How Can Memes Improve Security?
Memes are goofy. They’re easily recognizable. And they’re often used to make a point. So it’s no wonder that people on both sides of the InfoSec community are not only familiar with memes, but often use them in their endless games of cat and mouse. Consequently, memes are often a sign of a breach of security. Because there’s little as satisfying as leaving a meme as proof of your security prowess.
This episode, we hear from a couple of Red Hatters who rose to an unusual security challenge. And while intentions were good, the memes could have easily been something much more nefarious.
00:01 - Johan Philippine
Brent, Angela. Have you ever been pranked on a work computer?
00:06 - Angela Andrews
00:07 - Johan Philippine
00:08 - Angela Andrews
00:08 - Brent Simoneaux
One time. Well, I'm ashamed to admit this, multiple times, I have left my laptop open.
00:17 - Johan Philippine
00:18 - Brent Simoneaux
In the office.
00:19 - Johan Philippine
00:19 - Brent Simoneaux
And this, of course led to, I'll call them pranks.
00:25 - Johan Philippine
00:27 - Brent Simoneaux
Well, they were mostly, I'll say kind reminders to lock my computer when I walk away from it.
00:37 - Angela Andrews
00:38 - Brent Simoneaux
Yeah. Kind reminders that mostly took the form of emails to myself, from myself.
00:46 - Johan Philippine
At a previous company I worked at, we would do something very similar where if someone left their computer open and unlocked, someone would post as them in Slack saying like, "Hey, donuts are on me tomorrow." Right? So there's that extra little incentive for them to be a bit more careful.
01:02 - Angela Andrews
That'll learn ya.
01:03 - Johan Philippine
Mm-hmm (affirmative). It's harmless fun, right? But it has its role. And that is to encourage people to have better security practices. Now there's a story I want to share with the two of you that happened here at Red Hat, and it's called Caturday.
01:19 - Brent Simoneaux
01:22 - Angela Andrews
01:22 - Johan Philippine
This story involves pranks and security, but it also involves memes.
01:29 - Angela Andrews
You have my full attention.
01:30 - Johan Philippine
This is a great story, but it also led me to wonder how can memes improve security?
01:36 - Angela Andrews
01:41 - Brent Simoneaux
This is Compiler, an original podcast from Red Hat.
01:45 - Angela Andrews
We're your hosts.
01:46 - Brent Simoneaux
I'm Brent Simoneaux.
01:47 - Angela Andrews
And I'm Angela Andrews.
01:49 - Brent Simoneaux
We're here to break down questions from the tech industry; big, small, and sometimes strange.
01:55 - Angela Andrews
Each episode, we go out in search of answers from Red Hatters and to people they're connected to.
02:01 - Brent Simoneaux
Today's question: How can memes improve security?
02:05 - Angela Andrews
Producer Johan Philippine is here to help us out.
02:13 - Johan Philippine
Now, before we dig into the actual story of Caturday, it's really important that we understand the difference between blue teams and red teams. Angela, do you know what a blue security team is?
02:27 - Angela Andrews
Yes, I do. So the blue team are the security folks inside of an organization who do the defensive security measures. They're putting the things in place to secure the infrastructure. That's the blue team.
02:42 - Brent Simoneaux
You've got a defense team. And so I assume there's an offense team.
02:49 - Johan Philippine
02:49 - Brent Simoneaux
02:50 - Johan Philippine
So it's red versus blue. That's the classic, you know, clash of the colors. The red teams, they do kind of the opposite of the blue team, right? They're there to consistently and constantly test the defenses that the blue team have put in place. And when they find something, they usually let the blue team know so that the blue team can then fix whatever it is that needs to be fixed in order to make sure that other people who are looking to find ways into the system can't use that same vector for attack.
03:23 - Brent Simoneaux
And to clarify, the red team works for the same company as the blue team.
03:30 - Angela Andrews
03:31 - Brent Simoneaux
03:32 - Johan Philippine
Not always. Yeah.
03:32 - Brent Simoneaux
03:33 - Angela Andrews
Not always. Sometimes red teams are external to your company. Yeah. Now, they're hired by your company.
03:40 - Brent Simoneaux
03:41 - Angela Andrews
But they've been given permission to try to scan and compromise your system and find out what your weaknesses are. It just so happens that this company has both red and blue teams.
03:56 - Brent Simoneaux
And this is for the purpose of learning?
03:58 - Angela Andrews
Yes. Seeing where your systems may be vulnerable and how to find and remediate those vulnerabilities.
04:08 - Johan Philippine
No system is truly un-hackable, right? So if someone's in your system that shouldn't be there, you've got to be prepared and able to identify them. Now, luckily we've identified the two culprits for Caturday and it turns out they're part of the blue team. They are Alison Naylor:
04:25 - Alison Naylor
I manage the North America incident response and operations team within the information, risk and security team here at Red Hat.
04:32 - Johan Philippine
And Richard Monk.
04:33 - Richard Monk
My job is Senior Information Security Analyst. My title is Consulting Information Security Analyst. But if you look in Rover, it says Consulting Detective, and I'm happy for that.
04:47 - Johan Philippine
Now you may be wondering what memes have to do with red teams and blue teams.
04:53 - Angela Andrews
This is what I was waiting for. You're speaking my love language now. I love memes.
05:00 - Johan Philippine
Memes are so much fun.
05:02 - Brent Simoneaux
What's your favorite meme?
05:03 - Angela Andrews
My favorite meme that… this meme is in the hall of fame of memes. So when I was at my old job, we were on call and we rotated. So every time when my on-call came, I would post this photo of Beyonce, crying with her mascara running and she has a phone next to her ear and she looks a hot mess. And I would be like, "yeah, I'm on call this week." And I would post it on social media and I would send it to my boss. And then of course, when on call was over, I posted Mary Tyler Moore throwing her hat up in the sky and saying on call's over. Yeah, that's my hall of fame of favorite memes. Those two.
05:42 - Johan Philippine
05:43 - Brent Simoneaux
I love that.
05:44 - Johan Philippine
Brent, do you have a favorite meme?
05:46 - Brent Simoneaux
I… I don't internet.
05:49 - Angela Andrews
I don't internet!
05:56 - Johan Philippine
Well, the reason we're talking about memes today is because it turns out that these InfoSec teams, red team and blue team, and really the whole InfoSec community: they really love their memes.
06:09 - Richard Monk
I make jokes that the InfoSec team are ancient Egyptians and that we speak in pictures and worship cats.
06:17 - Johan Philippine
So Alison and Richard, they're part of the blue team, right? They're part of building up the defenses and they're monitoring the network, making sure that the systems are protected. They don't do any red team stuff… usually. But for this one project, Caturday, they switched sides. Here's how it started.
06:38 - Richard Monk
I want to say that it was about 2010. It may have been a little bit later than that. When the very first TVs were put up in the office, our manager at the time said, "Hey, it'd be pretty cool if we got Business Cat up there."
06:55 - Brent Simoneaux
I ask this as someone who doesn't internet: what is Business Cat? Or who is Business Cat?
07:04 - Richard Monk
Business Cat is a very adorable black cat with a little collar and a little yellow striped tie on. And he's adorable. And he's kind of the mascot for a lot of things.
07:15 - Johan Philippine
Pretty good mascot for a business prank, right? You put them up there and you know that something's not going right. Yeah.
07:23 - Angela Andrews
07:24 - Johan Philippine
Brent, would you mind kind of walking us through what these monitors are when and what they display, usually?
07:33 - Brent Simoneaux
So when I first started working at Red Hat, there were no monitors in my office. And then suddenly, they started appearing and they're in places like the kitchen and in the hallway. And they usually just display the weather, different announcements, the menu in the cafeteria, things like that. But they are all over the place now.
07:59 - Johan Philippine
So imagine there are these TVs put up all over the place, and you've got this challenge given by your boss to put Business Cat up on these TVs. I know that I would put at least a little bit of effort to try and get that done.
08:14 - Angela Andrews
08:15 - Johan Philippine
08:15 - Angela Andrews
08:19 - Brent Simoneaux
Who wouldn't do that?
08:21 - Angela Andrews
08:22 - Johan Philippine
The challenge was issued in about 2010 or so, and there was a prize involved, but no one was able to claim it until 2019. Now I'll put a little bit more context onto this and say that over the course of those several years, it was something that they would maybe try and catch the monitors as they were being restarted to get as much information as they could. And they'd poke around a little bit, but weren't devoting all that much time into actually getting it done.
08:48 - Brent Simoneaux
You're saying this wasn't their full-time job.
08:50 - Johan Philippine
08:51 - Angela Andrews
08:56 - Johan Philippine
The first breakthrough came in 2019.
08:59 - Alison Naylor
During my normal security analyst type of work, I was investigating an event. And in the process of doing that, I saw some post names that looked a little different to me. I didn't immediately know what they were. We have taps on the network where we're able to observe some parts of the traffic. And I saw what looked like unencrypted plain text, FTP traffic. And as part of that metadata, I saw what looked like a username and a password. A really, really easy password that no one should be using. And I was like, "no, that can't be," but I thought I would try it anyway.
09:36 - Brent Simoneaux
Was the password 1, 2, 3, 4?
09:39 - Angela Andrews
09:40 - Johan Philippine
It turns out that someone hadn't changed the default password for what turned out to be kind of this mothership server in charge of this whole network of Red Hat Tower TVs, monitors, displays.
09:59 - Brent Simoneaux
10:00 - Johan Philippine
And so at that point, she remembered the challenge, the Business Cat challenge, and she thought, oh, I might be able to actually finish this challenge. Finally.
10:10 - Alison Naylor
Even though I was logged into this mothership, I couldn't actually interact with the contents too much, but I wanted to learn more about the other signs, how they were named, how they were on the network in our building, in Red Hat Tower. I've started to browse our internal Wiki. And I found some host names. They seemed to follow a pattern and I found quite a nice list, once I knew the pattern to look for. And I found one that seemed to be different from the rest. And it looked like it was in the main lobby for the building. And I'd looked for default passwords and I found one and I thought I would try it. It can't be this easy, right? But it worked. Unfortunately the sign was pretty new and I don't think it had been fully set up. So the default admin credentials absolutely worked for me.
10:56 - Johan Philippine
She got super excited, she went over to her teammate, Richard. She told him what she'd found. She said, okay, let's go downstairs. Let's take a look at this. And let's get Business Cat up there.
11:05 - Alison Naylor
We're sitting in reception, probably acting very sketchy. We told our front desk person what we were doing so she wouldn't worry. We found a part of the interface that would allow you just to display any arbitrary image. You could just give it a URL and it would display whatever you pointed it at. So very quickly I went and made a little Business Cat meme myself. And I made it say, "You should probably change your password right meow."
11:32 - Angela Andrews
Aw! Right meow.
11:33 - Brent Simoneaux
11:35 - Johan Philippine
They displayed it in the lobby in all of its glory. Richard took this wonderful full picture of, it's got Business Cat in the background. And it's got Alison in the foreground kind of looking over her shoulder with this huge grin on her face. Like very satisfied with herself.
11:48 - Angela Andrews
What?! Like another famous meme that I'm thinking about.
11:52 - Johan Philippine
11:54 - Angela Andrews
11:57 - Brent Simoneaux
11:59 - Johan Philippine
So they took the picture and then they take it down because they're well aware that they're in this lobby of a prominent tech company with a huge, huge screen that has some…
12:13 - Brent Simoneaux
Doesn't look so good.
12:13 - Johan Philippine
Yeah. It doesn't look good for a tech company to have a meme in their lobby about changing passwords. So they take it down and they go up to their boss and they say, "all right, we did it. Here's the proof. Now give us our prize."
12:32 - Brent Simoneaux
What was the prize?
12:33 - Johan Philippine
Well, apparently there was no prize at that point.
12:35 - Angela Andrews
12:36 - Johan Philippine
Their manager said, "oh no, this isn't good enough. That wasn't the challenge. The challenge wasn't to get Business Cat on one screen that was new, that wasn't fully set up yet. The challenge was to get Business Cat on all the monitors and displays and TVs throughout the Red Hat Tower."
12:52 - Brent Simoneaux
12:53 - Angela Andrews
Oh. The plot thickens.
12:56 - Johan Philippine
And at that point, Alison and Richard, a little annoyed say, "all right then, challenge accepted." And that's when they put on their work gloves. And I'm imagining this whole big montage of like an '80s movie, their fingers go on the keyboard, they're typing away, there's code flying around. And really that's when the real work began, right? And what follows is, well, it gets pretty technically hairy. I'll let Alison give us the details.
13:27 - Alison Naylor
We started to just look for everything that was accessible there, every part of it. And so we found some scripts that we thought we could maybe take advantage of. And so we were able to get an authenticated command injection vulnerability.
13:40 - Angela Andrews
Tell us what that is.
13:41 - Johan Philippine
The way I understand it is this allowed them to trick the system into giving them more permissions than they should have had. That allowed them to run commands as if they were administrators.
13:53 - Angela Andrews
13:55 - Alison Naylor
We figured that needed to be a CVE. And we're going to have to tell them, we got to tell a vendor. But not right now, because we're definitely going to get Business Cat on the screens. So we started to find some other things. We were able to get a shell on this mothership and we started to examine the file system. We saw things like the temp directory. We could put programs there and run them. So we were able to do that. We were able to get ourselves an interactive shell, not just a reverse shell. And we really started to examine what we could find on that disc.
14:27 - Angela Andrews
Once you have shell access, and administrative shell access at that, that's the money shot.
14:33 - Johan Philippine
Yep. They could put programs on there and they could run them and they were able to get themselves an interactive shell. And it's just, at that point, that's when they were really able to do some mischief.
14:47 - Alison Naylor
We found that there was a user in the sudoers file that could read everything. We found that there were some other users that could run some other utilities on the system, including HT password, which can write out files and plain text, as long as there's a colon present somewhere in the line. Conveniently that also works for sudoers files. So we were able to explore that, to write a line into the sudoers so that we could make ourselves root. And now it's kind the game over from here, right? We have all the permissions we want.
15:13 - Brent Simoneaux
All right. I am a little lost here. What is sudoers?
15:20 - Angela Andrews
Sudoers is a file in the etc directory on a Linux system. And that file, allows you to set permissions for other users. You can set people's permissions. So imagine having access to be able to edit sudoers? Game over. You got the keys to the kingdom.
15:41 - Johan Philippine
So they have the keys to the kingdom, but it doesn't do them very much good unless they know how the system works.
15:49 - Richard Monk
And we figured out that at one point in the scripts, there was a location where the files were downloaded and then they were moved into the cache. And so that was the point that we could insert something. So in the script we inserted a single line that called our own script.
16:08 - Brent Simoneaux
Let's get our whiteboard out.
16:09 - Johan Philippine
Let's get the whiteboard out.
16:10 - Brent Simoneaux
Let's get the whiteboard out.
16:11 - Angela Andrews
16:11 - Johan Philippine
Love, love the whiteboard. Let's draw a big old cloud on the top of the whiteboard.
16:18 - Angela Andrews
16:19 - Johan Philippine
Okay. We've got some lines going up to the cloud.
16:25 - Brent Simoneaux
16:26 - Johan Philippine
Okay. And along those lines, we're sending files, we're sending images. We're sending, you know, menus, weather reports…
16:35 - Brent Simoneaux
These are the slides that I see, basically.
16:37 - Johan Philippine
These are the slides that you see every day.
16:39 - Brent Simoneaux
In the office. Every day.
16:40 - Johan Philippine
They go up to the cloud server, that cloud server then sends the files down to a location and moved into a cache, locally. So that you don't have to keep loading them every time from the cloud, right? It helps you minimize the amount of internet traffic and the bandwidth that goes from the cloud to your local server.
16:59 - Angela Andrews
17:00 - Johan Philippine
And then from that local cache, monitors and displays would pull the images that they would need and display them.
17:08 - Brent Simoneaux
And these are monitors in offices, around the world, from China to San Francisco, to Sao Paulo, to-.
17:20 - Johan Philippine
Wherever we have offices around the world that have this system and these displays in the offices, they're pulling from this cloud server.
17:32 - Richard Monk
Every time a new slide was downloaded, they were all just images. It would take a picture of Business Cat, like a translucent picture of Business Cat and overlay it on the bottom right of every single one, every single slide.
17:45 - Brent Simoneaux
This is pretty subtle.
17:47 - Johan Philippine
It's pretty subtle. Yeah. It's very clever.
17:52 - Brent Simoneaux
17:53 - Richard Monk
The other thing was, there's a term we have called a CNC command and control server. And so we wanted to manage this thing. We wanted to see what it was doing because we're not going to be on the machine forever. And so I used a service to send every time one got updated, it would send both Alison and myself, a notification on our phones. It would say, "Hey, I saw a new slide" and it would give us a picture of the slide. So we could watch it in real time as it was updating these slides.
18:23 - Johan Philippine
Then they would know that Business Cat was on his way to a screen near you.
18:28 - Angela Andrews
18:31 - Johan Philippine
And so they did that. They left some comments in the code to say like, Hey, this is InfoSec. We're playing around. If you see this, let us know so we can talk about what's going on here. Within about 24 hours, Business Cat started making his way around the world. So obviously he started appearing in the Red Hat Tower in Raleigh, North Carolina. But Alison and Richard also started getting messages about Business Cats showing up in Brno, in the Czech Republic.
18:59 - Brent Simoneaux
19:00 - Johan Philippine
And in Brisbane, Australia.
19:03 - Angela Andrews
19:04 - Johan Philippine
Mm-hmm (affirmative). So after years of stalling, the challenge had finally been completed.
19:13 - Angela Andrews
19:16 - Brent Simoneaux
Wait what happened?
19:17 - Johan Philippine
They were hoping that people would start noticing and contact them right away. That's not really what happened. So people did start noticing it because it was all over the place. They’d talk about it and they'd be like, "is that Business Cat on the monitors? What's he doing up there? What's going on?" And they'd be sitting there in the cafeteria, just kind of hiding their faces and giggling into their coffees, playing innocent. It took about a week before someone…
19:47 - Brent Simoneaux
19:47 - Johan Philippine
... actually contacted InfoSec to be like, "Hey, do you know what's going on here? Why is Business Cat showing up on these slides? We don't think that that's normal."
19:56 - Brent Simoneaux
We don't think this is normal.
20:00 - Johan Philippine
At that point they say, "yeah, that was us. We had our little fun, but we've got some things we need to talk about."
20:05 - Angela Andrews
Wow. Okay. So they got Business Cat on all of the monitors, all over the world. That is such a feat…
20:14 - Johan Philippine
20:15 - Angela Andrews
...in and of itself. And what was their prize?
20:18 - Johan Philippine
They went to their boss who had issued the challenge and explicitly told them that they had to get it. It couldn't be just one monitor. It had to be done all over the world. So they were like, "Okay, well this is what you asked for. Here it is." And their manager said, "Okay, good jorb," which is another meme. And then they ended up getting a, I believe it was a gift card of some sort as a reward for their efforts. But...
20:46 - Angela Andrews
Job well done.
20:47 - Johan Philippine
... obviously this story and the street cred is much more valuable.
20:52 - Angela Andrews
I love this story.
20:56 - Brent Simoneaux
So today's question was: how can memes improve security?
21:01 - Johan Philippine
21:02 - Brent Simoneaux
Johan, what did you learn from this story?
21:05 - Johan Philippine
Well, I learned that you can get some Cats up on some screens at Red Hat and the whole system becomes a little bit more secure. Let me trace out the logic for that a little bit more for you.
21:17 - Brent Simoneaux
21:17 - Angela Andrews
Yeah. I'm sure people want to know what's the causality here, but yeah.
21:22 - Johan Philippine
Yeah. Alison and Richard took extensive notes about what they were doing and the ways in which they actually got into the system.
21:31 - Angela Andrews
Okay. They documented their procedure.
21:34 - Alison Naylor
I actually wrote a report with all the problems laid out.
21:36 - Johan Philippine
Alison and Richard shared their findings with the rest of the blue team at Red Hat so that they could patch these vulnerabilities. For those that weren't Red Hat's responsibility, they disclosed the rest of the findings to the vendor.
21:51 - Alison Naylor
We did responsibly disclose our findings to the vendor because we wanted to help them fix those issues and to prevent some bad actors from finding the same holes that we did. And kudos to them for listening and taking us seriously. On the Red Hat side, the problems were those basic ones, right? Like plain text, unencrypted password on the wire that we were able to intercept, using a very weak and easily guessed password. Some passwords hadn't been set at all in the newer equipment. So they still had the defaults that admin default set up.
22:20 - Angela Andrews
Always change the default password.
22:23 - Johan Philippine
22:24 - Angela Andrews
22:25 - Johan Philippine
That's one of the easiest ways for people to get in, is they just try the default administrative passwords and if you haven't changed them, then they just have access to the system. One corollary to that is to make sure that you're not transmitting those passwords even if they are changed in a way that people can read them.
22:44 - Angela Andrews
22:45 - Johan Philippine
22:47 - Angela Andrews
So using FTP is never good. Never good. If you're going to use FTP, then you use SFTP where passwords and things aren't going over in clear text.
22:59 - Johan Philippine
And the S in SFTP stands for?
23:01 - Angela Andrews
Stands for secure. There you go.
23:03 - Johan Philippine
There it is. That's lesson number one, is just be very careful with your password.
23:09 - Angela Andrews
Yeah. Password hygiene. Okay.
23:11 - Johan Philippine
Exactly. Step number two, is to make use of the principle of least privilege. I could describe what that is. Angela, would you mind giving us what that means to you?
23:25 - Angela Andrews
Sure. So, the principle of least privilege means, whatever user you are, you only have the privileges that you need to do your job. Everyone doesn't have to be root. You only get access to exactly what you need access to. So the principle of least privilege is, my account only gives me access to do the things that I only need to do, to do my job. Nothing more.
23:55 - Johan Philippine
23:55 - Angela Andrews
Nothing more. So least privilege.
23:58 - Johan Philippine
Not everyone needs to have root access, which is basically the permission to change everything on a machine. Now the third lesson is more of a human thing and that's not to bypass security features for convenience.
24:18 - Brent Simoneaux
Wait, what do you mean by that?
24:19 - Johan Philippine
So, say for example there's a security feature that's put in place that's meant to protect a system, but it takes some effort to get around it or to get through it, right? It's just another layer of something that you have to do. A lot of the times people will find that to be an inconvenience and they'll find a way to get around that or to ignore it, right? And at that point, you're leaving the door open for someone to actually go in and do what that security was supposed to protect against.
24:55 - Brent Simoneaux
This is like, when I leave my front door unlocked, when I walk my dogs.
25:00 - Angela Andrews
Yes, that’s… yes.
25:01 - Brent Simoneaux
Pretty much because it's really annoying, slight inconvenience, but I find it annoying.
25:08 - Johan Philippine
The one example that Alison put in her report is that.
25:12 - Alison Naylor
Through various parts of the system, they also used curl dash K, which is insecure mode, ignoring SSL. So we could have man-in-the-middled there as well.
25:22 - Johan Philippine
Those are the lessons, really high level lessons as to what not to do. But you might be wondering why is that important, right? Especially for a system of monitors and TVs in a Red Hat office.
25:36 - Angela Andrews
This is just the beginning.
25:38 - Johan Philippine
It's just the beginning. And even if you have access to just that system, there's still a lot of things you can do with it. And even though a Business Cat on screens is harmless, you can put things in front of people that aren't so harmless, like instructions to go to a certain website to fill out information, to update something for a made up…
26:01 - Brent Simoneaux
26:02 - Angela Andrews
26:03 - Johan Philippine
... work update, right? Say, Hey, everyone, you're supposed to go and update your profile and update all your personal information, and it turns out to be a malicious website. Then they start collecting all of this personal data about people from inside the company.
26:20 - Brent Simoneaux
I could also see, like a QR code or…
26:23 - Johan Philippine
26:24 - Angela Andrews
26:25 - Johan Philippine
26:25 - Angela Andrews
I'm thinking of a myriad of ways or things that you can put up on that screen that could be so detrimental to Red Hatters all over the world. Business Cat was very innocent, very cute, but it just shows the depths at which you could infiltrate and social engineer folks to do all kinds of things that they wouldn't bat an eye. It's up on the monitors in our office, of course it's legit, right?
26:57 - Johan Philippine
26:57 - Brent Simoneaux
It's not like a USB stick you found on the sidewalk.
27:00 - Angela Andrews
Exactly. It's not just one person picking it up and sticking it in their computer.
27:07 - Johan Philippine
Now I would like to reiterate at this point that it took multiple years of people kind of poking at the system before they found a way in. There's no such thing as a perfect unhackable system.
27:19 - Angela Andrews
27:20 - Brent Simoneaux
27:20 - Johan Philippine
But this one seemed to be fairly secure up until it wasn't. Right up until they found that one little inch that they broke into and then kind of shimmied their way into the whole system.
27:33 - Angela Andrews
But look at what they learned in the process, the report that Alison wrote, detailing the methods that she used to break in and get business Cat on there, the things that she saw and learned along the way.
27:47 - Johan Philippine
27:48 - Brent Simoneaux
Yeah. They definitely learned a lot, but Johan, I'm curious about our original question. How can memes improve security? So I'm kind of curious how you're thinking about that.
28:00 - Johan Philippine
Are you not entertained? We've been talking about all these vulnerabilities that the blue team discovered, right? And I'm going to argue that it's thanks to the memes that these got found at all. I'm not sure that this challenge would've been completed, if it hadn't been for that meme element. If Alison and Richard had just been given a challenge to break into the system, it wouldn't have been as fun, right? There's that little element of mischief, that element of humor that I really think gave them the motivation to see it through. So I'm sitting here with my mug of tea, alone at my table, and I'm proclaiming that memes can be a fantastic way to find security vulnerabilities. Change my mind.
28:45 - Angela Andrews
And that does it for this episode of Compiler.
28:53 - Brent Simoneaux
Today's episode was produced by Johan Philippine and Caroline Creaghead. Victoria Lawton is always monitoring our work for shenanigans.
29:04 - Angela Andrews
I love her for it. Our audio engineer is Elisabeth Hart. Special thanks to Shawn Cole. Our theme song was composed by Mary Ancheta.
29:14 - Brent Simoneaux
Big thank you to our guests, Alison Naylor and Richard Monk for sharing the story of Business Cat’s big day at Red Hat.
29:22 - Angela Andrews
Our audio team includes Leigh Day, Laura Barnes, Claire Alison, Nick Burns, Aaron Williamson, Karen King, Boo Boo Howse, Rachel Ertel, Mike Compton, Ocean Matthews, and Laura Walters.
29:37 - Brent Simoneaux
If you liked today's episode, please follow the show, rate the show, leave a review, share it with anyone you know. It really does help us out.
29:49 - Angela Andrews
It sure does. Thank you so much for listening. We'll see you next time.
29:52 - Brent Simoneaux
All right. Bye everybody.