Unauthorized Opinions 05: Urgently Hiring! Someone to Patch the FBI
https://codykretsinger.com/podcasts/unauthorized-opinions/5

Narrator:
This is Unauthorized Opinions, part of the Threat Aware Podcast Network, where the Galactic Security Team says exactly what's on their minds. Unfiltered takes on the cybersecurity threats, trends, and stories that matter most to the people defending real organizations. Here's your host, Max Kurek.

Max Kurek:
Welcome in. We're glad you're here. I am joined as always by Galactics Director of Security Research, Cody Kretsinger, security analyst Aidan Brown, and Galactics President and Chief Security Officer Seth Loe. Gentlemen, hello. Welcome to another session of unauthorized opinions. And it is officially spooky season. The season is here. The weather is starting it's starting we're starting to feel a chill in the air. The leaves are turning. So does anybody have like any costume lined up for later in the month or you know, anything that they're doing to celebrate the spooky season now that we're here?

Cody Kretsinger:
I'm gonna go as a ten out of ten C V S score vulnerability that no one's patched yet.

Max Kurek:
I

Aidan Brown:
S

Max Kurek:
Was gonna say something

Cody Kretsinger:
Yeah.

Max Kurek:
Tells me like there's a Reddit forum that can help you put together a really compelling visual costume of how that looks.

Cody Kretsinger:
Alternatively, it would be the Kev, you know, the known exploit list, somehow. One of those two.

Max Kurek:
There we go. We've got a juicy one for you guys today. We're talking about something that you have absolutely read about, even if you're not a regular consumer of tons of cybersecurity news, because on September 22nd, a threat actor defaced a page on the FBI, yes, that FBI's recruiting website with a banner saying that the site had been seized. And then they actually went to reporters and said they had taken data on current, former, and prospective FBI employees. And wouldn't you know it, the jobs portal and the applicant portal both went dark not long after.

The threat actor themselves, they cited a zero day in Oracle PeopleSoft, which is the software platform that was running the jobs site as kind of the way in. Followed by some remote code execution and then some lateral movement onto FBI managed servers. And those same threat actors said they reached human resources, they reached medical, they reached criminal justice systems, and they walked out. To be clear, this is the threat actor's number with two to three terabytes of data that is unconfirmed by other sources at this point, but that is the claim here. Having said that, in terms of confirmation, Reuters actually took a sample and individually verified details on more than twenty-two individuals.

And what they came up with was, I mean, for lack of a better term, pretty comprehensive and pretty shocking in some cases. Names, home addresses, dates of birth, social security numbers, emergency contacts, even things like field office assignments, descriptions of intelligence and counter espionage work that was happening. So there was internal employees impacted, but a lot of f applicants impacted by this. We'll unpack more about that in just a minute. We may have some experience on the panel in that regard. And the other thing to be clear on, there was no ransom demand here. What this threat actor wanted, actually, this was a this is a reputation management play.

They wanted the FBI to retract an advisory that the Bureau had published in May describing how this specific threat actor operates. And in terms of a response, the FBI confirmed the incident on September twenty-fifth. So that was about three days after all of that unfolded, but said at that point it had no knowledge of where the breach started. But then on October fifth, the guy who runs the FBI's cyber division, a guy named Brett Leatherman. That's I don't know, that that's okay.

Seth Loe:
Can I weigh in on this? Because

Max Kurek:
Yeah, please.

Seth Loe:
To me, this is the name you pull out of the hat at 2 a.m. When you're writing a detective novel. The publisher saying your deadline is 8 a.m. And I'm like, I don't have a kick-ass name yet. And you go, Brett Leatherman. And that sticks. Just such a great name of an individual to go on camera and basically threaten the hacker group is what that announcement was. It was a minute forty nine seconds worth of you picked the wrong guy to mess with.

Max Kurek:
And Brett is a career FBI guy. Like he has been at the bureau since the early two thousands, I believe. So yeah, he he's not AI generated, and he runs FBI Cyber Division. And he said just a few days ago from when we're recording this episode that their internal review had found the cause. They cited a security failure on a platform managed by a third-party organization. We're gonna come back to that. There's a lot to understand. There, after a contractor failed to install a patch that had been issued specifically to secure it, obviously the assumption being where they're talking about Oracle PeopleSoft as the platform, they did not say who the contractor was.

The FBI didn't, but only that they were removed. Reuters reported later that it was a contractor from Accenture, and that's kind of the generally accepted belief there. There have also been arrests. Including one in the Netherlands, which actually happened a full week before any of this c was claimed publicly. And I know Seth might want to get into that a little bit more. I just want to be clear on one last thing. A couple of things we don't know. The FBI ha themselves have not named a specific vulnerability or cited a specific CVE on this.

Like in terms of getting to that level of specificity, there's conjecture out there, and if you want to go looking, you can find a CVE number that some folks think. It could be. The threat actor says it's not that, you know, whether that's true or not. The FBI has also not said how many people are actually affected by this. And the attacker claims that the bug that they used has no patch at all. So they're actually kind of saying the opposite of what the FBI is. So, anyways, there's a ton to unpack here. We're gonna talk about the attack vector, we're gonna talk about the target and the fact that this happened to the FBI.

We're going to talk about the response, but I kind of want to start at a more basic level. And Aidan, I want to come to you first on this because at its core, to any just like security layman, like somebody like me reading this, this strikes me as a very classic example of a supply chain attack, right? We're talking about a third party piece of software. Yeah, it happens to be the FBI. You know, there's a lot of notoriety that goes with that. But on the surface, this seems like a relatively simple supply chain attack, unpatched vulnerability.

So I guess what I want to ask you is, is that kind of your initial read on this too? And if so, like how should we start to think about this risk in particular? Putting aside that this is the FBI, we'll get to all that in a minute. But just on the surface of, hey, this is a supply chain attack, we're talking about unpatched vulnerabilities. What are the primary things from like an attack vector and remediation perspective that folks should be thinking about as they're reading this story and trying to contextualize it for themselves from your perspective?

Aidan Brown:
From my point of view, there's two parts or there's two sides to the story, and both are not very good, whichever one is true. The I think the first one is more concerning, which is there there's been sources out there claiming a CVE that was released in June by Sissa, added to the Kev catalog two days later. If we think about it, if that was the case, that CVE came out. Three months ago. Three months ago. That means if that's what the attackers used, that vulnerability, that gap in this software, in this Oracle software, was unpatched for three months.

Which is crazy to think about. Again, the to answer your question, Max, that that's security one one patching a vulnerability when a hit a patch and update gets released. And I mean, if we bring it back to this being the FBI. This CVE getting added to the Kev catalog gives federal agencies specifically a deadline to patch that vulnerability, which is obviously not three months. So again, I hope that is not the case. I hope this that vulnerability, this CVE that some sources are stating is how they got in. I hope that is not the case.

Cody Kretsinger:
Yeah. There was supposed to be a WAF that should have been able to catch this. And if I if there's many, many, many layers to this. And I feel like if there wasn't a patch that was supposed to be applied to the system, maybe they relied on the web application firewall a little too much in the interim. Because w let's be honest. All of us have patched systems before. Sometimes there's a system an organization identifies as being too critical. For a patch to be updated. I'm not saying in this case this shouldn't have been updated within these several months that it was on the noin known exploited vulnerabilities list.

But what I am saying is, and I can't believe this these words are gonna come out of my mouth, I can give a little bit of grace to the feds in terms of trying to put some kind of other solution in place in the interim. Knowing that maybe potentially they needed to make significant upgrades to the PeopleSoft

Seth Loe:
The FBI can put responsibility on a third party, but they cannot, you know, give up their accountability for this. And I too often what I see, and the mistake that I see made here is that somebody does a vendor risk assessment and they go, it's Accenture. They're just one of the best name known names in doing this. Low risk, move it on. Wait, it's PeopleSoft. It's one of the most widely used, you know, human resources, people management software's on the planet. It's got its game together. Low risk. Move it on. I don't know what the web application firewall was, but what I did learn is they only needed to change one character in the web request in order to bypass a poorly a poor configuration and get to that unpatched vulnerability.

So I don't think we can give First of all, the FBI a pass on accountability. I've already said that already, but when it comes to the responsibility of these systems, it seems to me like a failure in the software guy going, I can get around to that patch after we answer all these administrative concerns. This patch is going to cause this problem, that problem, this problem. We need to get the administrative concerns out of the way because the web application firewall team will prevent any unauthorized access to the system to begin with. And then the web application firewall team going, Hey, you know, we got our game together.

We configured that thing in 2024 and it was ready to go. Right? Rare to go on that old configuration. We didn't need to revisit that at all. And oops, we left two gates open at the same time. You know, and I think that is a layer of complexity and a layer of risk assumption. I mean risk that you are assuming when you go with an outsourced strategy is the more layers of complexity in the administrative in the administration of these critical systems you add, the more points of failure you're also adding. And who knows, maybe it was the same team that was responsible for both and they made a hiring firing, they made a vendor contract decision, you know, and that's problem solved.

We took care of it. But, you know, For the attackers to claim, you know, hmm, no, you didn't really patch it. This wasn't that particular vulnerability. These aren't the droids you're looking for. Had to get the obligatory Star Rose reference in there.

Max Kurek:
Counter sitting at one so far for this episode.

Seth Loe:
Yes, it is. For them to s for them to say that, that means that the problem isn't solved just because they changed vendors. Right? The problem wasn't just a configuration on a web application firewall or a poorly executed patch management plan. The problem was an overarching strategy for managing the security of a system that you outsourced. And that's something that the people who are accountable for it can't just push off. To a vendor and say we fired and we got a new vendor. And also, if they really they were down for one day. If they really swapped out a vendor on two terabytes worth of data in one day, that is the fastest vendor swap I have ever seen in my entire life.

Max Kurek:
So I Aidan, I wanna you mentioned security one hundred one and Seth and Cody kind of alluded to something here with like a defense in depth approach and maybe there being multiple gates that failed. I mean you analyze a lot of environments and you're doing a lot of this research every single day. And again, this might be a layman asking this question, but does defense in depth ever Can it ever cause a little bit of false sense of security from the perspective of the mindset of, well, I've got all these layers of protection, right? And if this thing doesn't catch it, this thing's going to.

And so I don't really necessarily need to be paying as close of attention as I probably should be to keeping these things patched or making sure these firewalls are configured properly, because even if I miss something, right? The other thing is going to catch it. And then next thing you know, Three months later I have firewalls configured incorrectly, alongside systems that are unpatched, and now all of my gates have holes in them. I'm just wondering like, is that a trap that people are falling into or am I just kind of inventing a problem where there isn't one?

Aidan Brown:
Hundred percent. Hundred percent. One thing I learned about studying for the CISSP exam was one of the concept on building a security architecture is kiss, keep it simple, stupid. I mean everybody has heard that. Keep it simple, stupid, because something the more tools you add to your belt, you said to yourself can add this fake sense of security. This Fake senses of security, the more tools I have, the better we're secured. But the thing about a lot of these tools, they come with these default settings that may work for some or environments, but may not work for others.

And some default settings may not be as secure as you need it for your certain environment. And maybe they create some a lot of false positives, a lot of false negatives in for your specific environment. So like The word that came to my mind, or the concept that came to my mind when you asked that question is the more tools you add, is the alert. I can't imagine the alert fatigue that you that some teams will get when you start adding more and more tools. You're getting more and more alerts. And this, I know Cody, you had you have a saying for this.

I think it's like crying your alerts start crying wolf or something like that. I know I'm messing it up, but I know you you've told me in the past something along those lines. But again, the alert fatigue, all these alerts that you're getting from all these tools, from all these different dashboards that you have. I hope you have a 49 inch monitor if you have all these tools. But I can't imagine looking at that and trying to pick out which ones you need to actually listen to, which ones you actually need to act on, and which ones you don't necessarily need to.

So again, keep it simple, stupid. Is a great concept with so many tools that these guys can get.

Max Kurek:
This was the frickin' FBI that we're talking about. And I will put our normal I will put our normal caveat on it here. We're not intentionally getting political with any of these opinions. We're sticking to the facts and we're sticking to the institution itself, not the individuals inside of it. Cody, you are a fitting person to begin this discussion of the fact that this is the FBI because I Feel like I heard you maybe have a special you have some friends over there. You have a special relationship with the folks at the FBI. Maybe in a previous life you spent some time hanging out with them in certain rooms and certain facilities.

But here here's what I want to ask is regardless of where your personal opinion on the FBI was entering this conversation. Does this change your assessment? Does an event like this change your assessment of the FBI's security capabilities, their legitimacy as a security organization? I just like what are the biggest what are the biggest holes in the armor now for the FBI as a result of this incident?

Cody Kretsinger:
Okay, so no, it does not change my opinion on either one of those things. The their legitimacy or you know how well they may operate or their capabilities or anything on along those lines. And there's a few reasons for that. First is, and I'll try to be brief here, is how threat actors identify targets. So PeopleSoft had this vulnerability. The threat actors were searching the internet for instances of this. This vulnerable product in order to exploit. They come across the FBI jobs website and they go, boy, wouldn't that make for a great target? And then they leverage it.

It had the FBI been vulnerable in a different way, eventually they would sorry, the threat actors would have exploited those vulnerabilities. It's just a crime of opportunity to a certain degree. And then because it was the FBI, it carried extra weight in terms of what you know, severity or news cycle stuff. Things along those lines. The other flip side of that is

Seth Loe:
A yeah.

Cody Kretsinger:
They were very good about updating folks as things were going on. Despite some of the messaging and all of that, it was within a couple of days of a threat actor announcing stuff. And that's how threat actors are doing this now is you get on a victim page and they're publicly shaming you. After the fact. So and they're not trying to exhort you with you know ransomware or anything like that, and they're already giving the data out for other people to download. That's just pretty much normal course. So the FBI was responding like any other organization was going to respond.

They did it pretty good. I thought it was fairly interesting that they rotated their contractor fairly quickly out of all of this, which means not only did they Not only did they do the thing that Seth and Aidan hit on, which was totally arm's length the liability of this and wanted another organization to own it, then they decided, well, we're not going to go internal with it. We're going to hire a different contractor now, after we were attacked, and maybe they'll do a little bit better, which will be interesting. Because there's a lot of parallels between this and the OPM breach that happened.

My goodness, what was it? 10 15 years ago, of which I was personally infect or affected by and not because the FBI arrested me, to be clear. It was because I had applied to go work for the NSA and had to fill out an SF eighty six. So there's some parallels here. I give the app the poor applicants in this. The applicants the vi are the true victim here. And unfortunately, some of the most private details of who they are. What they've done professionally as well as things that could impact them are now in the hands of anybody that wants to leverage them in a very public way and they will need to take precautions for the foreseeable future and then also probably throughout their lifetime even if they didn't work end up working for the FBI just being an applicant they're gonna be impacted by this and that's not an insignificant amount of people

Seth Loe:
Would like to just hit for a moment on how personal this is all this all is. I know we are a cybersecurity podcast. I know we talk tech, we talk security measures, we talk tools, we talk all kinds of stuff. But when you think about the chain that's you know, the chain reaction that has occurred here and the chain of events that set all this in motion. Somebody who sees themselves as the hero of their own story, and we all see ourselves as the hero of our own story, had set their own version of a moral line in the sand that they would not cross.

The FBI accused them of being on the other side of that moral line, and we kick off a cybersecurity incident over it. I think it's important that we understand that every even cybersecurity incidents that are motivated by money affect people. At the end of the day, it's a person who gets hurt. That can be people who lose their jobs because businesses close their doors. That could be people who have grown businesses as their life dream and have to shutter the doors on something that they spent decades building. People always get affected by this. And I think this is one of the clearest one of the clearest stories around.

Human. So we have got a group of attackers who had a very personal human reason that they report for having done this. And can I say it does seem to me like on the list of options to get somebody to change a blog post, which is basically what this is, somebody had to say, you know, could we just send them an email? And they go, Yeah, nobody reads email anymore. This this'll get us the results we want. Down to, you know, and you can follow this chain through. Let's even let's step back and get meta for a moment.

You notice how we are being careful about how we handle this on a personal level. There are choices that we've made around how we're going to talk about this. Had a lot of fun with Mr. Leatherman's name at the beginning of this podcast. But you know what? That was probably his data that got breached. So when he steps up and says you mess with the wrong people, that's coming from a very personal area for him. That is his children's names and information, his family's addresses, social security numbers of all the people he knew. And, you know, Cody and Aidan did a great job of talking about the forms that you've got to fill out in the interview process that you have to go through.

There are mental health questions on there. That means thousands of people have answered questions like With answers like, Well, I was abused and I went and sought therapy for that. Or when I was in college, I was having think thoughts about doing myself harm. And I went and got help for that. The help worked. I got better. And now I'm here and I want to be a part of the solution. And now those folks who maybe didn't even win a job out of it have regrets and may have regrets. And they're they are relying on a group of people who said, We did this.

And we don't intend to release this information, we're they're relying on them to uphold their word on that, right? So we will we'll even see on the tail end of that the strength of the original moral lines that had been drawn, saying we don't exploit these things, we don't do these things, we don't shame people. We'll get to see if that moral line gets upheld. So I think that's a really interesting human element to the motivations behind this.

Cody Kretsinger:
Seth is a hundred percent right. And I can give some perspective from the attack side as well, right? Let's there's a giant elephant in the room. There are some parallels between these threat actor groups in Lolsec. I was on Lolsec. We hacked Sony. We compromised people's information. It was about 1.2 million different records, and we posted them publicly. We gave a torrent of all of that information. And having been on that side of it, I can say I was so wrapped up in the Sony situation, in the let's go for Sony. We don't like Sony.

We're we need to make a statement. We need to make it hurt. They need to understand how much they've upset us. And very little of that was these victims that we are going to publicly put all of their information online for. What is going to happen to them? And to be fair, this is before the days of credit monitoring and all of that really kind of took off for my particular attack. But it's taken me years to recognise the damage that I could have potentially caused each one of those individual victims. And I think it's incredibly important to highlight the fact that at any point any one of those individuals could have been targeted because of the information that me and others decided to put online because we decided We didn't like Sony.

And we carried out the attack. So there's going to be some very big things that not only the threat actors are going to have to wrestle with, but from the victim standpoint, it's not only the FBI, but all of the actual victims, which will be the individuals that have their information released out of this. And we don't talk about that often enough. And as you alluded. As being on the incident response side, knowing how the bad guys think and being able to help organizations through all of that, it is something that you have to consider.

And I can't tell you how many, how many conversations I've had with a board of directors or C suite or maybe just a small mom and pop business where they just say, We'll do some credit monitoring. How much does that cost? Okay, that's great. Let's move on. And that's the extent of the conversation that they have for the victims. I am almost certain. Those types of conversations happened kind of like that in this particular one, with no real deep thought given in terms of how absolutely vulnerable these individuals may end up being based on this single attack.

But it is important. It is important to make sure that the human element of this actually gets thrust to the front and addressed in a really, really good and actionable way. I it's incredibly unfortunate.

Aidan Brown:
I I'm so glad this is where this episode went with this breach because you Cody, you said something there. You said this is something we don't talk about enough. And honestly, I don't know why. So I fall into that boat too. When I'm scrolling through threat intelligence feeds, you see so many breach happen. Breach happened. This is how many records got exposed. And again, I myself, I fall into that boat of I scroll right past them because they become unfortunately more and more common. And I don't know why, but this one, which is why I'm so happy this is where this episode went, this one really put that put it put this idea back into perspective that this there is a human element to every single cybersecurity incident.

And it's just something that needs to be talked about more and more, more than we are right now, more than just we'll do credit monitoring, what does it cost? Kind of like you were saying, Cody. So I just want to say, like, I if you're out there listening and you're like, man, I haven't been paying attention to these, like, I I'm right there with you. I scroll past those stories all the time. I look for the 10 out of 10 CVE vulnerabilities where I'm scrolling through. But these kinds of stories, these breaches, we need to remember the people that they're gonna affect these millions.

These we don't know the number of records, but they're claiming two to three terabytes of data. I don't even want to think about how many people that may or could be. So yeah, I just want to throw it out there.

Cody Kretsinger:
Yeah, and I promise this is it's same thought, train of thought as well. So I always joke that you need to feed and water your IR folks, but you also need to feed and water the rest of your staff, right? Because we often forget in an incident to do that. But the that aside, keeping it human, there's two things that I bring with me to every single incident, and one of which I lived, and one of which I lived through a really good buddy of mine. And through that buddy of mine, he told me a story of an incident that he worked, and essentially what it boiled down to is a hospital.

He gets the phone call at two o'clock in the morning, and the CISO says, we're not measuring downtime, we're measuring the loss of life based on this incident. And it's non zero. And my goodness, that puts it in perspective. That puts it human again. And the one I lived was a case that I actually helped the FBI with fairly recently where a specific threat doctor was targeting a very specific vulnerable type of person and putting very, very specific photos that were compromising online about their victims. And that led to more than one individual taking their own life because of those pictures being online.

And these are really, really awful stories. They are awful stories that have resulted in real impacting situations to people's lives. They've changed things. But I keep those two stories as reminders to make sure that despite what is going on and the cybersecurity elements of this, people are human. Humans have feelings. Those feelings can impact the outcome of the incident itself. And you absolutely have to take those into consideration.

Max Kurek:
If you're a defender that has ever or is in the process of questioning the importance of what you do, the things that you guys just went through should be the reminder, right? The reminder of why you do what you do, the reminder of why, the real reasons why we go through incident response training and why Cody says things like water your IR plan. Because at the end of the day, that response can lead to lives being saved if the context is fits that. And there's a lot of folks listening to this call that support vul organizations that serve vulnerable populations, that serve populations that are sick, that serve populations that are voiceless and faceless to a lot of us.

And so the work you're doing matters. And just if you ever need a reminder of that Go through your catalog of stories and the catalog of incident incidents you've worked and just take that one extra step to think about one of those incidents a little bit deeper, and you will remind yourself not just the impact you had on paper technically, but the impact you had on the human behind the number. And I really appreciate this discussion. I wanna spend a couple of minutes here, guys, talking about the response and talking about kind of what's happened since to kind of wrap our discussion.

And Aidan, there's something, you know, there was something very obvious that came in Mr. Leatherman's announcement, right? And I don't want to call it finger pointing, but they named the contractor's failure specifically and concretely. They didn't name who the contractor was. The FBI didn't, at least. We've since surmised who it is. But they basically did the proverbial finger pointing at this. And I'm wondering. From your perspective, both as a security analyst, but also as just a human being who is reading about this, is that the right first public statement, public finding, or does leading with the vendor here read as a little bit of a deflection in a certain case?

I'm just curious what your reaction to that is.

Aidan Brown:
My reaction goes back to what Seth said about accountability versus responsibility. It goes straight back to there and the FBI pointing a finger at somebody else, trying to put the blame, or really I should say, putting the accountability on them. I see that as straight deflection. That that's my personal opinion. That's what I see. Because again, you cannot transfer accountability when it comes to things like this, when it comes to your systems, the data that you are holding as an organization. And again, I'm saying that not just in FBI context, but in everybody, every single company out there context.

You just cannot transfer that accountability. And when their first statement, as you said, is pointing a finger at somebody else other than them. That's hard to not think of a as a deflection.

Seth Loe:
If I can take my swing at the response on here, I want to leave the security bits to Cody's finale. He's gonna wrap all that up. And I wanna talk about something interesting that I detected in the FBI message that was delivered by L Mr. Leatherman. They used AI to write their closing statements.

Cody Kretsinger:
Hm. Are you surprised?

Seth Loe:
No, I'm not. I'm surprised the degree to which they trusted it. So here's some things that I have picked up on the AI that they used. And first of all, I'm gonna tell you this was most likely the government edition of Microsoft Copilot that was favoring Chat GPT and had been trained on Reagan era speech writing. All right. So this is my claim. I'm gonna back it up a little bit. So first of all, that last paragraph of a statement, and they're punchy lines, these are quotable lines, right? That's what they said. We want four or five really good sound bites that's gonna make it on the news, that's gonna get our message out.

They are all XY statements.

Cody Kretsinger:
Mm-hmm.

Seth Loe:
Right. They are all if not X, then Y, or because of X, then Y. They're chiral statements. And everybody who's seen Breaking Bad has heard Walter White's speech on chirality, right? It's it means in Latin it's really about hands and it's about how the hands oppose each other. And one of the statements that was directly made was you know how to find us, and we know how to find you. It's that whole X, Y, chirality in there that hits with the punch. They all they also did a few Reagany things. He used to like to do these teasing hidden truths things.

And when they said we're confident that you've seen and heard things in recent days that aren't public yet, everybody goes, ooh, insider information. They know it. This is all intrigue. But in that moment though, this is the Mr. Gorbachev tear down this wall comment. Because what Reagan did in that moment was he was addressing the audience for that entire speech. And then the pivot point on that speech was when he turned from addressing the crowd, like the FBI was when they're talking about what they're doing to respond to this, to dr addressing the attackers directly.

That was the Mr. Gorbachev tear down this wall moment. And I think their AI's been reading Peggy Newman or Peggy Noonan and Peter Robinson like crazy because there's so many parallels to the way they used to write for Ronald Reagan. It's insane.

Max Kurek:
Seth, you are a an AI slop truffle pig, dude. Like I nobody has a nose for this stuff quite like you. I have Cody, I want to ask you one last quick question on the response here. And then guys, I want to wrap this with your final thoughts. But there's one aspect to this I do want to get an incident response perspective on. A lot of employees found out about this. FBI employees found out about this in the news, right? Just like it's like a sports player who finds out from a reporter that they're getting traded or something like this.

Is there ever a case in incident response and in incident communication where that would be an acceptable thing to happen, where that would be a necessary thing to happen, where an internal person, an employee, an impacted employee finds out about an incident and their personal impact that is being felt from that incident from a source other than their company or specifically from the news.

Cody Kretsinger:
In an ideal world, no, that should never happen. And I feel like they probably dropped the ball on victim notification on this one. But they also might have not known for quite some time as well. So it just kind of depends on the details. It'll be interesting as these details start to come up and we can start to connect the dots. But in an ideal world, obviously for IR, you want to make sure that your staff understands that something is occurring. Not to talk to the media, to be prepared for questions about it, things along those lines.

But if a incident is incredibly fast moving, there is a world in which not all staff is going to be prepped good enough in order to be prepared to see it on the news because sometimes those news stories, especially with an authority like the FBI, that's a news story that's going to move very, very, very quickly. But you know, if I'm reading the tea leaves here, they probably had an opportunity to tell their staff that something was going on. And they didn't, which is unfortunate, but they can salvage it's the FBI. The folks that work for the FBI understand you don't talk about things, you don't comment on things, even if there is a cybersecurity incident, you're not going to give any details.

They're all professionals like that. So not ideal, but Do tell your staff that you're having an incident. Please.

Max Kurek:
General best practice there. All right. So Aidan, give me like your quick sixty second concluding thought from the discussion today.

Aidan Brown:
If I I'll try to answer both quickly. If I were to give them a letter grade I think I'm gonna have to give them a D. Maybe teetering C minus. Because let's say from everything we've talked about today, let's say it was that three month vulnerability that went unpatched. Just think about it. They've already made arrests within a couple weeks. They found the attackers faster than their own unpatched server. Their own unpatched software. That's not very good, obviously. So that's why I'm leaning more towards a D. Like finding the attackers, that's I mean, that's the FBI's job.

So I'm not gonna give them any extra credit there. And the parts kind of going to my lesson, the parts that there was that they it was theirs to own, as in they were accountable for, as in the patch, really, the patch, their data, the data that it was holding, and their own people. They failed that part.

Max Kurek:
Seth, coming over to you. Final thought.

Seth Loe:
Yeah, build a racy chart and then watch a ray.

Max Kurek:
Yeah.

Seth Loe:
I want to abstain from giving them a letter grade. And here's what I want here's if I were to give them a message instead of a letter grade is that we have been told that attacks like this are gonna be on the rise. Go fucking show us how to do it. Show us how to do this the right way because there's a lot of people who are gonna follow you. There's a lot of businesses that are gonna do this after you. Show us how you do it and show us how to do it right, and then be ready to be there for the rest of this when this happens.

Make sure you're finding the people who attack us as quickly as you have found the people who attacked you. So l re letter grade to be withheld.

Max Kurek:
Cody, final thoughts from you.

Cody Kretsinger:
Final thoughts. I've actually broken this out into subcategories. So the missed patch, I'm given an F. Obviously it was old. Even if it was a zero day, that patch was still on those systems. The speed to the stated cause was thirteen days, which is very, very, very short. I give that a B plus. The accountability, I think we've established how that is. That's an F. The comms to the workforce. We've established the significance there, so I'll give that a D plus. And for my overall read, I did, I prepared I've actually got documents here. It's a D minus and it's a mix of the accountability because of the applicants.

Because the actual victims themselves are the ones who are going to be impacted the most out of this. I didn't give them an F only because they were very quick. To respond. That's it.

Max Kurek:
What everybody needs to remember here, and if I'm advising any organization and they're asking me about this specific incident, or better yet, I'm bringing them education on this specific incident. The two recommendations I'm making right away is have I scanned for vulnerabilities in the environment? Have I fixed those? And have I verified that those fixes are in place? That's number one. And then number two, have I conducted A vendor risk assessment and a supply chain risk assessment for every single vendor that I am dependent on for my business's continuity, for my financial bottom line, and for the reputation that I maintain with my clients and with my prospects.

And if the answer is no to either of those things within the next seven to ten days, I would be undertaking both of those efforts and putting all of my resources. Behind them. And I think that's something that everybody can do. If you need help doing it, talk to your security advisor, talk to your MSP, talk to us. We'd love to help guide you through those processes. That's what we live and breathe every single day. And the last thing I'll note for anybody who wants to up their incident response chops, we've talked a lot about responding to incidents.

On November 11th, we are putting on an incident response seminar. It's free. It's open to everybody. It's a full day that goes all the way from detection all the way through to recovery. Go to galacticsecurity.com slash incident dash response to sign up, free to register. We'll drop a link to it as well in the show notes for today. Otherwise, all I have left to say is for Seth Loe, Cody Kretsinger, Aidan Brown, I'm Max Kurek reminding you to stay threat aware. We will see you next time.