NB581: Brute Force Password Attack Bleeds Fortinet; US Sued Over AI Model Order

Speaker A: Take a network break. I'm Jonna Johnson.

Speaker B: I'm, um, Scott Roban.

Speaker A: Um, time to sip an energizing libation. Or maybe two. As we sweep through this week's tech news, there's a lot going on with the US Federal government, including the Federal Energy Regulatory Commission, news about Fortinet, Palo Alto, Verizon, Google, and more. Plus, we've got an update on Al Pacino. But first, a quick thank you to our sponsor.

Speaker C: We are sponsored today by Meter. Meter is the company building networks from the ground up. Uh, Meter delivers a complete networking stack, wired, wireless, and cellular in one. With Meter, you get fast, secure and scalable connectivity without the burden of managing multiple providers or tools. Meter Scale is from branch offices, warehouses, and large campuses to data centers. And its integrated network stack is designed to give you deep control and visibility. Meteor covers everything from first site survey to ongoing support, giving you a single partner for all your connectivity needs. Thanks to Meter for sponsoring. Go to meter.comnetworkbreak where you can book a demo. Now that's meter.comnetworkbreak to book a demo.

Speaker A: Okay, before we get officially started, I'd like to address a few quick follow ups. First, uh, last week, Scott, you were right. The advertisement featuring the tagline can you hear me now? Was in fact Verizon. Stay tuned because Verizon's still in the news, but points, uh, to you for that.

Speaker B: It is confusing because the guy did jump, uh, to Sprint for a time after his Verizon gig. So, you know, there's. The streams are interesting. Yep.

Speaker A: Yes. And also, the person we were thinking of who got nailed for tax evasion but was actually a major mobster was Al Capone. Not. Not Al Pacino. Al Capone was indeed caught for tax evasion, uh, rather than his mobster activities. As far as we know, Al Pacino has never been on the wrong side of the law for anything. So, uh, apologies to Mr. Pacino for using his name in vain. If you're listening, Mr. Pacino, sorry about that.

Speaker B: And for multiple Sharp listeners who, uh, who phoned that in, including, uh, Mrs. Roban. Thank you, Stephanie, for texting me that yesterday.

Speaker A: Yes, yes. Okay, moving along, we're going to kick off with the red alert. The red alert this week goes to IB in CVE2026 10561 with a CBSS of a full 10 out of 10. IBM says its LangFlow operating systems 1.00 through 1.9.3 have a vulnerability due to an improper isolation of Python execution, combined with an authentication bypass that allows Drumroll please and unauthenticated attacker to execute arbitrary code on the system host system resulting in complete compromise. Oops. Complete um, compromise of anything is not words you really want to hear. Uh, just to let folks know ah, Langflow is an open source low code tool for building AI agents and other AI applications through a drag and drop visual interface. The goal is to allow users to orchestrate LLMs, APIs, vector databases and custom components and build them into a genic workflows without actually having advanced programming skills. So yeah, you don't want complete system compromise for folks using that system. Uh, no deep dark surprise the fixes to upgrade to uh 1.9.4 or later. So if you're using Langflow please check or your users are using langflow please check um the version and upgrade to 1.9.4. Speaking moving right along to security news. Uh, two weeks ago a massive security breach exposed major corporations. Uh, we have a link in the show notes to the article in Ars Technica. Uh, but research uncovered a massive breach of Fortinet firewalls that has given Russian speaking attackers near unrestricted access to some of the world's largest and most powerful organizations, including Oracle, Chevron, Lenovo, FedEx, a NATO defense contractor and Fortinet itself. Nearly 74,000 Fortinet devices from more than 21,000 IP addresses in 194 countries have been compromised and their plaintext credentials exposed online. Uh, lots of really interesting discussion. We urge you to read the article net for enterprise organizations. All the security experts quoted in the article strongly recommend Fortinet users investigate networks immediately for signs of compromise. There is in fact a helpful search engine on one of the security company sites which can tell you if you're affected. That link is in the show notes. Scott, thoughts about this sort of major compromise of Fortinet and its customers.

Speaker B: So you know, never ending vigilance comes uh, to mind here. You know, for anybody who's been in uh, this business for decades, like both of us have, you know, we've seen this movie before and we really have to work hard to not be numb about it. And you can't, you can't give up. You know, never give up, never surrender. Um, it takes real effort. Um, when another big hit comes like out like this and you know we're going to need to keep responding.

Speaker A: So yep, I think that's basically the message. And uh, be aware that all of your security vendors are going to be major targets and over time many of them have gotten hit. We have another news item about almost exactly that. But before we get there, Scott, I think you have some. An item about, uh, Legion and Legion and Mythos.

Speaker B: That's right. So next up here, this is a little bit of a follow up to some of our discussion last week on, you know, what's happening with the models, uh, being available and unavailable, like this Mythos example. And there's an A.I. um, uh, company in Canada called Legion that's suing to keep Mythos available.

Speaker A: So I think it's actually got Canadian developers. I'm not sure where it's headquartered.

Speaker B: Very good.

Speaker A: I think it's us.

Speaker B: So Legion, the company, um, is suing the administration over the export order that forced anthropic to disable Fable 5 and Mythos 5 worldwide, claiming the munition category does not apply. Um, Legion Legal Tech Corp filed its complaint on 23 June in federal court in Washington, D.C. just to stumble stone's throw from, uh, from, uh, Jonna and myself, asking a judge to vacate the order and signaling that it will seek an injunction to stop the administration from enforcing it. So, in an open letter that is publicly available, um, we'll have that link in the show notes the CEO of Legal Tech, Arthur E. Rothrock. And who wouldn't be intimidated by Arthur E. Rothrock, esquire, Writes the following. No company should have its lawful work switched off by a phone call. So this lawsuit takes issue with both the direction of the decision itself and the process by which it was made. Uh, Rothrock goes on to say, quote, over a single evening, a handful of Anthropic's competitors got senior administration officials on the phone warning that the model could be talked into reviewing software for security flaws, something nearly every AI model on the market will do, and something the model was built to do for defenders. There was no study, no outside experts, no chance for anyone to respond. By the next night, the by. By the next night, the letter had gone out. So what do you. How do you want to unpack this, John? Lots of. Lots of stuff floating around this right now.

Speaker A: Well, I think, uh, randomly discriminating against a single vendor is petty, wrong, and illegal. Um, but the administration has been doing it since I think at least May, when it announced a major, you know, the Pentagon announced signing deals with basically everybody except Anthropic. Like, you know, big middle finger to you, Anthropic. So. But this is above and beyond. What I find interesting here is that you've got a law firm. Ah, it's essentially a law firm. The legal tech uses AI to help lawyers, and its stated mission Is we want to make the little lawyers just as powerful as the big lawyers at the big firms. Which I think it will do using uh, AI. Um, but here you have a legal firm saying the problem with the decision is not so much the decision, which is still wrong, but the process by which it was made. You literally cannot just decide because you had drinks with you, uh, know, a bunch of companies that, oh, we're going to knock their competitor out of the market. That's the government putting its thumb on the scales in a way that's really, should not be permissible. And I think it's interesting that he's going after the process, the process, not the actual decision, which I, uh, mean he disagrees with clearly, obviously.

Speaker B: But you know, in a lot of ways this is how the system is designed. Right. When a, uh, government or administration oversteps their bounds, you know, they can get away with it until somebody pushes back and actually sues. So it's good to see someone coming up and saying, hey, no, we don't think this is in line with the law. It's messy and it's slow. But um, it's the way the system's designed. So you know, while we want resolution more quickly than we'll probably get, at least the ball's rolling here and we'll see how this plays out.

Speaker A: Yeah, and I would suggest that, you know, the old rule is, uh, you know, never, never argue with someone who prints, you know, ink by the barrel. Never, never take on a firm full of AI assisted lawyers. That just seems like a terrible idea in a lawsuit, uh, even for the federal government. So we'll see.

Speaker B: Yeah, the link, the link to that open letters in the show notes, take, take a look at it. It's really interesting.

Speaker A: Okay, moving along, uh, Palo Alto has now announced that it's joined forces with IBM and Red Hat to automate patching. We have previously talked about Project Lightwall, the five, uh, billion dollars investment IBM made with Red Hat to improve open source security. Now Palo Alto, which has already partnered with IBM, has joined the party, uh, with a stated emphasis on improving enterprise patch management cycles. So listen up folks, if you are Palo Alto or Red Hat or IBM customers or me, using open source General, Palo Alto is integrating into the effort its virtual patch capability. And let me stop there because some of you may be thinking what the is a virtual patch? It doesn't actually patch, but it looks like it does. Um, hold tight. Because it is a multi stage approach to patching, what happens is the process will deploy that virtual patch at the network layer to block exploit attempts. So it's exactly what I often refer to as taking your bell jar and putting it over the roach. Can't do any further damage. Now you can get out the raid, you know, uh, that buys the time for software remediation, for open source software via lightwall. So that is a rapid response. That virtual patch is a rapid response, doesn't fix the affected software but stops it from executing the exploits. Um, the Palo Alto CEO Nikesh, uh, Arora says that this entire development is in response to AI compressing the window between vulnerability, discovery and exploit. Quote from weeks to minutes, I would say probably and from minutes to seconds. So it's basically this is Palo Alto Aalto's answer to Mythos. Uh, and as he says, traditional patching cannot keep pace. By collaborating with IBM and Red Hat, we are shifting the advantage back to defenders. I wouldn't go quite that far, but uh, I do think it's at least leveling the playing field. What do you think Scott?

Speaker B: Um, great headline to uh, catch the attention of people doing podcasts to talk about security issues. Right. Um, look, you know, patch management, hot fixes in service, software upgrades. Um, this has been with us for a very long time. It's great to hear about this. On paper, if I'm in the operator seat, like with anything automated, I'm going to like, okay, let's bring it in the lab, let's throw some real scenarios at it and let's make sure it doesn't catch any false positives or at least an acceptable minimum of false positives. So you know, you got to kick the tires around and make sure it's ready for production. But it's great to see this solution come forward.

Speaker A: Yeah. And I would push back just slightly on the we've been here, seen everything before world weariness here. Because what we haven't had before is Mythos. Um, and basically the ability to locate vulnerabilities in 30 year old code is rapidly and exploited instantaneously and chain Together low level CVEs to exploit, to generate a critical exploit and to do all that very, very quickly. That's new. And so I do think it's important that we're fighting back. I, I again I would agree with you that we're not really shifting the advantage back to defenders yet. And we certainly have anyone using this certainly should kick the tires. But it's a needed solution at this time I would argue, you know, I'm

Speaker B: just going to use this to call out, I think you just revealed, um, an inherent bias that I have on networking versus security. Right. Um, in networking it's always, I don't know, I want to make sure I trust it before I push it into production. In security in particular, even pre mythos, um, I can't fight the robots with humans, I have to fight the robots with robots and this need for rapid response, like so. Duly noted, Jona. Thank you. I will take that Moving forward.

Speaker A: Uh, the conundrum here is that um, that networking folks have been among the first to deploy automation and AI. In fact, our last episode we talked about that core of the network, the 5G and 6G, being automated using AI. So I think, uh, network folks are exercising an appropriate degree of cynicism and skepticism, but certainly are not stick in the muds when it comes to automation or AI use.

Speaker B: Well set, well said.

Speaker A: Let's stop for a moment and thank our sponsor. This episode is sponsored by Meter, the company building networks from the ground up. Meter delivers full stack networking infrastructure, wired, wireless and cellular to leading enterprises. Businesses are frustrated with an, uh, unpredictable pricing, it, resource constraints, complex cost prohibitive deployments and fragmented tools. This makes it difficult to achieve performance, reliability and security metrics that modern IT and operations demand. Alongside its partners, Meter designs, deploys and manages required for performant, reliable, secure and scalable connectivity. They design the hardware, write the firmware, build the software, manage deployments and run support. It's a single integrated solution that scales from branch offices, warehouses and large campuses to data centers. This includes everything. And I love this part, particularly isp, procurement, security, routing, switching, wireless firewall, cellular power, DNS security, vpn, sd, WAN and multisite workflows. Thanks again to Meter for sponsoring. Go to meter.comnetworkbreak to book a demo. Now that's M M e t e r.com NetworkBreak All Ah, one word. To book a demo. Okay, this one caught my eye. Partly because my county is engaged in a fierce dispute with data center, uh, operators who want to come in and kind of crush our energy grid. Um, because we're a very small county and our energy grid is actually operated by a cooperative, not, not a company. Uh, which is great for lots of reasons. But in any event, uh, on June 18th, the US Federal Energy Regulatory Commission, FERC released a set of directives ordering energy grid operators to create a square circle. Uh, in other words, they need to pick up the pace of connecting to data centers, but somehow not charge consumers extra for the massive increase in energy consumption by those data centers. And in particular what they're effectively saying is, uh, grid Operators should go back to data center operators and very, very quickly negotiate or renegotiate how they handle pricing. Good luck with that. Uh, by the way, the FERC orders also have teeth. They impose two deadlines, a 30 day and a 60 day deadline. So by July 18th, they need to. The grid operators need to report how they ensure adequate power generation for existing and anticipated demand. Then by August 18th, they need to either explain how they can meet large load connection requests within their existing rules and prices, or change their existing rules and prices and show how they're going to meet them that way. Again, that involves making those agreements with data center owners to pass the cost of handling larger loads over to those data center operators. Please figure it out by August. Move. Right. Um, the ferc, interestingly, also recommended the grid operators invest in technologies that maximize the current and optimize power routes and transmission lines. And this is kind of my favorite. The FERC addresses this whole speculative data center issue, where grid operators start building out enhancements to their. To their grids in anticipation of data centers that never actually get built. So the FERC's recommendation is grid operators do their enhancements in stages based on the seriousness of the data center operator, so do very little if there's just paper on a desk. But once there's, uh, according to Costas Samras, who's an engineering and policy research at Carnegie Mellon, once there's steel in the ground, move forward. You can move forward with investment. I love that phrase, steel in the ground. Anyway, um, it'll be interesting to see how this plays out. All the data center operators and the unions of concerned data center operators for AI workloads or whatever, those organizations seem to be cheering this decision. So we'll see. Scott, thoughts?

Speaker B: Yeah, I, um. I know this whole issue is messy. It's probably one of the most inconsistent things across different regions, um, and municipalities all over the country. For example, I'm 100 miles from Ashburn. Um, oh, boy. But I have seen no appreciable impact to my residential electricity costs. I'm afraid to say that out loud. Right. Because now I've cursed myself.

Speaker A: But Ashburn, I think that's kind of the key. Ashburn already was a major, major data center carrier, interconnect loc. So presumably you haven't seen any increase because they built it out a long time before you moved there.

Speaker B: It's certainly, certainly a foundational factor. I know there's other things happening in Virginia from, I think, down close to Hampton Roads, again up across Fairfax county towards Ashburn. Um, this is not the last time we're going to talk about this on the show, I'm sure, so.

Speaker A: Exactly, exactly. I think these data centers and uh, AI centric data centers are going to continue to be in the news. Speaking of in the news, there's some news about Verizon and Google.

Speaker B: So, um, regardless of our representation of Verizon marketing campaigns on previous episodes, um, this week, um, we're seeing the end of an era with Verizon being replaced by Google's, um, parent company Alphabet and the Dow Jones, um, I believe On Monday, uh, June 29th, um, the Google parent will join the Dow Jones and replace Verizon, leaving that slot after 22 years. Alphabet's class A shares are set to replace Verizon in the 30 stock Dow Jones Industrial Average effective Monday before the start of trading. Alphabet was now going to join ranks with other tech companies currently in the Dow, including Apple, Microsoft, Amazon, Nvidia, enhancing the index's exposure to tech, cloud infrastructure, AI and other digital transformation. So bye bye comms, hello chips, software and AI. You know, um, it's an interesting move. What do you think, Jonna?

Speaker A: Well, uh, when I saw that I sort of thought, oh, pendulum swings. You earlier made the remark about networking people versus software people and something uh, sprang to mind. Like when you walk into any group of engineers, you can tell immediately which side of the divide they're on. Because then if on the whiteboard there's a big network and like lots of little boxes or circles that are servers or clouds, those guys are networking the other way around. If you've got all the boxes and circles and the network is just like a simple line, those guys are the software people. Um, and the thing is the pendulum swings from the predominance of 1 to the predominance of other over decades. What tends to happen, as I've seen, is that, um, as the software evolves it becomes more network hungry and then the network technologies have to evolve. I will note, of course we're seeing an awful lot go on in space and other interesting and you know, quantum networking and things like that that will ultimately hold the seeds of the pendulum. Swinging back to interesting, you know, networking, networking companies being super interesting again, or comms companies I should say for sure.

Speaker B: And just, you know, in the interest of, um, providing uh, a broader perspective here, some of the other stuff I've read and heard over the last week. This isn't an uh, indictment on Verizon's performance or anything like that. It's really making the DAO more reflective of what's, uh, happening from a dynamism perspective in the market. So, like, no one should read this and say, oh, flee Verizon. Um, it's just, you know, it's not occupying the place in the market that it used to. And that's the way to think about it.

Speaker A: Exactly. Exactly. Well, that's our wrap up for now. Um, Scott, where can folks get more from you?

Speaker B: You can find me on LinkedIn. Please send, um, me a DM and listen, uh, to our sibling podcast, Total Network Operations, here on Packet Pushers.

Speaker A: Sounds good. And I'm Jonna Johnson. You can find me on substack@nemourtis.substack.com, click the button, contact us. Love to hear from you and thanks again to the listeners, uh, who have been sending in. Uh, good, good follow up. Please do hit us up on, uh, @packetpushers.net fu or packetpushers.net followup. We love to hear from you, we love your thoughts. So please do write in. And you don't, you can do so anonymously. Some of the best posts come from folks who purchase prefer to be anonymous. And also thank you again to our sponsors.