Live Studio Welcome And Setup

Eric Brown 0:00

Some code from some dude's repo and and running it in my environment, but I really love what he did as far as explaining this is how these threat actors approach their trade craft.

Joshua Schmidt 0:16

All right, you're listening to the Audit Podcast live stream. We are in the studio in St. Paul, Minnesota. Today we're joined by the usual suspects, Eric Brown and Nick Mellum, all the way up from Texas, live in the studio today. Nick, how are you doing? Thanks for making it all the way up. I am so happy to be here in between two studs. Just absolute gentleman. Just happy to be here. Well, we have a special guest today coming on the show. She's not here yet, but she'll be coming in hot. Kelly Vensky. Uh, she is the director of business operations here at IT Audit Labs. She'll be joining us today. And uh so we have a little news episode

Nation-State Pressure On Water Utilities

Joshua Schmidt 0:56

set up.

Eric Brown 0:56

Yeah, it's been an interesting couple of weeks here with uh cyber stuff going on, right? So we had in Minnesota and I think 27 other states too have had some nation-state issues in their water facilities. Yeah, you got the article here. So the programmable logic controllers, the uh threat actors had um the actual administrative passwords to these uh controllers. So yeah, interesting. And you know, I I think uh Josh, you were you were saying I seen a comedian saying, you know, why are they picking on the Iran, like it's it's almost comedi.

Joshua Schmidt 1:40

There's a comedic element. Not it's funny, not funny that you know Iran would be targeting Minnesota. It's kind of f uh one would assume that Minnesota's a rather exotic place coming from the Middle East.

Eric Brown 1:53

Well, I I mean I I think uh the the other states, right? Uh you know, Michigan, Georgia, New Jersey, South Dakota.

Joshua Schmidt 2:01

Yeah, that's what it says here. Trevor Burrus, Jr.

Eric Brown 2:03

It's really about the disruption and and um getting in as as far as they can. It's a good bet that if they've gotten this far, they're already in other areas that we just don't know about yet. We we had a little hiccup yesterday with one of the main um facilities in the state of Minnesota, the 511 building. Yes. Which um internet connectivity goes through. And um there was a an outage in that building. I think it was purported to be a a power outage. But we had a a fun time with the security team earlier today talking about that. And you want to talk about tinfoil hats, right? The conspiracy theories were flying. And the 511 building is right across the street from the stadium downtown. Uh yeah, U.S. Bank Stadium downtown Minneapolis. And uh, with all of the the drilling and whatnot, the uh the internet stayed up. So interesting that a power outage could occur in a building that has multiple layers of redundancy.

Joshua Schmidt 3:14

Yeah, I don't know. What's the difference between a conspiracy theory and the news and a fact? Is that a joke? About six months. So it started here last week. So I was on vacation and I got a message from Nick saying that uh Uncle Eric's gonna be on the the 10 o'clock news tonight. So I had to sneak away from my family and and try to record that. And we got it up on our LinkedIn. If anyone's curious, they can they can see uh Eric uh did a little appearance on Fox Nine, who we we've uh been lucky enough to be on several times now. So it started with Plymouth, South St. Paul, was it Maple Plain or something like that? Maple Plain was involved. Was it Baram?

Nick Mellem 3:54

That was the hardest hit, I think.

Joshua Schmidt 3:56

Yeah. And was this kind of the tip of the spear? Like Minnesota was kind of the first to get well that I heard of because we're in the state, but um was was this kind of the first wave of this attack, Minnesota?

Eric Brown 4:06

I'm not sure. It certainly seems like it was. I I think once you are able to get into one system this way, it's probably trivial to get into others through the same attack vector.

Nick Mellem 4:20

Maybe you guys could give a little kudos to Minnesota. Maybe we weren't the first ones, but maybe we're first to find it.

Joshua Schmidt 4:26

I'd like to welcome Kelly Vensky, our director of operations here at IT Audit Labs. Thanks for joining us today. This is our first uh podcast appearance. We roped her in. Um before she could object, we already had the uh announcement out on LinkedIn. So she said she had to go to a client, but I was there.

Nick Mellem 4:43

I was there. She actually was there.

Joshua Schmidt 4:46

Yeah. Do you want that one? Oh no. That's Eric's button. All right. Oh, so we were just talking about the water supply attack and how Minnesota was the possibly some of the first to detect it, if not the first from our standpoint to hear about it. And then uh Nick and Eric were uh going to break down how the Iranian hacker would have gotten these credentials or how they would have gotten in and kind of walk us through the 30,000-foot view on how this all played out.

Eric Brown 5:18

Yeah. So uh by the way, welcome. I think we got an icebreaker after this.

Joshua Schmidt 5:22

Yep. Let's do it. Let's finish this thought and we'll roll back the icebreaker.

Air Gaps, USBs, And Stuxnet Lessons

Eric Brown 5:26

So it basically it comes down to the the systems that are we hear terms um like air gapped, right? And we we we rewind the clock. Was it 2009, the uh the Natans attack on the uh the was it was it in Iran? The um the yeah, the reactors, right?

Joshua Schmidt 5:51

Oh yeah.

Eric Brown 5:51

The Natans um the centrifuge slowed down or altered. Where they they took a USB drive, threw it over the fence, and somebody picked it up, and you know, I think I think it had a spreadsheet with a malicious link in it, but that was able to bridge the air gap because they plugged that uh that device, uh, not that direct device. I think it went from the device that they found, plugged it into a computer to see what was on it, and then that computer was infected and then infected another uh USB device that went into the actual systems that were supposed to be air-gapped. And by air gapped, it means that nothing can cross that barrier. It's not connected to the internet. But in order to update drivers, you have to take the drivers from a non-air-gabbed machine and plug it into that air-gapped machine. And and that's that's how they invented the the attack that caused the uh centrifuges to spin at at a at a very high rate and not be detected by the software that was monitoring them. So they kind of um not all of them, but many were damaged and allegedly it set their nuclear program back. So I think on this case it was similar, but from what my understanding was was these devices had access to the internet or had access through a proxy machine to the internet, and that's how the threat actors got in, is they were able to actually connect to this quote unquote air gapped environment through a machine that um shouldn't have maybe had that connectivity.

Disruption Over Poisoning And Public Fear

Joshua Schmidt 7:31

So they get in to the system, right, or the environment, then what you know, I think it's specifically too, and I'm looking at the article that you know they they weren't actually trying to pollute uh the water quality.

Nick Mellem 7:44

They just were the facility went dark, so they're trying to disrupt service. I think, you know, and I wasn't spent many times or four years in the military, and you know, we we I think we look at these, I look at these texts from a strategic level, right? Like a military force is gonna assault beaches. But this is the most cost-effective way to actually, you know, for these uh countries to try to attack the U.S. because there's no way in. So what what they're just they're instilling fear in the public because even we saw in the news that everybody's afraid to actually drink the water. That's all they're just trying to do.

Eric Brown 8:17

Well, they they did issue a boil alert, too, because I guess the pressure differentials were down. And isn't cyber now the fifth domain of of warfare? It's not the Space Force, which weren't you trying to join up for the Space Force at one point? No, I'm too old for that now. I thought they were taking some chair guys, right?

Nick Mellem 8:32

Where you didn't have some potato peelers? Yeah, they wanted the potato peelers to get in there, the guys that clean the urinals.

Eric Brown 8:38

No, I think you do you could be beyond a certain age, right? Because they needed people.

Nick Mellem 8:43

Their benefits are their benefits are great. I'd I'd join the space. I don't think they're better than our benefits, though. Well, we got HR here to talk about benefits. Yeah, what about our benefits?

Kelly Venzke 8:51

Um our benefits are great. I don't know that they're military benefits, but they're good.

Nick Mellem 8:56

Best places to work. There's no housing. You don't pay for housing here at IT Auto Labs.

Eric Brown 9:00

Well, you can sleep under the desk.

Nick Mellem 9:02

That's why that hammock's back.

Eric Brown 9:04

We do have a shower.

Nick Mellem 9:05

Yes, there is a shower. There's a lot of it's a storage center.

Kelly Venzke 9:08

There is not a shaving kit.

Nick Mellem 9:10

Ooh, that was it. That is true. That was a good one.

Joshua Schmidt 9:13

There has been a moderate amount of PTSD sustained from this podcast recording situation. Well, Kelly, tell us what it was like being with Eric during this water thing. Was he freaking out? Was that taking his attention? Uh, or or what what's it like um, you know, being a partner with Eric when something like that's going down?

Kelly Venzke 9:32

He is all business. So fun Eric goes out the window when there's some security event going on.

Nick Mellem 9:39

What's fun? Let's Fun Eric the one who wears the golf clubs to kayak. We're doing this so that's fun, Eric?

Kelly Venzke 9:48

Uh no. That's the icebreaker. No, that's how Eric.

Nick Mellem 9:52

That's the icebreaker, by the way, Eric. What's the icebreaker? Kelly's like, should I really go here right now? She's giving him the side-eye.

Kelly Venzke 9:59

I'm trying to figure out how far I can go.

Nick Mellem 10:01

Well, we talked about this at lunch a little bit today on the way out. Eric and I did. On the way out, we're talking about Kelly coming on the podcast. We were excited, and uh well, we said we'd hash it out here, so I don't think there's any rules. Eric's like, gosh dang it. He's like, dang it.

Joshua Schmidt 10:17

Well, he already he already told on himself with the plug story. We had the plug story from the kayak almost uh being taken on water.

Kelly Venzke 10:25

We've got a lot of kayak

Kayak Gloves And The Grill Incident

Kelly Venzke 10:26

stories.

Joshua Schmidt 10:26

Oh, do we? We have more.

Eric Brown 10:28

Is this the icebreaker? I think so. Okay. So I mean it to defend myself. Sure. There's no defense. Well, to defend myself, first of all, I hear about so I go out with a customer. We go kayaking. Closing deals. Yeah, closing deals. Right? He wants to go kayaking. I like kayaking, let's go. So then, you know, I had some protective equipment with myself. PPE. PPE.

Kelly Venzke 10:52

That should be a life jacket.

Eric Brown 10:53

Wow. Isn't that all you needed? No, I can swim it. I think the river was like four feet deep. So but you need a glove. Well, it was a hot day. He's got to keep his hands crisp. It's a hot day, right? No. Hey.

Kelly Venzke 11:05

Did you have two gloves?

Eric Brown 11:07

I had two gloves because it's a hot day out. And kayaking is strenuous on the hands. I got to keep the hands.

Kelly Venzke 11:14

I heard it's strenuous on the back, too.

Eric Brown 11:16

That is true. Yeah. So I guess I wore gloves to protect myself from calluses, just like I would in the gym, right? You're gonna lift heavy weight, you're gonna put the gloves on.

Nick Mellem 11:25

Lifting heavy weights or paddling. We are lifting heavyweight at IT ALABs.

Kelly Venzke 11:30

Have you I've never seen you wear you must not lift a lot of heavy weight in the gym then because I'm gonna be able to do not set some more of an aerobic guy.

Joshua Schmidt 11:36

Yeah. Well, we uh had a game night last night uh last Wednesday. I wasn't here. How'd it go?

Kelly Venzke 11:43

I had eye surgery, so I was not.

Nick Mellem 11:45

Oh my gosh. It was me and Eric holding other four. Well, yeah, you know was I set up for failure? No. I wasn't.

Kelly Venzke 11:52

Oh, come on. Eric was in charge of ordering the food for me? To arrive on Tuesday, and I hear you ordered like five burgers. What is this? Some sort of intervention. It's a coup here, Eric.

Joshua Schmidt 12:07

I'm starting to feel bad for Eric now. I I'm trying to do icebreakers here, and Eric's just getting roasting.

Nick Mellem 12:12

It was great. I was happy to be here for the colour. Very much grilling burgers. I think we got the pizza. People were loving the pizza. We got a sheet cake from Bierley. Shout out to Byron.

Kelly Venzke 12:19

What was the flavor?

Nick Mellem 12:20

Uh Marble. I thought it was best of both worlds, you know. We had a painting or uh painted on the top. They put the icing on the top. Happy birthday, Tyler. Shout out to Tyler if you're listening. It's his birthday on Wednesday. Icing on the night. Happy game night. People were loving it. Sheet cake was gone. Pizza.

Kelly Venzke 12:34

People love the game night.

Nick Mellem 12:36

And then one more thing, too. I was standing out in the uh area here by the pinball machines. Oh, here we go. It looks like there's a dust storm going on outside. And I was like, you know, I've been tasked here to make sure the wheels don't come off the wagon. Okay, man, cool. I got it. Nailed it down. I go outside. Luckily, Cam's already out there too, wondering what's going on. Uncle Eric decides he wants to have a grilled cheese. He's got the grill on full blast. Okay. And there's smoke coming out. It looks like the grill's a fire. The grill's at like 850 degrees, and we're throwing water on it. I come inside and like, Eric, are you using the grill? He's like, Yeah, I'm going to make a grilled cheese. Because they're flames, and I said, Yeah.

Eric Brown 13:18

And he said, Okay.

Nick Mellem 13:18

It's a fucking thing. You lit the grill. No, no. So first of all, yeah.

Kelly Venzke 13:23

First of all, okay. From an insurance standpoint, he's a liability.

Eric Brown 13:27

So we turned it down to a low flame. So first of all, okay. Yeah, I ordered the food, right? I did order the food. Um, now it if I'm the one that's responsible for the cook, I'm gonna make sure we have enough food and deal with it maybe before five minutes before it's I did that. That's why I came back 10 minutes earlier with more buns and chicks. So well so yes, we had 18 burgers. We probably should have had twice that amount, but you know, lesson learned.

Kelly Venzke 13:54

The reason that I say that is because when I wrote up the instructions for Nick, and I wrote very well. Very, I mean, bullet by bullet, you said there's more people that come than that. Because I had in then you only ordered straight.

Eric Brown 14:09

Right? You know, it's second set of eyes on everything. We'll blame it on Costco. Yeah, we can blame it on Costco. Because the veggie didn't come in. Where were the veggie burgers? Where were the veggie?

Kelly Venzke 14:16

Did you order them? Let's look back at the order.

Eric Brown 14:17

I did, but then I checked the box. Do not, you know, like don't substitute. So they must not have had them. Anyway, let's get back to the grill on fire. So they cooked the the burgers up, and there's just, you know, there's just fat and grease all over the thing, right?

Joshua Schmidt 14:32

Yeah.

Eric Brown 14:32

I gotta cook a uh a grilled cheese because there's no veggie burgers. Sure. I gotta get all that shit off the grill on high, let it burn off, which is what I was doing, right? Did you stay out there with it? No, I had stuff to do. And then I came back and uh that was it.

Nick Mellem 14:48

You cannot read the temperature gauge anymore. It's just roasted because it was so hot.

Eric Brown 14:53

How is this a security podcast? This is the buttons. I don't know. I think the people want this.

Joshua Schmidt 14:58

I think you kind of like it though, because I think this was this was pre-planned between them. I'm just I'm just the producer. I mean, I got an icebreaker though now. Oh, I don't know. I want to switch gears to something a little lighter. I'm ready. Do your permission? Go ahead. It's coming.

Summer Bucket List And State Fair Takes

Joshua Schmidt 15:14

It's the end of summer. Do we have any bucket list items that we need to do before we got like what three more weeks left till uh Labor Day? That's going so fast. Going to the state fair. State fair, that's yours. What what are you like? Are you a corn cob kind of gal or are you kind of a Martha's cookies? I hate the cookies.

Kelly Venzke 15:31

I don't see the point. I don't understand the point. I can make better ones at home, in my opinion. Same.

Nick Mellem 15:35

So are you a pronto pup or a corndog?

Kelly Venzke 15:38

I'm a vegetarian. This is dang it. But I was a corndog.

Nick Mellem 15:43

Okay.

Kelly Venzke 15:43

I was a corn dog. Um I like what's the ice cream I like?

Eric Brown 15:48

Um Oh, the over where the uh the mouth is.

Kelly Venzke 15:52

It's in the food building. Oh, yeah, but it's flash frozen and they're from Iowa. It is the my favorite thing at the so I go twice. I go once with the kids, once with Eric. Because it's two different experiences. No, that's not bad. It's not a bad that's not a ding on Eric. It's just the kids and I have gone for their whole lives. We've got a routine. Yeah.

Eric Brown 16:17

And I get it, Eric.

Kelly Venzke 16:18

That would be too much for Eric.

Eric Brown 16:22

Eric doesn't go in any of the animal barn.

Kelly Venzke 16:24

We don't either.

Eric Brown 16:25

Yeah.

Kelly Venzke 16:26

We don't go in the animals.

Eric Brown 16:27

They're refer to in third person.

Kelly Venzke 16:29

Yeah. Yeah. But that I do we that and the cheese curts are my favorite.

Nick Mellem 16:33

Oh, yeah. Cheese curts always have a crazy line. The mousetrap or whatever it's called.

Joshua Schmidt 16:38

Yeah. And you don't strike me as a state fair guy. That's coming from a another guy that's not really that's not my jam. I I go for my family and I'm miserable most of the time I'm there. It's there's just not a whole lot to be enjoyed, in my opinion. I'm out on the whole thing.

Nick Mellem 16:51

No, you weren't with me.

Eric Brown 16:52

Yeah, I so I found it I found a way to make it um a good experience. Without alcohol? Without alcohol. Oh wow. It's you go real early, right? And you park like a block away because you can find the street parking. Yep. And you go, you get right in, there's no lines. We we we tried going early the last two years when they had the Georgia place with the donuts, and the line is like a quarter mile long to get these donuts. So I never got the donuts, and I think we went twice to try to get them.

Kelly Venzke 17:23

I got them once with the kids.

Eric Brown 17:25

So this year I want to get back into the carnival side of it, right? Go midway. In midway, and you know, you're throwing the stuff.

Kelly Venzke 17:31

And they've cleaned it up though. Back in the when I was young, that's when the carnies got to banter back and forth with you. Now they everything is PC.

Joshua Schmidt 17:42

Until the fights break out.

Kelly Venzke 17:43

Well, yeah, I'm not there that late though. Now, you know. Uh-huh.

Joshua Schmidt 17:46

Yeah.

Nick Mellem 17:47

After dark, you never know what's going to happen.

Joshua Schmidt 17:48

We we kind of switch it up with uh Renfest. And I don't do dress up. Do you dress up? Sometimes. Yeah. I haven't lately, but years ago I did. Did you dress up? What are you dressing up? I don't have any swag. Not right now, but like a Viking or something. I did have when I was in a band, one of the the bass player uh uh his mom like made us all costumes and we went one year. That was back before I had kids though, but I let the kids dress up as like berries and stuff like that. And then they had mermaids last year. You know, it switches it up a little bit, but uh my rule is I'm not gonna do both. So we're gonna we're gonna pick one. But I heard there's the the original state fair. Where is that out? It's um it's a smaller one. It's just outside of town. I'll have to look it up. But they've got all the county fairs. That's what I'm talking about. It's a county fair, it's not Hennepin County, obviously.

Kelly Venzke 18:32

Oh, they've done we just went to we took your mom to Washington County.

Joshua Schmidt 18:35

That's what I'm talking about.

Kelly Venzke 18:36

Yeah, so right all the counties have their own fair.

Joshua Schmidt 18:38

Yeah, that's way more pleasurable, in my opinion. Smaller.

Eric Brown 18:41

So you get stuck on one of those rides that they're pulling around in the back of a pickup.

Nick Mellem 18:46

Yeah, sure. Yeah. The original run fair, though, started down by me in Texas. And it's still a huge deal.

Eric Brown 18:52

We got a guy who comes to game night, he's got one leg, and he goes as a pirate. Yeah.

Joshua Schmidt 18:56

Cause we lean into it. M my neighbor uh where I live here in the Twin Cities makes chain mail, and he had like a full chain mail shirt that it costs like five thousand dollars to make, and it took him like 900 hours to put together or something.

Eric Brown 19:11

That's commitment.

Joshua Schmidt 19:11

Yeah, yeah.

Kelly Venzke 19:12

I think the big question though is is that is the Minnesota State Fair better than the Texas State Fair? And I have to say yes. Oh well, Texas is longer.

Nick Mellem 19:21

It's like Minnesota. So we have two things in Texas that I'm uh familiar with is the state fair, which is I think it's it's just it's longer than Minnesota, but the grounds that cover in Minnesota are bigger. It's like three and a half weeks in Texas, I think, but we also have the rodeo in Houston. That's almost a month, and it's probably the almost the size of the Minnesota State.

Eric Brown 19:42

Didn't I just read something where they had to enforce a dress code at the rodeo?

Nick Mellem 19:46

They did have to do that last year. What does that mean? Well, because people, you know, you get a little scandal. Trying to be cow cowgirls and stuff. Yeah, but you gotta keep it you know friendly. You know, because you got the whole thing with the mutt, what do they call it? Mutton bustin'. Yeah, they're riding the lambs and stuff.

Joshua Schmidt 20:03

What are you looking at me for? I'm trying to include it. No, I don't know what the hell you're talking about though.

Kelly Venzke 20:09

They didn't do that here, but that just didn't flow right off the tongue.

Joshua Schmidt 20:13

Button busting. I'm from northern Minnesota, Nick. You're asking me about some Texas rodeo and stuff. Yeah, yeah. I'm murdering myself. I can't help you.

Kelly Venzke 20:20

Have you gone to the rodeo?

Nick Mellem 20:22

Yes. Yep. Did you get to Ropa? Uh you can do those things, but it's like just like the state fair. They got all the food and everything you do.

Eric Brown 20:30

Do they have the unlimited milk that you can drink?

Nick Mellem 20:32

I don't think so. I don't think they get down with the milk.

Kelly Venzke 20:36

But the you know that the air show in Ashkosh was like the state fair, but around airplanes. Yeah, yeah.

Nick Mellem 20:42

Yeah, that's cool. Yeah. But then down there, then every night there's a concert, but it's first you they rodeo for like a couple hours or three or four hours in the morning, and there's a big rodeo at night. There's a different theme for every night, with balls, vehicles, et cetera. And it calls a night and you eat the kids, and then they every night it's like a big headliner that does like an hour-long concert at the end, and then it's done for the night. Country music. Yeah, there's a little bit of everything, but mainly country. Yeah, like yeah, the big guys. That's awesome. Real Texas twister, eh? Yeah, it's fun. Everybody's all dressed up, cowboy hats, boots, it's all the whole deal. Did you wear the hat and boots? Oh yeah. Always. Got you.

Eric Brown 21:17

Puss and boots.

Joshua Schmidt 21:18

Yep. All right. Mr. Meowgi can't. Should we get back into the

GitHub Tradecraft Sims And Teams Impersonation

Joshua Schmidt 21:25

news? I was having fun. All right. Well, what's it? Yeah, Eric's ready. We have the Senator OXO APT's and adversary simulation. Geez, this is hard to read. I'm gonna pull it up here.

Eric Brown 21:37

Yeah, that's a deep one.

Joshua Schmidt 21:38

So what is that one about?

Eric Brown 21:39

This one, uh, a security researcher found the different ways that the nation state actors tend to break into environments, so kind of like how they approach their tradecraft. And this researcher put all of his research out on GitHub so that you can download it and simulate it in your environment. Now, can you do it? Sure. I'd be a little cautious about downloading some code from some dude's repo and running it in my environment. But I really love what he did as far as explaining this is how these threat actors approach their trade craft. And we've seen this stuff in the wild where they will impersonate, and this was going around a couple of weeks ago, uh, where they're they'll impersonate a help desk caller on Teams. So Teams to Teams calling from outside of the organization, which is why the recommendation is to block external Teams calls, not the phone calls, but the Teams to Teams calls. Because they'll impersonate that help desk. Hey, we need to jump on your machine. They'll take over control and download some um some things to give them persistence in the environment. But it goes through the different attack factors that are traditionally seen by the different more common nation-state actors. So North Korea, Iran, Russia, and uh and the Chinese.

Nick Mellem 23:19

Uh clients where we are. And if you can you know break it down with an article like this and teach people kind of what we're up against, we might move the needle for funding or or whatever it is, but just teaching leadership um at a at a at a reasonable rate here, you know, what's going on or what we're up against.

Eric Brown 23:36

You're probably maybe partial to the Iranian APT, APT is the advanced persistent threat, because they they're tend to be named um with cat themes.

Joshua Schmidt 23:52

It feels like they should give them like less interesting, cool names, like dissuade people from doing this sort of thing. It feels like it's a badge of honor almost.

Kelly Venzke 24:00

It kind of feels like you, you know, just cuddly.

Joshua Schmidt 24:03

Make it tough. Yeah, it's kind of strange.

Eric Brown 24:06

Whether you find it or engineer it, you get to name it. So you could go DD themed. Ooh, I like that. Roaring dragon or whatever. Roaring kitten.

Kelly Venzke 24:15

What would would they dress up with that?

Eric Brown 24:18

I don't know. I don't know anything about that. Uh Nick used to LARP, I guess. I don't know.

Nick Mellem 24:21

That's exactly what I was thinking about. That's why I looked at you because I was like, yeah, Eric's definitely he's doing into that for sure.

Joshua Schmidt 24:28

Well, he did pick out the article.

Nick Mellem 24:30

He did, he did, he did.

Joshua Schmidt 24:31

Yeah. Well, that's good. Should we have a furry game night here? Do it on the day I'm not here.

Kelly Venzke 24:38

I'm gonna tap up.

Joshua Schmidt 24:42

It seems furry adjacent here.

Kelly Venzke 24:43

What food do you have on that kind of a night?

Joshua Schmidt 24:46

Another good. Bronto pups? I don't know, but I wanted to bring up here a uh someone said uh Faye 9915 said, uh, why is a vegetarian even allowed near a grill? That's a first point.

Kelly Venzke 25:00

I am one of the best grillers at game night. You ask Cameron Birkland.

Nick Mellem 25:04

This is maybe one of the best questions we've ever got.

Kelly Venzke 25:07

I make a well, I became a vegetarian at 40, so I was like, which I mean you were skilled behind the grill before 40. I have been, yeah.

Eric Brown 25:15

Yeah. I don't see why you can't grill as a vegetarian.

Kelly Venzke 25:18

I have no idea how to make a burger.

Eric Brown 25:20

Yeah, but aren't you grilling other things? Yeah, you could grill vegetables. Like if you get one of those blackstone grills, you can have the uh fajita veggies.

Kelly Venzke 25:27

Okay, would you like the do you like the blackstone or the gas grill or a charcoal? What's your favorite?

Nick Mellem 25:31

Well, I mean, it just has so many different purposes. I think the blackstone style is really cool because it just unlocks so many things you can do. Like a smash burger? Yep. Regular smash burgers, French toast. You can do like hibachi style stuff. We can do rice, there's lots of stuff you can do. Does anybody really do that vegetarian? We do.

Kelly Venzke 25:49

I probably would. I I love to cook. I do most all the time.

Eric Brown 25:53

So when I was doing the uh the glider lessons down at in Fairbo, the the guy who's teaching them, he's um he converted his grill into a wok. So at lunchtime, he's making you know these great um scrambles in that walk, and he he put this extra burner that you step on it with your foot and it releases like 18,000 BTUs or something. So it gets that walk really hot. Because you have that flat surface, you can do burgers on it. You could do veggie burgers, you could do everything. Uh veggie burgers aren't allowed, but we don't allow meat burgers on the grill.

Kelly Venzke 26:27

Do you have to bring it in? Is it gonna rust?

Nick Mellem 26:30

Oh, you just treat it. Yeah, you just No. Oh, maybe you guys may have grilled cover. I think it's fine. Grill cover.

Joshua Schmidt 26:36

Grill cover, clean it off real good at the end that you can treat them and Blackstones are a little finicky though, because you scrape the so my I have an old one that was used that was given to me. But I have a Traeger and then a Blackstone. And I feel like I sh sometimes I just want a propane, like a regular grill. My Traeger is an older one and it's finicky. It's because it takes 40 minutes for that thing to get up to speed. And if I don't do it just right, it will stall out on me, and then I gotta take the whole damn thing apart and and scoop it out and clean it up again.

Kelly Venzke 27:04

What I like though about a grill is that you get a grill is different than you're cooking on your stove. Yeah, it tastes better. Yeah.

Eric Brown 27:11

Well, you could get go back old school, get those charcoal briquettes out, get the little carcinogen causers right there. Beat it up.

Joshua Schmidt 27:18

The green egg is nice though to have the prop. No, no. I was gonna say I was gonna buy a green egg before I got the traeger. I'm like, there's way too many freaking parts for this thing. If you need to put more stuff in there, you're gonna you can't because it's too hot. I don't think they're tippy. They look tippy. It's just hard to keep the temperature rolling around. It's just finicky, and you got all these tools and all these accessories and the gods.

Eric Brown 27:38

Did we answer the gas girl? Did we answer Faye's question? I think we did. I think we've seen her Faye on a couple times before. Yeah.

Joshua Schmidt 27:46

By vegetarian, I meant Eric, she says. Oh.

Kelly Venzke 27:49

Yeah, Eric. Well, I mean, when Eric's gonna cook, it's we're gonna order.

Nick Mellem 27:54

So what so if you got a blackstone? If you get a blackstone, what are you putting on the blackstone?

Eric Brown 27:59

Oh yeah, I think like fajitas, you could do like you were saying, breakfast stuff, right?

Nick Mellem 28:02

You could do pancakes, omelets. Yeah.

Kelly Venzke 28:04

I'll I'll create a menu for you.

Nick Mellem 28:06

Excellent. And we get pictures and we'll put it on. Talk about it next time, we'll get Kelly on.

Eric Brown 28:11

Are you roasting coffee?

Nick Mellem 28:13

No, but I have it and I need to do it. Eric donated a roaster for me, and I haven't done it yet.

Kelly Venzke 28:19

We got I was the video person for you.

Nick Mellem 28:22

I inherited that one. Popcorn popper? Yes. Yeah. The popcorn popper.

Joshua Schmidt 28:27

Got it. I I did that once in my apartment and it got really hot. Like it was melting the thing.

Kelly Venzke 28:32

You have to use that whatever the popper is that you gave Nick. That's what you it's a Poppery too. The Poppery 2 doesn't melt.

Eric Brown 28:39

But it can if you do multiple like the plastic on the top. Yeah.

Nick Mellem 28:43

Well, if you gave that one to me, what are you using?

Eric Brown 28:45

I got a I got a real deal.

Nick Mellem 28:48

Yeah. What's the real deal? Like what a roaster.

Kelly Venzke 28:52

Yeah.

Nick Mellem 28:53

But that was for Christmas this last year. He got a roaster. That's cool.

Joshua Schmidt 28:57

Made a present for both of them. Trevor Burrus, you don't want the microplastics in your T Foss.

Kelly Venzke 29:02

He does it, I have to say, I've got to give him kudos. He does a good job with the coffee.

Joshua Schmidt 29:06

Okay. Well, we have to bring some in here. We can make some of that Brad's black, you know, unadulterated. No, no Brad lost privileges. I started drinking black coffee after Brad. I hear it gives you better cardio benefits if you don't add cream or any kind of dairy to your coffee. No alternative melts.

Kelly Venzke 29:22

Are you training for something?

Eric Brown 29:24

Life for longevity. Trevor Burrus, Jr. But scientifically, how does that make sense, though, right? Because you're drinking the same amount of coffee.

Joshua Schmidt 29:31

Don't shoot the messenger.

Kelly Venzke 29:32

And who's the they that told me this?

Joshua Schmidt 29:34

These are scientists that study food. That's where did you read this? This is on Instagram, so it's gotta be true. That's where we were.

Kelly Venzke 29:40

I get some of my things from TikTok, I'll say.

Joshua Schmidt 29:42

You learn from TikTok sometimes. Do you ever follow my wife says it's Dr. Rhonda Patrick? No. Okay. She was on Rogan many times, but Dr. Rhonda Patrick is like a food scientist and she's she's super cool. She talks about all this stuff like health, longevity, all these studies on different different foods, and like how does coffee affect you differently if you have cream in it versus you know no cream and sugar and stuff like that. So it changes the way the molecules br bind and enter the bloodstream, right? So if you put like MCT oil in your coffee, it crosses that uh brain barrier a lot quicker and supposed to hit a lot harder. So, you know, it does alter, you know, the concoction does alter how your body absorbs uh the antioxidants for all that.

Eric Brown 30:22

I don't know. I'm about to get the tinfoil out, but so I we got a buddy of I and we get together a couple times a year, this this group of guys, and the one guy he was responsible for the coffee one year, and we don't make that mistake again. But he shows up, he he brought, he bought like uh one of those five-gallon things of folgers. And I did not inspect the man's you know, what he brought, but I was ready for coffee in the morning and I opened it up. Two folgers, what in the f is going on here? Like, I can't drink this. What was wrong with it? It's terrible. No, I got you.

Nick Mellem 30:59

I thought he had done something, mixed something or done something. No. So family members said. What about Duncan? What about Duncan? Uh Nick, you know, those folders is not.

Kelly Venzke 31:07

My parents buy the folgers at Costco, and they get the Duncan from Costco.

Nick Mellem 31:12

Oh, Santa.

Kelly Venzke 31:12

They get the jumbo folgers. And Eric does not want to drink.

Eric Brown 31:16

No, I won't drink that. Because you have to grind the beans. You you cannot be putting in beans that are I got a roaster from you and I got a grinder.

Kelly Venzke 31:26

You were my secret Santa person.

Eric Brown 31:28

We're copied out. And then we come back the next year, right? We're at this other different dude shows up because I said, All right, we are we, you know, we're good on the coffee. Because you can imagine that, you know.

Kelly Venzke 31:40

You imagine him. Yeah. He's pitching a I mean, like a child's tantra. I can understand.

Eric Brown 31:46

Are we in a cabin here? We a cover. We rented a house. Oh, nice. It can ruin that can ruin your weekend. Bad coffee. Yeah. So dude shows up and he's got like a blade grinder, like he's chopping up spices. And I'm like, could you really tell? Oh, yeah. Because you you've got to run it through a bird grinder so it's the exact consistency.

Kelly Venzke 32:08

I'm gonna try it. We're gonna see how.

Eric Brown 32:10

I would have no idea how to tell the difference. Well, I don't think so either. The problem is the blade grinder, part of it's gonna be powderized and other parts are gonna be chunky. Right? So that powderized is gonna go through the filter like espresso.

Joshua Schmidt 32:25

Oh, that makes sense. Okay. While the other stuff's like, come on, no.

Kelly Venzke 32:28

Nick, you're just agreeing to be nice.

Joshua Schmidt 32:30

How is this security podcast? Oh, this is great. Whatever is kiss us off the coffee topic. Okay. Hey, I'm here for people want to know who we are. We're gonna do the next article now. This is a really wild episode. I like it. Um, Eric, you

Ethereum Command And Control Plus Malvertising

Joshua Schmidt 32:45

also brought this up. This is Etherat. Um, I have not heard of this at all, but I found this nice infographic here on X, and it says here, this is um Etherat uh brought back brought blockchain backed C2 into this in intrusion. Um malicious MSAI masquerading as anyway, you can read it. It's like reading Greek here. Um can you tell us what's going on here, Eric, and uh and why you chose this?

Eric Brown 33:12

So this is another one that we've recently seen out in the wild, so to speak, where they they're really looking at ways to gain persistence in your environment. It's a pretty technical way in which they're able to gain um uh a foothold. But essentially, once they're in the environment, they are leveraging the the blockchain because once something is in Ethereum, you're as long as you allow connectivity into um Ethereum, you're able to maintain persistence in that environment because the the domain names will just keep changing and they'll just they'll they'll be able to redirect pointers to whatever their next staging environment is. Because the the staging environments get taken down all of the time. But by maintaining that persistence, they can essentially keep the command and control connection into your environment. So it it's a good read. It I think it gets a little bit technical, but it is one of the um threat factors that that's out there. So what we're doing in the corporate environments these days is looking to extend the protection not just with um your antivirus tools, but bring that into the browser level. This one in particular is interesting because they're not specifically, or in this example, not specifically targeting an organization, but they are passively putting the lure into a Google or a Bing paid advertisement. So Bing. I haven't heard about Bing for a while. Well, you can essentially buy ads in Google, Bing, what have you, and point the payload of that of that ad to your staging site, which is what these threat actors do. So when an engineer at an organization, and and I think this is the one where they were targeting more of an engineer or more of an administrator type of um person that would be going out and searching for a particular type of tool to do their job. Maybe it's a FTP application or what have you. And if you typed in the name of the application into the browser search engine, that paid advertising link is gonna come up at the top. And instead of people actually scrolling through and looking for the link that comes from the organization, they're gonna click on that first link potentially. And if once that happens, that is how the payload is delivered. Um that's what I talk about when we talk about moving the protection into the browser and getting away from the commercial browsers and getting into more secure browsers. So Palo Alto's got a secure browser, Island's got a secure browser, and uh Cloudflare's has got uh similar way to do it.

Joshua Schmidt 36:17

That one way over my head. Can Nick and Kelly shed some. Kelly can I think.

Nick Mellem 36:21

This is heav this is what is heavily focused on social engineering. I think I would classify it down there. And that was what really makes me the most interested in these two, is because I I love that aspect of the social engineering part. But uh you know, like Eric said, it's using the you know, an ad. And I think the administrator part is key, but it's just it's preying on that person that's gonna click that and think, oh, this is out of date. I'm gonna update this because that's the right thing to do. And you know, that's I think that's the key of it. You see something's out of date, you run it, you you make it uh you know, you get it up to date.

Eric Brown 36:57

Or you you need a an application to do your work. It's not on that server. You're gonna go out, you're gonna try to find it. Uh but we're exposing and uncovering a lot of just bad behavior in environments where you have people who are administrators and have administrative privileges on a server, but they're logging in with their daily driver account instead of a an administrator account. So then their daily drivers, yeah.

Nick Mellem 37:21

Should their daily driver have access, though?

Eric Brown 37:23

It should not.

Nick Mellem 37:24

It should not, no. No, police privilege. But in it, you know, they're getting a screen sharing tool to install, right? So they're getting that remote access.

Eric Brown 37:32

And so in the home environment, I like to block all of the Google ads.

Nick Mellem 37:36

We talked about this before the show. Here you go. Keyed her up. She can't buy her red bottom shoes.

Kelly Venzke 37:42

Well, I can't buy them anyway. You can buy them.

Eric Brown 37:45

Just don't click. Why do you need the Google ad? You don't need that stuff.

Kelly Venzke 37:48

I want to click on what I want to click on. I do not need to be blocked.

Eric Brown 37:51

Trevor Burrus, Jr. And this is why corporate environments are compromised.

Kelly Venzke 37:55

He's got me locked down. Locked it down. And I and I do not yeah, lock it down. And I do not like it. So for anybody that does listen to the podcast here, when he's explaining on the what not to do items, he he might be talking about me. He he might be. I might be the tester at high. I might be the tester. Guinea pig at high. And and I you know, when he talks about people throwing a fit, yeah, that might be me too.

Eric Brown 38:24

We're getting a whole new side here. Yeah, I I I might you gotta keep that corporate environment, the home environment, particularly squeaky clean. Yeah. I don't like it. The pie hole guys on.

Kelly Venzke 38:33

I have to I have to go off of Wi-Fi to do the things I want to do.

Nick Mellem 38:38

That's where we go. This is kind of two. I also think about this one. It's like a to me, uh, it's also a version of like this is a stretch, like living off the land, like what's already on an app in an environment. So, you know, uh especially non-tech people, HR, whoever it is, they're gonna think of these tools that are perfectly legitimate and not think anything of it, right? Where maybe that's somebody's trained, maybe that's helped us personate sys haven, whatever it is, they're gonna see these tools and probably get tipped off. But I think the point here too for that thinking is if you don't notice it right away or you're not trained, that's just that much longer. The person is living here because they're not sending off any bells and whistles if they're living off the land. Right. So they go undetected much longer. And the tools aren't aren't sending any whistles or blowing any whistles off to the people that are watching for these things. That's that's

Browser Safety, Extensions, And Patch Timing

Nick Mellem 39:29

a big problem.

Joshua Schmidt 39:29

What browser do you all um prefer if you're using a secure browser? I mean most people use a browser? Or you mean just in general? Just in general.

Kelly Venzke 39:37

I mean, don't ask me. I mean, I I use Google Chrome or Firefox. I use Chrome and he has a fit. I didn't even want to use a password. I was mad when he told me he couldn't save my passwords in that browser, and I was not happy.

Eric Brown 39:54

You can't put your passwords in the browser.

Joshua Schmidt 39:56

I've also been a password evangelist after that. You got me set straight. That was one of the first things I changed. I'm like, if I'm gonna be on a cybersecurity podcast, I don't do it anymore. I've got a password evangelic.

Eric Brown 40:05

Hopefully you locked your credit too.

Joshua Schmidt 40:06

I do. Yes. I have that frozen. I'm I've I've listened. I've been listening there. Yeah. You know, we got SIP Cyber, and we do have some um nice tips on here from time to time when we're not bantering about kayaking or grills. But uh I I guess what would be you know, what would be a tip to um cybersecure br browsing um uh other than the obvious things we've already talked about, not storing your passwords in the browser? Is it not using Chrome? Is it not using uh a Safari or using a Firefox?

Eric Brown 40:39

I think it's being diligent about the extensions that you install and about the sites that you visit, um, and then what other protections you might have on your network, like you know, we had the pie hole episode on maybe a year or so ago. What's some of the additional tools that you can put into your environment?

Joshua Schmidt 40:56

I'm always really aware of my extensions, especially now that you can get LMs on your uh on your browser extensions. And so let's say you're you got a cloud, a cloud um extension going. Do you uh have a separate browser just for that so it's not connected to your email sign-ins or even is that still hold if you're still using Bitwarden or a password manager, or or how can you make sure that your your browser is secure if you're running an uh LM extension?

Eric Brown 41:22

You can run the um LLM extension in a separate browser. So you could run that in, say, Chrome, and then you're doing your other browsing work in, say, Firefox or what have you, and then it's isolated today.

Joshua Schmidt 41:38

Aaron Powell But what about if you have a separate sign-in or separate logins, say on like Chrome, um, and you have you know six different logins? Can you create a login specifically for your for your LLM extension browsing and still have that you know segregated from your other browsing?

Eric Brown 41:57

Yeah, so it so it wouldn't necessarily have access to your Gmail or whatever else.

Joshua Schmidt 42:01

How but I know you guys have also told me not to stay signed in. Don't click the stay signed in button. That's another good one. Yeah. What's the problem there?

Kelly Venzke 42:10

Aaron Powell My question is it's kind of related to this, but when there's like patches or things, how quick do you ever wait to patch for any reason?

Eric Brown 42:21

I don't wait.

Kelly Venzke 42:22

I'm just wondering because I don't want to use it. Do you wait to see have somebody vet it?

Eric Brown 42:27

They used to have these old like network relics where they're like, yeah, we just install the Cisco and we never patch it. It's like okay, dude.

Joshua Schmidt 42:32

Yeah, now we can't use it, yeah. K Kelly, my foible is that well, I use a lot of third-party software and third-party plugins for my audio engineering, my audio producing. And there's no way those developers are keeping up with the iterations of um Mac OS software updates. And if you can keep those, if you keep those um automatic updates on, you might go to work one day and just not be able to use. And this has happened to me, where I tried to use um Final Cut Pro one day and I tried to log in and just wouldn't work because my extensions were stalling. And so I got to like the boss level uh uh, you know, help support where they actually get get on your computer and they're like, oh yeah, we there's nothing we can do. This is a third party, they have the information. And so basically it was just like you just got to sit on your hands and not work. I was like, so I'm not so I can't work today. And I don't know when I'm gonna be able to work until this third-party software development company gets their stuff together to update their patch and then install that update. And so that's the problem. So especially with all I know a lot of um music producers and like video producers, you just can't because you'll just won't be able to work. And um, so yeah, we try to stay not on the cr very tip of the wave, on the kind of the back end of the crest of the wave, so to speak. But uh I know that makes the cybersecurity folks anxious.

Eric Brown 43:53

Chief excuse officer, you should just the amount of excuses that come in is mind boggling. But here's my question.

Kelly Venzke 44:01

As the boss as one of the bosses, somebody says I can't work because my software won't work on this version of the OS, what are you saying?

Eric Brown 44:09

Go get a different software.

Kelly Venzke 44:12

Is that what you're saying?

Joshua Schmidt 44:13

Sometimes there's not another software though. Sometimes for in my case, the Final Cut Pro wouldn't launch because it was searching through my I would have had to un install, uninstall, which is what I ended up having to do, uninstall all those plugins so that it would actually run. Because you know, when a you pull up a program, it like loads all the software and the extensions, right? So but there are some like plugins that won't do that, or you've already built out a whole project that has all those plugins baked into it.

Kelly Venzke 44:40

You have days of work that you now lost.

Joshua Schmidt 44:42

And there's no and all the way, the only way to do it would be like restart the whole thing or like fix every single one of those with a different plugin.

Eric Brown 44:49

So devil's advocate. So we have a house in Tahiti. And when these things come up, I like to say to the person, you know, why don't you you know take a couple of weeks off? Get your plane ticket, you can relax at the house in Tahiti.

Kelly Venzke 45:03

I haven't either. What who is who are you this like a pontoon?

Nick Mellem 45:07

It's like the pontoon story.

Kelly Venzke 45:10

I want to know who he's got at his house in Tahiti.

Eric Brown 45:12

Well, it's any coffee. Anyone who's gonna use a software issue.

Kelly Venzke 45:17

That's what Brad would say.

Eric Brown 45:18

If they have a software issue, they can go to that house in Tahiti.

Kelly Venzke 45:20

Can I sign up for a software issue?

Joshua Schmidt 45:23

All

Closing Notes Plus The DJ Mixer Question

Joshua Schmidt 45:24

right. Well, we're here. You guys want to wrap it up? Anything else? Anything else we need to air out here today?

Nick Mellem 45:30

I don't think so. No, we got pretty good.

Joshua Schmidt 45:33

He's coming back. All right. Well, it's great to have Kelly. You're definitely coming back. And uh and on time this time. Yeah, Nick, thanks for being here in the studio today. You've been listening to the audit presented by IT Autolabs. I'm your co-host and producer, Joshua Schmidt. Been joined today by Kelly Vinsky, the usual suspects, Eric Brown and Nick Mellum. Please like, share, and subscribe wherever you stream your podcasts. We do have video now on Apple, Spotify, and uh we'll catch you in the next one. Thanks for listening to this.

Eric Brown 46:03

Sure. About DJing. Sure. Why did the DJs always I'm not a DJ, but I'll try to answer this. Well, I see you touching the mixer. Why are they always touching it like it's hot? You know, like you know, they're just firing off the performance, actually. Like like that? They're f they're firing off a button. But why, you know, why make a big production out of it?

Kelly Venzke 46:22

Well, because you're performing the cat hands?

Eric Brown 46:24

Yeah, why are they because you're performing?

Joshua Schmidt 46:26

That is true. Like they're all over the place. Right. Because you're into the music. You know, it's like a dance, you know. It's like why is a guitar player make any gesticulations? I mean, you're feeling it. Okay. You know, it wouldn't it be boring if you're just like sitting. I mean, it's already boring watching a DJ, in my opinion. Right. So you gotta put some showmanship to gesticulate a little bit. A little spice, you know. Okay. I hope that answered it.

Eric Brown 46:53

Thanks for watching. See you in the next one. You have been listening to the audit presented by IT Audit Labs. We are experts at assessing risk and compliance while providing administrative and technical controls to improve our clients' data security. Our threat assessments find the soft spots before the bad guys do, identifying likelihood and impact, or all our security control assessments rank the level of maturity relative to the size of your organization. Thanks to our devoted listeners and followers, as well as our producer, Joshua J. Schmidt, and our audio video editor, Cameron Hill. You can stay up to date on the latest cybersecurity topics by giving us a like and a follow on our socials, and subscribing to this podcast on Apple, Spotify, or wherever you source your security content.