
[53:34.450 --> 53:37.210]  [SPEAKER_04]: And we'd love to hear from you.
[53:37.370 --> 53:42.950]  [SPEAKER_04]: And you can write to us too, oth@2600.com.
[53:43.150 --> 53:46.110]  [SPEAKER_04]: But I'd like to see people on the YouTube thing.
[53:46.310 --> 53:47.570]  [SPEAKER_04]: It's an experiment we're trying.
[53:47.570 --> 53:54.850]  [SPEAKER_04]: This way, we can take phone calls, which we can't do right now, since we're broadcasting from all over the place and don't have access to the board.
[53:56.130 --> 54:03.090]  [SPEAKER_04]: If you dial 802-321-4225 at eight o'clock and listen to Channel2600 on YouTube, you can talk to us.
[54:03.430 --> 54:05.490]  [SPEAKER_04]: And who knows?
[54:05.630 --> 54:07.070]  [SPEAKER_04]: Who knows what else we might be able to do?
[54:07.870 --> 54:09.030]  [SPEAKER_04]: Any closing comments, Alex?
[54:11.190 --> 54:20.050]  [SPEAKER_07]: No, I just, you know, wish everyone well who had their Christmases ruined by the SolarWinds platform hack and good luck rebuilding your networks.
[54:20.230 --> 54:21.430]  [SPEAKER_04]: Yeah, don't take it too seriously.
[54:21.690 --> 54:25.290]  [SPEAKER_04]: I mean, yeah, it sucks, but your job just changed a little bit.
[54:25.430 --> 54:26.810]  [SPEAKER_04]: And we learned something, hopefully.
[54:28.770 --> 54:31.270]  [SPEAKER_04]: SolarWinds 123, come on, let's not do that anymore.
[54:32.370 --> 54:34.550]  [SPEAKER_04]: Rob, Bila, any last words for you?
[54:35.830 --> 54:40.470]  [SPEAKER_06]: I just got to remember to change my password on all my stuff from SolarWinds123.
[54:40.710 --> 54:40.890]  [SPEAKER_06]: Yeah.
[54:41.990 --> 54:43.770]  [SPEAKER_06]: Someone broke SolarWinds.
[54:44.150 --> 54:45.370]  [SPEAKER_04]: Wow, that's a good one.
[54:45.410 --> 54:46.390]  [SPEAKER_04]: Good one, good one, Kyle.
[54:47.530 --> 54:47.970]  [SPEAKER_04]: Okay.
[54:48.930 --> 54:51.290]  [SPEAKER_04]: Please join us, Channel2600 on YouTube.
[54:51.990 --> 54:52.890]  [SPEAKER_04]: See you next week.
[54:53.110 --> 54:53.510]  [SPEAKER_04]: Good night.
[55:44.120 --> 55:55.340]  [SPEAKER_00]: And you're listening to WBAI in New York, 99.5 FM, NWBAI.org.
[56:02.920 --> 56:06.940]  [SPEAKER_04]: Well, here we are, our second overtime stream for Off The Hook.
[56:08.320 --> 56:09.100]  [SPEAKER_04]: I'm here, Kyle.
[56:09.240 --> 56:09.620]  [SPEAKER_04]: Are you there?
[56:10.000 --> 56:10.740]  [SPEAKER_08]: I think I'm here.
[56:10.760 --> 56:11.560]  [SPEAKER_04]: Okay, yeah, there you are.
[56:11.740 --> 56:13.140]  [SPEAKER_08]: You're loud and clear over on this end.
[56:13.200 --> 56:13.460]  [SPEAKER_08]: Am I?
[56:13.600 --> 56:13.800]  [SPEAKER_08]: Okay.
[56:14.040 --> 56:16.180]  [SPEAKER_04]: Well, sitting two feet away from each other, but that's fine.
[56:16.180 --> 56:17.800]  [SPEAKER_08]: Well, I just want you to know that I can hear that.
[56:17.880 --> 56:18.540]  [SPEAKER_04]: Okay, good, good.
[56:18.680 --> 56:19.500]  [SPEAKER_04]: That's good news.
[56:20.100 --> 56:21.120]  [SPEAKER_04]: I see Rob.
[56:21.360 --> 56:22.000]  [SPEAKER_04]: I see Gila.
[56:22.740 --> 56:23.800]  [SPEAKER_04]: Yeah, we can see each other.
[56:24.300 --> 56:25.640]  [SPEAKER_04]: You can't see us, folks.
[56:25.900 --> 56:26.620]  [SPEAKER_04]: That's by choice.
[56:27.800 --> 56:28.440]  [SPEAKER_04]: I'm sorry.
[56:29.320 --> 56:32.980]  [SPEAKER_04]: I know we're not using YouTube for the purpose in which it's intended.
[56:33.160 --> 56:34.100]  [SPEAKER_04]: We're using it for audio.
[56:34.160 --> 56:35.960]  [SPEAKER_04]: We don't do things the way you're supposed to do them.
[56:36.860 --> 56:38.440]  [SPEAKER_04]: Alex, where the hell is Alex?
[56:39.680 --> 56:41.120]  [SPEAKER_04]: This is why we need to be able to see each other.
[56:41.180 --> 56:42.360]  [SPEAKER_04]: We can see that he's not there.
[56:43.920 --> 56:45.400]  [SPEAKER_04]: Eight o'clock is when you're supposed to be back.
[56:45.940 --> 56:51.720]  [SPEAKER_08]: I think he took a break or had to attend to something and was going to be back momentarily.
[56:51.960 --> 56:52.140]  [SPEAKER_08]: Okay.
[56:52.300 --> 56:53.080]  [SPEAKER_08]: That was last I heard.
[56:53.420 --> 56:55.220]  [SPEAKER_08]: I was attending to some things as well.
[56:55.420 --> 56:55.580]  [SPEAKER_08]: Yeah.
[56:56.060 --> 56:57.780]  [SPEAKER_04]: You guys want to update us on the weather?
[56:57.960 --> 56:59.120]  [SPEAKER_04]: And we'll get the phone number out again.
[56:59.120 --> 57:04.600]  [SPEAKER_04]: And 802-321-4225, 802-321-HACK.
[57:04.980 --> 57:07.680]  [SPEAKER_04]: And one call at a time can get through.
[57:08.060 --> 57:11.220]  [SPEAKER_04]: So if somebody else calls, again, Google.
[57:12.120 --> 57:14.140]  [SPEAKER_04]: We can't get a busy signal from Google.
[57:14.580 --> 57:17.280]  [SPEAKER_04]: We're forwarding the line to a single line.
[57:17.340 --> 57:18.120]  [SPEAKER_04]: It doesn't have call waiting.
[57:18.300 --> 57:20.460]  [SPEAKER_04]: But you're going to get voicemail if you don't get through.
[57:20.800 --> 57:21.880]  [SPEAKER_04]: That's just the way it is.
[57:21.880 --> 57:26.000]  [SPEAKER_04]: So if that happens, just call back when the other call is...
[57:26.000 --> 57:31.000]  [SPEAKER_04]: Assuming there is a call in the first place, when that call is finished.
[57:31.940 --> 57:34.860]  [SPEAKER_04]: So, Rob, how are things in Queens weather-wise?
[57:36.240 --> 57:46.800]  [SPEAKER_03]: I would actually like to repeat my favorite radio weather forecast I ever heard in my life, which someone gave on my summer camp radio station, looked out the window and said, It's dark.
[57:48.800 --> 57:49.240]  [SPEAKER_04]: Good.
[57:49.440 --> 57:49.660]  [SPEAKER_04]: Okay.
[57:49.900 --> 57:50.200]  [SPEAKER_04]: All right.
[57:52.160 --> 57:56.180]  [SPEAKER_04]: But as far as the raging blizzard, though, how is that going?
[57:58.670 --> 57:59.730]  [SPEAKER_04]: Look out the window.
[57:59.750 --> 58:00.020]  [SPEAKER_04]: Why not?
[58:00.190 --> 58:00.380]  [SPEAKER_04]: Yeah.
[58:01.400 --> 58:04.400]  [SPEAKER_06]: We're sending her over to the window for a live weather update.
[58:04.580 --> 58:08.340]  [SPEAKER_06]: But yes, to build on her earlier report, it is dark.
[58:08.480 --> 58:14.340]  [SPEAKER_06]: But according to the forecast, it's going to be followed by light after a certain length of time.
[58:14.580 --> 58:15.020]  Wow.
[58:15.270 --> 58:16.670]  [SPEAKER_04]: I'm so happy we're doing this.
[58:16.670 --> 58:18.600]  [SPEAKER_04]: This is really adding to my evening.
[58:19.730 --> 58:23.080]  [SPEAKER_04]: Folks, you know, you have to call for us to continue doing this, though.
[58:23.170 --> 58:25.440]  [SPEAKER_04]: And if we don't get phone calls, we just won't do it anymore.
[58:25.620 --> 58:26.620]  [SPEAKER_04]: I know people are shy.
[58:26.790 --> 58:28.140]  [SPEAKER_04]: Getting the first phone call is always hard.
[58:28.290 --> 58:29.860]  [SPEAKER_04]: We're only doing this for about 10 minutes or so.
[58:30.760 --> 58:32.340]  [SPEAKER_04]: 802-321-4225.
[58:32.340 --> 58:33.120]  [SPEAKER_04]: We tested it.
[58:33.190 --> 58:33.730]  [SPEAKER_04]: We know it works.
[58:33.820 --> 58:34.980]  [SPEAKER_04]: Welcome back, Alex.
[58:35.320 --> 58:36.600]  [SPEAKER_04]: Glad you could join us.
[58:38.160 --> 58:40.500]  [SPEAKER_04]: We're on the damn YouTube right now.
[58:41.270 --> 58:41.670]  [SPEAKER_04]: Ah.
[58:41.900 --> 58:42.140]  [SPEAKER_04]: Yeah.
[58:42.940 --> 58:44.840]  [SPEAKER_04]: Like we said, we were going to...
[58:45.380 --> 58:46.270]  [SPEAKER_07]: Oh, I'm here.
[58:46.270 --> 58:46.730]  [SPEAKER_07]: You know what?
[58:46.790 --> 58:47.670]  [SPEAKER_07]: I guess my watch is...
[58:47.670 --> 58:50.400]  [SPEAKER_07]: I thought it was exactly 8 o'clock that I came back down.
[58:50.540 --> 58:51.920]  [SPEAKER_07]: I had to go up and get a cup of tea.
[58:52.040 --> 58:52.620]  [SPEAKER_04]: It's 8.03.
[58:53.210 --> 58:53.580]  [SPEAKER_07]: Yeah.
[58:53.790 --> 58:54.340]  [SPEAKER_07]: There we are.
[58:54.500 --> 58:54.730]  [SPEAKER_07]: All right.
[58:54.800 --> 58:54.940]  [SPEAKER_07]: Yep.
[58:55.170 --> 58:57.120]  [SPEAKER_04]: How is the blizzard in Pennsylvania?
[58:57.670 --> 58:58.710]  [SPEAKER_07]: It's pretty bad.
[58:59.670 --> 59:00.920]  [SPEAKER_07]: I looked out the window.
[59:01.040 --> 59:02.440]  [SPEAKER_07]: In fact, I'll take another look right now.
[59:02.800 --> 59:06.540]  [SPEAKER_07]: But we must have at least four or five inches.
[59:06.540 --> 59:08.940]  [SPEAKER_04]: I don't care anymore, Alex, because we have a phone call.
[59:09.270 --> 59:10.540]  [SPEAKER_04]: And good evening, caller.
[59:10.690 --> 59:11.520]  [SPEAKER_04]: Can you hear us?
[59:12.580 --> 59:13.300]  [SPEAKER_09]: Yes, I can.
[59:13.560 --> 59:14.270]  [SPEAKER_04]: Where are you calling from?
[59:14.560 --> 59:15.120]  [SPEAKER_04]: Can you hear me?
[59:15.340 --> 59:16.190]  [SPEAKER_04]: Yes, we hear you fine.
[59:17.540 --> 59:17.770]  [SPEAKER_09]: Fine.
[59:18.420 --> 59:19.920]  [SPEAKER_04]: Can you tell us where you're calling from?
[59:21.290 --> 59:21.670]  [SPEAKER_09]: Massachusetts.
[59:22.340 --> 59:22.600]  [SPEAKER_04]: Okay.
[59:22.600 --> 59:23.960]  [SPEAKER_04]: Is it snowing in Massachusetts?
[59:23.960 --> 59:24.120]  [SPEAKER_04]: Massachusetts.
[59:25.600 --> 59:27.210]  [SPEAKER_09]: Um, let me check.
[59:27.620 --> 59:29.800]  [SPEAKER_04]: Nobody seems to be looking out their windows.
[59:30.080 --> 59:31.620]  [SPEAKER_04]: Well, I guess that's a good thing in a pandemic.
[59:34.060 --> 59:36.710]  [SPEAKER_09]: Yeah, I actually don't have a window that I can look out right now.
[59:36.840 --> 59:37.800]  [SPEAKER_04]: What are you, in a basement?
[59:39.210 --> 59:39.600]  [SPEAKER_09]: No.
[59:40.250 --> 59:41.640]  [SPEAKER_09]: Just all my...
[59:42.270 --> 59:42.670]  It's...
[59:42.670 --> 59:43.790]  [SPEAKER_04]: Well, we don't need to...
[59:43.790 --> 59:45.960]  [SPEAKER_04]: We don't need to get into the situation you're in.
[59:45.980 --> 59:46.840]  [SPEAKER_06]: It's a personal choice.
[59:47.400 --> 59:47.800]  [SPEAKER_04]: So...
[59:47.800 --> 59:48.880]  [SPEAKER_06]: This is a hacker show.
[59:49.000 --> 59:50.580]  [SPEAKER_06]: We respect if people don't want to use windows.
[59:50.880 --> 59:51.730]  [SPEAKER_04]: Yeah, that's true.
[59:51.730 --> 59:54.620]  [SPEAKER_04]: So, what's on your mind, caller?
[59:55.800 --> 59:58.290]  [SPEAKER_09]: Um, my name's CJ, by the way.
[59:58.400 --> 59:59.080]  [SPEAKER_04]: CJ, how are you doing?
[01:00:00.270 --> 01:00:00.560]  [SPEAKER_09]: Good.
[01:00:00.920 --> 01:00:04.670]  [SPEAKER_09]: I've been researching a website that has had some issues.
[01:00:05.250 --> 01:00:09.860]  [SPEAKER_09]: Along with token that does not expire and can be used to access your account.
[01:00:10.400 --> 01:00:11.300]  [SPEAKER_04]: Oh, nice.
[01:00:12.940 --> 01:00:13.380]  [SPEAKER_09]: Yep.
[01:00:13.770 --> 01:00:20.190]  [SPEAKER_09]: So, on the bright side, you cannot access their purchasing information or make any purchases on their behalf with that information.
[01:00:20.980 --> 01:00:21.540]  [SPEAKER_04]: Okay, but...
[01:00:21.540 --> 01:00:23.340]  [SPEAKER_09]: You can watch all the shows you want with it.
[01:00:23.640 --> 01:00:23.960]  [SPEAKER_04]: Really?
[01:00:24.190 --> 01:00:24.540]  [SPEAKER_04]: Interesting.
[01:00:24.770 --> 01:00:27.380]  [SPEAKER_04]: So, you told us what kind of a system it is, I guess.
[01:00:28.480 --> 01:00:28.900]  [SPEAKER_09]: Yeah.
[01:00:29.750 --> 01:00:30.100]  [SPEAKER_04]: Wow.
[01:00:30.210 --> 01:00:32.270]  [SPEAKER_09]: It's a streaming platform, and I've reported it to them.
[01:00:32.880 --> 01:00:33.860]  [SPEAKER_04]: And any response?
[01:00:35.190 --> 01:00:35.860]  [SPEAKER_09]: Not yet.
[01:00:37.750 --> 01:00:38.170]  [SPEAKER_04]: Okay.
[01:00:38.500 --> 01:00:43.120]  [SPEAKER_09]: It could have been a worse thing, because with it, you can't actually get their...
[01:00:43.120 --> 01:00:45.340]  [SPEAKER_09]: So, the problem is, you can naturally...
[01:00:45.340 --> 01:00:47.980]  [SPEAKER_09]: That token lasts even if you change your password.
[01:00:49.060 --> 01:00:49.750]  [SPEAKER_04]: That's true.
[01:00:49.900 --> 01:00:50.270]  [SPEAKER_04]: That's...
[01:00:50.270 --> 01:00:50.380]  [SPEAKER_04]: Yeah.
[01:00:50.560 --> 01:00:52.710]  [SPEAKER_04]: That's how tokens can work.
[01:00:54.210 --> 01:00:56.040]  [SPEAKER_04]: What would you suggest they do to fix this?
[01:00:58.020 --> 01:00:58.500]  [SPEAKER_09]: They...
[01:00:59.000 --> 01:01:05.020]  [SPEAKER_09]: Shorter-lived tokens, and basically, like, a lot of revocation every so often.
[01:01:05.290 --> 01:01:05.580]  [SPEAKER_08]: Mm-hmm.
[01:01:06.670 --> 01:01:07.790]  [SPEAKER_09]: What part of the system...
[01:01:07.790 --> 01:01:08.480]  [SPEAKER_09]: And we just re-roll the tokens.
[01:01:08.960 --> 01:01:10.620]  [SPEAKER_08]: What part of the system is it?
[01:01:10.730 --> 01:01:11.290]  [SPEAKER_08]: Is it...
[01:01:11.290 --> 01:01:13.840]  [SPEAKER_08]: This is for, like, account creation and that kind of thing?
[01:01:14.640 --> 01:01:15.620]  [SPEAKER_09]: It's for login.
[01:01:15.920 --> 01:01:16.000]  [SPEAKER_09]: Oh, got it.
[01:01:16.000 --> 01:01:17.600]  [SPEAKER_09]: If you get the person's token...
[01:01:17.600 --> 01:01:17.790]  [SPEAKER_09]: Right.
[01:01:17.920 --> 01:01:21.300]  [SPEAKER_09]: ...you can then use that to login again under their name without...
[01:01:22.040 --> 01:01:23.320]  [SPEAKER_09]: Without their password.
[01:01:23.600 --> 01:01:24.520]  [SPEAKER_09]: You just need the token.
[01:01:24.770 --> 01:01:26.360]  [SPEAKER_04]: So, when did you discover this?
[01:01:26.360 --> 01:01:27.270]  [SPEAKER_04]: When did you notify them?
[01:01:28.380 --> 01:01:30.190]  [SPEAKER_09]: I discovered this a few days ago.
[01:01:30.770 --> 01:01:33.210]  [SPEAKER_09]: But it's also known information.
[01:01:33.440 --> 01:01:35.670]  [SPEAKER_09]: Like, there's a GitHub repo that actually mentions it.
[01:01:35.980 --> 01:01:37.710]  [SPEAKER_04]: And they still haven't fixed it?
[01:01:38.710 --> 01:01:39.190]  [SPEAKER_09]: Nope.
[01:01:39.540 --> 01:01:43.040]  [SPEAKER_09]: This site has been so bad for a long time.
[01:01:43.340 --> 01:01:49.440]  [SPEAKER_09]: Like, a long time ago, you used to be able to tell their mobile API that you were a paying customer, and it would just accept it.
[01:01:50.020 --> 01:01:50.500]  [SPEAKER_04]: Wow.
[01:01:50.800 --> 01:01:55.060]  [SPEAKER_04]: Well, in your opinion, at what point do you go more public with something like this?
[01:01:56.500 --> 01:02:00.290]  [SPEAKER_09]: Um, if they don't fix it in, like, six months.
[01:02:00.860 --> 01:02:02.900]  [SPEAKER_04]: That's a pretty healthy amount of time.
[01:02:02.900 --> 01:02:04.580]  [SPEAKER_04]: So, you're more generous than I would be.
[01:02:05.440 --> 01:02:06.000]  [SPEAKER_09]: Yeah.
[01:02:07.400 --> 01:02:07.960]  [SPEAKER_04]: Okay.
[01:02:08.120 --> 01:02:15.400]  [SPEAKER_09]: I also broke the DRM on digital talking books from the National Library Service.
[01:02:15.420 --> 01:02:16.320]  [SPEAKER_04]: Oh, you didn't?
[01:02:16.320 --> 01:02:16.840]  [SPEAKER_04]: Oh, wow.
[01:02:18.250 --> 01:02:19.670]  [SPEAKER_04]: That's pretty awesome.
[01:02:19.670 --> 01:02:25.120]  [SPEAKER_09]: Uh, it involved a talking book player, a steady hand, and a serial cable.
[01:02:25.710 --> 01:02:26.140]  [SPEAKER_04]: Nice.
[01:02:26.500 --> 01:02:26.980]  [SPEAKER_09]: Uh, you are cable.
[01:02:27.210 --> 01:02:28.400]  [SPEAKER_09]: So, an FTDI chip.
[01:02:28.770 --> 01:02:31.100]  [SPEAKER_04]: Uh, CJ, would you write an article for us about that?
[01:02:31.210 --> 01:02:34.020]  [SPEAKER_04]: That sounds awesome and very inspirational to a lot of people.
[01:02:35.210 --> 01:02:35.640]  [SPEAKER_09]: Yeah.
[01:02:35.840 --> 01:02:37.820]  [SPEAKER_09]: I actually still need to do that.
[01:02:38.750 --> 01:02:44.520]  [SPEAKER_09]: But, it's, yeah, the moral of the story, don't dynamically link to OpenSSL.
[01:02:45.540 --> 01:02:46.400]  [SPEAKER_04]: Duly noted.
[01:02:47.380 --> 01:02:48.300]  [SPEAKER_04]: Write that down.
[01:02:48.600 --> 01:02:48.690]  [SPEAKER_04]: Yeah.
[01:02:49.100 --> 01:02:51.170]  [SPEAKER_09]: And this is an ARM-embedded device.
[01:02:51.360 --> 01:02:55.900]  [SPEAKER_09]: So, I actually contacted the company, asked them to give me their open-source bits.
[01:02:55.900 --> 01:03:00.080]  [SPEAKER_09]: So, like, they're, basically, they're OpenSSL, and they gave me their build root.
[01:03:00.560 --> 01:03:05.340]  [SPEAKER_09]: And then I compiled OpenSSL with a backdoor that spits out private keys.
[01:03:06.170 --> 01:03:10.730]  [SPEAKER_09]: And this breaks the protected digital talking book standard, which is basically just key escrow.
[01:03:11.750 --> 01:03:12.230]  [SPEAKER_06]: Wow.
[01:03:12.920 --> 01:03:14.060]  [SPEAKER_04]: Rob, you had a question.
[01:03:15.040 --> 01:03:17.860]  [SPEAKER_06]: Yeah, CJ, are you referring to the DAISY players?
[01:03:18.690 --> 01:03:19.520]  [SPEAKER_09]: Yes, I am.
[01:03:20.270 --> 01:03:21.620]  [SPEAKER_06]: Yeah, I used to work in the field.
[01:03:21.750 --> 01:03:23.230]  [SPEAKER_06]: Those things are actually pretty cool.
[01:03:23.230 --> 01:03:26.600]  [SPEAKER_06]: But, yeah, I respect what you've done.
[01:03:28.210 --> 01:03:28.600]  [SPEAKER_09]: Yeah.
[01:03:28.800 --> 01:03:34.960]  [SPEAKER_09]: Also, I will not go public with this, because if I did, the storm that would happen would be ridiculous.
[01:03:36.670 --> 01:03:40.860]  [SPEAKER_09]: Like, I will not release the keys if someone else decides they want to try that.
[01:03:41.170 --> 01:03:43.980]  [SPEAKER_09]: First off, they have to have access to the NLS.
[01:03:44.500 --> 01:03:49.080]  [SPEAKER_09]: And second off, they have to have a, they have to spend, like, $300, $400 on a player.
[01:03:49.580 --> 01:03:49.980]  [SPEAKER_04]: Right.
[01:03:50.360 --> 01:04:03.520]  [SPEAKER_04]: Well, and you don't have to go public with particulars, but the theories that get people to think in those methods and also to design systems that are better, I think that's an invaluable service you could perform.
[01:04:05.170 --> 01:04:16.290]  [SPEAKER_09]: The reason why I won't go public with it is because it would be near impossible for them to revoke the keys and then redo everything, because they would have to recall every single talking book player.
[01:04:17.040 --> 01:04:19.560]  [SPEAKER_09]: And the logistics would just be insane.
[01:04:20.000 --> 01:04:20.140]  [SPEAKER_04]: Yeah.
[01:04:20.320 --> 01:04:21.880]  [SPEAKER_04]: No, that's very responsible of you.
[01:04:22.020 --> 01:04:26.460]  [SPEAKER_04]: And the scary thing is that there are many people out there who are not nearly as responsible.
[01:04:26.640 --> 01:04:27.920]  [SPEAKER_04]: That would cause harm.
[01:04:27.920 --> 01:04:31.460]  [SPEAKER_04]: And people designing these systems should keep that in mind.
[01:04:32.140 --> 01:04:32.710]  [SPEAKER_09]: Yeah.
[01:04:32.790 --> 01:04:39.120]  [SPEAKER_09]: And also, this is like 10, 15 years old tech for, for the DAISY protected digital talking book standard.
[01:04:39.120 --> 01:04:39.800]  [SPEAKER_09]: Uh-huh.
[01:04:40.560 --> 01:04:40.820]  [SPEAKER_04]: Uh-huh.
[01:04:41.000 --> 01:04:41.250]  [SPEAKER_09]: Uh-huh.
[01:04:41.250 --> 01:04:46.960]  [SPEAKER_09]: So also, it doesn't help that the audio is encoded in a format that's, uh, that's in padded hell right now.
[01:04:48.400 --> 01:04:48.960]  [SPEAKER_10]: Uh-huh.
[01:04:49.300 --> 01:04:52.460]  [SPEAKER_09]: AMR WB Plus is the codec.
[01:04:53.250 --> 01:04:56.840]  [SPEAKER_09]: There's not really that much that can actually play it, especially in software.
[01:04:57.820 --> 01:04:58.100]  [SPEAKER_04]: Uh-huh.
[01:04:58.400 --> 01:04:59.900]  [SPEAKER_04]: Yeah, we're familiar with things like that.
[01:05:00.040 --> 01:05:02.400]  [SPEAKER_04]: It's, uh, it's always good when you can figure it out, though.
[01:05:02.400 --> 01:05:05.380]  [SPEAKER_04]: So, Alex, did you have any, any question for, for CJ?
[01:05:06.620 --> 01:05:14.620]  [SPEAKER_07]: No, I think he, you know, it's interesting that he's taking the responsible route and disclosing this to the company and giving them ample amount of time.
[01:05:14.940 --> 01:05:21.500]  [SPEAKER_07]: Um, and, um, you know, some types of companies don't take kindly to this type of thing.
[01:05:21.620 --> 01:05:25.270]  [SPEAKER_07]: And others, you know, may offer him some form of bounty as well.
[01:05:25.380 --> 01:05:27.420]  [SPEAKER_07]: So that's certainly something you would want to look into.
[01:05:28.100 --> 01:05:32.290]  [SPEAKER_07]: And, um, you know, and don't hesitate to be in touch with us if you need some additional guidance.
[01:05:33.380 --> 01:05:35.360]  [SPEAKER_04]: CJ, thank you very much for your call.
[01:05:35.560 --> 01:05:37.580]  [SPEAKER_04]: And thanks for, for being a good hacker.
[01:05:39.000 --> 01:05:39.210]  [SPEAKER_09]: Yep.
[01:05:39.560 --> 01:05:40.190]  [SPEAKER_09]: No problem.
[01:05:40.620 --> 01:05:40.940]  [SPEAKER_04]: All right.
[01:05:40.960 --> 01:05:41.800]  [SPEAKER_04]: We'll talk to you again soon.
[01:05:42.730 --> 01:05:43.420]  [SPEAKER_09]: Talk to you soon.
[01:05:43.540 --> 01:05:43.820]  [SPEAKER_09]: Take care.
[01:05:43.920 --> 01:05:44.020]  [SPEAKER_09]: Bye.
[01:05:45.340 --> 01:05:52.060]  [SPEAKER_04]: And that was, uh, one of our listeners, CJ, from Massachusetts, from, uh, a room with no windows, or, I'm not really sure.
[01:05:52.270 --> 01:05:55.710]  [SPEAKER_04]: But the important thing is that, uh, he's got a good sense of values.
[01:05:55.900 --> 01:05:58.480]  [SPEAKER_04]: And that's what I, I like to see, uh, in the hacker community.
[01:05:58.900 --> 01:06:01.340]  [SPEAKER_04]: Uh, okay, uh, we're going to be on in a couple more minutes.
[01:06:01.340 --> 01:06:03.420]  [SPEAKER_04]: It's 802-321-HACK.
[01:06:03.600 --> 01:06:04.960]  [SPEAKER_04]: I didn't have to give the phone number out, did I?
[01:06:05.230 --> 01:06:06.400]  [SPEAKER_04]: So it's ringing off the hook.
[01:06:06.460 --> 01:06:07.250]  [SPEAKER_08]: You should give it out anyway, though.
[01:06:08.500 --> 01:06:10.420]  [SPEAKER_04]: 802-321-HACK, 4225.
[01:06:11.100 --> 01:06:15.460]  [SPEAKER_04]: And right now, if you call it, you'll, it'll ring, even though it's busy, and you'll get a voicemail message.
[01:06:15.460 --> 01:06:18.920]  [SPEAKER_04]: Um, so just hang up and call, try again, if we take another call.
[01:06:19.060 --> 01:06:20.420]  [SPEAKER_08]: But after this, maybe you can get in.
[01:06:20.540 --> 01:06:21.600]  [SPEAKER_04]: Yeah, let's see who we have.
[01:06:21.790 --> 01:06:22.380]  [SPEAKER_04]: Uh, good evening.
[01:06:22.580 --> 01:06:24.250]  [SPEAKER_04]: You're on Overtime.
[01:06:24.770 --> 01:06:25.320]  [SPEAKER_04]: Who is this?
[01:06:26.360 --> 01:06:26.900]  [SPEAKER_02]: Hey, guys.
[01:06:27.230 --> 01:06:29.290]  [SPEAKER_02]: Uh, Alan Cole from Cranford, New Jersey.
[01:06:29.800 --> 01:06:30.170]  [SPEAKER_04]: Great.
[01:06:30.340 --> 01:06:33.080]  [SPEAKER_04]: I imagine the weather in New Jersey is, uh, pretty crazy right now.
[01:06:33.920 --> 01:06:34.920]  [SPEAKER_02]: Yeah, it's looking pretty good.
[01:06:35.040 --> 01:06:37.940]  [SPEAKER_02]: It's, uh, well, about four or five inches right now.
[01:06:38.100 --> 01:06:40.820]  [SPEAKER_02]: It's supposed to really start coming down the next few hours, though.
[01:06:40.820 --> 01:06:47.210]  [SPEAKER_04]: See, I like that you said really, I like that you said really good, not really bad, because I think it is really good to have, have snow in December.
[01:06:48.040 --> 01:06:49.020]  [SPEAKER_02]: Changes up the routine.
[01:06:49.270 --> 01:06:50.600]  [SPEAKER_02]: You know, it's the first storm of the year.
[01:06:50.730 --> 01:06:55.420]  [SPEAKER_02]: It's like, I don't know, I was a teacher for a long time, so like a snow day is like a big deal happening.
[01:06:55.710 --> 01:06:55.940]  [SPEAKER_04]: Uh-huh.
[01:06:56.250 --> 01:07:01.300]  [SPEAKER_04]: And, but now you don't get snow days anymore, because everybody can learn from home, you know, all this virtual environment.
[01:07:01.440 --> 01:07:05.940]  [SPEAKER_02]: Well, I'm hearing that it's become, it's, it's kind of like a, a charitable thing.
[01:07:06.100 --> 01:07:08.300]  [SPEAKER_02]: Some districts are giving the day off tomorrow.
[01:07:08.520 --> 01:07:08.800]  [SPEAKER_04]: Mm-hmm.
[01:07:09.120 --> 01:07:10.120]  [SPEAKER_04]: Those are good districts.
[01:07:11.300 --> 01:07:12.730]  [SPEAKER_04]: Alex, it's a nice thing to do.
[01:07:13.100 --> 01:07:13.800]  [SPEAKER_04]: Go ahead, Alex.
[01:07:14.380 --> 01:07:30.980]  [SPEAKER_07]: Yeah, on that, that point, you know, my, my son is in school in, in public school in Manhattan, and they have issued, well, the Department of Education has issued a snow day for tomorrow, but there's a lot of disappointed kids because, you know, it's all remote learning.
[01:07:31.080 --> 01:07:46.580]  [SPEAKER_07]: Well, most of them have remote learning the following day anyhow, but the principal of our school has given us the option of having the kids do the remote learning or not, because some parents, you know, see a snow day as something that's beneficial to a kid,
[01:07:46.770 --> 01:07:47.500]  [SPEAKER_07]: part of growing up.
[01:07:47.800 --> 01:07:53.960]  [SPEAKER_07]: And I thought that was pretty cool that she gave the option, that the principal actually gave the option of attending school or not tomorrow.
[01:07:54.380 --> 01:07:56.960]  [SPEAKER_04]: Uh, caller, did you, did you have something you wanted to ask us?
[01:07:57.710 --> 01:07:57.960]  [SPEAKER_02]: Yeah.
[01:07:58.140 --> 01:08:00.340]  [SPEAKER_02]: Hey, it's like one nice thing that, you know, that they could do.
[01:08:00.560 --> 01:08:05.380]  [SPEAKER_02]: Yeah, I actually, you know, I was listening to your, listen to the show on the radio, you know, um, just now.
[01:08:05.580 --> 01:08:09.040]  [SPEAKER_02]: You guys were talking about the, um, solar winds story.
[01:08:09.040 --> 01:08:22.120]  [SPEAKER_02]: And I just wanted to bring this into the conversation because I feel like it didn't, it didn't get in there, but you guys know more about this stuff than me, but I was listening to a talk, um, about this about, it's about a year ago, six months ago.
[01:08:22.440 --> 01:08:27.940]  [SPEAKER_02]: And it was a group called the, um, Center for Strategic and International Studies.
[01:08:27.940 --> 01:08:30.100]  [SPEAKER_02]: They're like a think tank that's like in DC.
[01:08:30.690 --> 01:08:31.730]  [SPEAKER_02]: I don't know much about them.
[01:08:31.820 --> 01:08:48.100]  [SPEAKER_02]: Maybe you guys know more, but, um, you know, they have like these discussion panels and one of them was about security and like, you know, technology and security and, and the entire panel was about supply chain, um, in like virus and injections where,
[01:08:48.730 --> 01:08:56.420]  [SPEAKER_02]: you know, you get like, uh, some group that basically tried to do exactly what happened, um, with this case.
[01:08:56.520 --> 01:09:06.480]  [SPEAKER_02]: And it's, it's hidden because it's, it's in like a piece of code that somebody, some contractor used, you know, to put together a piece of whatever they're using.
[01:09:06.480 --> 01:09:07.880]  [SPEAKER_02]: So they might not even know what's in there.
[01:09:08.190 --> 01:09:13.280]  [SPEAKER_02]: Um, but I just wanted to mention that idea because they had a whole, a whole panel about her for a couple hours.
[01:09:13.380 --> 01:09:20.400]  [SPEAKER_02]: And I feel like I didn't hear that come up when you guys were discussing, but maybe I missed it because I'm not technical enough to, to follow the conversation here.
[01:09:21.660 --> 01:09:22.460]  [SPEAKER_07]: Yeah, sure.
[01:09:22.770 --> 01:09:39.020]  [SPEAKER_07]: You know, the, the, you mentioned CSIS, they're, they're actually part of Johns Hopkins University in, in Baltimore, and they have some absolutely excellent panels and some really great researchers as well as, uh, you know, just strategic thinkers when it comes to things like you had mentioned,
[01:09:39.200 --> 01:09:40.360]  [SPEAKER_07]: the supply chain attacks.
[01:09:40.520 --> 01:09:42.920]  [SPEAKER_07]: I, I have no doubt that their panel was very, very interesting.
[01:09:43.190 --> 01:09:46.770]  [SPEAKER_07]: And this certainly was, you know, an example of a supply chain attack.
[01:09:46.960 --> 01:09:52.420]  [SPEAKER_07]: And we, I think we tried to hint at that, uh, by describing it as somebody who's essentially on a bus, right?
[01:09:52.520 --> 01:09:55.770]  [SPEAKER_07]: That's, that's got access to the internal compound, right?
[01:09:55.770 --> 01:09:55.820]  [SPEAKER_07]: Right.
[01:09:55.960 --> 01:09:57.160]  [SPEAKER_07]: So this is part of it.
[01:09:57.230 --> 01:10:06.920]  [SPEAKER_07]: It is, is part of the infrastructure that a lot of major companies and minor companies all around the world, not just the United States use to manage a dispersed network infrastructure.
[01:10:07.540 --> 01:10:13.300]  [SPEAKER_07]: And, um, you know, almost everybody, you know, who's anybody will use solar winds in some form or another.
[01:10:13.500 --> 01:10:16.960]  [SPEAKER_07]: And so now it's, it's, you know, triage time, right?
[01:10:17.080 --> 01:10:31.980]  [SPEAKER_07]: Because if these entities know that there was a potential route for being compromised through something like a supply chain attack, as you mentioned, which, which this certainly can be classified as now they have to figure out, well, did the, did the attackers break out anywhere?
[01:10:32.140 --> 01:10:36.740]  [SPEAKER_07]: Do they have, have they established any sort of other persistent access to our networks?
[01:10:36.980 --> 01:10:40.860]  [SPEAKER_07]: And if so, how are we going to root them out of our networks?
[01:10:40.980 --> 01:10:42.160]  [SPEAKER_07]: Are we going to have to tear it down?
[01:10:42.280 --> 01:10:43.740]  [SPEAKER_07]: Are we going to have to rebuild it entirely?
[01:10:44.160 --> 01:10:50.480]  [SPEAKER_07]: Um, so yeah, it becomes a very, very big problem and supply chain attacks are certainly not going to go away.
[01:10:51.000 --> 01:11:06.540]  [SPEAKER_07]: I think in, in the election component of, or rather in the election context, this has been something that's been talked about for, for quite a while because a lot of the, uh, election, uh, electronic components that go into digital voting, things like that,
[01:11:06.620 --> 01:11:07.600]  [SPEAKER_07]: they're all made overseas.
[01:11:07.920 --> 01:11:12.220]  [SPEAKER_07]: And so how do you monitor and regulate these third parties that are all part of that supply chain?
[01:11:12.340 --> 01:11:13.840]  [SPEAKER_07]: It's a very, very big problem.
[01:11:14.080 --> 01:11:15.880]  [SPEAKER_07]: Has any great solutions for it yet?
[01:11:16.200 --> 01:11:19.020]  [SPEAKER_07]: But yeah, you, you, you bring up, uh, I think an excellent point caller.
[01:11:19.200 --> 01:11:21.860]  [SPEAKER_07]: It's, uh, it's, it's some scary stuff for sure.
[01:11:22.460 --> 01:11:23.060]  [SPEAKER_08]: Yeah.
[01:11:23.160 --> 01:11:43.800]  [SPEAKER_08]: When you have these popular services, it just becomes, um, something that like Alex insinuated, uh, everybody who's anybody is using it because these networks are so similar in a lot of their complexities that you would need a dashboard, like what this provider,
[01:11:44.480 --> 01:11:58.080]  [SPEAKER_08]: um, offers and, okay, so they're best in class and our teams inside engineering and, um, operations aren't going to build or engineer it.
[01:11:58.520 --> 01:12:04.040]  [SPEAKER_08]: And in even what we said, I guess they won't even go so far as change the password in some cases.
[01:12:04.340 --> 01:12:27.660]  [SPEAKER_08]: Um, they just need to fix a gap in the internal knowledge as they're designing what is, as we pointed out, rightly, very complex, often very complex and disparate, both things, um, requiring something to keep a handle on, on a huge system, global systems.
[01:12:27.980 --> 01:12:31.300]  [SPEAKER_08]: But, um, and I'm not sure I have an answer in there either.
[01:12:32.220 --> 01:12:35.500]  [SPEAKER_04]: Um, caller, anything else that you wanted to tell us?
[01:12:36.240 --> 01:12:37.800]  [SPEAKER_02]: Yeah, no, that was, that was good.
[01:12:37.960 --> 01:12:42.560]  [SPEAKER_02]: I'm glad to hear you guys talk more about it just to, you know, you know, hear, hear it that way.
[01:12:42.720 --> 01:12:45.900]  [SPEAKER_02]: It does, it sounds like a totally impossible problem to solve.
[01:12:46.080 --> 01:12:47.640]  [SPEAKER_02]: And I'm sure we'll, we'll figure it out though.
[01:12:47.740 --> 01:12:52.100]  [SPEAKER_02]: So it'll be interesting to see, but yeah, thanks for, uh, let me keep that conversation going.
[01:12:52.260 --> 01:12:53.240]  [SPEAKER_04]: And thanks for bringing it up.
[01:12:53.400 --> 01:12:53.740]  [SPEAKER_02]: Great show.
[01:12:54.020 --> 01:12:55.020]  [SPEAKER_04]: And thanks for listening.
[01:12:55.180 --> 01:12:55.320]  [SPEAKER_02]: Great show.
[01:12:55.440 --> 01:12:57.240]  [SPEAKER_02]: And I'm happy to keep watching you online now.
[01:12:57.380 --> 01:12:57.900]  [SPEAKER_02]: So thanks.
[01:12:58.160 --> 01:12:58.460]  [SPEAKER_04]: All right.
[01:12:58.580 --> 01:12:59.020]  [SPEAKER_04]: You take care.
[01:13:00.840 --> 01:13:03.840]  [SPEAKER_08]: So yeah, it's, it's about thinking really carefully with...
[01:13:03.840 --> 01:13:05.360]  [SPEAKER_04]: He said, he said he was watching us.
[01:13:05.480 --> 01:13:06.540]  [SPEAKER_04]: He can't see us, can he?
[01:13:08.160 --> 01:13:08.960]  [SPEAKER_04]: Are we hacked?
[01:13:09.120 --> 01:13:09.740]  [SPEAKER_04]: Did he hack us?
[01:13:09.740 --> 01:13:11.460]  [SPEAKER_08]: Maybe, maybe he can't see us.
[01:13:13.080 --> 01:13:13.520]  [SPEAKER_08]: Wow.
[01:13:15.170 --> 01:13:16.740]  [SPEAKER_07]: Anybody watching the YouTube feed?
[01:13:18.300 --> 01:13:20.080]  [SPEAKER_08]: I think it's just fine.
[01:13:20.260 --> 01:13:22.180]  [SPEAKER_08]: I put a piece of tape over everything.
[01:13:22.520 --> 01:13:23.840]  [SPEAKER_08]: So we're, we're, we're just fine.
[01:13:23.980 --> 01:13:24.340]  [SPEAKER_08]: We're secure.
[01:13:24.360 --> 01:13:25.380]  [SPEAKER_04]: I ripped the camera out.
[01:13:25.540 --> 01:13:26.980]  [SPEAKER_08]: Oh, is that what you were doing with the drill?
[01:13:27.200 --> 01:13:27.200]  Yeah.
[01:13:27.200 --> 01:13:27.580]  [SPEAKER_04]: What do you think that was all?
[01:13:27.640 --> 01:13:27.800]  [SPEAKER_04]: Yeah.
[01:13:28.200 --> 01:13:29.480]  [SPEAKER_04]: That's all that noise was.
[01:13:29.720 --> 01:13:30.160]  [SPEAKER_08]: Okay.
[01:13:30.260 --> 01:13:31.140]  [SPEAKER_08]: That's an upgrade.
[01:13:31.820 --> 01:13:33.000]  [SPEAKER_08]: But I think it is.
[01:13:33.100 --> 01:13:42.220]  [SPEAKER_08]: A lot of this is like, it depends on how much resource, how many, how much resource you're willing to put into procurement.
[01:13:42.860 --> 01:13:50.500]  [SPEAKER_08]: And when you're building a system with off the shelf products and services, you need to think these things through.
[01:13:50.740 --> 01:14:04.800]  [SPEAKER_08]: And this would be, I think, a best in class off the shelf service that, you know, fit the bill, but had a high cost in failing, especially with lateral moves.
[01:14:05.000 --> 01:14:07.620]  [SPEAKER_08]: Consider this hack is probably old news.
[01:14:08.190 --> 01:14:19.160]  [SPEAKER_08]: Everything that you could have seen or gleaned as a consequence of it, though, those lateral and other effects, that's where people are probably looking right now.
[01:14:19.220 --> 01:14:19.600]  [SPEAKER_08]: Right, Alex?
[01:14:19.780 --> 01:14:21.380]  [SPEAKER_04]: By the way, we're going to try to take one more phone call.
[01:14:21.560 --> 01:14:23.420]  [SPEAKER_04]: 802-321-4225.
[01:14:24.100 --> 01:14:26.280]  [SPEAKER_04]: 802-321-HACK.
[01:14:26.440 --> 01:14:27.840]  [SPEAKER_04]: And that's going to be the last phone call.
[01:14:28.000 --> 01:14:30.340]  [SPEAKER_04]: And that's if we get another phone call.
[01:14:30.480 --> 01:14:31.580]  [SPEAKER_04]: 802-321-HACK.
[01:14:31.660 --> 01:14:32.280]  [SPEAKER_04]: Yes, go ahead, Alex.
[01:14:33.040 --> 01:14:36.280]  [SPEAKER_07]: Oh, I was just going to say, yeah, I think you're absolutely right there, Kyle.
[01:14:36.720 --> 01:14:37.320]  [SPEAKER_07]: So, yeah.
[01:14:37.580 --> 01:14:38.820]  [SPEAKER_07]: This one's going to be tricky.
[01:14:38.980 --> 01:14:42.780]  [SPEAKER_07]: But like the caller suggested, too, you know, this is a very, very difficult problem to solve.
[01:14:44.980 --> 01:14:48.080]  [SPEAKER_07]: But it's also, you know, it's an issue of third-party risk, right?
[01:14:48.180 --> 01:14:58.360]  [SPEAKER_07]: I mean, and how much risk are you taking on board from third parties that have access to your networks or develop network management software like this, right?
[01:14:58.500 --> 01:15:04.280]  [SPEAKER_07]: I mean, this is the type of risk that I think people have been undervaluing for a long time.
[01:15:04.500 --> 01:15:18.160]  [SPEAKER_07]: So now, you know, CISOs and GRC teams or governance risk compliance teams are going to be have to, are going to have to reevaluate all of the network monitoring and any kind of software that's going to have administrative rights within their networks.
[01:15:18.440 --> 01:15:34.920]  [SPEAKER_07]: And any company that's very similar to SolarWinds that develops this type of software that could be used or and abused is going to have to really redouble their efforts to ensure that their source code is not compromised, signed and sent out to all of their customers.
[01:15:35.600 --> 01:15:43.340]  [SPEAKER_07]: This is certainly also not the first time that we've seen compromises like this happen.
[01:15:43.680 --> 01:15:51.640]  [SPEAKER_07]: This also happened, and I don't have the details in front of me, but I want to say it was in Ukraine or it might have been Czech Republic.
[01:15:51.880 --> 01:16:07.580]  [SPEAKER_07]: It was some place in Eastern Europe that I think had to do with accounting software, where account, a specialized form of accounting software was compromised and dispersed to the client base through the updating process.
[01:16:07.820 --> 01:16:12.160]  [SPEAKER_07]: And I think we might have even talked about this, you know, maybe three or four years ago, perhaps.
[01:16:12.460 --> 01:16:17.200]  [SPEAKER_07]: But this sort of attack vector is not entirely new.
[01:16:17.420 --> 01:16:18.940]  [SPEAKER_07]: It's very innovative.
[01:16:19.420 --> 01:16:29.040]  [SPEAKER_07]: And to compromise a company like SolarWinds, this is a massive, massive coup, very different from some lesser used accounting software firm.
[01:16:29.160 --> 01:16:39.420]  [SPEAKER_07]: But maybe that was the proving ground several years ago for the threat actors and showing that as a proof of concept, the attack could be accomplished.
[01:16:39.840 --> 01:16:42.000]  [SPEAKER_04]: Well, there's a major motion picture here, I think.
[01:16:42.180 --> 01:16:46.420]  [SPEAKER_04]: It's a fascinating story and something that we'll be hearing about for years to come and seeing the effects of.
[01:16:46.560 --> 01:16:49.460]  [SPEAKER_04]: I just want to say we're going to be on another two minutes.
[01:16:49.600 --> 01:16:52.600]  [SPEAKER_04]: If somebody calls us in those two minutes, we'll take the call.
[01:16:52.600 --> 01:16:54.920]  [SPEAKER_04]: If not, we will sign off with two good calls.
[01:16:55.040 --> 01:16:55.800]  [SPEAKER_04]: I'm happy with that.
[01:16:56.380 --> 01:17:00.440]  [SPEAKER_04]: Again, the phone number, 802-321-4225.
[01:17:01.140 --> 01:17:03.040]  [SPEAKER_04]: Now, that's a Vermont area code.
[01:17:03.120 --> 01:17:04.320]  [SPEAKER_04]: We're not actually in Vermont.
[01:17:04.440 --> 01:17:06.320]  [SPEAKER_04]: We just thought that was a cool number to get.
[01:17:06.760 --> 01:17:08.040]  [SPEAKER_04]: It's a Google Voice number.
[01:17:08.200 --> 01:17:13.480]  [SPEAKER_04]: It forwards to a landline and the landline has one phone line attached to it.
[01:17:13.540 --> 01:17:14.260]  [SPEAKER_04]: It does not have call waiting.
[01:17:14.400 --> 01:17:17.100]  [SPEAKER_04]: So if you called it again, you would get a busy signal.
[01:17:17.220 --> 01:17:24.480]  [SPEAKER_04]: However, Google Voice decided nobody wants to hear a busy signal, so they insist on going to a voicemail message that we don't want.
[01:17:24.660 --> 01:17:28.440]  [SPEAKER_04]: So if you call when someone else is on the phone, that's what you'll get.
[01:17:28.780 --> 01:17:30.740]  [SPEAKER_04]: And you'll, you'll hear the anger in our voices.
[01:17:31.740 --> 01:17:34.280]  [SPEAKER_04]: 802-321-4225.
[01:17:34.960 --> 01:17:37.100]  [SPEAKER_04]: We could lose power at any moment, Kyle.
[01:17:37.280 --> 01:17:39.620]  [SPEAKER_04]: I realize I hear the wind howling outside.
[01:17:39.920 --> 01:17:42.380]  [SPEAKER_08]: And it's very Vermont-like out, I would imagine.
[01:17:42.480 --> 01:17:43.000]  [SPEAKER_04]: It is.
[01:17:43.120 --> 01:17:43.500]  [SPEAKER_04]: It is.
[01:17:43.580 --> 01:17:44.220]  [SPEAKER_04]: I like this.
[01:17:44.300 --> 01:17:46.200]  [SPEAKER_04]: I could live like this for the entire winter.
[01:17:47.140 --> 01:17:49.180]  [SPEAKER_04]: Alex, you lived in Vermont at one point.
[01:17:49.340 --> 01:17:50.580]  [SPEAKER_04]: I imagine this is bringing back some memories.
[01:17:51.400 --> 01:17:52.940]  [SPEAKER_07]: Yeah, it certainly does.
[01:17:53.980 --> 01:17:57.460]  [SPEAKER_07]: I mean, Vermont was like this, you know, pretty much almost every other day, right?
[01:17:57.500 --> 01:17:59.240]  [SPEAKER_07]: You'd have a massive snowstorm.
[01:17:59.520 --> 01:18:02.520]  [SPEAKER_07]: And I used to live, I lived in Vermont when I was in law school.
[01:18:02.680 --> 01:18:06.020]  [SPEAKER_07]: I used to live in Montpelier, which is smack in the middle of the state.
[01:18:06.160 --> 01:18:08.980]  [SPEAKER_07]: The law school was about 35 miles south.
[01:18:09.700 --> 01:18:12.120]  [SPEAKER_07]: So we'd have these massive snowstorms.
[01:18:12.240 --> 01:18:24.660]  [SPEAKER_07]: And I remember thinking, you know, the tragic irony of all of this was that I was driving an old 1992 geo-prism, which, you know, wasn't 1992 back when I was in law school.
[01:18:24.840 --> 01:18:34.660]  [SPEAKER_07]: But I would often get on the interstate and drive this kind of small car with sandbags in the back to lay it down before the interstate was plowed.
[01:18:34.860 --> 01:18:44.960]  [SPEAKER_07]: And so it was an incredibly dangerous 35-mile journey on unplowed interstate to get to my wills, trust, and estates class at 830 in the morning.
[01:18:45.100 --> 01:18:52.420]  [SPEAKER_07]: And I always thought it would have been, you know, terribly tragic and ironic if I had died on the way to my wills, trust, and estates class.
[01:18:52.740 --> 01:18:56.820]  [SPEAKER_07]: So that was sort of a reminder for me to slow down on the interstate.
[01:18:56.900 --> 01:19:02.740]  [SPEAKER_08]: Yes, only to be topped by you actually writing or signing your will while you're driving.
[01:19:03.680 --> 01:19:08.720]  [SPEAKER_04]: I think we all have stories of incredibly dangerous things that we used to do that we somehow lived through.
[01:19:08.760 --> 01:19:13.160]  [SPEAKER_04]: I remember I had a 66 Impala that had bald tires all around.
[01:19:13.320 --> 01:19:17.600]  [SPEAKER_04]: In fact, I got two flats at the same time, which was unheard of.
[01:19:17.780 --> 01:19:19.760]  [SPEAKER_04]: I remember also the same route.
[01:19:19.760 --> 01:19:26.020]  [SPEAKER_04]: I would ride my bike in the middle of the night with no lights or anything, and somehow I would make that.
[01:19:26.040 --> 01:19:27.440]  [SPEAKER_04]: That was before people wore helmets.
[01:19:27.620 --> 01:19:33.080]  [SPEAKER_04]: So yeah, there's a lot of finger crossing, and we're fortunate that we get through this.
[01:19:33.160 --> 01:19:37.840]  [SPEAKER_04]: But that doesn't mean that you listeners should be out there taking unnecessary risks.
[01:19:38.560 --> 01:19:40.280]  [SPEAKER_04]: It's blizzarding outside.
[01:19:40.280 --> 01:19:41.380]  [SPEAKER_04]: It's very cold.
[01:19:41.560 --> 01:19:42.040]  [SPEAKER_04]: There's a pandemic.
[01:19:42.180 --> 01:19:46.020]  [SPEAKER_04]: Although I have to say, you know, tomorrow or the next day, sleigh riding.
[01:19:46.020 --> 01:19:48.640]  [SPEAKER_04]: I mean, it seems like the perfect opportunity.
[01:19:49.020 --> 01:19:49.720]  [SPEAKER_04]: Socially distant.
[01:19:49.900 --> 01:19:50.660]  [SPEAKER_04]: You're bundled up.
[01:19:50.840 --> 01:19:52.220]  [SPEAKER_04]: You wear a mask.
[01:19:52.520 --> 01:19:53.740]  [SPEAKER_04]: You're not near other people.
[01:19:53.840 --> 01:19:54.440]  [SPEAKER_04]: You're outside.
[01:19:54.680 --> 01:19:56.060]  [SPEAKER_04]: Seems like a healthy thing to do.
[01:19:56.180 --> 01:19:58.780]  [SPEAKER_04]: And if I'm wrong, of course, Dr. Fauci will tell me.
[01:19:59.400 --> 01:20:01.140]  [SPEAKER_04]: But enjoy the weather.
[01:20:01.580 --> 01:20:02.880]  [SPEAKER_04]: Enjoy the winter.
[01:20:03.360 --> 01:20:04.960]  [SPEAKER_04]: Enjoy the uniqueness of it all.
[01:20:05.180 --> 01:20:08.500]  [SPEAKER_04]: Because these are times that we will remember for the rest of our lives.
[01:20:09.020 --> 01:20:10.340]  [SPEAKER_04]: Okay, I don't think we're getting another phone call.
[01:20:10.440 --> 01:20:12.340]  [SPEAKER_04]: So let's sign off for tonight.
[01:20:13.320 --> 01:20:14.520]  [SPEAKER_04]: We'll see you guys next week, eh?
[01:20:16.460 --> 01:20:17.320]  [SPEAKER_08]: So long night.
[01:20:18.280 --> 01:20:18.780]  [SPEAKER_04]: All right.
[01:20:19.880 --> 01:20:20.300]  [SPEAKER_04]: Stay dry.
[01:20:20.480 --> 01:20:20.820]  [SPEAKER_04]: Stay healthy.
[01:20:21.300 --> 01:20:21.780]  [SPEAKER_04]: Good night.