The Rapid Rise of AI Exploit Development and More Axios Compromise Effects

Analysis that came out Oh yeah, Google Mandiant, yeah. So that, you know, that's kind of the the big development that's that's come out of this. Yeah, it definitely is that I think Google refers to this group is UNK 1069, which is, you know, UNK in their nomenclature is just an uncategorized Group, One that they haven't sort of graduated to the formal, you know, naming conventions that they have. But it's a financially motivated threat actor from North Korea.

As we sort of speculated about in the last episode where we were saying, you know, there was some talk out there at that point that this is, this looked like it was North Korea based on some of the malware that was used and some of the coding artifacts, which is one of the things that Google talked about in their analysis. They named the back door that this intrusion used as Wave Shaper version 2, which is a descendant, as you might imagine from the name of Wave Shaper, which you know, they, they have tied to this group.

So that's kind of the main way that they tied this intrusion to that 1069 group and they have a whole deep analysis of the malware itself, the back door, how it works, all the all the capabilities and all that kind of stuff. So it seems pretty solid from from everything that I've read so far. Yeah. And there was another unique aspect of it as well that I think we were texting about earlier. But the the fact that I think it was ACNN article came out talking about how the end goal for this appears to be cryptocurrency, which you know, as as we know about North Korea, you know, that makes sense. That's kind of the at the heart of all of their intrusion that we've seen.

And I mean, it's a little different from crypto mining, which we had been discussing earlier. Yeah, this is like, it appears like maybe going straight to the source, which is like crypto firms or whatever. But it that certainly makes sense knowing, you know, kind of what we know about North Korea and their TTPS and everything else. It definitely does if for people that aren't completely familiar with the way that these things operate. The last, I don't know, 10 years, 12 years, North Korean threat actors, you know, those that are directly working for the state government, as well as some that I assume are contractors and private sector threat groups, have been just essentially funding the North Korean military and missile programs through cryptocurrency thefts. And on a large scale, you know, some that you've heard of, some that you probably haven't, there are numerous examples of this. You can go and you can go and

find them very easily. And some of these have been in the hundreds of millions of dollars. So also some hard currency thefts, not just cryptocurrency, some actual money instead of no magic Internet money. But they're it's not a stretch to say that they are funding part of their common economy with this kind of activity. You know, that's what these threat intelligence teams have found. You know, our, the US government has indicted several actors as part of this, sanctioned some of these groups that that stuff doesn't have a real effect on them, as you can tell. But yeah, I mean, this, this makes sense. Just imagine, had this, had the window of exposure for this been more than the two to three hours that it seems like it was for these two malicious packages.

Had this been not noticed for say 36 hours or a couple of days, imagine what the potential damage could have been from that. You know, it, it, it kind of, it's kind of mind boggling what what may have happened. Yeah, I know. Definitely. And you know, I think that the whole North Korean piece of this that you know, kind of, as you've mentioned that this is really how in a, in a sense they are powering their economy like that is fascinating to me. I think, you know, I, I'm curious if there's any sort of any books about that or, or whatever, because I'm sure if there, it's, there is a whole other level and dimension to that and it's just insane.

Yeah, I, I don't know that anybody has read or written a not specifically about them. I think, you know, the the books that like some of the folks we know, like, you know, Andy Greenberg and Kim Zetter and other folks have have written, have more focused on other. Yeah, more on like the Russian side of things as opposed to the North Korean aspect of it. I think for various reasons, like there's just not that much known about the way that North Korea operates.

You know, there. Yeah, there just isn't. We don't really know what's happening there. And that's by design, obviously. But, you know, we know far more about the way that Russian threat groups operate and probably even Chinese as closely as as these researchers track the North Korean threat groups. We don't have like the at least not that I've seen them. They may exist privately. The sort of, you know, social graph and breakdown of how all these units are tied together. The way that you, you can find those for, you know, Chinese threat groups and Russian threat groups and that sort of thing. Probably for US, honestly.

But I, I've never seen one of those for DPRK. They they may exist, but I've never seen one. Yeah, I know there's kind of a weird, you know, mystery around, you know, I know there's like Lazarus and subgroups and all of that, but it's it's hard to know. And then also just the, you know, the fake job interviews, like, Oh my God, cryptocurrency and fake job interviews right now, those are kind of the two big things that North Korean threat actors are that we're seeing with them.

And both of those things are just, again, it's, it's fascinating to me because it's working at such a wide scale. And you look at something like this attack and this is absolutely working for them as well. And so, you know, they're looking for the ways that they can kind of sneak into organizations or try to get those credentials. And with that end goal, that financial end goal, and it's, you know, they seem to be successful at a wide scale. It's crazy.

I mean, the, the sort of axiom that you hear now that attackers don't break in, they log in, you know, which is a very simplistic way of, of saying that a lot of these really successful attacks do use, you know, people on the inside, either voluntary, voluntarily or involuntarily. Like whether they're, they were placed there through one of those, you know, insider schemes, the, the fake IT workers or, you know, however you want to turn that thing or they're just stolen credentials that, you know, are being used for, for various attacks.

But these kind of the supply chain attacks like the Axios one and the, and the team PCP ones that we've seen over the last few weeks, it's weird that they're all clustered together like this, but these things happen all the time. You know, the, the supply chain attacks are have turned out to be incredibly effective ways for for threat actors to get access to high value, you know, organizations and accounts over time. You know, we've seen it time and time again. Yeah, definitely.

The other thing I wanted to mention too, just another like kind of smaller update from when we last talked about this news item, but the maintainer of Axios kind of came out and did a little bit of a breakdown of what had happened further. And I know last time we talked a little bit about the fact that, you know, it seems like his you mentioned there was a compromise and I think you said his his codes have been somehow accessed or something like that. Two factor backup codes 2.

Factor backup codes. So he came out and essentially said like the gist of it was was that he someone had gained his trust as someone they basically pretended to be someone who was interested in working or partnering together on open source is what he said. And I know I talked about the XC back door last time. Like this seems again very similar to that, which is if you remember, in that case, there was a maintainer who was feeling overwhelmed because these these projects, like a lot of the times are come down to like, you know, like one person in a lot of cases and looking for help, maybe looking to partner with someone, looking for support and then threat actors taking advantage of that and kind of slipping in as through social engineering or whatever.

So I don't, you know, based on this, I still don't understand fully the initial access vector. Like I couldn't really understand it from this explanation, but like it sounds like that was an interesting part of. Yeah. The kind of how this attack played out from the beginning. Yeah, it's a very old school social engineering tactic to sort of gain the the targets trust, you know, that this person appeared to like express interest and be, you know, helping with this project, becoming a contributor, contributor or maybe even a maintainer. And it it's not clear from his post like what period of time this took place over, but it, and he doesn't say specifically like I gave them access to my maintainer account. It doesn't sound like that to me. It sounds like in, in one way or another, they were able to kind of weasel some access to his,

you know, MPM and GitHub accounts and then locked him out, like changed the e-mail address and locked him out so that they could, they could do this. And it's very clear from the various analysis that I've read that this is a, you know, a very well planned and, you know, tightly executed attack. It was not a haphazard thing. And this just backs that up. Yeah, Yeah, definitely. So yeah, that was the other kind of new development there.

It's, it's like depressing the way that we talked about it in the last episode of like all these open source projects, you know, people start them as, you know, kind of a hobby or a side project or something like that. Or because they want to do something good and help, you know, help the ecosystem or something along those lines. And then something like this happens and they're, you know, they're spending their spare time doing this and, you know, responding to bug reports and, you know, feature requests and all that kind of thing.

And in that post that you mentioned Lens, he you know, at the end of it, he says it's sad to me that zero trust can be not zero trust architecture, but zero as in no trust can be put in people as my only objective is to create useful things with code. But it seems like the world is strongly against that with someone trying to steal, slash, exploit something at every corner. That's so sad. Yeah, I know.

It's like. Yeah, this, this guy, this person is clearly just trying to, like you said, like this is something that they're doing, you know, as a free service to the world. Because they wanted to do something cool that they thought was, you know, interesting and might might, you know, be useful to other people. And it's one of those things like you, like we know people who, you know, have developed open source tools or given things away like that. And people just end up like shouting at them. Like, why didn't you do it this way? Or why didn't you add this feature that I emailed you about like 9 months ago or, you know, things like that. People, we can't have nice things. Like people just can't be grateful. You know, they just have to, I don't know, it's, it does just, it's a little depressing when you see that, you know? 'Cause, you know, and you know, I know there was a lot of discussion about this like 2 or so years ago and like I think the OSS Foundation or something

like came out and said like we here's what we need. Like, you know, all we need more support from the companies that are, you know, reaping the benefits of these sorts of projects. I really haven't seen anything since then. I mean, maybe I'm just have been, you know, there hasn't been any big announcements, but I'd be curious to talk to, you know, either maintainers or like people in the open source community and see what's going on and if. I haven't seen much. Yeah, there's been a bunch of efforts like that over the years. And it always happens after something like this where there's a lot of attention on it. And then all of a sudden everybody's like, well, oh, why didn't you have this security feature? Why didn't you do this?

And he, this maintainer says in his message, he's like, you know, I'm not totally versed in security. I didn't, I, I didn't realize that I needed to have MFA on every single account and this and that, which is completely understandable. Yeah. He's just trying to write a cool software tool. And yeah, the, the whole open source security, the problem is that there's no funding for that like that. And that's what the OSSF was trying to do was like get some money together and then give stipends to some of these like load bearing projects that could, you know, actually do something with that money, like hire a full time developer or a part time developer to do code audits or add some different security features. And you know, I think the thing that you mentioned would came out after happened after log 4 J if I remember right. I think that was like the inciting incident. They all kind of run together.

But yeah, it's there have been various effort attempts at this over the years. And some of them, you know, more realistic than others. But you do see people sometimes yelling at large software vendors who incorporate a lot of open source software into their products to to hey, throw some money at this. You know, you benefit from this, give some funding to this. And I know that some of them do. And, you know, some of them trumpeted, some of them don't.

So you don't always hear that, you know, say Microsoft or you know, Cisco or Google or whoever gave 200 grand to very, you know, to some project, but it's, it's not nearly as common as it should be. Right. Yeah, that's, it's unfortunate. It's, it's also hard though. It's a hard business. It's a hard model. The way it's set up is not, you know, it's not going to work itself out, I guess in an easy manner, just operationally so, yeah. No, I mean.

It as well. Commercial software vendors with huge development and QA and security teams have a hard time securing their own products. So in defending against account takeovers and source code depth and things like that. So individual maintainers who are doing this as a side project and aren't, you know, kind of don't stand a chance against somebody on the level of a North Korean state actor.

You know, what can you do in the face of that? Yeah, just. Hold on and hope for the best, and that's not really a strategy. Yeah. True. Unfortunately, yeah. So the other thing that I wanted to talk about with you is kind, I mean it's a little bit related, but we've talked a lot about AI in the last few months as everybody has in various capacities. And something that struck me both last week at RSA and even this week it two things. One is just how insanely fast this is all going in terms of how both threat actors are using AI tools and how. Offensive vulnerability researchers are using them as well to find bugs in, you know, software targets. I you know, just in various conversations with people last week at RSA, people both on like

the defender side and also on the vulnerability research side were just talking about how they can't even really wrap their arms around the speed with which things are changing. Like almost on an hourly basis with how how much better and more efficient some of these models are getting at finding actual vulnerabilities and writing exploits for them at the same time, which is something that people have been predicting. Like that's one of the effects of the broad availability of these tools that people have been worried slash excited about in the security world is, oh, we're going to be able to automate vulnerability discovery and then that'll help us on the defensive side because we'll be able to go patch all those bugs or whatever.

But there are two things happening. 1 is companies and again, open source project maintainers are being absolutely buried by bug reports, you know, in the like, up until very recently, like within the last couple of months, those were trapped Most of those were were slop, they were AI generated junk that almost never included a real bug or something that actually mattered if it was a reproducible bug, it was, you know it was, it was noise. But in the last like month or two, I've seen so many people saying, OK, now we're just getting report after report after report of legit serious slash critical bugs in our software slash project.

And you know, say, just take Axios for example, like somebody that's a single maintainer or maybe part of a two person team, If they just start getting inundated with valid bug reports that were, you know, found by AI tools, you know, getting say, even as few as like 6 or 8 a week, like no way they can handle that. How can they triage those and then go write patches for them and deploy the patches and all that kind of stuff. And even some of our friends that work at large commercial software vendors are having a really hard time dealing with this.

And they have professional triage teams that do nothing but this, and they're getting absolutely buried by these. Yeah, I mean, this was already an issue even before AI, but now AI has just made it explode like it's so much worse. And I feel like I was listening to Casey Ellis, who with Bug Crowd, who founded Bug Crowd, he was talking about, I think it was at that Run Zero event that you talked at during RSA as well. He's talking to Todd Beardsley about how bug bounty's going to change in particular because of AI and because of kind of this like influx of AI generated reports. And he made a really good point, which was basically that, you know, these AI is lowering the barrier to be able to generate these reports and it's making it

faster and more effective. But then on the other side of the coin, companies are still really bad at patching and they're really bad at like, you know, responding to these things. And there's still vulnerabilities that exists that we that companies know about that haven't been patched yet. So there's just that's, that's kind of the, the biggest issue in all of this is that there's a discrepancy between, you know, bad actors that want to use AI tools to figure find vulnerabilities and even good actors that want to disclose the vulnerabilities and the companies that are able to not able to keep up with with everything. Yeah.

I mean, one of the things that people that have thought very deeply about this for the last, you know, say 2025 years, it came to a conclusion, you know, years ago is there's essentially an infinite supply of bugs in software. You know, it's not, it's, it's inexhaustible. You will, if you keep looking, you will keep finding bugs. They, they may, there may be a limited supply of critical ones or serious ones, but you will just keep finding bugs and software for the obvious reason that it's written by humans and humans make errors and blah, blah, blah.

But up until very recently, even with automated fuzzing tools and things like that, there was kind of an upper limit on how many, how many resources that say an individual, even a highly skilled individual vulnerability researcher could, could, how many bugs that person could find in a given amount of time. You know, because then they they have to, they have to not only find the bug, but make sure it's exploitable, possibly write an exploit for it or send the crash dump along with the vulnerability report to the vendor that the vendor might ask them to write a patch for it, which happens more than you would think, which is insane. And like go through this whole process now with these AI tools, 99.9% of that is automated and it's doing as good or better job than very high end, you know,

offensive security researchers and exploit devs can do on their own. And these are, you know, folks with 15 or 20 years of exploit development experience that make very, very good money to do that. And now we just have tools doing it. You know, there was a two things I wanted to mention. One is a, a post my friend Tom Taschek wrote that I think it just came out on Monday. Yeah, it was Monday or maybe Sunday called Vulnerability Research is Cooked.

And for people that don't know who Tom is, you, you can go read his CV. He's one of the original vulnerability researchers from the mid 90s, started a couple of successful security companies. Montesano is one of those. He's extremely well respected, one of the smartest people I've ever met and thinks very deeply about these things. And he writes like one blog post every six years. So when he writes one, like people tend to pay attention to it. And he essentially said what I've been saying much less succinctly.

It's a good word to trip over. But he goes into much more detail about why this is true, but essentially said, I think this outcome is locked in. This is going to happen. It's just a question of, you know, how quickly. And we're seeing it right now. You know, there was a a researcher who people might know named Tai Dong, who's a Vietnamese security researcher, very well known, just, you know, helped discover a couple of really serious TLS attacks back in the day. He and his team used clawed to find a full remote code execution exploit in BSD.

Like yes, I think they published it yesterday. And they were like, this is what a very high end team would have spent weeks or months doing just last year. And now tada, you know, it's like it's getting spooky. Like it's it's crazy fast. Yeah, that's, I feel like we keep seeing the writing on the wall here a little bit. And it's funny, you bring it like, you know, it's bad when these really, really smart researchers are coming forward and being like, this is, this is not good.

No, yeah. Yeah, I and I also, I, I was going to talk about like this at unprompted, which is this conference they had a couple weeks ago about specifically about AI, which was an awesome, like they released the talks on YouTube and it, it was a really, really interesting event. But there was one session by Nicholas Carlini, who is a he's, you know, really, really smart research scientist at Anthropic and was basically, you know, saying the same thing, which is just talking about how good LLMS are at creating vulnerability reports right now. But what stuck out to me from from that talk in particular is people then during the Q&A session were saying, OK, So what do we do?

Like do we build safeguards? Like how do we deal with this? And. Too late. Yeah. And I think, you know, he was like, we need to find a way to fix this. Like we need to basically like we that we're going to need like all the help that we can at this point to like be able to step up and meet this, this challenge. But like I, I was trying to rack my brain about how we could, how you know, when we actually enter this era of like this, where in this situation and scenario that you describe, like how we're going to be able to handle that.

And I really couldn't like there's no, there's no safeguards. There's not really any way to implement safeguards because this is something where threat actors are going to be abusing legitimate tools similar to you know what we do what we have right now with other many other things, but just at a way faster and scarier scale. And there's not any like rules or, you know, regulations or anything when we're AI right now and how it's being used.

There's not even really any sort of, we don't have any rules right now where if like someone uses AI to like make a statement or write something or create code like at like it's just like at the most basic level, like there's nothing that, you know, there's no principle that is, you know, connected to AI. So, yeah, I don't know. I think that's kind of the heart of all this is we're just going into this and we don't have any sort of standard set up for it. No, there's, there's none whatsoever. I mean, we have historically a terrible time trying to develop any kind of security standards or even like societal norms around how to disclose vulnerabilities. Like that's been going on for literally 30 years. And there's still no like, broad agreement on that. You still see people arguing on Twitter about that like literally every day.

So no, I have absolutely no faith that this will be, you know, that any of this will be contained in any sort of way anytime soon. It's funny that that talk you just mentioned, that's actually the vulnerability that those researchers I just described developed the exploit for. That They, that's the exact one that Ty and his team just said to Claude, oh, here's this bug in BSD. Write an exploit. 8 hours later, they had a fully functioning exploit for it. Yeah.

So like, that's like weeks of work for, you know, smart people with lots of experience. And now it's just, yeah, it's an AI model. You know, I think right now the only thing that's limiting this honestly might be money and how much money researchers want to burn, you know, paying for AI model time to, to do this kind of stuff like that.

That's not cheap. I mean, that's, I'm sure it'll come down the way that everything does except for food and gas and housing. But you know, but I'm sure that model usage costs will, will stabilize or, you know, there will be some, some sort of economic model that makes it feasible for people to use them on an ongoing basis. But that might be the only thing that's holding back, holding this back from going absolutely, you know, straight up in terms of the number of vulnerabilities and exploits that these things are writing every day. Right, yeah.

The the other thing that I think about too is how this is going to play out in real life. Like, are we just going to start seeing an explosion of exploitation? Like, is it going to be like, how is it going to look in three months like? Oh God, I know. Yeah, so 'cause we're seeing, we're seeing the efforts from good, you know, from white hat, you know, researchers right now and we're seeing through their research how easy this is.

But like, you know, the way that we're going to see this front in terms of how how threat actors are going to use it to increased exploitation is entirely different story. Yeah, I think if we, you know, as you said, like sometime this summer, if we're having a conversation like this, things might be radically different already, you know, by mid June or mid-july or something like or after Black Hat, who knows, there could be the landscape could look completely different.

And we just, yeah, I haven't, I've asked that that question of lots of researchers and security folks. Nobody seems to have a, a really like, you know, solid answer that they are 100% sure of because I don't think anybody's sure of anything in this, in this world right now with AI. But threat actors using AI tools to, you know, automate exploit development is something that's obviously happening right now.

The exploitation I itself, I still feel like is probably for the most part being done by individual operators just because it, that takes some care and, and, you know, precision to do that, but I don't know how long that'll that state of affairs will last. And, you know, we, we talked about on our last podcast, like the radio silence from Sisa on that, that Axios compromise, as much as we've heard from Washington about AI and none of which is like coherent really.

I haven't, I haven't really seen anything on this either like the security implications of AI models or more of what we've seen is, you know, the environmental impacts of AI companies and that sort of thing and how they're destroying our economy. But that's a whole other discussion. But this kind of stuff, I haven't seen really anything from senators, even the ones that understand it. Like, I don't know, unless I'm, I'm forgetting. I haven't, you know, I haven't seen anything from like Ron Wyden or the folks that actually understand what's going on. You know, obviously they have their hands full with a war and other things.

But yeah. Yeah, that's a good point though. And I I'm don't know why that is. Maybe it's just not like a hot political issue right now, but it's certainly. It might just be that people don't know what to like, how to talk about it. Like, because honestly, like we've been saying for the last 20 minutes, it's just changing so quickly. You know, you just, you really can't get your arms around it at any point in time.

Yeah, I know. Like personally for me over the past two years, the shift has been really interesting to see. Just as someone in cybersecurity who's covering news too, is like when, when AI, when we were first talking about AI like 2-3 years ago, I think at that point I was like rolling my eyes and I was just like, this is just all hype. No, no actual like substance in this and now like. That was true then, by the way. Yes, Yeah, yeah, that's true that. Was accurate.

And then like within the last year or like even six months, like I feel like I was just like, oh, Oh, no, like. Yeah. This not only has substance, but like this is very, you know, there is some potentially really bad use cases out of this. So yeah, it, you know, it's like when you see the long range forecast and they're predicting, you know, like 4 feet of snow or something, you're like, yeah, they're always wrong. That never happens.

And then it gets closer and it gets closer. You're like, oh, this is the Yep, it's going to happen. That's a very New England. It is, yes. Yeah, You can tell it. Yeah. My psyche is still damaged from this past winter, but yeah, yeah, you're right. I mean, the, our friend Gary McGraw, who's the, the, the person I know who's thought the most about AI and machine learning over the last because he did his PhD on this in the the 90s. So he very few people know more of thought more about this than than Gary has. And, you know, even he is, I think I haven't talked to him in the last couple weeks about this, but even he, I think is kind of like amazed by how the, you know, just the absolute uptick in craziness that's gone on recently. Yeah, no, I was thinking, yeah, we need to have Gary back on the podcast, like to have, you know,

I remember I think it was maybe like last year or the year before you last talked to him or something. But I would be really interested to hear what he has to say specifically about how things have accelerated recently so. Yeah, I'd have to roust him out of his semi retirement and his, you know, his farm down by the river. But yeah, he would do it. Yeah. I I should call him. He's he's, he'll probably text me. He has like superhuman powers to know when somebody's talking about him.

But yeah, All right. The last thing I wanted to mention is we are again sponsoring with our friends at Material Security, their security theater event. They've been doing a series of these. They did one in San Francisco, one in New York and they're doing one this coming Tuesday, April 7th in Austin, TX. And the the movie this time is Hackers, which is one that we is on our our list of hacker movie podcasts, one we're going to do sometime soon. But these events are really great. I'm I'm going to be in Austin for this. I'm really excited about it.

So they show the movie and they do some movie trivia beforehand. They have prizes. It's all like, you know, a bunch of security nerds and movie nerds sitting around, you know, kind of laughing at the absurdness of hackers and, and just having a good time. So if you are in the Austin area, I'd, I'd encourage you to register. You can go to material dot security slash theatre or material dot yeah, material dot security slash theatre and you can find the registration there. It'll be a great time.

I'm going to bring some decipher swag with me. So he he some of that away. I know that's. Good. Yeah, that sounds really fun. I 'cause we always, you know, we, we have our kind of hacker movies that we do. But like, there's something about sitting down with people who really appreciate hacker movies and specifically hackers and watching it together and then some cool trivia like that just sounds so fun.

I'm excited. I did not see this dumb movie in theaters and I'm I'm talking about about it. I I like this movie. It's fun. It's completely ridiculous. There's a whole subset of the security community that this is like, this is their movie, the way that Like Sneakers is my generation's movie. People, I don't know what it is about this movie. Maybe it's, you know, it's kind of the campiness and like the roller blades and the pagers and like the neon colors and all that kind of shit. But some people just love this movie so much. So.

Yeah, it'll be fun to see in the theater. Should be great. That's. Awesome. Yeah, and we do. We are going to have a couple upcoming Hacker Movie podcast episodes. We're going to have your colleague John Hammond on one. We don't know exactly when that's going to happen yet, but I saw him at blackout last week and asked him if he wanted to do one of these with us. And his immediate response was, do you know that movie Black Hat? Yes, I do, John.

I sure, sure do. So we're going to do Black Hat with Jon Hammond, which will be an absolute blast because that movie is absurd too. Like the the one that the one where Thor is a hacker is the way that somebody described that to me, which I thought was just perfect. That's that's a great description of it. They should have just made that the tagline. Honestly, yes, had they known how big the the MCU was going to be, they because this came out sort of before all of that, but yeah, that would have been that's retroactively.

They should do that just yeah, Thor as a hacker, yeah, but yeah, so we'll do Black Hat pretty soon and we should do hackers too. Get that going because that'll that'll be a super fun one, especially after I go and sit through it in the theater, which will be quite an experience. Yeah, definitely. Yeah, we've got to run through some more and to like any of our listeners too. If, if anyone has any suggestions, we would love to hear them. Be sure to comment on our maybe our Twitter page or whatever to see for SEC.

Yeah, we would love to hear those 'cause we have our own list. But I know that there's some like people every once in awhile will mention a movie to me and I watch an, an embarrassing number of movies. But sometimes people just you know, mention oh, have you seen this? I'm like, no, I've never even heard of that. So there's a lot out there that, you know, we probably haven't thought of. So if you guys have like favourites that you'd like to see from, you know, especially recently because I'm more on like the 80s nineties scale and lens.

I think you're on more on like the 2000 scale. But yeah, some of the more recent, like straight to streaming ones that you and I have talked about, like Heart of Stone, I think is one that we really need to do given the AI, Oh my gosh, aspect of that movie. I, I can't imagine that there's eight people listening to this who know what Heart of Stone is. But somehow you and I both watched it, I think like in the same week separately, like whenever it came out last year or two years ago.

And whoa, is that movie terrible. But it would be an entertaining podcast. They do, yeah. I think there is like a sub, a weird subset of AI movies that I think we need to also do. Like what was the one? There was one who? Let's see. Well, the last two Mission Impossible movies are, yeah, centered around AI in a very stupid way. Right, I know it's it's just crazy there. There have been some other good ones too. I'm blinky on the names, but I'll find them. There's a lot there.

There's so many, especially in the the streaming era. You can, you can find a bunch on like, you know, Amazon or Netflix or two V or whatever and it'll just the thumbnail will just be some person like in front of a transparent screen, like you know, with their hands up and a bunch of like ones and zeros or something. What's happening? Yeah. I know there that was also there's like a kind of a weird subplot in that House of Dynamite movie that came out recently, which is more about like a nuclear war. But there's some, you know, cybery stuff in there. And also that horrific show that came out last year, Zero Day. Oh, well, yeah, that was.

I couldn't finish that. Oh, it's so. Bad. It's such good hopes for such high hopes. God, it had Robert De Niro. It had Robert De Niro. Yeah. And it was like, I, I don't, I can't even calculate what ungodly amount of money they must have paid him to do that. Yeah. Whatever it was, I hope he had a good time 'cause that was absolute garbage. Oh, I know there was, there was this is interesting. It wasn't so much AI mean. First of all, this is a documentary and it wasn't like fiction like it was an actual thing about actual events with some people that we know in it.

But had you heard of a most wanted teen hacker on HBO? Yeah, I mean, that was I watched that during maternity leave. That was kind of interesting to watch. It was a four part series. And yeah, there were it. It was one of those things where like I I like watching hacker movies because they don't hit too close to home. Like like you're just like, oh, like this is a feel good, like culturally like significant movie. And then I was watching this and I was just like, I remember writing about that. I remember looking at that.

Like very much so, yeah. And then like you said, there's just people that we know, like on screen you're like, oh God, wait, I know her. Yeah, it's it's a little too close to home. That is a good one, though. That's. Yeah, that's kind of, yeah. The true ones are a little bit like I tend not to like those as much just because for the reason you just explained, like you need some kind of escape, like I need to see the ones and zeros flying through the air to make it, you know, unrealistic to to put me at ease. Or you know, we were talking about the pit a few weeks ago on here in the cyber aspects of that which I don't. You're caught up right?

Like you've seen. OK, so they kind of forgot about it for like a week. They just were like, OK, I mean, which is plausible because the show is just hour by hour, right? But this past episode I'm. Just I'm laughing because I know exactly like you're going to talk about. They just kind of were like they said, OK, well, the other two hospitals paid the ransom, so we're just going to bring our network back online and we feel good about that. And a even if you pay the rent, if those hospitals paid the ransom, good for them.

That does not mean that anything is coming back online anytime soon over at those hospitals. Right. And you bring your network back up. If the hackers were in your network beforehand and you turn it back on, guess what? Kaboom. Like they're like, I don't know. That's funny too, because Nurse Dana was like, she was like, she what did she call it? She was like, the cyber conflict is over.

And I was like, it's not a conflict. Like no. Hospitals were attacked. What did she you screenshotted it? You screenshotted it on Twitter? It was something about like these cyber assholes or something. Like this I was like that is perfect. Yes, that's what it was. Yeah. Yeah, right. But she did. She was like the cyber conflict is over. Like what's the conflict like? You guys just turned your power off like I don't. But that was, you know what? I give them props. That's realist. Like, realistically how probably like someone who didn't understand cybersecurity would talk about all these things, like just being like, yeah, the cyber conflict, it's done and we're all safe now. So yes, that's exactly right.

Those are the kind of, you know, calls and texts we get from, like, our parents that are just like, I heard there's a cyber war. Is that true? I don't know. What are you talking about? Be specific because probably which one? Yeah, right. Exactly who? Tell me who, which two parties you're talking about. And I'll tell you what, if you're right. Yeah. OK. Well, that's been our movie and TV portion of the podcast. So again, if you're in Austin, come see me and all the great material security folks next Tuesday.

It's at the Alamo Draft House, which is, I've never actually seen a movie in one of those. I'm excited. It should be super cool. Like they have the awesome reclining chairs and all that kind of stuff. So beats the hell out of the movie theater at the mall that I go to. Yeah, A. 100%. Yeah, All right, Linds, great to see you. You too. All right, talk to you soon. Bye.