Security Confidential S12 E10 Bourbon Breakdown

[Music]

Chris Cazel: Thank you. Hello everybody. Welcome to the season finale of Security Confidential. I’m Chris Cazel.

Rory Meikle: Rory Meikle is still here. We’re back.

Chris Cazel: Yeah, Manoj is not in town this week; he’s abroad.

Rory Meikle: So, we were bestowed the honor of capping off the season. There we go. For today’s episode, Chris, Emily, and I have, over the past week, been gathering some stories from around the “cybersphere,” if you will. We’re going to go through them. Chris, obviously being our resident security expert, we’re going to get his take and his feedback. If you guys have comments or thoughts, we’d love to hear them.

Chris Cazel: Yeah, and disclaimer: I haven’t seen any of the articles, so it’s just going to be off the cuff—basically gut reaction, the hot take.

Rory Meikle: Yeah. So, the first one here: New Apple zero-day exploited to target Egyptian MP with Predator spyware. The three zero-day flaws addressed by Apple on September 21st, 2023, were leveraged as part of an iPhone exploit chain to deliver spyware called Predator, targeting former Egyptian Member of Parliament Ahmed Tantawi. The tool was delivered via links sent on SMS and WhatsApp. Users at risk are advised to keep devices updated and enable Lockdown Mode. What do you think?

Chris Cazel: I did see a bit about this. It’s weird, but I don’t think mobile phones are that secure. On a PC, you can block things, avoid domains—but on a phone, links are shortened, and it’s harder to tell what you’re getting into. It’s interesting there’s a zero-day on iPhone. Macs are seen as secure, but that’s partly because they’re less targeted. iPhones are so popular that attackers put more effort into them.

Rory Meikle: There’s definitely an illusion that iPhones are more secure than Androids.

Chris Cazel: There’s some credibility to that. Apple’s App Store has stricter controls. That builds trust. But it doesn’t mean they’re invulnerable.

Rory Meikle: Yeah, we’ll have to revisit that one.

Chris Cazel: Yeah, let’s link it and take a closer look.

Rory Meikle: Next one: Temu. A report claims PDD is a fraudulent company and Temu is essentially spyware. It has characteristics of aggressive malware. Over 100 million downloads in nine months. Not offered in China. Losing money per order. The idea is they profit from selling user data. Thoughts?

Chris Cazel: Sounds plausible. I see Temu ads everywhere, especially on Twitter. It reminds me of those old “too good to be true” ads. Either it’s a weird business model or they’re harvesting data.

Rory Meikle: What are they doing with all that data?

Chris Cazel: Data is profitable everywhere, not just China. It’s resold to advertisers, brokers—anyone.

Rory Meikle: Fair point.

Chris Cazel: Still, I get why people are uneasy about where it’s going.

Rory Meikle: Next: Cisco buying Splunk for $28 billion. Splunk had a $35 billion valuation in 2019, with $3 billion revenue last year. That valuation seems off. The theory is leadership changed and the company lost momentum. Thoughts?

Chris Cazel: I don’t know much about the business side, but Cisco doesn’t seem as dominant as it used to be. I’ve seen similar patterns—companies like Kaseya or ConnectWise acquiring everything. They don’t always maintain products well; they just absorb customers.

Rory Meikle: How do you think this affects Splunk users?

Chris Cazel: Could go either way. Cisco has credibility with older IT pros, not as much with newer ones. Splunk is expensive—very enterprise-focused. This might open the door for competitors.

Rory Meikle: Yeah, it’s the Rolls-Royce of products.

Chris Cazel: The Gucci.

Rory Meikle: Before we move on—bourbon today: Booker’s.

Chris Cazel: It’s strong. I’m more of a scotch guy, but it’s good.

Rory Meikle: I like the wax top—reminds me of Maker’s Mark.

Chris Cazel: Looks cool.

Rory Meikle: Next: the F-35 crash. Pilot ejected, plane went missing, and they asked the public to help find it. There are claims it may have been hacked due to known vulnerabilities. What do you think—hack or malfunction?

Chris Cazel: Hard to say. I doubt there’s a persistent connection allowing someone to control it mid-flight. More likely a malfunction. Planes are complex—lots of failure points.

Rory Meikle: These planes cost around $100 million each, with the whole program at $1.7 trillion.

Chris Cazel: That’s a huge investment. You’d think vulnerabilities would be addressed. But there are so many systems and people involved—it’s complicated.

Rory Meikle: The autopilot theory suggests it could’ve flown for hours after ejection.

Chris Cazel: That’s wild. But I still think hacking it mid-air is unlikely.

Rory Meikle: Some people think it was remotely controlled after ejection.

Chris Cazel: That feels far-fetched.

Rory Meikle: We’ll see if more incidents happen.

Chris Cazel: Yeah, one incident is weird—multiple would be a pattern.

Rory Meikle: Next: MGM and Caesars breaches. Social engineering of IT help desks led to the attack. Okta confirmed multiple clients were affected. Thoughts?

Chris Cazel: Completely believable. It’s the same type of attack we’ve seen before. It’s just a bad look for an identity management company to fall victim to IAM-related social engineering.

Rory Meikle: There are now lawsuits—class action—over failure to protect PII. Data is being sold for $40–$200 per record.

Chris Cazel: That’s profitable. If you have customer lists, spending habits—you could resell or even blackmail.

Rory Meikle: Or just sell the data broadly. People won’t ask where it came from.

Chris Cazel: Exactly. Data is the most valuable commodity.

Rory Meikle: And the fallout—lawsuits—can be worse than the breach itself.

Chris Cazel: Absolutely. Insurance might cover some, but not everything.

Rory Meikle: And you don’t want casino owners mad at you.

Chris Cazel: Definitely not.

Rory Meikle: Last one: Sony allegedly hacked by a new ransomware group. 6,000 files leaked. They’re selling the data instead of ransoming it.

Chris Cazel: Not surprising. Legacy infrastructure is a big risk. Older systems can’t always be updated easily.

Rory Meikle: What would attackers even do with Sony data?

Chris Cazel: Customer info—credit cards, addresses—that’s valuable. Employee data too.

Rory Meikle: Hopefully not my PlayStation data.

Chris Cazel: Depends how much Fortnite you play.

Rory Meikle: Not much.

Chris Cazel: Then you’re probably safe.

Rory Meikle: That wraps it up. Thanks for tuning in to the Season 12 finale of Security Confidential.

Chris Cazel: If you have feedback or requests for Season 13, let us know.

Rory Meikle: And watch out for Cyber Horror Stories all October—Monday through Friday.

Chris Cazel: If you have your own stories, send them in. We won’t reveal your info.

Rory Meikle: See you in the next one. Bye-bye.