Latest / Tech Talks With Kinsoft / Charter/Spectrum – ShinyHunters Vishing Breach

Transcript

Charter/Spectrum – ShinyHunters Vishing Breach · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. Hey, everyone.
• 0:02
  So picture a massive corporate data breach for
• 0:06
  a second. You know, you're probably imagining
• 0:08
  elite hackers sitting in a dark room somewhere,
• 0:11
  right? Frantically typing complex code to like
• 0:15
  smash through sophisticated firewalls. Oh, yeah.
• 0:19
  The classic guy in a hoodie in a basement trope.
• 0:21
  Exactly. We'll delete that image entirely. Because
• 0:24
  today we are looking at how a really simple phone
• 0:28
  call, just a smooth talking voice on the line,
• 0:31
  unraveled one of the biggest telecom networks
• 0:34
  in America. It really is wild when you break
• 0:36
  it down. Yeah, it is. And, you know, we designed
• 0:39
  this show with a very specific premise in mind
• 0:41
  to tackle stories just like this one. We take
• 0:44
  a stack of reputable sources like articles, research
• 0:46
  papers, our own notes, and we just extract the
• 0:49
  most important insights. Right. So you can stay
• 0:51
  perfectly informed without succumbing to the
• 0:54
  whole information overload thing because. I mean,
• 0:57
  there is just a relentless flood of data out
• 0:59
  there right now. Oh, absolutely. And our entire
• 1:00
  job is to find the signal through all that noise,
• 1:03
  especially when the security of your personal
• 1:05
  data is on the line. Which brings us to today's
• 1:08
  mission. We are unpacking an event that perfectly
• 1:10
  illustrates why paying attention to those signals
• 1:12
  is so crucial. We're digging into the massive
• 1:16
  Charter Communications data breach. Right. Which
• 1:19
  most of you listening probably know better by
• 1:21
  their primary consumer brand, Spectrum. Yeah,
• 1:24
  exactly. Spectrum. And this breach was officially
• 1:27
  confirmed in late May of 2026. Now, before we
• 1:32
  really get into the weeds here, I just want to
• 1:33
  clarify that our entire analysis today is based
• 1:36
  strictly on reporting from two excellent sources.
• 1:39
  That's Ticklicious. and security affairs. Both
• 1:42
  really solid sources for this kind of thing.
• 1:44
  Yeah, definitely. And the hook here, I mean,
• 1:46
  the reason the story is just so fascinating is
• 1:48
  that there was no malware involved in the initial
• 1:51
  break -in at all. No zero -day software exploit.
• 1:54
  Nothing like that. Right. To really grasp the
• 1:56
  sheer scale of the damage here, we first have
• 1:58
  to look at the honestly incredibly mundane way
• 2:01
  the attackers actually got inside the network.
• 2:03
  Yeah, it completely flips the traditional cybersecurity
• 2:05
  narrative on its head. It really does. I mean,
• 2:08
  we spend so much time and money focusing on hardening
• 2:12
  the software and the hardware, right, that we
• 2:14
  just, we often forget about the wetware, the
• 2:17
  human element. The human element, yeah. So let's
• 2:19
  lay out the timeline. The initial entry happened
• 2:21
  on April 1st, 2026. April Fool's Day. Yeah, which
• 2:26
  is just dark irony. Anyway, this extortion group
• 2:29
  known as Shiny Hunters used a technique called
• 2:32
  voice phishing. or vishing, to compromise a charter
• 2:35
  employee. Basically, they got an employee on
• 2:38
  the phone and just, well, talked them into surrendering
• 2:40
  their Microsoft Enter access credential. No brute
• 2:42
  force password cracking, just a converse date.
• 2:45
  Okay, let's unpack this. Because think about
• 2:48
  it this way. Imagine a bank spending tens of
• 2:51
  millions of dollars building a state -of -the
• 2:53
  -art high -tech vault. Right. You have biometric
• 2:55
  scanners, laser grids, you know, foot -thick
• 2:58
  steel doors. And then... A con artist just calls
• 3:01
  this security guard working the front desk, speaks
• 3:03
  a highly convincing story, and just asks for
• 3:06
  the keys. And the guard just hands them over.
• 3:08
  Exactly. They just hand them over. What's fascinating
• 3:10
  here is the psychology behind a vishing attack,
• 3:13
  because that's what makes it so devastating.
• 3:15
  It entirely bypasses all those expensive technical
• 3:18
  barriers you just mentioned simply by exploiting
• 3:21
  basic human nature. Right. Like our desire to
• 3:24
  be helpful. Exactly. Human trust and our inherent
• 3:26
  desire to be helpful in a crisis. The attacker
• 3:29
  isn't fighting a complex algorithm. You know,
• 3:32
  they are manipulating a person. So they usually
• 3:35
  create this highly believable sense of urgency.
• 3:39
  Like what? Well, they might pretend to be from
• 3:42
  the IT help desk, right? Saying there's an emergency
• 3:45
  with the employee's payroll account and they
• 3:48
  need to verify a login code immediately. Oh,
• 3:51
  wow. And that's how they get around two -factor
• 3:53
  authentication, isn't it? Because, I mean, we
• 3:55
  are always told that two -factor authentication
• 3:57
  is the silver bullet. Yeah, the holy grail of
• 3:59
  basic security. Right. But if the IT guy on the
• 4:02
  phone says, you know, hey, I just texted you
• 4:04
  a six -digit code to verify your identity. Could
• 4:07
  you just read it back to me? Well, you just gave
• 4:08
  the attacker your second factor. Precisely. A
• 4:11
  text message code is completely useless as a
• 4:14
  defense if the human holding the phone simply
• 4:16
  reads it aloud to the person trying to break
• 4:18
  in. Man. Yeah. When an attacker creates that
• 4:21
  artificial pressure, critical thinking just shuts
• 4:24
  down. And we have to look closely at what they
• 4:26
  were actually targeting here, too, because they
• 4:28
  weren't just asking for access to the employee's
• 4:30
  email. Right. They specifically targeted Microsoft
• 4:32
  Entra credentials. Now, my understanding is that
• 4:35
  Microsoft Entra isn't just like a standard login.
• 4:39
  It's essentially. the master key card a hotel
• 4:43
  manager uses. Oh, that's a perfect analogy. Yeah,
• 4:46
  like you get that one card and suddenly you can
• 4:48
  walk into any room in the building without picking
• 4:49
  a single lock. Exactly. Untra is a centralized
• 4:53
  identity and access management system. It's basically
• 4:56
  the modern evolution of Azure Active Directory.
• 4:58
  So in a corporate environment, it acts as the
• 5:01
  master key. So it proves who you are to all the
• 5:03
  other apps. Right. It's the central authority
• 5:05
  that proves who you are, and then it automatically
• 5:08
  grants you access to all the different software
• 5:10
  applications you need to do your job. So by stealing
• 5:14
  those specific credentials, the attackers gain
• 5:17
  the ability to impersonate that employee across
• 5:19
  the entire corporate ecosystem. Wow. Yeah. For
• 5:23
  a modern threat actor, an identity system like
• 5:25
  Microsoft Entra is the absolute holy grail. Okay,
• 5:29
  so they have the master key, but an identity
• 5:33
  platform like Entra doesn't actually hold the
• 5:35
  company's customer data, right? Yeah. It just
• 5:38
  points you to it. Correct. It's the gateway.
• 5:40
  So where did this stolen key card actually take
• 5:42
  them? And I guess that brings us to the next
• 5:44
  phase of this event. The loot and the massive
• 5:48
  dispute over what was actually inside that vault.
• 5:50
  Oh, yeah. The dispute is fascinating. Because
• 5:52
  once Shiny Hunters had the Entra account, it
• 5:55
  led them directly into the company's Salesforce
• 5:57
  instance. And, you know, for anyone unfamiliar,
• 5:59
  Salesforce is a massive customer relationship
• 6:01
  management platform. It's basically the digital
• 6:03
  brain where a company stores its customer data,
• 6:06
  interactions, and support histories. Right. And
• 6:08
  this is where the reporting gets very muddy because
• 6:11
  we have two completely conflicting narratives
• 6:14
  about what was extracted from that database.
• 6:16
  Yeah. So let's lay out the claims. impartially
• 6:19
  based on the sources. On one side, we have the
• 6:22
  attackers. Shiny Hunters claims they exported
• 6:25
  a staggering 42 million records. That's a massive
• 6:29
  number. It's huge. And they claim this haul includes
• 6:32
  highly sensitive customer proprietary network
• 6:35
  information, or CP &I, which is federally protected
• 6:38
  telecom data. It reveals who you call. when you
• 6:42
  call them and exactly how long you speak. Right.
• 6:44
  And then on the other side, you have the company's
• 6:47
  official stance. Charter has explicitly denied
• 6:50
  that any sensitive personal information or PI
• 6:52
  or any CPI data was exfiltrated by the threat
• 6:55
  actor. So they're just flat out denying it. Yeah.
• 6:57
  They are flatly stating that the most serious
• 6:59
  part of the attacker's claim is false. Wait,
• 7:01
  hold on a second. Stop right there. Forty two
• 7:03
  million records. That math just doesn't work
• 7:05
  out. I mean, I'm looking at the notes here and
• 7:07
  Charter only has about 32 million U .S. customers
• 7:10
  in total. Right. Are the attackers just entirely
• 7:13
  fabricating this number? How can they steal more
• 7:16
  records than the company has customers? Well,
• 7:18
  on the surface, it definitely. looks like an
• 7:20
  outright lie. And look, it is a very common tactic
• 7:23
  for extortion groups to inflate their numbers,
• 7:26
  right? Just to increase the media pressure on
• 7:29
  the victim. Sure. Make it sounds barrier than
• 7:31
  it is. Exactly. However, when you understand
• 7:33
  how a Salesforce database operates, the number
• 7:36
  actually starts to make. a weird kind of sense
• 7:40
  really because it likely contains a massive amount
• 7:43
  of duplicated data and more importantly a crm
• 7:46
  database doesn't just hold current active paying
• 7:49
  customers oh i see where you're going with this
• 7:51
  yeah it holds data on former customers who cancelled
• 7:54
  years ago and crucially it holds data on prospective
• 7:57
  customers you know people who simply called to
• 8:00
  inquire about internet service or maybe filled
• 8:02
  out a form online but never actually signed up
• 8:04
  right so the total number of profile records
• 8:07
  in a sales system will naturally be significantly
• 8:09
  higher than the current active subscriber count.
• 8:12
  OK, that makes sense. They are scooping up the
• 8:14
  leads, not just the active accounts. But I want
• 8:17
  to circle back to the CP &I data. The call logs.
• 8:20
  Yeah, that's the scary part. Even with Charter
• 8:23
  denying that this specific data was taken, we
• 8:26
  need to understand why shiny hunters would even
• 8:28
  brag about taking it. Like, why is CPI so uniquely
• 8:32
  dangerous if it falls into the wrong hands? It's
• 8:34
  vital to understand this because CPI reveals
• 8:37
  the invisible network of your life. It isn't
• 8:40
  just about knowing your phone number or your
• 8:42
  billing address. Right. If someone possesses
• 8:44
  your call logs, they know if you are making recurring
• 8:47
  calls to a bankruptcy lawyer, maybe a divorce
• 8:50
  attorney, an oncologist, a suicide hotline, or
• 8:53
  a substance abuse treatment center. Oh, wow.
• 8:55
  Yeah. They know exactly when you called and how
• 8:57
  long you stayed on the line. You know, when you
• 8:59
  frame it like that, the metadata is almost more
• 9:02
  invasive than recording the actual phone call.
• 9:05
  I mean, you don't need to hear a single word
• 9:07
  of the conversation if you know a person is talking
• 9:09
  to a cardiologist for an hour every Tuesday afternoon.
• 9:12
  The story just writes itself. Exactly. It strips
• 9:14
  away your privacy without the attacker ever needing
• 9:17
  to intercept the actual content of your communications.
• 9:20
  And that is exactly why it's protected by strict
• 9:22
  federal laws and why the stakes in this specific
• 9:25
  dispute between Charter and Shiny Hunters are
• 9:28
  incredibly high. Well, we do have some independent
• 9:30
  data to help us piece together what actually
• 9:32
  happened. The research team at CyberNews and
• 9:36
  the Breach Notification Service have at Ben Pound
• 9:38
  actually analyzed the data that shiny hunters
• 9:41
  leaked on the open web. Right, which they leaked
• 9:44
  when Charter apparently refused to pay their
• 9:46
  ransom. Yeah, exactly. And they indicate that
• 9:48
  roughly 4 .9 million unique email addresses were
• 9:51
  exposed. And this came along with names, physical
• 9:55
  addresses, phone numbers, and details from nearly
• 9:57
  10 million customer support tickets. That's a
• 10:00
  huge amount of support data. It is. They also
• 10:02
  found around 85 ,000 employee directory records,
• 10:05
  work emails, job titles, and some home addresses.
• 10:08
  The exposed systems seem to primarily manage
• 10:11
  current, former, and prospective business customers,
• 10:14
  basically the Spectrum Enterprise division. Look,
• 10:16
  that 4 .9 million figure is still a massive exposure,
• 10:20
  even if it falls way short of the 42 million
• 10:23
  they originally claimed. And honestly, it leads
• 10:26
  us to a much broader issue here. Right. Because
• 10:29
  this breach at Charter is alarming on its own,
• 10:31
  but we really have to zoom out to understand
• 10:34
  the current threat landscape. This was not an
• 10:36
  isolated random attack by some lone wolf. No,
• 10:39
  not at all. It's part of a highly successful,
• 10:42
  repeatable playbook being executed across the
• 10:44
  corporate world right now. now. Shiny Hunters
• 10:47
  is a well -known entity in the cybercriminal
• 10:50
  ecosystem. Definitely. And the sources note they're
• 10:52
  associated with a broader, loosely connected
• 10:54
  network that researchers refer to as the Calm.
• 10:57
  Which, honestly, sounds incredibly ominous. It
• 11:00
  really does sound like a movie villain organization.
• 11:02
  But what makes the comm unique and uniquely dangerous
• 11:05
  is their demographic makeup. How so? Well, this
• 11:08
  network is largely comprised of young, native,
• 11:11
  English -speaking threat actors based in Western
• 11:13
  countries. And that completely changes the dynamic
• 11:15
  of a vishing attack. Oh, right, because of the
• 11:18
  phone calls. Exactly. In the past, if a foreign
• 11:21
  threat actor tried to call an American corporate
• 11:23
  employee, the language barrier, maybe a thick
• 11:25
  accent or just awkward phrasing, would often
• 11:28
  be an immediate dead giveaway. The alarm bells
• 11:31
  would just ring in the employee's head. But when
• 11:33
  the person on the other end of the line sounds
• 11:35
  exactly like, you know, a frantic 22 year old
• 11:38
  I .T. intern from the Omaha office who just spilled
• 11:41
  coffee on the server. the employee's defenses
• 11:43
  drop completely. Exactly. The social engineering
• 11:46
  just becomes flawless. And this group has perfected
• 11:49
  a very specific, devastatingly effective playbook
• 11:52
  for 2026. Okay, let's break down the mechanics
• 11:55
  of that playbook because it operates like a corporate
• 11:57
  nightmare assembly line. Right. Step one is the
• 12:00
  vishing call. They socially engineer an employee
• 12:03
  into handing over credentials and bypassing MFA.
• 12:06
  Right. Step two is compromising the single sign
• 12:08
  -on, or SSO, accounts. These are systems like
• 12:11
  Microsoft Entra, Okta, or Google Workspace. Step
• 12:14
  three is the pivot. And that's where the damage
• 12:16
  scales up. Yeah. Once they have that SSO token,
• 12:19
  that Hotel Master keycard we talked about, they
• 12:22
  jump into all connected SaaS platforms. They're
• 12:24
  instantly inside Salesforce, Slack, Microsoft
• 12:27
  365, Zendesk. And finally, step four. They extract
• 12:32
  data at massive scale and demand a cryptocurrency
• 12:35
  ransom. Yeah. And if the victim refuses to pay
• 12:38
  the ransom, the group just dumps the data on
• 12:40
  public leak sites. This destroys the company's
• 12:43
  reputation and forces future victims to take
• 12:45
  their extortion threats seriously. It's a brutal
• 12:48
  cycle. It is. And the sources list an absolutely
• 12:51
  staggering string of victims in 2026 alone that
• 12:54
  fell for this exact playbook. I mean, Panera
• 12:56
  had over 5 million customers breached. Instructure's
• 13:00
  Canvas platform, which is used by more than 30
• 13:02
  million students and teachers globally, was breached.
• 13:04
  The identity protection company Aura saw nearly
• 13:07
  1 million customers breached. And the security
• 13:09
  firm ADT had 5 .5 million customers breached.
• 13:13
  Just massive numbers across the board. Yeah.
• 13:15
  And here's where it gets really interesting.
• 13:17
  And I have to ask you about the underlying technology
• 13:19
  here. Because for years, the IT industry has
• 13:22
  been preaching that single sign -on is the absolute
• 13:25
  pinnacle of corporate security oh absolutely
• 13:27
  it's been the gold standard right you have one
• 13:29
  strong password secured with multi -factor authentication
• 13:32
  and it safely connects your entire workflow but
• 13:36
  if one stolen password given away over a simple
• 13:39
  phone call unlock Salesforce slack your email
• 13:43
  and your customer databases aren't we just putting
• 13:46
  all our highly sensitive eggs in one incredibly
• 13:49
  vulnerable basket. You are hitting on the central
• 13:52
  debate in modern identity architecture right
• 13:55
  there because single sign -on is fundamentally
• 13:57
  a double -edged sword. On the positive side,
• 14:00
  you have usability and administrative control.
• 14:02
  It is vastly more secure than forcing an employee
• 14:05
  to memorize 50 different complex passwords for
• 14:07
  50 different applications. Yeah, because when
• 14:10
  you do that, human nature takes over and they
• 14:13
  just write all 50 passwords on a sticky note
• 14:15
  attached to their monitor. Right. The classic
• 14:17
  analog security flaw just defeats the digital
• 14:20
  security. So SSO allows security teams to enforce
• 14:25
  strict logging policies at a single choke point.
• 14:28
  But the other edge of that sword. Is the blast
• 14:30
  radius. Centralized access inherently means centralized
• 14:33
  risk. The architecture basically works using
• 14:37
  authentication tokens. So when you log into UNTRA,
• 14:40
  it generates a digital wristband that tells Salesforce,
• 14:43
  hey, I vetted this person, let them in. Oh, I
• 14:45
  see. If the human element fails, like if an employee
• 14:49
  is successfully vished and hands over that token,
• 14:51
  the resulting blast radius is catastrophic. The
• 14:55
  attacker doesn't just breach one application.
• 14:57
  They get the keys to the entire digital kingdom.
• 15:00
  Man. Yeah. The exact same architecture that makes
• 15:03
  it seamless for an employee to do their daily
• 15:05
  job makes it utterly seamless for an attacker
• 15:08
  to pivot and steal millions of records in an
• 15:10
  afternoon. Wow. Well, we have spent a lot of
• 15:12
  time talking about the macro level here. You
• 15:14
  know, the corporate networks, the criminal syndicates,
• 15:16
  the architecture of single sign -on. But let's
• 15:18
  bring this right into the listener's living room.
• 15:20
  Good idea. If you are a Spectrum customer sitting
• 15:23
  at home right now, hearing that an attacker might
• 15:25
  have your contact info and your support ticket
• 15:28
  history, that changes everything. You aren't
• 15:31
  just a generic number in a database anymore.
• 15:33
  You're a target. Exactly. So with all this data
• 15:36
  floating around the open web, what is the actual
• 15:39
  defense plan? Well, it requires an immediate
• 15:41
  proactive shift in how you protect your identity.
• 15:44
  Because even if Charter's claim is true and the
• 15:46
  highly sensitive CP &I data wasn't taken, the
• 15:49
  data that is confirmed to be out there is bad
• 15:51
  enough. Yeah. Your name, address, email. Right.
• 15:54
  Your physical address, your phone number, your
• 15:56
  email. That is more than enough ammunition for
• 15:59
  a secondary wave of attacks. So let's outline
• 16:01
  the actionable steps directly from the reporting.
• 16:03
  If you are a Spectrum customer, the very first
• 16:06
  thing you need to do is log in and change your
• 16:08
  Spectrum account password. Simple but essential.
• 16:11
  Yeah. Second, turn on two -factor authentication
• 16:13
  for your account if you haven't already. Third,
• 16:15
  go to the website haveibnpeln .com and type in
• 16:19
  your email to verify if your specific address
• 16:21
  was part of the $4 .9 million swept up in this
• 16:23
  breach. Right. Highly recommend that site. And
• 16:26
  finally, the big one. You need to place a credit
• 16:28
  freeze at all three major credit bureaus. That's
• 16:32
  Equifax, Experian, and TransUnion. I really want
• 16:35
  to spend a moment on the credit freeze, actually,
• 16:37
  because it is arguably the most powerful tool
• 16:40
  you have to prevent identity theft. It's entirely
• 16:43
  free and it is easily reversible when you need
• 16:46
  to apply for a loan. How does it actually work
• 16:48
  in practice? Well, what a freeze actually does
• 16:51
  is lock your credit report at the database level.
• 16:54
  So if an attacker tries to use your leaked name
• 16:56
  and physical address to open a new credit card
• 16:59
  in your name, the bank will automatically query
• 17:02
  Experian or Equifax to check your credit score.
• 17:05
  But because of the freeze, the bureau denies
• 17:07
  the bank access to the file. And without seeing
• 17:10
  the credit file, the bank automatically blocks
• 17:12
  the fraudulent application. It just shuts the
• 17:14
  attacker down right at the source. That is brilliant.
• 17:17
  It stops the attack entirely. It does. But there
• 17:21
  is another layer to this defense plan that requires
• 17:24
  a shift in your daily behavior, I think, because
• 17:27
  think about the root cause of this entire corporate
• 17:30
  breach. If a highly trained employee working
• 17:33
  inside a massive telecommunications company can
• 17:35
  be tricked over the phone by a confident. Fast
• 17:38
  talking voice. You have to be incredibly skeptical
• 17:41
  of anyone calling you claiming to be from Spectrum
• 17:44
  Support. Oh, absolutely. And that is where the
• 17:46
  leakage of nearly 10 million customer support
• 17:49
  tickets becomes so incredibly dangerous. Right.
• 17:52
  Because of what they know. Yeah. We aren't dealing
• 17:54
  with generic automated spam calls here. We are
• 17:57
  looking at highly targeted spear phishing and
• 17:59
  account takeover attempts. Because the hackers
• 18:01
  possess your support history, they know exactly
• 18:04
  what you have been struggling with. That's terrifying.
• 18:07
  They know if you called three weeks ago complaining
• 18:09
  about a slow router or maybe disputing a weird
• 18:12
  charge on your bill. So the attacker doesn't
• 18:14
  just blindly call and say, hi, this is Spectrum.
• 18:16
  They call and say, you know, hi, this is Dave
• 18:18
  from Spectrum Advanced Support. I am following
• 18:20
  up on that ticket you opened on May 12th. regarding
• 18:23
  the slow upload speeds on your living room router,
• 18:26
  are you still experiencing that lag? And just
• 18:30
  like that, the fake call becomes incredibly convincing.
• 18:34
  It instantly lowers your guard. The attacker
• 18:36
  builds rapport and trust because they possess
• 18:39
  inside information that only the real company
• 18:41
  should have. And then they strike. Right. Once
• 18:44
  they establish that trust, they spring the trap.
• 18:46
  They might ask you to confirm your account details
• 18:48
  or read back a security code they just texted
• 18:50
  you to, quote, verify your identity or even click
• 18:53
  a link in an email to authorize a diagnostic
• 18:55
  scan. In reality, they are using that code or
• 18:59
  that link to take over your personal account
• 19:01
  entirely. It is terrifyingly clever. So the golden
• 19:05
  rule moving forward really has to be if you receive
• 19:08
  an inbound call, even if the person on the other
• 19:10
  end knows your entire support history, you just
• 19:13
  politely hang up. Exactly. Just hang up. You
• 19:16
  look up the official support number for Spectrum
• 19:18
  yourself and you dial them directly. Never, ever.
• 19:22
  Trust the inbound caller ID. Precisely. You must
• 19:25
  always verify the communication channel by initiating
• 19:27
  it yourself. I think it really highlights how
• 19:30
  the true front lines of cybersecurity have moved.
• 19:32
  They aren't just at the corporate firewalls and
• 19:35
  network routers anymore. The front lines are
• 19:37
  on our own smartphones, relying on our own judgment.
• 19:40
  Which brings us to a lingering thought that I
• 19:43
  think everyone needs to grapple with after unpacking
• 19:45
  a story like this. We are watching massive corporations
• 19:48
  spend billions of dollars on advanced artificial
• 19:50
  intelligence, machine learning anomaly detection,
• 19:53
  state -of -the -art firewalls. Billions. Yeah.
• 19:57
  But as these technical defenses become nearly
• 19:59
  impenetrable, is the ultimate unpatchable vulnerability
• 20:03
  of the future simply a confident, persuasive
• 20:05
  human voice on the other end of a phone line?
• 20:08
  Well, as long as humans operate the systems,
• 20:10
  human psychology will remain the most exploitable
• 20:12
  attack vector. We can build the most advanced
• 20:14
  digital vaults in the world, but we still have
• 20:16
  to ensure the people guarding them know how to
• 20:18
  spot a con. That is a chilling thought to end
• 20:21
  on, but an absolutely necessary one. And look,
• 20:24
  if exploring the mechanics of this breach made
• 20:26
  you rethink your own business's defenses, or
• 20:29
  if you find yourself wondering how resilient
• 20:30
  your team really is against these kinds of modern
• 20:33
  social engineering tactics, you should visit
• 20:35
  www .kinsoft .com .au to discuss your security
• 20:40
  and IT needs. Yeah, they have the expertise to
• 20:43
  help you build not just robust technical defenses,
• 20:45
  but really strong human defenses as well. Well,
• 20:48
  that brings us to the end of our time today.
• 20:49
  Thank you so much for joining us and trusting
• 20:51
  us to help you navigate the noise. Stay skeptical,
• 20:54
  stay secure, and we will catch you next time
• 20:56
  on Tech Talks with Kinsoft.