Lighthouse Phishing Kit Takedown, Zero Day Mysteries, and Measuring Cyber Attack Costs

So it's always interesting to see the state of play there and how people are trying to measure that. So all the things we're going to get to. Let's start with the the Google store. You mentioned Linds, you wrote about that they Google took down this the infrastructure for this lighthouse fishing as a service platform kit, however you want to phrase it. This is something that we've seen Google and probably more often Microsoft do in the, you know, the last 10 years or so.

I'd I'd say in using some sort of legal means to go after not just the threat actors themselves. A lot of times they don't even there aren't even threat actors named in some of these legal things. You know, it's, it's unknown actor ABC and D or something like that. And a lot of times they're in countries that it doesn't matter anyway because they're not ever going to come here. But I I have to confess, I'm not sure I knew about the Lighthouse fishing as a service platform. There's a million of those things out there and it's hard to keep track. But I don't think I was familiar with this one. It seemed like it was newer it it seemed like I did a little bit of research into kind of how the how it operated and kind of the developers behind it.

And I guess it's operated by Smishing Triad, which is this Chinese group that has been operating for a while. But then the this actual specific lighthouse fishing kit was only just announced by the developer of this group. I think it was back earlier this year. So sounds like it was first kind of publicized in like by silent push researcher found that the developer was kind of touting this, this kit and on on their Telegram channel.

And you know, the, the kit itself seems like, I mean, the developer was saying they have like 300 front desk staff worldwide to support it. And just, you know, all these all these weird figures that kind of go into the back end of it. So it makes you wonder kind of what's happening in terms of how cyber criminals are operating it. But I hadn't heard of Lighthouse either. And I kind of heard of Smishing Triad and passing. But it is interesting.

It sounds like it's kind of behind those texts that impersonate these popular brands. Like if you've heard of those EZ pass texts and USPS kind of scam texts. And. You know, I remember, I think it was earlier this year, we saw a lot of those, the texts that came through that were pretending to be EZ Pass. And Oh my God, yeah. Sure. You know, if you're anything like me, like your family and friends were kind of like texting about it, texting you about it probably and being like, is this legit? All the time.

Yeah. So I can only imagine like I, I know those are wildly successful for the scammers, those types of things, because they're, they're smishing, you know, they're SMS phishing, They're focused on consumers who probably don't really, you know, have a great sense of security. The Google post did give a little bit of kind of details around. They said Lighthouse has hit over 1,000,000 victims across 120 countries and help cyber criminals steal. This is a weird variation of numbers, but between 12.7 million and 115,000,000 credit cards of the USI was like that's a weird range but.

That's that's a pretty broad range of money, yeah. Yeah, did a double take at that one. But regardless, it seems like there is a kind of it's a highly lucrative business right now for kind of the people that are operating this and so. You know. Google came out and they're they're kind of seeking or were seeking at the time to dismantle the core infrastructure behind this, this operation. And I think they cited like the Rico Act, which you know is kind of behind criminal enterprises and wire fraud and all that. And then the LAN, the Lanham Act, which is trademark infringement, and then finally CFAA. So like it was interesting to see like the kind of legal routes that they were taking to get those court orders. And I think they also sued, you know, specifically sued specific individuals as well.

Oh yeah, they do that sometimes. It's interesting. I'm always like we've seen, I don't know if you've ever seen this, but there's some interesting like you can find these videos or posts sometimes of when Microsoft or even the Department of Justice, like when these indictments come down against like Chinese or Russian cyber criminals. You can see them like celebrating, like their colleagues, like, you know, like throwing them a party. Like they've done something like they're like, they've achieved some extra level of like, you know, proficiency or notoriety.

Like, hey, good job, you did it. Microsoft sued you like like a. Badge of success. Oh. Geez. Kind of amazing, but those SMS phishing scams that you just described are so prevalent. I haven't gotten a ton of the EZ Pass ones in a while, but those were about a year ago. They started like last fall and then through the spring and summer I was getting like 3-4, five of those a day in some cases, you know, and they were all pretty relatively targeted. They would all, you know, come from the state that we live in. They were pretty, you know, believable, pretty, pretty credible.

And I know that some of my former colleagues at Census did a bunch of research into the infrastructure behind those scams and a lot of them, I'll have to, excuse me, I'll have to find it, I'll put it in the show notes. But there's some pretty interesting research on on how those people are, are doing this. Or like SIM farms set up overseas, you know, that are just, they switch the numbers every couple seconds that they, you know, use one number to send out a few dozen or 100 texts, kill that SIM switch to another, that whole thing.

And a lot of them are connected to these sort of human trafficking organizations too, where people are lured into these work from home or those type of types of jobs in, you know, Indonesia, other places like that. And they end up being essentially like, you know, I don't know what the right word for it is, but they're they're almost imprisoned doing this kind of work. And we've seen some disruptions from the authorities in some of these countries, But it's really, really hard to track these people down and do anything about it, especially when there might be government corruption involved or things like that. But it also like just sounds like the plot of the Beekeeper where like, you know, it's just like this legal corporation with with help desk people and customer service and, you know, nobody gives a shit until Jason Statham goes and burns it down. Spoiler alert for Beekeeper.

Sorry. That's that that is like absolutely crazy that that's happening behind the scenes. And also like, you know, it's, it's an interesting angle in all of this because when you think about what Google is trying to do and how effective these disruptions are, like if you have that, you know, even if they're kind of targeting certain things like the infrastructure, like domains or things like that. Like if you have this level of organized crime behind the scenes for these types of scams, like, you know, you have people working on it 24/7, like they're, they're going to be hyper focused on how to pivot, how to switch. They're probably going to be a little bit ahead of the game in terms of, you know, if they're if their core infrastructure does come down.

So you. Know, no question. Yeah. Yeah. I mean, it's always great to see Google or Microsoft or whoever else doing this, taking this kind of action. But as you said it, I don't know how much of a lasting effect it has because they do have these are, you know, semi, well, not even semi. They're professional operations with a good amount of money and personnel behind them.

A lot of those, a lot of that personnel is not, not there voluntarily, but they do have the ability to move off of compromised or, or, you know, exposed infrastructure very quickly and move to they, they just have, you know, they can go to another bulletproof hosting service. They can do whatever they need to do. They can get another 3000 SIM cards and keep going. It's not that difficult for them. And the, the money involved compared to the amount of effort that they expend is crazy. You know, it doesn't take a lot of successful, you know, targeting to make this profitable, especially when the the labor is essentially free because you're not paying these people.

Yeah. The other thing that I was thinking of when you were talking about kind of getting that spurt of scam messages is like, you know, it seems like it's died down. Like anecdotally, like I haven't heard people talking about it as much. Like what it does that mean that, you know, the the people behind this operation are now like targeting other parts of the world or maybe like doing other things so. That would be my guess, honestly, yes, they might.

It might be somewhat geographic in, in that I know that anecdotally and from the the research that I mentioned before, they like this all began with targeting essentially of the East Coast of the US. It was like Florida, New England, Pennsylvania, New York. Those are the states I'm talking about the the toll fraud one or the EZ pass toll scam text, because those are states with large populations that do have toll roads and you know, they're relatively it would be an easier, not easy. It would be a logical place to, to start because you have a whole bunch of potential victims that all, you know, if you travel on 95 anywhere on the East Coast of the United States, you're, you're on a toll road essentially. So if you, you know, if you

drive up and down Florida or through Massachusetts or whatever, you're, you need an easy pass or whatever it's called in your state. So it's a, it's a clever idea. I don't know if they've moved on to other parts of the country, so we're not hearing about it as much or other countries. But I don't know how like I don't know that toll, you know, easy pass things exist in other countries. I truly don't know. They probably do. But you know, here in Massachusetts, it's, you know, the Mass Pike or some of the other roads, you know, Yeah, it's it's perfectly logical. And the first few times I saw those I was like wait a second I know that I have these auto build but at the same time. Yeah.

Did one of my kid like, you know, it. It gives you enough pause that it's a. It's a clever scheme. Yeah. No, it definitely is. I mean, I clearly like the numbers speak for themselves that they're that this is working for them, so. If it's enough for Google to spend legal resources on this, then yeah, it yeah, it matters. They've got plenty of other things to do, I would imagine. Yeah, and it is interesting. So I know you mentioned before Microsoft had done a few of these legal actions as well.

And I think it was like earlier this fall they did the Microsoft or sorry Raccoons 5, like they got a court order against that fishing kit. So it's interesting that they, you know, like there's kind of this targeting of phishing kits specifically, which makes sense by the by these tech companies. But like when you look at the other takedown that happened this week, which was the third Phase, I think, or the latest phase of operation end game focusing war on kind of info Steelers and and malware. Just like the the different tactics that different entities are taking as they focus in on kind of different parts of the cyber criminal ecosystem.

Because obviously in info stealer and what it the severity of it and what where it fits into the cyber criminal ecosystem is very different from kind of fishing kits, even though similarities in both cases. So I thought that one was was interesting too and it was good to see Operation End Game come back. I know they've previously, it's kind of an ongoing thing. Yeah, it's like a it's like an annual event that Europol does like it's really, it's interesting that I think that.

Yeah. Did you say the third? Is this the third version of it at least? Right. They had one earlier this year and that was when they did I think they took down previously. They took down like Dana bot like follow me like all these these pretty big well known iced ID. Yeah. Steelers. Iced ID? That's a throwback. Yeah. Man, that's one of those ones that just pops up every once in a while and you're like, wait a second, come on, you know? I remember we talked about that one on on the podcast after they took that one.

Down we did. The thing about that I like about this specific law enforcement operation is that they seem very strategic and what they're focusing in on within the ecosystem. I mean, these are like if you look at like info Steelers or loaders like these are things that eventually lead to other more severe deployments of ransomware or maybe. Malware like. That so cutting kind of doing the kneecap and like the middle level, I think is really smart. And the other thing I like is that they're not just taking down, they're not just disrupting servers. Like it seems like they made an arrest in Greece of I think it was the venom rat, something linked to allegedly venom rat. They seized 20 domains.

Like that's fine. They, yeah, disrupted some servers. But like, for me, like the arrests are really like getting to the heart of a lot of this activity because it all comes down to the people behind it, so. Yeah, it's, you're right. The domains and the servers are, it's all nice, but like we said before, that kind of stuff is so ephemeral and so easy to switch. It doesn't matter at all. It's nice to put in a press release and all that, that they serve, you know, they, they seized like 1025 servers or whatever it happened to be in this case. And it, it's great.

I don't want to, I'm not making light of that, but the people are the thing and you know, they're obviously there's always going to be other people to sort of like slide in and take their place because there's so much money involved. If you've ever seen any of those like extremely upsetting and annoying videos that like some of our researcher friends will post every once in a while of like, we know who this ransomware actor is. And they show them like sitting on a yacht, you know, off of Santorini, like literally in a hot tub full of like EUR or something with you're just like, what in the hell? And they're like, yeah, this is that guy from this ransomware gang.

We know who he is. We know where he is. Like we've been, we have ways of tracking him or whatever. And they're some of them are not shy. They have like public Instagram accounts with like thousands of followers that are like, yeah, bro, looking great, you know, nice Lamborghini or whatever. You're just like, Oh my God. You know, the, the money is there obviously, especially for the ransomware gangs, you know, the, the toll fishing scams, that's that's a lower level down. They're all somewhat connected. But the ransomware gangs, that kind of money is just all it takes is 1 big hit or maybe 2 if you're smart, you can go live on the damn yacht in Santorini and be like, see you guys, I'm retired now peace out.

But you know, most of them don't, obviously because you know greed is contagious. But I don't recommend going to watch those videos because you'll get so mad. Yeah, I know that's where it's tough because it's like you have the safe harbor countries, you know, makes it hard. But I will say, like looking at some of these law enforcement operations, it seems like there's the list of countries that where they're coordinating together and working with law enforcement seems to be ticking up every time I.

Get. It and you know, I think that it's we're the other thing is kind of the private sector partners also is always fun to look at and so that's. Yeah, there's a lot of. Places they can vacation. They're becoming increasingly limited in their yachts. Yeah, there is a ton of collaboration. I almost said that's not the right word, collaboration between all these, not just vendors.

You know, we often see Crowd Strike and Mandiant and Microsoft and and others involved in these, but also sort of the research collectives like, you know, Shadow Server or other organizations like that. Have I been poned? Which is, you know, Troy Hunt's thing that are contribute to these, you know, in a in a lot of cases it's data and connecting certain things to certain other things that that kind of that kind of work. It's not the law enforcement work itself, but all of that matters.

It's all the kind of stuff that goes on behind the scenes before somebody goes in and kicks down a door and, you know, Romania or wherever. Yeah, yeah. And I love to see that because like if you look at all the different companies that are on, on the operation end game thing, like you mentioned, like shadow server, have they been poned like bit defender, all of those guys, like they all have different levels of visibility. And it's like, but they also all have kind of gaps in what they're able to find and see. And so like putting together all of these different critical, like threat Intel pieces from different people, it's just really cool to like companies come together with law enforcement like that and, and, you know, help to kind of track down these these people so. This is the best version of the public private partnership thing that, you know, our government is always talking about and you know, sometimes works and often times doesn't for various reasons because our government isn't working or maybe they're working today.

I think they might have just started, but you know, Congrats everyone. But this is the best version of that where all the private sector research organization, not all but a bunch get together. They all have a common goal. They have a common target and they put their expertise to work and you know that you see this end result. But yeah, it's, it's great to see that stuff. So the other story I wanted to get to was this research report by Amazon threat Intelligence about two separate 0 days. One was in Cisco ISE and another was in a Citrix product that Amazon happened to happened to is not the right phrasing, but they found an APT targeting these two vulnerabilities earlier this year, quite a bit earlier this year, I think. I don't remember exactly which which month, but it was several months ago where they actually discovered these vulnerabilities and saw the targeting well

before they were ever publicly disclosed or even had CVE identifiers. And Amazon doesn't name the APT or even give any like vague attribution. It doesn't even say, you know, geographic part of the world. It doesn't say anything like that or any of their any operations, any previous operations that they might be connected to. It's, it's very vague, I'm sure intentionally. But the interesting thing is not just that these were both being targeted before they were public, but Amazon says in their report that in this, this is obviously true, that there are two possibilities here.

One, this group, whoever they are, is doing original vulnerability research and found these two vulnerabilities in these two products, developed exploits and then went on their merry way. The other possibility, which is one that me and our friend Ryan and a few other conspiracy idiots like to talk about, is that they might have access to non public vulnerability data from another source. In this case that would make me think because this is two different companies. It's not 2 vulnerabilities from one company's products. It's two separate companies that would, you know, lead you down the path of that would be some sort of CVE database that they, but both of those companies are CVE authorities, I believe. I know Cisco is, I'm pretty sure that Citrix probably is. So they would have separate CVE,

you know, private CVE databases. It's fun to not fun, but it's interesting to go down that path and think how would this threat actor have gotten access to private, you know, pre disclosure vulnerability information that seems unlikely to be in this case. I think it was just something that, you know, Amazon's threat Intel team put in there. As you know, here's something that may have happened. It's something that researchers and other people in the industry have been talking about for as long as there have been bug databases. But it seems more likely to me that whoever this group is is doing original phone research or paying people to do it or buying these bugs from some third party on the on the black market, which is, you know, you know, something we know happens all the time.

Yeah, Yeah. When when you talk about those two options, like what I always think about is like what is going to be the least heavy lift for threat actors and what's going to be most lucrative for them. So like of those two options, like it seems like like with with no obvious knowledge of like what's actually going on behind the scenes here. But like, I, I think I would agree with you that, you know, that's probably it. But like I think you bring up a good point, which is that, you know, if if that was, if such a database did exist, like I think it, you know, it is interesting that there were kind of two unique 0 days here that were, yeah.

Yeah. I mean, we know that those bug databases are very attractive targets for threat actors. We know that there have been some compromises in private bug databases over the years. I'm sure there have been more that we don't know about their obvious targets. But it it seems much more likely is in I think you describe it exactly, right. What's the path of least resistance for these guys? It's spending money to have somebody else do their work for them, right?

You pay somebody who's already done the exploit research or you pay somebody to go do it. Because either you have a specific target that you know is running one or both of these vulnerable or one or both of these products and you want to see if there you can find a bug in them in order to get access. Or you have an idea for a large scale campaign and you're like, what are some large, you know, widely deployed products that, you know, historically, you know, we could probably find bugs in that seems like the more likely scenario to me.

Yeah. And then what I also was looking, so what's the, what was some of the post exploitation activity that Amazon was describing? It's interesting they didn't, so they dropped a custom back door into the compromised environments that they had never seen that Amazon had not seen before and couldn't find any other references to either. You know, it's, it's a relative, not not run of the bill, but it it has capabilities that you would expect in a in a back door.

You know, it runs in memory. It has all these evasion techniques stuff that you would, but it was custom. It was not off the shelf. It was not something that was known. So I don't, I'm wondering if given that the original vulnerability research part of this and the fact that Amazon didn't give any clues whatsoever as to the identity or even a vague attribution of this group, it's pretty intriguing to me. That was the thing that really caught my interest was the combination of those factors.

And I don't know if this is some new emerging group or, you know, an offshoot of some, you know, Russian or North Korean group or, and we don't know. But I, I don't think I'd have to go back and look. But I don't think they gave any real demographics of the victimology either. I don't think they said, you know, there were, we found 12 victims in the US and one in Germany or one in Brazil. I don't think they said any of that. So they're keeping their cards close to the vest, which is, you know, an interesting thing. I would imagine, as is often the case, that there's a private version of this report that has more information in it, you know, that the research community might have access to. But.

Yeah, that would make sense. I mean the, it seems like it was pretty tailored to the like that the group had done like some research obviously on kind of what they're who they're targeting. And you know, you mentioned the back door, the bespoke back door, and it was specifically tailored for those, for the Cisco ISC environment. So it's, yeah, it seems like they have like a fair amount of knowledge of the different things that they're looking to target. Yeah. Well, that's the thing. It's not just the development of or going to find a vulnerability, which, you know, there are many thousands of people that have that ability, but then the ability to write an exploit for it and write a custom back door as an implant for the compromised target is, you know, 2 if not 3 interesting skill sets.

You know, the, the people that write malware aren't often the same people that are doing vulnerability research. You know, sometimes those skills overlap and you know, there are people who can do both, obviously, but they're often a kind of division of Labor there. You know, the the folks that are doing original vulnerability research are then handing that off to somebody to write an exploit for it. That person is then handing that off to somebody to say, here's the environment. What can you give us that'll give us persistence on this machine?

Yeah, Yeah. That's kind of why I wish that we knew more about the victimology. I mean, obviously it's going to be a high value target for for this level of kind of coordination and understanding. But it seems like this was a pretty unique incident. Yeah. Set of incidents, yeah. I'd like to. I definitely hope there's some follow up information from Amazon about this or somebody else. You know, if Crowd Strike or Sentinel One or somebody else picks up the ball and and runs with it and find something else along these lines, I'd be really interested to see what else is out there.

Yeah. But one other thing, too, that's kind of interesting is that the way they discovered this was through their honeypot service. Like, yeah, I think that's kind of funny Just, you know, based on, like, the level that these threat actors tried to, you know, go down and then, you know, getting nabbed by honeypot. Yeah, which I believe is called Madpot. Is that what it's called? Yeah. Love it I. Love it. Yeah, it's great. Crazy, crazy honeypot name.

Yeah. It sounds like something I would order at a restaurant and then, like, regret it an hour and a half later. Yeah, definitely. All right, So before we go, I wanted to ask you about the the story that I mentioned that you were working on about the financial effects of cyberattacks and you use the recent Marks and Spencer intrusion from the summer. Was that what it was? Yeah, as as a hook, which I I love. That was it's, you know, it was a massive deal in the UK. It's like that was in the news every single day in in the general press to not in just in the tech press. It was, I mean, it got some press here as well, but I think most people were like, I don't know what Marks and Spencer is, is that, you know, it sounds like some club in London that I don't care about, but it was, I like the idea of using that and then going to talk to some smart people and be like, what are the actual like?

You can, as you did, you can look at the financial reports and see a quantitative thing of like our profits went from this to this and we're attributing X percentage of that to this intrusion. That's, you know, you can look at that in black and white and see it, but there's so many other downstream and long term effects that are not as easy to measure, which, you know, I, I thought was a you did, you brought out really well in the piece.

Yeah, yeah, it was interesting. So like, and this is a discussion that's been going on forever in the industry, but like looking at the Marks and Spencer financial reports, you know, they, they talked about like this, you know, pretty big jarring, like one off impact from the incident, but then they're like, they were pretty bullish about kind of being back on track and covered by the financial year end. So I thought, you know, that that was interesting.

It's like, how quickly are companies recovering and like what factors go into that and what aren't we seeing behind the scenes? And I also looked at like financial reports by United Health, which is the parent company of Change Change Change Healthcare, which as you remember last year was like that huge. Grand. That was really all-encompassing as well as solar winds, which I thought was kind of funny because they are still kind of, you can still see like the remnants of like the SolarWinds Orion attack from like what, four years ago. 5 S. Five, I think, yeah.

Yeah, which, you know, it's, it's funny to look back on and I, I actually wish I'd gone back to like some of the older. I think I'm going to go back and like look at some financial reports from like older attacks as well. But like, it's just like, you know, there's, there's always discussion around like brand damage and you know, brand reputation damage. But then you think about like, what about stocks? Like what about cyber insurance? Like what about the variables like the size of the company or like the sector that it's in or the type of attack, the severity and like downtime that comes with it.

So I think there's, it's really hard to measure, but I think it's like something, you know, based on the people I was talking to, it's something that's really important to know because it adds a lot of understanding and context in those discussions around like security risk and, you know, trying to, you know, talk about budget and resources in the boardroom and like lend more context around those types of discussions. Yeah, I thought that was an important part of it too. Especially if you ever have a conversation with the CSO or CTO and they're try and ask them about the process of going to get budget for some security product that they want or service or something along those lines. And the board or their boss saying, well, show me how this is going to contribute to the bottom line. How is this going to save us money or how is this going to make us money?

And they're like, well, it's not like I can't because it's a preventative measure that hopefully will prevent bad things from happening, but I can't show you how bad that bad thing is because it hasn't happened. You know, like, it's like trying to explain how a vaccine works and like, well, I've never been sick. Like, why would I need a vaccine? I, like, demonstrably haven't had COVID, so why would I need?

OK, I can't have that conversation with you. Thank you for your time. Like there's just, it's really difficult and I, you know, we both know people that have banged their heads against the boardroom door with these kind of conversations. So trying to quantify those intangible things like brand reputation loss or honestly the stress on the personnel involved in this, in those kind of especially big time, very public incidents like the Marks and Spencer 1 you wrote about. Go and talk to the IR folks or any of the people that are working around the clock for 10 days or three weeks or something like that, responding to those.

It's like real legitimate PTSD that they have after those things. Like they, they discuss it in the ways like you can't compare it to, you know, combat or something like that. But the stress and the toll it takes on the is a real thing. And there's no way to to honestly quantify that. You know, we know people that have quit the business because they're like, I, I just can't do that for the rest of my career. There's no way. Yeah. I know it's so it is interesting. And like I think you also point out too, like the preventative controls, like there, there's two different parts there. And this is something that I was talking to Ed Bellis with Empirical Security and he, this is how he said that he views it. But there's like the detection and response side of it. But then there's also the, as you say, preventative and like control side of it, which is more proactive, I guess. And like, you know, it was funny because I from my perspective, like we have all this public data about more of those tangible things like financial

reports that I was looking at. But then when you look at more of the preventative stuff like that's it's so unique based on the organization. And it's also really, really hard, like you're saying to put into kind of quantifiable risk. And I know Ed was talking about like basically like the, the best way to do it is really to kind of map different business processes and financial functions of the business to be able to do that. But it you really have to understand like the organization and you really have to get into the weeds and like know the, the different functions and how downtime will, you know, have an impact on different areas.

So like, it seems very complex to do and. The other thing is I think you just point to like a great issue with security overall, which is like you're not going to be able to like like the cyber security industry is trying to solve an issue that for a lot of businesses like they don't even like under fully understand like the the potential of what could happen. So, and I think that this topic is like a pretty good way to, you know, understand how that works. Yeah, I, I completely agree.

Like, you know, smart guys like Ed and Wade Baker, who you also spoke to for the piece, have been trying to figure this out and lots of other people have too for two decades. You know, Wade was involved with the the origins of the Verizon DBIR, so understand this on a very deep level. But even for folks like that, at some point they just kind of shrug and they're like, yeah, I don't know. You just kind of got to understand that bad things can happen and you have to, you know, spend money to try and prevent those things from happening.

Yeah, yeah. But I have to say both those guys are like doing the doing the good work because I like is just so critical in this industry, like having that data. And like, and I say that as someone who's worked as a cybersecurity reporter, who's like, you know, like I, I feel like there is a bit in the media, there's a lot of reliance on reports about the data behind it and there's a lot of reliance on anecdotes and like these types of things.

So having that data for me is just so, so important, I think for for the security landscape. And hopefully, like, you know, as we go forward, there's going to be more, more data that we can kind of, I mean, it seems like there's an overload of data right now. There's so much, yeah. But yeah, I mean, Ed and wait, they're doing God's work, like digging through all that all that shit and, you know, coming up with comprehensive, you know, understandable reports that can give people fodder to say here's why this is important.

Here's what the bad results could be if if we're not doing AB and C. So yeah, you know, I thought it was great. Good job. Nothing. You need me to tell you to write. Yeah. Yeah, it's fun. Yeah. OK. Any animal updates? How are how are things at the at the house? Everything good Weld. An exterminator. So oh. OK, Have they come? They're actually coming today, so I hope that I have. All right. Yeah. Things were quiet and then things got a little noisy again last night, so I'm putting my foot down here.

This is Yeah, we're, we're getting rid of these critters. You got, yeah, at some point. I'm, I'm sorry, everybody, those things need to like end up in a glue trap or whatever. They're not going out to the farm like the, you know, your childhood dog like they need to. They got to go. Yeah, no, we're we're done with animals here. But hopefully we don't have any more animal updates after. This uninvited animals. Yeah. Yeah, Yeah. Well, that's good news. OK. Well, hopefully that that works out. I know.

Well, that was a fun storyline for a month or so. Not so fun for you, but yeah. Yeah, as long as I like, don't have bats, knock on wood, but like. You don't want them. Yeah, I'm. I'm done. I'm done. You don't want them. Now The funny thing is like I think the last podcast we did together was like 2 weeks ago, right after that, like a a couple of hours later, I heard a mouse like running around in the basement where my office is.

And I was like, of course, yeah, that makes sense. So I got like I'm. Starting to like, talk like other people By talking to me, you're kidding. This is just a normal, you know, household mice, you know, not a not a kangaroo rat or whatever the hell else was going on in your house. Right my my husband has a new theory that it's a vole. Oh, OK. We there are voles in our neighborhood.

We have had them in our yard. That is not what that is. You don't think it? Is not that picture that you sent me a couple weeks ago. I and also voles are kind of well, the ones I've seen are like relatively big, like they're bigger than a mouse and these. Were big. OK. They were big, but they, yeah, it didn't really have like based on the picture I saw, it didn't have like the tail that with the fur on it, but it did have, it was like kind of like circular, like a vole. So body shape.

Also you would know like you would see Voltrax in your lawn, like they dig tunnels, like like right under the surface of the grass you would see that. Interesting. That's how you know, Yeah, which we've had to deal with those outside. I've never seen one in our house, which is good, but there's good ways to murder them outside. But if if it comes to that in the spring, I'll let you know. Yeah, well, I'll keep you posted on the Exterminator. OK, good, great.

Help me please. High point. All right, Well, great to see you have a good weekend. Good luck with the exterminator. Thanks. Yeah. Thanks, Dennis. All right. See ya. While you were happy with the planet, I was trying to decide for what it meant, even if I couldn't understand it.