OpenAI’s Adult Mode Debate | Cyber Strategy Clash | 7,000 Robot Vacuums Hacked

Hey, everyone. Happy Wednesday. Welcome to Techstrong gang.

You know, Mike Vizard is still on his trek from Boston to New York. I don't know whether his horse broke down or what, but he could have walked it and made it in two days. But anyway, no, no, no, Man in the High Castle today, but we still have a great gang of folks here to talk to us.

Let me introduce you to them. She's be- she's in front of the brick wall once again, our cyber sleuth, Terry Robinson. Joining us from Boulder, down under, our mate Andy Mann.

Looks like he's home in northern Virginia, hugging close to that beltway, Jack Pollard. And our West Coast Bureau Chief, but- Aha ... I've got an announcement to make.

I am gonna make John Swartzum now on just the Bureau Chief, no longer just West Coast. I'm gonna change my title then. Okay.

Yeah. We are consolidating our East Coast Bureau with our West Coast Bureau- Our vast empire ... to just have one bureau.

Christians. Yeah. Exactly.

There you go. Welcome, John. Thanks, Bill.

No problem. So guys, look, the, uh... I, I just feel like we're...

It's crazy times right now. Yeah. We've seen so much...

Well, there's so much going on in the world beyond tech news and everything else, but we're in our own little private Idaho here, not paying attention to who they killed where. Um, talking about what's going on in our world. Uh, and I guess apropos, we're gonna lead off with something ar- around adult AI.

You know, it, it had to come. I was surpr- Yeah ... I'm surprised it hasn't come before, I guess.

But John, what's this one about? Okay, yeah. I'm gonna try to parse through this.

Uh, this is, yeah, it's... The world we live in is getting stranger and stranger, and it always seems as if OpenAI is in the middle of it- Yes ... whether they want to or not, right?

So they're thrust in the middle of this. And I also think something to say about this story is that there are other companies like Meta and, and, Musk and his companies that are delving a little bit into this, but OpenAI gets all the flack because they are assuming this kind of Black Knight status within tech. They are the company we all wanna beat up on.

So they've essentially delayed release of this naughty version of ChatGPT, which is designed to let mature text-based conversations take place while prohibiting the generation of erotic imagery or audio. That's what they say. So according to a Wall Street Journal report, this new feature, which is called the adult mode, in which the company categorizes as, as s**t rather than pornography.

I can't believe the spokesperson said this. It was supposed to come out this month, right? But it's not ready, and there's a reason why it's not ready.

There is an age prediction technology which is supposed to estimate the user's age based on the conversation topics and usage patterns, but that's failing 12% of the time. " But OpenAI in pursuit, perhaps of profits and ego and hubris, as they always do, they, they forged ahead. So o- one of the advisors actually cautioned that without ironclad guardrails, the bot would morph into a sexy suicide coach, and that, uh- Ooh ...

this could foster dangerous emotional dependence among users, which I, I think is a... based on some of the lawsuits and some of the cases we've heard is, is very, is very possible. So, you know, when I saw this, I thought of the MPAA ratings in a weird way in the movie industry and Jack Valenti way back in the day in the '60s, I believe, and maybe later.

And this is something that is hard to categorize, but something that OpenAI is gonna push forward to. I, I think they're motivated as much by money as anything else, obviously, like the world. Um, but it's become a, a black eye and an eyesore for them.

And, I think it's something that they, they're... Like in a lot of the cases of what they're going through, it's more than they bargained for. And so I'll, I'll just kick it back to you.

You know, I, I just shook my head, right? So again, I, I always look at parallels in our AI evolution with what I lived through during the dotcom days. And, I'll be honest with you, I, I founded what became a hosting company before we called it hosting back in '96.

Nine- '96, '95 even. Um, sold it in '97, the end of '97. And at that time, you know, I quickly found out that, you know, what did they say?

40, 40% of all the bits going over the internet at that point were pornography related or adult entertainment, because pornography is only something you recognize when you see it. Um, or something like that, the legal says, the legal description. Um, you know, but I thought we outgrew that.

But i- I just... To me, this is just living proof that, you know, the oldest profession in the world is what it is, what it is. And we will...

H- humanity will never outgrow its predilection for s**t, pornography, whatever you wanna call it. Um, I, I don't think we could ever escape it. It, the, it must be something buried deep in our psyches.

Well, when you, when you mention the internet, I think about AOL. I mean, that sex drove it. I mean, it helped make- Those AOL chat rooms.

Yeah, every pedophile in the world. Yeah. Well, not everyone, 'cause one was probably stillUp in his tower somewhere.

But, um- I think that's called an island. No, it's called- Well, that's the one pedophile. I'm talking about his friend, his buddy.

He had a tower in New York. Wow. But anyway, we'll, we'll save it for the next segment, Jack.

But let, let's, let's talk about, let's talk about this. I mean, look, I think it's a, it is a bad idea all around. It's just a bad idea that's gonna ...

It's not gonna end well. Yes, there is money. There is money in adult- Well, yeah ...

whatever you wanna call it The purveyors of s**t have been making money for decades. Yeah, no. Decades and years.

It's the second oldest and ... Yeah, profession. They- They are the pioneers of a lot of internet, uh- Well, I think- ...

inventions and products ... it goes back before the internet, right? It's, the, the ability to- Yeah, the 800- ...

reproduce was ... Well, before that. This is what made VHS versus Betamax, for those of us old enough to remember it, is that Sony did not allow, adult content on Betamax, which was arguably a much better technology than VHS.

Superior, yeah. JVC allowed to do it, and that's what made VHS tape sell, was that you could get adult entertainment on it. So this is a very old thing.

But now bringing that back to OpenAI, you mentioned a key word, John, which is profitability, and that's what OpenAI is missing right now. What's I think we missed alongside this announcement was that OpenAI is going to refocus their entire business on their core AI and not on the rest of the stuff, and I'm pretty sure that ... I, I, I don't know what this means for Johnny IV and devices, but I think- Yeah ...

that's probably a, a problem. And I don't necessarily know that, adult entertainment is core to the AI business, but it is clearly a way to fund building data centers, which is what they are doing in a big way. Yes.

It's been interesting you mention that Johnny IV thing, that this ... 5 billion on that, on his company, and now the feeling ... I don't know what you've heard about this, Jack.

I know we're kind of going down a little bit of a side street, but I don't think that's gonna amount to much of anything now, so. Well, no. If you could ...

Maybe Johnny IV builds an adult entertainment AI device. Now, there you go. You know, that you- Oh, my ...

has a hologram or something generator. I don't know. Ugh.

Um, use your imagination. Alan, this thing- The sky's the limit ... indus- that takes industrial design to an entirely new level.

Yes, it does. Yes, it does. I mean, my- Go from Apple to that.

Yeah. Wow. You know, all kidding aside, all kidding aside, there, there's, there's gold in them there hills.

There's no doubt about it. No one denies that the, the adult entertainment industry is a cash register. You know?

That, it- Yeah. But, but here's the thing. Age verification can't be wrong 12% of the time, 10% of the time, 4% of the time.

It's a law. If you're not 18 or 21 or whatever the age is, you don't get in. Not, "Well, except for 4% of the time.

" Um, there, there ... It, it's against the law. It ...

You're gonna get sued. If I'm a parent- Well, it's- ... and I found out my kid got in here 'cause it was the, you know, only 6% of the time it made a mistake, I'm suing.

I'm, I'm doing something. Well- I, I'm asking the law enforcement authorities to get involved. Let's take Sam Altman away in cuffs.

Is it worth it? Well, a lot of people would like to see that. Did, did, you say that they're determining age by patterns of behavior- Yeah ...

and how you come onto the site? Yeah. Yeah.

It's an algorithm. Yeah. Well, I said I think the, the- Yeah ...

the, the challenge there is, and in a lot of states, in a lot of countries, and in a lot of states in this country, you need to do age verification before you get to access a, an adult content website, right? Right. But if it's ChatGPT which has the ability to generate the stuff, they then have to do age verification in order to just access, right?

Where ... How do they do that? 'Cause you don't wanna put, that friction of age verification just to access the service for people who have no interest in it whatsoever.

No, I, I think you put it in by- Right? Right. So, so, I mean, this is, this is the big challenge they have and why they're using the AI to do age verification, and failing at it, rather than doing actual age verification like show me your driver's license.

When you put in a prompt and you ask it to generate something that may be considered adult, content, why can't you do a pop-up then? I'm very sorry, I can't generate this without verifying your age. You know, I, I think this is just another example of OpenAI kind of going down the path of Meta- I'd like to- ...

in a certain way, right? You know, Meta took ... got a lot, got into a lot of hot water because of, access, granted to underage kids, people 13, in their congressional hearings, and I, I just could see this in the future- But that wasn't porn ...

in the future. That was just access to Facebook. Yeah, I know.

A- again, access to, to things that the, the ... You know, you're not supposed to have kids under 15 or 16 on Meta, period. And, and I, I just, I just feel as if this is gonna be another instance where OpenAI's gonna be made an example of.

Once Congress gets wind of the, the pushback, they were gonna, they're gonna find some designated whipping boy, and it's gonna be in this case OpenAI, and this'll be more fodder for their files. Well, what does Congress do? Come on.

Not much. You know? But, but here's the imp- a, a thing I think we need to acknowledge It wasn't that this got shut down by regulatory agencies.

It wasn't that it got shut down by some external group. This got shut down as a result of internal friction. So that does tell you that, look, there are people within the AI or OpenAI power hierarchy who are saying, "Hey, full stop, this ...

Guys, this isn't a good idea. Wait, wait. Delay this.

Let's not do this. Let's really think about this. " Well, one of the members of the council did resign and went public about it and mentioned her, her misgivings.

But what, to me, my interpretation is that OpenAI is determined to do this regardless, right? They're gonna do it in some form. Well, let, let me play devil's advocate.

If OpenAI doesn't, there are gonna be other AI models that do. There probably already are. I ...

It's just not my, not my cup of tea, so I, you know, I don't know what's out there. But I would venture to guess that there are probably AI models that are, are, are doing this already. So but does this boil down to something similar in terms of a moral stand similar to OpenAI and Anthropic versus the Department of War, where Anthropic wasn't willing- Mm-hmm ...

to cross certain lines and OpenAI apparently is, since they made an agreement. Looks like this may be something that they are willing to get into in some way or another, where, right, they're taking a different moral stance on it. Right.

Not that I agree with their stance, but- That plays into their, that plays into their market, their, their, their, good vers- the white hat versus the black hat- Right ... part of their marketing, their advertising. They'll play ...

I mean, they'll, they'll lean into that. Yeah, sure. What do you suppose the overlap is though between the Defense Department and the s**t people?

Oh, in, in the current- One ... in the current iteration? Yeah.

I don't even ... Let's save it for the next segment. That's a loaded question.

Let's save it for the next segment. But I do acknowledge that you called it the Defense Department versus Jack acquiescing to the dictates of the administration and calling it the Department of War. It's still the DoD to me.

I, you know, the Defense Department- Yeah, no, I, I think Congress has to get involved for that. But look, guys, it's coming, right? I mean, we have not figured out a way to stamp out s**t, pornography, whatever you wanna call it.

And I, I just, you know, I, I'm glad to see that at least someone there is, is having, you know, some doubts. But if, if it's not OpenAI, as I said, it'll be somewhere else. It, it is ...

And then the question becomes, well, if someone else is making money off, off of it, and we desperately need to be profitable, why aren't we doing it, right? And I'll tell you one thing, one thing I want y'all to look out, look out for. Um, normally people will say The Simpsons did it first, right?

This time it was Green's other show, Futurama did it first. Go Google don't date robots. It's a short episode.

Yeah. I don't even know if I wanna go there. So it's funny.

That doesn't sound like it's gonna end well for me, man. Oh, no, it's fun. It's fun.

It's fun. Um- Yeah ... it's an episode of Futurama where they start dating robots, set in the future, right?

It's 2,000 years in the future or something. It's a cartoon. It's an adult cartoon.

Not an adult cartoon, but a grown-up cartoon. And it was don't date robots. And it starts off with the trauma inflicted on a young teenager by Marilyn Monrobot.

Um- A- a- and, and this young teenager, loses his paper route, stops making money, and the girl across the road ends up washing her hair at night because he's dating Marilyn Monrobot. Um- Don't date robots. I thought we'd already figured this message out.

The idea of using a chatbot trained on Reddit and Pornhub to go and have a conversation, a, a, a sexy, s****y conversation is crazy to me. Um, but I think, Alan, it's really important you, you mentioned right up at the front, meanwhile, we've got Grok just straight up producing CSAM. Yeah.

Right? I mean, look, a text chat is one thing, but producing these pornographic images of underage children and just at random, I think we got bigger things to worry about outside of OpenAI having a chatbot. Yeah.

I think it's great that internal people had a conversation. I worry a lot about programmers being asked to create these things without any great training in, in social studies or, or, or, you know, sexual therapies or anything like that. And so at least they're doing something, which is more than some of the others are doing.

Yeah, you know, Andy, I'm glad you mentioned that because Meta is under investigation for AI avatars engaging in sexual chats with children. And as you said, Grok has ... They, they've, they've generated non-consensual explicit, explicit imagery.

So there, there, there are no safeguards there or guardrails there. Anyway, I know we're, we're running short on time. Look, you know what?

We ... In this country, we have a system of checks and balances. And unless the judiciary is gonna come down on these uses, unless our legislature is gonna legislate, right?

Executive orders alone are not laws. They're just executive orders. We need a unified government that i- if you're serious about acting on this stuff, and I agree with all what you're saying, a lot of this is just disgusting.

But if you don't have the will to do something about it, it is what it is. I mean, I don't know what else to do other- Yeah ... you know, personal responsibility, that's always the answer you hear from those kinds of folks, right?

And they're always the ones who wind up getting brought up on charges. But anyway-We gotta jump to our next, our next topic here. You know, this one was a long time a-coming, because Jack and I just haven't been on at the same time, due to engagements.

But, I guess it was maybe two weeks ago now, our executive put out a, a cybersecurity strategy that was, I think, five to seven pages, but that included the covers, the title pages, the footnotes. It was actually all of three pages. Um, Jack, why don't you tell us about this brochure?

Well, yes. I think it takes a different tact, and what I'd- what I'm hoping we can do is separate the policy from the politics, which is very hard to do, and look at simply what the, the approach that the current administration takes, which is a approach of identifying the key policies and directions we wanna go and saying, "This is the direction we wanna go," and allowing the private industry, which is the, in my opinion, where-- the people who know best to implement, to come up with the tools and technologies to help the federal government and private industry implement those policies. And part of those policies is to change the way we view cybersecurity from pur-purely a technical thing to a, look at it more as an economic and a criminal enterprise because, you know, we've been talking for twenty years about nation-state actors and, with the exception of very recent events, they are almost entirely, motivated by financial mo- Uh, they have financial motivation.

They wanna steal things. And we should be treating that as criminal so that the government can, enable the private industry to go after those criminals that affect them, just like, the government does. And that we should allow the agencies to go and, particularly CISA, to go and figure out what the right technology is, rather than having the White House describe the actual technology.

Now, you know, A-Alan, obviously and I have a different agreement on this. Um, I will say if we look at the previous executive order from the last administration, what did it do? It spent forty pages telling us that we need to implement passwordless and FIDO authentication.

And the one four years before that spent forty pages to tell us we need to do, MFA. And I'm not sure that the government shouting MFA and passwordless is any different than the industry which has been shouting that. I mean, RSA was created thirty-five years ago with MFA, or however long it is.

We've known about these things for a very long time, and we've never been able to get either private industry or the federal government to do it. And I'm not sure that another executive order saying the same thing over and over again is gonna make a difference. So this takes a different approach and says, basically, let's use the, the, the best and allow industry to develop the best technology and apply it as appropriate.

Okay. So Jack, let me, let me see. Y-you said a lot there.

Let me, let me try to respond to some of this. And I, and I wrote this up. First of all, to think that you could separate politics from policy when dealing with Washington DC is extremely naive.

Let, let's make no mistake about it. All policy in DC is involved in politics. That's just the way of the world.

We're old enough to know that. If you're old enough to watch the adult AI porn, you're old enough to know that how DC works. It's all about politics.

Secondly, I think what you're doing, and, and it's... And I get it, you're a fan of, of, of the administration, but you're substituting their brevity and laziness for, for, for brilliance. And this is an administration led by a man who basically has made a career of taking the shortcut, taking the, the, the, the short way home, doing...

cutting a corner doing this. Let-let's, let's go back to what the role of government is. And you know what?

I was a political science, government and politics major, actually is what my major in undergrad was, and I, I learned a little bit at, from the good priest over at St. John's University, which was not a liberal bastion by any means, by the way. This was...

St. John's is as conservative as they come. Um, why do we have government?

Why say, "Screw it, we don't need government. Let private industry do everything. They do it better, cheaper, more efficiently.

" Right? People have thought about this over the years. Guys with names like Rousseau and Locke and Hobbes and, you know, some of the great philosophers.

We need a government. We've decided as humans, y-you have a social contract 'cause we understand that there are certain things that need to be done that we can't do ourselves, that things like private industry where profit is a motive, where there's greed and avarice and everything else involved, they can't solve the problem, right? Private go- private industry wouldn't have gotten us to the moon in 1968.

It works now because of the, the foundational work that the government put in at NASA over all these years. Right? That's why we have a government.

Not to invent technology, to seed, to seed the technology. I'm, I'm surprised you mentioned CISA in your response because nothing in that cybersecurity plan mentioned CISAThey didn't mention CISA one time, and I'll tell you why. They've c******d, they've kneecapped CISA.

I've written about it over four times. They've kneecapped CISA. What we have in this cybersecurity plan is a direct correlation to the great healthcare that we...

You know the healthcare I'm talking about. It's gonna be huge, huge. Huge.

We're gonna have everything we need. Cheap drugs, great coverage. We have the concepts of a healthcare plan.

This, my friend, is the concepts of a cybersecurity plan. What am I supposed to do? Put it under my bed and wait for the cyber f***y to give me money in the morning to do it?

There's no plan here. " Yeah, they're gonna do... You, th- you think they're gonna be able to do it all?

They're not gonna do it just for their profit motive. You don't think you need a public-private partnership, which is what CISA is all about? Well, actually- What are they gonna do here?

That's, that's exactly- We're gonna go off... Jack, I'm not done yet. I'm not done yet.

We're gonna ... " What are we gonna do? Go kill a few more ayatollahs?

Burn some more tankers? Is that what offensive cybersecurity is here? There's no plan here.

Well, I- I'm sorry, Terry. Go ahead. I worry about the...

I was just gonna say, I, th- see about a, a lot of things. I worry about the definition of what offensive means too, in, in this context. Uh, you know, for s- for cyber, because we've talked for years about hack back and not doing all these things.

And so, suddenly are we gonna be ... So without parameters, that's scary. Um, I think public-private collaboration is critical to cybersecurity.

I've written about this for- Absolutely ... years and years and years. But this administration has decimated that and has sort of set it, you know, turned it on its ear with what it's doing with CISA, which is sup- is supposed to facilitate that, right?

Um, but I, I think, you know, I was reminded, Alan, as you were speaking of the disgraced congressman, Anthony Weiner, who would've probably been more interested in our last segment, but- Yes ... I will say. Yeah.

He said one time in the, the, like, sort of when they were, they were debating healthcare on the floor of the House, right? He said, you know, something along the lines of, "You know, healthcare companies, so private industry does what private industry does," right? They wanna make a profit.

They wanna, you know, further their own products and solutions. But government is there to make sure that the people are protected, and that it is for the people of this, country. And then, of course, he just got whisked away in his own scandal.

Well, he's- But I'm just saying that- He knows what AI to look up porn on ... that he was a... Yeah.

He was exactly right on that. But, but you're right, Terry. I, I agree with you.

It is, it is about a public. Even if, Jack, even taking your, your, your statement about private industry does the technology, they absolutely do. But you need that public aspect for enforcement and policy.

Even the part about deregulation. This is something... Look, you've been in security as long as I ha- Well, maybe not as long as I have.

You're younger. But we've heard in security forever, "Let's self-regulate so that this way we, we kind of sh- short circuit government regulation," right? This was the whole reason why the PCI card industry did the PCI, regulations, right?

Mm-hmm. We, we got out in front of it before the government regulated us. And it was, you know, depending who you talk to- So, so Alan, what has, what has been the result of the, the five years, the four years of CISA, the past four years of CISA?

Well, CISA's been around actually I think closer to seven or eight years. And I think, well, Jack, I'm glad you asked, 'cause, you know, Chris Krebs happens to be a friend of mine. And I've, I've had, we've had Chris at our RSA event.

I've had Chris here on Techstrong TV a number of times. They've done yeoman's work. They've done amazing work of bringing together the public and private sectors.

'Cause you know the story in security, when nothing happens, we did our job, right? How m- I mean, how many crisises averted? How many things that were done working together public and private?

And I, you know what? Look, I love the people at the RSA Conference. I've been involved with Linda and Britta Glade and, and the folks there for 25 years.

And I've been privy to discussions around ... I, I used to have a very good friend from the NSA, Tony Sager, who was always at RSA. I'd go out, grab a, a meal or a beer with Tony and hear about some of the things.

And I'm not here to talk about some of those things. But I will tell you that the public-private partnership of government working with private industry has been fantastic in cyber. Going back bef- not even just at RSA, when you used to go to the old DEF CON, back when it was really DEF CON- Mm ...

and Black Hat was Black Hat down at Caesars, not up at Mandalay Bay, right? The feds working with us was, was such an important part of- And- ... this cyber landscape.

And, and that is my point exactly. Mm-hmm. Which is this executive order, instead of saying, "Do this, do that, do the other thing," is saying, "Federal government, work with the private industry.

Continue that partnership to-" But with no teeth. With no teeth, Jack. To- With- But you have to define what that looks like ...

but the teeth haven't, the, Alan, the teeth- He had just put out the CliffsNotes on it. You know, you have to define- But, but- ... what that looks like But, but we'd, we haven't- I can say that ...

we have, we, we haven't done that for t- for, for the past 15 years we haven't done that. The, the, the past executive orders, what you're asking for is a 40-page document in a seven-page document, that's a whole lot of blather that says nothing other than within 60 days we'll implement, MFA. We still haven't done that.

Has anybody gone back and checked if the federal government, if every single institution of the federal government has done MFA? I guarantee you- Why, why haven't we? Do you know why we haven't?

That would ... Why? Why?

Why haven't we done that? No, tell me why. Why?

" Alan, we had four years to do that. That was an executive order issued the very first time at the very beginning of the Biden administration, and absolutely nothing has happened. If you don't think they're not doing- No, I think a lot of MFA has been- Well, we're not doing nothing.

Am I done? To say nothing has happened is not true, Jack. Okay.

It has happened. That's true. I, I, I take that back.

There's a lot of MFA out there. You're, you're right, I will take that back. My point is that sometimes the right approach is to say, "The policy directive is this," rather than say, "You must do this, you must do that," because things move very quickly.

S- so Jack, I'm a CEO- So you're, you're for prescriptive being prescriptive, right, Jack? I mean- I'm sorry, say that again. That's what, that's exactly what you're saying.

But Jack, as a CEO, I make ... I set broad policy and then I ask my ... I think I have good people working for me who implement it.

Yes. What we have here is a broad policy. You've kneecapped the people who are supposed to implement it, and, and that's it.

It's, it is the, as I said, it's the concepts of a plan. It's not a true plan. And quite frankly, had he, had they come out with this plan and then had a follow-up from whatever agency they want to take CISA's place, 'cause obviously CISA is not a place for them, that they put a lot of faith in.

Had they come up with a follow-up plan that says, "Okay, here's how we're gonna implement. This is what we mean by offensive. This is what we mean by public/private partnerships.

" But sometimes actions speak louder than words. You've got an administration here who put out this concept of a plan and said, "Wait a second. Take all your b***s and go home from RSA.

" Why? W- what about the public pr- "Well, they have Jen Easterly as the, as the CEO. " Is that, is that who you're putting your faith in to do this public/private stuff?

'Cause this don't, this don't sound like a plan to me. Anyway, Jack, I love you. I appreciate your thoughts, but I very much disagree.

I, I don't think this is the- I don't think, I don't think we figured it out that you disagreed, Alan. Oh, well, let me be really clear. No.

Hey, we're at 33 minutes though, and I gotta jump to our next one here. We've got a robot ... This isn't some AI porn story, is it?

It could be. I mean, I don't wanna go there, but, you know. Robot vacuum hack.

Okay, Terry, what do we got? Okay. So this intrepid, I guess he was a software engineer, had a, a robo vac- vacuum, right?

And he wanted to program his own remote to be able to make this thing do, you know, whatever he wanted, remotely and whatnot. He found in the course of doing this that he had access and could control, like, 7,000 of these things, so that are out in the marketplace. Yeah.

So I mean, it, you know, the best case scenario is he marshals them all and you have a super clean house by the time this guy gets through. Or worst case, you know, somebody with nefarious intent goes in and does something nefarious. So, you know, it was a ...

I mean, they, they ... The company fixed it pretty quickly, patched it up. It was, just like these things almost always were, the, the access and the privilege was just, too loose and, loosey-goosey.

And he was able to- Wasn't there a story like this about refrigerators, IoT refrigerators a couple years ago, being zombies? We actually did one about- It was a zombie? There was one about, a, actually a humanoid type robot out of China.

Um, can't remember the name. Unitary we had, was one we did, yes. Can you imagine if they were autonomous then?

God knows. Oh. Well, this has, this has been a problem forever.

In home automation and home systems- Yeah ... it's crazy how open these, these devices are. Oh, yeah.

I don't know why people don't think home systems should be secure. They should probably be the most secure, right? Because people are- 'Cause ...

No, no, but people think, "Well, what, what could happen? " I know. And I mean, you, you say, Terry, yeah, the worst case scenario is you wake up and you've sh- your, your, your, your house is, i- is sparkling clean 'cause someone's randomly vacuumed for you.

Look, that is, that is definitely not a risk in my house, let me tell you. But my biggest concern- No ... is breakouts, right?

The other thing is that the protocols are not safe. Half of this stuff is not on SSL. It's just straight up HTTP connections over web hooks.

They ... You can break out from a Roomba to a NAS to a network packet to a password file. And now all of a sudden I've got- Or, or just use it for DDoS.

Use it for DDoS, right? Or just use it for DDoS. Yeah.

Yeah. Exactly. And I think there's- Exactly ...

there's two other interesting, breakouts to think about. One is the breakout you're talking about, Andy man, which is when, these devices, and this is what we talked about with the Unitary thing as well, is when these devices move from the consumer side of the world into the enterprise, and the enterprise starts employing robotic vacuums because they're cheaper than janitorial staff. And then all of a sudden you have this device here.

The other problem- Ooh ... both for the enterprise and linking it back to our first story, is a lot of these devices have microphones in them and cameras in them. And they will be running around your bedroom while you're in flagrante delicto.

And then not only will another crime- I love it when you talk Latin And we, and we've seen that with I think Spotify, one of the, one of the- Or you're using the AI s**t thing. There you go. One of the home camera- Well, no, why don't you combine the vacuum with the AI s**t thing?

There's all kinds of possibilities. Have you seen a Roomba, Alan? It's the wrong form factor, my friend.

Hey, you know what? One man's- I don't wanna know ... one man's wrong form factor- I wanna get a- ...

is another man's treasure, Andy. But, but, but let me, let me, let, let's back up, though. What we're really talking about is really IoT devices in general.

Okay. IoT devices. Yes.

You know, I'm reminded, Mitchell Ashley and I, w- you know, we were two of the three co-founders of Still Secure. My friend Raj Bhargava was the third. And w- one of our biggest accounts, well, one of our biggest accounts was the, Department of Interior.

And Mitch and I used to go to DC every month, and we, one time were there at the US Geological Survey, which was one of the 16 bureau agencies in the DO, Department of Interior. And, we asked them if they had scanned any of their sensors, right? US Geological Survey, in case you don't know, they have sensors at the bottom of the ocean to, to seismic, you know, under- underwater, earthquake detection.

They have sensors at the top of the mountains, in volcanoes, I mean everywhere. And, you know, like tens of thousands of sensors. " Mm-hmm.

"Who would wanna do that? We're scientists. We're scientists here.

" "As a matter of fact, it's important that anyone be able to access this because it is important science. " It, it's that same attitude. We, we couldn't convince them that you had to lock these down.

You know, I have- Now I'm hoping they are now. Yeah, I, I have this bad flashback to about 10 years ago, covering CES when I was at USA Today, and I would, I would always go to these Samsung events. Remember the big IoT push?

Oh, it's all interconnected. Everything, your refrigerator, your television- Mm-hmm ... your garage door opener, and your vacuum.

When I saw this story, it just made me think about everything they talked about at, at at least two CESes, and security was almost never mentioned or the consequences. No. And it's just a bad flashback.

It, it even goes beyond security. Let me give you a real world story of what happened to me. So this, or last season, last football season, or the football season before, I think some Thursday night football games are only on Amazon Prime.

You can't get them on regular TV. You gotta get them on Amazon. Unless you're, unless you live in the markets.

Unle- right. Unless you're in the local- Local markets, yeah ... so I put on my Amazon Prime, and I get a message, "Very sorry, you have too many concurrent streams running.

" And I'm, I'm a foot- you know, I'm a football fan. I'm crazy. So I, the first thing I do is I call my sons and I yell at them.

"You better stop using my account. " Yeah, we're not even home. Okay.

I, I, I went through all the... Finally, I called Amazon Prime and said, "Hey, I'm not, I'm only watching it on one TV. " They made me disconnect all of my household appliances that were connected, like my refrigerator, and we had a washing machine, and because they said sometimes those get picked up.

And once I disconnect, I literally had to shut down the entire Wi-Fi in the house and then just plug the TV in, and then plug things in one at a time to see what was triggering the, the streams of, of, that Amazon was picking up as a Prime stream or that, which to me was... But, but this is the, this is the world we live in. Mm.

Right? It, it- What, what device did it turn out to be, Alan? Oh, that's a great chain.

What? I'm, I'm fascinated. It wasn't TVs.

It was, it was IoT devices in the house. It was the refrigerator and, um- Refrigerator ... there was something else that was smart.

Oh, it was the Alexas. I had to, I had to disconnect all the, I have, I don't know, a couple of Alexas in the house. That's, yeah.

The Alexas, too. So there's, there's, there's a very interesting website which unfortunately has become popular enough that they've put it behind a paywall 'cause they can make money at it. Shodan, S-H-O-D-A-N, which is a company that went out and scanned the internet for all open ports from IoT devices, and they were finding millions of things- Oh, sure ...

particularly one of the biggest ones were IP cameras, IP connected security cameras that people have. All these rings. And they have, they have no security in them whatsoever.

They're open to the world and, and I think, Andy, I can't remember if it's you or Terry, somebody mentioned it, that they're being used for DDoS attacks, right? Yeah. You mentioned Chris Krebs.

I think it was Chris Krebs that was, had re- recorded one of the largest, DDoS attack sets against him that was something like, multiple terabytes a second of data, and it was all j- being generated by taking o- you know, bad guys who had taken over IP cameras. Zombied IoT devices. Zombied IoT devices.

Yeah. Just amazing how much bandwidth you can generate by taking over this stupid little device. I mean, you think about it, we, we moved from IP4 to IP6 so we could get all these devices on there, and this is what you got.

Oh, I know. Andy, what were you gonna say? I'm sorry.

Yeah, no, I was just gonna put my CTO hat on here, and you're, Jack, I have to, when I do work for external people, I have to sign their terms of service, their terms of use, their acceptable use-A guideline. Sure. Running my own business, I had to work with large enterprises.

I had to show them what my acceptable use policies were. I work from home full time. So now we have this opportunity to DDoS me at home at my work.

Now we have this opportunity- Right ... to have a remote controlled camera filming me in my workplace, filming me logging on with my passwords. So you talk about when enterprises adopt this.

It occurs to me enterprises have already adopted this because enterprises have adopted work from home. And I ... Look, I was literally just setting up my home assistant to turn on my webcam lights whenever my webcam goes on, right?

Little integrations like that from my work laptop. I'm gonna have to have a chat with my CISO about this. Yes, you are.

Absolutely. Um, I, I ... One thing, Alan, real quickly, just on that note, is we did an article, and I think I discussed this on Techstrong Gang a couple y- maybe six months, a year ago, about, buses and cars that- I remember ...

are internet connected. Remember that? The ...

So, I think it was Norway actually took one of their connected buses that was ma- well, yeah, an electric bus manufactured by China, some Chinese company. They, the only place they could figure out what to do this is they actually put it in a cave so there was no other internet connections. And they turned this thing on and tried to figure out exactly what it was doing and who it was talking to and what it was reaching out to.

And they're like, "There's so much data going out of this bus that we can't ... " We actually, they actually- Yeah ... if I remember correctly, they decommissioned the buses.

Um- Yeah ... and Israel did the same thing. They found that some of the cars they were doing, they couldn't allow on the military bases because there was too much data being sent out.

Well, they, they probably donated them to Hezbollah And then, and, and they're tracking them now. But that's a whole nother story. Yeah, another story.

Yes. But, you're, you're right. Look, you know, Armis, which is a pretty big ...

Actually, Armis, I, I forgot who just bought them for a lot of money. Billions. Uh, anyway, but they, they w- they did a groundbreaking work in IoT security that really did help lock some of these things down.

But a- as we've said here, we, we don't think of these household devices as necessarily part of that, right? And, it, it's a problem. It, it continues to be a problem.

I'll tell you another problem is we're over time. We were supposed to stop a minute or so ago. I apologize.

Um, Ja- John, Jack, Andy, Terry, thank you for being on. Hey, we've got Techstrong TV, I guess, or coming up after this, though, it's playing if you wanna go to any of our sites now. It plays through the day.

Uh, we'll be back tomorrow with another Techstrong Gang. I also have a Shimmy Says tomorrow, which is gonna be a, I think, a pretty cool one. Stay tuned for that.

And, next week, I'm not quite sure. We, we've gotta figure the gang out for next week. A lot of us are gonna be in San Francisco for the RSA Conference.

Others of us will be in Amsterdam. I know Mike is gonna be over in Amsterdam at the KubeCon- Oh, how fun ... conference.

And, we'll be, we'll be streaming live all day from RSA. Jack, are you heading out to San Francisco this year? I will see you in San Francisco, absolutely.

All right. Stop by, right, stop by Broadcast Alley. Maybe we could do a live Gang or something.

I would love to do that. Absolutely. John, you gonna be there too, no?

Yeah, I will be there whenever you need me. Um, I'll be- All right. So there, we got the make...

Terry, how about you? I'm gonna be there. All right.

Sounds like- Oh, wow ... we got a date. All right.

So we will have the Gang next week. Stay tuned for that. Yeah, yeah, the usual or whenever.

Absolutely. 9:00, early, before things get started. Um- But until then, this is Alan Shimel.

Thanks so much for watching. I hope you've enjoyed our Gang, and we'll see you tomorrow.