Labeled Fake, Bigger Security Bloggers Network, Ransomware Takedowns – Security Boulevard Chats EP15

Hi everyone. I'm Mitch Ashley, and I'm a Shiel and you're listening to Security Boulevard Chats. Chats.

Absolutely. Alan, good to be back on the podcast trail on the, I feel like we're on the road again. We're doing fantastic on the road.

Like Bob Hope and Bing Crosby. Bing Crosby. Yeah.

I don know how many, many people remember that. Maybe we should look for a horse track. I don't know.

You croner our USO tour. Yeah. That we're really dating ourselves.

Yeah. Yeah, we are. Um, easy, easy on that one.

But Mitch, it's good to be back on the podcast. For those who have been listening, you know, we relaunched Security Boulevard podcast and the DevOps Chats podcast. They're separate.

And, um, you can follow DevOps Chats, uh, and Security Boulevard chats on any of your favorite podcasting platforms or on Textron tv. Mm-Hmm. com.

Yeah. They play on there. And, uh, cloud native now is podcast and all the great stuff.

Stuff. And digital CX O podcast, Textron AI podcast. There's a new one coming up.

We'll tell you about it next week. And, um, and of course our, our CSO talk, our, uh, uh, tech Strong Women and DevOps Unbound podcast. Mm-Hmm.

As well as Textron Techstrong Unplugged, which are own Naton Solomon does. And it's really aimed at, you know, kids coming outta college. Mm-Hmm.

Trying to figure out how they're getting that first gig in tech. Absolutely. Great stuff.

Very cool. Got a lot of, whether you're security software or cloud Oh, native ai, whatever you is. We got you covered here at Techstar.

We've got your podcast. Well, so let's, let's chat a little bit. You'd picked out a couple, uh, things on Yeah.

I wanted to go over a couple of things, Mitch. Um, one article is by our friend Richie Jennings, for those of you who may not know Richie's over in the uk. And he does a blog watch column, I think once a week, maybe more.

And in it, he kind of picks out a, a timely topic that's being covered around the web and has excerpts of what people have blogged about on that topic. So the one I I chose for this week actually just ran last week, right? Mm-Hmm.

And it was the US will fight Russian disinformation hacks and leaks and deep fakes. Oh my, oh, my. Richie has, Richie has a, what's the word?

Acerbic, sense of humor. Um, sometimes people get wrote the wrong way to Google that, whatever that means. That was a good word, rich.

I pulled it. That was a, that was a college word. I pulled it outta there.

Yeah. That was one of my Or LSAT words. Yeah.

Um, anyway, though, but the point is, someone over at the State Department, you know, made the announcement so we could all sleep well at night, that the US government and State Department will be fighting Russian and Chinese, uh, disinformation campaigns using AI and not that may try to influence or skew our elections. Well, thank goodness for that. Um, you, you sleep under the blanket of protection that I offer Yeah.

That I provide. You can't handle the truth. Um, but, but seriously, look, this is a very serious topic.

Oh, absolutely. All kidding aside, right. Unfortunately, I don't think the US State Department is equipped at all to combat this.

Um, but that being said, what I mean, Mitch, what do we have to do to safeguard the integrity of our elections? It, it is, it is a perplexing question because our use of social media, our use, our other parties wanting to influence mainly Russia, but I'm sure there's other actors, China, China and others who are creating this information. There's really no good way to tell.

Is that true? Is that really true? Other than doing your research Right.

Whether going to tru you trust sources you trust. 'cause hopefully they're accurate in Snopes and things like that. Uh, uh, it seems to me though, that there, the State Department of doing this, they're labeling it, right.

They're saying this is, I don't know what words they're gonna use, but let's say misinformation. Um, you know, well, that's the government labeling or categorize saying what's fake and what's not, and who's, that's gonna build a lot of their biases. Yeah.

I think all those conspiracy theorists will really appreciate, you know, the government. Well, what was interesting, Mitch, is, uh, you know, there was the argument in the Supreme Court last week around the two state laws from Florida and Texas. Mm-Hmm.

Trying to regulate the social media companies in terms of free speech and what, you know, what they can censor or not, or label or what have you. And the, and the Supreme Court justices seem to be against the two state laws. Yeah.

But one of the distinctions they made as to why they were against it is the social media companies are not the government. The government has a, I hadn't heard that. A different burden regarding freedom of speech than a private company does.

They're supposed to have the public interest. So now you're gonna get the State Department labeling stuff, and they have to respect freedom of speech. Yeah.

Quite frankly, a private entity doesn't. Florida and Texas, and I'm sorry, I took us down a legal angle here. No, no, that's fine.

Florida and Texas, were making the argument that these social media companies are akin to a public utility, and that therefore they had to get treated similar to a government entity and respecting freedom of speech. And the justices from at least the oral arguments, we haven't seen the written opinion, but from the oral arguments, the justices did not buy into that they're still private companies. I don't see how the State Department does that without running afoul of freedom of speech.

It, I mean, everybody has to abide by it. Well, you, you, you're right in terms of a public forum, and the government has to support that. Um, so let me ask, if I label something, you, I'm the State Department and I label what you just produced on Facebook, whatever platform.

And I say that's fake, but Alan just posted as fake. Is is that infringing on your free speech? Right?

Yeah, it sure is. Yeah. I'm watching off the court and saying, you've infringed on my Exactly.

Freedom of speech. Yeah. You're telling me now the State Department will say No, I let you said it.

I just said that it's b******t. Exactly. I mean, seems to me that doesn't, I can't see this either solves anything for that reason or builds trust in the information we're reading because the government has said it's, it's Yep.

Valid. But Mitchell, just because this may not be a successful solution, doesn't diminish the problem. No.

I saw another report this week that just between Russia and China, approximately 75% of all your malware and this kind of stuff, uh, comes from Russia and China. Mm-Hmm. You know, at some level, freedom of speech or not, you gotta start thinking, Hey, I want to close my southern border of immigration.

I wanna close my electronic border of the nonsense. Mm-Hmm. Right.

If 75% Yeah, yeah, absolutely sense me now, then we could all do what they do in China, which is run VPNs to get around that great wall of firewall of China. But, mm-Hmm. Um, nevertheless, it brings up a real problem, Mitch.

We got an election coming up. It's probably gonna be another close one. Right.

Because how fast can 80 year olds run Yeah. Of that'll be a long race. Yeah.

But, you know, is, is interference from foreign governments with, and we didn't even have AI deep fakes last time. We're gonna have a lot more this time. Mm-Hmm.

Is that gonna be enough to, to tip a state or two? 'cause that may be all it takes. Well, not that the Russia would follow our laws, but, uh, sorry, I didn't mean to step on you.

No, no. I heard, I think yesterday that either the senate, Senate House, probably Senate was a few folks were working on a law that says you can't use, or you must disclose the use of AI in any political ads. Yeah.

If things like that, when we outlaw guns, only guns only outlaws will have guns. Right. I'm sure the Russians, you know, brought to you by Putin.

Hello, comrade. Please be advised, this is a net ski, you know, AI now get back in line for your breath. Right.

Duston, whatever the heck it is. But, um, your bo hear is getting cold. Oh, it's already cool.

Yes, yes. You know, it, it's ludicrous. I mean, so what's the answer?

The answer is the same thing we've been trying to come to terms and grapple with, you know, since social media really burst on the scene. I would say in 2004, 2008, maybe between 2008 and 2012 mm-Hmm. Um, you know, quite frankly, I think actually President Obama was probably the first political campaign that really leveraged social media, right?

Mm-Hmm. I think John McCain was a little out of Yeah. You know, Sarah Palin was watching Russia from her porch, and Barack Obama was all over Twitter.

Mm-Hmm. And, um, but so even though that was 2008, so that was, you know, 4, 8, 4 16 years ago Mm-Hmm. As a society, the world, not just the US has not, has not been able to separate truth from bull Mm-Hmm.

Fact from fiction, quality from nonsense when it comes to social media posting. Mm-Hmm. And what we've done instead, at least in the US and maybe the EU a little bit, is we've, we, we were relying on the Twitter's, Facebook's LinkedIn's, Google Apples of the world to kind of filter for us Mm-Hmm.

By taking out stuff that was really, and they weren't doing a great job, but they were probably taking the worst of the worst down. Now, of course, you know, that's one of the reasons Elon Musk bought Twitter X and drove it to hell. Mm-Hmm.

Um, but if those companies aren't the ones to regulate it, we gotta assume it's never gonna be regulated. And the, and the real answer is educate users to do a better job of separating fact from fiction. Mm-Hmm.

Right. And, and it's probably gonna take, you know, the generations coming up now, these AI native folks and, and the, the Gen Z natives, I think the Gen Zs still don't get it, but it may take a generation, Mitch, for people to be able to, you know, do this. Right.

We'll almost need that abo moment of something so big happening with fake information. And maybe it's an election, maybe it's not. Um, but some, you know, I've said that too, about security and ransomware and stealing data.

Some, it'll be big enough that it'll have, you know, that sizing kind of event that hasn't happened. But I don't know it, it is a perplexing problem. I certainly don't have many answers.

More about what No. What to do to solve it. No.

Even Krebs, remember he was on, in, in, in one of our, sure. Brian Krebs, Brian, he was on, um, he was on one of the news programs. I saw him, and he basically said, you have to go back and check the sources and do fact checking and see who was saying it, or if someone else can validate it that you trust essentially was, it came back to, so you're gonna, you're gonna enter a world where you don't know if anything's true, and you're gonna have to have ways of validating what is not, what isn't.

And I, I think, uh, unfortunately, I think it's gonna get worse before it gets better. Yeah, I think so too, unfortunately. Right.

I, I think, uh, you know, there are nation state actors, there are unscrupulous politicians and political movements, you know, go back to Nazi Germany. They were the first, you know, they made propaganda a religion. Mm-Hmm.

Right. And Geral said, the bigger the lie, the more you say it, the more people will believe it. Yep.

The more often you say it. Yeah. And I, I, it's, it pains me to say this, but he's right, or they're right.

And I, I, you know, I mean, it's gotten to the point, Mitchell, where like, I, I don't, I don't believe 90% of what, and, and I'm a easy goer person, I think, but I don't believe 90% of what I see online, whether it comes from those I identify with or those I don't, I'll go back and go look, just what Brian said to do. I'll go back and go look, did you like in Incre this week, the, the Florida, uh, surgeon General said it's a parent's decision on whether kids who had been exposed to measles should come to school or not, because it's not up to us to tell a parent to vaccinate their child. So I read this and I said, this can't be true.

This is f*****g ridiculous. Mm-Hmm. I went away crazy.

So I, I didn't repost it or say anything at first. I then went and I looked up and I saw the video, and I saw the letter that was sent, and I saw multiple, multiple reports all exactly the same. I said, oh my God, I, you know, I would've thought, for sure, this is nonsense.

But no, it's not nonsense. It's just Florida men. And, um, you know, that's the world we live in.

Just, you know, truth is stranger than fiction when it comes to Florida. And, uh, go figure, like the Saturday Night Live, uh, I forgot who the host was, but there was a, they're doing a skit on playing basketball, and the, the guests would shoot and miss. And he, he figured I'd gone to some course about, all you have to do is say, is that you did it.

So he says, I did. I hid it. It, it was good.

I got a point for that. And they're all like, oh, okay. All right.

It's go along with the flow. But, you know, I think for the sake of humanity and civilization, we need people who aren't gonna go along with the flow. Yeah, yeah.

Who are going to say, Hey, wait a second here, is this really true? Right. They're not, they're not selling children out of some pizza shop in DC Yeah.

Or whatever that conspiracy theory was. Right. Whatever.

Yeah. Uh, pizza. But, um, I did have, I did confirm something though.

Social media was very helpful to me today. I confirmed something I'd always wondered, you know, in the original Star Trek, you remember when they were getting bombarded by, you know, whatever phasers or photon to Beatles from some, you know, the rhyming ones or Clingons and everyone on the ship would be doing this, and they'd be doing that. And, you know, Uhhuh doing that.

Well, the, somebody posted a picture that showed the crew doing that, and above it, uh, someone had made a rocking chair that looked exactly like the Star Starship Enterprise and the kid was, was just pushing the whole Starship. That's pretty funny. That's what, that's what that was.

No. That, that wasn't a deep fake or anything at, at that was, that was real. Not at all.

That was real. So I'll tell you something I found out on social media today that may blow your mind. Okay.

And I saw it on a Facebook post. I didn't believe it. I went back, I googled everyone's name and pictures and Sure as heck it was true.

So, you know, Mitch, I'm a big Godfather movie fan. I love Oh, yeah. Godfather.

You have a lot of quotes from The Godfather. I, everything you need to learn in life, you can learn from watching the Godfather movies. Mm-Hmm.

And, and I, and like many of us, I'm also a Sopranos fan. Mm-Hmm. mm-Hmm.

Right. Yeah. One of the best TV shows ever.

David Chase, you know, and, and, uh, the whole, I mean, David Chase was the producer, but, um, just the whole, the whole cast of Sopranos Mm-Hmm. Um, and the writers and the, just the show's amazing. Um, but here's something that'll blow your mind.

If you remember in Godfather two, Hyman Roth Sicilian Messenger, boy, he was called Mm-Hmm. Johnny Orla. Mm-Hmm.

Right. Good old Johnny Orla knew this town, like the back of his hand. He's an orange from our friend in Miami.

Johnny Orla is the act. The actor who plays Johnny Oler is Uncle Junior in The Sopranos. You're kidding.

I'm not kidding. Go Google it yourself. Check it out.

I'm gonna have to look, I'm gonna have to, I'm trying to put you that, that Lou that was, that was a Revel, what we talk about here at Security Boulevard. But anyway, that was, that was amazing to me. Amazing.

It's funny, when you watch the older films and TV shows and stuff, how many actors that are really famous, you've gotten to know, we're like, like, you know, babies recycled, you're really young. They looked like they're 14. Yeah.

18 or something. Yeah. Like, wow.

I didn't know they were acting back then. Of course, nobody, no. Blew my mind.

Blew my mind. Anyway. That's amazing, Mitch.

Moving right, moving right along onto our next security topic. Yeah. Well, this is sort of a security topic.

It's important to us. So Mitch, you were there when we started the Security Bloggers meetup at RSA, I think it was 2003 or 2004. Yeah, sounds about right.

And then in like 2000, 4,000, there were 12 of us that went to that first one. It was not, yeah, it wasn't, Microsoft posted maybe more than 12, but it was, it was Rich Mogul, I think Mike Rothman, Martin McKay ui, uh, a bunch of other folks, but, um, small group of us, Michael Farham was there. Mm-Hmm.

Anyway, you know, and then we started Security Bloggers Network, which is a alive and healthy as ever on Security Boulevard. Mm-Hmm. Represents probably the majority of the, more than the majority, or super majority of the stories on the Boulevard come from the bloggers network, but Blogging's not what it was.

Mm-Hmm mm-Hmm. In 2004 and 2005 today, many of us create security related content, some by blogs and art written articles, some by podcasts like this, some by videos, audio, um, various, you know, security creation, uh, security content creators. Mm-Hmm.

And, you know, and, and the highlight of the bloggers network was always the bloggers meet up at RSA network every year at RSA conference every year. Excuse me. It was always Wednesday.

No Marketing Zone. And we, what a great at Jillions used to be anyway, at Jillions Yeah. Until that close.

But, you know, the, the people who have been with coming to that with us for 20 years, we A they're now giants in the industry. Mm-Hmm. But b, they're really good people that, you know, we've grown to love and, and, uh, respect good friends.

Um, but for the last couple years, Mitchell, it, you know, we've made it sort of, it hasn't gotten its due because I didn't focus on it personally. The situation in San Francisco was hard to get a place to make it. Yeah.

Yeah. Um, and, and quite frankly, you know, here's to us and those like us damn few left Mm-Hmm. Um, sitting around the barrel playing checkers.

Well, you know, yeah. What happened to our bloggers network when we were watching it? Remember when we used to blog?

So I, I've wanted to revitalize it now for a couple years and, and bring it forward to today's time. And, you know, it was actually, I spoke to Rich Mogul and Jennifer Gio, two of the people who helped start the bloggers meet up with me. Mm-Hmm.

And, you know, we, the idea was tossed around instead of calling it security bloggers network, maybe we call it Security Creators Network, SCN. And I love that idea because I think that's much more in invo, you know, engrossing what today's content, whatever the media is, right. Yeah.

It doesn't matter what form it's still Yep. Sharing ideas, communicating, advancing the knowledge base. Yep.

And so I, I've wanted to do this, but I I didn't wanna just change the name to change the name, I wanted to wrap it around. So I also, uh, been talking, um, with Gianna from the Security Marketing Professionals. Mm-Hmm.

Society, or I think that's it. Yes. Um, about helping me.

'cause I wanna bring a new fresh audience in. Yeah, we do. I wanna bring some of the younger people I want to bring Branch out, you know, the people who are creating content.

And, uh, again, she we're talking about their help coming in. But I've been able to locate a place to do it at RSA, you know, Jack Daniels and, and a couple of the people used to do Tonga Con every year at the Tonga Room. I don't know if you remember it right.

Polynesian theme they give out Lays Mitchell. You and I had many a drink there over the years. I don't, I don't remember of any of that.

I was there, but I don't remember. No, you were there. You were there.

You probably lost something there. But anyway, there's some podcasting equipment. I dunno what it's, it wasn't there.

It was the w But anyway, I'm not gonna, I'm not gonna rip that bandaid off the wound. Thank you very much. Well let sleeping dogs live.

But anyway. Oh my God. So, you know, Jack's not doing Tonga Kong anymore.

Jack's kind of retired and Mm-Hmm. Uh, my friend Jeff Mann suggested I call the Tonga Room, and I did. And I've been able to, it looks like, uh, lock down.

I'm not gonna take the whole room because I don't think we're gonna have 450 people Mm-Hmm. But to take down a good portion of it to more than cover what we need. We'll have some good food, some good drinks.

And, uh, we're gonna relaunch for RSA, the Security Bloggers Network is the Security Creators Network. And we're gonna do our first security creators network party. I don't think we're gonna do awards this year, next year.

Security Creators network party at, at it. And, and, and to honor the heritage of Tonga Khan, we're gonna try to take some of the essence of what made Tonga Khan such a great party as well. And, um, Polynesian drinks.

Well that for sure. Yeah. But, um, you know, actually, okay.

Actually, actually, Mitch, I was going to throw it out to our audience. com and, and tell me what you liked best about Tonga Con and what can we include in the Security Creators meetup that kind of honors that Tonga Con heritage being, we're doing it in the Tonga Room. Mm-Hmm.

And we'd love to get that in there. I think it'll be a nice touch, Mitch. We would, we would, we would.

Yeah. Are we gonna have sponsors because we've always had sponsors or we do. Well, it makes it real hard to pay for these things without sponsors.

You, I was, I was gonna say thank, thank God we have sponsors. 'cause that's how we do this. Yeah.

So I'll, I'll be looking for sponsors. I, one company was suggested. I'm reaching out, we'll be looking for more Gianna and the security, uh, marketing Professional Society hopefully will help with that as well.

But there will be Eventbrite registrations and everything else. But we're back, we're backing with our own show, not borrowing someone's venue with our own party. It's going to be the Wednesday of obscurity of RSA probably start around 5, 5 30, run till seven 30 or something like that so people can go to their next parties and partake the party the night away.

But I'm really pumped about it, Mitch. And it, and it's not just the party at RSA, I think this will revitalize Mm-Hmm. There's 400 blogs or whatever in the bloggers network.

But I want, I want more kinds of content security related content. And we're gonna open the roles up and, and bring people in with this. People's YouTube channels, their TikTok, their everything, Instagram, their, you know, maybe they're writing in a different form somewhere, somehow, you know, and it's to broaden the forms, but it's also, as you were saying, deepen the generational aspect of this.

Right. Yeah. We've been doing this for a while and there are folks who are doing great work, you know, better than, you know, what we did, what we may have done, you know, they're, they're advancing it from where we are today.

And we wanna help help them have that voice, get that out there. Security, security Creators network. That's what it's about.

So we're excited. Stay tuned for more information on that. Sounds really great.

Good stuff. Good stuff. Yeah.

I'm excited. I'm excited. Alright.

What other security stuff, is there anything else on the docket for today, Mitch? I think I have we hit everything. I think, oh, we, we talked a little bit about the whole, uh, governments doing take down of ransomware groups.

That was a Textron gang topic. Yeah. That was, that was a, a Textron gang discussion.

You're right. Um, and I'm forgetting the ransomware group that they took down now, uh, I'll sort of could tell you in a minute, but we'll, we'll find it. But what was interesting is they made a huge announcement that it was taken down and then two days later it's back up.

Yeah. The Whack-a-Mole. Yeah.

Well, this, this is the problem. When you have nation states that I i, if they don't outwardly support these gangs, they tie, they, they turn a blind eye on em. Mm-Hmm.

You know, and, and it was like, I, we, we were discussing about, you know, they're going after the big ones, right. Because it is sort of like going after Kingpin. You were talking about the, the Godfather earlier, you know, and then there's, you know, thousand, millions, billions of small, you know, medium and small things happening that are probably leveraging a lot of the same tools.

Right? Yep. But, um, lock Bit was the name of Lock Bit.

That's it. You're right. Lock bit that I remember.

And it's back. And, and so look, I applaud the government for their efforts. I applaud, you know, a lot of the companies that get involved in this, but this just gives you a peek into how insidious these, these and, and deep rooted these things are.

Mm-Hmm. It's terrible. You know what was interesting?

I woke up this morning as I often do really early. It was about 5, 5 30 in the morning. And, um, I checked my email just because I don't know, something's a matter with me.

Um, but I, I checked my email and I got a message from Google. 'cause my son's email, I'm the emergency contact, I guess, or whatever, and Google sent out an email for my son's account that says you're the emergency contact. We've seen his password on the dark web.

Change your password immediately with disabling the account. Oh. So at first being the cyber pro that I am, I said, oh, this is a Phish, uh, you know, quick here, click this link, son.

Yeah. So I went to log in his email and sure enough, it was real Google. And I gotta tell you the truth, I was pretty amazed that Google, I mean, it, it must be automated, right?

Yeah. I can't imagine there's people doing that. But kudos to Google for doing, it was a regular Gmail account too.

This isn't corporate. Um, kudos to Google for keeping an eye on things like that. Bad things were happening on it.

Like it had been compromised and emails being sent out. It, or just said that the password for this account was found in a, oh, the password for this account was found in a breach. Oh, okay.

It was contained in a breach. Oh. Well, they shouldn't in theory know your password, so they must be taking that data from that breach and saying, let me run it against our authentication and see if it's either, either or.

They're just saying, Hey, this breach was able to get ahold of username and passwords. And when they saw the username Yeah. They, they assumed the password was too, but that's okay.

I applaud them for doing it. I wish every email provider did that. Mm-Hmm.

Right, right. Good for them. Makes a lot of sense.

Right. I mean, you wanna, you know, ignorance is not bliss. It's just ignorance.

It's just ignorance. And, and, you know, you could have an opinion all you want, but when it's ignorant, it's ignorant. Exactly.

I'd rather know. All right, Mitch. I think that that does it for me on Security Boulevard Chats this week.

I think we've hit several nails on the head, or at least taken some swings. So I had a good time. I had fun.

I had fun. Been great doing it. We'll definitely check out, um, you know, if you're listening to this podcast or you're seeing it for the first time on one of our websites, um, particularly Security Boulevard, but check us out.

We've got a bunch of podcasts that are available around DevOps, cyber security, cloud native, now, ai, we talked talk about a lot of those. So Yep. We're really enjoying producing this content and helping share some of the really, you know, a lot of great stuff on our, on our websites and we'd like to highlight some of it.

So that's a real privilege to do that. Yep. Well, and if you like sort of crazy old uncles talking like this, you should also check out Textron Gang, uh, Monday, Tuesday, and Thursday every week where we're joined by Mike Ard and Sharon Florentine, Amanda Rini, and a whole bunch of friends at Techstrong discussing cyber and DevOps and Cloud native and AI and transformation and the rest.

It's all good stuff. Well, thanks for joining us, everybody. Uh, this is Mitch Ashley and Alan Bel.

Thank you for joining and listening to us on Security Boulevard Chats. Bye everybody.