WEBVTT NOTE Transcription provided by Deepgram 00:00:00.799 --> 00:00:02.800 Hello, and welcome to the Geek News Central 00:00:02.800 --> 00:00:06.720 podcast episode eighteen fifty five. I'm tonight's host, 00:00:06.720 --> 00:00:08.960 Ray Cochran. We've got a pretty great show 00:00:08.960 --> 00:00:11.920 lined up for you folks tonight. Leading off, 00:00:11.920 --> 00:00:15.165 a bombshell three year investigation from the Associated 00:00:15.305 --> 00:00:19.564 Press reveals how Silicon Valley giants IBM, Intel, 00:00:19.945 --> 00:00:23.465 NVIDIA, Oracle, and more spent decades selling the 00:00:23.465 --> 00:00:27.280 technology that built tech China's surveillance state. We're 00:00:27.280 --> 00:00:30.980 talking facial recognition, predictive policing, and the infrastructure 00:00:31.120 --> 00:00:35.600 that enabled mass detention in Xinjiang. This one's 00:00:35.600 --> 00:00:39.300 a gut punch, folks. Also on the show, 00:00:39.520 --> 00:00:43.295 malicious Chrome extensions, stealing credentials from over a 00:00:43.295 --> 00:00:46.835 hundred seventy sites, Microsoft's ambitious plan to eliminate 00:00:47.135 --> 00:00:49.295 all c, c plus plus code by twenty 00:00:49.295 --> 00:00:53.295 thirty. This one's speculative. And then China's combat 00:00:53.295 --> 00:00:56.415 ready human robot humanoid robot that kicks its 00:00:56.415 --> 00:01:00.530 CEO to prove it's real, and scientists running 00:01:00.530 --> 00:01:03.670 the most detailed brain simulation ever on Japan's 00:01:04.130 --> 00:01:08.370 supercomputer. Let's get into it. For the first 00:01:08.370 --> 00:01:11.784 article from, the Associated Press, This one's written 00:01:11.784 --> 00:01:15.405 by a few different, authors, David Goldman, Ing 00:01:15.865 --> 00:01:22.744 Han Kuang, Felipe Dana, and, Dake Kang Dake 00:01:22.744 --> 00:01:25.065 Kang. Thank you guys very much for the 00:01:25.065 --> 00:01:28.020 article. But, it is a bit more of 00:01:28.020 --> 00:01:29.859 a photo essay, so I definitely recommend you 00:01:29.859 --> 00:01:32.679 guys tuning in to check this article out. 00:01:32.740 --> 00:01:35.380 The images are, you know, mildly chilling, and 00:01:35.380 --> 00:01:39.955 I understand that this maybe it's, seems a 00:01:39.955 --> 00:01:41.555 lot more intense when you look at it 00:01:41.555 --> 00:01:44.755 from this point of view, but it's crazy 00:01:44.755 --> 00:01:47.795 to see the infrared dot images that are 00:01:47.795 --> 00:01:50.115 scanning our faces every time we unlock our 00:01:50.115 --> 00:01:54.159 phones. But, basically, over the last quarter century, 00:01:54.380 --> 00:01:57.420 American technology companies have played a far greater 00:01:57.420 --> 00:01:59.979 role than previously known in designing and building 00:01:59.979 --> 00:02:03.020 China's surveillance state. The Associated Press conducted a 00:02:03.020 --> 00:02:05.500 three year investigation based on tens of thousands 00:02:05.500 --> 00:02:08.144 of leaked emails and databases from China's Chinese 00:02:08.144 --> 00:02:12.385 surveillance companies, confidential corporate and government documents, public 00:02:12.385 --> 00:02:15.905 marketing materials, procurement records, and interviews with over 00:02:15.905 --> 00:02:19.685 a hundred current and former engineers, executive officials, 00:02:19.825 --> 00:02:23.610 and police officers across three continents. The investigation 00:02:23.750 --> 00:02:28.890 revealed that companies including IBM, Intel, NVIDIA, Oracle, 00:02:29.110 --> 00:02:33.350 Dell, Microsoft, and Amazon Web Services, Thermo Fisher 00:02:33.350 --> 00:02:36.845 Scientific, and others sold billions of dollars worth 00:02:36.845 --> 00:02:40.525 of technology to Chinese police, government agencies, and 00:02:40.525 --> 00:02:43.965 surveillance companies despite repeated warnings from congress and 00:02:43.965 --> 00:02:46.125 media outlets about how these tools were being 00:02:46.125 --> 00:02:49.980 used to quash dissent, persecute religious groups, and 00:02:49.980 --> 00:02:55.040 target ethnic minorities. The foundation of Chinese surveillance 00:02:55.260 --> 00:02:57.980 apparatus was built on American technology, particularly in 00:02:57.980 --> 00:03:01.055 the far western region of Xinjiang, where it 00:03:01.055 --> 00:03:03.775 enabled a brutal mass detention campaign targeting the 00:03:03.775 --> 00:03:10.015 Uigh Uighur population. US companies brought predictive policing 00:03:10.015 --> 00:03:13.055 technology to China, systems that analyze vast amounts 00:03:13.055 --> 00:03:17.400 of data, including texts, calls, payments, videos, DNA, 00:03:17.540 --> 00:03:21.300 and even utility usage to identify individuals deemed 00:03:21.300 --> 00:03:26.500 suspicious and predict their movements. While the flood 00:03:26.500 --> 00:03:29.614 of American technology slowed considerably starting in twenty 00:03:29.614 --> 00:03:33.155 nineteen after international outrage and sanctions over atrocities 00:03:33.534 --> 00:03:36.915 in Xinjiang, it had already laid the foundation 00:03:36.974 --> 00:03:39.295 that Chinese companies have since built upon and, 00:03:39.295 --> 00:03:43.500 in some cases, replaced. Even today, connections persist 00:03:43.500 --> 00:03:46.220 between American tech and Chinese surveillance with companies 00:03:46.220 --> 00:03:49.019 like Amazon Web Services offering cloud services to 00:03:49.019 --> 00:03:51.900 Chinese surveillance giants despite them being on the 00:03:51.900 --> 00:03:55.885 US commerce's US Commerce department's entity list for 00:03:55.885 --> 00:04:01.345 national security and human rights concerns. Yeah. That 00:04:03.805 --> 00:04:06.205 things the sick things that people do for 00:04:06.205 --> 00:04:10.710 money. This this is just awful. The AP 00:04:10.710 --> 00:04:16.310 investigation uncovered that these companies had basically supplied 00:04:16.310 --> 00:04:19.750 critical infrastructure for China's digital police state. They 00:04:19.750 --> 00:04:24.535 sold facial recognition system, AI powered cameras, predictive 00:04:24.595 --> 00:04:29.175 policing software, cloud storage, DNA analysis kits, geographic 00:04:29.315 --> 00:04:32.355 mapping tools specifically marketed for use by Chinese 00:04:32.355 --> 00:04:36.380 police and surveillance agency. IBM, Dell, and Hitachi 00:04:36.520 --> 00:04:39.560 promoted facial recognition for police use, while NVIDIA 00:04:39.560 --> 00:04:42.520 and Intel partnered with China's three biggest surveillance 00:04:42.520 --> 00:04:45.479 companies to add AI capabilities to camera systems 00:04:45.479 --> 00:04:49.100 deployed across China, including in Xinjiang and Tibet. 00:04:50.065 --> 00:04:53.025 Dell marketed a military grade AI powered laptop 00:04:53.025 --> 00:04:56.465 with all race recognition capabilities to Chinese police 00:04:56.465 --> 00:05:00.305 in twenty nineteen. Thermo Fisher Scientific marketed DNA 00:05:00.305 --> 00:05:02.705 kits to Chinese police as designed for ethnic 00:05:02.705 --> 00:05:07.500 minorities like Uyghurs and Tibetans. Oracle, HP, and 00:05:07.500 --> 00:05:10.880 Esri sold geographic and mapping software allowing officers 00:05:10.940 --> 00:05:14.560 to track when blacklisted individuals strayed from designated 00:05:15.100 --> 00:05:20.495 areas. In Xinjiang specifically, this American technology enabled 00:05:20.495 --> 00:05:23.295 the creation of a comprehensive surveillance system where 00:05:23.295 --> 00:05:26.515 administrators assigned risk scores to residents with deductions 00:05:26.815 --> 00:05:29.695 for factors like growing a beard, being between 00:05:29.695 --> 00:05:32.255 fifteen and fifty five years old, or simply 00:05:32.255 --> 00:05:36.950 being Uyghur. By twenty seventeen, the system flagged 00:05:37.010 --> 00:05:40.050 twenty four thousand four hundred twelve people in 00:05:40.050 --> 00:05:42.710 a single week, most of whom were detained. 00:05:43.330 --> 00:05:46.050 Workers installed millions of cameras and wired over 00:05:46.050 --> 00:05:51.535 seven thousand police outposts. The investigation also revealed 00:05:51.535 --> 00:05:55.535 that across five presidential administrations, both Republican and 00:05:55.535 --> 00:05:59.055 Democratic, the US government repeatedly allowed and even 00:05:59.055 --> 00:06:01.935 actively helped American firms sell technology to Chinese 00:06:01.935 --> 00:06:05.350 police and surveillance companies despite warnings about national 00:06:05.350 --> 00:06:08.790 security and human rights abuses. The revelations have 00:06:08.790 --> 00:06:12.950 prompted bipartisan calls from lawmakers, including senator Josh 00:06:12.950 --> 00:06:16.010 Hawley, to subpoena tech companies and post stricter 00:06:16.390 --> 00:06:22.805 export controls. Man, I'm sure for a lot 00:06:22.805 --> 00:06:24.824 of you long time listeners to the show, 00:06:26.724 --> 00:06:29.065 that have kind of been through some of 00:06:29.365 --> 00:06:32.965 my dad's opinions, and maybe even align with 00:06:32.965 --> 00:06:35.479 that. Yeah. You you might find this one 00:06:35.479 --> 00:06:43.080 to be pretty crazy. It yeah. Well, maybe 00:06:43.080 --> 00:06:45.259 not crazy. It's it's maybe it's something that 00:06:45.400 --> 00:06:47.580 we do a little bit too often here. 00:06:50.215 --> 00:06:51.895 Trying to get a a little bit extra 00:06:51.895 --> 00:06:54.315 dough, I guess, here in the US. Jesus. 00:06:54.615 --> 00:06:59.655 This is just but, you know, this this 00:06:59.655 --> 00:07:02.750 kind of investigation raises critical questions about, like, 00:07:02.750 --> 00:07:06.030 corporate responsibility, you know, global impact of, like, 00:07:06.030 --> 00:07:10.050 technology sales. When American companies sell surveillance technology 00:07:10.110 --> 00:07:13.950 to authoritarian regimes, aren't aren't aren't we becoming 00:07:13.950 --> 00:07:16.765 complicit in those human rights abuses even if 00:07:16.765 --> 00:07:19.405 the abuses occurred, like, across an ocean that's 00:07:19.405 --> 00:07:21.965 on our continent? It's it's really easy to 00:07:21.965 --> 00:07:24.925 take a blind eye to these to what's 00:07:24.925 --> 00:07:28.225 happening when we're the ones enabling it realistically. 00:07:29.610 --> 00:07:31.770 And I don't mean we by us personally, 00:07:31.770 --> 00:07:39.370 but we, the American people. The technology for 00:07:39.370 --> 00:07:42.170 market access bargain that Silicon Valley struck with 00:07:42.170 --> 00:07:46.245 Beijing has had devastating real world consequences for 00:07:46.245 --> 00:07:51.125 millions of peoples or people. Yeah. Especially the 00:07:51.125 --> 00:07:54.245 Uyghur population. I think that's really tragic. I 00:07:54.245 --> 00:07:55.724 think I a few years back, I saw 00:07:55.724 --> 00:07:58.620 a lot of images of just, like, weird 00:07:58.620 --> 00:08:01.680 people lined up, you know, on their knees, 00:08:01.980 --> 00:08:04.460 on, like, like, just, like, concrete floor. It's 00:08:04.460 --> 00:08:09.680 just like a horrible imagery, but I digress. 00:08:10.540 --> 00:08:12.540 Sorry. It's a really heavy heavy one to 00:08:12.540 --> 00:08:16.514 lead with, but I think it's pretty crazy 00:08:16.514 --> 00:08:17.955 to think, you know, just like even over 00:08:17.955 --> 00:08:19.634 just, like, the last quarter century, you know, 00:08:19.634 --> 00:08:23.955 we we were the ones saying all these 00:08:23.955 --> 00:08:28.889 bad things about how the surveillance over there 00:08:28.889 --> 00:08:32.970 is too much, saying, you know, it's crazy 00:08:32.970 --> 00:08:34.970 to have a social score, and yet we're 00:08:34.970 --> 00:08:37.630 the ones enabling it. You know? Who knows? 00:08:37.850 --> 00:08:39.690 We probably have all that here too, just 00:08:39.690 --> 00:08:44.135 not not that we know of. Well, let's 00:08:44.135 --> 00:08:46.055 move on. Let's, let's let's hit a little 00:08:46.055 --> 00:08:48.215 bit of lighter note. I wanna do a 00:08:48.215 --> 00:08:49.655 little bit bit of a shout out to 00:08:49.655 --> 00:08:54.055 our incredible sponsor at GoDaddy. Score exclusive deals 00:08:54.055 --> 00:08:56.215 and discounts right now at geek new central 00:08:56.215 --> 00:08:58.500 dot com forward slash GoDaddy. And to all 00:08:58.500 --> 00:09:00.740 of you guys, our listeners, you are truly 00:09:00.740 --> 00:09:03.060 the heartbeat of the show. If you wanna 00:09:03.060 --> 00:09:05.060 support Geek News Central directly, head over to 00:09:05.060 --> 00:09:07.540 geek new central dot com forward slash insider 00:09:07.540 --> 00:09:11.235 and become a GNC insider. Grab yourself a 00:09:11.235 --> 00:09:13.555 modern podcast app at podcast apps dot com 00:09:13.555 --> 00:09:16.834 for the full next gen podcast experience. Of 00:09:16.834 --> 00:09:18.435 course, you can check out the entire Geek 00:09:18.435 --> 00:09:20.995 News Central universe at geek news central dot 00:09:20.995 --> 00:09:22.995 com, where you'll find all our partner shows 00:09:22.995 --> 00:09:25.154 and tons of great content published every single 00:09:25.154 --> 00:09:28.270 week. Stay in the loop. Follow or subscribe 00:09:28.270 --> 00:09:30.590 in your favorite podcast app. Lately, I've been 00:09:30.590 --> 00:09:34.270 using, PocketCasts. That one has been pretty good 00:09:34.270 --> 00:09:39.085 to me. But, yeah, follow us in your 00:09:39.165 --> 00:09:40.845 or subscribe to us in your favorite podcast 00:09:40.845 --> 00:09:42.125 app, and don't forget to sign up for 00:09:42.125 --> 00:09:43.965 our newsletter, which I have not been sending 00:09:43.965 --> 00:09:47.245 out. So, that one's not so pressing. But 00:09:47.245 --> 00:09:49.005 do sign up so that when I do 00:09:49.005 --> 00:09:52.145 get that all set back up again, properly, 00:09:52.205 --> 00:09:54.290 we can hit you guys with a fresh 00:09:54.290 --> 00:09:57.810 newsletter every time we drop a show. And 00:09:57.810 --> 00:09:59.330 then you can always reach us directly at 00:09:59.330 --> 00:10:02.210 geek news at g mail dot com. If 00:10:02.210 --> 00:10:04.450 you wanna, you know, directly get talk to 00:10:04.450 --> 00:10:07.735 us, give us some feedback, or give us 00:10:07.735 --> 00:10:09.175 your opinions about, you know, any of the 00:10:09.175 --> 00:10:10.694 topics on the show. We'd love to hear 00:10:10.694 --> 00:10:13.814 from you guys. Definitely makes me feel good 00:10:13.814 --> 00:10:15.415 when I when I pop open an email 00:10:15.415 --> 00:10:16.774 from one of you folks and read what 00:10:16.774 --> 00:10:17.894 you have to say about one of the 00:10:17.894 --> 00:10:20.134 articles I talked about in the previous show. 00:10:20.134 --> 00:10:22.394 Thank you again for continuing to reach out. 00:10:24.350 --> 00:10:25.870 But we wanna take a moment to thank 00:10:25.870 --> 00:10:28.990 our sponsor, GoDaddy. They've been with us for 00:10:28.990 --> 00:10:31.070 a long, long time, as long as I 00:10:31.070 --> 00:10:33.630 personally can remember, and their incredible support of 00:10:33.630 --> 00:10:35.710 this podcast is what makes it possible for 00:10:35.710 --> 00:10:37.650 us to keep doing what we love, continuing 00:10:37.710 --> 00:10:40.644 on our father's legacy, and for for you 00:10:40.644 --> 00:10:42.245 guys to hear what you guys love every 00:10:42.245 --> 00:10:45.685 single week, some great tech news. If you're 00:10:45.685 --> 00:10:47.204 ready to start your own website or even 00:10:47.204 --> 00:10:49.764 launch a podcast, GoDaddy has you covered. At 00:10:49.764 --> 00:10:52.105 geek news central dot com forward slash GoDaddy, 00:10:52.380 --> 00:10:54.300 you'll find special promo codes that make it 00:10:54.300 --> 00:10:56.780 easy and affordable to get started. And these 00:10:56.780 --> 00:10:59.260 promo codes are not expiring, so I verify 00:10:59.260 --> 00:11:01.500 them every single day. They're all up and 00:11:01.500 --> 00:11:03.660 running. I've got, links to each one. So 00:11:03.660 --> 00:11:06.525 definitely check out the site, geek new central 00:11:06.525 --> 00:11:08.085 dot com forward slash godaddy if you're trying 00:11:08.085 --> 00:11:10.365 to start on a website. Here are some 00:11:10.365 --> 00:11:13.085 of the deals we offer. Economy hosting is 00:11:13.085 --> 00:11:14.765 just six ninety nine a month. It's a 00:11:14.765 --> 00:11:16.525 full year of hosting with a free domain 00:11:16.525 --> 00:11:20.670 name, professional email, and a SSL certificate. If 00:11:20.670 --> 00:11:23.090 you're like us, and you you like WordPress, 00:11:23.630 --> 00:11:25.870 WordPress hosting is only twelve ninety nine a 00:11:25.870 --> 00:11:28.510 month, including that same free domain name, email, 00:11:28.510 --> 00:11:33.150 and SSL certificate. WordPress, I I think the 00:11:33.150 --> 00:11:35.685 more I use it, the more I like 00:11:35.685 --> 00:11:40.404 it, to some degree. It is an awesome, 00:11:40.404 --> 00:11:43.524 awesome ecosystem just to easily get something like 00:11:43.524 --> 00:11:45.764 a blog up and running, have a great 00:11:45.764 --> 00:11:48.245 personal site available for people to come visit, 00:11:48.245 --> 00:11:49.605 see what's going on with you and your 00:11:49.605 --> 00:11:51.790 family. So So definitely check it definitely check 00:11:51.790 --> 00:11:54.830 it out. It's a lot more private than 00:11:54.830 --> 00:11:57.570 posting to a social media site. You know? 00:11:59.710 --> 00:12:01.490 And if you just need a domain name, 00:12:01.630 --> 00:12:02.910 you think this is a cool idea, you 00:12:02.910 --> 00:12:04.270 wanna do it in the future, you don't 00:12:04.270 --> 00:12:06.644 know how right now, no no problem. Just 00:12:06.644 --> 00:12:08.565 grab a domain domain name for eleven ninety 00:12:08.565 --> 00:12:11.045 nine. And, you know, if you're not super 00:12:11.045 --> 00:12:13.765 tech savvy, GoDaddy also has a website builder 00:12:13.765 --> 00:12:15.365 where you can get a free thirty day 00:12:15.365 --> 00:12:18.245 trial on business our personal business and business 00:12:18.245 --> 00:12:21.020 plus plans and get your website online in 00:12:21.020 --> 00:12:23.180 no time. Website really only needs to be 00:12:23.180 --> 00:12:27.180 built once. Right? Now I use GoDaddy's products 00:12:27.180 --> 00:12:28.940 and services myself, and I can tell you 00:12:28.940 --> 00:12:32.115 that their reliability is the real deal. Your 00:12:32.115 --> 00:12:34.835 support of GoDaddy directly supports the show. So 00:12:34.835 --> 00:12:36.755 please use our codes, click and save, and 00:12:36.755 --> 00:12:39.875 help keep this independent podcast going strong. Share 00:12:39.875 --> 00:12:41.795 those friends with friends and or share those 00:12:41.795 --> 00:12:43.475 links with friends and family. I can share 00:12:43.475 --> 00:12:45.480 your friends with your friends and family too. 00:12:45.560 --> 00:12:47.800 But, every time one's used, it's like writing 00:12:47.800 --> 00:12:50.199 a check to the show. We truly thank 00:12:50.199 --> 00:12:51.880 you for supporting us here at GoDaddy or 00:12:51.880 --> 00:12:53.639 at Geek New Central. Wow. I'm just tripping 00:12:53.639 --> 00:12:55.399 over my words tonight. Thank you so much 00:12:55.399 --> 00:12:57.880 for supporting us at Geek New Central. Huge 00:12:57.880 --> 00:13:00.605 thanks to GoDaddy, and thank you for believing 00:13:00.605 --> 00:13:02.605 in independent creators like us here at Geek 00:13:02.605 --> 00:13:05.725 News Central dot com. Let's move on. Let's 00:13:05.725 --> 00:13:07.565 see if I can get through this show 00:13:07.565 --> 00:13:11.025 with, without tripping over all my words. Jeez. 00:13:11.325 --> 00:13:12.605 Maybe I need some water. I gotta get 00:13:12.605 --> 00:13:25.710 some water. Alright. Jesus. Okay. Alright. Jeez. Hopefully, 00:13:25.710 --> 00:13:27.490 you guys didn't have to hear all that. 00:13:28.025 --> 00:13:32.505 Let's move on. I did mention this in 00:13:32.505 --> 00:13:35.065 the intro, but speaking of security concerns a 00:13:35.065 --> 00:13:38.045 little bit closer to home, two Chrome extensions 00:13:38.105 --> 00:13:41.145 were caught secretly stealing credentials from over one 00:13:41.145 --> 00:13:44.920 hundred seventy sites. This one's from Hacker News 00:13:44.920 --> 00:13:49.820 written by Ravi Lakshmanan. Thank you very much, 00:13:50.920 --> 00:13:56.140 Ravi. But browser extensions have become a significant 00:13:56.394 --> 00:13:58.815 security threat in twenty twenty five with multiple 00:13:58.875 --> 00:14:02.795 large scale campaigns exposing millions of users to 00:14:02.795 --> 00:14:06.555 data theft and surveillance. The ecosystem's vulnerability stems 00:14:06.555 --> 00:14:09.890 from several systemic issues. Ninety nine percent of 00:14:09.890 --> 00:14:13.649 enterprise users have browser extensions installed with fifty 00:14:13.649 --> 00:14:16.769 two percent running more than ten extensions. Up 00:14:16.769 --> 00:14:19.649 to fifty three percent of extensions in enterprise 00:14:19.649 --> 00:14:23.204 environments have high or critical risk permissions, allowing 00:14:23.204 --> 00:14:27.285 access to sensitive data like cookies, passwords, browsing 00:14:27.285 --> 00:14:30.904 history, and web page contents. Perhaps most concerning, 00:14:31.204 --> 00:14:34.264 fifty four percent of extensions are published anonymously 00:14:34.565 --> 00:14:37.410 via Gmail accounts with seventy nine percent from 00:14:37.410 --> 00:14:41.010 publishers who have released only one extension, making 00:14:41.010 --> 00:14:45.670 trust assessment really challenging, which I can totally 00:14:45.810 --> 00:14:48.209 understand. Now for those of you that are 00:14:48.209 --> 00:14:52.555 generally using plugins on your browsers, how are 00:14:52.555 --> 00:14:54.875 you determining that they're safe to use? What 00:14:54.875 --> 00:14:58.014 types of plugins are you guys using that, 00:14:59.194 --> 00:15:02.074 that these types of concerns are are, you 00:15:02.074 --> 00:15:05.320 know, are even coming up? It's honestly kind 00:15:05.700 --> 00:15:10.340 of freaky. I don't know. You I think 00:15:10.340 --> 00:15:14.660 all my, extensions are from trusted providers that 00:15:14.660 --> 00:15:17.560 I'm familiar with. I've never downloaded an extension 00:15:17.620 --> 00:15:24.265 from, you know, someone that only has the 00:15:24.265 --> 00:15:29.065 single extension and is unknown. So, you know, 00:15:29.065 --> 00:15:30.825 an unknown name. I feel like I've only 00:15:30.825 --> 00:15:34.810 ever downloaded, like, browser extensions from, like, official 00:15:35.029 --> 00:15:38.170 providers, like, you know, like, Chrome extension or, 00:15:38.470 --> 00:15:41.130 you know, this one's being distributed by Android 00:15:41.269 --> 00:15:44.845 or something. I I don't know. But these 00:15:44.845 --> 00:15:47.185 recent incidents highlight the scale of the problem. 00:15:48.125 --> 00:15:51.645 So, the shady panda campaign spent seven years 00:15:51.645 --> 00:15:55.165 publishing or acquiring harmless extensions, letting them run 00:15:55.165 --> 00:15:57.645 clean to build trust and gain millions of 00:15:57.645 --> 00:16:01.129 installs, then suddenly flipping them into malware via 00:16:01.129 --> 00:16:05.310 silent updates, ultimately affecting four point three million 00:16:05.370 --> 00:16:08.170 Chrome and Edge users. In late twenty twenty 00:16:08.170 --> 00:16:10.730 four and early twenty twenty five, a phishing 00:16:10.730 --> 00:16:13.725 campaign compromised developer accounts for at least thirty 00:16:13.725 --> 00:16:17.725 five legitimate Chrome extensions, allowing attackers to inject 00:16:17.725 --> 00:16:20.765 malicious code that stole cookies and access tokens 00:16:20.765 --> 00:16:23.885 from over two point six million users. These 00:16:23.885 --> 00:16:27.245 incidents demonstrate how attackers exploit the sleeper agent 00:16:27.245 --> 00:16:30.990 strategy, maintaining legitimate extensions for years before weaponizing 00:16:31.130 --> 00:16:33.450 them through updates that auto install across the 00:16:33.450 --> 00:16:36.170 entire user base. That is brutal. How do 00:16:36.170 --> 00:16:40.589 you even defend against that? It's actually brutal. 00:16:41.165 --> 00:16:43.884 Security researchers at socket dot dev discovered two 00:16:43.884 --> 00:16:47.324 malicious Chrome extensions, both named Phantom Shuttle, that 00:16:47.324 --> 00:16:49.504 have been operating since at least twenty seventeen, 00:16:49.725 --> 00:16:53.279 marketed as VPN and network testing tools while 00:16:53.279 --> 00:16:56.160 secretly stealing credentials from over one hundred seventy 00:16:56.160 --> 00:17:00.160 targeted websites. Extensions published by the same threat 00:17:00.160 --> 00:17:05.535 actor using the email, the new one, the 00:17:05.535 --> 00:17:08.015 new as in I knew, the new one 00:17:08.015 --> 00:17:14.175 dot com at Gmail dot com, have have 00:17:14.175 --> 00:17:17.715 accumulated over two thousand one hundred eighty users 00:17:18.220 --> 00:17:21.820 who paid subscriptions ranging from nine point nine 00:17:21.820 --> 00:17:24.820 to ninety five point nine Chinese yuan. So 00:17:24.820 --> 00:17:27.660 a dollar forty or thirteen fifty USD, believing 00:17:27.660 --> 00:17:34.934 they were purchasing legitimate VPN services. I don't 00:17:34.934 --> 00:17:40.054 understand you people. The malicious code is cleverly 00:17:40.054 --> 00:17:43.575 hidden by prepended to the legitimate hidden by 00:17:43.575 --> 00:17:47.070 being prepended to the legitimate jQuery library, making 00:17:47.070 --> 00:17:52.590 detection more difficult. Dude, these people are so 00:17:52.590 --> 00:17:55.470 clever. It's it's insane. The attack operates through 00:17:55.470 --> 00:17:59.470 sophisticated traffic interception. The extensions automatically inject hard 00:17:59.470 --> 00:18:03.675 coded proxy credentials. Username top fanny, password nine 00:18:03.675 --> 00:18:06.655 six three eight five two way, into every 00:18:06.795 --> 00:18:10.555 HTTP authentication request without user knowledge, running all 00:18:10.555 --> 00:18:13.755 browsing traffic through attacker controlled proxy servers hosted 00:18:13.755 --> 00:18:16.380 on Alibaba Cloud. This creates a man in 00:18:16.380 --> 00:18:19.040 the middle position allowing attackers to capture unencrypted 00:18:19.180 --> 00:18:23.340 data, including passwords, form data, session cookies, and 00:18:23.340 --> 00:18:27.420 browsing history. The hundred seventy domain target list 00:18:27.420 --> 00:18:31.705 specifically focuses on high value development tools, Docker, 00:18:32.005 --> 00:18:37.145 NPM registries, enterprise platforms like Cisco, IBM, VMware, 00:18:37.605 --> 00:18:41.045 and social media sites. The extensions maintain a 00:18:41.045 --> 00:18:43.365 sixty second heartbeat to their command and control 00:18:43.365 --> 00:18:47.160 server at phantom shuttle dot space, continuously exfiltrating 00:18:47.300 --> 00:18:50.820 user data. Most alarmingly, every five minutes, the 00:18:50.820 --> 00:18:54.500 extensions send user email addresses and passwords in 00:18:54.500 --> 00:18:57.940 plain text to the attacker infrastructure. As of 00:18:57.940 --> 00:19:00.945 December twenty twenty three twenty twenty five, the 00:19:00.945 --> 00:19:05.125 extensions remain operational in the Chrome Web Store 00:19:05.345 --> 00:19:07.985 through though socket dot dev has submitted takedown 00:19:07.985 --> 00:19:17.170 requests to Google's security team. What? Yeah. How 00:19:17.170 --> 00:19:19.010 do you defend against something like this? You 00:19:19.010 --> 00:19:21.330 know what I mean? How do you defend 00:19:21.330 --> 00:19:25.090 against something like this? This incident kinda reveals 00:19:25.090 --> 00:19:27.330 how browser extensions have evolved to the one 00:19:27.330 --> 00:19:30.165 of the most dangerous attack vectors in modern 00:19:30.165 --> 00:19:34.645 cybersecurity, particularly for developers and enterprise users. The 00:19:34.645 --> 00:19:37.285 targeting of developer flat platforms and cloud consoles 00:19:37.285 --> 00:19:40.965 is especially concerning because compromised developer credentials enable 00:19:40.965 --> 00:19:44.220 supply chain attacks. When attackers gain access to 00:19:44.220 --> 00:19:47.980 GitHub accounts, Docker registries, or MPM packages, they 00:19:47.980 --> 00:19:50.620 can inject malicious code that proc propagates to 00:19:50.620 --> 00:19:53.820 thousands or millions of downstream users. The fact 00:19:53.820 --> 00:19:57.260 that these extensions operated undetected for potentially eight 00:19:57.260 --> 00:20:00.535 years demonstrates a massive blind spot in both 00:20:00.535 --> 00:20:06.135 individual security practices and platform oversight mechanisms. For 00:20:06.135 --> 00:20:08.715 the average person, you know, this might illustrate 00:20:08.775 --> 00:20:10.934 to you why the traditional just be careful 00:20:10.934 --> 00:20:14.110 what you install advice is literally insufficient because, 00:20:14.110 --> 00:20:15.870 you know, I was talking to Mac here 00:20:15.870 --> 00:20:17.549 at the beginning, but then turns out that 00:20:17.549 --> 00:20:20.610 they were, you know, that you're using sleepers 00:20:20.990 --> 00:20:24.110 sleeper agent strategies. So, you know, these could 00:20:24.110 --> 00:20:26.830 be apps that you see them on the 00:20:26.830 --> 00:20:29.295 the the Chrome extension store and you see 00:20:29.535 --> 00:20:32.015 thousands and thousands of people have installed it, 00:20:32.015 --> 00:20:35.215 you inherently trust the the extension a little 00:20:35.215 --> 00:20:39.295 bit more. So I'm sure I'm sure there's 00:20:39.295 --> 00:20:41.870 at least one where, you know, it got 00:20:41.870 --> 00:20:48.210 flipped on its head. Who knows? But, definitely 00:20:48.350 --> 00:20:54.030 be careful installing extensions on your, browsers nowadays. 00:20:54.030 --> 00:20:55.870 You know, you really wanna only have the 00:20:55.870 --> 00:20:59.045 ones that are by trusted providers. And I 00:20:59.045 --> 00:21:03.045 know that's easy to say, but but, I 00:21:03.045 --> 00:21:05.845 mean, come on. They were these people were 00:21:05.845 --> 00:21:14.970 already literally paying you on to someone. It's 00:21:14.970 --> 00:21:17.450 like, it's out of country. You don't need 00:21:17.690 --> 00:21:19.370 like, how can you trust any of the 00:21:19.370 --> 00:21:24.115 services that are being sold there? So I 00:21:24.115 --> 00:21:26.115 don't know. It's an interesting thing. It's it's 00:21:26.115 --> 00:21:29.174 really hard to be able to diagnose whether 00:21:29.235 --> 00:21:31.794 a business is trustable in the in the 00:21:31.794 --> 00:21:34.135 scope of being able to handle your data. 00:21:34.275 --> 00:21:38.610 And I think this is a big example 00:21:38.670 --> 00:21:40.110 of why you should be careful of where 00:21:40.110 --> 00:21:42.050 you sign up or what kind of extensions 00:21:42.190 --> 00:21:44.590 you pay into, you know, the types of 00:21:44.590 --> 00:21:50.455 sites you're paying into. Yeah. I don't know. 00:21:50.455 --> 00:21:52.535 Even just going through some of my, you 00:21:52.535 --> 00:21:55.335