React2Shell, Typhoon Attacks, and Why Our Infrastructure is So Vulnerable

So a few days, but very quick turn around between initial disclosure and public disclosure and fixed versions and all that kind of thing. But the bug itself is obviously very serious and the two vulnerable libraries are extremely widely deployed. These things are everywhere, especially React. You know, it's in like 40 or 50% of apps. It's it's all over the place. And we were just talking before we started recording, I was looking at some of the stats on how many people have updated so far and they're not good. It's the, the numbers are very low. The percentage of people that have been able to to update the their apps to fix versions of the library is not great right now, which you know, after 48 hours isn't shocking. But given the nature of this bug and how many serious level headed researchers in threaten

tell people we've seen saying, hey, hey, hey, this is not a drill. Go fix this like right now you I would expect a little more urgency from folks. But it might also be the case where these libraries are in places that are not easy, easy to update to. You know some of these apps you might not be able to update right away. Yeah, that's kind of what I was gonna. What I was thinking is kind of the the rollout of patches is going to be a little bit slower, I'd imagine because of that reason you just mentioned.

And this one's tough too, because we're, you know, Amazon also came out and has said and a few other researchers that, you know, at this point, obviously threat actors are trying to exploit this. And it's it's, you know, fairly easily exploitable for the most part. So I mean, this is one of those ones where the pace at which threat actors are moving is going to be a lot faster than, you know, the time it takes for organizations to, A, become aware of this honestly. B be able to kind of find and understand where this fits into their own internal environments and then see actually, you know, roll out the patch.

So I think it's just one of those tricky situations. And then of course, you've got all these fake PO CS flying around Twitter. Got to love that. I yeah, that's such a weird phenomenon to me. Like I, it's a, it's like a childish thing of like, hey, I was there first. Look what I did. But then I mean, some of them in past cases have turned out to be malicious, like they're essentially like malware loaders or something. But I think in some of these cases, it's just like people thought they had PO CS and they're not. But like the guy that disclosed the bug has a thing on his site like saying look we've seen a bunch of fake or invalid PO CS and it's such a weird thing.

Like I don't, I don't really understand what the point of that is. Yeah, I think it is like to your point, it's partially like in my in my personal opinion like probably for clout a little bit. And then also there's not really I, I wish there was more of a discussion around the exposure or disclosure, I guess of PO CS in the security industry. Like I think there's, it's, it's something that needs to be done responsibly. And like, you know, obviously UCS have played a valuable part in kind of vulnerability disclosure and management and all that.

But then there's also a tricky situation in times like these. I mean, it's definitely an interesting topic. And then when you have these fake ones, it's just like you're sending research, you know, basically like security teams down, down the wrong rabbit hole and taking valuable time away when they're already at a time crunch for something important like this. Yeah, it's a weird thing because sometimes like the thing that you just described is like sending security teams down the wrong path or something like that. This the researcher who disclosed the vulnerability, whose name is Lachlan Davidson, I hope I'm pronouncing Lachlan correctly said that some of the PO CS are, you know, would likely produce false negatives.

So if you're running the POC and it says, oh, you know, it doesn't work against your app or your, your endpoint or something be like, OK, cool, we're, we're good. But some of them aren't aren't, you know, valid. They're they're looking at the wrong thing or testing the wrong thing. So you might have a, you know, a false negative, which is in this case much more dangerous than a false positive. Yeah, yeah, My conspiracy self wonders if, you know, maybe threat actors are like launching some sort of POC disinformation campaign or if that's something they're going to be doing in the future if they're not already so. I love this.

You've been hanging out with me and donning you too much for these conspiracy theories. I like it. I know. Yeah, it's so the bug itself is obviously very dangerous. And almost immediately, as you mentioned, Amazon's threat Intel team came out with a blog describing exploitation activity from some China aligned threat groups. And I have to say we the threat actor naming conventions, we could do an entire podcast on that whole thing. But the ones in Amazon's blog post, which came out yesterday, I believe two of the, I don't know what these are Earth Lamia, LAMIA, don't know what that is, never seen it. And Jackpot Panda.

Jackpot Panda, I kind of enjoy that name. The other one, I don't know what the hell that is, but two Chinese aligned threat groups already out there exploiting this. I'm sure there's more, I'm sure there's individual actors doing this, but the Chinese threat actors are almost always the quickest and you know, a lot of times most successful when they're jumping on things like this. They have a lot of resources at their disposal and they will sometimes pull those resources even among, you know, state backed ACT, state backed actors and contractors and that sort of thing just to get a jump on these. And that seems to be what we're seeing right now. Yeah, it's, I think it's really interesting just the operational alignment for a lot of these Chinese, you know, threat groups versus when you look at that stacked up to where we're at on the defense side for something like this, which is still even just in the beginning of the

roll out of the patches. So it's, it's definitely a bigger overarching issue that we deal with when we, when it comes to kind of more widespread vulnerabilities like this. You know, there's a little bit of a lag, I guess behind how, how easily threat actors are able to jump on this. Yeah, this bug has brought up a sort of one of the things that I think we've written about and talked about for many years.

And lots of people in the security community have talked about too, which is the value. Value is not the right word, but patching something like this, you know, going through a fire drill like this when something very serious gets disclosed versus a comprehensive security program that is trying to mitigate risk, you know, as a broader thing on a, on a constant on a continuous basis, You know, trying to figure out ways where something like this wouldn't even if you have vulnerable apps, they wouldn't be reachable or things like that. You know, the broader idea of risk mitigation versus running through these, you know, react and patch, God, no pun intended there.

That's so bad. These, these patching fire drills all the time, which we see, you know, not weekly, but pretty regularly, at least monthly on very serious bugs. And that's, you know, it's an easy thing to tell people tell organizations to go do that, But a lot of orgs don't have the money or people to do those things. You know, it's, it's really tough. Even, I mean, you were mentioning there was a Cloudflare outage last night, which you know, isn't connected to an attack, but they were, they were their logs were essentially like overwhelmed because of this, which is like an insane thing to think of for Cloudflare.

Right to check. All the resources on the planet, literally. Yeah, I know. Yeah, They said that the root cause was disabling some logging to help mitigate this week's React CV. So it's yeah. Yeah, if they can't, if they can't do it, I don't know who can. Yeah, I know. But that's I think you bring up a a good point for sure. I think organizationally and like strategically, it's really difficult for a lot of companies too, just because I mean, we saw and maybe we saw that this seems like it was a little more like of a well known thing.

But like even back with a log 4J or things like that, like even being able to understand like you don't even know what's out there in your in your environment for a lot of these different types of vulnerabilities. So I think, I think it's just tough to be able to plan ahead for that a lot of times. I mean, if anything, I guess it's planning ahead for what you don't know and trying to best prepare yourself on that front. Yeah, which is a really difficult theoretical thing to do. You know, the the unknown unknowns or whatever that phrase is. Like it's also a question of resource allocation for even for, you know, an organization with a mature security team and a lot of financial and human assets to throw at a problem like this.

Do you throw them all at this problem or you probably have other attacks and other things that you're worried about as well? It's not all one thing, you know, there's, there's always a variety of problems to deal with. So you know, even a a good, fast, mature security team isn't always going to be able to react quickly to something like this. Yeah, I did see a post from Kevin Beaumont that was talking about how basically this, the flaw applies to React 19, which was I think he said it was released in the past year. And then it applies when you're using React server components, which are also fairly new.

So like, I wonder too, in terms of just the overall like when we're talking about a tax surface and like how organizations can approach this, like maybe that might help like cut back a little bit on trying to understand how what the impact is. But that said, like, you know, it's hard to even track those different types of versions and all of these different types of, you know, things and whether you do have kind of that React server components and where those are so. Yeah, it's.

Kind of a mess. No, it's absolutely. And you know, the, the Chinese exploitation part of this is interesting. It's, it's kind of what you would expect honestly, as we mentioned before. And it kind of plays into a separate story that you wrote this week on some lawmakers and other folks getting a little worked up that maybe our telecom networks aren't, you know, completely secure, which is a hilarious thing to think about.

Like, you know, but this is like kind of pegged to the one year after the the Salt typhoon intrusions were exposed, you know, something that was well known in the security community beforehand, but you know, became public about a year ago when the government woke up and was like, what? Wait a minute, There are there are foreign actors in our telecom networks. What are you talking about You? Would have known. Who could see it coming?

Yeah, that was, I remember, I think I covered that and maybe you covered part of it too. But the that the reaction to that was one of those ones where, you know, you and senators like blast putting, you know, different telecom industry people on blast. Oh yeah. Things of being like, we like, you know, we're not going to stand for this. And so just like as background context, this was the salt typhoon targeting of, you know, all those different telecom vendors.

I think it was like AT and TT mobile, like all the, you know, big ones. And then that led to them being able to access, you know, some communications that were related to government officials. And then also like obviously all the like Americans, you know, that different type of data too. So it was not great. And one of the things that came out of that which, you know, we talked about this I think on the last podcast we did two weeks ago was the FCC coming out.

I think it was beginning of this year, January and saying, hey, we're going to start implementing some some new rules for these for communications infrastructure companies in order to better address security risks and be able to like bolster those types of measures. And then Fast forward to November there, the FCC reversed that ruling. Yes, so. And what's happened between January and November, Lindsay? Yeah, yeah.

What's? Changed. So, so the so anyways, all that to say, that was like one of the the big points of discussion during this hearing that I listened it on earlier this week on Tuesday. It was basically kind of a culmination of some government officials and then also some private sector folks, which, you know, I always like that because it's, it's good to hear out of their own, you know, mouths like how a private sector is like dealing with this, like what their, what their opinions are on it. So we got to hear from a couple of different people that were either working at telecom companies or who were part of kind of an alliance that was, you know, supporting that industry.

So, you know, it was interesting, you know, you kind of got the arguments on both sides that you would have thought and that we talked about on the podcast last time, which is, you know, on the on the pro side of the FCC reversal. People were saying, you know, this is prescriptive, it's ineffective. It doesn't hold up to the environment of how like telecom organizations are operating today. And then the critics were coming back and saying, well, now we don't have any sort of understanding publicly of like how telecom companies are, you know, aligning to standards set in place about security and how we can address threats like Salt Typhoon.

So it was, yeah, there was a lot of talk around that. One of the, I don't know if they discussed this in that specific hearing, they they almost always do. Somebody from the telecom side will will explain this, but one of the big problems is the telecom networks, like most old networks, are extremely heterogeneous and have extremely old hardware and software in places that they can't be swapped out or, you know, upgraded in a lot of cases.

You know, some of the the stuff that some of the attacks that that we've seen against telecom networks take take advantage of bugs in software that people have never heard of because it was implemented like 45 years ago or things like that. So there's always that underlying issue of, OK, this is a really rapidly aging network. You know, the obviously the front end of it is upgraded all the time with, you know, 5G and all that kind of stuff that they're always trying to get us to buy new devices for. But the a lot of the underlying infrastructure is real old and, you know, not fixable in a, in a, you know, broader sense. Yeah, I think it's really important to to note that because it is really easy from kind of the security industry like almost bubble to be like you need to apply these, you know, checklist basically of

like different standards that make sense from a if, if you're in a environment that maybe is more a standard business environment. But like to your point, if you are in like a very specialized critical infrastructure environment, it's going to be very, very different. And when you're dealing with those issues, obviously you need to be dealing with them and, and being able to secure those. But it's, it's going to have to be in a very different way than kind of what what most people are used to within our industry when they're talking about these things.

And they talked about that a little bit in terms of the need for like a meeting of like a better understanding of standard when we talk about standards and things like that. So. You know, I thought there was, there was a lot of different advice that was thrown around and, you know, I appreciated the the brainstorming and like all these different things. But there was, you know, there was talk of everything from like, you know, all the same things we've really seen people discuss like cultural shifts or, or like threat intelligence sharing, public private collaboration, all those different things.

So you know, I personally I didn't walk away from the meeting like fully understanding like if there was 1 correct action that like everyone totally agreed on. I guess like maybe info sharing but. Oh good, it's. Like easiest thing to do moving forward. And I think it's just like a broader recognition to your point is needed about like that there is like a very specific internal environment for a lot of these organizations. And like how do we, how do we come together and like understand how we can kind of have both security and then also like understand that there's very custom requirements that businesses in that industry need to kind of be so? And the other sort of related part of that is these big telecom companies are companies.

They're, you know, they're enterprises. They are not government agencies. And but the networks that they operate are essentially critical infrastructure for the nation and are treated as such by the government. So they sort of have this like government oversight in a lot of ways that can be, you know, kind of onerous, but also in other ways their businesses that have to run like businesses, you know, they have to have to turn profits. They have to, you know, compete against each other, even though in a lot of cases they are cooperating and, you know, in certain ways as well.

So it's a weird sort of dynamic among the companies themselves and also between the companies and the government because they get treated like, yet you're part of a government agency because you're, you know, everything you do like the nation's business depends on these networks running, you know, efficiently and being up all of the time. If there's and, you know, a billionth of a percent of downtime in any of these major telecom networks, people lose their shit, you know, and it's a it's a weird dynamic.

There's no real way around it. Like we're not going back to government owned, but actually I take that back. I don't know. I I don't know. Yeah, let's hope we're not going back to government owned telecom infrastructure, but who can say? That's a good point too. And you know, we see that with a lot of even, I mean we're talking about these massive orgs right now, but this is, this applies to a lot of different sectors within that are categorized as critical infrastructure. And like, for instance, even like, you know, local water utilities or things like that, there's a lot of pressure now to, you know, now that those have been categorized under this, this particular, you know, sector that SISA has put it, you know, under something that is really important when it comes to cybersecurity. There's a lot of pressure for them. But then at the same time, it's not like tit for tat, but you know, when you look at kind of

more of those local water utilities, like they still have their own way that they need to get budget, which is, you know, through kind of these local processes. So it's Oh yeah. Interesting the different dynamics there that need to go into play. Yeah. And another thing, just like the the water utilities, these large telecom networks are not a network in the sense of like they're wholly, you know, discreet things. They're built up of pieces of little regional telecoms that were, you know, absorbed over decades, you know, little regional like New England telecoms and Midwest telecoms and all that kind of stuff that had their own infrastructures and ways of doing things and processes and all that kind of stuff.

And that's all happened over time. So it's not like one thing, you know, the, the AT&T network is not like a homogeneous thing that they, you know, that all operates the same way. It's, you know, it's a weird kind of Frankenstein's monster of things. Yeah, Yeah, that's, that's a good point. And then looking at the other side of the coin, when, when we're talking about Salt Typhoon and these, you know, different threat actors that have been targeting these networks, the like, the thing that I think could have been discussed more was like just this extreme persistence of, of these threat actors. You know, I don't like, I, we're, we're not ready for that from, from the communications infrastructure side of things. And like, I, I think that's what worries me most is just like exactly how long and like easy it is for Chinese threat actors right now to stay in, in these networks. I mean, they're probably in

there right now, so. Yeah. I mean, yeah, we've talked about this a million times, but the thing that maybe some of these legislators and lawmakers and regulators don't may not understand, some of them do. But this is a job for those threat actors. You know, many of them, especially the the Chinese and Russian and North Korean ones are employed by their governments to go and do this thing. You know, this is their job that they get up and do every day for 8 hours or 10 hours is to find a way into US or other Western telecom networks and sit there and be pre positioned for whatever operations may come next.

That's that's what they do, you know, and it's a weird thing to explain and be like, yes, there are offensive cyber teams all over the world that, you know, just get up everyday looking for ways to attack us. You know, the parallels with like military are not exact. They're always used, but they're not. We don't just have foreign armies pre positioned on, you know, in like Louisiana or North Dakota all the time, as far as I know.

But we do have foreign threat actors in our networks at all times. And it's just one of those weird things you have to wrap your brain around and be like, they're here. We just have to find a way to mitigate their access. And you can try and eject them, but they have they've shown over and over again that they don't find a way back in. Yeah, even the SYSA advisory that I think it was yesterday or the day before on on Brick Storm that came out basically warning that Chinese threat actors have been targeting Gov orgs in the tech sector with this malware, which, you know, they described as sophisticated that essentially has enabled threat actors to, I think they said achieve persistent access an average of 393 days.

That's not good. It's not what you want. That's a long time. It's a really long time. Yeah, so and I think, you know, it's, it's a good point that these are, this is their full time job is like trying to figure out the best way to maintain that access because that level of persistence is is extremely valuable for threat actors. Yeah. You know, think of all the things that they can collect and you know, data isn't an information, it's not it's, it's constantly changing and like being able to stay on top of that is is really valuable. So.

Yeah. I mean, they can sit there and depending on their level of access, look at, you know, the way that the network is changing, the way that personnel is changing inside the organization, what they're, you know, patching levels are how they're thinking about their, you know, annual budgets and all that kind of shit. It's just, you know, 390. I mean, by my math, that's more than a year. I think that's a long time. Yeah. Yeah, it is. You'll. Get a full FCC role enabled and then reversed in that time. We sure did.

Yeah. It's wild what can happen inside of a year. Yeah. All right, so between now and Christmas, which is holy shit, three weeks away, I'm sure we'll do a couple more of these podcasts, but also some more movie podcasts. We were talking about doing Die Hard, which I'm one of the people that is like, this is not a Christmas movie. So it's a movie that take place at Christmas, but we can save that for the podcast. But so we'll do that in the next week or two. Are there any?

I was thinking about Home Alone because it's been on all the time and it's such a like delightful, like, you know, social engineering isn't the right word. I guess it is, but that could be a fun one too. Yeah, I think so. I love home alone. Home alone too. Yeah, Home Alone too I think is honestly more of my favorite. Yeah, aside from the bird lady who just freaks me out, I can't like the pigeon lady. Just every time she's on screen, I'm just like, oh.

Man is what's who's the better side character, the pigeon lady or the old man in Home alone The. Old man, I always forget about him in the in the home alone every time. I'm like fight. With his. Son, why is this like Dickens ghost guy shoveling snow and showing up in the church and being a weirdo? I always forget about it. Yeah, I don't know. He freaks me out too, honestly. Yeah, both of them scary. Characters. Yeah, and his name is literally Marley, right? The old man. I'm pretty sure it is.

Yeah, just like in A Christmas Carol. Yeah. I don't. I don't know. They both weird me out. John Hughes. Interesting dude. But yeah, I don't know. We could. We can talk it out. I don't know which one we should. I think the first Home Alone is maybe the more like, although he does a lot of damage at the townhouse in in home loan too too. So that's, yeah, I maybe we could put it up to vote on Twitter or something, see what more people want, yeah.

I do feel like I don't know about your generation but like my kids like home alone too more. It's like their thing. Yeah, I don't know if it's like a generational thing, but personally I like the New York City. Like I like the vibe of New York more. So yeah, I mean, I'm, I'm down for both, for either. Do both. Yeah. I mean, the the first one is obviously it's like it's set in Chicago in the same like area of every John Hughes movie from the 80s.

You're like, OK, Ferris Bueller probably lives around the corner. Like, you know, the pretty and pink kids live down the street or whatever it is. It's like OK. Massive houses by the way where like 6 kids live in one like. Their house is crazy. That thing is so weirdly The thing is filmed in. Like the town that my mom is from. Really. Yeah, all. They're all filmed in this little suburb outside of Chicago. But the the old man in Home Alone one, we're getting sidetracked here.

But the old man, he lives by himself on that same St. like next door to the Home Alone family. Like, how is he affording that? Their house is like a $9 million house. He's just. He looks like he's barely hanging on. I don't. Yeah, I I think it's time to go to retirement. Yeah, also houses way more affordable in the 80s kids. Yeah. Oh, must be nice. Yeah.

Oh man. Yeah, born too late. We. Can discuss during the podcast. Oh, we will. We're. In cybersecurity conversations. That's right, housing prices and old men. Yeah, yeah. All right. Well, good to see you. Have a good weekend and talk to you next week all. Right, see you in tennis. Bye.