{"version":"1.0.0","segments":[{"speaker":"Jordan Natter","startTime":3.18,"endTime":5.16,"body":"Good morning,"},{"speaker":"Jordan Natter","startTime":3.18,"endTime":5.16,"body":"folks. Welcome back to the Cyber"},{"speaker":"Jordan Natter","startTime":5.22,"endTime":8.22,"body":"Threat Perspective. You have"},{"speaker":"Jordan Natter","startTime":5.22,"endTime":8.22,"body":"Brad Causey over here, and you"},{"speaker":"Jordan Natter","startTime":8.31,"endTime":11.1,"body":"have me, Jordan Natter. I'm"},{"speaker":"Jordan Natter","startTime":8.31,"endTime":11.1,"body":"doing the intro this time"},{"speaker":"Jordan Natter","startTime":11.19,"endTime":15.18,"body":"because I just wanted to throw"},{"speaker":"Jordan Natter","startTime":11.19,"endTime":15.18,"body":"you guys a curveball. So today"},{"speaker":"Jordan Natter","startTime":15.48,"endTime":18.42,"body":"we are back talking about the"},{"speaker":"Jordan Natter","startTime":15.48,"endTime":18.42,"body":"OWASP Top 10 for web apps."},{"speaker":"Jordan Natter","startTime":18.54,"endTime":22.25,"body":"Right? We previously talked"},{"speaker":"Jordan Natter","startTime":18.54,"endTime":22.25,"body":"about AO three. Now we're going"},{"speaker":"Jordan Natter","startTime":22.25,"endTime":24.8,"body":"to talk about AO four. In this"},{"speaker":"Jordan Natter","startTime":22.25,"endTime":24.8,"body":"case, this is going to be"},{"speaker":"Jordan Natter","startTime":25.49,"endTime":29.45,"body":"cryptographic failures, right?"},{"speaker":"Jordan Natter","startTime":25.49,"endTime":29.45,"body":"In our opinion, it's a rather"},{"speaker":"Jordan Natter","startTime":29.51,"endTime":32.36,"body":"boring topic. So this might be a"},{"speaker":"Jordan Natter","startTime":29.51,"endTime":32.36,"body":"shorter episode, and we might be"},{"speaker":"Jordan Natter","startTime":32.54,"endTime":35.18,"body":"rehashing some topics you guys"},{"speaker":"Jordan Natter","startTime":32.54,"endTime":35.18,"body":"have previously heard us talk"},{"speaker":"Jordan Natter","startTime":35.24,"endTime":39.2,"body":"about. But there is good reason"},{"speaker":"Jordan Natter","startTime":35.24,"endTime":39.2,"body":"why we have to talk about this,"},{"speaker":"Jordan Natter","startTime":39.35,"endTime":44.98,"body":"right? So this has not only been"},{"speaker":"Jordan Natter","startTime":39.35,"endTime":44.98,"body":"a finding on the top 10 for"},{"speaker":"Jordan Natter","startTime":45.07,"endTime":48.34,"body":"many, many, many years, but it"},{"speaker":"Jordan Natter","startTime":45.07,"endTime":48.34,"body":"has also changed positions. The"},{"speaker":"Jordan Natter","startTime":48.58,"endTime":51.88,"body":"reason it's changed positions is"},{"speaker":"Jordan Natter","startTime":48.58,"endTime":51.88,"body":"not because it's no longer as"},{"speaker":"Jordan Natter","startTime":52.0,"endTime":55.6,"body":"exploitable, but because of the"},{"speaker":"Jordan Natter","startTime":52.0,"endTime":55.6,"body":"other topics are actually like"},{"speaker":"Jordan Natter","startTime":55.72,"endTime":58.72,"body":"being seen more, right, guys? So"},{"speaker":"Jordan Natter","startTime":55.72,"endTime":58.72,"body":"just want to keep that in mind"},{"speaker":"Jordan Natter","startTime":58.78,"endTime":61.44,"body":"while we're talking about this."},{"speaker":"Jordan Natter","startTime":58.78,"endTime":61.44,"body":"So no, it's not less important,"},{"speaker":"Jordan Natter","startTime":61.5,"endTime":64.62,"body":"but it is lower on the top 10,"},{"speaker":"Jordan Natter","startTime":61.5,"endTime":64.62,"body":"right?"},{"speaker":"Brad Causey","startTime":66.69,"endTime":70.23,"body":"Yeah, no, totally"},{"speaker":"Brad Causey","startTime":66.69,"endTime":70.23,"body":"agree. And so, one of the things"},{"speaker":"Brad Causey","startTime":70.35,"endTime":72.63,"body":"I will say, and the reason that"},{"speaker":"Brad Causey","startTime":70.35,"endTime":72.63,"body":"we don't love this thing so"},{"speaker":"Brad Causey","startTime":72.78,"endTime":77.88,"body":"much, right, is the vast"},{"speaker":"Brad Causey","startTime":72.78,"endTime":77.88,"body":"majority of the findings that"},{"speaker":"Brad Causey","startTime":78.0,"endTime":81.74,"body":"fall into this category are not"},{"speaker":"Brad Causey","startTime":78.0,"endTime":81.74,"body":"practically exploitable in the"},{"speaker":"Brad Causey","startTime":81.89,"endTime":86.09,"body":"wild. So, do they create risk?"},{"speaker":"Brad Causey","startTime":81.89,"endTime":86.09,"body":"Yes, but probably not in the way"},{"speaker":"Brad Causey","startTime":86.21,"endTime":86.54,"body":"you think."},{"speaker":"Jordan Natter","startTime":87.049,"endTime":87.169,"body":"Yes,"},{"speaker":"Brad Causey","startTime":87.32,"endTime":88.64,"body":"right. And we're"},{"speaker":"Brad Causey","startTime":87.32,"endTime":88.64,"body":"going to talk about that in"},{"speaker":"Brad Causey","startTime":88.73,"endTime":91.67,"body":"today's episode. But generally"},{"speaker":"Brad Causey","startTime":88.73,"endTime":91.67,"body":"speaking, when we start talking"},{"speaker":"Brad Causey","startTime":91.67,"endTime":95.45,"body":"about Sweet 32 and Beast and"},{"speaker":"Brad Causey","startTime":91.67,"endTime":95.45,"body":"what are some of the other goofy"},{"speaker":"Brad Causey","startTime":95.57,"endTime":99.65,"body":"ones? I can't. I can't remember"},{"speaker":"Brad Causey","startTime":95.57,"endTime":99.65,"body":"all of them, but there are like"},{"speaker":"Brad Causey","startTime":100.55,"endTime":106.75,"body":"15 or 20 different specific, you"},{"speaker":"Brad Causey","startTime":100.55,"endTime":106.75,"body":"know, named vulnerabilities that"},{"speaker":"Brad Causey","startTime":106.78,"endTime":109.72,"body":"are out there, and most of them"},{"speaker":"Brad Causey","startTime":106.78,"endTime":109.72,"body":"are kind of BS. If we're being"},{"speaker":"Brad Causey","startTime":109.84,"endTime":112.6,"body":"honest, right? From from a from"},{"speaker":"Brad Causey","startTime":109.84,"endTime":112.6,"body":"a realistic threat actor"},{"speaker":"Brad Causey","startTime":112.72,"endTime":117.13,"body":"perspective, nobody's exploiting"},{"speaker":"Brad Causey","startTime":112.72,"endTime":117.13,"body":"Sweet 32. No, right? So then,"},{"speaker":"Brad Causey","startTime":117.13,"endTime":117.76,"body":"why do we even care?"},{"speaker":"Jordan Natter","startTime":118.87,"endTime":121.08,"body":"So in this case,"},{"speaker":"Jordan Natter","startTime":118.87,"endTime":121.08,"body":"we are specifically talking"},{"speaker":"Jordan Natter","startTime":121.11,"endTime":125.07,"body":"about it because it gives a"},{"speaker":"Jordan Natter","startTime":121.11,"endTime":125.07,"body":"hygiene risk or a brand brand"},{"speaker":"Jordan Natter","startTime":125.91,"endTime":129.66,"body":"brand reputational risk, right?"},{"speaker":"Jordan Natter","startTime":125.91,"endTime":129.66,"body":"So just having these, so"},{"speaker":"Jordan Natter","startTime":129.9,"endTime":133.65,"body":"granted, some of this would be"},{"speaker":"Jordan Natter","startTime":129.9,"endTime":133.65,"body":"exploitable, but the amount of"},{"speaker":"Jordan Natter","startTime":133.74,"endTime":136.83,"body":"effort you have to do to like"},{"speaker":"Jordan Natter","startTime":133.74,"endTime":136.83,"body":"actually exploit it is not"},{"speaker":"Jordan Natter","startTime":136.89,"endTime":140.42,"body":"typically worth it. But it is"},{"speaker":"Jordan Natter","startTime":136.89,"endTime":140.42,"body":"causing risk for you guys in a"},{"speaker":"Jordan Natter","startTime":140.48,"endTime":143.72,"body":"brand, in a brand reputational"},{"speaker":"Jordan Natter","startTime":140.48,"endTime":143.72,"body":"way, right?"},{"speaker":"Brad Causey","startTime":144.17,"endTime":147.68,"body":"Yeah, yeah, I"},{"speaker":"Brad Causey","startTime":144.17,"endTime":147.68,"body":"agree. So, so two things, right?"},{"speaker":"Brad Causey","startTime":147.86,"endTime":151.16,"body":"So you mentioned hygiene, you"},{"speaker":"Brad Causey","startTime":147.86,"endTime":151.16,"body":"mentioned brand rep. To me, that"},{"speaker":"Brad Causey","startTime":151.25,"endTime":154.16,"body":"those those things are almost"},{"speaker":"Brad Causey","startTime":151.25,"endTime":154.16,"body":"one and the same, right? But"},{"speaker":"Brad Causey","startTime":154.19,"endTime":156.68,"body":"we'll talk about them slightly"},{"speaker":"Brad Causey","startTime":154.19,"endTime":156.68,"body":"separately. But but they they're"},{"speaker":"Brad Causey","startTime":156.71,"endTime":161.23,"body":"both valid points, right? And so"},{"speaker":"Brad Causey","startTime":156.71,"endTime":161.23,"body":"there are platforms that exist,"},{"speaker":"Brad Causey","startTime":162.28,"endTime":165.43,"body":"Security Scorecard is one of"},{"speaker":"Brad Causey","startTime":162.28,"endTime":165.43,"body":"them. BitSight is another one."},{"speaker":"Brad Causey","startTime":165.97,"endTime":170.62,"body":"And for those of you that are"},{"speaker":"Brad Causey","startTime":165.97,"endTime":170.62,"body":"unfamiliar with those, they"},{"speaker":"Brad Causey","startTime":170.71,"endTime":175.69,"body":"basically go out and try to"},{"speaker":"Brad Causey","startTime":170.71,"endTime":175.69,"body":"score you on your security from"},{"speaker":"Brad Causey","startTime":175.81,"endTime":179.02,"body":"the outside of your environment"},{"speaker":"Brad Causey","startTime":175.81,"endTime":179.02,"body":"using super light touch testing."},{"speaker":"Brad Causey","startTime":179.23,"endTime":183.54,"body":"Right. So they're going to"},{"speaker":"Brad Causey","startTime":179.23,"endTime":183.54,"body":"identify web components in your"},{"speaker":"Brad Causey","startTime":183.54,"endTime":189.72,"body":"environment that are you know"},{"speaker":"Brad Causey","startTime":183.54,"endTime":189.72,"body":"SSL 3.0 or TLS 1.0 or TLS 1.1."},{"speaker":"Brad Causey","startTime":189.72,"endTime":194.46,"body":"These are all depreciated"},{"speaker":"Brad Causey","startTime":189.72,"endTime":194.46,"body":"protocols, and so you know"},{"speaker":"Brad Causey","startTime":195.27,"endTime":198.69,"body":"again, are they exploited in the"},{"speaker":"Brad Causey","startTime":195.27,"endTime":198.69,"body":"wild? No. However, does your"},{"speaker":"Brad Causey","startTime":198.84,"endTime":201.89,"body":"score matter? Well, and that it"},{"speaker":"Brad Causey","startTime":198.84,"endTime":201.89,"body":"could matter, right? It"},{"speaker":"Brad Causey","startTime":201.98,"endTime":204.92,"body":"definitely could, and in most"},{"speaker":"Brad Causey","startTime":201.98,"endTime":204.92,"body":"cases, it does to a degree or"},{"speaker":"Brad Causey","startTime":204.92,"endTime":209.81,"body":"another. So again, if I am a"},{"speaker":"Brad Causey","startTime":204.92,"endTime":209.81,"body":"let's I'm not uneducated is the"},{"speaker":"Brad Causey","startTime":209.81,"endTime":212.24,"body":"wrong term, but maybe someone"},{"speaker":"Brad Causey","startTime":209.81,"endTime":212.24,"body":"who who doesn't understand all"},{"speaker":"Brad Causey","startTime":212.27,"endTime":216.17,"body":"the nuance associated with these"},{"speaker":"Brad Causey","startTime":212.27,"endTime":216.17,"body":"things, I go look at a potential"},{"speaker":"Brad Causey","startTime":216.2,"endTime":220.28,"body":"business partner on Security"},{"speaker":"Brad Causey","startTime":216.2,"endTime":220.28,"body":"Scorecard, and they've got a you"},{"speaker":"Brad Causey","startTime":220.31,"endTime":223.99,"body":"know 75 out of 100, and I go"},{"speaker":"Brad Causey","startTime":220.31,"endTime":223.99,"body":"look at another potential"},{"speaker":"Brad Causey","startTime":224.02,"endTime":226.81,"body":"business partner, and they got"},{"speaker":"Brad Causey","startTime":224.02,"endTime":226.81,"body":"out 99 out of 100. Which one are"},{"speaker":"Brad Causey","startTime":226.81,"endTime":228.19,"body":"you going to go with? And so"},{"speaker":"Jordan Natter","startTime":228.49,"endTime":229.03,"body":"99,"},{"speaker":"Brad Causey","startTime":229.48,"endTime":231.43,"body":"probably right. If"},{"speaker":"Brad Causey","startTime":229.48,"endTime":231.43,"body":"this is an important thing to"},{"speaker":"Brad Causey","startTime":231.46,"endTime":233.77,"body":"you, and and again, if you don't"},{"speaker":"Brad Causey","startTime":231.46,"endTime":233.77,"body":"really understand how this stuff"},{"speaker":"Brad Causey","startTime":233.92,"endTime":237.61,"body":"works, you know, it looks like"},{"speaker":"Brad Causey","startTime":233.92,"endTime":237.61,"body":"they have poor, you know,"},{"speaker":"Brad Causey","startTime":237.73,"endTime":240.16,"body":"security hygiene. It looks like"},{"speaker":"Brad Causey","startTime":237.73,"endTime":240.16,"body":"that they have a lot of"},{"speaker":"Brad Causey","startTime":240.16,"endTime":243.6,"body":"vulnerabilities, and in many"},{"speaker":"Brad Causey","startTime":240.16,"endTime":243.6,"body":"cases that is not necessarily"},{"speaker":"Brad Causey","startTime":243.72,"endTime":248.49,"body":"true. However, brand risk"},{"speaker":"Brad Causey","startTime":243.72,"endTime":248.49,"body":"matters, right? Reputational"},{"speaker":"Brad Causey","startTime":248.52,"endTime":250.8,"body":"risk matters, and so if your"},{"speaker":"Brad Causey","startTime":248.52,"endTime":250.8,"body":"score is out there making you"},{"speaker":"Brad Causey","startTime":250.86,"endTime":254.28,"body":"look bad, you could be losing"},{"speaker":"Brad Causey","startTime":250.86,"endTime":254.28,"body":"business, right? People's"},{"speaker":"Brad Causey","startTime":254.49,"endTime":257.28,"body":"people's opinion of of your"},{"speaker":"Brad Causey","startTime":254.49,"endTime":257.28,"body":"organization may be skewed."},{"speaker":"Brad Causey","startTime":258.42,"endTime":261.62,"body":"Again, just to be completely"},{"speaker":"Brad Causey","startTime":258.42,"endTime":261.62,"body":"transparent, the scores that are"},{"speaker":"Brad Causey","startTime":261.71,"endTime":264.65,"body":"put out by these these these"},{"speaker":"Brad Causey","startTime":261.71,"endTime":264.65,"body":"platforms are effectively"},{"speaker":"Brad Causey","startTime":264.71,"endTime":268.64,"body":"meaningless. You know, they're"},{"speaker":"Brad Causey","startTime":264.71,"endTime":268.64,"body":"they're finding the easiest"},{"speaker":"Brad Causey","startTime":268.67,"endTime":271.43,"body":"stuff they can possibly find and"},{"speaker":"Brad Causey","startTime":268.67,"endTime":271.43,"body":"artificially inflating the"},{"speaker":"Brad Causey","startTime":271.46,"endTime":274.25,"body":"severity of it, so they're"},{"speaker":"Brad Causey","startTime":271.46,"endTime":274.25,"body":"making you do work, right? And"},{"speaker":"Brad Causey","startTime":274.28,"endTime":277.34,"body":"so they're just trying to be"},{"speaker":"Brad Causey","startTime":274.28,"endTime":277.34,"body":"relevant. And so you know, we"},{"speaker":"Brad Causey","startTime":277.43,"endTime":280.57,"body":"could debate the value of those"},{"speaker":"Brad Causey","startTime":277.43,"endTime":280.57,"body":"all day, every day. You know,"},{"speaker":"Brad Causey","startTime":280.69,"endTime":283.45,"body":"for me, it's less than zero"},{"speaker":"Brad Causey","startTime":280.69,"endTime":283.45,"body":"because it's just creating"},{"speaker":"Brad Causey","startTime":283.51,"endTime":287.83,"body":"unnecessary work for everyone."},{"speaker":"Brad Causey","startTime":283.51,"endTime":287.83,"body":"But it is something that exists,"},{"speaker":"Brad Causey","startTime":287.89,"endTime":290.74,"body":"and we have to be aware of it. I"},{"speaker":"Brad Causey","startTime":287.89,"endTime":290.74,"body":"would actually, if you don't"},{"speaker":"Brad Causey","startTime":290.92,"endTime":291.97,"body":"mind me chiming in, no, I would"},{"speaker":"Jordan Natter","startTime":291.97,"endTime":293.83,"body":"look at the"},{"speaker":"Jordan Natter","startTime":291.97,"endTime":293.83,"body":"security scorecard as something"},{"speaker":"Jordan Natter","startTime":293.86,"endTime":296.35,"body":"like this, right? So, as a"},{"speaker":"Jordan Natter","startTime":293.86,"endTime":296.35,"body":"penetration tester, what we're"},{"speaker":"Jordan Natter","startTime":296.44,"endTime":299.53,"body":"doing is mostly manual testing,"},{"speaker":"Jordan Natter","startTime":296.44,"endTime":299.53,"body":"and we're actually like weeding"},{"speaker":"Jordan Natter","startTime":299.62,"endTime":302.4,"body":"out those. Positives, and then"},{"speaker":"Jordan Natter","startTime":299.62,"endTime":302.4,"body":"trying to take like"},{"speaker":"Jordan Natter","startTime":302.61,"endTime":305.58,"body":"vulnerabilities and exploit them"},{"speaker":"Jordan Natter","startTime":302.61,"endTime":305.58,"body":"further, right? Well, in this"},{"speaker":"Jordan Natter","startTime":305.7,"endTime":309.27,"body":"case, security scorecard is"},{"speaker":"Jordan Natter","startTime":305.7,"endTime":309.27,"body":"doing like the smallest amount,"},{"speaker":"Jordan Natter","startTime":309.69,"endTime":311.82,"body":"and like, and this isn't in a"},{"speaker":"Jordan Natter","startTime":309.69,"endTime":311.82,"body":"bad way that I'm explaining"},{"speaker":"Jordan Natter","startTime":311.82,"endTime":313.98,"body":"this, but they're doing like"},{"speaker":"Jordan Natter","startTime":311.82,"endTime":313.98,"body":"more or less the smallest amount"},{"speaker":"Jordan Natter","startTime":313.98,"endTime":316.29,"body":"of work that we are doing at the"},{"speaker":"Jordan Natter","startTime":313.98,"endTime":316.29,"body":"beginning because they're"},{"speaker":"Jordan Natter","startTime":316.44,"endTime":319.47,"body":"looking at that low hanging"},{"speaker":"Jordan Natter","startTime":316.44,"endTime":319.47,"body":"fruit. Well, that those low"},{"speaker":"Jordan Natter","startTime":319.62,"endTime":323.72,"body":"hanging fruit for them is tends"},{"speaker":"Jordan Natter","startTime":319.62,"endTime":323.72,"body":"to be the higher on their like"},{"speaker":"Jordan Natter","startTime":323.81,"endTime":326.84,"body":"scoring system, right? So what"},{"speaker":"Jordan Natter","startTime":323.81,"endTime":326.84,"body":"is really low to us that we're"},{"speaker":"Jordan Natter","startTime":326.9,"endTime":330.38,"body":"like, oh, it's trivial, it"},{"speaker":"Jordan Natter","startTime":326.9,"endTime":330.38,"body":"doesn't matter, like at least it"},{"speaker":"Jordan Natter","startTime":330.38,"endTime":332.66,"body":"doesn't matter in this case."},{"speaker":"Jordan Natter","startTime":330.38,"endTime":332.66,"body":"They're like, oh my goodness,"},{"speaker":"Jordan Natter","startTime":332.72,"endTime":335.24,"body":"this is like make or break"},{"speaker":"Jordan Natter","startTime":332.72,"endTime":335.24,"body":"because they are using these"},{"speaker":"Jordan Natter","startTime":335.33,"endTime":337.46,"body":"things that are really old and"},{"speaker":"Jordan Natter","startTime":335.33,"endTime":337.46,"body":"they shouldn't be using these"},{"speaker":"Jordan Natter","startTime":337.76,"endTime":340.87,"body":"like algorithms anymore. Yeah,"},{"speaker":"Jordan Natter","startTime":337.76,"endTime":340.87,"body":"that that's how I would look at"},{"speaker":"Jordan Natter","startTime":340.93,"endTime":343.96,"body":"it, right? So to them, it's a"},{"speaker":"Jordan Natter","startTime":340.93,"endTime":343.96,"body":"really big deal because they can"},{"speaker":"Jordan Natter","startTime":344.08,"endTime":346.75,"body":"only look at the lower hanging"},{"speaker":"Jordan Natter","startTime":344.08,"endTime":346.75,"body":"fruit. For us, it's not a big"},{"speaker":"Jordan Natter","startTime":346.84,"endTime":348.25,"body":"deal because we're seeing the"},{"speaker":"Jordan Natter","startTime":346.84,"endTime":348.25,"body":"whole picture,"},{"speaker":"Brad Causey","startTime":348.73,"endTime":351.73,"body":"right? So, so yeah,"},{"speaker":"Brad Causey","startTime":348.73,"endTime":351.73,"body":"beautifully explained, by the"},{"speaker":"Brad Causey","startTime":351.73,"endTime":354.76,"body":"way. And I want to add to that"},{"speaker":"Brad Causey","startTime":351.73,"endTime":354.76,"body":"just a little bit, right? So I"},{"speaker":"Brad Causey","startTime":354.85,"endTime":358.21,"body":"can I can just arbitrarily go"},{"speaker":"Brad Causey","startTime":354.85,"endTime":358.21,"body":"pick, and and we're turning this"},{"speaker":"Brad Causey","startTime":358.27,"endTime":361.53,"body":"into a security scorecard like"},{"speaker":"Brad Causey","startTime":358.27,"endTime":361.53,"body":"like abuse, you know, episode,"},{"speaker":"Brad Causey","startTime":361.56,"endTime":364.47,"body":"and that's not what I meant to"},{"speaker":"Brad Causey","startTime":361.56,"endTime":364.47,"body":"do. But let me explain why we"},{"speaker":"Brad Causey","startTime":364.59,"endTime":366.6,"body":"feel the way that we do. Just,"},{"speaker":"Brad Causey","startTime":364.59,"endTime":366.6,"body":"just one last thing, and then"},{"speaker":"Brad Causey","startTime":366.6,"endTime":368.7,"body":"we'll move on to to to what some"},{"speaker":"Brad Causey","startTime":366.6,"endTime":368.7,"body":"of these different"},{"speaker":"Brad Causey","startTime":368.73,"endTime":372.54,"body":"vulnerabilities are. But, but"},{"speaker":"Brad Causey","startTime":368.73,"endTime":372.54,"body":"yeah, so like for example, I can"},{"speaker":"Brad Causey","startTime":372.6,"endTime":378.0,"body":"go arbitrarily take a a client"},{"speaker":"Brad Causey","startTime":372.6,"endTime":378.0,"body":"or or an organization that has a"},{"speaker":"Brad Causey","startTime":378.24,"endTime":382.07,"body":"perfect score in security"},{"speaker":"Brad Causey","startTime":378.24,"endTime":382.07,"body":"scorecard, and then they have a"},{"speaker":"Brad Causey","startTime":382.28,"endTime":386.99,"body":"terrible password policy and no"},{"speaker":"Brad Causey","startTime":382.28,"endTime":386.99,"body":"MFA, and I will get into their"},{"speaker":"Brad Causey","startTime":387.05,"endTime":390.29,"body":"environment and own everything"},{"speaker":"Brad Causey","startTime":387.05,"endTime":390.29,"body":"inside their network in a day."},{"speaker":"Brad Causey","startTime":391.7,"endTime":394.61,"body":"Right? Do I care that they have"},{"speaker":"Brad Causey","startTime":391.7,"endTime":394.61,"body":"Suite 32 on their web server?"},{"speaker":"Brad Causey","startTime":394.88,"endTime":397.58,"body":"That's probably a brochure"},{"speaker":"Brad Causey","startTime":394.88,"endTime":397.58,"body":"server anyway, like like just an"},{"speaker":"Brad Causey","startTime":397.61,"endTime":400.64,"body":"informational website."},{"speaker":"Brad Causey","startTime":397.61,"endTime":400.64,"body":"Absolutely not. So they're"},{"speaker":"Brad Causey","startTime":400.76,"endTime":403.12,"body":"looking at the things that don't"},{"speaker":"Brad Causey","startTime":400.76,"endTime":403.12,"body":"matter. We're looking at things"},{"speaker":"Brad Causey","startTime":403.21,"endTime":407.71,"body":"like that are material risk to"},{"speaker":"Brad Causey","startTime":403.21,"endTime":407.71,"body":"an organization that a threat"},{"speaker":"Brad Causey","startTime":407.8,"endTime":411.22,"body":"actor could take advantage of."},{"speaker":"Brad Causey","startTime":407.8,"endTime":411.22,"body":"Almost none of the findings that"},{"speaker":"Brad Causey","startTime":411.34,"endTime":414.55,"body":"show up in Security Scorecard"},{"speaker":"Brad Causey","startTime":411.34,"endTime":414.55,"body":"and Bidsight are meaningful in"},{"speaker":"Brad Causey","startTime":414.61,"endTime":416.86,"body":"that they are creating true"},{"speaker":"Brad Causey","startTime":414.61,"endTime":416.86,"body":"material risk for that"},{"speaker":"Brad Causey","startTime":416.92,"endTime":421.26,"body":"organization. However, by the"},{"speaker":"Brad Causey","startTime":416.92,"endTime":421.26,"body":"existence of the score, we're"},{"speaker":"Brad Causey","startTime":421.38,"endTime":424.89,"body":"creating reputational risk,"},{"speaker":"Brad Causey","startTime":421.38,"endTime":424.89,"body":"right? Now, I'm going to back up"},{"speaker":"Brad Causey","startTime":424.92,"endTime":427.02,"body":"for just a second because we've"},{"speaker":"Brad Causey","startTime":424.92,"endTime":427.02,"body":"said all the reasons why you"},{"speaker":"Brad Causey","startTime":427.14,"endTime":429.0,"body":"should not pay attention to"},{"speaker":"Brad Causey","startTime":427.14,"endTime":429.0,"body":"these things, and I do want to"},{"speaker":"Brad Causey","startTime":429.12,"endTime":432.24,"body":"add one thing to this that you"},{"speaker":"Brad Causey","startTime":429.12,"endTime":432.24,"body":"should pay attention to, and"},{"speaker":"Brad Causey","startTime":432.45,"endTime":436.65,"body":"this is we call it hygiene, and"},{"speaker":"Brad Causey","startTime":432.45,"endTime":436.65,"body":"this is just scanning and"},{"speaker":"Brad Causey","startTime":436.71,"endTime":438.96,"body":"patching, vulnerability"},{"speaker":"Brad Causey","startTime":436.71,"endTime":438.96,"body":"scanning, pen testing and"},{"speaker":"Brad Causey","startTime":439.02,"endTime":442.73,"body":"patching, and just having a"},{"speaker":"Brad Causey","startTime":439.02,"endTime":442.73,"body":"general, overall security"},{"speaker":"Brad Causey","startTime":442.85,"endTime":448.46,"body":"program that keeps old"},{"speaker":"Brad Causey","startTime":442.85,"endTime":448.46,"body":"vulnerabilities from surfacing"},{"speaker":"Brad Causey","startTime":448.49,"endTime":451.79,"body":"in my environment, right? And so"},{"speaker":"Brad Causey","startTime":448.49,"endTime":451.79,"body":"Suite 32, I think, came out in"},{"speaker":"Brad Causey","startTime":451.79,"endTime":457.04,"body":"2013, right? So it's a 16 year"},{"speaker":"Brad Causey","startTime":451.79,"endTime":457.04,"body":"old vulnerability, and so why am"},{"speaker":"Brad Causey","startTime":457.1,"endTime":459.11,"body":"I still seeing it in"},{"speaker":"Brad Causey","startTime":457.1,"endTime":459.11,"body":"environments, right? Well, the"},{"speaker":"Brad Causey","startTime":459.26,"endTime":461.53,"body":"reason that I'm seeing it is"},{"speaker":"Brad Causey","startTime":459.26,"endTime":461.53,"body":"because you do not have proper"},{"speaker":"Brad Causey","startTime":461.56,"endTime":464.65,"body":"hygiene, because you do not have"},{"speaker":"Brad Causey","startTime":461.56,"endTime":464.65,"body":"a vulnerability management"},{"speaker":"Brad Causey","startTime":464.68,"endTime":468.76,"body":"program, or your asset"},{"speaker":"Brad Causey","startTime":464.68,"endTime":468.76,"body":"management and inventory is out"},{"speaker":"Brad Causey","startTime":468.79,"endTime":470.95,"body":"of date, and you have systems"},{"speaker":"Brad Causey","startTime":468.79,"endTime":470.95,"body":"out there that are not part of"},{"speaker":"Brad Causey","startTime":470.95,"endTime":475.45,"body":"that program. Whichever way you"},{"speaker":"Brad Causey","startTime":470.95,"endTime":475.45,"body":"want to look at it, I do not"},{"speaker":"Brad Causey","startTime":475.54,"endTime":478.87,"body":"want a 16-year-old vulnerability"},{"speaker":"Brad Causey","startTime":475.54,"endTime":478.87,"body":"in my environment. Does that"},{"speaker":"Brad Causey","startTime":478.87,"endTime":480.82,"body":"make sense? Whether it's"},{"speaker":"Brad Causey","startTime":478.87,"endTime":480.82,"body":"exploitable or not, I don't"},{"speaker":"Brad Causey","startTime":480.82,"endTime":482.79,"body":"care. We're talking about"},{"speaker":"Brad Causey","startTime":480.82,"endTime":482.79,"body":"hygiene at this point. Like, am"},{"speaker":"Brad Causey","startTime":482.88,"endTime":486.72,"body":"I doing a good job as a security"},{"speaker":"Brad Causey","startTime":482.88,"endTime":486.72,"body":"practitioner? And the answer is,"},{"speaker":"Brad Causey","startTime":486.78,"endTime":488.79,"body":"if I have 16-year-old high-risk"},{"speaker":"Brad Causey","startTime":486.78,"endTime":488.79,"body":"vulnerabilities in my"},{"speaker":"Brad Causey","startTime":488.85,"endTime":491.1,"body":"environment, probably not,"},{"speaker":"Brad Causey","startTime":488.85,"endTime":491.1,"body":"right?"},{"speaker":"Jordan Natter","startTime":491.16,"endTime":493.95,"body":"Well, that, in in"},{"speaker":"Jordan Natter","startTime":491.16,"endTime":493.95,"body":"my opinion, if I see that, I'm"},{"speaker":"Jordan Natter","startTime":494.16,"endTime":496.95,"body":"instantly wondering what else"},{"speaker":"Jordan Natter","startTime":494.16,"endTime":496.95,"body":"are they not keeping up with,"},{"speaker":"Jordan Natter","startTime":497.13,"endTime":498.0,"body":"right? Bingo. If it's"},{"speaker":"Brad Causey","startTime":498.089,"endTime":498.869,"body":"bingo, yes,"},{"speaker":"Jordan Natter","startTime":499.44,"endTime":501.53,"body":"especially for"},{"speaker":"Jordan Natter","startTime":499.44,"endTime":501.53,"body":"things that tend to be easier to"},{"speaker":"Jordan Natter","startTime":501.62,"endTime":504.71,"body":"fix, even if they are just those"},{"speaker":"Jordan Natter","startTime":501.62,"endTime":504.71,"body":"hygiene issues. Like if you're"},{"speaker":"Jordan Natter","startTime":504.74,"endTime":507.74,"body":"not fixing those, what else"},{"speaker":"Jordan Natter","startTime":504.74,"endTime":507.74,"body":"aren't you fixing? Especially if"},{"speaker":"Jordan Natter","startTime":507.74,"endTime":511.07,"body":"those are easy to fix. Like what"},{"speaker":"Jordan Natter","startTime":507.74,"endTime":511.07,"body":"big thing that's hard to fix"},{"speaker":"Jordan Natter","startTime":511.13,"endTime":513.68,"body":"that's even more vulnerable are"},{"speaker":"Jordan Natter","startTime":511.13,"endTime":513.68,"body":"you not fixing because of how"},{"speaker":"Jordan Natter","startTime":513.86,"endTime":514.7,"body":"old it"},{"speaker":"Brad Causey","startTime":514.7,"endTime":517.19,"body":"is? And that's"},{"speaker":"Brad Causey","startTime":514.7,"endTime":517.19,"body":"actually that that's actually"},{"speaker":"Brad Causey","startTime":517.19,"endTime":520.6,"body":"exactly why you could make the"},{"speaker":"Brad Causey","startTime":517.19,"endTime":520.6,"body":"case that security scorecard and"},{"speaker":"Brad Causey","startTime":520.63,"endTime":525.49,"body":"bitsight matter, right? Because"},{"speaker":"Brad Causey","startTime":520.63,"endTime":525.49,"body":"if I've got a 75 score, which I"},{"speaker":"Brad Causey","startTime":525.55,"endTime":528.7,"body":"mean, that's still passing,"},{"speaker":"Brad Causey","startTime":525.55,"endTime":528.7,"body":"right? I guess so. Like that's a"},{"speaker":"Brad Causey","startTime":528.82,"endTime":533.89,"body":"C, isn't it? Yeah. So like, if I"},{"speaker":"Brad Causey","startTime":528.82,"endTime":533.89,"body":"have a 75 score, and and and"},{"speaker":"Brad Causey","startTime":533.95,"endTime":537.79,"body":"security scorecard is able to"},{"speaker":"Brad Causey","startTime":533.95,"endTime":537.79,"body":"find all these issues, then"},{"speaker":"Brad Causey","startTime":537.85,"endTime":540.01,"body":"maybe I have other things going"},{"speaker":"Brad Causey","startTime":537.85,"endTime":540.01,"body":"on that are pretty serious,"},{"speaker":"Brad Causey","startTime":540.13,"endTime":542.94,"body":"right? So so again, I don't mean"},{"speaker":"Brad Causey","startTime":540.13,"endTime":542.94,"body":"to be completely dismissive of"},{"speaker":"Brad Causey","startTime":542.94,"endTime":545.94,"body":"the platforms. Maybe they"},{"speaker":"Brad Causey","startTime":542.94,"endTime":545.94,"body":"provide value to somebody who,"},{"speaker":"Brad Causey","startTime":546.24,"endTime":548.91,"body":"again, usually people who don't"},{"speaker":"Brad Causey","startTime":546.24,"endTime":548.91,"body":"know how this stuff works are"},{"speaker":"Brad Causey","startTime":549.0,"endTime":551.4,"body":"the people that are in security"},{"speaker":"Brad Causey","startTime":549.0,"endTime":551.4,"body":"scorecard that are that care"},{"speaker":"Brad Causey","startTime":551.49,"endTime":554.43,"body":"about those scores, and again,"},{"speaker":"Brad Causey","startTime":551.49,"endTime":554.43,"body":"not not being dismissive of"},{"speaker":"Brad Causey","startTime":554.46,"endTime":557.34,"body":"their opinion or anything like"},{"speaker":"Brad Causey","startTime":554.46,"endTime":557.34,"body":"that. So, said all of that to"},{"speaker":"Brad Causey","startTime":557.43,"endTime":561.98,"body":"say, the cryptographic failures"},{"speaker":"Brad Causey","startTime":557.43,"endTime":561.98,"body":"of A 04 really focused in for"},{"speaker":"Brad Causey","startTime":562.01,"endTime":565.64,"body":"the most part on two broad"},{"speaker":"Brad Causey","startTime":562.01,"endTime":565.64,"body":"categories, right? Data in"},{"speaker":"Brad Causey","startTime":565.79,"endTime":568.94,"body":"transit, which is where HTTPS"},{"speaker":"Brad Causey","startTime":565.79,"endTime":568.94,"body":"comes into play, right? How"},{"speaker":"Brad Causey","startTime":569.09,"endTime":572.03,"body":"secure is the information I'm"},{"speaker":"Brad Causey","startTime":569.09,"endTime":572.03,"body":"sending back and forth across"},{"speaker":"Brad Causey","startTime":572.09,"endTime":576.26,"body":"the network, and then the second"},{"speaker":"Brad Causey","startTime":572.09,"endTime":576.26,"body":"half of that is is data stored,"},{"speaker":"Brad Causey","startTime":576.56,"endTime":581.38,"body":"right? Storage of data securely,"},{"speaker":"Brad Causey","startTime":576.56,"endTime":581.38,"body":"and so that comes down, and"},{"speaker":"Brad Causey","startTime":581.41,"endTime":584.83,"body":"we're going to further break"},{"speaker":"Brad Causey","startTime":581.41,"endTime":584.83,"body":"both of those down into two"},{"speaker":"Brad Causey","startTime":585.07,"endTime":589.03,"body":"broad categories of of problems"},{"speaker":"Brad Causey","startTime":585.07,"endTime":589.03,"body":"that we're solving. The first"},{"speaker":"Brad Causey","startTime":589.09,"endTime":593.8,"body":"one is going to be the integrity"},{"speaker":"Brad Causey","startTime":589.09,"endTime":593.8,"body":"of my data. All right, when I"},{"speaker":"Brad Causey","startTime":594.07,"endTime":597.31,"body":"send it over the network, does"},{"speaker":"Brad Causey","startTime":594.07,"endTime":597.31,"body":"it arrive at its destination"},{"speaker":"Brad Causey","startTime":597.34,"endTime":600.33,"body":"without being modified, right?"},{"speaker":"Brad Causey","startTime":597.34,"endTime":600.33,"body":"Or somewhat can. One in the"},{"speaker":"Brad Causey","startTime":600.45,"endTime":604.29,"body":"middle tamper with my stuff."},{"speaker":"Brad Causey","startTime":600.45,"endTime":604.29,"body":"Okay, so so we're going to call"},{"speaker":"Brad Causey","startTime":604.35,"endTime":607.05,"body":"that you know the transport"},{"speaker":"Brad Causey","startTime":604.35,"endTime":607.05,"body":"security, which is literally"},{"speaker":"Brad Causey","startTime":607.17,"endTime":613.32,"body":"what the T in TLS stands for."},{"speaker":"Brad Causey","startTime":607.17,"endTime":613.32,"body":"And so so yeah, so so the the"},{"speaker":"Brad Causey","startTime":613.62,"endTime":615.96,"body":"movement of data securely, but"},{"speaker":"Brad Causey","startTime":613.62,"endTime":615.96,"body":"then the storage of data"},{"speaker":"Brad Causey","startTime":616.02,"endTime":619.89,"body":"securely so that it can't be"},{"speaker":"Brad Causey","startTime":616.02,"endTime":619.89,"body":"read, right? And so if I'm"},{"speaker":"Brad Causey","startTime":620.07,"endTime":622.67,"body":"sending sensitive information or"},{"speaker":"Brad Causey","startTime":620.07,"endTime":622.67,"body":"storing sensitive information"},{"speaker":"Brad Causey","startTime":622.79,"endTime":627.47,"body":"like credit card numbers, like"},{"speaker":"Brad Causey","startTime":622.79,"endTime":627.47,"body":"like passwords, for example, in"},{"speaker":"Brad Causey","startTime":627.5,"endTime":631.4,"body":"a database. Am I adequately"},{"speaker":"Brad Causey","startTime":627.5,"endTime":631.4,"body":"protecting that information as"},{"speaker":"Brad Causey","startTime":631.46,"endTime":634.79,"body":"it's being stored? And this goes"},{"speaker":"Brad Causey","startTime":631.46,"endTime":634.79,"body":"into like all different kinds of"},{"speaker":"Brad Causey","startTime":634.85,"endTime":637.22,"body":"subcategories, right? And we're"},{"speaker":"Brad Causey","startTime":634.85,"endTime":637.22,"body":"going to talk about one of them."},{"speaker":"Brad Causey","startTime":637.67,"endTime":639.83,"body":"I think because you got a pretty"},{"speaker":"Brad Causey","startTime":637.67,"endTime":639.83,"body":"cool story that we're going to"},{"speaker":"Brad Causey","startTime":639.86,"endTime":643.15,"body":"dive into. In fact, we should"},{"speaker":"Brad Causey","startTime":639.86,"endTime":643.15,"body":"probably dive into that and then"},{"speaker":"Brad Causey","startTime":643.21,"endTime":645.34,"body":"dissect it afterwards. I think"},{"speaker":"Brad Causey","startTime":643.21,"endTime":645.34,"body":"that would be a really good"},{"speaker":"Brad Causey","startTime":645.46,"endTime":648.28,"body":"segue into, like, hey, let's"},{"speaker":"Brad Causey","startTime":645.46,"endTime":648.28,"body":"tell you about some things that"},{"speaker":"Brad Causey","startTime":648.31,"endTime":649.78,"body":"actually matter. You know what I"},{"speaker":"Brad Causey","startTime":648.31,"endTime":649.78,"body":"mean?"},{"speaker":"Jordan Natter","startTime":651.19,"endTime":653.53,"body":"Is this the JWT"},{"speaker":"Jordan Natter","startTime":651.19,"endTime":653.53,"body":"one? Yeah, yeah, let's do that"},{"speaker":"Jordan Natter","startTime":653.74,"endTime":654.55,"body":"one. Yeah, yeah, if"},{"speaker":"Brad Causey","startTime":654.58,"endTime":654.97,"body":"you don't mind."},{"speaker":"Jordan Natter","startTime":655.75,"endTime":658.21,"body":"All right, first,"},{"speaker":"Jordan Natter","startTime":655.75,"endTime":658.21,"body":"I'm going to let Brad talk about"},{"speaker":"Jordan Natter","startTime":658.27,"endTime":660.63,"body":"what a JWT is because he always"},{"speaker":"Jordan Natter","startTime":658.27,"endTime":660.63,"body":"likes to steal the thunder for"},{"speaker":"Jordan Natter","startTime":660.66,"endTime":664.17,"body":"that part. So, take it away, and"},{"speaker":"Jordan Natter","startTime":660.66,"endTime":664.17,"body":"then I will tell the story."},{"speaker":"Brad Causey","startTime":664.71,"endTime":667.47,"body":"So, JSON Web Token"},{"speaker":"Brad Causey","startTime":664.71,"endTime":667.47,"body":"JWT. If for for those of you"},{"speaker":"Brad Causey","startTime":667.5,"endTime":670.23,"body":"that listen to the to the"},{"speaker":"Brad Causey","startTime":667.5,"endTime":670.23,"body":"podcast on the regular, you've"},{"speaker":"Brad Causey","startTime":670.23,"endTime":674.1,"body":"heard us talk about this many"},{"speaker":"Brad Causey","startTime":670.23,"endTime":674.1,"body":"times. You know, we find them"},{"speaker":"Brad Causey","startTime":674.22,"endTime":678.48,"body":"for the most part in these web"},{"speaker":"Brad Causey","startTime":674.22,"endTime":678.48,"body":"applications and APIs, mobile"},{"speaker":"Brad Causey","startTime":678.75,"endTime":681.8,"body":"apps, and they're generally"},{"speaker":"Brad Causey","startTime":678.75,"endTime":681.8,"body":"they're almost like a more"},{"speaker":"Brad Causey","startTime":681.92,"endTime":686.99,"body":"complex session token, and so"},{"speaker":"Brad Causey","startTime":681.92,"endTime":686.99,"body":"you know at at its core, a JWT"},{"speaker":"Brad Causey","startTime":687.11,"endTime":693.32,"body":"is comprised of you know it's"},{"speaker":"Brad Causey","startTime":687.11,"endTime":693.32,"body":"JSON, right? Big surprise, and"},{"speaker":"Brad Causey","startTime":693.44,"endTime":698.48,"body":"and inside of it's a base 64"},{"speaker":"Brad Causey","startTime":693.44,"endTime":698.48,"body":"encoded JSON key value pair"},{"speaker":"Brad Causey","startTime":699.92,"endTime":705.37,"body":"structure, and so inside of it,"},{"speaker":"Brad Causey","startTime":699.92,"endTime":705.37,"body":"though, we we are going to sign"},{"speaker":"Brad Causey","startTime":706.03,"endTime":709.15,"body":"the body of that, and that's"},{"speaker":"Brad Causey","startTime":706.03,"endTime":709.15,"body":"where the cryptographic stuff"},{"speaker":"Brad Causey","startTime":709.21,"endTime":711.7,"body":"comes into play. But at the end"},{"speaker":"Brad Causey","startTime":709.21,"endTime":711.7,"body":"of the day, JSON is basically"},{"speaker":"Brad Causey","startTime":711.76,"endTime":714.82,"body":"just a way for the web server or"},{"speaker":"Brad Causey","startTime":711.76,"endTime":714.82,"body":"the web service to identify who"},{"speaker":"Brad Causey","startTime":714.94,"endTime":718.15,"body":"I am, and in some cases, what"},{"speaker":"Brad Causey","startTime":714.94,"endTime":718.15,"body":"I'm allowed to do or not do. And"},{"speaker":"Brad Causey","startTime":718.18,"endTime":720.72,"body":"there there are usually like"},{"speaker":"Brad Causey","startTime":718.18,"endTime":720.72,"body":"timestamps in there, and there's"},{"speaker":"Brad Causey","startTime":720.78,"endTime":723.24,"body":"all these different things, and"},{"speaker":"Brad Causey","startTime":720.78,"endTime":723.24,"body":"and I've seen some JWTs. They're"},{"speaker":"Brad Causey","startTime":723.42,"endTime":727.17,"body":"huge and full of like group"},{"speaker":"Brad Causey","startTime":723.42,"endTime":727.17,"body":"memberships and access and"},{"speaker":"Brad Causey","startTime":727.2,"endTime":730.26,"body":"permissions and all this crazy"},{"speaker":"Brad Causey","startTime":727.2,"endTime":730.26,"body":"stuff. And so they are"},{"speaker":"Brad Causey","startTime":730.38,"endTime":734.07,"body":"interesting, they are valuable,"},{"speaker":"Brad Causey","startTime":730.38,"endTime":734.07,"body":"but we still have to protect"},{"speaker":"Brad Causey","startTime":734.13,"endTime":735.24,"body":"them. And now it's back to you."},{"speaker":"Jordan Natter","startTime":735.84,"endTime":738.48,"body":"Yes, and as"},{"speaker":"Jordan Natter","startTime":735.84,"endTime":738.48,"body":"you've heard from us many many"},{"speaker":"Jordan Natter","startTime":738.57,"endTime":742.04,"body":"times, we do talk about JWTs a"},{"speaker":"Jordan Natter","startTime":738.57,"endTime":742.04,"body":"lot because that happens to be a"},{"speaker":"Jordan Natter","startTime":742.1,"endTime":745.13,"body":"thing we commonly see and one"},{"speaker":"Jordan Natter","startTime":742.1,"endTime":745.13,"body":"thing that we actually, for"},{"speaker":"Jordan Natter","startTime":745.19,"endTime":748.07,"body":"whatever reason, enjoy. It's fun"},{"speaker":"Jordan Natter","startTime":745.19,"endTime":748.07,"body":"to take"},{"speaker":"Brad Causey","startTime":748.07,"endTime":749.42,"body":"it apart so we can"},{"speaker":"Brad Causey","startTime":748.07,"endTime":749.42,"body":"do with it, right?"},{"speaker":"Jordan Natter","startTime":749.48,"endTime":751.61,"body":"Yes, yes. I mean,"},{"speaker":"Jordan Natter","startTime":749.48,"endTime":751.61,"body":"who doesn't like to decode a"},{"speaker":"Jordan Natter","startTime":751.88,"endTime":754.19,"body":"JWT? I'm just saying you can"},{"speaker":"Jordan Natter","startTime":751.88,"endTime":754.19,"body":"find you can find some"},{"speaker":"Jordan Natter","startTime":754.28,"endTime":759.17,"body":"interesting things. So, on that"},{"speaker":"Jordan Natter","startTime":754.28,"endTime":759.17,"body":"note, in this story, it has to"},{"speaker":"Jordan Natter","startTime":759.2,"endTime":763.9,"body":"do with JWT's magic. So in this"},{"speaker":"Jordan Natter","startTime":759.2,"endTime":763.9,"body":"case, I started off the pin"},{"speaker":"Jordan Natter","startTime":763.96,"endTime":766.72,"body":"test, right? I noticed they're"},{"speaker":"Jordan Natter","startTime":763.96,"endTime":766.72,"body":"using a JWT for authentication."},{"speaker":"Jordan Natter","startTime":767.38,"endTime":770.62,"body":"Cool, nothing special about"},{"speaker":"Jordan Natter","startTime":767.38,"endTime":770.62,"body":"that, right? So I go ahead and"},{"speaker":"Jordan Natter","startTime":770.8,"endTime":774.7,"body":"decode the JWT. All right, it's"},{"speaker":"Jordan Natter","startTime":770.8,"endTime":774.7,"body":"still normal stuff, right? I see"},{"speaker":"Jordan Natter","startTime":774.76,"endTime":778.36,"body":"a user ID, I see an email, role,"},{"speaker":"Jordan Natter","startTime":774.76,"endTime":778.36,"body":"expiration. Nothing typically"},{"speaker":"Jordan Natter","startTime":778.42,"endTime":782.76,"body":"surprising, but pin tester brain"},{"speaker":"Jordan Natter","startTime":778.42,"endTime":782.76,"body":"is already like okay I see a"},{"speaker":"Jordan Natter","startTime":782.88,"endTime":786.99,"body":"role so that is telling me"},{"speaker":"Jordan Natter","startTime":782.88,"endTime":786.99,"body":"telling the web server what role"},{"speaker":"Jordan Natter","startTime":787.08,"endTime":790.8,"body":"my like user has permissions for"},{"speaker":"Jordan Natter","startTime":787.08,"endTime":790.8,"body":"right so in this case I'm that's"},{"speaker":"Jordan Natter","startTime":790.86,"endTime":795.6,"body":"pretty common yes yes nothing"},{"speaker":"Jordan Natter","startTime":790.86,"endTime":795.6,"body":"nothing inherently bad about"},{"speaker":"Jordan Natter","startTime":795.66,"endTime":798.81,"body":"that right this is all very"},{"speaker":"Jordan Natter","startTime":795.66,"endTime":798.81,"body":"typical right now so I'm like"},{"speaker":"Jordan Natter","startTime":798.93,"endTime":802.49,"body":"okay cool pin test your brain I"},{"speaker":"Jordan Natter","startTime":798.93,"endTime":802.49,"body":"see I have a role. Can I somehow"},{"speaker":"Jordan Natter","startTime":802.7,"endTime":805.61,"body":"make that role a higher"},{"speaker":"Jordan Natter","startTime":802.7,"endTime":805.61,"body":"privileged user? Right? Maybe I"},{"speaker":"Jordan Natter","startTime":805.67,"endTime":808.85,"body":"want to go from a user to an"},{"speaker":"Jordan Natter","startTime":805.67,"endTime":808.85,"body":"administrator. All right, cool,"},{"speaker":"Jordan Natter","startTime":808.94,"endTime":811.58,"body":"cool. All right. So what are"},{"speaker":"Jordan Natter","startTime":808.94,"endTime":811.58,"body":"they signing the token with?"},{"speaker":"Jordan Natter","startTime":811.97,"endTime":815.84,"body":"Well, in this case, they're"},{"speaker":"Jordan Natter","startTime":811.97,"endTime":815.84,"body":"using HS 256 again. Not"},{"speaker":"Jordan Natter","startTime":815.9,"endTime":818.75,"body":"inherently bad by itself. All"},{"speaker":"Jordan Natter","startTime":815.9,"endTime":818.75,"body":"right. That's totally fine."},{"speaker":"Jordan Natter","startTime":818.87,"endTime":823.15,"body":"That's just a totally fine"},{"speaker":"Jordan Natter","startTime":818.87,"endTime":823.15,"body":"algorithm, right? But in this"},{"speaker":"Jordan Natter","startTime":823.27,"endTime":826.33,"body":"case, what we ended up having a"},{"speaker":"Jordan Natter","startTime":823.27,"endTime":826.33,"body":"weird component where we"},{"speaker":"Jordan Natter","startTime":826.57,"endTime":830.92,"body":"actually were able to get the"},{"speaker":"Jordan Natter","startTime":826.57,"endTime":830.92,"body":"JWT secret with from a"},{"speaker":"Jordan Natter","startTime":831.1,"endTime":833.8,"body":"configuration backup that was"},{"speaker":"Jordan Natter","startTime":831.1,"endTime":833.8,"body":"left exposed on the web server."},{"speaker":"Jordan Natter","startTime":834.19,"endTime":835.84,"body":"That is where it becomes secret."},{"speaker":"Brad Causey","startTime":836.56,"endTime":838.9,"body":"Okay. Yes. All"},{"speaker":"Brad Causey","startTime":836.56,"endTime":838.9,"body":"right. That's jacked up, man."},{"speaker":"Jordan Natter","startTime":839.98,"endTime":845.88,"body":"So now I can take"},{"speaker":"Jordan Natter","startTime":839.98,"endTime":845.88,"body":"that. Wow, it's my secret now."},{"speaker":"Jordan Natter","startTime":848.31,"endTime":852.36,"body":"So now I have the secret, right?"},{"speaker":"Jordan Natter","startTime":848.31,"endTime":852.36,"body":"So now I can tamper with the"},{"speaker":"Jordan Natter","startTime":852.54,"endTime":856.26,"body":"signature, and that now gives me"},{"speaker":"Jordan Natter","startTime":852.54,"endTime":856.26,"body":"access to tamper with everything"},{"speaker":"Jordan Natter","startTime":856.32,"endTime":860.99,"body":"within the JWT. So now I can"},{"speaker":"Jordan Natter","startTime":856.32,"endTime":860.99,"body":"change what the user is and"},{"speaker":"Jordan Natter","startTime":861.02,"endTime":864.41,"body":"change it to administrator, then"},{"speaker":"Jordan Natter","startTime":861.02,"endTime":864.41,"body":"re-sign it and then send it off"},{"speaker":"Jordan Natter","startTime":864.47,"endTime":865.04,"body":"to the web server."},{"speaker":"Brad Causey","startTime":865.64,"endTime":868.16,"body":"Yeah, absolutely."},{"speaker":"Brad Causey","startTime":865.64,"endTime":868.16,"body":"And and this story that you"},{"speaker":"Brad Causey","startTime":868.19,"endTime":870.5,"body":"describe is not even that"},{"speaker":"Brad Causey","startTime":868.19,"endTime":870.5,"body":"uncommon, right? Yeah. There are"},{"speaker":"Brad Causey","startTime":870.59,"endTime":873.62,"body":"variations of that that I've"},{"speaker":"Brad Causey","startTime":870.59,"endTime":873.62,"body":"seen in web apps where like the"},{"speaker":"Brad Causey","startTime":874.07,"endTime":876.89,"body":"the mechanism on the web server"},{"speaker":"Brad Causey","startTime":874.07,"endTime":876.89,"body":"side that's supposed to do the"},{"speaker":"Brad Causey","startTime":876.89,"endTime":881.35,"body":"validation is just off. So like"},{"speaker":"Brad Causey","startTime":876.89,"endTime":881.35,"body":"even though it's signed and I"},{"speaker":"Brad Causey","startTime":881.47,"endTime":884.86,"body":"don't know what the key is, I"},{"speaker":"Brad Causey","startTime":881.47,"endTime":884.86,"body":"can just tamper with it, and the"},{"speaker":"Brad Causey","startTime":884.86,"endTime":886.96,"body":"server's like, \"Yeah, Roger"},{"speaker":"Brad Causey","startTime":884.86,"endTime":886.96,"body":"that, Sergeant, and it's just"},{"speaker":"Brad Causey","startTime":886.99,"endTime":889.87,"body":"like kicking back whatever I ask"},{"speaker":"Brad Causey","startTime":886.99,"endTime":889.87,"body":"for. So there's a lot of"},{"speaker":"Brad Causey","startTime":889.87,"endTime":892.84,"body":"variance in there, but but but"},{"speaker":"Brad Causey","startTime":889.87,"endTime":892.84,"body":"improperly implemented"},{"speaker":"Brad Causey","startTime":893.29,"endTime":895.48,"body":"cryptography is really what we"},{"speaker":"Brad Causey","startTime":893.29,"endTime":895.48,"body":"come at what we're coming down"},{"speaker":"Brad Causey","startTime":895.54,"endTime":899.74,"body":"to, and that can take the form"},{"speaker":"Brad Causey","startTime":895.54,"endTime":899.74,"body":"of like you describe loss of"},{"speaker":"Brad Causey","startTime":899.8,"endTime":904.59,"body":"key. Right, and and this can be"},{"speaker":"Brad Causey","startTime":899.8,"endTime":904.59,"body":"anything, right? Like, I mean,"},{"speaker":"Brad Causey","startTime":904.8,"endTime":908.76,"body":"you know, compromising private"},{"speaker":"Brad Causey","startTime":904.8,"endTime":908.76,"body":"keys on SSL and TLS and stuff"},{"speaker":"Brad Causey","startTime":908.79,"endTime":912.3,"body":"like that. So, like, there there"},{"speaker":"Brad Causey","startTime":908.79,"endTime":912.3,"body":"are some practical exploits that"},{"speaker":"Brad Causey","startTime":912.33,"endTime":914.94,"body":"are relevant to A 04."},{"speaker":"Jordan Natter","startTime":915.75,"endTime":915.84,"body":"Yes."},{"speaker":"Brad Causey","startTime":916.32,"endTime":918.99,"body":"All right, cool."},{"speaker":"Brad Causey","startTime":916.32,"endTime":918.99,"body":"No, I love that. Absolutely love"},{"speaker":"Brad Causey","startTime":919.02,"endTime":920.96,"body":"that. And one other thing I do"},{"speaker":"Brad Causey","startTime":919.02,"endTime":920.96,"body":"want to mention really quick is"},{"speaker":"Brad Causey","startTime":921.08,"endTime":923.39,"body":"for those of you that have been"},{"speaker":"Brad Causey","startTime":921.08,"endTime":923.39,"body":"around the web dev world for a"},{"speaker":"Brad Causey","startTime":923.42,"endTime":926.75,"body":"little while, and you're used to"},{"speaker":"Brad Causey","startTime":923.42,"endTime":926.75,"body":"seeing passwords stored in MD"},{"speaker":"Brad Causey","startTime":926.87,"endTime":930.56,"body":"five and SHA one format. We"},{"speaker":"Brad Causey","startTime":926.87,"endTime":930.56,"body":"stopped doing that like 20 years"},{"speaker":"Brad Causey","startTime":930.59,"endTime":936.29,"body":"ago, by the way. I still see it"},{"speaker":"Brad Causey","startTime":930.59,"endTime":936.29,"body":"all the time. No, I mean maybe"},{"speaker":"Brad Causey","startTime":936.44,"endTime":938.66,"body":"maybe I'm projecting. Okay,"},{"speaker":"Brad Causey","startTime":936.44,"endTime":938.66,"body":"maybe I'm projecting a little"},{"speaker":"Brad Causey","startTime":938.69,"endTime":941.41,"body":"bit, but but but what I'm"},{"speaker":"Brad Causey","startTime":938.69,"endTime":941.41,"body":"getting at though is these"},{"speaker":"Brad Causey","startTime":941.5,"endTime":944.05,"body":"libraries are still out there,"},{"speaker":"Brad Causey","startTime":941.5,"endTime":944.05,"body":"right? And so I know you see it"},{"speaker":"Brad Causey","startTime":944.08,"endTime":947.2,"body":"in the in the mobile world all"},{"speaker":"Brad Causey","startTime":944.08,"endTime":947.2,"body":"the time, so much where where"},{"speaker":"Brad Causey","startTime":947.26,"endTime":951.25,"body":"it's like you know non-random"},{"speaker":"Brad Causey","startTime":947.26,"endTime":951.25,"body":"numbers being used for secrets."},{"speaker":"Brad Causey","startTime":951.7,"endTime":956.35,"body":"We see the use of MD5 and SHA"},{"speaker":"Brad Causey","startTime":951.7,"endTime":956.35,"body":"for what should be encryption"},{"speaker":"Brad Causey","startTime":956.59,"endTime":960.93,"body":"and or or even secure hashing."},{"speaker":"Brad Causey","startTime":956.59,"endTime":960.93,"body":"So there are better ways to do"},{"speaker":"Brad Causey","startTime":961.08,"endTime":965.37,"body":"that. So there's a Argon 2s"},{"speaker":"Brad Causey","startTime":961.08,"endTime":965.37,"body":"Crypt for password has like"},{"speaker":"Brad Causey","startTime":965.52,"endTime":969.87,"body":"really good password hashes, and"},{"speaker":"Brad Causey","startTime":965.52,"endTime":969.87,"body":"then you know I think it also"},{"speaker":"Brad Causey","startTime":970.17,"endTime":972.54,"body":"and I'm going to step off the"},{"speaker":"Brad Causey","startTime":970.17,"endTime":972.54,"body":"side for just a second when we"},{"speaker":"Brad Causey","startTime":972.54,"endTime":977.94,"body":"start talking about TLS SSL, all"},{"speaker":"Brad Causey","startTime":972.54,"endTime":977.94,"body":"of the headers that go with that"},{"speaker":"Brad Causey","startTime":978.12,"endTime":985.1,"body":"right HSTS Secure renegotiation,"},{"speaker":"Brad Causey","startTime":978.12,"endTime":985.1,"body":"expiration-all of those kind of"},{"speaker":"Brad Causey","startTime":985.25,"endTime":990.74,"body":"fall into this session"},{"speaker":"Brad Causey","startTime":985.25,"endTime":990.74,"body":"management category, which again"},{"speaker":"Brad Causey","startTime":990.89,"endTime":995.9,"body":"are just kind of subcategories"},{"speaker":"Brad Causey","startTime":990.89,"endTime":995.9,"body":"of A04. No, I love that. I think"},{"speaker":"Brad Causey","startTime":995.93,"endTime":997.82,"body":"that's absolutely good. I'm"},{"speaker":"Brad Causey","startTime":995.93,"endTime":997.82,"body":"trying to see if there's"},{"speaker":"Brad Causey","startTime":997.85,"endTime":1000.07,"body":"anything else in my notes that"},{"speaker":"Brad Causey","startTime":997.85,"endTime":1000.07,"body":"we want to hit on. Do you have"},{"speaker":"Brad Causey","startTime":1000.1,"endTime":1004.14,"body":"anything else that you want to"},{"speaker":"Brad Causey","startTime":1000.1,"endTime":1004.14,"body":"cover before I kind of wrap up?"},{"speaker":"Brad Causey","startTime":1004.17,"endTime":1005.97,"body":"There's one thing I do want to"},{"speaker":"Brad Causey","startTime":1004.17,"endTime":1005.97,"body":"mention before we wrap."},{"speaker":"Jordan Natter","startTime":1007.17,"endTime":1009.24,"body":"I was thinking we"},{"speaker":"Jordan Natter","startTime":1007.17,"endTime":1009.24,"body":"talk about the kind of coffee"},{"speaker":"Jordan Natter","startTime":1009.57,"endTime":1012.57,"body":"shop incident where we talk"},{"speaker":"Jordan Natter","startTime":1009.57,"endTime":1012.57,"body":"about how difficult it is to"},{"speaker":"Jordan Natter","startTime":1012.66,"endTime":1013.86,"body":"actually exploit. Let's do that."},{"speaker":"Brad Causey","startTime":1014.73,"endTime":1016.65,"body":"Yeah. Okay. So, so"},{"speaker":"Brad Causey","startTime":1014.73,"endTime":1016.65,"body":"what Jordan's talking about here"},{"speaker":"Brad Causey","startTime":1017.61,"endTime":1020.69,"body":"is is is another reason that we"},{"speaker":"Brad Causey","startTime":1017.61,"endTime":1020.69,"body":"don't love a lot of these like"},{"speaker":"Brad Causey","startTime":1020.78,"endTime":1024.98,"body":"Sweet 32 Beast, I wish I had the"},{"speaker":"Brad Causey","startTime":1020.78,"endTime":1024.98,"body":"list in front of me because"},{"speaker":"Brad Causey","startTime":1024.98,"endTime":1028.07,"body":"there's like there's a there's"},{"speaker":"Brad Causey","startTime":1024.98,"endTime":1028.07,"body":"like 15 of them, right? But the"},{"speaker":"Brad Causey","startTime":1028.19,"endTime":1031.97,"body":"point is like these name they"},{"speaker":"Brad Causey","startTime":1028.19,"endTime":1031.97,"body":"sound super scary, you know. And"},{"speaker":"Brad Causey","startTime":1031.97,"endTime":1033.89,"body":"then you go read about them,"},{"speaker":"Brad Causey","startTime":1031.97,"endTime":1033.89,"body":"they're like, oh, dude, I can"},{"speaker":"Brad Causey","startTime":1033.95,"endTime":1037.49,"body":"totally like steal all the data"},{"speaker":"Brad Causey","startTime":1033.95,"endTime":1037.49,"body":"in your session if I'm in the"},{"speaker":"Brad Causey","startTime":1037.55,"endTime":1039.8,"body":"man in the middle type scenario."},{"speaker":"Brad Causey","startTime":1037.55,"endTime":1039.8,"body":"So the reason that we don't love"},{"speaker":"Brad Causey","startTime":1039.83,"endTime":1042.04,"body":"these cryptographic"},{"speaker":"Brad Causey","startTime":1039.83,"endTime":1042.04,"body":"vulnerabilities in the context"},{"speaker":"Brad Causey","startTime":1042.07,"endTime":1044.95,"body":"of things like TLS SSL is"},{"speaker":"Brad Causey","startTime":1042.07,"endTime":1044.95,"body":"because the barrier for"},{"speaker":"Brad Causey","startTime":1044.98,"endTime":1049.24,"body":"exploitation is so high, and so"},{"speaker":"Brad Causey","startTime":1044.98,"endTime":1049.24,"body":"the the example that Jordan's"},{"speaker":"Brad Causey","startTime":1049.3,"endTime":1051.13,"body":"talking about is let's say I"},{"speaker":"Brad Causey","startTime":1049.3,"endTime":1051.13,"body":"want to steal your banking"},{"speaker":"Brad Causey","startTime":1051.19,"endTime":1054.37,"body":"information, right? I've got to"},{"speaker":"Brad Causey","startTime":1051.19,"endTime":1054.37,"body":"follow you to a coffee shop"},{"speaker":"Brad Causey","startTime":1054.49,"endTime":1056.71,"body":"because doing it at your house"},{"speaker":"Brad Causey","startTime":1054.49,"endTime":1056.71,"body":"is very difficult if you're you"},{"speaker":"Brad Causey","startTime":1056.74,"endTime":1059.98,"body":"know using appropriately secured"},{"speaker":"Brad Causey","startTime":1056.74,"endTime":1059.98,"body":"Wi-Fi or wired or whatever. So"},{"speaker":"Brad Causey","startTime":1060.1,"endTime":1065.94,"body":"I'm going to have to find you on"},{"speaker":"Brad Causey","startTime":1060.1,"endTime":1065.94,"body":"a unsecured wireless network. Be"},{"speaker":"Brad Causey","startTime":1066.27,"endTime":1069.06,"body":"physically present at that"},{"speaker":"Brad Causey","startTime":1066.27,"endTime":1069.06,"body":"location at the same time that"},{"speaker":"Brad Causey","startTime":1069.18,"endTime":1072.69,"body":"you are, and you need to be"},{"speaker":"Brad Causey","startTime":1069.18,"endTime":1072.69,"body":"doing something interacting with"},{"speaker":"Brad Causey","startTime":1072.78,"endTime":1076.56,"body":"like an online banking system at"},{"speaker":"Brad Causey","startTime":1072.78,"endTime":1076.56,"body":"the same time that I'm capturing"},{"speaker":"Brad Causey","startTime":1076.62,"endTime":1081.5,"body":"traffic off the network, and it"},{"speaker":"Brad Causey","startTime":1076.62,"endTime":1081.5,"body":"has to have a sufficiently"},{"speaker":"Brad Causey","startTime":1081.74,"endTime":1085.52,"body":"vulnerable implementation of"},{"speaker":"Brad Causey","startTime":1081.74,"endTime":1085.52,"body":"TLS, which would be like I think"},{"speaker":"Brad Causey","startTime":1085.55,"endTime":1088.61,"body":"Suite 32 actually goes back to"},{"speaker":"Brad Causey","startTime":1085.55,"endTime":1088.61,"body":"SSL 3.0 if I if I remember"},{"speaker":"Brad Causey","startTime":1088.67,"endTime":1092.03,"body":"correctly, or maybe an early"},{"speaker":"Brad Causey","startTime":1088.67,"endTime":1092.03,"body":"version of TLS like 1.0. But the"},{"speaker":"Brad Causey","startTime":1092.09,"endTime":1094.31,"body":"moral of the story is is that"},{"speaker":"Brad Causey","startTime":1092.09,"endTime":1094.31,"body":"I'm going to have to get there."},{"speaker":"Brad Causey","startTime":1094.31,"endTime":1096.86,"body":"And if you go, you can literally"},{"speaker":"Brad Causey","startTime":1094.31,"endTime":1096.86,"body":"go to the Suite 32 website and"},{"speaker":"Brad Causey","startTime":1096.92,"endTime":1100.33,"body":"read this for yourself. It's"},{"speaker":"Brad Causey","startTime":1096.92,"endTime":1100.33,"body":"going to take like 250 gig of"},{"speaker":"Brad Causey","startTime":1100.39,"endTime":1105.4,"body":"captured data for me to derive"},{"speaker":"Brad Causey","startTime":1100.39,"endTime":1105.4,"body":"the key. For those of you who"},{"speaker":"Brad Causey","startTime":1105.43,"endTime":1109.09,"body":"have never captured web traffic,"},{"speaker":"Brad Causey","startTime":1105.43,"endTime":1109.09,"body":"like in a in in Wireshark or"},{"speaker":"Brad Causey","startTime":1109.15,"endTime":1114.82,"body":"Burp, like there, it would take"},{"speaker":"Brad Causey","startTime":1109.15,"endTime":1114.82,"body":"a week of constant communication"},{"speaker":"Brad Causey","startTime":1115.0,"endTime":1118.18,"body":"with a system to generate 250"},{"speaker":"Brad Causey","startTime":1115.0,"endTime":1118.18,"body":"gig worth of data. Like it's"},{"speaker":"Brad Causey","startTime":1118.21,"endTime":1121.89,"body":"absurd how much information that"},{"speaker":"Brad Causey","startTime":1118.21,"endTime":1121.89,"body":"is. Not realistic."},{"speaker":"Jordan Natter","startTime":1122.549,"endTime":1124.049,"body":"No, I'm sure"},{"speaker":"Jordan Natter","startTime":1122.549,"endTime":1124.049,"body":"you're not going to sit that"},{"speaker":"Jordan Natter","startTime":1124.109,"endTime":1124.919,"body":"long at a coffee shop."},{"speaker":"Brad Causey","startTime":1125.4,"endTime":1128.79,"body":"No, and and to my"},{"speaker":"Brad Causey","startTime":1125.4,"endTime":1128.79,"body":"knowledge, there have there's"},{"speaker":"Brad Causey","startTime":1128.94,"endTime":1132.21,"body":"never been a documented instance"},{"speaker":"Brad Causey","startTime":1128.94,"endTime":1132.21,"body":"of Suite 32 being exploited in"},{"speaker":"Brad Causey","startTime":1132.21,"endTime":1135.69,"body":"the wild. It's never happened"},{"speaker":"Brad Causey","startTime":1132.21,"endTime":1135.69,"body":"because that barrier is so high,"},{"speaker":"Brad Causey","startTime":1136.17,"endTime":1138.63,"body":"and all these things need to"},{"speaker":"Brad Causey","startTime":1136.17,"endTime":1138.63,"body":"take place. And again, like if"},{"speaker":"Brad Causey","startTime":1138.63,"endTime":1143.72,"body":"if you're not going to unsecured"},{"speaker":"Brad Causey","startTime":1138.63,"endTime":1143.72,"body":"Wi-Fi, it's almost impossible."},{"speaker":"Brad Causey","startTime":1143.87,"endTime":1146.63,"body":"Like I would have to compromise"},{"speaker":"Brad Causey","startTime":1143.87,"endTime":1146.63,"body":"your ISP, or I would have to get"},{"speaker":"Brad Causey","startTime":1146.66,"endTime":1150.17,"body":"on your online banking's network"},{"speaker":"Brad Causey","startTime":1146.66,"endTime":1150.17,"body":"and their DMZ and somehow figure"},{"speaker":"Brad Causey","startTime":1150.23,"endTime":1153.26,"body":"out how to capture traffic. And"},{"speaker":"Brad Causey","startTime":1150.23,"endTime":1153.26,"body":"it's just like, I mean, if I'm"},{"speaker":"Brad Causey","startTime":1153.26,"endTime":1156.5,"body":"going to do all that, I just"},{"speaker":"Brad Causey","startTime":1153.26,"endTime":1156.5,"body":"want a password spray something."},{"speaker":"Brad Causey","startTime":1156.65,"endTime":1158.93,"body":"You know what I mean? Like it's"},{"speaker":"Brad Causey","startTime":1156.65,"endTime":1158.93,"body":"easier. There's just so many"},{"speaker":"Brad Causey","startTime":1159.02,"endTime":1161.71,"body":"better ways to go about"},{"speaker":"Brad Causey","startTime":1159.02,"endTime":1161.71,"body":"accomplishing this, and that is"},{"speaker":"Brad Causey","startTime":1161.71,"endTime":1164.92,"body":"the case for. And we see this on"},{"speaker":"Brad Causey","startTime":1161.71,"endTime":1164.92,"body":"like SSH, for example, right? We"},{"speaker":"Brad Causey","startTime":1165.1,"endTime":1169.57,"body":"see SSH all the time with with"},{"speaker":"Brad Causey","startTime":1165.1,"endTime":1169.57,"body":"with old CBC ciphers, or we'll"},{"speaker":"Brad Causey","startTime":1169.75,"endTime":1174.13,"body":"see like I mentioned before, TLS"},{"speaker":"Brad Causey","startTime":1169.75,"endTime":1174.13,"body":"1.0. Yeah, man, fix it, right?"},{"speaker":"Brad Causey","startTime":1174.28,"endTime":1176.62,"body":"But is it something to burn the"},{"speaker":"Brad Causey","startTime":1174.28,"endTime":1176.62,"body":"house down over? Are we really"},{"speaker":"Brad Causey","startTime":1176.65,"endTime":1179.32,"body":"that worried about it? Not"},{"speaker":"Brad Causey","startTime":1176.65,"endTime":1179.32,"body":"really. Most of these, you know,"},{"speaker":"Brad Causey","startTime":1179.47,"endTime":1182.04,"body":"fall down to a much lower"},{"speaker":"Brad Causey","startTime":1179.47,"endTime":1182.04,"body":"severity once you actually put"},{"speaker":"Brad Causey","startTime":1182.07,"endTime":1184.02,"body":"them in context. So,"},{"speaker":"Jordan Natter","startTime":1184.35,"endTime":1186.18,"body":"and and that's"},{"speaker":"Jordan Natter","startTime":1184.35,"endTime":1186.18,"body":"why kind of at the beginning you"},{"speaker":"Jordan Natter","startTime":1186.21,"endTime":1188.19,"body":"heard us mention the fact that"},{"speaker":"Jordan Natter","startTime":1186.21,"endTime":1188.19,"body":"this is probably one of our"},{"speaker":"Jordan Natter","startTime":1188.28,"endTime":1191.61,"body":"least favorite in the top 10,"},{"speaker":"Jordan Natter","startTime":1188.28,"endTime":1191.61,"body":"and why we don't necessarily"},{"speaker":"Jordan Natter","startTime":1191.76,"endTime":1194.82,"body":"think that this is something"},{"speaker":"Jordan Natter","startTime":1191.76,"endTime":1194.82,"body":"you're to fret about other than"},{"speaker":"Jordan Natter","startTime":1194.91,"endTime":1198.51,"body":"the hygiene risks. It's because"},{"speaker":"Jordan Natter","startTime":1194.91,"endTime":1198.51,"body":"of like the security scorecard."},{"speaker":"Jordan Natter","startTime":1198.72,"endTime":1201.14,"body":"Is they're taking that and"},{"speaker":"Jordan Natter","startTime":1198.72,"endTime":1201.14,"body":"they're. Oh, it's crazy! But in"},{"speaker":"Jordan Natter","startTime":1201.23,"endTime":1204.32,"body":"pen testing, brain, it's like"},{"speaker":"Jordan Natter","startTime":1201.23,"endTime":1204.32,"body":"I'd just much rather like steal"},{"speaker":"Jordan Natter","startTime":1204.41,"endTime":1208.49,"body":"your laptop or find another way"},{"speaker":"Jordan Natter","startTime":1204.41,"endTime":1208.49,"body":"to exploit something else, other"},{"speaker":"Jordan Natter","startTime":1208.61,"endTime":1211.91,"body":"than just doing sweet 30 to you"},{"speaker":"Jordan Natter","startTime":1208.61,"endTime":1211.91,"body":"because it's not worth the bang"},{"speaker":"Jordan Natter","startTime":1212.03,"endTime":1214.76,"body":"for its buck. If I said that"},{"speaker":"Jordan Natter","startTime":1212.03,"endTime":1214.76,"body":"analogy right?"},{"speaker":"Brad Causey","startTime":1215.81,"endTime":1218.75,"body":"Yep. No, you're"},{"speaker":"Brad Causey","startTime":1215.81,"endTime":1218.75,"body":"absolutely right, and and there"},{"speaker":"Brad Causey","startTime":1218.75,"endTime":1221.14,"body":"are just other things that are"},{"speaker":"Brad Causey","startTime":1218.75,"endTime":1221.14,"body":"much more important than that,"},{"speaker":"Brad Causey","startTime":1221.77,"endTime":1226.06,"body":"from my perspective. Now, one"},{"speaker":"Brad Causey","startTime":1221.77,"endTime":1226.06,"body":"thing I do want to mention, just"},{"speaker":"Brad Causey","startTime":1226.09,"endTime":1232.69,"body":"super quick, and that is in"},{"speaker":"Brad Causey","startTime":1226.09,"endTime":1232.69,"body":"regard to what you should care"},{"speaker":"Brad Causey","startTime":1232.75,"endTime":1235.0,"body":"about. From a, we talked a"},{"speaker":"Brad Causey","startTime":1232.75,"endTime":1235.0,"body":"little bit about reputational"},{"speaker":"Brad Causey","startTime":1235.06,"endTime":1236.56,"body":"risk. We talked a little bit"},{"speaker":"Brad Causey","startTime":1235.06,"endTime":1236.56,"body":"about all those different"},{"speaker":"Brad Causey","startTime":1236.59,"endTime":1242.13,"body":"things, but again, classify your"},{"speaker":"Brad Causey","startTime":1236.59,"endTime":1242.13,"body":"data and just be smart about"},{"speaker":"Brad Causey","startTime":1242.22,"endTime":1244.5,"body":"what you're using from an"},{"speaker":"Brad Causey","startTime":1242.22,"endTime":1244.5,"body":"encryption algorithm"},{"speaker":"Brad Causey","startTime":1244.56,"endTime":1247.59,"body":"perspective, or from a hashing"},{"speaker":"Brad Causey","startTime":1244.56,"endTime":1247.59,"body":"algorithm perspective, and so"},{"speaker":"Brad Causey","startTime":1248.49,"endTime":1251.4,"body":"you know that's going to be the"},{"speaker":"Brad Causey","startTime":1248.49,"endTime":1251.4,"body":"biggest thing that you can do to"},{"speaker":"Brad Causey","startTime":1252.3,"endTime":1254.7,"body":"prevent or protect yourself from"},{"speaker":"Brad Causey","startTime":1252.3,"endTime":1254.7,"body":"having these in your"},{"speaker":"Brad Causey","startTime":1254.73,"endTime":1258.42,"body":"environment. But at the end of"},{"speaker":"Brad Causey","startTime":1254.73,"endTime":1258.42,"body":"the day, again, you know these"},{"speaker":"Brad Causey","startTime":1258.51,"endTime":1260.48,"body":"things. Oh, that was the other"},{"speaker":"Brad Causey","startTime":1258.51,"endTime":1260.48,"body":"thing I wanted. I was I was"},{"speaker":"Brad Causey","startTime":1260.57,"endTime":1263.03,"body":"actually trying to buy time so I"},{"speaker":"Brad Causey","startTime":1260.57,"endTime":1263.03,"body":"could remember the thing that I"},{"speaker":"Brad Causey","startTime":1263.09,"endTime":1268.13,"body":"want to talk about quantum"},{"speaker":"Brad Causey","startTime":1263.09,"endTime":1268.13,"body":"computing. All right, there is a"},{"speaker":"Brad Causey","startTime":1268.37,"endTime":1272.21,"body":"reasonable possibility that in"},{"speaker":"Brad Causey","startTime":1268.37,"endTime":1272.21,"body":"the future that these"},{"speaker":"Brad Causey","startTime":1272.36,"endTime":1276.62,"body":"theoretical attacks are going to"},{"speaker":"Brad Causey","startTime":1272.36,"endTime":1276.62,"body":"become realistic, right? So"},{"speaker":"Brad Causey","startTime":1276.95,"endTime":1280.81,"body":"quantum computing is absolutely"},{"speaker":"Brad Causey","startTime":1276.95,"endTime":1280.81,"body":"coming. In fact, you you might"},{"speaker":"Brad Causey","startTime":1280.87,"endTime":1284.62,"body":"even be able to say it's already"},{"speaker":"Brad Causey","startTime":1280.87,"endTime":1284.62,"body":"here, and so you know as we get"},{"speaker":"Brad Causey","startTime":1284.68,"endTime":1289.12,"body":"more powerful computational"},{"speaker":"Brad Causey","startTime":1284.68,"endTime":1289.12,"body":"capability, cracking things is"},{"speaker":"Brad Causey","startTime":1289.18,"endTime":1292.72,"body":"going to become easier, right? I"},{"speaker":"Brad Causey","startTime":1289.18,"endTime":1292.72,"body":"mean, we're we're cracking 24"},{"speaker":"Brad Causey","startTime":1292.81,"endTime":1295.18,"body":"plus character passwords at this"},{"speaker":"Brad Causey","startTime":1292.81,"endTime":1295.18,"body":"point. You know what I mean?"},{"speaker":"Brad Causey","startTime":1295.27,"endTime":1299.92,"body":"Using some pretty fancy shadow,"},{"speaker":"Brad Causey","startTime":1295.27,"endTime":1299.92,"body":"you know, methods with hashcat"},{"speaker":"Brad Causey","startTime":1299.92,"endTime":1303.0,"body":"and stuff like that, but take"},{"speaker":"Brad Causey","startTime":1299.92,"endTime":1303.0,"body":"all of that and now go throw"},{"speaker":"Brad Causey","startTime":1303.06,"endTime":1304.89,"body":"that on a quantum computer and"},{"speaker":"Brad Causey","startTime":1303.06,"endTime":1304.89,"body":"see what you can do with it."},{"speaker":"Brad Causey","startTime":1304.92,"endTime":1307.89,"body":"Right now, I'm cracking 50"},{"speaker":"Brad Causey","startTime":1304.92,"endTime":1307.89,"body":"characters. I don't know, but"},{"speaker":"Brad Causey","startTime":1307.89,"endTime":1311.1,"body":"the point that I'm getting at"},{"speaker":"Brad Causey","startTime":1307.89,"endTime":1311.1,"body":"is, while it is true today that"},{"speaker":"Brad Causey","startTime":1311.13,"endTime":1313.41,"body":"most of these are theoretical,"},{"speaker":"Brad Causey","startTime":1311.13,"endTime":1313.41,"body":"most of the vulnerabilities that"},{"speaker":"Brad Causey","startTime":1313.47,"endTime":1316.8,"body":"fall into a 04 a 04 are"},{"speaker":"Brad Causey","startTime":1313.47,"endTime":1316.8,"body":"theoretical. They may not be in"},{"speaker":"Brad Causey","startTime":1316.8,"endTime":1321.17,"body":"the future, so I would encourage"},{"speaker":"Brad Causey","startTime":1316.8,"endTime":1321.17,"body":"you guys to you know, yeah. If"},{"speaker":"Brad Causey","startTime":1321.29,"endTime":1325.85,"body":"you have 16-year-old versions of"},{"speaker":"Brad Causey","startTime":1321.29,"endTime":1325.85,"body":"TLS and SSL, like maybe go"},{"speaker":"Brad Causey","startTime":1325.97,"endTime":1327.11,"body":"upgrade that, right?"},{"speaker":"Unknown","startTime":1327.53,"endTime":1327.83,"body":"Just maybe."},{"speaker":"Brad Causey","startTime":1328.459,"endTime":1331.189,"body":"Just maybe. All"},{"speaker":"Brad Causey","startTime":1328.459,"endTime":1331.189,"body":"right, folks, that's all we have"},{"speaker":"Brad Causey","startTime":1331.279,"endTime":1334.129,"body":"time for today. I hope you"},{"speaker":"Brad Causey","startTime":1331.279,"endTime":1334.129,"body":"enjoyed this episode. We'll see"},{"speaker":"Brad Causey","startTime":1334.219,"endTime":1338.209,"body":"you guys next week, and then"},{"speaker":"Brad Causey","startTime":1334.219,"endTime":1338.209,"body":"we'll be doing A 05 soon, and"},{"speaker":"Brad Causey","startTime":1338.209,"endTime":1340.449,"body":"it's going to be way cooler than"},{"speaker":"Brad Causey","startTime":1338.209,"endTime":1340.449,"body":"A 04. So stay tuned."},{"speaker":"Jordan Natter","startTime":1341.14,"endTime":1341.23,"body":"Yes."}]}