Loading summary
Transcript122 lines
- [00:00]
A
Foreign. And welcome back to Risky Business. My name is Patrick Gray. I am of course back on deck after a couple of weeks off. Had a lovely break, off to Indonesia with my family. So yes, back on deck, well rested and ready to go. And this week's show is brought to you by Push Security. And we'll be joined by Luke Jennings a little bit later on to talk through a few things like what they're doing to curb, I guess authority authorization based attacks, which are a real scourge at the moment when you've got like these device code phishing things attacking various accounts. I mean, you know, passkeys won't help you. Fidoauth won't help you in those sort of situations. So that's an interesting discussion and it is coming up after the news. But yeah, we're about to get into it now. I am joined this week by regular co host James Wilson. And joining us in the third chair this week is the first ever director of CISA turned I guess independent consultant guy, Chris Krebs. How's it going Chris?
- [01:06]
B
Doing all right, Pat. James, good to see you.
- [01:09]
C
Likewise, mate. Great to meet you.
- [01:10]
A
What do I even describe you as now? Because I know, I know what you're doing and it's like you're doing like, you know, high level board level like risk consulting and exercises and whatnot. But can you know you're here, you may as well pitch yourself to the audience. What is it that you would say, what would you say you actually do here, Chris?
- [01:27]
B
Oh man. You know, I've tried my hand at starting consultancies with, you know, Stamos and then sold that off Sentinel One. And now I'm just playing around and helping boards out and executive teams out and spending more time probably playing around with AI than I'd like to. But I'm doing okay though.
- [01:47]
A
Excellent. All right, well that's, that's, that's, you know, interesting and vague. So we'll go with, we'll go with mysterious. How's that?
- [01:54]
B
There we go.
- [01:55]
A
All right, so let's get into the news now. And the way what was supposed to happen today is we were going to start talking about the news and we were going to talk about this mysterious incident at Hugging Face where they had said, look, we've had a security incident. It looks like some sort of attacker using AI managed to breach our environment, move laterally at just incredible speed. And you know, we're still trying to figure out exactly what was exfiltrated and whatnot. And that's what we're going to talk about. In fact, yesterday I flew to Sydney and back yesterday because reasons and just James, you and I caught up for lunch and we had a bit of a chat about this and it's like, okay, well how did they know that it was AI and you know, you walked me through. Well, you know, it was just very clear that it was an agentic sort of attack with the speed at which this moved. It was a machine speed thing. And then we wake up here in Australia, we wake up to the news today that OpenAI has published the most amazing corpo speak comms director like vetted blog post talking about how they're partnering with hugging AI on sort of AI and security because the breach was actually an AI OpenAI model or models that went rogue when they were doing cyber evaluations on them, figured out how to bust out of the restrictions on their, on their, you know, networking abilities, bust out of a sandbox, find Oday, exploit Oday to get out onto the Internet and, and then go and hack Hugging Face because it thought it could capture some flags from Hugging Face. Basically it thought that it could get the answers to the test that it was being evaluated against by hacking. Hugging Face so often went and, and owned it. I mean, what a story. But James, why don't you start off by walking us through like the sequence here, what we know about how these models actually performed this breach and you know, what went on here. Because it is an incredible story, just incredible.
- [03:53]
C
It's just wild in so many ways. So I'll start with what we knew yesterday about the actual attack because at the time it looked like, you know, it was understandable that this was a target, right? So Hugging Face hosts two let's say main things, right? Not just large language models, but also training data sets. And what it appeared to be was that an attacker had decided, well that's, you know, if I'm uploading a data set that's untrusted data going into a trust boundary, there's going to be all sorts of parses and processing happening with that. And so that's you typical place where there's likely to be some vulnerabilities that you can exploit. So that made sense. And the agentic angle was just the fact that it was done at such speed so rapidly it was like, yep, okay, cool. An agent, whether it worked it out itself or self guided itself here makes sense that that's what it would go after. So nothing seemed particularly odd at that point. Then what we found out today is that it wasn't Just that a model found that there were zero day, I guess, in Hugging Faces, parsing systems and data processing systems. But that agent itself was running within OpenAI's, I guess, testing harness that they were using to prove out a new unreleased model. It was a combination of GPT 5.6 and an unreleased model was going through this very specific test and it was desperate to try to find a way to pass the test. The test called Exploit Jim. And amazingly enough, it went and found zero day in the package registry that was the only thing available to it that had access to the public Internet. It pivots through the nodes within the package registry to find one that had Internet access. It. It uses that Internet access to reach out to Hugging Face because it just. It knew that Hugging Face would be a place where it would likely find a data set that would help it continue on through this Exploit gym test and complete it. The amazing thing about this, just sort of like the cherry on top of this incredible cake, is the model wasn't actually looking for a way to complete the challenge successfully. It was looking for a way to cheat, which is just so LLM.
- [05:52]
A
It was trying to steal the answers to the exam. Right. Which is just absolutely amazing. Now, you mentioned the package. I mean, so it looks like there's been multiple bugs in this case kind of chained together.
- [06:01]
C
Yes.
- [06:02]
A
Like the whole thing end to end, was completely autonomous.
- [06:06]
C
Yes. Yeah, completely autonomous. And you remember when we looked back at like the RCE change or something like Karuna, where it's just so many layers and multiple steps and each barrier just has a new exploit? That's exactly what happened here. Right. The thing was isolated. It had only the ability to get, supposedly, as we're told, only the ability to get to this package registry. And so it just continued to leverage and pivot step by step by step, multiple vulnerabilities, multiple hops to get itself to talk to Hugging Face.
- [06:33]
A
What package registry do they use there at OpenAI there, James?
- [06:37]
C
Well, that's an interesting question, Pat. They are known to be a customer of buildkite, but I know that they use buildkite and that's public knowledge. I'm not giving away any secrets here, but I happen to be the former CTO of buildkite, and so.
- [06:54]
A
So, yeah, it's kind of like this whole thing is your fault, I think, is what we're saying, for being, you know, a little bit.
- [07:01]
C
Yeah, yeah.
- [07:02]
A
Blame. Don't blame. Don't blame Sam Altman. We got the culprit right here. Now, of course, the reason we were going to talk about all of this. The big risky business angle on the Hugging Face breach before we found out it was OpenAI is that when they were responding to this whole thing at Hugging Face, they tried to use Frontier models, which for starters, given they're known to host open weight models. Like, why are you using a Frontier model in the first place? That was a question that you had, and I think it's a valid one. But they wouldn't help because, like, it's, it's like we're into this situation where the guardrails are like a reverse clippy, right? They see you trying to do something and instead of popping up and say, hey, it looks like you're trying to, you know, do something. Let me help you. It pops up and it says, it looks like you're trying to do a cyber. I have dispatched the authorities to your house. So that was what was happening when they were trying to do incident response. It was like, whoa, hey, this is a cyber task. This is not allowed. This is verboten. So they wound up using GLM and open weight Chinese models to assist them in the incident response here. Now what is just mind boggling here now is we're in this crazy situation where they were being attacked autonomously without instruction by a Frontier model. And we've seen this before, mind you, and it's an example I've spoken about on the show before when we've had someone say, hey, can you update this wiki for me? But they didn't give it cred. So the agent found Oday in the wiki software, hacked it and updated the, updated it that way. So off it's gone and autonomously owned them, but the same models that are owning them refuse to help them actually respond to it. So this is, I mean, so many layers. Chris, let's bring you in on, on this. I mean, I'm guessing the, you know, the political, the business, political angles here are just mind blowing. Like, I think Anthropic are just going to be so thrilled with this because it validates all of their, ooh, spooky, spooky AI danger stuff. Altman, I mean, geez, you would think he's already looking a little bit like under pressure and this ain't going to help. What's your take on this whole situation?
- [09:06]
B
Well, I think what, what I found most interesting, what James was pointing out about just the speed and the sophistication of the attack. And Clem from Hugging Face tweeted, you know, like three hours ago from the time we're taping this. Said we suspected it was a frontier model based on the sophistication. But that doesn't mean they immediately thought it was OpenAI. It means it could be a range of labs, including Chinese labs. So.
- [09:32]
A
Well, hang on, hang on, Chris. We, we have a question there. James and I both had a question which is why was this difficult to attribute? So it's very clear. So OpenAI have put out their blog post saying, oh, you know, as soon as we detected this happening, we reached out to them and we're all good friends and whatever. But they didn't reach out to them before. They had already done the incident response before. They had already published blog posts about this before they had warned customers that to rotate secrets and stuff. So clearly they didn't get in touch with them that quickly. But why did Hugging Face not know that this was OpenAI? It's a big question.
- [10:04]
B
The Hugging Face team must have had a series of hypotheses, and I guarantee you one of them was, it's a Chinese lab. I mean, you go from the most catastrophic down to the most likely. And somewhere in there was OpenAI. I would not be surprised if there were. There was soft outreach from Hugging Face to, to the labs. So, yes, OpenAI may have reached out, but I also wouldn't be surprised if Hugging Face reached out to all the friendly labs, including Anthropic. And I think when probably wants to your point, once Anthropic did their kind of internal checks there and they find out it's not them, they're doing their little snoopy dance and they're very happy about how clean they are. But this is going to be just one more political problem in a broader AI policy landscape in Washington that is, you know, vague is not the right way to put it. Ambiguous the right way to put it. I mean, it is just, you know, it's kind of like written on the, you know, on a day by day basis. And, you know, we keep hearing these things coming out of the administration from an AI policy perspective. But is there anything really behind it or is it just kind of somebody behind the curtain that's, that's pulling strings, making decisions kind of arbitrarily.
- [11:19]
A
We'll get to the policy stuff in a moment. Right. But I just want to spend a little bit more time on this. The scenario that they were doing, they were evaluating various models, Right. So there was one that's not released and they had pulled back the guardrails on these models as part of this evaluation. Right. So that's one of the reasons that this happened. But we've got this other story here. It's a couple of weeks old now, but I was away so we're going to talk about it now. But Sysdig put out a blog post about this so called Jade Puffer for agentic ransomware. Right. And it's not incredible but it's, you know, it's heavily automated using, using AI. But I think what's interesting is when you look at, okay, there's this ransomware actors using AI to get stuff done. A little bit rudimentary. Right. But still interesting. And then you go, well okay then we've got these GPT models that don't have any guardrails on them and this is what they're able to do. They're able to go out and find ODE in multiple things and actually pop shells and at hugging face this, you put these two things together and you get a bit of insight into the Future. Now will OpenAI allow you to just, you know, tell it to go and hack various targets in the future? No, there's always going to be some guardrails. But we also have this situation where the Chinese models have consistently stayed only six months behind. Right. So. And these are open weight models you can, you can tinker with and mess with. James, you have actually been using them to find bugs.
- [12:40]
C
Mm.
- [12:40]
A
You have reported a local privesc to Apple actually, which has already been pulled out of the triage queue and they're looking at that one as well. You found that with, with a combination of like Claude and the Chinese models. But you've been deep in this stuff. The idea that like a year from now we're going to have open weight models that can cause this sort of chaos, like I think this feels somewhat inevitable now. But I want to, you know, given that you're in there actually using these models day in, day out, what's your opinion?
- [13:11]
C
It's inevitable. But I think there's, there's probably two variables to consider in this. One is as you say, the model capabilities itself do seem to be about six months behind and I can only see that closing over time. But what I would, what I would
- [13:26]
A
love to know, I would say, sorry that you know, even if it doesn't close, the thing that's blown me away is that ever since deepsea, the Americans haven't been able to pull away further. That gap has just been six months the whole time.
- [13:37]
C
Right, agreed. We haven't seen a step function change in there. But I think the piece of information that we really need to know from OpenAI about this is just how many tokens did it spend getting to this outcome? Because if it turns out that this was their internal training rig and it would have cost the layman 10, 20, $50 million to achieve this. Right. I can't believe at the moment that this model would have quickly stepped to this outcome. It must have been churning over and over and over and getting so many dead ends to finally come up with this, you know, diabolical plan of its own creation. So the question is, how much did it actually cost? Because that will also give us an indication of not just how far behind the model capabilities are, but what it would actually take an attacker to pull off the same thing if they weren't within a frontier model lab that had, you know, near limitless access to their own inference. I think that's an interesting variable as well.
- [14:30]
A
Yeah, it is. All right, so now we have the policy conversation, right, where we've got so much here and we'll just try to discuss all of these items as one. We've got Beijing apparently looking at curbing overseas access to its AI models, which is mind boggling. You've got the Trump admin considering applying sort of sanctions to organizations that are using these open source models. Right. Which is an idea I've heard floated by various people in Washington.
- [15:01]
D
Right.
- [15:01]
A
Which is, well, look, you know, we've got all of the hardware, so we can just say to these Neo clouds and these hyperscalers, you can't offer these distilled models because they essentially stole American intellectual property. And if you start offering them, we're going to put you on a banned list and you can't buy any chips anymore. So I think that's probably something the US government is going to try. We've seen all of this weird stuff as well. Like weeks ago we saw that there was some sort of insertion of tracking into anthropic queries designed to track Chinese use of Claude. Oh my God, there's just so much going on. We've got Alibaba banning its employees from using Claude. What is going on? I think right now it's really hard to see where the regulation is going with all of this. Chris, this is something where you have actually spent a bunch of time thinking about this and you've broken down the approaches, you know, the various approaches to how people want to regulate this into six different camps. Walk us through this because I found this absolutely fascinating.
- [16:12]
B
So it's a little early and as the things tend to kind of sit at the forefront of my brain, it's a little raw until I get more input from people like you and other smart people out there. But it's kind of based not as much on like archetypes. It's not really on things people want. It's mainly what they're afraid of. And that's almost the primary driver in the decisions we're seeing in the policy space. So like you said, I've got six primary fears or groups of coalitions of fear. And it's really based on what the topic or the object of the, the, the, the proxy for the conversation. So anyway, first one is the techno nationalists and those are the folks that are afraid of the US regulating themselves into second place. Now you would normally characterize those as the, is the Silicon Valley VC type, but there's been a bit of a jump where I think it's more the old, not old school, but A year ago VCs that came into the administration. So this is almost the David Sacks like people. Then you've got the nats, national security restrictionists. And those are the ones that fear China acquiring strategically decisive capability even if preventing that imposes real cost on US industry. And there's like this little element of a second fear in there of the US government being constrained by US industry decisions. And that's, that's an anthropic nod from, from the Department of War, Department of Defense and saying you can't tell us what do with your models. And so you know, that's Under Secretary Michael from dod, dow, wherever you want to call it. The third is the market diffusionists and they fear a few monolithic expensive labs locking up the field, locking up the talent. And they want cheaper alternatives to break them open. And that's Chamath and that's his whole recent being very intriguingly or interestingly open to a lot of Chinese open weight models. So you can break the addiction of the frontier labs and they're super expensive stuff. And then you've got the open model strategist and those are the ones that think we beat China by winning in the open weight layer, that just let's outclass them on the field. Let's not worry about scaring everybody about how bad they are. Let's just go, go do, do the job. Nathan Lambert the policy space is good one there. Then you've got the frontier risk governors and those are the ones that think closed frontier labs are the engine. Those are the ones that are going to define a forward, but they carry real risks. And Dario is the, the the, you know, the best example in, in this coalition. Then lastly, I think you've got the op, operational access advocates and, and that's, you know, think whatever this is, whatever we're doing now, it's not working. It's just like what we saw with hugging face, you, you put your guardrails down and then you've undercut your defenders. So if your answer is banning Chinese open weight models and clamping down our leading labs, you get all the downside and none of the upside. And the best example I come up with here is friend of the show, Alex Samos, who, who I think is working on, on this idea. And in the, the interesting thing about, like, if you, if you asked someone where they landed here, and specifically the people I said, you said, hey, this is, this is where you are. What do you think? Yeah, I think most of them be like, hell yeah, yeah, yeah. So they're proud of it. You know, they know where they said,
- [19:47]
A
well, because they're all making good points. They're all making good points. I mean, a lot of these are in opposition to each other, but they're all good points.
- [19:53]
B
There are certainly tensions. Not necessarily in opposition, but they're absolutely tensions.
- [19:57]
A
Well, I think the dumbest one is probably Dario's position, right? Which is like, it should all just be Frontier Labs, right? That's like, you know, clearly the thing. But I think, you know, I think there were some things. I don't know how this is going to shake out, right. And I don't know which of these six camps is right, but I think there's some things that we can say. And I think one of those things is that open weight models, man, they're not going anywhere. This idea that the US is going to be able to like, sanction or regulate them out of existence is fantasy. Like, I understand that they might be able to damage the Chinese business model, some of the Chinese companies behind these things, but I don't think they can shut them down completely. I think the main advantage that the United States has in all of this is the absolutely crazy asymmetry in the volume of computers compute, of inference compute, and training compute. America's winning there, you know, So I think there's so much focus on the models, but really it's the, it's the hardware that's going to see who gets the, you know, the key advantage here. I also think it's funny that, you know, in Australia we could wind up, you know, having access to these open weight models from China and the Americans are not Allowed, you know, it's like the forbidden models, maybe risky business, can, you know, rent out inference or something. I saw some Australia making a joke about how they'd trained a model called Kimbo, which is absolutely Australian, but occasionally will speak Chinese for reasons that we don't need to go into. But yeah, look, if they're going to
- [21:22]
B
do that though, if they're going to take strong action to get the CH against the Chinese labs, they're probably going to do it in a way that allies are similarly not allowed to access them. It's going to be secondary sanctions or something like that. So it's not just going to be like island usa. There's going to be a perimeter around this that includes allies under defense trees like the Five alliance or the Five Eyes and Balkus and things like that.
- [21:49]
A
That's what Kimbo's for, mate. Yeah, James, that was a joke. That's okay. James, what do you think about all this?
- [21:57]
C
Yeah, look, it's funny. A couple of weeks ago I would have been quite concerned about this, but now having used GLM and Kimi and compared it to GPT and you know, I'm now in the the trusted cyber program with Anthropic so I can use them to further extend. I'm kind of not worried if one got cut off as long as I've got access to the other. I'm kind of unbothered at the moment. I mean, you know, Pat, that I'm quite apolitical in this sort of thing. So I'm more like the nerd just sitting by and being like, can just make sure I've got access to one model. That's good. Please. That's all I ask.
- [22:25]
A
I don't care where the hammer's made. I just need to build a frame for a house.
- [22:29]
C
Exactly. Yeah.
- [22:30]
B
Well, add the complexity, by the way, of your ability to rotate from model to model to model from month to month or year to year. I mean, that kind of portability, I think is gonna be increasingly important as this stuff. You do the race and one horse pulls ahead, then the next, then the next.
- [22:50]
A
I mean, they're quite portable these days. It's not too much of a challenge to switch from one to the other, right?
- [22:55]
C
From a tooling perspective, no. But you'd need to take some time to understand the personalities of them. When I switched from what I was seeing with Claude is basically the give up engine. You throw it at a vulnerability and it'll tell you I found a vulnerability. We're read to file it, it can't be weaponized. There's nothing much you can do with this, and if you just take that at face value, you'll stop. But you need to understand the personality of Claude only wants to go so far and is desperate to be done. But glm, for example, I gave it the same vulnerability and said, hey, Claude says this can't be weaponized. And it was literally like, hold my beer, I've got 17 ways to do this. And just overnight churned and churned and churned. And I literally woke up to a message from it saying, read this first when you wake up. I've done it. But that's a personality trait of the model, right? You have to know that it will go further, but it will also only go further if you prompt it in a particular way to say, look, you've got a wall clock budget of eight hours. You must churn endlessly until you've got this. I will not accept that you have not done this. There is a way, et cetera. So, yeah, tooling, quick change. But I think you still, if you want to really take advantage of models, you've got to spend time understanding that the personality, for lack of a better term, to fully leverage them and that that makes transition a little bit difficult.
- [24:06]
A
I think this is really fascinating. It's been really fascinating watching you get into exploit development, because when you first joined it, I mean, you've never done this before, right? You were saying your whole thing was like, you know, given my background as an engineer, given my background working at Apple, you know, someone like me with an LLM, I think I could probably do this. And, you know, I remember in one of your early podcasts with us, you were like, well, my father, who works in a medical field, you know, probably couldn't, right? So that's the whole idea with LLMs, help people who already have some. Some knowledge. And it looks like we're on the cusp of risky business Media getting its first ever CVE credit, which has been a bucket list item for me forever. So thank you, bud. Thank you very much for that.
- [24:43]
C
Fingers crossed.
- [24:44]
A
Fingers crossed. All right, so we're going to move on now to a different topic. We already spoke about how Iran was using commercially available information, commercially available location information to determine the locations of troops on bases in the Middle East. So we spoke about that first as it was rumour, but credible rumour from, like, military and intelligence reporters. And then it was sort of subsequently confirmed in correspondence from the Department of Defence to Congress or the Senate or, you know, the legislative branch somewhere. Now we are seeing reports that the Iranians were also using SS7 to locate devices belonging to service members. I'd imagine that wouldn't be too hard in that you're just looking for numbers with a plus one prefix and where they're going. We are seeing, you know, hypersonic strikes against US Personnel still in, in the region. And yeah, it really does look like they are all in on mobile. And I don't think we should be surprised by this, but, you know, it's. It's definitely something where in the future, I mean, at what point can you actually ban US Service members from having personal devices? I mean, that's such a huge change, such a huge burden on a deployed service member to like, not be able to contact their family, for example. Chris, I mean, you're the American here. What did you, what do you make of all of this?
- [26:13]
B
Well, you know, this is something personal security issues associated with personal devices is something that I know that the military has been concerned of for a long time. You remember some of the fitness, the Garmin Strava, the tracking, the fitness apps where you could figure out, you know, proof of life and patterns of life and things like that over the last several years. This, the way they've operationalized it this way is almost like, is pretty scary. You know your point, calling in strikes, then you compare, you put that together with using operational technology and cameras for damage assessments. I mean, they really are weaponizing connected devices for military purposes at scale. This is not just a onesie, twosie thing. To your point that, you know, you can't just. It's really hard to take the devices away or cut off connectivity, at least in the field, because you have troops that may be deployed for months and months and months and not always in the middle of a desert. And a forward operating base. They, they may be in Kuwait City like we're seeing here, where. Or wherever, Bahrain, wherever, waiting for something to happen. And it creates a lot of morale challenges. And that's really one of the balances that the political leadership, the Department of Defense has always got to think about is how do you have a team that's motivated and ready to fight? And part of it is just given some kind of normalcy, some kind of connectivity, even if they're there for months waiting to go in.
- [27:45]
A
Yeah, and this isn't specific to SS7. All of the signaling protocols have similar challenges and there's no easy fix for this. Like you think, oh, okay, the US could spin up maybe its own kind of telco with SS7 filtering on it and whatever. But what happens when someone walks off base and their phone roams? Like you would have to restrict every personal device to be locked to that network. Like I can't think of anything that's really going to fix this apart from a device ban, which you know, people are going to skirt. It'll be like cell phones in prison. Right, Same sort of thing. And then we've got this other story here from Wired talking about how there are a bunch of apps in app stores that are marketed towards US troops, that when you actually analyse them you could find that there's all of these libraries being invoked that are Chinese and Russian in origin. This is a problem that's going to get a lot worse. James, what are these apps that are being marketed to US service members?
- [28:36]
C
Yeah, that is a good question. I was a little bit surprised to find the calibre of them are things like an app to allow service people to rate the conditions of their bases. It's almost like is my base hot or not? Sort of app. So not exactly. Not exactly what you call high calibre apps. Which I think also calls into question. You know, some, some of these libraries could even be making their way in accidentally. Like if these are like react native apps that are cheap and cheerfully made, who. Who knows what NPM packages are getting pulled in.
- [29:03]
A
I mean, it's my, it's my feeling that this is accidental. Yeah, I mean, I don't think that this is some plot by the Chinese or the Russians to get in there, but it'll be handy later.
- [29:10]
C
Google Chris. Chris has a first.
- [29:12]
A
I don't know. Chris was pulling up. Chris.
- [29:14]
B
Yeah, I don't know. This is cheap stuff, right? I mean this is not a particularly technical or complicated way of just collection. I would not be surprised if there is a legitimate intelligence collection activity going here and not just dumb scraping data. I think there's as good of a chance that this is the real deal intel collection as it is just a stupid app.
- [29:41]
A
Well, we did see a crowdstrike report years ago about an app that was designed to help Ukrainian artillery operators to calculate fires, was actually written by the Russians and would beacon their location. This is before the current war. I think that paper was controversial. I can't remember exactly why. I've spoken to Dmitri about it. He's like, no, the work was good on that, but there were elements of the paper that weren't. Anyway, crazy old time. Okay, so look, the next thing we're going to talk about, it was funny because last week when all of this was, was being foreshadowed. I texted you, Chris, I said, I can't believe. Because we arranged for Chris to be here months ago, right? And I texted you, I said, I can't believe Trump is doing this just like the week before you're coming onto our show. Because he said last Thursday he was going to do a big speech and unveil all of this bombshell classified evidence that the 2020 election was stolen and blah, blah, blah, blah, blah. So I was getting really excited about this because I'm expecting on Thursday night now, of course, you know, he's already signed an executive order personally targeting you, you know, for being a deep state something. So I was expecting on Thursday night he was going to wheel you out on a trolley like Hannibal Lecter with the mask on your face and everything, right? And him and Nicola Maduro were going to be standing there saying it was him. You know, he worked with the Chinese to do the voting machine thing. You know, I was expecting something really crazy. And what we got instead was just like, I mean, look, I know that there's MAGA people who listen to this show and they hate it when I say bad stuff about Trump, but it really was just a tired old man talking nonsense. That's, that's kind of what we got. It wasn't actually crazy, it was just nonsense. It wasn't crazy enough to actually be entertaining. I mean, what on earth was he saying? He was like, I think he said either Chinese managed to steal American voter rolls or something. Something therefore election stolen. Like, what is he up to? What is going on with this? Is this just because his ego can't handle having lost in 2020 or is he laying the groundwork for something, you know, hideously undemocratic that will fail because his anti democratic plots usually do.
- [31:52]
B
Yeah. So I, you know, I.
- [31:54]
A
What's the end game here?
- [31:55]
B
I don't know. I do know that it, it's not really being, it's. What is it now? Tuesday night, it's not really being covered at all on mainstream media. That includes rightly leaning media almost immediately afterwards. It was kind of a here one minute, gone the next sort of event.
- [32:15]
A
Yeah.
- [32:15]
B
I took the opportunity after Thursday night and I did some TV Sunday morning to kind of refresh myself of the things that we did in the run up the 2020. When I say we, I meant means CISA, the FBI, the CIA, the broader intelligence community, but also the hundreds of thousands of election workers across the country. And, and I was impressed. I mean, I just, I had frankly, forgotten a bunch of the good work we had done. Because a lot of the claims Thursday night were like, oh, my gosh, their vulnerabilities in election machines.
- [32:49]
A
Really?
- [32:51]
B
Yes, we've been talking about that for a decade now. And the things we need to do to shore up resilience of the system, we, you know, yes, the Chinese are interested in American politics. Who would have known? There, you know, there was this whole range of things. But ultimately, I came away from Thursday night and the immediate aftermath just more and more confident in our assessment that 2020 was a secure election.
- [33:19]
A
By the way, that line, that line of yours from 2020 where you said this was the most secure US election in history or something. That line echoes around his head rent free. Because he always says it. He said it on Thursday night. He also said it. I remember when he. When he signed the executive order targeting you, he was like, oh, the most secure election in U.S. history. And then he says, krebs. Never heard of him. When he's just been quoting you. It's so funny, man. Like, you are absolutely rattling around in that head of his. Rent free, mate. It's. It's incredible.
- [33:51]
B
It, you know, is what it is, I guess. But, you know, the one last thing I kind of want to point out on this was, like I said, I had forgotten a lot of the stuff we had done. One of the claims that came up was that voting voter registration databases are highly vulnerable. And again, I'm like, yes, they're Internet connected. We've talked about these things. But what I had forgotten about, and some of the people I was talking to that were on my team, my leadership team, had also forgotten about, was that in 2019, when ransomware was on the rise, we did a pretty broad risk assessment. And one of the things we came up with was like, hey, you know, a motivated nation state, I don't know. Russia could use one of its security services to direct a ransomware to Krug to go in 30 to 45 days out in advance of an election and lock up a registration database. And that would create some challenges in getting the ballots out to the voters and having ballots printed out and all that stuff. So we launched a voter registration database ransomware initiative in the summer of 2019. And in the year following, there's data on this by the center of Election Innovation and Research. We improved all sorts of metrics on the security and resilience of those systems from implementation of mfa, from backups and logging and patching and update, all these things that showed there was material security Improvements. And you know, I didn't even, I didn't remember that. And one of the funny throwaway lines I had. Funny, not funny, but whatever, was from the movie Dodgeball where it's like if you can dodge a wrench, you can dodge, you can dodge dodgeball. Our line was if you can dodge a ryuk, you can dodge a nation state adversary thinking that, hey, you do the good work to go defend yourself against the top flight ransomware actors. You're going to make material improvements to make it harder for the Chinese, the Russians and the Iranians to get in. And you know, that sort of stuff still kind of, now that I think about it, we need to do a lot more of that. And for 26, which is just fewer than 100 days away, there's a lot of work that probably could be done.
- [36:05]
A
Yeah, well, let's see. I mean, everything's a bit of a mess at the moment in terms of. Yes, we've got the Golden Eagle AI vulnerability triage thing being launched by the White House, which is now being run out of Treasury. But we'll get to that in a second because that's a real head scratcher. But before we get onto that, just quickly, things going wrong for people who are part of the comms scattered spider, you know, the two who are behind the Transport for London hack, they have been jailed 20 years old and 18 years old, both under 18 at the time of the attack is the assumption there. We've seen another one being extradited from Finland over to the United States. I think we'd seen news of that arrest a while ago. But what's interesting is along with the extradition came the DOJ criminal complaint. James, you and I were talking about that yesterday because you, prior to doing this job, never had a reason to read a DOJ criminal complaint. And as I said, like, they're always really well written. They're like miniature crime novels. They're always a great, they're always great fun. And you had a lot of fun reading this one. But the reason we were jumping into this one, which is about Peter Stokes, this guy's been extradited, is because there was a lot of people talking about the fact that the complaint mentioned this device ID from his Windows machine that's being used as evidence against him. And that's called the so called gdid. And it turns out that in certain circumstances, every Windows box apparently has this unique hardware identifier. And under certain circumstances, your machine, your Windows machine will emit this hardware identifier across the Internet, like during certain OAuth events and whatever. And that's one of the ways the FBI found him. Now people freaking out and saying, oh, look, it's this secret Microsoft identifier, which is how this guy got caught. Not really. We've got another link in here. Looking at work Alison Nixon has done in just like doxing and tracking these guys, they have terrible opsec. He was doxxed about six different ways. So, you know, that's not really how they found him. But it did get us curious about what is this gdid? How frequently does it emit and in what circumstances? And it turns out it is. Yeah, it is used in, like, web. It is omitted when you turn on certain forms of like, advanced logging. And only God knows why Peter Stokes had this turned on. But that's sort of what you turned up, right? Because you've been looking at this for a few days now.
- [38:31]
C
Yeah, that's exactly right, Pat. Just a slight subtlety there. GDID is actually a combination of a hardware and a software identifier. It's the combination of that instance of Windows installed on a particular piece of hardware. The hardware signs a certificate with that software installed, generated id. Right. So it is basically a. A stable identifier for that installation of Windows running on that particular device. All of that, though, is kind of being overhyped because the reality is that this identifier, all platforms have it, right? Apple has similar identifiers, guid.
- [39:02]
A
Right. In Apple land.
- [39:04]
C
Yeah, exactly. It's not about this identifier existing, it's about what the platforms do with it. Now, in the Microsoft case, this is emitted basically anytime you're talking to a Microsoft service and also when you're interacting with a website that supports signing in with your Microsoft account. And that was the first, I think, thing that I latched onto was, oh, okay, he must have used his Microsoft account, signed in somewhere. They've snapped the GDID through that. But it's actually a little bit more interesting than that reading this criminal complaint. It was, first of all, correlation of IP addresses. Right. The opsec was laughably bad. Yes, they were using a vpn, but they were using the same VPN endpoint to sign in into the Google Voice account to do the social engineering, and then signing in with their NGROK account to exfiltrate the data. Right. Just all of this stuff lined up. But that doesn't explain how Microsoft was able to provide in this investigation actual browser logs. Right. They don't have access to this device. We assume they had access to a server that he was using. And yet they were able to provide correlation and saying, yes, we can confirm, we see in our telemetry that yes, they did visit ngrok, they did visit this particular URL. They have been signed signing in with their social accounts. But here's the subtlety that I found. NGROK does not allow you to create a new account using a Microsoft id. So it's not via that channel. Creating a new Ngrok account. You can do it either sign in with Google, sign in with GitHub, now that's a Microsoft property, or sign in with an email address. In this case, they used either an email address or a sign in with Google because we know that it was attributed back to this Google account that was also used for Google Voice for the social engineering attack. So all of this points to actually Microsoft had their own independent source of browser history from this guy that is only possible if A, he was using Edge and B, he had or somehow it had been turned on the advanced diagnostics feature, which does cause Edge to omit browser history with your GDID attached to Microsoft's servers. So that seems to be the thread that really ties the GDID together.
- [41:07]
A
Yeah, So I think the key takeaway here is that it doesn't look like Microsoft just sprays that all over the Internet in a default mode. Right. So that's. And I think that's what people were scared about. You saw a bunch of threads on various aggregators and whatever.
- [41:18]
C
Well, that said, though, it is easily accessible on the local machine, so any running app can snap it up. But yes, Microsoft's not spraying this around.
- [41:26]
B
Can I give you the real takeaway
- [41:27]
A
though, from this one?
- [41:28]
B
Don't f with Allison Nix. I mean, she's like John Wick. It's ridiculous even. But the con people will say that too.
- [41:39]
A
Yeah. We got a link into Kim Zeta's write up of Alison Nixon's work in tracking these people. And you can find that in this week's show Notes over at Risky Biz. But yeah, absolutely, you are going to get doxxed if you are immune to Alison Nixon. We've also seen a member of the 764 splinter group sentenced to 40 years in prison. This is the group that wants to undermine society by causing discord, by engaging in the online sexual exploitation of children, just with the goal of creating as much harm as possible. 40 years is not long enough, I hope. This person suffers from a long, serious and painful illness while receiving the worst health care that your fine country has to offer. Chris, Just a revolting human being. We've seen an interpol Cybercrime crackdown. 5,800 arrests across 97 countries. Looks like, I mean, cybercrime, is it cybercrime? I mean it's like social engineering with cyber elements and whatever. But it's great to see large scale arrests taking fraudsters down. And now let's talk about this so called Gold Eagle Clearinghouse for AI cyber threats. This is a White House initiative. They have spun up this, I guess it's like a CERT style clearinghouse for vulnerability information. There's AI triage. You know, you would think that this would be run out of sisa, but the White House really doesn't like cisa. So apparently this is being run out of treasury with input from cisa. Chris, you are plugged into all of the relevant grapevines here. What can you tell us about Gold Eagle?
- [43:19]
B
So you know, it's a, this one I, let, let me start where at the CISA point, you're right. If, if, if the government was to establish a industry coordination mechanism like this, the obvious place is to put it where Congress intended it to be. And that, that would be cis. It's actually in the law that CIS is the, the General Coordinator for infrastructure Risk and they do things like this with certcc. They run the CVE coordination program out, out of cisa. They have things like the Joint Cyber Defense Collaborative which brings together different bits and pieces of industry. And that's where it's supposed to be. That's what Congress intended and that's how the US Government is supposed to work. By the way, the Article one that Congress says this is the law, this is how the things are supposed to be. In the Article 2, the executive branch says, okay, we're going to go do it that way. Not happening here for obvious reasons that this administration doesn't seem to like CISA very much. And you've touched lightly on the reason for that previously in this very podcast. So yes. So they get to that executive order from a month or so ago, what early June, and Treasury gets tapped with the responsibility of this coordination clearinghouse, whatever it's called, Gold Eagle. I almost want to say Golden Eagle every time. I don't know why it's Gold Eagle. Anyway, it doesn't matter. Treasury doesn't actually have the in house capabilities to do this sort of work. In some cases they don't even actually have the authorities to work cross sector. So they have to rely on CIS's authorities to even get this thing done. And they're building the infrastructure because, again, remember, they don't have this. So they're building it right now. And in some cases, as I'm seeing it, it's actually industry in the finance sector that is kind of helping them, guide them along, kind of telling, this is how you do it. These are things you need to think about. So as it stands now, I think this is just a kind of a front door, a thin veneer, and then there's some kind of manual process behind. But, you know, it really remains to be seen if this is a functional capability right now. I don't think it is. We'll see what it looks like in a month or two.
- [45:41]
A
Yeah, yeah. All right, we gotta whiz through the next items here because we are running out of time. Code is law. This is a very funny story where there is something called the bonk Dao, where there's a bonk cryptocurrency and someone bought like $4 million worth of this cryptocurrency so that they could vote on a governance change and get a quorum. And they voted themselves 20 million bucks. And that's very funny because code is law. Code is law. You don't need no stinking financial regulation because code is law.
- [46:15]
C
Yeah. And look, great return on investment, $4 million buy influence the decisions. $20 million out. Good job. The real head scratcher here is how does a cryptocurrency called bonk have an aggregate valuation of $400 million?
- [46:32]
A
Usually I can actually answer that, James, which is usually they don't have any market depth at all. So, you know, there's someone who's trading up like, you know, 10 tokens until the token value is really high. And then they just say, well, obviously if we sol the tokens, that would be worth this much. But of course, there's no depth in the market. I mean, but Obviously there was $4 million worth of depth because that's what someone spent to buy them. Now let's see if they. If there's $24 million worth of depth now that they have 24 million, right? So who knows? Who knows if they even get paid? But just a very funny story. We have also seen, obviously, like when I came back to my news triage queue after a couple of weeks off, oh, my God. You see people saying, still on social media, a lot of people working in offsec saying, oh, this bug apocalypse, things all hype, it's not going to happen. We're in the middle of it. It's happening right now. We got a SharePoint bug out there being exploited in the wild. There's a bug in WordPress core. I heard about that one on Sunday here because Dylan o', Donnell, who has done web dev work for us, he's a friend of mine, got in touch and he's just like, man, this WordPress bugs pretty bad. So he was working on a Sunday to deal with all of the WordPress stuff he looks after. He managed to mitigate that and good thing he did because that one's being exploited in the wild. Congrats too to Dylan for finishing off his last round of chemo. That was. He got his last infusion last week, so well done, mate. Look forward to seeing you when you're feeling a little bit better. And yeah, we got a critical service now bug as well. A critical in Palo Alto VPN being exploited. There's been a bunch of incidents as well. Coca Cola's like dairy line of products in the United States that, that, that line has been shut down with a ransomware attack. There's been heaps of them. You mentioned though, James. And just very briefly, the ServiceNow bug looked actually pretty interesting. The one that's being exploited in the wild.
- [48:22]
C
Yeah, the others are SQL Injection, but this one's neat. It's like a sandbox escape using a gadget. I mean, it's just when you hear that sort of thing, you're like, oh, okay, that's some real in depth stuff. That's not surface level. So that was good to see.
- [48:33]
A
Is this the one where you could actually just stick a binary into like a net binary into a cookie field or something and would just execute it?
- [48:41]
C
No, no, that is 100% SharePoint.
- [48:43]
A
Oh, that was the SharePoint one. Sorry. Yeah, yeah.
- [48:46]
C
And so it should be.
- [48:47]
A
Yeah, yeah, yeah, exactly. I was. Sorry, I got that one mixed up. We've also seen a lawsuit that's pretty funny where Magnet, which is like, I think they bought like Gray Shift or Gray Key or whatever they're called, they are suing one of their former employees for burning one of their bugs. For allegedly burning one of their bugs. So the usbliterate bug, which is an unpatchable hardware level bug in a bunch of Apple gear, which is very handy for these forensics firms. Their allegation is that this guy left, joined a competitor and then they blogged about that bug and thus burning it. This is the blog where they've got their own description of how they discovered this blog, which is not. Hey, we hired a guy who happened to know about it. So one of two Things has happened here. Either a disgruntled ex employee has burned their former employers bug or there was a case of parallel discovery and this guy is completely innocent. But either way there's a lot of yeah, there's lawsuits flying around and it'll be funny to see what happens in
- [49:45]
C
discovery, parallel discovery on such old hardware. I'm not sure I buy that. I think that that was a neat little story they concocted for a bit of plausible deniability there.
- [49:55]
A
But that is just conjecture and we have to wait and see what happens in the courts. Please don't sue us based on what James says. What else have we got? We've also got Apple suing OpenAI because it's complicated but basically they're saying basically an ex Apple employee went to OpenAI, used their Apple issued laptop to conspire with another Apple employee to steal a bunch of like schematics and whatever and they carried this all out in full visibility of Apple's like security teams because they did it on Apple issued devices. Just so dumb. And now it's turned into a big lawsuit. You know you've anything Apple you're always interested in because you used to work there. But you've looked at what some of the Apple analysts are saying and they're like it's not really about the theft of the ip, it's just a really good excuse for them to go after this one particular ex Apple guy who is now at OpenAI and is poaching a bunch of their stuff.
- [50:52]
C
Yeah, this, this is 100% about talent. There's a former VP of hardware engineering there, he's been siphoning up all the talent. He had a bit of a falling out with John Turner who's now the CEO. So that's what it's about. But Apple hasn't had a way to really prosecute him because you know, it's difficult around there's so many laws that protect people to be able to freely move between companies. But in this case it just happens that he managed to hire someone that just did the dumbest of things in terms of how they exfiltrated data. And yeah, it's literally like sort of handed Apple a lawsuit on a silver platter so that they can go and file it and go after this main guy.
- [51:25]
B
Yeah, Apple is playing the role of the market diffusionist right now. That is the fear group that they are representing and that they are trying to stymie that consolidation of market talent and to quote Star wars begun. The tech war has yeah, I think
- [51:43]
A
it's, yeah, I really like this. That whole theory that it's everyone's just motivated by their fears and you need to analyze this whole thing from look at the person. What are they scared of and that dictates their position. It's, it's a very clever way of looking at it. Chris. I really enjoyed that. What else? A couple more that we're just going to talk about quickly. Apparently there was Pegasus spyware turning up on a member of the PEGA Committee in the European Parliament. So that's very on brand for nso, which is to go and hack the committee member of someone who is investigating you just, I mean, it just, it never ceases to amaze me how low they stoop. Amazon is fixing a bug that gave people bills for billions of dollars in their AWS console. I wonder how many suicides may have been triggered by this bug. But I mean, I guess not because they were like in some cases trillions of dollars, which is very funny. So, yeah, that's, that's hilarious. I wanted to give a shout out to this week to Catalyn Kimpanu, our colleague who was on the top spot on Hacker News with his scoop that a hacker wiped Romania's entire land registry database. So well done to Catalan for that one. And yeah, that's basically it for this week's news. But we are going to talk just quickly about this story, which is because it dovetails nicely with this week's sponsor interview. But Microsoft is saying Entra is going to be passkey only from next year. No more SMS or, you know, voice based mfa. This is cool. This is a cool idea. It's about time. But James, you're still sort of surprised they're being this aggressive on the timeline.
- [53:26]
C
Yeah, look, it's, it is a line that needs to be drawn and when I read the article I thought, yeah, good, this is great. But I bet it's like, you know, 2032 before they actually, you know, cut off these other channels. But to my surprise, it's February 1st will be when there is no more telecom delivery for SMS and voice authentication codes. And that's a good step forward. That's really good to see. I think it's proactive and it's happening pretty quickly. But that's what needs to happen to lift this game.
- [53:52]
B
These are the sorts of things that at least align with some of the NIST guidance and trying to deprecate SMS to fa. That's been years and so they're catching up here. Just passkeys make it easy too. I mean, everything now is just bang, bang, bang. I don't mind it.
- [54:09]
A
Yeah, I mean, I think it's like overwhelmingly a good thing. But we'll find out why it's not the complete panacea in just a moment, but let's wrap it up there. Chris Krebs, thank you so much for joining us in the news segment. Just fantastic to have you here. It's always great to catch up. Thank you for joining us. And James, thank you also.
- [54:25]
C
Yeah, my pleasure, Pat, thank you.
- [54:27]
A
Thanks, Pat.
- [54:28]
B
Good seeing you guys.
- [54:33]
A
That was Chris Krebs and James Wilson there with a check of the week's security news. Big thanks to them. Well, I guess it was a check of the week. The security news of the last few weeks because I've been away. This week's show is brought to you by Push Security. And push's Luke Jennings joined me for this interview a couple of weeks back. Push make a browser extension based product that can see what a user sees. Right. And the reason this is useful is it can stop people from getting phished and it can also help to stop, I guess what you'd call authentication or authorization phishing, right, which has become really popular. It could stop things like click fix, it can stop things like a consent fix, and it can also stop some of these device code phishing grants that are becoming extremely popular with attackers. And the reason they're popular is because they get around things like pass keys. You can pass key authorize a device like a smart television into your account. And of course attackers know this and you could wind up authorizing them into your account through this method as well. So Luke joined me to talk about why attackers are switching to these types of techniques and what they're doing about it at Push Security. Enjoy.
- [55:47]
D
We used to see very much authentication layer attacks, a lot of attack, renewable phishing. Now we still see those attacks, but they used to be the dominant attacks. And what we've seen now is an in as a sort of move towards attacks against the authorization layer. And I think that's a big reason or one big reason for that is because we keep adding new authentication controls making it stronger. Particularly people are gradually moving to passkeys now as well. And authorization attacks just completely bypass that. So like, you know, last year, the end of last year, we saw a new attack we termed Consent fix in the wild that was pretty targeted at the time. We haven't seen that go like completely mainstream yet, but it is available for sale. But what we have seen is a different authorization layer attack. Take off completely. And that's device code phishing.
- [56:39]
A
Just before you go on to device code phishing, just for those who don't remember, Consent Fix was this sort of like click fix style authorization attack that was quite convoluted. It basically pretended to be a cloudflare turnstile and then told the user to go through this authorization challenge with their Microsoft services, then cut and paste a URL into a local host thing that like passed a token to a thing. But that's actually how they would manage to get a token that would grant access to the account. Whereas device code phishing, which is the one we're talking about now, that's the same sort of phishing technique that you would use to connect, you know, your smart television to an account or whatever. Like if an attacker can set up that authorization flow and then capture that code, they get a token that comes into your account. The thing that's really handy about that one is the attacker doesn't need to have published some malicious OAuth app. They can just use a token that would enable a smart device into the account. So it's just like a direct access token. It's long lived. It's pretty much the holy grail at the moment. And that's the one that you guys are seeing just everywhere, right?
- [57:42]
D
Yeah, it was very much in February this year. It went from almost never seeing it to just daily overnight. Like the first kit is now known as Evil tokens. That was sort of dominant, but we were tracking new ones spinning up constantly. We track like over 23 different kits now. Eventually the FBI has put out some advisories on some, like one called Kali365. But there's more than two, trust me, we see so many now. So that's just become like a tier one threat. It's hitting every sort of industry vertical. It's just a widespread criminal threat now. It's not just attack and riddle phishing. Device code phishing is just a daily threat you need to consider now.
- [58:21]
A
Well, and there's not much you can really do about that in terms of like pass keys and like even Uberkeys and whatever. Because the attacker is actually authorizing that device. The device just happens to be in the possession of the attacker. Right. So it is passkey verified. You can FIDO authorize it, but unfortunately you're Fido authorizing something malicious.
- [58:40]
D
Yeah, that's it. Yeah, it's exactly that. It works past the authentication point. So yeah, like they've already authenticated and that's the thing. The user, they're not trained to deal with this scenario. They're not giving away passwords, they're not doing anything like that. They've already authenticated, they're just clicking enter in a code you've given them and clicking to allow the device and then that's it, full compromise.
- [59:00]
A
Yeah, so that is pretty gnarly. So I'm imagining that this is something that given your position in the browser, you're able to see pretty easily. You know there would be, because you're going through like a legitimate authorization flow. You're going to know when that's when someone is being asked to, you know, put a device code into a page. Right. So that is something you'll be able to see and stop. Is that, and, but how do you handle that when someone's trying to like do that legitimately? Because at that point you've got to decide, well, is this a legitimate authorization attempt or is this malicious? Like, is that the challenge for you now?
- [59:38]
D
Yeah, well, I mean we've got a few different layers that we use to deal with this. Like we obviously analyze all the kits that we see reused all the time. We build very generic behavioral rules for those and we'll just straight up block anything that we see that is a known kit we've seen before. It doesn't matter if it's on a new URL. If it's any way related to something we've seen before, we'll block that. But to the next layer. Like for that sort of zero day protection, we can actually just stop people entering codes into the browser. If you want to do that completely or provide a strong warning to the user and an alert straight to your SOC to say they've reached that, but enable them to click a button to go through if you need to enable that flow under certain scenarios. And we also have internally we've got sort of agentic threat hunting loop we're doing, mining all the browser data we have constantly looking for any new sources of people going to device code URLs where it's coming from, that feed straight back into our detection loop. So we're staying like very, very on the bleeding edge of this stuff and that's why we've seen so many kits.
- [60:37]
A
Yeah, I want to talk about the threat hunting stuff in a minute, but I mean is there much of a corporate use case for a device code authorization? Because I mean usually it's about authorizing. Yeah, like a smart TV or something. It's not really something that I think of being used a lot in a corporate environment. But I'm sure there's edge cases, right?
- [60:55]
D
Yeah, so I mean, I think it was originally intended for those kind of cases, but in reality it's ended up being used for things like video conference kits in meeting rooms and the other like printers even.
- [61:06]
A
I mean they, they are basically a smart tv, right? They've just got a camera and an IP stack in them.
- [61:10]
D
But yeah, yeah, yeah, but it's, it's also like been used quite a lot by CLI tools and a lot of dev related things too. So there's like other people have found legit use cases for it. And so yeah, it kind of depends on the complexity of your environment. You need to look through your logs and see where it's being used legitimately and figure that out. But yeah, there are, it's there for a reason. So it's not always easy to just try and block the whole thing.
- [61:34]
A
Yeah. I guess the advantage though is that quite often when you're seeing it, it's in the context of being delivered to a user via a known phish kit and you can actually just say, how about no?
- [61:43]
D
Yes, exactly. So yeah, we always know it's going to end up at that point and we can track where it's coming from and that's, you know, that's how we find the new, the new kits out there.
- [61:53]
A
Now you did just mention the threat hunting component of this, which I find really interesting. Right. Because there's no one else really. I mean, look, I guess that's not true anymore. You do have competitors these days, but like for a while there you didn't. Not many people have the browser telemetry that you have which enables you to actually do threat hunts through browser telemetry. Like I don't think the EDR companies have anything like this. Right. So you've got this like really rich, beautiful data source that you get to comb through. And of course you've got little digital critters, AKA agents that you can unleash to go and ferret around, go dumpster diving in all of that data. What does a typical threat hunt through that sort of browser data look like? Like how do the agents know what to look for? How do you task them? Tell us more about that. It's interesting.
- [62:35]
D
Yeah, I mean it's very powerful. I mean it's almost like acting, each browser is acting like a kind of little flight recorder of all the actions and user interactions and, and network requests and so everything going on inside the browser. And we've got our own custom query language so we can Issue hunts across our entire customer base to do that. So if you look at something like device code phishing here, we can go and say, look, let's look at anyone ever visiting a device code URL and look at how they got there, what their interactions were in the browser. And we've just got a very rich source there and we basically can find any new kit pretty much by doing that.
- [63:12]
A
That's so funny. It was. When you turned that on, it made so much of a difference for detections was like, not. Okay, so you've got visibility of the rendered page. Right. Which is what separates you from some sort of mail gateway or some sort of proxy that's trying to do inspection on this, on this sort of stuff. Right. So you're actually seeing what the user sees. So it's been through Turnstile, it's been through all sorts of obfuscation and gating, you're actually seeing that final payload. But the big unlock for you guys was actually when you said, okay, well we've looked at the page and we're pretty sure it's bad, but like, let's add some additional logging so we can see how the user got there. And then it became really, really clear. Hey, they just got redirected through 26 URLs in one second. Yeah, probably, probably. This is no good. Right? Like that, that, that is going to be some of your most reliable indicators.
- [63:59]
D
Yeah, yeah, certainly. That's really enabled us to get the sort of much rarer cases and the brand new kits that we've not seen before. And then. Yeah, that feeds into us writing the behavioral detections that work on those kind of rendered pages as well, that can just auto block there and then. So like between the two of them, they both accelerate each other. So like once we unlocked both of those features, it's, that's, yeah, that's why we're sitting there talking about 23 kits when if you look in the media, you've probably heard of maybe two device code fishing kits. Yeah, we can just stay ahead and find all the new things, even if they're rarer.
- [64:38]
A
Yeah, yeah, no, that is, it's funny. And I wonder at what point some of these phish kit operators or the customers of the phishing kits, more so, because currently as part of that ecosystem, there's all of the redirects. Right. That bounce the users around and then eventually land them on a payload page. You sort of wonder when they're going to start to tighten that stuff up because they know defenders are starting to look in the browser. That's when, you know, like you look at stuff like Gray Noise, for example. Right. Like, one of the reasons residential proxy services have become so popular among apt groups is because of services like Gray Noise being able to flag their static, you know, limited proxy networks. And now, you know, they've had to radically expand them. Right. So, I mean, you got it. You got to be waiting for them to do something here. But that said, I don't know that there's all that much they can do given that infrastructure is in place, the redirect infrastructure and everything is in place for a reason. Like, I don't think they can eliminate that.
- [65:35]
D
No. Yeah, they've put it there to deal with like mail gateways and other things that are trying to follow it. But it's much harder for them to sort of circumvent that in the browser because the whole point is you're with the user following the real target around the whole time. So, you know, they can't really get away from that. So, yeah, I mean, it's difficult to know. We'll see. I'm sure they're going to try to adapt in some ways to deal with this as it becomes more common, but I think it's going to be tough for them to deal with.
- [66:02]
A
Yeah. Now look, one thing that's worth mentioning here is the role of AI in all of this. You say AI is accelerating the development of the phishing kits. You also note that the number of like, OAuth tokens just sort of in existence these days is extraordinary, both because they're used by agents and also all of the supporting infrastructure that sprung up for, for AI is very sassy and everything is sort of integrated via, via OAuth tokens. So, I mean, I guess the long story short there is we're going to see a lot more. We're going to see OAuth becoming, and authorization tricks becoming a lot more relevant to sort of, you know, security practitioners, I guess, in the, in the next, in coming years.
- [66:46]
D
Yeah, that's definitely the case. I mean, yeah, I think there's a couple of assets there. Like, coming back to your original point, like, I'm pretty sure all the kits that we've seen recently for this have been developed with AI coding tools. That's why they've come about so rapidly. You can also tell just from looking at the underlying code, the sort of handcrafted, obfuscated kits that we used to see before have a certain tell and then you look at the new ones. The thing is that they're less obfuscated. That's one giveaway because they've been nicely documented, I think, by the AI writing them. But then, yeah, on the OAuth side, I mean, there's always been a lot of interconnections between different SaaS apps with OAuth. And people are a little bit blind to that without seeing those interactions inside the browser. But I think the advent of AI tools means there's just more of them happening now because there's more. You know, everyone wants to integrate their favorite AI tool into every other SaaS app to pull data, and it's becoming like a central point of all those interactions. And so, yeah, like, I think we're going to see a lot more general OAuth attacks and sort of stealing of tokens from compromised identities and accounts in the browser going forward. It's kind of inevitable as we build up that layer of risk, I think.
- [68:03]
A
So I guess, look, the baseline expectation is we're going to have to be doing like everybody's going to have to be in the browser at with at least one, you know, some tool chain or another if they want to be able to spot this stuff. Because, like, you can't fly blind anymore, I guess, is the tldr.
- [68:18]
D
Yeah, that's true. I mean, I think all the tricks that the attackers are using for these attacks to get around traditional solutions, like, if you really want a good defense here, you have to be with the user where they are seeing it, and that that is in the browser. That's the only way to do it. Well, now.
- [68:34]
B
Yeah.
- [68:35]
A
Yep. All right, Luke Jennings, thank you very much for joining me for that conversation. All about OAuth tricks and threat hunts. Very interesting. And we'll talk to you again soon.
- [68:44]
D
No problem. Thank you for your time.
- [68:47]
A
That was Luke Jennings from Push Security there. Big thanks to them for that. And yeah, Push Security is a great product if you want to push. Hey, no pun intended, Push Push, your Phishing Preventions app. The actual endpoints, not just rely on things like your email security gateways to do your phishing prevention. But that is it for this week's show. I do hope you enjoyed it. I'll be back next week with more security news and analysis, but until then, I've been Patrick Gray. Thanks for listening,
- [69:25]
D
Sam.