UnHacked - Cybersecurity Made Simple for Small Businesses

Justin Shelley (00:11)
I have a question. If I changed up the music, would we dance differently? 'Cause I think we're all doing the same stupid ass dance. Also, my other question

Mario Zaki (00:16)
trying I I was trying to do the Trump dance.

Justin Shelley (00:20)
Good God. not touching that one with a ten foot pole. The other question I had is, does dancing to the music make us more nerdy or less nerdy than just sitting here all stiff? 'Cause I've done both. I don't know which one.

Joshua Holloway (00:34)
Well, I'm not gonna touch I'm not gonna touch the stiff thing ⁓ with a ten foot pole. ⁓ but I I would say no matter what, everybody's just gonna perceive us as being nerds. We're j we're just nerds.

Mario Zaki (00:34)
I think the way we've been danced.

Justin Shelley (00:38)
Shit.

That's true. Fair enough. Okay. So trying trying to dodge that one's not happening. Got it. ⁓ guys, welcome to yet another episode of Unhacked. And I don't know what episode it is, so I'm looking quickly. Episode one.

Joshua Holloway (00:59)
one eleven, one twelve.

Justin Shelley (01:02)
Well, is it eleven or twelve? ⁓ I confused myself because we did a bonus episode for the first time in history. ⁓ yeah, we're at 112 today. Nope, one eleven. Jesus. it's gonna be one of those. So welcome to the latest episode, whose number I can't get straight. guys, it's it's just it just keeps feeding us information to talk about. There is not a lack of content out there to discuss and digest.

Joshua Holloway (01:14)
eleven.

Justin Shelley (01:30)
So we're gonna do that. I did a little bit of research. It just said stop doing the long introductions. Nobody wants them. So we're skipping that. I'm going right to what we're gonna talk about today. We are gonna talk about four things. Number one, five hundred dollars. Fuck my life. That's number one. Number two, apparently a defense contractor unleashes clawed code on a secure Pentagon system. Brilliant. Then we're gonna talk about the apocalypse strikes again. We've done an episode on the apocalypse. New flavor this week, because there always is one.

And then we're gonna wrap this up with some researchers who apparently got around the little known lockdown mode in ChatGPT, which none of us even knew existed until right now. I didn't know that. Maybe it's the default mode. I don't know.

Joshua Holloway (02:07)
Who knew they had that?

⁓ I'd like to throw a curveball.

Justin Shelley (02:14)
Go do it, please.

Joshua Holloway (02:16)
Yeah. So our breaking news last week was on Binance, right? And ⁓ as we were reporting it was two point seven billion in crypto that had been moved. I wanna

Justin Shelley (02:19)
Yeah, yeah.

Correct. But we didn't know. As we recorded, we didn't know if that was real or if that was people pulling their own stuff out, right? Go ahead. Yep.

Joshua Holloway (02:31)
That is correct. So I I don't have that number, but what I do have is last I heard that number was almost six billion dollars. Or six billion, yeah, crypto. There you go. Six point four billion in crypto. Can't say dollars.

Justin Shelley (02:40)
Six point four. Six point four. With a B.

Gone. Correct. Okay. ⁓ but it was was in fact confirmed malicious movement. It was not ⁓ people trying to that was a different story. People were also pulling money out. But yeah, six point four was the number they froze, I think around three billion of it. So I believe that means that's recoverable. The rest of it gone to the North Koreans. Well played, well played.

Joshua Holloway (03:10)
But who knew crypto could also be froze and non-recoverable? I thought that was the whole idea behind it. But should I digress? That's for another episode.

Justin Shelley (03:17)
This is above my pay grade.

Above my pay grade, sir. Yeah, we need a full episode with l ⁓ some time to prep. ⁓ so yeah, I mean, and and actually that's a good point, Josh. We probably need to talk about, you know, do a little bit of follow-up on that. number one, thank you, audience. Appreciate you guys' support and listening to our nonsense that we spew every week. ⁓ our most downloaded episode in history was that little update. So it was was a big deal. It was a lot of a lot of ⁓ crazy stuff going on.

Mario Zaki (03:28)
Nobody knows that shit.

Justin Shelley (03:50)
Does anybody know how they got in? Have you done follow up research on this?

No, crickets? Bueller, Bueller, Bueller.

Mario Zaki (03:56)
Probably using AI.

Joshua Holloway (03:59)
No, hold on. I gotta I

Justin Shelley (04:01)
Well, you can't search it. You gotta know this stuff. ⁓

Joshua Holloway (04:03)
No, no, I'm trying to remember the name of the company. There was a another company that had access through an API and they hacked that company and used that if I remember correctly, but I think I might be wrong, but I'd have to refresh.

Justin Shelley (04:18)
No, that's what they said. That was that was a theory. So what actually happened, which has been confirmed, ⁓ they the bad guys got control of the developers, the engineers, laptops. So this this really made me stop and think of all the security protections we put in place, ⁓ all it takes is somebody to get access to your cloud account. and the and they now have full access to whatever you're developing, right?

Somebody gets a hold of my Claude account and they can go in and ⁓ uncode, move files, whatever, everything I've built. So ⁓ all you vibe coders that were mentoring and and coaching and training up, you gotta be careful. You just gotta be careful. ⁓ man, if they get a hold of your stuff now, mm

Mario Zaki (05:06)
so I thought I I heard they got a hold of somebody's laptop. ⁓ I didn't know they got a hold of like their actual well did they get a hold of the laptop and found like their coding platform?

Justin Shelley (05:18)
The they got they got malware onto the laptop. There was lateral movement so that it got onto higher up engineer's laptop. And then on that one, they found the and now this is where I'm I might I don't know exactly, but they found a way to manipulate the trading. On the so it was the the engineer who was developing the trading process, I believe. Check my math on that, don't take that as doctrine.

Mario Zaki (05:41)
Mm.

Joshua Holloway (05:44)
Dude, why would they not have zero trust set up? Like, come on.

Justin Shelley (05:49)
Are you telling me zero trust cannot be bypassed? Zero trust, once you become trusted, I mean you know. I don't know. These are not the details that I have. I just know a a laptop was compromised. That laptop contained the the code, the keys, everything needed to transfer money. Because it was the guy, as I understand it, it was the person who was developing the the money transferring process. Listen, I'm not a crypto expert. I will admit that right now. It worked. I don't

Joshua Holloway (06:15)
Well it well, it worked.

Mario Zaki (06:18)
It worked, whatever yeah, whatever they did worked.

Justin Shelley (06:19)
Th this is not my yes, I guess.

Joshua Holloway (06:19)
Yeah. Whate whatever he was writing, it works.

Mario Zaki (06:22)
I mean, w we know what w if if somebody were to let ⁓ in, you know, onto a computer or now they're on the network, they're ninety percent of their work is done. You know, like you know, once you get in through a gateway or through a an entry point, it gets a lot easier after that. Now obviously there are things you can do to to completely stop it, but once they get in, it gets a lot easier. Am I wrong?

Justin Shelley (06:50)
Yeah. No, absolutely. Absolutely. All right. Anything else we want to talk about on the Binance debacle?

Joshua Holloway (06:50)
Yeah. No, you're not wrong.

N no, I just wanted to close that one out.

Justin Shelley (06:59)
I I do want to give them a kudos though because they came up with ⁓ largely their own money to cover those losses. So that was I I was impressed with that. I don't know what choice they had because otherwise, you know, you lose people their money, they're not coming back. ⁓ they covered it. Like three billion something dollars they covered out of their own pockets.

Joshua Holloway (07:18)
man, just think about the lawsuits though. That that number could have been tripled, quadrupled. We had all just through class action.

Justin Shelley (07:23)
yeah, easy. Easy. Yeah, but that's gotta that's gotta hurt. Just 'cause you have it doesn't mean that doesn't hurt to pay it. Ouch.

Mario Zaki (07:30)
Yeah, I mean we're talking about billions, not just like thousands or even millions. We're talking about billions, you know, like yeah. That th that that's gonna that's gonna hurt Musk, you know, like that's gonna hurt everybody, you know.

Justin Shelley (07:36)
With a B. You gotta you gotta specify with a B.

Joshua Holloway (07:37)
Yeah, with a B. So

Well. So no Bugatti. No Bugatti this Christmas.

Justin Shelley (07:44)
Well. No no Bugatti. No Bugatti. shit. Don't anyways. Five hundred dollars FML. Gentlemen, I hold five hundred and five hundred and thirty-six dollars, I believe, in my hands right here. Two very small chips of memory. Thirty-two gigs each. I mean, back in the day that wasn't a small chunk of memory.

Mario Zaki (07:46)
Yeah.

Joshua Holloway (07:58)
Holy shit.

Justin Shelley (08:13)
But back in the day that amount of memory was not five hundred dollars. I'm pissed. ⁓

Joshua Holloway (08:18)
No, it was like a hundred and fifty. Well.

Mario Zaki (08:20)
Yeah.

Justin Shelley (08:20)
Maybe, yeah. My workstation sitting here with sixty four gigs of memory, and when I bought it, I gave it no thoughts. Like, yeah, upgrade to sixty four gigs. Cheap. So, FML. That's all. yeah. I haven't bought the hard drive yet. I need that too, but I'm like, Good lord. This is a for a toy. This is for a toy, dang it. ⁓ okay.

Joshua Holloway (08:30)
Well, hard hard drives too, man. ⁓ I was looking at yeah.

Yeah. That hurts.

Well, and I you know, I think you bring up a a good point right now, be with the cost of hardware, right? Not just talking about servers, right? That memory that you're holding is meant for a a laptop or a desktop. You know, and that's five hundred bucks to get sixty four gig of memory. And that's because of all of, you know, shortages, AI taking up all the new hardware, like it drives the cost of supply and demand, natural economics.

Justin Shelley (08:51)
Yep. Yep.

Old Sam, what's his name? The chat GPT guy. What's his name? Sam Altman? I think it was him. I might be quoting wrong. he's quoting yeah, he yeah, he's one of our audience members. So he'll he'll call me up when this is over and say, Justin, what the anyways? ⁓ he I I saw a clip of him, maybe it was ⁓ deep fake, I don't know, where he was basically just saying that us peasant consumers do not have the right to hoard memory. We need to give it all to the AI companies and let them manage it properly because if

Joshua Holloway (09:07)
Sam Altman? Yeah.

He listens, right? Like he he's one of our

Justin Shelley (09:34)
God forbid we're using sixty four gigs of memory, hmm, like me, ⁓ to check email. that's irresponsible and we shouldn't be allowed to do it. So that's the next regulation we're come coming down the pipe. ⁓ defense contractors, Josh, tell us what is going on.

Mario Zaki (09:42)
That is irresponsible. You're a whore.

Joshua Holloway (09:52)
So came across this one, thought this would be a good one to talk about, especially ⁓ it's a defense contractor that was ⁓ working inside the Pentagon and to help their daily routine and their daily lives, they used their personal Claude account and gave their administrator username and password that they were using to build servers to Clod.

And they were automating a process. Well, then lo and behold, it has some tasks that it wants to do. They won't name the website. That's the one thing I've I've been crawling all over the place to try and find the website. But his Claude Yes. And and and ⁓ you know, NIST has marked it as a compromise site and they won't name names, but it went out, it dropped off the usernames, the password for the account, as well as in a complete map, network map of Nipponet.

which is the private network for ⁓ non classified CUI ⁓ information. So that's ⁓ not fully classified ⁓ information, ⁓ but they have the entire network layout. Yeah, the control ⁓ information.

Justin Shelley (10:55)
Controlled.

Still controlled. It's unclassified, but it's controlled information. Yeah.

Joshua Holloway (11:01)
Yep. Yep. And then inside the Nipper net, if you're wondering why it's important, there's several agencies, three letter agencies, that share information across that network. So it's it's not potentially compromising to one. It's kind of come it's compromising to all.

Justin Shelley (11:17)
Yeah. So let

Joshua Holloway (11:18)
Now the other the other crazy thing is this went on for two months. Undetected. Yep.

Justin Shelley (11:23)
Right before they cut it. Okay, now I read that part. I did not read the part how they finally detected it. Do you know that?

Joshua Holloway (11:33)
I did not come across that either. They did not talk about how it was detected. ⁓

Justin Shelley (11:38)
There's the lesson learned. Honestly, if there's a takeaway from that story, it isn't that it happened. It is how do we prevent it from happening again? Right. And we don't have that. And that's the thing that frustrates me more than anything else in the world of cybersecurity. We're so secretive because it's embarrassing that we got hacked. It's like that then nobody can learn from it.

Joshua Holloway (11:53)
But so here here's the only sentence, the only information I could find. A vulnerability ⁓ a vulnerability was identified and patched after two months. That's all they s they said is it was a detected vulnerability that was identified and patched after two months.

Justin Shelley (12:05)
Yeah.

Mario Zaki (12:11)
I don't know if it's necessarily because they're embarrassed necess over they don't want to get f Fd. You know, like if they say, yeah, we just, you know, completely forgot to do this, or yeah, there was a you know, yes, it's embarrassing, you know, using a default password on something or whatever and it gets compromised, but I think it's more like if we if people know we did this, we're fucked.

Justin Shelley (12:12)
Interesting.

Mario Zaki (12:37)
You know, we're gonna get sued, we're gonna get shut down, we're gonna get

Justin Shelley (12:40)
Exactly. Listen, this goes back to the marketing campaign that was available to all of us. Some of us ran it. I did. I actually my my first security podcast was named after this campaign. It was called Stupid or Irresponsible. Familiar? Yes? No? You guys heard this? ⁓ and and the headline really is when you get attacked, I think it said breached, but we're not supposed to say that anymore. When you get breached, are they gonna call you stupid or just irresponsible?

Mario Zaki (12:55)
Yes. Yes. Yeah.

Joshua Holloway (13:04)
You have an incident?

Justin Shelley (13:08)
But either way, what they're not gonna do is come to your defense, be empathetic, like a victim of any other crime. You get empathy, you get support, you get help, right? In cybersecurity, you get shamed, you get prosecuted, you get investigated, you get sued, you get fined. The victims. It's kinda crazy.

Joshua Holloway (13:28)
So the other the other crazy thing too is the the very large MSP that was providing this person to to come and work, this contractor to come and work, this is not the first time a couple months ago the FBI came in and ⁓ had another incident with that same company. ⁓ and ⁓ they had to they had to boot them out of the network. And

Of course, the the company said that they did all their own investigation. They had an external third party do an investigation. And ⁓ they weren't at fault. And and that's their that's their primary ⁓ response right now is like they've they've that's their yeah, they followed their contract. Even though the federal government requires a 72 hour notice of ⁓ an incident, they failed to adhere to that.

Justin Shelley (14:09)
That's their story, they're sticking to it.

Joshua Holloway (14:21)
But still, whoever the third party was that investigated this whole entire thing cleared

Justin Shelley (14:25)
Wow. Hmm.

Joshua Holloway (14:27)
And I don't know if you guys are going to think this is a good thing or a bad thing. I'm kind of leaning towards a a good thing, but the broader impact is it triggered a federal legislation change enforcing stricter AI security framework through DFARS and CMMC. So they're now starting to include ⁓ AI frameworks or going to be asking for it when CMMC rears its head and it comes back up and becomes a thing that we all have to adhere to again. ⁓ for those who need to adhere to it.

Justin Shelley (14:39)
Yeah.

Joshua Holloway (14:53)
There's going to be stricter guidelines for artificial intelligence and the use of it and and the access that it has to ⁓ CUI, non C UI.

Justin Shelley (15:03)
Generally speaking, I am not a fan of regulations. But I will tell you in this case, in our industry I am. ⁓ and and they need to. They need to do that. So

Mario Zaki (15:10)
It needs to be. But w as we've seen some examples is even when you put those guardrails on AI, it doesn't mean shit because it's just gonna say, Okay, fuck these regulations or fuck these guardrails.

Justin Shelley (15:24)
All right, and there's our segue, Mario. You're on. Were you were were you were you done, Josh? I'll pause real quick to make sure you'd covered everything you wanted to talk about.

Joshua Holloway (15:29)
Man, you couldn't have lined up that any better.

Mario Zaki (15:29)
What's

Joshua Holloway (15:35)
No, I think w you know, we talked about the incident. I I think I'm good unless you guys have any questions or you wanna push back on it.

Justin Shelley (15:38)
Okay. Mario, talk about lockdowns and guardrails.

Mario Zaki (15:44)
Yeah, so researchers bypass ChatGPT's lockdown mode to ⁓ to explore chats with ⁓ without users interaction. So lockdown mode for people that don't know ⁓ that that ChatGPT had this mode is it it pretty much it's almost equivalent to going like doing incognito in your like your

Justin Shelley (16:01)
Like me.

Mario Zaki (16:13)
in your Chrome browser. So when you do it, when you turn this on, it disables like there's no live web browsing, no deep research, no agent mode, ⁓ image support is disabled, Canvas networking is blocked, file download. You know like

Justin Shelley (16:31)
Is it is it different from temporary chat, Mario? Because I'm that's what I'm looking at right now, is I've got temporary chat. So it's different from that.

Mario Zaki (16:36)
It is. ⁓ I mean, the way the way you would have to do this is you go to settings, safety and security, advanced security, and then toggle on lockdown mode. So you would actually turn this on by default, it's not on. so it it's very limited and in the in the sense where if you're gonna put in like sensitive information and stuff like that, you put that down there. So like I said, it's like almost like incognito mode.

⁓ for your Chat GPT. Again, we I I we've never I never used it. We didn't even really know. You know. so now they patched this, but pretty much what ended up happening is ⁓ checkpoint researchers disclosed a non-patch flaw that had let attackers get around Chat GPT's lockdown mode. ⁓ it's an opt-in

Justin Shelley (17:13)
I still can't find it. I ca I'm looking right now, I can't find it. So interesting.

Mario Zaki (17:34)
opt in settings. It has been patched since then. ⁓ has it been patched since then? ⁓

Justin Shelley (17:43)
This is breaking news, folks. We're

Mario Zaki (17:43)
Yeah, it it fixed so this this happened back in June, but they fixed it they fixed it ⁓ towards the end of September. So it's about a little month more than a month old, but it's just kind of making some ⁓ some noise now. ⁓ but pretty much, you know, they had something to contain it, you know, where it would prevent people from leaking information or whatever, and lo and behold, it was leaked and people were able to get in there.

Joshua Holloway (18:12)
Sh I'm reminiscent on this of the debacle of Chrome's incognito browser where their their whole shtick was it's private, we don't capture any information. And then lo and behold, what comes out? They were capturing information, that information was stored. This sounds very indicative to the exact same thing.

Justin Shelley (18:22)
Yeah.

Mario Zaki (18:34)
Yeah. Yeah. ⁓ incognito mode, you know, it it disables your plugins, you're like your your extensions. It ⁓ doesn't keep a history locally on your computer, but that's locally on your computer. It doesn't mean that they can't get shit, you know, that ⁓ of what you're doing. ⁓

Justin Shelley (18:53)
Your internet providers, your employers, ⁓ any anybody intercepting traffic on your own network can all see that stuff in incognito mode. It's not really incognito, it just doesn't it it yeah. It's a false sense of security, that's what it is.

Mario Zaki (19:01)
Yeah.

Yeah, it it pretty much Exactly. One hundred percent. You know, like you know, we see it, you know, we have our on our firewalls and stuff like that, when we're capturing like IP addresses and browser information or whatever, we see what they're on, no matter if they're on incognito mode or not. It it's more to get away like if you're if you're looking at stuff that you shouldn't be looking at because you don't want your significant other to know, you open it up and like incognito mode.

Justin Shelley (19:20)
Yeah. Yep.

Like what?

Joshua Holloway (19:31)
⁓ really? Mario? Tel tell us a little bit more about that.

Justin Shelley (19:34)
I don't even understand.

Mario Zaki (19:35)
So so so I've heard

Justin Shelley (19:39)
good lord. That's how you know we're nerds. so to be clear, this was something researchers found. It's been patched. Was there any actual ⁓ did anybody get busted here? Like caught with their pants down, so to speak? It was just kind of like a oopsie daisies, our bad.

Mario Zaki (19:41)
Yeah.

⁓ it it doesn't really Yeah, no, it doesn't ⁓ I mean it it was discovered in June and not patched all the way to ⁓ till April until September.

Justin Shelley (20:08)
Yeah, that's kind of crazy.

Joshua Holloway (20:08)
Yeah, see that's what I have a problem with. I mean, look at what Black Black October has pretty much trained us on, right? Pat vulnerabilities being seen super quick now. Patches have to come out even faster, and they left that door open for a couple of months. That's almost as bad as the the the guy on the Pentagon's network for si you know, two months.

Justin Shelley (20:25)
Yeah.

I know for two months. Yeah. And we gotta do better. We gotta do better.

Mario Zaki (20:32)
Mm-hmm.

I mean, honestly, I it it blows my mind because, you know, I as you guys know, like we've developed our own like ticketing system and I was able to put the together like a kick-ass system in a just a few weeks. And we went like soft live. So my technicians were using it this whole week. And I was expecting come in on Monday and I'm like, all right, day one, let's use it. I'm like ready, you know, like for for

Justin Shelley (21:00)
Yeah. Ready to fix all the problems? Mm-hmm.

Mario Zaki (21:04)
Fix all the issues and I'm like, okay, we didn't kill the old system. If you need to revert back to the old system. And you know, all of Monday, they're like, ⁓ you know, this is not clearing. Or not all of Monday. I mean like all day I only had like one or two things that came up. one was like to fix something, and then somebody's like, it would be cool if we can do this. And by the time they got back to their desk and like started like a whatever, they would get a message from me saying, It's it's there.

Joshua Holloway (21:04)
Uh-huh.

Justin Shelley (21:34)
Yeah, fixed.

Mario Zaki (21:34)
It's fixed or it's updated or whatever. And they're like, Holy shit, you know, that was that was quick, you know. So if I can do something like this using tools, the company that developed these tools, why can't they go a little faster? You know?

Justin Shelley (21:47)
They because they're they're stuck in their old school ways would be by theory. I don't know. I'm I'm just I've got to add to your ⁓ because we're we're both doing this at the same time, right? Building our own software, similar software. And I've added a feature request section on mine. but by the way, I stole that from you, Mario. I mean that's an a common concept, but ⁓ anyway, so I put that on there. My text start putting things in. I'm getting swamped. I've got now like 40 feature requests on this.

I've looked at they're valid. And the other day I'm just like, hey, Claude, can you just like go look at those tickets and tell me how many of those can you do without my intervention and just get it done? And Claude's like, Yeah, I got you. And knocked out like half of them. I come back, it's just done. Like, my God, that's beautiful. That's beautiful.

Joshua Holloway (22:25)
Mm.

Yeah.

It's I think you're making a an important point without really pointing it out just yet. And it's a similar conversation that I had with another client this morning that we're building a very customized ⁓ AI centric app for them. And they were telling me that they had previously looked at a SaaS company and what they were developing. And they even said it. They're like, these guys were writing code or a system for 50 other different types of of companies. We do

Maybe five percent of what they were writing to. We needed it to be very specific. And then the owner said what one thing to me that stuck in my head. He's like, I broke it in fifteen minutes because it didn't do exactly what I wanted and it wasn't fully functional. And he's like, and that's when I decided to walk away. And that's when I no longer wanted to try out the app because inside of 15 minutes, he already broke it. So it wasn't lining up with his methodology of how he did things.

Justin Shelley (23:29)
Yeah.

Joshua Holloway (23:29)
Which brought him full back to what we were talking about because we were showing him new functionality, new data flow processing. We're writing exactly to their processes. This is their IP. Their IP telling us how to how to do this. And I said the reason why is a hundred percent of what we're doing for you right now is devoted to you and what you're trying to deliver. Everybody else, like who has these big SAS SaaS softwares, they're thinking about how can we get the most amount of customers in here.

Justin Shelley (23:39)
Yeah. Right.

Joshua Holloway (23:59)
To utilize this platform and maximize our dollar. And and then if they have a problem, they're gonna be slower to fix it because how does that fix affect all the 50 different types of businesses that are going to be using this platform? And they have to go through all of that iteration. And I and I think that's where us being able to make applications that are core focused to the client, the client's need, that's what they're asking for, is where this wins out pretty big.

Mario Zaki (24:27)
I have a perfect example ⁓ of what you pretty much just said. So with this system, one of the main reasons I really wanted this is for better reporting, right? I want to be able to see, you know, the customers, how much time we're spending for each customer, how much time you know each technician is spending on each ticket and stuff like that. Now, my old system.

Justin Shelley (24:27)
Yeah.

Mario Zaki (24:54)
Can do that, but it gives you you you have to build a report and you have to test it. And it you have to have like a PhD degree to to to to to really be able how to figure out how the system. I would have to incorporate AI just to build me, you know what I'm saying? I'm like, I want good reports. And I'm sitting there and I it took me a couple minutes. I'm like, all right, so how should I do this? Should I build like an

a report builder and whatever. And I'm thinking like, F that, why why would I need to create a report builder? I can just type it into my, you know, my GPT and say, create me this report exactly the way I want it. I don't need to sit there and build the report builder so that I can just go ahead and spend more time to build the report. I can just tell it, build me the report. Now this is not a report I can customize. This is like a dashboard that

Joshua Holloway (25:35)
Mm-hmm.

Mario Zaki (25:51)
has already built for me and it's exactly what I want. And if it's something wrong, I say make this into a link. Make this, you know, add a date field, add a you know, search button button. You know, it it takes me no search button. ⁓ you know stuff like that made it so much easier that I can just do a one-off because it's only for me. I'm not doing it for

Joshua Holloway (26:05)
Not a not a search bot.

Mm-hmm.

Mario Zaki (26:19)
you know, all my customers are or all you know, to sell it. I'm not trying to sell it, you know, because I know I I don't that's not what my intention was. My intention was I wanted to do it and have it perfect for me and for my company.

Joshua Holloway (26:35)
So are you saying with the SAS the savvy customer who's thinking beyond their like their business and the current platforms, the ones that are saying, I wish I had an app that did this, this, this, this, and this, now's their time to shine because they can drop that one SaaS application that does twenty five percent and they've just limped by or they've just put up with, or they've created, you know, manual processes where they spend hours and hours and hours hand jamming that. That's that's gone.

The savvy person could start to ask people like us to to build it or they can go and build it themselves, but they still need to ask people like us to come in and check it for security. Like that's the new dawn.

Mario Zaki (27:15)
Yes, yes. ⁓ I mean they gotta proceed with caution when they when they're when they wanna build it themselves, especially when it's going to you know work with company data. I I had a client yesterday. I literally the conversation was I started using clawed code yesterday and it seems pretty cool. Can you give me access to get it to work with my with our Microsoft SharePoint?

Justin Shelley (27:44)
Yikes.

Mario Zaki (27:44)
I'm like, you you started it when? He's like, yesterday. I'm like, okay, here's a disclaimer. Or sorry, here's a a ⁓ a liability form. I'm like, I strongly advise against it, but you have to sign here before we do it. He hasn't sent it back yet.

Justin Shelley (27:53)
Yeah.

Joshua Holloway (27:58)
Yeah. Well, and a and I think if you think about it, right? People go into ChatGPT or they go into Claude, not Claud Code. They go into it and it's a ⁓ a chat based interaction, right? If you if you think about it, it's like a librarian. You go to the librarian, you ask for a book, she slides it across the table of whatever information you're looking for, and that's your interaction, right? They don't do anything to the the computer, they don't do anything to the system whatsoever.

Justin Shelley (28:00)
Yeah.

Joshua Holloway (28:26)
But when you introduce Claud Code or other other CLIs like like Claude Code, which is the the command line interface, that's when you're given it access to your co your computer. So the idea with that is you know now it's an assistant that you've given the keys to your car, your bank accounts, all your information, and you said, Hey, run my life, right? Because you now have all of that access. But my computer, if it gets compromised, who like.

Whoever compromises it has all that access to. So people really need to understand the power of what's happening when they go to Claude Code or they go to other applications that are are like that.

Mario Zaki (29:06)
I mean it every topic we talked about prior to this is a perfect example. Look at the first topic that we talked about. Somebody's computer got got ⁓ you know compromised. They did a lateral movement, they got to the developer's computer, and all of a sudden billions of dollars is gone. Now, I don't have you know many clients that have billions of dollars just lying around. ⁓ but

Joshua Holloway (29:23)
Mm-hmm.

Mario Zaki (29:35)
No matter what. And the and and the thing is, these hackers know exactly how much you have and what they can ask for. You know, they're not gonna ask you for three billion dollars or try to extract three billion dollars. They're gonna take whatever they can. You know, and the same thing, you know, no matter how big you are. You know, it's once they get in, they get in. They don't they you know, they don't discriminate, you know, ⁓ based on how much money you have. They'll take it all.

Justin Shelley (30:03)
I I wonder if we need to work on our wording as far as ⁓ hackers, because we're not supposed to use the word hack anymore. Should we be ⁓ purveyors of incidents or I don't know.

Joshua Holloway (30:14)
We wait, we wa wait, we have to we have to PC we have to PC hackers now?

Mario Zaki (30:14)
Justin, why did you

Justin Shelley (30:20)
Well well we we're calling incidents instead of hacks and breaches, right? So the the the It's all a joke. It's all a joke, Josh. ⁓ all right. A bad one, obviously, but ⁓

Joshua Holloway (30:24)
Well, that's more of a joke because of of lawyers.

Mario Zaki (30:31)
I mean

Joshua Holloway (30:34)
Purveyors of incidences. I kinda like that. So a P a P a POY? Like a like a POY?

Justin Shelley (30:38)
⁓ that's yeah, yeah, yeah. Yeah, like that we don't want to hurt their feelings and call them hackers because hack really means like a shortcut or a you know a a poor job of doing something, a hack job, right? These are these are professionals. They have feelings. All right. Shall we move on? enough of that. Let's talk about the aco I can't even say it, the apocalypse. It strikes again.

Mario Zaki (30:39)
The not so good guys.

Yeah.

Joshua Holloway (31:07)
yeah, I'm really curious about this one. What happened?

Justin Shelley (31:07)
How ⁓ guys, we have been worried as humans, we have been worried about the end of our civilization since the beginning of it, I think. I don't know. And it's always happening tomorrow, and somebody always knows when it's gonna happen. And it never happens, but we still keep believing it. I don't get it. All right, so here's the latest. Circulating on social media is this panic trend of you've gotta prepare for 90 days. The government's saying it.

Joshua Holloway (31:35)
Mm.

Justin Shelley (31:37)
The, you know, everybody's saying the there's this 90 day blackout coming. We've got to have food. We've got to have power. We've got to have fuel. We've got to like I mean, I'm having some PTSD because I don't know if you guys know this, but ⁓ as a recovering Mormon, I grew up with this panic my whole life. We had to prepare for a we it was called a year's supply. We had to have a seventy-two hour kits on top of that a year's supply of food. Mormons will go to great lengths to store just shit tons of food all over the place.

Joshua Holloway (31:57)
Mm-hmm.

Justin Shelley (32:07)
under the beds, in the basement, all over. Right. Okay. So I'm like, I I I catch wind of this. I'm just like, well, what's really going on? Here's what's going on. The government, United States government, issued an an initiative called Fortress. Have you heard of this? So they're they're basically just strengthening the military bases so that they could function up to 90 days in the event of.

Joshua Holloway (32:27)
but

Mario Zaki (32:27)
Mm-hmm. No.

Justin Shelley (32:35)
A modern attack, which by the way, modern attacks are becoming cyber warfare, right? So do the bad guys get a hold of our power grid? Do they, as they have done in France and other parts of Europe, ⁓ hack into the refrigerators and freezers of grocery stores and spoil all the food?

Joshua Holloway (32:48)
I just about to just about to hit on that and ask you about that, yeah.

Justin Shelley (32:54)
And guys, I mean, haven't we been saying for quite some time now? You gotta know what's on your network and you have to protect it. So this isn't like some brilliant hack where they're getting into some complex network and and getting a hold of the refrigerators in this coordinated way to end humanity. It's just that they're leaving the damn controllers open to the internet. It's not even that hard. So stop doing that. Anyways, so you've got that.

Combined with the government coming out and saying 90 days for their bases. Then I believe there was somebody else, and now I'm making shit up. I mean, I read it, but I don't know the details, that we as as citizens should ideally have 30 days. And like this is becoming good advice at some point. I lived through hor hurricanes in Florida and you know, seven days was kind of the the magic number. Right a day or two before, fuel's gone from the gas stations. Like there's cars lined up, there's no gas, right?

You go to the grocery store, bottled water is not a thing. Toilet paper, we have this obsession as humans with toilet paper. We don't want a dirty butt. ⁓ toilet paper's gone off the shelves. Canned goods gone. you you couldn't buy, and then if you had perishable food, like get your your hamburger or whatever in the fridge, well, the power's out for a week, so that all goes bad. So ⁓ and we didn't have power, so we have I I went out and bought a propane grill.

To cook my food on that just that had a burner, you know, off to the side, and I'd use that, put a boil water and whatever. That's how I was cooking for my family during the hurricanes. So listen, this is good advice. ⁓ I am here to debunk the 90-day blackout, impending blackout, doom and gloom, apo apocalyptic thing that's going all over Facebook and whatever, social media, Facebook's for old people. ⁓ but ⁓

Joshua Holloway (34:42)
Are are you are you busting out your non visual crystal ball? Like we don't get to see it, you get to see it.

Justin Shelley (34:47)
Yeah. No, I've got my crystal ball right here. You can't see that? Yeah, that's weird. I c it's clear, I can see it.

Joshua Holloway (34:51)
No, sorry, bro.

I mean it looks like you're holding balls.

Mario Zaki (34:55)
Right.

Justin Shelley (34:58)
Good lord. ⁓ Dear audience, we don't apologize. Okay, so listen, my crystal ball says, like, just fact check. It's not a crystal ball like future checking or future predicting. It's it's here's some advice. If you got it on social media, just go ahead and fact check it. There's a lot of true stuff that comes out on social media. I get a lot of my news on social media. That's where first hear about it. First thing I do is like, did this really happen? Like no matter what it is, did this really happen? ⁓

Go start looking for for other sources and get to the bottom of what's really going on. ⁓ and I would I would apply the same thing here at what we do, right? This is a world of fear that we live in. Every every time I read something new, and and our our little breaking thing that we did last week, I'll be honest, that scared the shit out of me. as we were recording, and I didn't really know what was going on, and I'm I'm hearing numbers in the billions with a B, ⁓ and I'm thinking snowball effect, economy crashes, it's already bad.

I am thrilled at how that thing turned out. I'm sure that Binance isn't, because they had to cough up three billion dollars. ⁓ but I'm really thrilled with how it went out. And I do think it's a good example of human resilience. We are wired to survive. We've been doing it for hundreds of thousands of years, as far as we know. ⁓ these little things that keep scaring the shit out of us, I I think there's value in paying attention to them.

But I also think there's value in just stepping back and taking a breath and finding out what's real and what's not real. And I really hope that that's kind of what we provide here on this show. audience, I hope that's what you're getting. Co-hosts, this is a message to you and to me. Like that is really what we need to do. What I would like to do is filter through the the fear, the doom, the gloom, and look at what is it that we really need to do to protect ourselves, to protect our businesses, and to protect our money. So

There's my rant, my tirade. ⁓ I'm open to feedback, controversy, argue with me, argue amongst yourselves. Like, ⁓ I have had the feedback that we need to be a little bit more ⁓ feisty on here. We we agree with each other too much. Somebody disagree with something.

Mario Zaki (37:08)
I mean the

Joshua Holloway (37:09)
I mean, and when we all make really good points, what is there to disagree with?

Justin Shelley (37:12)
We're so smart, it's hard. Yeah.

Joshua Holloway (37:14)
Nerds.

Mario Zaki (37:17)
I mean, listen, I I've heard the same stuff, you know, stock up on three days worth of stuff or 30 days, 90 days. Everybody keeps changing the numbers. I mean, ⁓ yeah, you know, you should probably have something that you'll be able to survive in for a couple days in case there's like a outage or something. I you know, d we've all been through those type of weather, you know, stuff that caused that. But

the for the the fact of the world ending tomorrow, you know, like the end of the day, if the world ends tomorrow, it ends tomorrow. What are you gonna do differently, you know, today that's gonna help you with the world ending tomorrow? As long as you're in the right place for, you know, who whatever, you know, who however higher up you believe in, ⁓ you know, that's the only thing. You know, you you you know, I I'm I'm a religious person, so I'm always trying to be prepared, but you know

Justin Shelley (37:54)
Right.

Mario Zaki (38:13)
You do you, you get your your you know, your shit together with with your, you know, ⁓ higher up and that's the only thing you can really do, you know. You're not gonna just going and getting a extra couple cans of tuna because the world is ending tomorrow, it's not gonna do anything for you, you know? ⁓

Justin Shelley (38:26)
Yeah.

And what, you want to the only survivor and rebuild civilization from scratch? I do not, by the way. I will tap out. I'm I'm not I'm not down for that. I like the world the way it is.

Mario Zaki (38:37)
what was that movie? What was that movie with Will Smith? ⁓ where he was like the last man on Earth or something? Yeah, yeah.

Justin Shelley (38:42)
⁓ and his dog was he with his dog and his dog died? I know the movie, but I don't know what you're talking about. Yeah.

Joshua Holloway (38:47)
Mm-hmm.

Mario Zaki (38:50)
⁓ I mean

Joshua Holloway (38:51)
I think this is w one of those points in the topic where I hope my mom's not listening to this. So, ⁓ I was raised a prepper, right? I I don't know if I I I've never I've never I dunno if we've ever

Justin Shelley (38:55)
Ha ha.

Mario Zaki (38:55)
Mm-hmm.

Justin Shelley (38:59)
cool. Okay. Okay. So also Mormon? Hmm. Anyways. Is there a difference? Meh. Go ahead. I know, I know.

Joshua Holloway (39:04)
Raised Catholic. Mom converted to Mormonism. But yeah. So again, hope mom's not listening because I'm just gonna air some dirty laundry. I was ra I was raised a prepper, raised on a farm. I was always told that the world was gonna go to the hell in the handbasket. That was the phrase I always heard. You needed to learn how to hunt, fish, prep meat, live off the land, do everything, right? Drilled into my head. I'm 46 years old. I don't think I've ever not heard it, you know. So

It is not uncommon for me to have upwards of 30 days worth of food in my garage. Because if you've heard prep, prep, prep, prep, prep, prep all your entire all your entire life, what are you gonna do? Now, I don't go to the extent like my parents have years. And they cy and they cycle through years of food. And there's a there's a lot of things to it. And I think there's some validity to have extra goods and things in the home so that you are prepared, even if the if the power is out for five days, you still have a food problem.

Justin Shelley (39:40)
yeah.

Mm-hmm.

Yes.

Joshua Holloway (40:04)
⁓ if you if if you know you need medical attention, you need to have things to to protect you, right? Not saying it should be for a year, I'm not saying it should be for two. ⁓ but going back to the COVID thing, ⁓ when they announced closure and everybody was freaking out, I already had three months worth of stuff. So I was just like, cool. And then when people when people were were flying toilet paper off the shelves, I was like, well, I don't have three months worth of toilet paper, but I'm still cool.

Justin Shelley (40:23)
Yeah.

Joshua Holloway (40:33)
I I think the biggest thing is is, you know, when you when you think about it, yes, be prepared. Going back to security and technology, be prepared by locking it down as much as you possibly can, right? Do the right thing, patch what you can, be prepared. If if your refrigerator is internet facing, I'm sorry, you you deserve a hack because that that's that's horrid. Like to to to have it easily accessible, come on now. Lose your job. Do better. Be better. Where's your CISO? Like where's your guy who's saying, Hey, you what? It's a

Justin Shelley (40:52)
Mm-hmm.

Joshua Holloway (41:03)
It's a bad idea that our refrigerators are Yeah.

Justin Shelley (41:05)
you're talking about supermarkets. I'm like, I'm taking this personally. I'm like, we just got a dishwasher that apparently we can access over the internet. I don't know. I don't know. I don't know. I haven't hooked it up. I'm just saying it could.

Joshua Holloway (41:11)
Okay, that's another thing. Why does your dishwasher have to hit you up on the internet? It doesn't. Yeah.

Mario Zaki (41:18)
We got a new dryer that is connected online and I honestly turned it off. Like I'm like, cool. You know, I can fucking do my lo my dryer from my phone and three days into it, I'm like, I'm disabling this shit because it's so annoying. I don't need to know when my wife ⁓ is doing laundry and all of a sudden my phone is dinging. you you know, laundry's on. Go ahead.

Justin Shelley (41:43)
You sexist, why aren't you the one in there doing laundry?

Joshua Holloway (41:46)
Yeah, Mario. It's twenty twenty-six. Well, I I think you like I have a refrigerator that connects to the internet, right? I had I had it doing it for a while and I was using it because everybody every time somebody would leave the door open, I'd get a notification and I'd be like, Who left the door open, close it now? You know, so it's like the the dad with the thermostat. I was doing the same thing with the refrigerator. I turned it off. Nobody nobody needs that.

Justin Shelley (41:50)
You must be a republican.

Yeah.

Mario Zaki (42:09)
I do the same thing with the garage. I get an alert if the garage is left open for more than 15 minutes and then I start yelling at people. I'm like, you know, go close the garage. Why is the garage open for fi more than 15 minutes? You know. But to add on to what you you said, Josh, Josh, I actually would want to put like cameras, I want to have smart a smart pantry because you know, you you're you're prepared for three months or or sorry, th you know, 30 days or three months.

Justin Shelley (42:13)
Yeah.

Mario Zaki (42:37)
My wife is prepared for like ten years. You I can't tell you how much pasta we have, canned food, all these sauces and stuff like that. Every time she goes to the market, she grabs another like three pack. And I'm like, we have no place to put this. I actually would need something like I would need an apocalypse like this so we can eat all the pasta and all the sauce that we have so we can clear out the freaking pantry. You know, but

Joshua Holloway (43:06)
So parties at Mario's house, so we can help clear out the the clear out clear out the pantry. But you know what, you're not wrong, man. I've seen I've I definitely have seen that. ⁓ I've seen large stores that when you when you go into the like my parents' barn. You s you go in the my parents' barn and you would walk into a like a locker and it was rows and upon rows upon rows upon rows of food.

Mario Zaki (43:08)
Yeah.

Justin Shelley (43:08)
That's what I'm hearing. Let's go.

Joshua Holloway (43:28)
And when I was a kid and I was going to college and broke, it was awesome because it was a grocery store that I paid for and blood sweat equity, not hard earned cash. Right. And it'd be like, Hey, do you mind if I take this? Cool. Yeah. So I I mean, there's a bit there are benefits. Yeah, go ahead.

Justin Shelley (43:34)
It's a grocery store, yeah.

Nice. Nice.

All right, guys, I'm gonna bring this back. I I did this, I did this, I I throw this thing out there, everybody ran with it, we're way off track. ⁓ deal with it. But anyways, ⁓ bringing it back, I I just will say that there there was a lesson learned in this, and because the question that was posed, and this was actually brought up by by Liana, she hates it when I mention her name, but I'm gonna do it because she brought this up and she's like, Hey, if this happened, would we have like, do we have a generator where we could

Mario Zaki (43:56)
Yeah.

Justin Shelley (44:13)
provide power for the to the house for 90 days. And you know, after I got done with my overly unan analytical like interrogation of what the hell she's talking about, which she didn't appreciate. ⁓ come on, I'm fact checking on live, you know. Anyways, ⁓ so then we start a real conversation of what it would take to to prepare. ⁓ yes, we have a generator. Would it last 90 days? No. If it did, could we get fuel for 90 days? You know, but but we started going through this, you know, what can we do to improve our

⁓ security, you know, like proverbial security around here or survivability. And and it really did. I wanted to bring it up here because it it it is kind of a similar mindset to what we're talking about. And I will just say again, be familiar with what the real threats are, cut through the hype, get rid of the stuff that everybody's panicking about. Do not prepare for unfounded panic. Don't do that because that's a waste of resources.

And whether that's preparing your home for an apocalyptic event, ⁓ or if it's preparing your business for the attack that you surely will have happen to you at some point. Know what it is that you need to protect, have a plan to protect it, have a plan to live without it if it ever goes away. That's what you need to do. That was kind of my takeaway from this whole conversation. So, ⁓ gentlemen, we're gonna wrap up. Final thoughts, closing arguments, key takeaways.

Let's try to keep it to forty five seconds 'cause we're at forty five minutes right now, so ⁓ kind of ten percent ish. Josh, you look like you've got you've got that cocked head and that look in your eye. I know you've got something to say. Forty five second clock starts now. Go.

Joshua Holloway (45:52)
No, man, I was just thinking about being a smart ass. And after you got done saying what you're saying, I just wanted to be and remain unhacked. honestly, I got 45 seconds and I got less than that. Now, at the end of the day, analyze your business, analyze the way it functions, what you can control, what you can't control, what you have access to. Then just like Justin did, right? Go back and analyze what is out of my control my control that I can bring back into control, i.e.

Justin Shelley (45:55)
Ha ha.

Mario Zaki (45:58)
Yeah.

Justin Shelley (45:59)
Yeah, there you go. There you go.

Joshua Holloway (46:22)
Do I have all the usernames and passwords? Do I have a network map? If if my IT guy died or if my IT company closed their doors, would we be able to function? Ask that question. And then do that with every other business process that you have and shore up your business. And if you can't think through it techno technologically, I know some guys on a podcast who've been talking about it and we're here to help you on that one. So that that's my final thought. Like shore up, shore up your defenses.

Justin Shelley (46:47)
There it is. All right, Mario.

Mario Zaki (46:52)
⁓ for me, the thing is ⁓ IT and cybersecurity is not really like something like a a DY, I feel, because it's not like you can go on YouTube and search how to unclog a toilet or change a pipe or you know, repla you know or or you know, like there's ⁓ honestly, I could look that stuff up, but I l I rather keep it the

Joshua Holloway (47:10)
man, the the plumber demographic is gonna kill us now.

Mario Zaki (47:22)
Professional. You know, I rather have a plumber come fix the plumbing. I rather have an electrician come fix my electricity. You know, yes, I can probably Google it and figure it out. Same thing with this. You can find you can find things that'll say, do this. I mean, you can go to unhackmybusiness.com and see what you know what fundamentals you should be doing. And you can do it, but keep it to the professionals. This is just like

Joshua Holloway (47:30)
Absolutely.

Mario Zaki (47:51)
every other trade, you know, we've dedicated our life to this, you know, where, you know, we I feel like we almost know what we're doing, you know, so you know, keep it keep it to the professionals. And if you let the professionals do their thing, then maybe you can postpone, you know, doomsday for another couple of weeks or months or years.

Justin Shelley (48:01)
Telechanges.

Mario Zaki (48:15)
Hopefully.

Justin Shelley (48:15)
⁓ and thank you for the plug on unhackbybusiness.com because that really is what that was the vision when I built that tool website. But it it is truly a tool. And no, I don't expect people to self-implement, although that is the tool to do it if you choose to. The instructions are there briefly. You can Google or AI the rest of it. You could. I don't recommend it. ⁓ but what it really is is a way to hold

yourself, your team, your outsource teams accountable and to give you true visibility into your risk and the financial cost associated with that risk. I sat down with a client the other day. I don't know if I already said this or not, and I punched in their information. It pops up on the window. Your company has $1.5 million at risk. Now we hadn't started going through and closing the gaps in the system. The gaps are closed. They just weren't accounted for. But that reaction, that like, my God, look on her face.

That's what I'm looking for. ⁓ I I teased this a little bit last week. I'm gonna drop a little bit more this week. What's coming next? Because you know, we don't wanna go to another website. There's a million of them out there, is gonna be a little display, a little miniature computer that sits right on your desk and shows you your score. And you can watch that score go up, go down, the the dollar amount at risk go up and go down so that you know. And that that really is my ultimate goal, is that you, the business owner, the executives,

The ones who have skin in the game know where you stand. And it's not a guessing game. Cause right now we say leave it to the professionals, but do you know your professionals are doing what they what you pay them to do? That's the ultimate question. And that's what the tool is for. So ⁓ I'm closing up with that. Guys, thank you as always for being here. And we will be back next week, maybe with some breaking news sooner, but at a minimum, we'll be back next week with more riveting information in the world of technology and all things AI.

Guys, we will see you next week.

Mario Zaki (50:13)
Unhacks.

Joshua Holloway (50:15)
Un unact.

Justin Shelley (50:18)
Why do you guys always say that?