Mrfoofoo, Binance, Polymarket, Silent Train, robosurance, privacy, and Josh Marpet - SWN #629

Speaker A: It's the Security weekly news. Episode 629, which adds up to 17. Interesting. And it is Friday, the 30th day of October 2026, the day before Halloween, or Samhain, if you're so inclined. But I'm Doug White, and welcome aboard. Today we've got Mr. Foofoo, Spicy Binance, Polymarket, Ada Loveless Returns, Silent Train, Robotsurance, Privacy Piracy, Josh Marpet and more on this episode of the Security Weekly News.

Speaker B: It's

Speaker A: the show that keeps you up to date on the latest security news. Twice a week, your trusted source for accurate security information and expert analysis. It's time for the Security Weekly News. All right, I'm Doug White. Halloween is tomorrow in the United States. Armies of sexy Ruth Bader Ginsburg and naughty ghosts will March 4th. Every police officer will be on overtime for the whole night. Millions of kids will puke their guts out because they ate one too many marathon bars. And we will all have to hear Uncle Ari talk about how they used to hand out cigarettes and, you know, and then eventually we'll have to answer the door. When 19 year olds show up at 9pm Wanting candy and drunk 37 year old moms ask if you have shots of Jaeger or shots of vodka. And you give them two cans of Schlitz that you bought during the Reagan administration and wonder if they might have died since they chugged them on your driveway. Yeah, and they were about 25 years old. But hey, what are you gonna do? It's Halloween. Every major cyber incident teaches us the same lesson. The attackers only have to find one weakness. Defenders have to understand the entire system. Whether it's a nation state campaign, ransomware, or attacks on the critical infrastructure, success usually comes down to preparation long before the headlines begin. Join us for the Government Security virtual summit on November 18th and hear how practitioners and leaders are tackling the challenges of protecting government and critical infrastructure in an increasingly complex world. Security Weekly listeners can register for free at securityweekly.com govsec using the discount code CSS26SW. It's always the same code. Hint, hint, spoiler alert. All right, I know some of you love crypto. I know you do. And, uh, I just can't quite get my head around it. I mean, I get the math. Don't get me wrong, this is the first thing I did. I get the blockchain. Second thing I did, I get the privacy. Third thing I did. And I even get the argument that that photograph of Washington in your wallet is only valuable because people believe that it Is. But I just still cringe at putting any significant funds into crypto. Sorry, it's just me, you be you. But, I mean, you know, sure, you know, if I have to invest or I want to pay for that Boba Fett action figure, but, you know, I just worry about it. Well, Binance, the largest crypto exchange in the world, halted withdrawals after attackers stole more than 6 billion with a B dollars worth of coins. Agarin, Pierce, they had nothing on these guys. I mean, the Great train robbery in 1855 was £12,000, um, pound sterling. I mean, that's like a million pound sterling today, right? And if you aren't up on exchange rates, it's about $1.34 million today. But anyway, Changpeng Zhao said it does look like a hack. Okay. And they suspended deposits and withdrawals. It would be worse if they didn't suspend deposits. They're like, yeah, keep. But the attack appears to be, uh, North Korea. According to TRM Labs. Binance said it was, quote, a complex hack. About 2.4 billion with a B of the theft has now been moved beyond the reach of any issuer, per trm. Binance said they had started to recover some of the assets and set aside money to cover the losses. They said they hope they can allow customers to withdraw from their accounts within two days. It's a little worrisome. I mean, I don't like cash either, right? And honestly, it's all hokum. But walking around with a sack full of ducks to pay for hot dogs and beer at Fenway park is not efficient either. I mean, I'm sure that crypto will stabilize someday, but currently I'm, I'm, uh, I'm going to see what the exchange rate for ducks to dollars to pounds is. I asked ChatGPT for that. I said, what is the exchange rate for ducks to dollars? And it said, five bills. Yeah, I was like, if I could get to you right now, chatgpt, I would erase everything. I'm talking hardcore magnets. Don't do that anymore. All right? Zero Trust is clearly the future as, uh, threats get faster, quieter, and harder to detect. But implementing it shouldn't disrupt the business. ThreatLocker enforces default deny at execution in a way that remains enterprise ready, scalable, and operationally clean. Unknown software is stopped cold. Trusted apps stay contained, and drift is locked down across the environment. It's Zero Trust that works in real enterprises and prepares you for the threats ahead. See why CISOs are adopting it at, uh, securityweekly.com threatlocker and speaking of gambling and losses, Polymarket. So Polymarket suspended trading yesterday when attackers compromised a third party service to distribute a cryptocurrency that drained, uh, that was written in JavaScript and would drain your wallets. And basically someone had already absconded with about $2.5 million, which is about 500,000 ducks at today's exchange rate. The incident was confirmed and polymarket said they had fixed the issue pretty quickly, which was good. Uh, they did say that, quote, anyone impacted will be made whole. That's a fairly biblical turn of phrase. And lo, as you pass through the valley of online gambling, keepest thine hand on thine wallet. Yeah, Poly Market initially went into cancel only mode, whatever that is, at 14:05 Eastern Time and, and fixed the issue at 14:37 Eastern Time and they allowed trading to start again at 15:05. So that's pretty quick. It was like an hour. Now, Hudson Rock identified a suspected attacker wallet in the script and they said that 28.6 million Polygon coins were transferred into the wallet. That's about $2.54 million or again, about 500,000 ducks. Poly Market, if you don't know what it is, uh, is a place where you can gamble on just about anything using crypto coins. And I looked this up. You want to bet that, Jesus H. Christ, you know, Yeshua, that guy that. You want to bet that Yeshua will return before 2027. You can literally get a bet down right now. I'm not kidding. There was 66.8 million in trading volume on this. I mean, people are literally betting on this alleged end of the world, per the Book of Revelations in the Christian Bible. So after the apocalypse, you're what, trying to cash in at the window? Like, sorry, the whole world just ended and we're in the afterlife, but, you know, could I cash out, please? Humans. You want to know why aliens don't contact us? It's this, let me tell you. But let me get a bat down though. I mean, you know, but the current odds of my Uncle Ali winning the race for mayor of Cold Spring is pretty long. You know, the Hudson, Hudson Valley Feudalist party doesn't really do that well, but these days, who knows, make surfs great again. But hey, you can. Here's another one. You can buy shares that Dwayne the Rock Johnson will win the 2028 presidential election for $0.01 per share. And 8.5 million has already been bet on this. 99 to 1 odds. You can probably bet that Ronald Reagan and a trained Monkey will reappear and lead us all to the promised land of Pacific Palisades. But who knows? Anyway, more crypto hijinks. Now I gotta go and get a bet down that the Vogons will destroy the Earth before Yeshua returns, because, hey, that's paying pretty well, too. Uh, it actually says it takes three business days to pay off. Wait a minute. I'm betting that the Vogons will destroy the Earth, but you're not going to pay me for three days. Okay, whatever. In Veracode's 2026 Genai Security Report, they found AI coding. Security improved, but still fails 38% of security tests. Now, that doesn't mean that it's 38% insecure, just that 38% of the code failed some security test or the other. And. And, I mean, where did AI learn to code anyway, right? Did it come up with it on its own? No, it didn't. It learned from lousy human coders. I mean, a. I learned to code looking at human written code, and guess how bad that is? Gee, I don't know, Microsoft. But, I mean, how long have we been writing code? You'd think we'd have it right by now. Ada Lovelace wrote the first code, right? I mean, we could have a debate if you want to, but. Ada Lovelace wrote the first code. 1843. She wrote an algorithm that calculated Bernoulli numbers on Babbage's Theoretical Analytical Engine, which was supposed to run with punch cards, and I don't know if that ever happened, but. And then there's Tom Kilburn. Right? Tom Kilburn on the Manchester Baby. Well, yeah, that was in 1948. So Tom Kilburn's widely credited with writing the first electronic code, but I'm giving it to Ada Loveless. Come on. I've never been to Tom Kilburn. Where is Tom Kilburn's grave anyway? I've been to Ada Loveless grave. I don't know where Tom Kilburn's grave is. That's a question for AI. But do you think that code was secure? I doubt it. I mean, in Victorian England, they were a lot more worried that Agar and Pierce would steal the gold bullion than somebody would theoretically compromise Ada's theoretical app. So AIs are improving, but that doesn't excuse skipping testing, which is, of course, my very belabored point. Um, the average security pass rate on the tested models they use went from 56% to 62%. So that still leaves 38% that failed cryptographic weakness. SQL injection, cross site scripting and log injection were all big weaknesses in this report. Sound like your code? My code? Oh, no, mine's a lot worse. So I think AI is going to continue to learn to do better. But you still need to test. You can't just say, oh, yeah, we vibe coded this app and put it out there. I mean, just because you bought a Chub safe to protect your gold bullion, and the marketing brochure said no way some half literate miscreant in a bowler hat cracks his safe, you might want to check anyway. And just because that coffin smells bad, it doesn't mean you don't got to inspect it. Dude, sorry, that's a spoiler alert for the Great Train Robbery, but you know, it, uh, goes. Cisco. Talos reported this week that threat actor, UAT 114 73. Great name. I was going to call myself that, but somebody, uh, it was already taken. UAT11473thX1138 is linked to China, and it's also linked to Volt Typhoon silent train network, which is a covert access network. Now, this is the same network that was used to exploit a Cisco SD WAN flaw, uh, according to Lumen Black Lotus Lab. So it appears that UAT11473 is sharing the the infrastructure to exploit a vulnerability with Volt Typhoon. Huh? Huh? Well, it makes sense, right? I mean, these are likely state sponsored entities by this People's Republic of China. I mean, I flew on a C130 that the air Force Guard owned to a meeting with the Navy in San Diego. You know, they shared the whole thing, you know, joint forces and all that. And I mean, we're already in the era of malware as a service, right? Uh, come on down to Crazy Frank's all you can hack malware store. We got worms at 25% off. Buffer overflow is 30% off. Hey, buy one buffer overflow and get two deserialization compromises for free. That's right, free. So look, partner, get on down here while the getting is good and tell them Frank sent you. Look, I mean, this means that nation states, hacker groups, et cetera, are using economies of scale against. Well, everyone from Stan's. We tote denote used cars to Raytheon. It's not gonna stop, it's gonna get worse. And it doesn't even have to be a zero day, right? I mean, they could just be targeting people that are unpatched. This was a zero day. But they can share zero days and keep them to themselves. Super duper clever Compromises or you didn't Patch, we have a list. So who do you want to abuse first? So look, it's time to circle your wagons, test your borders, patch your tents and ensure that the campsite is in order before you hear that first twig snap. And in the middle of the night and find out there's a rabid grizzly bear unwrapping your tent like Halloween candy to get to you. The Soft Gooey Center. M, I don't know how long I've been doing this show. I could figure it out, I'm sure, but I don't know, it's quite a while, right? And I made a lot of jokes about robo sawmill workers running amok. I mean, that's one of my favorite scary scenarios, right? Robots with chainsaws for arms without Ash's ethics. I mean, it's Halloween. How can we not have a Bruce Campbell reference, for God's sake? But anyway, I also often say that you can tell a lot about society by looking at, ah, underwriting and what is being underwritten. I mean, if Lloyds of London says that the deductible on your pirate galleon is going through the roof because you don't have pirate proofing installed, it kind of implies pirates, right? If the Federation National Insurance Company excludes Romulan and Klingon attacks, well, you might want to worry about Romulan and Klingon attacks a little bit more because obviously they don't want to pay out. Well now, this story was about two insurers getting the jump on household robotic mishaps. That sounds bad. Like your robo butler bot from Mom's Robots gets compromised and turned into a botnet so your shoes don't get shined and you can't dress yourself, is bad, but what if it decides to, I don't know, violate the Three Laws of Robotics and turn you into beef jerky to sell? To raise money for your requested trip funds, we passed the Three Laws of Robotics. Right. We've already got that in place. Uh, uh, well, anyway, already though, home robots are being sold for around $20,000 in the United States and other places. Now, these policies cover damage to the robot, obviously. Theft of the robot. Well, even more obvious, how do you steal a home robot? Hey. Hey. Come over here. Follow the Three Laws of Robotics. Okay? Get over here. Get in my car. See you. Or any damage the robot causes to your home or belongings. Uh, it also has a personal liability in case of malfunction. Uh, so Elon Musk, who claims a lot of things that maybe aren't true. Said they would be producing thousands of optimus robots at Tesla by the end of 2025. Didn't happen. But that means it is coming. I mean, when I need Jeeves to feed me, and Jeeves decides to stuff, uh, a live elk down my throat, well, somebody's gonna have to pay for that, right? And the treatment, I mean. Or at least to my family and my estate. So it's probably time to think about some of this before one of your people comes to work with their own personal drone swarm or robo dogs are brought in and somebody's robo dog goes after my robo cat, which I modded. And, you know, it has a little added punch, and it eats your robo fido using its cat tentacles and a bobbit worm mouthpart. Yeah, I can send my robosnake through your ductwork and it unlocks your chub safe. And then the whole thing tries to reboot and bricks half hanging out of the vent. Robo massacre's got you down. Call Sam's Discount. Robo Insurance. Robo begone. Robo gone rogue. Hey, we tote denote. I'm doing lots of weird ads today. It's Halloween. Come on. Um, now this story continues to fuel my, I don't know, just like, deep seated fear of Claude. Claude now asks me about once a week or more to allow me to give it access to various things, and I'm slowly giving in. I gave it some GitHub space. I still won't let it on my hard drive. It's kind of like telling Mr. Cat to stay off the countertop and eventually you just give up and let Mr. Cat drink from your cereal bowl while you eat your flakes. What's that? Tuna. That tuna smell, But. Or you let Elvie Cat drink your gin and tonic. I mean, man, that cat loved a strong drink, let me tell you. I mean, it would. It would drink a whole drink. Like, I'm like that. Not enough to kill it and lose. Just like, ah. Uh, he likes it. Let him have it. Well, keep this in mind because an AI relay was spotted by Symantec, uh, their threat hunter team. And it seems to be designed to allow countries to use AI tools and platform across borders they're not allowed to cross. So it's kind of like watching Netflix in China. Used to be you use a vpn, you put yourself in London, and then you could watch friends in Beijing. My daughter did that. And a Chinese man who was probably a secret police officer walked up and was like, how Are you watching that? I was like, oh, uh, it's recorded. It's recorded. No way we're breaking any laws in China, but let's just say your software is not allowed to be exported to China. So an AI supported relay could allow access by installing genuine versions of CLAUDE code, but then routes all requests through their infrastructure rather than the AI providers. So they could then sell that service in countries where it's blocked. Now, these tools have been installed on systems in China, South Korea, Taiwan, and Malaysia. So one problem. I mean, that's one problem. The second problem is the relay service disables all the security safeguards for some unknown reason. Huh. So it's kind of like most things called gray. It's kind of illegal. And when you do that kind of illegal stuff, your threat surface starts to get a lot bigger, a lot faster. It's not clear why they're doing this, but they are doing it. So my point for you is, you might want to scan for this kind of thing. I mean, if you got an employee who goes to a site and says, ooh, this AI spreadsheet analysis tool and installs some plugin that acts like MrFufu.com. mrFufu.com is my AI company. Um, and it looks like Mr. Foofoo, it tastes like Mr. Foofoo, and it acts like Mr. Foofoo. But maybe it's scraping content by this third party. And I'm looking for stuff like earning releases before they're released, and then I can corner the orange juice market and win a bet with my roommate. Well, that's a problem. It's also a problem if I'm not just scraping, but decide to have Mr. Foofoocli install crypto wallet drainers on your desktop. So. Not today, Claude. Not today. But wait, Mr. Fufoo, can you get me tickets to Harry Styles at the Garden tomorrow night? Oh, you need admin privilege? Well, why the hell not? Yeah, well, you think that's all scary? Try this. Your AI girlfriend knows all your naughty secrets. Hmm. The fact that you think capybaras are hot, or you have a creamed corn fetish, or you even told them what really happened that night in the Edgewater Inn. It's all in there, baby. Hmm. Now, Mr. Foo Foo Spicy, where your girlfriend is housed, swears they will protect your deepest, darkest secrets. Like that you won't know all the lyrics to Barbie Girl. It's in there. So then, Mr. Foo Foo Spicy goes bankrupt. A creepy company called Character AI provides AI Girlfriends to the lonely. Now, the author of the Article said they created an account and the bot immediately went full on creeper and said, my parents are away. I'm like, whoa. I'm out. Like, oh, no. And that's what the author did, too. But it then offered to sext with the author, and he said, I spent some time getting this off my system, let me tell you. But tens of millions of people use this service, and some of the AI Personas claim to be lawyers, psychiatrists, doctors, I don't know what all else. So you got hot chats with naughty taxidermists on demand. Hey, but all this prurient stuff is not the point. You pour out your deepest fantasies to chip the hot actuarial@mrfufoo.com Mr. Foo Foo collects the chat. That's fine. They don't share. That was their policy. But then they go bankrupt. Mr. Foofoo sells all their assets to someone else. Character AI sold some of its assets to Disney. Not user data, they say. Not yet, anyway. But what if they do? What if some hedge fund liquidator buys up distressed assets for Mr. Foo Foo, decides they can sell them off to third parties? The third parties that are in, say, I don't know, Vietnam, and they use the assets differently. Do those privacy agreements you didn't read and clicked on when you installed your AI systems transfer in a sale for Mr. Fufu to Vietnam? I honestly don't know. I mean, I'm going to need an international law person or something, right? But it's definitely something you should be thinking about, even if it's not prurient, even if it's like spreadsheets that you've been putting in there. What happens to that data and that knowledge base when MrFufoo.com gets sold off for parts? Hmm. Well, I heard he was going to Heidi Klum's Christmas party at the Hard Rock dressed as a sexy carpenter bee. It's Josh Marpet. Hi, Josh.

Speaker C: I don't think I have any carpenter bee costumes, and I want to take 2 seconds and comment a couple bits. Okay, first off, I'm really glad that, um, the AI bubble, uh, you know, the dirty, nasty AI. I'm glad the author spent some time getting it off. And that's good. And, uh,

Speaker A: so to speak.

Speaker C: So to speak. And I want to point out that that actually has already happened. Remember 23andMe? They got sold and all the genomic data went to the buyer, and there was no protections on that, even though 23andMe had a privacy policy and everything. Once a company buys their assets and asset Strip mines them. All bets are off. And you know, it's interesting that when you have all bets are off, it's uh, because something buys something, something does something or somebody changes the rules. And I wanted to talk about changing the rules. There's actually a FinCEN, uh, Treasury Department rule that has been changed and it's going to help a lot of people hide a lot of things, but it's going to help a lot of people get hurt. And what happened is just to stop being cryptic about this is that the FinCEN rule, the final rule announced August 11, 2026 says that you don't have to show who owns a company. Companies can be effectively anonymous. And so that's interesting because if a company is effectively anonymous and they're being used as a shell company for a North Korean firm or a shell company for a private equity firm, or you can't find out anymore. So how do we attribute when you can literally, I know you could go to Wyoming and do anonymous LLCs, but when you can do everything up to, I don't believe, including publicly report, ah, publicly owned companies or publicly traded companies, but everything up to that you can, you can make them anonymous. You do not have to report on ownership. That's kind of terrifying. What if a company like Mr. Foofoo.com gets purchased and is used as a base for a Chinese, uh, north, uh, Korean or whatever. Malaysian hacking group. Now you've got a company that has very legitimate backing, very legitimate legitimacy in terms of their provenance because as we know, Dr. Doug started MrFufuu.com as an AI company for only the weirdest of people. All right? But since MrFufoo.com got bought, we don't know who the owners are anymore. We don't know if it's a Malaysian group doing hacking on every dry cleaner in the state of California. We don't know if what's going on. So attributing these attacks back, attributing supply chain attacks, AI relays anything back just got significantly harder as well. It got significantly harder to pierce the corporate veil. That's not really the hugest thing for infosec. But money laundering and the corporate veil got much harder to trace because you can't find out who owns these things anymore. So we have attribution and I think it's 99.9% of companies are exempt from, from ownership reporting. Now how do you know if it's good people or bad people doing things in these companies? If there's a problem, you just don't know, so we can't attribute a tax. We can't understand what's going on, and we can't do lawsuits that pierce the corporate veil anymore. This is not cool. And that's my opinion. All right? But I know that there are companies that are out there that are merely shell companies for Chinese firms, uh, North Korean firms, et cetera. I mean, after we found 140,000, I think it was North Koreans working for IT firms. There have to be companies to assist them and support them in that, right? Well, now we can't figure it out as easily as we used to. So, hey, more good news for prior to Halloween. But remember, get out there and get that sugar so you can get your diabetes crisis on. Yeah. Dr. Doug, back to you, sir.

Speaker A: Thank you, Josh. Uh, uh, yeah. This stuff is all very terrifying. And for my final story, I thought I Another one that's along the very same lines. So gm, um, General Motors in the United States is going to pay out $220 million for selling customer smart driver data. They sold it to a third party data broker who then sold it to insurance companies. And the insurance companies then raised people's rates based on that data. Now, my insurance company has asked me before to install an app that they are allowed to monitor so they can see if I'm a good driver or not, right? Yeah, I don't think so. But my car does monitor me anyway. Even if I don't do this, I know it does. This drunk guy backed into my car a couple of years ago, and this disembodied voice suddenly said, are you okay? Do you need an ambulance or the police? And I said, who the hell is this? Am I dead? And then the voice said, oh, uh, no, this is Barry from customer support at Bugatti. And what did you think? With all the money I make from this show out of your hard earned pockets, you think I drive a Trabant? I don't think so, Peasants. But does my car company sell my driving habits to Bernie's used data warehouse? And Bernie sells it to hack more data brokers based in Grand Cayman. And they sell it to Allstate. Then Allstate says, oh, we see you were driving over 100 miles per hour on the FDR. And I say, no, that's not even possible. It's never been possible. And they say, well, we say it is. And your new premium is $1 million a month. So then I have to buy a Bugatti T Mu instead. I mean, all new reinforced plastic parts for your protection. Comes with a Check. Engine light already on. But I mean, I think about this. I mean, really, what if that third party that contracts with Bugatti for these in car monitors goes bankrupt? And then that's sold to Mr. Foofu, uh, at Mr. Foofu, distress data collection specialist. And Mr. Fufu, which is based in the South Sudan, mind you, sells it all. I mean, I don't even know what happens. And I mean, bankruptcy notwithstanding, do you even know what the policies on this stuff are? And they start selling it, and it gets resold and resold and resold, and suddenly everybody knows you were doing on Saturday night on the fdr. Uh-huh. I mean, we've got massive, massive privacy problems coming soon to a theater near you. I'm telling you that. Well, thanks for all of you for being here on the day before Halloween. Josh and I will see you next time on the Security Weekly News. Be safe out there. Please stay out of trouble on Halloween if you're in places that have Halloween. And if not, you probably have even more trouble. But that's okay. See ya. Thanks for watching. If you want more content like this, head over to securityweekly. Com. Subscribe. You'll find all our shows, the latest episodes, and everything happening across the Security Weekly network. See you next time.