Dumping Edge Security Devices, the SystemBC Botnet, and the Joy of Joybubbles

As you know, there's been plenty of vulnerabilities disclosed in these devices over the last few years. And one of the big issues with these devices is that a lot of organizations don't always update them. And also the when they go out of service or reach the end of their their sort of supported life and the vendor stops supporting them and issuing software patches for them, then you have an even bigger problem because there is no way to update them. So they become really dangerous parts of your network. So this week, SIS issued this binding operational directive to all of the civilian executive branch agencies, essentially saying you need to get these devices off your network. And here's what they said in I'm just going to read a little bit from the directive itself says the imminent threat of exploitation to agency

information systems running end of support edge devices is substantial and constant, resulting in a significant threat to federal property. CISA is aware of widespread exploitation campaigns by advanced threat actors targeting end of support edge devices. Recent public reports of campaigns targeting certain vendors highlight actors attempts to use these devices as a means to pivot into federal civilian executive Branch Information system networks.

Now, that's a lot of words that essentially tell you get these things off your network. There's a bunch of language and time frames in the in the directive itself. There's, you know, sort of a rolling sunset period for these depending on how old the device is, what the support is and those sorts of things. But the general gist is get these things the hell off your network or you are going to be in trouble. Now, as I said, this only really applies to government, federal government agencies here in the US, but this is good advice for everybody.

If you if your organization is running an out of support edge device, that thing is not only not doing you any good, it's a liability on your network. It's literally just a way in for threat actors. As we've talked about many times in this podcast, we know it's not simple or easy to even update these things all the time.

And so taking them out of service and replacing them is also not a simple task. That's why there's these kind of rolling deadlines in the directive and even for enterprises with, you know, large security budgets and mature security teams that know how to do these things, it's not a simple thing. It's not something you do over the weekend. You know, there's a lot of moving parts and things to consider when you're doing this, but it's something that needs to be addressed. And the issue of critical vulnerabilities in these devices has, it's been there for quite a long time, but it seems to have been snowballing in the last like year or two.

If you go back and look at the number of critical or even serious RCE vulnerabilities or authentication bypasses or things like that, that have been disclosed either by the vendors themselves or researchers or used to 0 days in even just the large device manufacturers saying just pick a time frame, pick 2436 months, you would be overwhelmed by the number of bugs that are there. So you know, the best time to have replaced these devices is yesterday.

The next best time is now. So you know, if you haven't developed a plan to get these end of support devices off your network, if you have them, now is the time. So you know, threat actors are constantly scanning for these things. There's plenty of and day vulnerabilities in them, as I mentioned, at their disposal. They do not need 0 days. They do not need a ton of skill to get to find these things and exploit them.

So there's plenty of runway there for them. Just get them, get them out of there if you can. Another story I wanted to mention this week is some research from the team at Silent Push who looked at the system BC botnet, which is not one of the, you know, hugely famous bot Nets. It's not Mirai, but it's one that's been around for quite a while. And it was actually one that was disrupted to a certain extent by Europol's Operation End Game in 2024, I believe it was.

Operation End Game is one of those things that it's kind of an annual event where I don't know if an event is the right word, but occurrence where Europol and a bunch of other law enforcement agencies around the world sort of go after a bunch of cybercrime operations. And the this system BC botnet was one of those and they disrupted a bunch of its infrastructure. But there's a new variant that the silent push researchers discovered. It's written in Perl and it targets Linux systems and it's got a bunch of interesting capabilities.

It acts as a proxy and a back door. So it's not something that you want on your net network, obviously. And as I said this, this botnet has been around for a few years. So it's I'd encourage you to go read the story so you can get a handle on the the scope and the scale of this. Silent Push said they found more than 10,000 unique infected machines worldwide. And the biggest chunks of those were in the US, followed by Germany, France, Singapore and India.

So it's not a small one, but it's not the biggest one as I mentioned, but it's big enough to draw attention. And some of those infected IP addresses were government owned machines in foreign countries, so such as Vietnam and Burkina Faso. I hope I pronounced that correctly. I don't think I've ever actually heard it said out loud. But that's something that I think folks should go and have a look at because bot Nets are, you know, one of the oldest threats on the Internet and they're a constant threat. But I feel like they sometimes fade into the background when we are talking about the threat landscape just because there's so many other things to consider these days, You know, like bugs in edge security devices that are, you know, a major threat or anything like that, or the malware landscape or AP TS or whatever the case may be.

There's plenty of threats out there. So I feel like bot Nets are kind of the forgotten elderly uncle in the threat landscape, but they're still there and they can do damage, not just DDoS attacks, which is kind of was there bread and butter for a very long time. But now they're used for all kinds of things, you know, malware delivery networks, cyber espionage, all kinds of stuff. So go and have a look at that story. It's pretty interesting. And the the third story I wanted to get to this week is a story that I wrote about a documentary that actually premiered at the Sundance Film Festival last week. And it's called Joy Bubbles, which is probably not a title of a movie that I would have necessarily like lined up to see.

But I became aware of this. I think it was my friend Chris Weisopol who posted something about it on Twitter in blue sky a few weeks ago and said, hey, this looks really interesting. It's kind of a hacker history movie. So I went and looked it up and it tells the story of a guy named Joe Ingresia Junior, who was born blind and had a pretty troubled childhood and adolescence and eventually discovered, I guess not eventually, but when he was growing up, he discovered that he, he was born with perfect pitch. So he was one of the folks that could, during the analog phone network era, could whistle down the phone line and essentially control the phone network how however he wanted. He could bend it to its will.

Because if you're not familiar with the way that those old networks worked, you know, they relied on physical switches that were housed in massive buildings that you can probably still find in your in the big city near you. And one of the ways that they operated was they used supervisory tones. And different tones essentially were different commands for the switches. And Ingressia figured out that he figured out those tones and he figured out that he can mimic them perfectly and not just get free long distance calls, which is sort of the the thing that a lot of phone freakers did once they figured this thing out.

But he could also just call anyone around the world and talk to them or connect to anyone he wanted to, which was kind of a huge deal for someone who was born blind and didn't have a lot of social life and didn't have a lot of social interaction with other folks. So the phone kind of became his lifeline and it in the doc, this documentary, which is called Joy Bubbles, which is a moniker that Ingresia actually legally changed his name to Joy Bubbles later in his life.

This documentary is directed by a woman named Rachel Morrison. And it's absolutely fascinating. I wrote not a movie review, but kind of a, a, a description, I guess, or an appreciation of the movie that's up on the site now. And if you're interested at all in hacker history, especially kind of the prehistory of where the hacker scene came from and how it developed in part out of the phone freaking scene of the 60s and 70s before computers became widely available, I'd really encourage you to not just read the piece. I'd love it if you wrote the piece. Read the piece, but find this movie when you can. It's it's not available for wide release yet. It's playing other film festivals, and I assume it'll be in some theaters and then on a streamer at some point. But it's such a great depiction of the innate curiosity and joy of discovery that not just Joy

Bubbles himself has, but a lot of hackers that I know and other people, you know, other people listening to this probably know that drove them to get into this hacking slash infosec world in the 1st place. You know, they wanted to figure out how these devices worked, how they could make them do things that maybe they weren't supposed to do, how they broke, what happened when they broke, all that kind of stuff.

And it's it's just a fascinating, fascinating portrait of a person, but also sort of historical document of how this scene developed in the 60s and 70s. You know, Steve Wozniak is in this documentary. There's a few other folks that, you know, you might recognize in the documentary as well. You know, it uses archival audio from Joy Bubbles. He he died in 2007, but they have archival audio of him and interviews with his friends that are really, really fascinating. So I'd really encourage you to go and check out the piece as well as the documentary itself.

And if you're a fan of hacker movies like I am, Sneakers is my favorite. It's one of my favorite movies of all time. In fact, we did a hacker movie episode on that earlier, you know, a few months ago. Me and Daniel Cuthbert, the character of Whistler in Sneakers who is also blind, the character played by David Strathairn, is loosely semi based on Joy Bubbles. They're both blind. They both, you don't in sneakers, really see Whistler doing the kind of freaking that, you know, Joy Bubbles did and other phone Freakers did.

But you do get the sense that, you know, you see the scene where he's having Robert Redford's character describe what the car ride sounded like when he was trapped in the trunk. And Whistler is sort of like figuring her out, figuring out the sounds and, oh, you were going over a bridge. How far apart were these sounds? Oh, that's this bridge because the joints are this far apart or the seams are this far apart. So that character of Whistler is, you know, loosely based on Joy Bubbles.

So there's a connection there. But I can't say enough about how much I enjoyed this movie. I only got to watch it once just because that's the way that Sundance works. But I would have loved to to watch it multiple times just so I could have gotten an even better appreciation for it. But I can't recommend it enough. So if you have a way to go find that at a Film Festival when it's playing near you, I'd encourage you to or you, you know, just wait until it hits theaters or streamer and and check it out.

So that's it for this week. I hope everyone has a great weekend and we'll talk to you next week. Thanks.