The Host Unknown Podcast - Episode 104 - The Late Late Show

Episode Date: May 21, 2022

This Week in InfoSec (07:03)With content liberated from the “today in infosec” twitter account and further afield15th May 2003: In the Friends episode "The One in Barbados, Part One", Ross Geller's laptop was infected by the Kournikova worm when Chandler Bing checked his email on it and opened an email claiming to contain nude images of tennis player Ana Kournikova.https://twitter.com/todayininfosec/status/1523719745555648514 Rant of the Week (09:34)Department of Justice Announces New Policy for Charging Cases under the Computer Fraud and Abuse ActDOJ says it will no longer prosecute good-faith hackers under CFAAThe U.S. Justice Department announced Thursday it will not bring charges under federal hacking laws against security researchers and hackers who act in good faith.The policy for the first time “directs that good-faith security research should not be charged” under the Computer Fraud and Abuse Act (CFAA), a seismic shift away from its previous policy that allowed prosecutors to bring federal charges against hackers who find security flaws for the purpose of helping to secure exposed or vulnerable systems.The Justice Department said that good-faith researchers are those who carry out their activity “in a manner designed to avoid any harm to individuals or the public,” and where the information is “used primarily to promote the security or safety of the class of devices, machines, or online services to which the accessed computer belongs, or those who use such devices, machines, or online services.” Billy Big Balls of the Week (17:05)National bank hit by ransomware trolls hackers with dick picsAfter suffering a ransomware attack by the Hive operation, the Bank of Zambia made it clear that they were not going to pay by posting a picture of male genitalia and telling the hackers to s… (well, you can use your imagination).Last week, the Bank of Zambia, the country's central bank, disclosed that recent technical outages resulted from a cyberattack."The Bank of Zambia wishes to inform members of the public that it experienced a partial disruption to some of its Information Technology (IT) applications on Monday 9th May 2022," disclosed the bank in a press release."The disruption, which affected some systems at the Bank such as the Bureau De Change Monitoring System and the Website, emanated from a suspected cybersecurity incident. We wish to advise that these systems have since been fully restored." Industry News (20:50)Doctor Accused of Being Prolific Ransomware DeveloperUS Government Warns Firms to Avoid Hiring North Korean IT WorkersPolice Warn of £15m Courier ScamsDigital Skimming is Now the Preserve of Non-Magecart GroupsUK Government: Lack of Skills the Number One Issue in CybersecurityJav: Personal Information of Nearly Two Million Texans ExposedHalf of IT Leaders Store Passwords in Shared DocsMicrosoft President: Cyber Space Has Become the New Domain of WarfareCISA Issues Emergency Directive for VMware Vulnerabilities Tweet of the Week (26:16)https://twitter.com/haveigotnews/status/1526505336017936384 Come on! Like and bloody well subscribe!

I know you guys are getting old by the, you know, you're taking a bit to heart by saying there's no time left. Yeah, well, there isn't. I've got to cut off in 45 minutes. We need to get this stuff done. Ah, it's OK. I'm sure Andy has as well in his new job. I do.

It's going to be in 45 minutes, it's going to be half eight, my first meeting starts, so we need to speed this up. The tea needs to be made. You're listening to the host unknown podcast right that'll do hello hello hello good morning good afternoon good evening from wherever you are joining us and welcome to episode 104 ish of the host unknown podcast it's been 104 for the last six weeks the fastest podcast you'll listen to this week. Yes, we are up against it this morning. We've all got, well, two of us now have proper jobs,

so we've got meetings and everything and then Jav. I've got an idea, Tom. How about we record this in two times speed? Yes. Then we can do a full show. We'll just do it quicker. Well, actually, I haven't got the tech to do it in two times speed so if we all speak like we're alving the chipmunk then it's the same thing right is

this a time we break out that that special supply you sent us andy to get us like speeded up guys take vitamin tablets labeled emergency use only now and the gummy dildo yeah called Emergency Use Only Now. And the gummy dildo, yeah. That'll make me talk fast. Oh dear. Gentlemen, how are we this morning? Jav, how are you?

Fantastic. And as you know, we actually got to meet in person on Monday. We did. Tuesday. Up on the Edgware Road. I mean, Andy was invited, but apparently yeah i like that i was actually invited like well you guys were actually there already right you're like oh yeah by the way shit andy no no no no that's lies lies lies you were invited well in advance yeah yeah i was invited on the monday i'm really busy i'm out out Monday, Wednesday and Thursday.

And we were going out Tuesday. So it was fine. But apparently you've got new friends now in your new job. I was actually seeing old friends from the old job most of the week. So what category do we find? You're somewhere between acquaintances and uh people that wind me up i will always think of you both as people i once knew yes who are you guys what are you doing on my podcast anyway yeah we had a great talk we had a we had a lovely uh you had a chicken shawarma, as I recall. Yes, yes. A bit of shisha. And yeah, it was good.

It was so good. I went there the next day as well. I took an American friend who's in town, I took him there. Did he think you were really cultured? Yeah, exactly. You knew all the locals then, like. He did. You know, the waiter was like hello sir how are you

oh dear didn't get the america then the american guy get freaked out that they were um you know foreigners serving you surrounded by you laugh but uh. But otherwise, how has your week been, Jav? Yeah, it's been good. It's been great. You know, seeing you two stressing out about your new jobs makes me feel so good. You're getting comfortable, Jav. That's the issue.

We are having flashbacks. There's the man who changed jobs after 17 years yes i've only been there three years though like you know i'm not that comfortable and andy how's your week been good i uh i'll be honest i'm feeling a little bit hung over this morning it's been a bit of a struggle i'm not used to drinking and uh we went to a very nice restaurant last night in Mayfair. Ooh, which one? Celebrated the last couple of years of investments that have been made in my previous role.

So it's a restaurant called Hush. You sure that's a restaurant? Yeah, well, do you know what? Sounds like somewhere else. It was opposite a Victoria's Secret, which was interesting. Yeah, who sell terrible underwear, apparently. I wouldn't know. I haven't, yeah, I don't think they do my size, which is why I've never worn them.

I read a BuzzFeed article. Okay, of course. What can I say? How was your week? Yeah, good, good. Very busy as usual. Although, although I did attend the Lloyds Rugby Sevens tournament yesterday, which was good fun. Ah, you're properly getting back out into the CISO world.

Oh, I know. I know. But... Corporate hospitality is flowing. Yeah, exactly. Exactly. But they had all, you know, it was, it was, um, at the sort of little, uh, you know, temporary, I want to say tent things, but they're not. But they had rows and rows of them because there were loads of teams playing because they're teams from all of the, you know, insurers and underwriters and all that sort of stuff.

And I was the only one from the company who actually went into the grandstand to watch some of the rugby. Everybody else was schmoozing and boozing, you know. But, yeah, it was good. It was good. I came across some people who lived in Dover at the same time I was there at school and at the same age as well. So we realized we probably crossed paths a couple of school dances you know and things like that which is really funny um yeah but uh and then really busy

today so uh yeah i'm just going to warn everybody in advance that you won't get this until quite late on friday if that's okay yeah so everyone's okay with that. Yeah, yeah. Well, they're forewarned now, right? Yeah. If you disagree, say nay. Yeah. Speak up now or forever hold your peace. And they can work around it. Yeah, okay. The yays have it.

Let's continue. Yes, indeed. Indeed. So, yes, we're all stressed apart from Jav, who's just cruising. But aside from how stressed we are, let's see what we've got coming up for you this week in this week's Really Short Show. This week in InfoSec highlights a plot hole. Rant of the week. Won't somebody think of the researchers? Billy Big Balls is a story about the organ that is attached to said Billy Big Balls.

Billy Big Balls is a story about the organ that is attached to said Billy Big Balls. Industry News brings us the latest and greatest security news stories from around the world. And Tweet of the Week is a piece of advice for Elon Musk. And with that, we shall go straight on into our favourite part of the show, the part of the show that we like to call This Week in InfoSec. It is that part of the show where we take a stroll down InfoSec memory lane with content liberated from the Today in InfoSec Twitter account.

And our first and only tweet, our first and only story this week is from the 15th of May, 2003, which is only a mere... Do the maths. In the Friends episode, the one in Barbados, part one, Ross Geller's laptop was infected by the Kournikova worm

when Chandler Bing checked his email on it and opened an email claiming to contain nude images of tennis player Anna Kournikova. And whilst this was very much a real virus at the time and very topical, the version of the worm in the episode was obviously more malicious than the real thing. So it actually deleted his entire hard drive, including the speech on paleontology, which is what he was there to do. But moreover, the computer was actually a PowerBook G4. And of course, the anacornicova virus was a Windows targeting malware.

So it would not be compatible. So minor plot hole uh in that one but uh you know this is how it was 19 years ago wow you know anna kornikova is now 40 years old she's born in 81 i cannot believe it older than me i can't believe that wow time flies but yeah she's still still married to Enrique Iglesias Good goalkeeper Yes So let's keep the football references out of this, Andy Yeah, always a good one

Always a good one to go back to some of the old school worms Back when virus researchers were true gentlemen As Graham Cooley used to say. And thank you. That was this week's... This week in InfoServe. You're listening to the award-winning Host Unknown podcast.

Officially more entertaining than smashing security and from time immemorial we've always moved on to this one next so we're straight on to this week's listen up rent of the week it's time to mother rage so as we, security researchers have been doing a world of good, to be honest with you, since, well, for many, many years, for a good few decades. These are people who are actually, who responsibly disclose vulnerabilities because they enjoy and they value the contribution they can make as they go around websites, they go around applications and check to see for vulnerabilities and things like that. And then they disclose them to the organization themselves in an attempt to get said vulnerability fixed. And in many cases, a lot of these researchers will either do it out of the goodness of their heart. This may be a side hustle. It may be, you know, a hobby, etc. Or even take very, you know, just some kind of either recognition or even, you know, just a bit of company swag or something and something, you know, a thank you very much.

swag or something and something, you know, thank you very much. On occasion, and this has been formalized in recent years, on occasion, they will request a bug bounty. And in fact, now many companies are doing bug bounties, which basically means they've got a program that if people find vulnerabilities in their code and in their systems, they will pay those researchers according to the severity and the uniqueness, etc. So Apple have a bug bounty. I think Microsoft have a bug bounty. And I believe wasn't a young researcher paid something like $100,000 or $150,000 by Apple for finding a flaw in one of their systems fairly recently? a flaw in one of their systems fairly recently. So there's been a, let's say an uneasy sort of arrangement between companies and security researchers. No more uneasy than with the Department of Justice, the US Justice Department. with the Department of Justice, the US Justice Department.

And this is because they had, up until now, a policy that they would charge security researchers under the Computer Fraud and Abuse Act. And we saw this recently when a journalist was identified and was arrested and prosecuted for... Viewing source. Yeah, viewing source code on a website, for instance. Although, as it turned out, the person who decided to press charges was actually responsible for the department

that ran the very, very poor code in the first place. Anyway, so they will, you know, well, like all good Americans, you like to sue at the drop of a hat, don't you, chaps? So the US Justice Department. Objection, one of us, libelous. Yeah, well, allegedly. So I heard from a friend. So Andy told me the other day.

So the US Justice Department, you know, as soon as they suspect something like this has happened, even if there's been no malicious disclosure, even though there's been no actual sort of exfiltration of data, et cetera, et cetera, will still bring charges under the Computer Fraud and Abuse Act, which is terrible. It puts people off. It actually reduces security for the industry. It criminalizes an activity that actually can bring huge benefits to the world. Until very recently, the Department of Justice has said it will no longer prosecute good faith practice, good faith hackers under the Computer Fraud and Abuse Act. Well, blimey, talk about, you know, bolting the door after the horse has bolted. No, locking the door after the stable door after the horse has bolted. It's like 20 years too late. I mean,

it's good. It's good that it's happened. Don't get me wrong. But why are they so behind on this? And it seems like that the viewpoint of many lawmakers and we covered this a little while ago where we find that, you know, rapists and murderers may get away with, you know, 20 years or whatever behind bars. 20 years or whatever behind bars. And yet if you if you press a button and, you know, help out on a distributed denial of service attack, you face up to 99 years in prison, which is totally insane. And so this this sort of high level persecution of security researchers, and not only that, but good faith security researchers. And you can, you know, it doesn't take a genius to work out, you know, who's a good faith researcher and who's, you know, a bad actor, as it were. So it's, and in fact, even the Justice Department have their own definition of this now, those who carry out their activity in a manner designed to avoid any harm to individuals or the public. Well, we could have told them that 20 years ago, right?

This is ridiculous. So, yeah, I'm going to cut this one short because. Wow. Oh, so thank God you're cutting this short. I'd hate to hear the long version. Never in the history of podcasting has someone said so many words to say absolutely nothing. I wouldn't say nothing. I've said,

I've said that this is outrageous and it's 20 years too late. I don't know, man. Like, this is like, how can you tell someone's intention? I think that's the biggest. It's just a prank,

bro. No, it's by their actions. You know, I you know i i can't exfiltrate exfiltrate data and say just a prank bro you've actually exfiltrated my my intention is to avoid any harm to individuals or the public i just want an extra 200 grand in my bank account what that makes no sense exactly and that's that's how lawyers are going to get you in a in a in a in a twist when you're on on the stand and uh you're going to be like but what that doesn't make any sense and then you're going to start crying like amber heard so what you're saying is oh oh see you

you know you're victim blaming again here great so so you believe that amber is the victim here so so why did we even go to court because like tom knows the outcome already i don't know the outcome i think they're both horrible people oh so now you're calling people horrible he'd never met never interacted with yeah just seen a few movies and now you're an expert on human behavior horrible before i met you i called you horrible because i saw your presentation anyway uh that was this week's rant of the week this is the host unknown podcast

this is going to be one of those shows isn't it it is is that the end of the jingle? This is the host's unknown podcast? It's got a stumpy one, I didn't realise Exactly We call those the Andy ones The Andy jingles They're all stumpy No, no, we call them jangles Oh dear Alright, let's go on to

this fucker and these Billy Big Balls. OK, so as our resident Billy Big Balls, this story is fantastic. It puts such a big smile on my face. And you know how we always see in movies, there's always some good guy like Wisecracker doesn't negotiate with terrorists. And, you know, you feel good about him, like a John McClane type character or Deadpool or something. And so ransomware has been the plight of many organisations. It's just been like a blemish on the cyber security buttock for many years now. And it's always the same story.

Someone gets hit by ransomware. Oh, we're not going to pay the ransomware. And then after two days of downtime, we're going to pay the ransomware because we can't afford the downtime and what have you. But the Billy Big Ball this week is the Bank of Zambia. They were hit by ransomware. And their response is beautiful.

Not only did they not pay, but they replied to the attackers. So the attackers will normally try to enter into a negotiation and they normally like oh okay this is cool if you don't want to pay us 50 million pay us 40 million instead but um they uh the bank of zambia posted them some pictures of eggplants aubergines uh basically the emoji yes uh so they sent him a whole bunch of pictures saying uh suck this and stop locking back networks thinking that you will monetize something learn to monetize so i think this is absolutely brilliant i wish every organization now would start just replying with dick pics to uh ransomware gangs and just

saying like hey monetize this um so so what you're saying jav is that institutions should respond by breaking the law and committing a sexual offense by sending unsolicited dick pics yes because then what's gonna happen you heard it here first folks the ransomware gang is gonna say but we use minors in bangladesh and now you've just exposed yourself to a minor so you're gonna get not only you're gonna get done for that oh this could go so far this is brilliant i love it did your mother ever not tell you that two wrongs don't make a right well maths has taught us that two wrongs don't make a right? Well, maths has taught us that two negatives do make a positive.

Oh, dear. But, OK, maybe find your own PG version of this response, but, you know... PG version? What, your little finger? Yeah. A picture of Tom. Oh, that's so offensive.

I'm many things. How very dare you call me PG. Oh, dear. Thank you, Jav, for that piece of unsolicited advice on how to respond to ransomware for this week's... Billy Big Balls of the Week. Now, it's time for something else now. And, you know, maybe it's time to, you know,

for Javanite to now turn our attention to Andy, you know, give him a bit of a hard time. We've beaten each other up now. So Andy, is it that time? Jav, I think he's trying to tap out. But I will tell you what time it is. It is that time of the show where we head over to our news sources over at the InfoSec PA Newswire who have been very busy

bringing us the latest and greatest security news from around the globe. Industry News Doctor accused of being prolific ransomware developer. Industry News US government warns firms to avoid hiring North Korean IT workers. Industry News He's sworn off £15 million courier scams. Industry news. Digital skimming is now the preserve of non-mage cart groups. Industry news. UK government.

Lack of skills the number one issue in cyber security. Industry news. Personal information of nearly two million Texans exposed. Industry news. Half of all IT leaders store passwords in shared docs. Industry news. Microsoft president says

cyberspace has become the new domain of warfare. Industry news. CSAT issues emergency directive for VMware vulnerabilities. Industry news. And that was this week's... Industry news. Huge, huge if true.

I have to go straight to the US government warning firms to avoid hiring North Korean... That's exactly what I was going to look at. Really? Obviously, we know that there's been an influx of North Koreans leaving the country and emigrating to the US, you know, for the promise of a better life. But given they're not allowed to leave the country, you've got to wonder how they got out. I know, exactly right. the country you've got to wonder how they got out i know exactly right oh this is like uh you know like a a hacker turns up with a really bad mustache like a fake wig and stuff and says oh yes the clip on glasses with the nose yeah i'm here to administer your it systems yes my name is mevin

kitnik oh dear this is brilliant i mean i can't imagine there's many people from uh and Kipnick. Oh dear. This is brilliant. I mean, I can't imagine there's many people from the Democratic People's Republic of Korea on Fiverr. Exactly. What I found really funny in this, and

I'm saying like, you know, correlation is not causation, but you two start new jobs, and all of a sudden the UK government says lack of skills is the number one issue in cyber security. I wonder why they asked me to do that survey. Oh, dear. And this half of IT leaders still pass. What? 46%?

I think there's a huge amount of people that are lying on that. You think it's more? Yes, without a doubt. Yeah. I mean, IT leaders infers people who are in sort of management and above roles, right? Yeah. You can afford the 20 quid a year for last pass or whatever.

Yeah, but I don't know. I can see this happening in an organisation where you might have a high turnover. You've got some shared systems. I'm not saying they're going to be critical systems. We're not talking about domain admin. These could be just internal. Yeah, absolutely. But nonetheless, the practice itself is appalling.

It is, but I can still see it. Small companies, there's a lot of mum and pop shops out there. Exactly. 94% said they require password management training. 94% of IT and security leaders requested password management training. See, I think there might be a nuance here. They might have said that because that's what it is, but maybe what a lot of them are asking for is clarity

around what the organization's password policy is because no matter who you turn to, you're going to get a different answer in a lot of places. Yeah, yeah. So some of it might be... no matter who you turn to you're going to get a different answer in a lot of places yeah yeah so some of it might be if that that doesn't mean they shouldn't be doing this sort of shit though well it's battery stable yeah i mean like yeah yeah there's still so many systems that don't actually support shared shared accounts and and what have you. No, but something like LastPass does.

Yeah, LastPass does. You're right. And other password management. Yes. Yeah, same. So they start sponsoring us. People are available out there. Yeah.

Yeah, let's cut it off there. And I'll open to sponsorship. Yes. Outrageous. Absolutely outrageous. Anything else? No, let's move on. Let's move on. Short show. Absolutely outrageous. Anything else? No, let's move on. Let's move on.

Short show, short show. Which would be with you two anyway. That was this week's... Industry News. The host unknown podcast. Orally delivering the warm and fuzzy feeling you get when you pee yourself. And talking of wet pants, let's go over to Andy for this week's... Tweet of the Week.

We always play that one twice. Tweet of the Week. It is over to me as I click through the show notes to say this is a tweet from the have i got news for you twitter account and it is the news following obviously elon musk's uh proposed takeover of twitter elon musk wrong about the number of fake bot accounts says current ceo at twitter boss four eight three two nine eight eight seven three oh that one tickles me i like that one yeah well it's really weird you know and i know this isn't the topic of the tweet but

elon musk is like one of those people like like he's he's extremely gifted in in some aspects of life but a complete knob in others. So, you know, it's like how he needs better people around him that can help him separate himself out from each other so he doesn't go on Twitter or whatever and say dumb shit and just focus on whatever rockets he's making or Teslas. Yeah. Yeah, he's deliberately driving the price down.

Yeah. And then he's's gonna buy it that way yeah absolutely absolutely and the thing is they were doing research in um as part of his due diligence he said they were looking at you know how many fake accounts there were and they were going to take a sample size of 100 accounts. Yeah. Wow. 100. That's statistically zero. Carefully curated. But I'm surprised that, you know, even going through the diligence process, I'm surprised at how public he's been with everything he's talking about. Because he's always been like that, right?

Because it manipulates stock prices well that's where i was gonna it does uh you know is share price impacting yeah yeah yeah it's not it's not cool i mean i was chatting to somebody over the weekend in fact it was carol our friend of the show carol terrier and um um saying that just because elon's done a you know huge amount of good you know he's changed the view of electric cars you know the public perception of electric cars and he's he's opened up a lot of the patents that he's had there he's opened up those patents so other companies can can use them and utilize it you know the drive train for instance and stuff like that you know

he's revolutionized um uh sort of space travel i mean his nearest competitor bezos and his little you know phallic blue origin is nowhere near uh as successful as what spacex is doing and in fact now with the you know now with us um not talking to russia it's the only way we can get in and out of the space station right and it's you know and and he's is the other stuff he he does as well the hyperloop although i think it's more of a hype loop at the moment but nonetheless i think there's you know there it has got some legs in there it's just maybe technologically not there so he's doing a huge amount of good stuff that doesn't preclude him from being a bit

of a knob yeah i know you mentioned uh bezos there and again we're going on segue um but it you know with all the tech stocks diving recently yeah um did you hear that that saudi um aramco over to capital is the world's most valuable company that's right yeah yeah which is terrible because that's a product that's a company completely focused on oil production right yeah well saudi is trying to diversify like a lot of the arab countries Because that's a company completely focused on oil production, right? Yeah. Well, Saudi is trying to diversify. Like a lot of the Arab countries, they're trying to diversify a bit because of the oil dependency. But Saudi Arabia also bought this week 5% of Nintendo.

What? Yeah. Yeah, so Princess Peach is going to be wearing a headscarf in the next I'm glad you made that joke she's not allowed to drive either she's going to be oh god move on

step away from the lawsuit step away from the Twitter storm excellent thank you Andy for this week's tweet of the week Step away from the lawsuit. Step away from the Twitter storm. Excellent. Thank you, Andy, for this week's. Tweet of the Week. Well, we have, like Princess Peaches, come crashing into the end of the show here.

A short one, a very short one. I think we're going to have to sort out our professional lives or even perhaps start on time. That might help as well. Yeah. But, yeah, gentlemen, thank you so much for your time this week i i hesitate to thank you jav given uh quite how uh uh sort of querulous you've been today but uh thank you well you're welcome for calling a spade a spade that's all i can say what i think i think jav is just hitting the auto quote generator in

google something you know what andy you know there was two of those packets of emergency use only which one was i meant to take before oh dear yeah those oh man those days are um i'm talking like a long time ago do you remember you could just like you go out with me you just hand them a pill and say quick swallow that and like they just swallow it like no idea what's uh so i did it too so it's like one of the guys and uh i was leaving work the other week uh i did it one time we were out uh this is like years back and i like gave us like here quick swallow that and without hesitation he just swallowed it so you know about to go into a place

and after it is like what was that sliced viagra it genuinely was as well oh dear i don't mess around with the other stuff and this is how andy met his It genuinely was as well. Oh, dear. I don't mess around with the other stuff. And this is how Andy met his wife. Oh, dear. Do you know what?

When people do that to me nowadays, it's normally a Neurofen. Yeah. Or some Exlax to help you. Just to help you in the morning. And talking of uncontrollable diarrhea, Andy, thank you so much for this week's contributions. Stay secure, my friend. Stay secure.

You've been listening to The Host Unknown Podcast. If you enjoyed what you heard, comment and subscribe. If you you hated it please leave your best insults on our reddit channel worst episode ever r slash smashing security the shortest episode ever uh yeah how about a quickie as opposed to what so that's stay secure my friends you know i I've always said that since day one, right? There's some guy on TikTok that says it. What? Yeah, there's like this... He talks like some security stuff

and he always signs off his TikToks with Stay Secure, my friend. Sounds like a very intelligent, charming man. Have you done a cease and desist? I will do. Yeah, no, I will. No, don intelligent, charming man. Have you done a cease and desist? I will do. Yeah, no, I will. No, don't, don't. Some people can't handle lawsuits. Oh, please, just send one anyway.

Oh, Andy, how much do you want the monthly direct debit to be? Travada,aktia Malik. Play us out now, Tom. Tom? Tom? He's had a stroke on air. He's dead. Yes, this is the episode I was waiting for for so long.

Finally, let's get to play it. Yes.