Speaker 1: Do you want to be an American idiot?
Speaker 2: Go building one to night? Do you see lost on
Speaker 2: Saturday or won on Saturday? The loss today on the Loss,
Speaker 2: of course, is Jim Kelly Junior passing away at seventy two.
Speaker 1: I've been fighting cancer a long time.
Speaker 2: I was enjoyed listening to Jim along with Dan Horde
Speaker 2: for what the last twenty years as the color analyst
Speaker 2: for the UC Bearcats, and just so sad to hear
Speaker 2: because he's such a good guy. But our thoughts in
Speaker 2: pairs with that Jim and his family, everyone in the
Speaker 2: in the Bearcat family as well. Sloane here on seven
Speaker 2: hundred WLW. If you watch the Bengals last night, lose
Speaker 2: but lose in a better way?
Speaker 1: Typic whatt you dose?
Speaker 2: You hang on for a minute before you cut over
Speaker 2: to NBC and watch our boy talk about well last
Speaker 2: night's gale. I didn't say I've watched the whole thing
Speaker 2: in Kansas City wind up winning last night, But you
Speaker 2: watch sixty minutes on CBS and you always catch like
Speaker 2: the first couple of minutes. I thought last night they
Speaker 2: had a fascinating story on about China Our front of me.
Speaker 2: China has infiltrated some two hundred critical infrastructure operations in
Speaker 2: the US water treatment plants, electrical grids, transportation, hospitals, telecommunications.
Speaker 2: Pretty scary stuff that the incursions, these intrusions have been
Speaker 2: going on for a while now and we haven't done
Speaker 2: anything about it. Why because we're getting intel on what
Speaker 2: the Chinese may or may not do as they can
Speaker 2: control some of our critical infrastructure. We've talked about this before,
Speaker 2: but I think when you start to hear two hundred
Speaker 2: or more facilities in America could be under Chinese control
Speaker 2: in a couple of keystrokes, that is a huge wake
Speaker 2: up call, going, what if they're doing this on sixty minutes?
Speaker 2: We know the government's known about it for a while,
Speaker 2: and we're allowing this to continue. And what happens in
Speaker 2: the future on that is that Chris niheis. Chris is
Speaker 2: the CEO of Vigilant Cybersecurity here in Cincinnati. Chris, welcome back,
Speaker 2: are you Hanks?
Speaker 1: Scott? I'm doing great one.
Speaker 2: I'm well till I saw this thing last night after
Speaker 2: football lost. I'm like, well, wait, what's going on here?
Speaker 2: So the idea here is that China is lying dormant
Speaker 2: in two hundred these things, and I think it was
Speaker 2: like a small some small town in Massachusetts.
Speaker 1: I forget where that it turned out.
Speaker 2: The FBI shows up and tells the operator, the guy
Speaker 2: who's in charge of it, Hey, listen, the Chinese have
Speaker 2: taken control of your facility. You don't know that, but
Speaker 2: the Chinese have digital control of your facility. So we
Speaker 2: know that everything now is plug and play, and it's
Speaker 2: the Internet of things, and everything is controlled remotely and electronics.
Speaker 2: And so before we branch off into what they're doing
Speaker 2: and how they're doing it, a water treatment plant, what
Speaker 2: could go wrong if the computers are under control of
Speaker 2: the Chinese and a water treatment.
Speaker 3: Plant rights the Littleton, Massachusetts, and a lot can go wrong. Actually,
Speaker 3: I mean inside these water treatment plants, you have different
Speaker 3: vats of chemicals. Those chemicals are mixed together in different
Speaker 3: varying levels. You have fluoride, you have all coins of
Speaker 3: different things in there, chlorine, Those are mixed together very
Speaker 3: precisely to make sure that the water that we drain
Speaker 3: is clean, purified, it's refreshed when it gets to us.
Speaker 3: If those systems, or the chemical interactions or even just
Speaker 3: the mounts, the measurements are put into water differently.
Speaker 1: It could be catastrophic.
Speaker 3: It can make our water undrinkable, untenable, it could be
Speaker 3: it could make poisonous.
Speaker 1: There's there's a lot.
Speaker 3: Of different things that can happen inside a water treatment plant.
Speaker 2: And that's just a small time. But imagine the masses
Speaker 2: steria of a town of I don't know if that
Speaker 2: ten twenty thousand people, if all of a sudden, your
Speaker 2: water's poisonous, and we would know it because they program
Speaker 2: everything to make it look like the tests are fine.
Speaker 2: I don't know if they do physical manual tests and
Speaker 2: how often they do that. I don't know the workings
Speaker 2: of water treatment BLA. I would think so that somebody's going, hey,
Speaker 2: there's something with the right but it'd be too late
Speaker 2: for some people who are drinking poison water.
Speaker 1: That would be way too late.
Speaker 3: And then the problem with the two is, I mean,
Speaker 3: if you look at the way water works. We pump
Speaker 3: water into our water towers, that creates water pressure into
Speaker 3: our cities, but you'd have the entire system would be contaminated.
Speaker 3: And you know, it just makes even if even if
Speaker 3: no one drank it, even if the system was contaminated,
Speaker 3: you have you have a major problem. And to your point,
Speaker 3: you know they're doing so much automation now, Uh, you
Speaker 3: know all all of the chemical you know, the chemical measurements,
Speaker 3: the purification, it's.
Speaker 1: All, it's all automated. Uh.
Speaker 3: The testing is mostly automated. They do spot checks and
Speaker 3: things like that. But there's sensors throughout the entire line
Speaker 3: that determine tempature. It determines, uh, if there's different chemicals.
Speaker 3: I mean, you've even seen recently where they can see
Speaker 3: if COVID is spiking up inside Uh, you know, different
Speaker 3: cities because of what's coming in to the waste treatment plants.
Speaker 3: So there's there's a lot of different sensors there. But
Speaker 3: but like you said, those sensors can be modified so
Speaker 3: that that way it gives incorrect information and then people
Speaker 3: don't know.
Speaker 1: You know, the monitors aren't going to trigger off that something.
Speaker 2: You can make boiling water look like it's freezing water
Speaker 2: based on what the what the what the sensors on
Speaker 2: and reprogram all that stuff, and no one or know
Speaker 2: until that's all sadly too late and you gotta shut
Speaker 2: them and I don't figure out what's happening. And that's
Speaker 2: just in one small town in Massachusetts, and then there's
Speaker 2: at least one hundred ninety nine others and other water
Speaker 2: treatment plants, but electrical goods, transportation, hospitals, all these things
Speaker 2: I mentioned. And what's interesting about it is there they
Speaker 2: said there's about two hundred that they've identified since twenty
Speaker 2: twenty three. I suspect, like anything, the two hundred the
Speaker 2: most obvious ones. How many more do you think I
Speaker 2: are out there?
Speaker 1: Oh?
Speaker 3: I would say in every critical city, we work a
Speaker 3: lot in critical infrastructure. A lot of my background is
Speaker 3: in critical infrastructure. And you know, even back in the
Speaker 3: early two thousands, I was working with COMMONI control systems
Speaker 3: and you could see that those systems were trying to
Speaker 3: be attacked.
Speaker 1: And I would say.
Speaker 3: That was my wake up call, that you know, that
Speaker 3: wake up call. But at the moment I realized how
Speaker 3: evil this could be because in those situations, what we
Speaker 3: were seeing is someone attacking back then our Windows ninety
Speaker 3: five systems, and they were back in these really old
Speaker 3: operating system it was, you know, not old at the time,
Speaker 3: but these systems were connected to these valves that could
Speaker 3: you know, from the system, you could open a valve
Speaker 3: and it would be a release valve. And you could
Speaker 3: release ammonia or an ammonia actually can melt people's lungs.
Speaker 3: So you know, when I saw that happen, like whoa
Speaker 3: wait a second. And that's what really made me get
Speaker 3: into this industry because for me, it's about making sure
Speaker 3: that we protect the United States right, and one of
Speaker 3: the things we have to be really aware of is
Speaker 3: that we're not doing a great job of it because
Speaker 3: they're everywhere so well.
Speaker 2: The problem is this, right, we have decentralaw Unlike China,
Speaker 2: everything's centralized in China. Here it's decentralized. So you've got
Speaker 2: small municipalities, and I'm guessing that a lot of these
Speaker 2: two hundred chris are small municipalities that don't have the budget.
Speaker 2: And you know, fifty grand to them may not be
Speaker 2: a lot to the state of Ohio or the United
Speaker 2: States of America, but fifty grand to a small community
Speaker 2: is a lot of money. That's what it costs us
Speaker 2: one small town to redo all their infrastructure to essentially
Speaker 2: make what the Chinese did moot. And on top of that,
Speaker 2: you know, paying for new equipment and getting taxpayers to
Speaker 2: put the money for the latest and greatest servers and
Speaker 2: technology isn't always an easy sell. People don't make that
Speaker 2: connection until while it's too late. We don't want to
Speaker 2: spend that time. Why are we spending more money? We
Speaker 2: just updated these computers and our systems have been updated,
Speaker 2: and we don't need to do that anyway. Why are
Speaker 2: we spending so much on people, like, for example, the
Speaker 2: contract with Vigilant Cybersecurity. I mean, that's a huge cost
Speaker 2: item right there, and so we tend to cut away
Speaker 2: all of that help and all those people in safety
Speaker 2: Net and then something like this happens and we want
Speaker 2: more of it.
Speaker 1: Right.
Speaker 3: Well, see, here's the problem is that I'll make some
Speaker 3: bold statements here. You know, we talked about before you
Speaker 3: got to wonder you know why. You know, like the
Speaker 3: average time it takes to detect the threat U Riising
Speaker 3: comes out with report every year. It's a great report.
Speaker 3: But the average time it takes the detective threat today
Speaker 3: someone comes into your environment. The average time it takes
Speaker 3: for most cybersecurity technologies, right, this is the average, right,
Speaker 3: two and eighty seven days.
Speaker 1: Right.
Speaker 3: And so the biggest problem is that a lot of
Speaker 3: companies are buying technology that seems to work because it's
Speaker 3: a brand name we're a big no name, but it
Speaker 3: doesn't actually do what it's supposed to, and so you
Speaker 3: end up with the attackers and these environments that are
Speaker 3: there forever, and what they really want to do in
Speaker 3: any warfare scenario is they want persistence. So what happens
Speaker 3: is these attackers come in, they trigger an event so
Speaker 3: that your security systems see it, you go do an
Speaker 3: instant response. But what they're really doing is they're embedding
Speaker 3: themselves for persistence for later while they're triggering a fake incident,
Speaker 3: right or a real incident that you go work. The
Speaker 3: second problem is that companies, you know, use their security technologies.
Speaker 1: That they use as badges, and the security companies that
Speaker 1: work with them also use them as badges.
Speaker 3: So what I mean by that is, you know, they'll
Speaker 3: put their logos up on their Webb site, they'll you know,
Speaker 3: the security.
Speaker 1: Providers will do that. So that tells you the hacker.
Speaker 3: Exactly what technology is used. And then the third thing
Speaker 3: that happens, especially in these municipalities, is when they're buying things,
Speaker 3: they're buying things under committee or approval with their cities municipalities,
Speaker 3: and so those are all open meetings. And so if
Speaker 3: I'm a Chinese threat actor, I can come in, I
Speaker 3: can know exactly. I mean, in the state of California, you.
Speaker 1: Can go out. There's a law that requires them to
Speaker 1: do this.
Speaker 3: It lists everything any city, every single technology they buy
Speaker 3: was from a cyber standpoint, is on a list, so
Speaker 3: they can an attacker can easily go to water treatment
Speaker 3: plant see exactly what they use, and they just they.
Speaker 1: Just know how tottack them. So you wrap all that up.
Speaker 3: And I think here in the United States we don't
Speaker 3: understand warfare in the private sector very well. And in
Speaker 3: China they do, and in Russia they do. Outside US
Speaker 3: they do. We just don't understand it here because we
Speaker 3: you as citizens, are so comfortable with not interfacing with evil, right, well.
Speaker 2: Because we are commerce right and some small businesses. We're
Speaker 2: business people, so we understand that. We don't see that.
Speaker 2: As you know, there's competition, but not in the arena
Speaker 2: that the Chinese do because of that centralization element too.
Speaker 2: And so Chris ninehis is here CEO of vigil and Cybersecurity,
Speaker 2: in the sixty minutes thing last night, that there's some
Speaker 2: two hundred plus critical infrastructure operations. We're talking electrical, we're
Speaker 2: talking water, treatment plants and the like that essentially are
Speaker 2: under Chinese control. And so what they did is they've
Speaker 2: infiltrated that infrastructure and now they're just laying dormant. They're
Speaker 2: not shutting it down like some I don't know if
Speaker 2: you're if you have malware, which we've talked about before
Speaker 2: in the past, right, you shut them down Cattering Health
Speaker 2: for example, pay me my money and I'll open everything
Speaker 2: back up. Or maybe not, some other actor gets in
Speaker 2: there and just wants to be disruptive and destroy things
Speaker 2: and shut it down and put some sort of political
Speaker 2: or anti state message on whatever it might be. We've
Speaker 2: seen that this is different. They're actually lying in wait.
Speaker 2: It's like a trojan horse. They're watching what you're doing online.
Speaker 2: They're watching the systems that you have in place, and
Speaker 2: in the future if they need to, when they need to,
Speaker 2: when they will, they will strike by doing all the
Speaker 2: stuff we talked about and multiply that by hundreds more.
Speaker 2: And you've got real problems here in America that they're
Speaker 2: sitting there just watching and wait and lying dormant and
Speaker 2: our own infrastructure and most of us have no idea
Speaker 2: they're there.
Speaker 3: Yeah, right, And the reason you know you and you know,
Speaker 3: we don't know all the details of Littleton, but you know,
Speaker 3: we spent fifty thousand dollars to rebuild his network. I
Speaker 3: would say he didn't really He may not have actually
Speaker 3: even had to do that if he had.
Speaker 1: The ability to see what was what.
Speaker 3: Was embedded as in this environment, you don't have to
Speaker 3: swap out all of your systems, but if you don't
Speaker 3: have the ability to see what's there, then you do.
Speaker 1: You have to start all over.
Speaker 3: But the big problem there is he may not know
Speaker 3: how they actually got in, so he may have just
Speaker 3: rebuilt his entire environment. And this happens with a lot
Speaker 3: of companies. I'm not saying that Littleton did this, but
Speaker 3: they'll rebuild their whole environment. They don't know exactly how
Speaker 3: they actor got in, and then they get in again,
Speaker 3: and they just wasted all that money.
Speaker 1: Yeah, you know. And yeah, right.
Speaker 3: The other thing too, Scott, that happens and this is
Speaker 3: this happens with a lot of our power generators. A
Speaker 3: lot of those does come from China. Right, They have
Speaker 3: about you know, the transformers, things like that. They have
Speaker 3: a year and a half way time to get those.
Speaker 3: We've already found you know, when they when those things
Speaker 3: have come in. Not we vigilant, but you know particularly
Speaker 3: but you do. It's government has found that there's malware
Speaker 3: inside the systems already, right, Uh, just straight out, straight
Speaker 3: straight coming over.
Speaker 1: So the thing that.
Speaker 3: We we just have to be a lot more aware
Speaker 3: of is that, uh, you know, we're going down a
Speaker 3: path that we have.
Speaker 1: All these back doors in a critical coming instruction.
Speaker 3: Now I'll say this, now we have that as well, right,
Speaker 3: so you know, we do the same thing around the world,
Speaker 3: you know.
Speaker 1: And that's why I went here, is like, well we're
Speaker 1: doing it too, but it doesn't make it better, no, no,
Speaker 1: because I get it. On our side. Yeah, I think
Speaker 1: for us to be embedded over there, totally get it.
Speaker 1: We want to.
Speaker 3: It's like an arms race, right who could be embedded
Speaker 3: the most because in any case, it's whoever can hit
Speaker 3: the button first, right, and and and there's a couple
Speaker 3: of different things that can take place in that. But
Speaker 3: the big thing is to realize is that you know, this,
Speaker 3: this is a this is the hidden war, and cyber
Speaker 3: warfare has already happened. We're already in that, but you know,
Speaker 3: most of us don't realize it. And in the critical
Speaker 3: infrastructure world or even the you know, the small business
Speaker 3: meetium sized business world. In the United States, it makes
Speaker 3: up like eighty percent of our financial postability here in
Speaker 3: the US. And so you know, if you want to
Speaker 3: take out hospitals, go and bed yourself in hospitals. You
Speaker 3: want to take out water, go and bed yourself in water,
Speaker 3: You want to take out the financial sex to the
Speaker 3: United States, go after small medium sized businesses that normally
Speaker 3: don't have the protection they need, right right, And then
Speaker 3: you just took down the entire country.
Speaker 1: And you do it with some keystrokes. You don't fire
Speaker 1: one shot, but you do it via computer.
Speaker 2: So we had two hundred of these infrastructure operations that
Speaker 2: were compromised, right, and now it's on sixty minutes. And
Speaker 2: I'm guessing that the Chinese have known that, We've known
Speaker 2: about this for a while before it gets on sixty
Speaker 2: minutes for sure, right. So, yeah, in the month, in
Speaker 2: the months that that's happened, where our years even where
Speaker 2: they're exposed that and moved, what's that? What's happening right
Speaker 2: now as we speak? Then more of the same, less
Speaker 2: of the same or a different same.
Speaker 3: Oh, it's more the same, Yeah, I mean it's you know,
Speaker 3: the yeah, it just it just continues on and inside
Speaker 3: these environments, that's where work happens. We found this was
Speaker 3: a couple of years back, we found a Chinese threacture
Speaker 3: group that bounced through United States entity out to another country, right,
Speaker 3: And what they're trying to make it look like is
Speaker 3: that the attack was coming from the United States.
Speaker 1: To that other country.
Speaker 3: So the you know, you have that issue as well
Speaker 3: is where you know, China will act like Russia, russiall
Speaker 3: act like China ran axt right like Russia. You know,
Speaker 3: you're trying to really tie it back to whoever is
Speaker 3: actually really attacking. But the big key here and you
Speaker 3: mentioned as well, you mentioned kettering health. Right, We've seen
Speaker 3: significant aspects where malware is you know, in ransomware is
Speaker 3: used to come into an environment, create a distraction, and
Speaker 3: then allow people to be embedded. And most, like I
Speaker 3: was saying, most security technology out there is built to
Speaker 3: detect things that it knows about, not to always detect
Speaker 3: things that are unknown. So if you can attack someone
Speaker 3: embed yourself in a way that isn't known yet or
Speaker 3: isn't detectable yet, you can hide and wait and especially
Speaker 3: if it's like a you know, in a triggered thing
Speaker 3: that's based on a timer, like maybe that connection reaches
Speaker 3: back out every month or every two months.
Speaker 1: You know, it's a.
Speaker 3: Single ping in the midst of millions of connections. It's
Speaker 3: really hard to find. So, you know, a lot of
Speaker 3: the ransomware or malware, those are the things like if
Speaker 3: you're in an organization you've had ransomware or malware, just
Speaker 3: fighting that is not the end of your battle. You
Speaker 3: now have to comb through your infrastructure and find out
Speaker 3: is there a back door that was put in during
Speaker 3: that attack, because you know, ransomware, like I said, is
Speaker 3: being used a lot. Is just that distraction now and
Speaker 3: you know and also too it's funding terrorism. You know,
Speaker 3: they just put these groups do they come in, they
Speaker 3: do ransomware, they fund terrorism, they create a backdoor and
Speaker 3: now they're embedded.
Speaker 2: And they'll be to continue can and mouse game like this.
Speaker 2: And in the fear of course, is one day if
Speaker 2: we are at odds and a war with the Chinese
Speaker 2: or whatever transpire, they can shut down a significant portion
Speaker 2: of what it is we have our infrastructure and if
Speaker 2: you tease will they be able to execute that plan?
Speaker 3: I mean I think we're already seeing some of that.
Speaker 3: I think Colonial Pipeline was a good example of that.
Speaker 3: You know a few years ago, and I talked about that,
Speaker 3: you know, or you know, there's there's inside of these pipelines,
Speaker 3: there's sensors. You can take over the sensors, you can
Speaker 3: heat them up and explode the pipeline. Uh, you know,
Speaker 3: like I said earlier, among control systems, water water treatment plants.
Speaker 1: I think when we when we see these.
Speaker 3: Isolated attacks, you know, quote unquote isolated attacks, I think
Speaker 3: that those are just tests, right.
Speaker 1: I think they're hey, how far can we go? Right?
Speaker 3: I mean we and again you see those things happening
Speaker 3: around the world. I think we do our own tests also,
Speaker 3: you know, uh, you know, but you know, and it's
Speaker 3: just to show each other, Hey, I'm here and I
Speaker 3: can do that. But I think in the United States
Speaker 3: we have to be much more careful and aware that
Speaker 3: just putting the security technology in doesn't mean that it's
Speaker 3: going to find what we're actually looking for. And we
Speaker 3: have to be much more educated as business owners into
Speaker 3: what is really coming in our environments, especially if we
Speaker 3: support companies like a General Electric you know, if you're
Speaker 3: a city if you're a community a business here in
Speaker 3: Cincinnati that supports general electric, highly likely you're going to
Speaker 3: get attacked before they will, because they'll try to come
Speaker 3: through you to get to them, right. Uh you know,
Speaker 3: especially if you're an HVAC company or you're a you know,
Speaker 3: you're you're you're, you're, you're building plans for them, you know,
Speaker 3: to build out a facility or whatever. Highly likely you're
Speaker 3: you're going to get attacked. If you are a business
Speaker 3: that creates a part for you know, a defense industry
Speaker 3: or for uh parttery gamble, right, that's really critical to
Speaker 3: their system, chances are you're.
Speaker 1: Going to be attacked and and so got it. You
Speaker 1: have to be a lot more hyper aware. You know
Speaker 1: that that what?
Speaker 2: Yeah, So he's Chris n Ihi, CEO of since Today
Speaker 2: Based Vigilant Cybersecurity. Go to the CBS or sixty minutes
Speaker 2: so you can watch this whole piece. It really is fascinated,
Speaker 2: uh in how embedded the Chinese air system? Chris, all
Speaker 2: the best, thanks again, thank you, Scott. All right, being well,
Speaker 2: got to get the news running late. Just a few
Speaker 2: minutes away. We got Julie Age mental health Monday here next.
Speaker 2: If you're a procrastinator. She's going to be talking about
Speaker 2: you and to you. Just ahead on seven hundred WLW