AI Finds Zero Day Vulnerability For First Time: Cyber Security Today for Wednesday, November 6, 2024

Summary

Cybersecurity Today: AI Finds Zero Day Vulnerability For First Time

Episode Released on November 6, 2024 | Host: Jim Love

---

1. Introduction to the Episode

In the latest episode of Cybersecurity Today, host Jim Love delves into groundbreaking advancements in cybersecurity, significant policy changes by major tech firms, and a recent cyberattack that has caught the attention of the industry. The episode, titled "AI Finds Zero Day Vulnerability For First Time," explores how artificial intelligence is revolutionizing cybersecurity, the imperative shift towards multifactor authentication, and the quirky yet concerning ransom demand faced by a French energy firm.

---

2. AI Discovers the First Zero Day Vulnerability

Timestamp: [00:01]

Jim Love opens the episode by highlighting a monumental achievement in cybersecurity—Google's AI-driven system, Big Sleep, has successfully identified the world's first AI-discovered zero day vulnerability in SQL Lite, a globally utilized open-source database engine. This breakthrough signifies a pivotal moment where artificial intelligence aids in preemptively securing software against potential threats.

Key Points:

• Big Sleep's Capabilities: Developed through a collaboration between Google's Project Zero and DeepMind, Big Sleep leverages large language models to detect security flaws that traditional human fuzzers might miss. Love emphasizes, “This marks the first time, at least publicly, that an AI agent has successfully discovered such a critical exploitable vulnerability” ([00:01]).

• Nature of the Vulnerability: The identified vulnerability is an exploitable stack buffer underflow—a subtle yet dangerous flaw allowing unauthorized access to systems. Project Zero promptly reported this to SQL Lite in October, leading to a patch before any official release, thereby averting potential exploitation.

• Future Implications: The Big Sleep team acknowledges that while these results are promising, they remain experimental. However, the integration of AI in fuzzing processes could revolutionize how vulnerabilities are detected and addressed, making software inherently more secure. As Love summarizes, “AI could bring a huge advantage to defenders, the team explained, not just in finding vulnerabilities, but in providing root cause analysis, making triaging and fixing issues significantly cheaper and more efficient” ([00:01]).

Notable Quote:

"Finding a vulnerability in such a well-known, well-fuzzed system is an exciting result," said the Big Sleep team. ([00:01])

---

3. Google Cloud Mandates Multifactor Authentication (MFA)

Timestamp: [00:01]

Shifting focus, Jim Love discusses Google's recent decision to enhance security protocols by making multifactor authentication mandatory for all Google Cloud users starting January. This strategic move aims to bolster account security in response to the escalating threat landscape targeting cloud environments.

Key Points:

• Mandate Details: Effective January, users who previously relied solely on passwords will be required to adopt MFA, impacting approximately 30% of Google Cloud's customer base that had not yet implemented this security measure. Google articulated their stance in a blog post, stating, “At Google Cloud, we're committed to providing the strongest security for our customers” ([00:01]).

• Evolution of MFA: Since introducing two-factor authentication in 2011, Google has continuously advanced MFA methods, including phishing-resistant security keys and passkeys. While MFA was optional for consumer accounts, its necessity for cloud environments underscores the critical nature of data protection in these spaces.

• Industry Trend: Google Cloud's initiative aligns with similar policies from other tech giants. AWS plans to enforce MFA for privileged accounts, Microsoft mandates MFA for Azure administrators, and Snowflake has already required MFA for all users following several account breaches.

• Effectiveness of MFA: Data from Google's Mandiant Threat Intelligence team and agencies like the Cybersecurity and Infrastructure Security Agency (CISA) reveal that MFA usage reduces the likelihood of hacking by 99%. Additionally, Microsoft's research on Cybergroup Storm 0501 demonstrated that MFA could effectively disrupt sophisticated cyber threats, including cloud breaches and ransomware attacks.

Notable Quote:

“By automating and supercharging this process, the Big Sleep AI aims to spot cracks in software before it's even released,” Jim Love explains, highlighting the proactive nature of AI in cybersecurity ([00:01]).

---

4. Schneider Electric Cyberattack and Unusual Ransom Demand

Timestamp: [00:01]

In a surprising twist, the episode covers a cyberattack on Schneider Electric, a prominent French energy management firm. The breach resulted in the compromise of approximately 40 gigabytes of internal project tracking data. What sets this incident apart is the attacker's unconventional ransom demand: 125,000 baguettes.

Key Points:

• Nature of the Breach: The hacker, identified as Greppy on X (formerly Twitter), exploited compromised credentials to breach Schneider's JIRA server. This breach allowed access to 400,000 rows of user data, including 75,000 unique email addresses and names of employees and customers.

• Ransom Demand: In a provocative move, Greppy demanded payment in baguettes to conceal the seriousness of the threat, stating, “$125,000 in baguettes to avoid publicizing the stolen data” ([00:01]). This unusual demand has left Schneider Electric navigating both the technical and PR challenges of the breach.

• Company Response: Schneider Electric confirmed the incident and is actively investigating the unauthorized access. Importantly, they assured that none of their products or services were affected by the breach. The company faces a dilemma balancing the ransom's lighthearted demand with the potential risk of publicizing the stolen data.

• Implications: While the ransom request is presented humorously, the underlying threat remains severe. Schneider Electric must address both the technical fallout and the reputational impact, highlighting the multifaceted challenges cybersecurity incidents pose to large organizations.

Notable Quote:

Greppy taunted Schneider Electric, saying, “Hey Schneider Elect, how was your week? Did someone accidentally steal your data and you noticed?” ([00:01])

---

5. Conclusion and Forward Look

Jim Love wraps up the episode by reflecting on the evolving landscape of cybersecurity. The integration of AI like Big Sleep presents a promising frontier in proactive defense mechanisms, potentially shifting the balance against cyber adversaries. Concurrently, the enforcement of MFA by leading tech companies underscores a unified approach to mitigating threats in increasingly targeted environments such as the cloud.

The Schneider Electric incident serves as a reminder of the unpredictable and often unconventional nature of cyber threats, emphasizing the need for robust, adaptable security strategies. As AI tools mature and security protocols become more stringent, defenders may gradually regain the upper hand in safeguarding digital infrastructures.

Final Thoughts:

"Defenders may finally gain a bit of an edge in the never-ending battle against cyber threats, turning the table on hackers who have long enjoyed the upper hand," concludes Jim Love ([00:01]).

---

For More Information:

Listeners are encouraged to access detailed reports and additional resources through the show notes available at technewsday.com. Feedback, tips, and constructive criticism can be directed to [e-mail].

---

This summary encapsulates the key discussions and insights shared in the November 6, 2024, episode of Cybersecurity Today, providing a comprehensive overview for those who haven't tuned in.

Transcript

[Jim Lau]

Google uncovers the world's first AI discovered Zero day vulnerability Google Cloud makes multifactor authentication mandatory. Hackers infiltrate a French energy firm and demand $125,000 in baguettes. This is Cybersecurity Today, I'm your host Jim Lau. Google has announced that its AI driven system, Big Sleep, has uncovered a zero day vulnerability in the real world code of SQL Lite, an open source database engine used globally. This marks the first time, at least publicly, that an AI agent has successfully discovered such a critical exploitable vulnerability, a significant milestone for the future of cybersecurity. Developed jointly by Google's Project Zero and DeepMind, Big Sleep uses a large language model to assist in finding security flaws before hackers do. Project Zero, known for its elite team of ethical hackers, combined its expertise with DeepMind's leading AI research to create Big Sleep, an agent capable of navigating code in ways even the most sophisticated human fuzzers can't always manage. The vulnerability Big Sleep uncovered was an exploitable stack buffer underflow, essentially a door left ajar in the back end of a widely used software. Google's Project Zero promptly reported it to SQL Lite in October and it was patched before any official release, protecting users from potential exploitation. Finding a vulnerability in such a well known, well fuzzed system is an exciting result, said the Big Sleep team, although they admit this is still highly experimental. Fuzzing, a classic security research technique, involves bombarding code with random data to find exploitable errors. It's an approach that's effective, but far from foolproof. Google believes that AI can take fuzzing to the next level, enabling defenders to find the vulnerabilities that traditional fuzzing tools miss. By automating and supercharging this process, the Big Sleep AI aims to spot cracks in software before it's even released, closing loopholes before attackers can get in. AI could bring a huge advantage to defenders, the team explained, not just in finding vulnerabilities, but in providing root cause analysis, making triaging and fixing issues significantly cheaper and more efficient. While the results are still in the experimental phase, the implications are promising. The hope is that AI driven systems like Big Sleep will ultimately make software far less penetrable, leaving malicious actors out in the cold for now. Google's successful use of AI to detect vulnerabilities like the one in SQL Lite represents a powerful step forward towards proactively defending against cyber threats. It's a glimpse of a future where AI not only builds systems, but also safeguards them as Big sleep evolves and AI tools mature, defenders may finally gain a bit of an edge in the never ending battle against cyber threats, turning the table on hackers who have long enjoyed the upper hand. Starting in January, Google Cloud users will no longer be able to rely solely on passwords. Google Cloud is mandating multifactor authentication for all accounts, forcing the approximately 30% of its customer base that has yet to adopt MFA to add this extra layer of security. The move reflects Google's belief that mfa, long encouraged by cybersecurity experts, will dramatically improve cloud account security. At Google Cloud, we're committed to providing the strongest security for our customers, the company said in a blog post. By January, all Google Cloud users signing in with just a password will be required to implement MFA solutions. As we all know, multifactor authentication is a well established method for increasing security, using a secondary form of verification to prove a user's identity. Google first introduced two factor authentication for its users in 2011, evolving it into more secure forms like phishing resistant security keys and even passkeys. While enabling two FA has been optional for consumer accounts, Google Cloud now deems it crucial for every user due to the nature of data hosted in cloud environments. This move is backed by data from Google's Mandiant threat Intelligence team and government agencies like the cybersecurity and Infrastructure Security Agency CISA, which found that users who use MFA are 99% less likely to be hacked as part of the rollout. Google Cloud will also require MFA for users leveraging federated authentication. Here, Google is offering flexibility by allowing customers to choose whether to enable MFA through their identity provider or directly through Google's system. Google Cloud's decision follows in the footsteps of other major tech companies that are also pushing for broader adoption of mfa. AWS recently announced plans to enforce MFA for privileged accounts, while Microsoft implemented a similar policy for Azure administrators. Even Snowflake moved to mandate MFA for all users earlier this year after a series of account breaches. Cloud services providers are making these changes not just out of goodwill, but due to the increasingly evident threat landscape. A recent PwC report found that cloud based threats have become a top concern for chief information security officers, outpacing even the fear of ransomware for many organizations. Cybercriminals are increasingly targeting cloud environments, and enabling MFA has proven to be one of the most effective ways to prevent breaches, especially for sensitive accounts. Microsoft's own research into Cybergroup Storm 0501 demonstrated the use of MFA could effectively disrupt the group's dual tactics of of cloud breaches and ransomware attacks. So as MFA becomes a mandatory feature across big tech companies, it can serve as a case study on how simple security steps can stifle even sophisticated cyber threats. Hackers have compromised internal data At Schneider Electric, a France based energy management firm, Schneider representatives confirmed that roughly 40 gigabytes of internal project tracking data was breached, including issues and plugins. The hackers, however, are demanding their ransom in baguettes. The threat actor known as Greppy on X, formerly Twitter, taunted Schneider Electric in a weekend post. Hey Schneider Elect, how was your week? Did someone accidentally steal your data and you noticed? Shut down, the services, restarted without finding them. Now you shut down again and the criminals seem to have taken more juicy data. Greppe later shared a screenshot of code allegedly linked to the breach involving JIRA project management users and tickets. Greppe told Bleeping Computer that they breached Schneider's JIRA server using compromised credentials and scraped 400,000 rows of user data with a mini orange REST API, including 75,000 unique email addresses and names of Schneider employees and customers. Schneider confirmed the breach, stating that they were investigating a cybersecurity incident involving unauthorized access to one of their internal project tracking platforms. The company says that none of its products or services were affected. In a dark web post, the hackers demanded $125,000 in baguettes to avoid publicizing the stolen data. They also acknowledged that if Schneider acknowledged the breach, which it has, the ransom would be cut in half. Though the mention of the baguettes is clearly a joke and the half a loaf is clearly a joke, the situation still leaves Schneider in a sticky predicament. Although a company that size probably has the dough to pay up if they want to. Sorry, couldn't resist. That's our show for today. You can find links to reports and other details in our show [e-mail] we welcome your comments, tips and even the occasional bit of constructive criticism and editorial@technewsday CA. I'm your host Jim Love. Thanks for listening.