Loading summary
Transcript76 lines
- [00:00]
A
Foreign and welcome to Risky Business. My name is Patrick Gray. We'll be chatting about the week's security news with Adam Boileau in just a moment. And then we'll be hearing from this week's sponsor. And this week we're speaking with Arooj Bernie, who is the global head of risk and resilience at mastercard. And we're talking to him about, I guess, why fraud and cyber departments at financial institutions were traditionally separate and why they're unifying. That is an interesting conversation and it is coming up later. But first up, yeah, Adam, we got some great stuff to talk about this week and one interesting conversation to kick us off, which is this report from Anthropic about apparently a Chinese APT group using Anthropic to heavily automate operations. Now what makes this an interesting conversation, I guess is, I mean there's the report itself, but then there's been the reaction to the report with a lot of people poo pooing it. And we're going to sort of wade through all of that. But first of all, why don't you just walk us through what the Anthropic report actually says.
- [01:07]
B
So they spotted a campaign that was using their CLAUDE LLM tooling to carry out some kind of attacks. And they went and kind of pulled that thread. And it turns out that a Chinese group was, you know, had built some kind of framework to orchestrate attacks using CLAUDE as one of the components. And they were attacking, I think in the end something like 30 companies with this set of tooling and in some cases were successful, able to break in. And judging by the speed of the operation and the kind of amount of human interaction, Anthropic have written it up as kind of like a reasonably automated set of attacks that was able to do initial reconnaissance, submit those results back to a human for approval, carry out attacks. We saw some conversation about using credentials that are discovered, some using SQL injection, some using server side request forgery flaws. So using technical flaws that the LLMs had kind of pulled together to break in, escalate some access, exit the data, triage that data for further credentials and access, and then use that eventually to extract information from the target organization. So a pretty reasonable end to end hacking campaign orchestrated by an LLM on behalf of maybe the Chinese mss. So it's pretty cool.
- [02:25]
A
I mean, it's extremely cool. Right. So what's kind of surprised me about this is the number of people taking a cricket bat to the findings. Right. Taking a cricket bat to the report. And there's this Strange line of attack that a few people have participated in. Right. So one of them is, is Kevin Beaumont, who is quoted in, I have to say, an excellent write up on all of this by Derek B. Johnson at cyberscoop. If you're going to read one story about this, it should be that one. But you know, it quotes Kevin Beaumont in that piece, you know, saying that Anthropics report lacks transparency. Okay, fair. We'll get into why that might be a little bit later on. But he also describes, he said it describes actions that are already achievable with existing tools. And I've seen multiple people, you know, criticize the report saying, oh, it's not a big deal because they used existing tools. I mean, that's not the novel part here. I mean, that's entirely what you would expect from this sort of campaign. So I don't understand that criticism.
- [03:16]
B
Yeah, yeah, I mean, I think, you know, we want to see amazing, you know, superhuman stunt hacks that no human could ever pull off. Like that's what we want from AI hacking. And we're not there yet. We may well get there because, I mean, you know, is moving at a very good pace. But like the thing here is that doing it at scale and Anthropic had some data points in the report about kind of like how many people they think are involved, like kind of what scale of the operation this is and being able to do things successfully break into even if it is only a handful of the 30 targets with a relatively small team. And to do that kind of at scale, that's kind of interesting. Even if it isn't the superhuman stunt hacking that we want to see. And maybe we will.
- [04:02]
A
Yeah. I mean, look, our mantra on this show is talking about how operational sophistication beats technical sophistication every time. I mean, that is something that we have been saying for 10, 15 years about apt operations. Right? So to see this criticized on the basis that it's not doing anything technically novel, that's not the interesting part. The interesting part here, as you point out, is the scale. So I think people are attacking this as in they're sort of straw mounting a bit and saying that the report is saying something it's not. I mean, this report is not saying that a Chinese APT crew just entered go hack these targets into a prompt and off it went. That's just not what is alleged to have happened here. But imagine this. Imagine you take you look at the pyramid of skills in an organisation like MSS or NSA or whatever, right? You don't have to go too far from the top of that skills pyramid before the skills tend to thin out pretty rapidly, right? So you've got your really, really a tier sort of operators, right, who can write exploits, direct attacks and whatnot. And you know, a big part of their job is getting the lower tier people to be effective and that's what this solves. So imagine if you take your hundred best people from an intelligence Org for example, and just task them with using AI tools to do these sort of campaigns. You're going to get just insane bang for buck. And I think that's really what the, what the message is here and it is significant. This is huge.
- [05:29]
B
Yeah, I mean the, I guess, you know, there's a number of questions like why Anthropic? Like why are they exposing, you know, an American firm to the inner part of their hacking? And that's, you know, kind of, it feels proof of concept rather than a thing they are, you know, using in like real anger. Because as you say, like the, if you were to do this with the 100 best people in an intelligence Org, like the results you would get would be pretty impressive. And in this case like they are still learning, right? I mean one of the things Anthropic says in the reports is that there are a number of cases where Claude has, you know, hallucinated credentials or hallucinated access that it's got or overstated its findings. And actually when I was talking about this with one of, one of my ex colleagues, you know, we said this is exactly like a junior pen tester. There are plenty of people that I worked with that got overly excited about something they saw, they misinterpreted something or they didn't think about the overall security model. And training those people into being amazing hackers is kind of what we did back at Insomnia. And the idea that you can do the same with LLMs with the right guidance and with the right framework and plumbing and scale, it, you know, is pretty wild. And I think, you know, you are right in the sense that, you know, as people go all in on this type of thing, like it's going to get pretty wild, like, and we are only seeing the beginnings of it. And of course we want to see the end state, right? I mean I want to see all of the juicy details and you know, we want to see, you know, what does this look like right now and where is it going and we want to be excited about that. But it is very easy to, you know, also fall into the trap of, well I mean, of course it's just automating, you know, some SQL app or anyone could do that. But that's kind of, as you say, not really the point. Right.
- [07:10]
A
It's not the point. Like, I actually was having a conversation earlier this week with HD More for an upcoming sponsor interview for the. For the weekly show. And, you know, there was this interesting part. I don't even know if it made the final cut, but we were just talking about how like, something like run zero, you know, it's not really at risk from agentic platforms, but it is something that agentic platforms will use. Like, so. So for all of the products that I can think of that where it makes sense it to actually have an MCP server, it's like run zero, Right. Because you want agentic platforms to be able to use these things. So, I mean, I don't see anyone criticizing an elite pen tester because they use existing tools. Like, are they only supposed to use novel tools? Like, it's just such a weird way to argue about this. I think it's also interesting. Yeah. That they used anthropic, given that there were guardrails that they had to bypass, for example. And you're thinking, well, why would you do that when you could probably spin up like a deep SEQ rig, you know, in China and do it? So cyberscoop has sort of wondered whether this is signaling. I don't think so. I think it's just like, why not proof of concept? Like, let's, let's give this a go and see what happens, see if we get rumbled. I don't think anything too sensitive on their end was exposed, but, you know, the whole thing is just fascinating. Now, one criticism that you do have of the report is that it lacks detail. I think it's about as detailed as it can be without having the senior executives come and absolutely kick the crap out of you for sort of giving people a template for how these operations are conducted. I mean, that's, that's. I mean, I think they've been reasonably detailed in what the shape of this operation was. I was sort of surprised to see you criticize it for lack of detail. I mean, you wanted to see the, the command lines. You wanted to see the PCAPs.
- [08:52]
B
Yeah, exactly. I always want to see. I always want to see the juicy details. But, you know, because they're so much of interacting with LLMs is in the specifics. Right. Of how you craft the prompts, how you convince it to do the things, and how you kind of berate it. Into doing what it needs to do. And actually, I think there's a guy from Anthropic's Threat intel team that was talking to CybersGroup.
- [09:12]
A
Yeah, no, he. And he gave, he gave great comments too. That's why it's one of those. It's a terrific story. People should read it.
- [09:17]
B
Yeah, yeah, he did. And he said that, like, the framework that they built to do this was probably the bit that involved the most engineering. Right? Because like harnessing the LLMs and all the MCPs and doing all the integrations and making all of that kind of plumbing work was the real challenge here, as opposed to the LLM, as you say. Like they could have easily subbed in a Deep Seeker or something else. And I guess just using Claude for a proof of concept, for something to try out and give it a go, as you said. Why not? What are they really going to lose here? Everybody's trying this kind of thing. But of course I want to see the prompts, I want to see the input data, I want to see the output, I want to review its output. Because, you know, I did so much of this stuff for a living. So I'm professionally curious, like, how good a job did the LLM do of what used to be my job? Right? So, yeah, that's one of the things.
- [10:07]
A
One of the things, one of the things the attackers did here is that, yeah, they broke everything up into tiny steps to kind of avoid those guardrails, right? And I sort of think, well, you know, if they start publishing exactly how they did that, you know, I can't imagine they fixed this yet. I can't imagine they've got a uniform ability, like a reliable way to detect this sort of behavior. So I just can't see them doing that. Do you know what I mean? I can imagine there would have been terrible management pressure as well. Like, just imagine, imagine being a security people who wrote this report, reading the.
- [10:34]
B
Anthropic report, like, you can definitely feel a little bit of that frustration between the lines when they're talking about how they've addressed it and added more kind of layers of controls and so on. So it is a very hard problem to stop large language models doing what they have been asked to do, right? And all of the guardrails you have to add and all of the kind of things you can do. The fact we end up having to role play, but we're defending, we're totally legitimate security researchers or whatever with the LLMs to make them do stuff is on its own just already hilarious. One of the other criticisms has been around, you know, whether they provided enough details to let defenders, you know, kind of see these attacks in the wild. So things like IOCs, they've been sharing privately. But of course I always want to see all of the good stuff, you know, wherever. And you're right, like I imagine the pressure on them around this. So the amount of review that's probably had to go through, you know, does mean it gets cut down a little bit for the general, you know, the general release.
- [11:28]
A
Yeah, I mean I think we've got to remember like what you just talked about in terms of like how they had to build a big rig to make all of this happen. And the AI was one small component of it. It's just such a critical component. Like you can kind of think of this as like a way to write, you know, to have a self writing bash script or something like that, which is just so powerful. Right. Simple steps, but you need some smarts in there. That's why when you look at how tines have thought about AI where they can just have like a single automation block that you can put into an automation, I mean it's just there's so much you can do there. So I do really see this as a big deal. We're going to move on to talking about some other stuff. But one thing that I found fascinating is yeah, these attackers were dealing with these things as you mentioned earlier, like hallucinated and fabricated credentials, exaggerated findings, you know, things like that. When you talk to people who work in AI based startups, which I do quite a lot, these are the same challenges that they face. Like it's, you know, 99% of the work is in dealing with the shortcomings and unpredictability and weird results that you get out of these models. So yeah, I just, I think this thing is really interesting and I think it is just so naive to think that this isn't kind of game changing. Right. You look at what people are doing on the white hat side with scaled out pen tests and sure they're not going to be the most elite level pen tests and whatever, but scale, scale is important. Scale is a very big deal. Scale is game changing. And I think you ignore this or shoot it down at your peril because this is the future of operations and it's really just going to mean that those top people, those most talented people get scale. So yeah, anyway, everyone should check out that cybersecurity piece. It's really, really good. Now talking about something a little more old school is Amazon has discovered an APT group exploiting some Cisco and Citrix o days. Hoora.
- [13:21]
B
Yes. Yeah, this is a campaign that's targeting the Cisco identity services engine which is like kind of their like Radius and authentication plumbing system underneath. It's just a Java web app. And the reason obviously we see bugs attacking this kind of software stack pretty often. The reason I wanted to pull this one out is Amazon looked into the like the post compromise parts of this, the implant that gets dropped and so on and it's actually really good. Like it's proper in memory only Java post exploitation payload with proper crypto with good auth uses thread injection reflection stuff to propagate and stick itself in the right place in the Java process. It hooks all of the incoming requests going through the Tomcat servlet engine for its own purposes to be able to get data in and out. It's very well done. It's nice and competent. And you know that I love hurting Java systems so when somebody else does it, you know, I have respect for that.
- [14:18]
A
Do we know who the threat actor is here or.
- [14:20]
B
I don't know that we do. Amazon didn't really say. I mean it honestly it feels Chinese but that's just vibes like I've got no actual, actual data there I don't think. But it's competent, which I like to see.
- [14:32]
A
And another week, another absolute clanger in a Fortinet product.
- [14:36]
B
This one's dear. So there was a bug in Forta Web which is their web application firewall product and the bug is path traversal to codexec. So like through to making accounts you can call an API to create user accounts and get CodExec and whatever else, but it's just like it's in the web application firewall and it's path traversal. Like what are you doing? It got stuck in the CISAKEV list. It is, I believe the 21st Fortinet entry into the CISAKEV link. So like that's pretty special I guess. Congratulations.
- [15:13]
A
They do security. Fortinet does security.
- [15:16]
B
They do it. I guess that's a verb you could use. CISA has told U.S. federal agencies to patch everything super urgently. This thing got spotted in the wild as a zero day. I think maybe as far back as August we saw some people spotting us hitting honey pots and stuff. So just the classic Fortinet story. Except that there is also another Fortinet bug which is being explored in the wild as of a couple of days ago, which is another. What was that? One's a command injection. So yeah, that's just, you know, the fact that there are so many bugs and so many Fortinet products being exploited by so many people. And this is meant to be a security thing. Like we've, we've said all of this so many times before, but it's just, you know, it's embarrassing for us as an industry to have a Fortinet in it.
- [16:02]
A
So yeah, it is. I mean, I had a great conversation with Andrew Morris actually. I'm going to be publishing that one later this week. That's a soapbox edition. And you know, I think there's a bit of a misunderstanding out there among organizations about what their risk exposure is when it comes to border devices. And you know, Andrew's sitting there at Gray Noise just seeing all of this stuff because they've got this massive honeypot network. It's interesting too, the Amazon stuff, the bugs that the Citrix and Cisco stuff that Amazon found, that was also honeypots, right? So there's really cool scaled honeypot networks now, Gray Noise probably being the gold standard there. And yeah, he's just like, there's so much happening. He's like, I can't. He's like he could barely believe it. He's like, if people could see the scale of it, like it would get more attention. And it's just this black hole. Like you talk to orgs and they're like, oh no, we're totally comfortable with what's on our border. And you're like, why?
- [16:52]
B
But they just don't know, right? I mean, that having a Fortinet on the edge of your network is the strongest correlation to getting owned that you can have. Right? What are you doing? What are you doing? What are you doing?
- [17:01]
A
Yeah, exactly. So as you said, CISA is giving federal agencies one week to patch that, which is great, just in time to call Mandiant. But look, speaking of cisa, I mean, this is a real slap your forehead kind of thing. Eric Geller over at Cybersecurity Dive has this write up which is CISA is now planning a hiring spree. Adam. Now this comes after they just fired so many people and now they're trying to rebuild. I mean, I just despair, like, like, what was the point of any of it? What was the point of any of it? I mean, I get the sense that Americans are getting quite frustrated with this admin. And when you consider that he was only sworn in in January, like, that's amazing how quickly he's become so unpopular. And it's just chaos like this where you just think, my God, you know, you go in there, take a razor to an organization like this and then you turn around within months and you're planning to rehire according to a memo from, like senior executives there.
- [18:03]
B
Yeah. And at what cost? How much did it cost to get all those people out of there? How much money did they say? Probably not very much. And now they're going to have to bring, you know, a whole fresh tranche of people in, train them up again, rebuild all the relationships again. All of the skepticism that partners and, you know, people that they had relationships with, like, it's just so stupid at a point in time where, you know, like, who could have thought that cyber would be a thing they'd still have to care about in a few months, you know, that China wasn't just going to stop. And so it's just so frustrating and so predictable and like, I just, you know, I feel for, you know, people like Chris Krebs. Right. Who obviously were, you know, super involved in SIS's existence. It must just be like, how does that guy get up in the morning and not want to just crack open a bottle of scotch at dawn, you know, because it's just so frustrating.
- [18:52]
A
Yeah, it really is. So this comes from a memo from the acting sister director, which is Madhu Gotu Makala. This was a November 5th memo to staff that Eric got his hands on. And, you know, the agency remains hampered by an approximately 40% vacancy rate across key mission areas. So you just think, well, what was the point?
- [19:12]
B
Yeah, really? Yeah, exactly. So dumb.
- [19:16]
A
Now Google is suing 25 people it alleges is behind this scam text operation that uses a phishing as a service platform called Lighthouse. This is a story from Matt Burgess over at Wired. And you think, okay, why? This isn't a very interesting story. And then you read it and you get a sense of the scene scale of the operation they're talking about. You're like, okay, wow.
- [19:38]
B
Yeah, yeah. This is one of the kind of tooling and frameworks that's behind a lot of the scams you get for, like, you know, you've got a package or you've got an unpaid road toll or whatever else. And there are some ties from this particular set of tooling back into some of the really large scale financial fraud operations that are trying to say the ones that are using, you know, like phones preloaded with credit cards and stuff that they've gone through Google Pay or Apple Pay through get enrolled using phishing techniques. So there's a bunch of tie in between this group and that kind of mechanism of cashing out. But yeah, the scale, like something like a billion dollars is what Google says has been involved in this particular. The Lighthouse. The Lighthouse Group or the Lighthouse software service being used here.
- [20:23]
A
It's not just a monetary scale. It's like you look at the tens or hundreds of thousands of scam websites that are linked to this and you're just like, my God, that's a lot of work.
- [20:31]
B
Yeah, I mean, the scale is really quite something. And you know, the quality of the integration with, you know, Google RCS and Apple iMessage and all of the, like, components. You need to do this at scale. And yeah, I think one of the numbers was something like between 100,000 and 200,000 scam sites. Not victims, just sites. Yeah, right. And you know, tens. Sure. As many as 100 million victims. Right. And the scale is just. It's ludicrous. And this particular lawsuit, like Google hasn't. So most of these people are unnamed, but I think this is part of, you know, kind of wider things to start applying pressure, start shutting it down, start using some of the other tools in law enforcement options around the world to be able to deal with it. But yeah, the scale is wild and yeah, I guess good work, Google, for pulling this together and, you know, dealing with, you know, going through the courts here.
- [21:19]
A
Yeah, I think. Well, I think you go through the courts when law enforcement hasn't done anything. Right. Like, that's a big part of it. But, you know, staying with the theme of scale, it seems like scale is really our theme this week because there's been some researchers who look, I mean, it's. It's nothing much to get excited about, I guess, but it's still kind of interesting. Andy Greenberg has this one over at Wired where some researchers were able to enumerate like some basic WhatsApp account details just by looking them up in like the WhatsApp contact directory service or whatever. You wonder if they hammered them from one endpoint. Probably not, because they enumerated 3.5 billion phone numbers and worked out that they were, you know, WhatsApp phone numbers. And a substantial portion of them, you know, you pulled down the, like, display name and the picture, which is interesting. I mean, we've talked about scraping over the years and how these data sets, even though they're very limited, can actually come in quite handy, especially when you start cross referencing them against other data sets. But geez, 3.5 billion accounts. It gives you an idea of just how big WhatsApp is. And you do really Wonder what they can do when it is essentially like this gigantic multi billion endpoint, you know, network. What can they do to stop that sort of enumeration? I think it's kind of hard.
- [22:37]
B
Well, I mean, I think that this report proves exactly that because this is not the first time we've seen bulk enumeration of WhatsApp accounts. And the last time around this happened, WhatsApp and Meta said they were going to introduce some rate limiting and some controls and so on. And it does not seem that that has been super effective. This particular set of researchers, I think they're Austrian, they started out enumerating some in the US and they said they went through like 30 million American phone numbers in the space of half an hour, realized that they weren't getting throttled or stopped the block defectively and then just kind of kept going to see how far they would get. And when WhatsApp in some countries, WhatsApp is super big, like in Brazil for example, and they were able to get a couple of hundred million people's worth of stuff out of WhatsApp in Brazil, which as you said, when you can correlate with other data sets or in particular cases where the market penetration is very high. In India, they also found a heap ton because WhatsApp works really well in poor network connectivity situations. Like it's one of the more robust messengers. So like there are things you can do with this and you know, much like Google Dorking for hacking targets or whatever else, like being able to, you know, do something comprehensively at scale like this does give you things even when it is just public data. And I think, you know, the response here is what, you know, Meta has come back and said they're going to work on, you know, rate limiting controls and so on, but ultimately using something like a phone number as a user identifier has this inherent problem and moving to usernames or something because remember we had the conversation about when Signal brought in their username feature and started discouraging the use of phone numbers as identifiers on the signal network. That's kind of the direction it has to go, which has its own frustrations, of course, but inherently it is very difficult to make phone numbers suitable for this purpose. And this is why. So.
- [24:33]
A
Yeah, yeah, no, I mean, it's like, it's funny what you said about the poor connectivity thing because like cell service in Brazil is actually pretty good. My wife's Brazilian. I spent a lot of time in Brazil. The, you know, the connectivity thing isn't so much of the issue. But the plumbing of the networks meant that SMS were just really unreliable, which is why WhatsApp just took off over there. And, you know, it's a story I've told on the show before, but we had a little car prang over in Brazil once and the entire insurance claims process was driven over WhatsApp. Like it is so ingrained into absolutely everything. I've got a fun story that I'm going to tell actually, which is when my wife moved to Australia, she kept her old Brazilian phone number and kept her WhatsApp number, you know, so that was her. She just kept it on her Brazilian number and that was all well and good until eventually that number expired and then some kid wound up having the phone number and her WhatsApp was just locked out. So we wind up messaging with this kid and he was like 12, 13 years old or something in Brazil saying, you've actually got our wife's, you know, we explained the situation to him and we actually had to get him to briefly relinquish the account so that she could recover all of her, like WhatsApp history and everything, which was just this really funny situation where we're sitting here in Australia trying to convince this like 12 year old Brazilian to please, like abandon the account. And he was a good kid, he did it, he actually did it. And we were able to recover the account and like turn it over to an Australian number and whatever, which meant that I think she lost access to like groups or something. Like there was a reason we hadn't do it, I hadn't done it. But yeah, it's just funny when you've got just so much PIN to a phone number and that phone number can be returned to a pool and away it goes. Now let's move on and talk about a mystery being solved, right, because we saw that Starlink was finally cutting off some of these, some of these dishes that were being used by scam compounds in Myanmar. And we thought, wow, maybe that was in response to the announcement of a congressional inquiry or a committee was going to look at why this was happening. But I think we have a better answer now in that Elon Musk and his friends are not particularly well known for being, you know, scared of Congress. The DOJ has actually spun up a new task force that is looking to tackle a lot of these scam compounds. And one of the things they've been doing, which is very smart, is issuing like seizure demands for the dishes that are being used by these scam compounds. Which means that Starlink has to turn them off because they are sort of seized, they are property of the US Government. Turn them off. And I think that is a great way to skin the cat.
- [26:57]
B
Yeah, yeah. So I mean they, they can't physically seize nor at least there's no, you know, obviously there's no easy way for them to do that. But the process of marking them as seized, making, authorizing them for seizure, now SpaceX has to help out and actually, you know, block these devices. And yeah, like when I saw this come through when we were preparing the run seat for the show, I'm like, was this an option all along? Did they only just think of this? Like, is this a novel approach? Because yeah, like it's working, which is great. And any tool that kind of, you know, helps hamper these scam comments is great. It's just funny that it kind of took this long. Like I would have thought that if this was an avenue they would have thought of doing this before. But I guess, you know, maybe there's some reason that it didn't happen yet, but.
- [27:37]
A
Well, they would have been busy, right? Like that's always the answer. It's always the boring answer of like they were busy doing other stuff. And you would have to think like, okay, so you're a scam compound operator in Myanmar. You've lost your Starlink, you can't get fiber. I mean the next option you're probably going to be going for like microwave links at that point. Right? Like just beaming them across until you can get to some point where you can plug into some fiber, you would think. But then that comes with its own risks as well. Hopefully we can turn this into a losing battle for them.
- [28:05]
B
Yeah, like having to build out your own infrastructure and maintain it and so on. Like that's complicated. It also expands, exposes you because of the, you know, at some point you have to interact with the rest of the network. And we saw that with, you know, like our mobile network being built by, you know, South American crime organizations for example. Like you have to trust the people that are building it. You have to trust the equipment, you have to trust the interconnect points. Anything that increases the amount of interaction with third parties makes it more risky. And yeah, Starlink I guess was just super easy and now we've got a tool for taking that away from them. So yeah, yay.
- [28:37]
A
Yeah. Now staying with US law enforcement actions and a bunch of US citizens have pleaded guilty for, to helping these North Korean IT worker scams. What was interesting here though is a bunch of the People who were charged, I think there's 1, 2, 3, 4 of them, they pleaded guilty to wire fraud conspiracy because they provided their identities to North Korean workers. So this was how they were making money. The North Koreans approached them and say, hey, we want to use your identity so that we can have this job and you funnel the payroll or whatever. But they even went so far as to, like. One of them went so far as to, like, take an employee, like, drug test for the remote North Korean worker. I think one of them was paid about 50 grand for his role. The other one's like three and a half, four and a half grand. Like, not much. And now they're in really serious trouble. But it's just interesting, isn't it, that the number of little moving pieces that. That are required to get a scam like this actually running and the amount of money they made in salaries was like 1.28 million. So not really that much. I mean, I don't understand quite why they bother with this as a money spinner. I mean, maybe as a way to get access, but it doesn't look like it's actually that profitable compared to the crypto theft, for example.
- [29:46]
B
Yeah, it does. It does seem a little. I was surprised at the size of the amount of money involved here. Like, I was expecting it to be bigger than it was. And certainly, you know, for the people who are helping them out here, I was expecting they were making a little bit more money than this. One of these. One of the guys that pled guilty was an active U.S. army soldier, and, like, this is his side hustle is making what, 50 grand out of North Korean scammers? Like, you would think that. Surely at some point in the indoctrination process, you know, you get some training about, you know, operational security and blah, blah, blah. Maybe not, you know, peeing in a jar for a North Korean, you know, employee scam, or, you know, having laptops and laptop farms in your house for this stuff. Like, surely this is a thing that would have crossed your mind. But you know, and also for 50 grand. For 50 grand, that's a lot of.
- [30:31]
A
Money for a grunt, right?
- [30:33]
B
I suppose. But, you know, still, dear, oh dear. Some people, you know, like, surely he must have thought through this process just a little bit. Anyway, I guess he's finding out now if we've got to the find out phase. But yeah, it's just funny, you know, seeing because you're selling yourself scapegoat as a service, that's what you're providing here. And I don't know, it just. What were you thinking? What were you thinking? What were you thinking?
- [31:00]
A
I agree, I agree. But there's a lot of what were you thinking in this show? You know, there's an awful lot of it. Like, Peter Williams comes to mind, but. Oh, and we should also point out, too, do not be alarmed by the sirens in the background. Adam is not at home. He is. He has traveled to Auckland because he is going to the Metallica show tonight. Right?
- [31:17]
B
Yes. Metal.
- [31:19]
A
Yeah. So that's going to be fun. So don't worry, they're not coming to arrest him. He's just in a noisy Airbnb.
- [31:24]
B
Not today.
- [31:25]
A
What's interesting about this one, too, is the DOD. Jay's like, yeah, we also seized, like, $15 million. And you're like, wow, that's great. And then you read that the $15 million is the proceeds of a bunch of different incidents. One theft of 37 million, one of 100 million, one of 138 million, and one of 107 million. But, hey, you seized 15 million. That's.
- [31:45]
B
That'll show them some hella roi right there.
- [31:49]
A
Yeah. We got more. Absolutely staggering numbers from the Land Rover ransomware attack. Alexander Martin has this one up for the record. Headline is, Cyber Attack leaves Jaguar Land rover short of 680 million pounds. So that's about 900 million US dollars. And I think. What was it, it lost 640 million dollars, I think it was over the quarter, over the period, it just says. But that was driven by the production halt, which is down from a $400 million profit in the same period last year, which is just, you know, wow, this is just, you know, I think if. If this doesn't motivate senior policymakers to take this as seriously as cancer, nothing will.
- [32:37]
B
Yeah. I mean, they also face, what, US$250 million worth of costs involved in the direct costs from recovering from the incident. Like, it's a real big set of numbers there. And, you know, given that there were probably British kids doing it, like, man, oh, man, are they gonna be in trouble. And you're right. Like, the policymakers in the UK are just, you know, what else? How much worse would it have to be, I guess, for them to take it real seriously? And, yeah, these law enforcement wheels are gonna turn. You know, they may take a while, but they're gonna turn. They'll get there in the end, and boy, oh, boy, they're in for a rough time.
- [33:10]
A
Yeah. And meanwhile, the FBI has been out talking about the Akira ransomware gang, and they say that they've made about $250 million in Ranso 23 or whatnot, which is, you know, quite a lot of money. These guys are kind of like particularly scummy because they attack sort of small to medium enterprises, which you kind of think, and you know, K12 districts and stuff like that. You kind of think if you're a ransomware actor, that is kind of smart. I'd avoid the school districts though, just for political reasons. But if you want to stay under the radar, the SME is, is where it's at.
- [33:43]
B
Yeah, like you don't want to be doing a, you know, half billion dollar Jaguar Land Rover. Why do you want to be doing a whole bunch of smaller, smaller things that you have a plausible chance of getting away with and not being too big to get, you know, the kind of law enforcement attention we've seen some of the other crews that got too big, you know.
- [33:57]
A
Yeah. So I kind of feel though that when the FBI is going out and talking about how much money you made like you are on a whiteboard somewhere.
- [34:03]
B
Maybe you reach that threshold. Yeah, yeah.
- [34:06]
A
It's not a happy place to be. Speaking of another one from Alexander Martin, Operation Endgame. This is this rolling sort of Europol coordinated operation taking down various componen of the ransomware ecosystem. They've done a bunch of takedowns as well against what was it like an info stealer and like what, like a Trojan network, something. What did they take down here?
- [34:28]
B
Yeah, so the Radamanthus infrasteer, the Venom Rat Modaxis Trojan and the Elysium botnet. So those are things that are used by crime organizations to build their just in time crime pipeline. And yeah, Europol's just been grinding through, you know, taking care of business. And it's good work, it needs done.
- [34:47]
A
We love to see it. Now this last piece, which is by Joel Khalisi over at Wired, he's on the business desk and he's done a terrific job with this yarn. This is like our reading list item of the week. And it's about a guy getting bilked out of 200 grand in Bitcoin, which isn't all that much money, but it's the sophistication of how they did it. I mean this is really like a confidence scam, you know. This is an old school confidence scam like you see in the movies. It involves real life meetups, you know, people in nice clothes wearing Rolexes, you know, you can trust us, bro, kind of thing. But it was just I got sucked into this piece, big time. It was a great read. Why don't you walk us through the shape of it?
- [35:34]
B
Yeah, yeah, it is. It's a great read. So this particular, you know, couple of guys scammed a dude he was making. He worked for a company that made, like, bitcoin mining hardware. And they originally showed up offering to buy some, you know, hardware from him. And then they invited him to a meeting in like, Amsterdam or something and take them out for fancy dinner and so on and so forth. Eventually they. The crux of this game in the end was they wanted to do like a test transaction with some bitcoin. And so they did a little transaction, it all worked and everything was fine. And then a couple of weeks later, they followed up with, oh, alongside our crypto mining hardware you're going to sell us, can we also have a couple hundred thousand dollars worth of bitcoin or $400,000 worth of bitcoin or whatever it was, and then pressure the guy into, you know, kind of like testing it's going to work. And they make him install a wallet on his phone while they're there, you know, in the club after a few drinks and a caviar dinner and so on. And they must have had some kind of camera or third party watching this guy whilst he's installing this wallet app. And they read the, you know, the seed phrase off the screen of his phone. And then at some point, $200,000 worth of Bitcoin ends up in that wallet and they nick it and stop talking to him. So pretty straightforward kind of scam, but just like, doing it, as you said, like movie style, you know, with caviar and smart suits and Rolexes and, you know, to the. To the guy's credit, I think the company that he worked for ended up surviving, losing $200,000 in the process, but just, you know, the perils of a financial ecosystem where you can, you know, give away $200,000 sitting in a hotel bar, you know, like, that's just. It's not a financial system with no recourse. Right, exactly. Because, you know, code is law or whatever, you know, whatever the crypto bros want to tell you. So anyway, the point is this is a good lunchtime read. And I think, you know, any friends and family you have that are, you know, kind of not really in the cyber world, but would still appreciate a good kind of like, heist story, it's worth a read.
- [37:31]
A
Yeah, it definitely is. All right, mates, that is actually it for the week's news. Thanks for joining me. For all of that. And we'll do it all again next week.
- [37:39]
B
Yeah, thanks, Pat. We certainly will.
- [37:41]
A
And have fun at Metallica tonight.
- [37:47]
C
Hello, I'm Tommy Wren, the policy and intelligence editor at Risky Business Media. You can join the Gruk and I every Tuesday for the between between two Nerds podcast, which is all about cyber intelligence and cyber war. Deny, degrade, discombobulate. You can find the between two Nerds podcast and more in the Risky Bulletin podcast feed. Subscribe today by searching for Risky Bulletin in your podcatcher.
- [38:14]
A
That was Adam Boileau there with a look at the week's security news. It is time for this week's sponsor interview now. And this week's show is brought to you by MasterCard, which, you know, thanks to its acquisition of recorded future and, you know, due to some historical reasons, you know, MasterCard, I guess you can think of them kind of like they have a side gig doing cyber threat intelligence and cybersecurity services. And today we are speaking with Uruj Bernie, who is the global head of risk and resilience at MasterCard and really talking about a big trend in financial service these days where the fraud teams and the cyber teams are starting to work closer and closer together, which makes. Makes a lot of sense to me. But I started off by asking Aroosh, like, why these roles were originally kind of separate when, you know, I think intuitively it kind of makes sense for there to be a lot of overlap between them. And here's what he had to say.
- [39:03]
D
When we look at it, why it was structured this way, I think there were maybe three things that we have to think about there. The first one is around priorities and success Metrics were different for the organization. Cybersecurity teams were focusing more on the technology aspects of protecting the enterprise or more focused on systems data, unauthorized attacks that would compromise their infrastructure and the enterprise. Whereas if you think about what the fraud team's focus was on, they were focused on protecting customers. They were focused on transactions and making sure that fraudulent activity as it relates to transactions and payments was. Was being managed and customers could transact more freely and with. With less friction. So I think it was driven by, you know, maybe that was one of the factors there. And we're now seeing that ultimately when you, when you think about it from a risk perspective, rather than a cybersecurity perspective or a fraud perspective, but risk to the business viewpoint, this is where we're starting to see that combination coming through, right? And the organizations are saying we have to look at risk more holistically across the organization. That payment risk that was previously a little bit more manual, a bit more analog, is a lot more digital. Now the impacts to payment systems are more cyber enabled, more cyber driven. And so there is a need to start bringing these two teams together much more cohesively, being able to have a relatively similar taxonomy and being structured organizationally in a way that they're able to communicate better, report more holistically, I think, in terms of risk and overall impact to the organization.
- [40:58]
A
Well, let's get into that for a moment because what you just described was two organizations that have very, very different priorities, right? Like, as you say, one is worried about a bit of malware hitting a corporate desktop and then some threat actor tearing through the network and, you know, accessing Swift terminals or whatever it is, whereas the other one is much more concerned with protecting customers. Now you say that there's a need to sort of unify these teams, bring them together. Like you alluded to some of that just then by talking about like cyber enabled attacks against like payment infrastructure and stuff. So that's one area where I can, I can sort of understand what you mean. But like, what is fundamentally driving the need to unify those two teams? Because they still to me sound like fairly different functions within a, you know, say a bank.
- [41:43]
D
Yeah, they are different functions, but I think there are what we have to understand that there, there are dependencies or there are not dependencies necessarily, that may not be the best word, but there are connections between the two. So when you think about how do fraud teams identify why fraud is happening, it's because something has happened previously that is driving that to occur. That could be, you know, an increase in digital skimming infections on different types of sites where merchants are, you know, losing information or exfiltrating information related to payments. And that fraud team is seeing that the intelligence that comes in on the cyber side of the house understands that there has been something bad that has happened, but that is not communicated to the fraud team. So the fraud team action is reactive after the fraud starts to happen, and that is then understood to be the result of a cyber event that's taken place.
- [42:44]
A
So this is interesting because what you're basically saying is it's the people on the sort of cybersecurity side, right, who are responsible for defending the organizations, who are the consumers of the threat intelligence, which is useful to the fraud team. So the question is, why don't you then just sell the threat intelligence to the fraud team? You know, why do you need to unify these teams when really what we're talking about is it's that awareness piece among the cyber teams that is useful to the fraud teams.
- [43:10]
D
Absolutely. And you can sell that threat intelligence to the fraud teams. Unfortunately, they don't have that skill set that comes when, you know, being in the CISO organization. So one of the things that we're actually looking to do with our solution, MasterCard Threat Intelligence, is democratize that information, make it so that it's applicable for the audience that it's looking to serve, which is the folks in payment fraud. And as a result of that, they're then able to communicate and understand their landscape, what threats they're facing, what's coming at them, what they need to be worried about. And they go from being reactive to being a little bit more predictive. I'm not going to use the term proactive necessarily, because proactive means you see things before they happen. They're still reacting, but they're being reactive in a more predictive manner, if you will. So that. That certainly is there more and more.
- [44:04]
A
Of a process than everybody panic and run around and not quite know what you're doing.
- [44:07]
D
Exactly, exactly. And so it's more. And then once you have that, you're able to share that information back and forth between these organizations. So you can structure them organizationally to be one team, or you can have them sitting in perhaps what's conceptually thought of as a fusion center where teams work together. It doesn't have to be a physical location, it's just a means and mechanism through which they can exchange information. But ultimately, that's really what it's about. It's about the democratization of what has typically been very technical information to be able to be used by teams that are typically not technical or don't have that same level of technical background. And then the ability of those teams to then understand how things are shaping up and communicate how to implement more controls or better controls on the enterprise side of the house that the CISO and other teams can do.
- [45:02]
A
Now, you just mentioned, like two approaches, right. Since we've been having this conversation. One approach is that you unify those teams, you turn them into one thing. Right. With a clear reporting line to the same person. The other thing you mentioned is this sort of fusion center approach, which is actually like more what I've seen here just over the years with the people I talk to, which is, you know, the fraud people and the security people sit next to each other and, and collaborate and are sort of told to get along, which seems to be the winning approach at the moment as this all changes. Is it, is it the case that these reporting, you know, that things are being unified into a single department, or is it more the case that we've got just better cooperation?
- [45:39]
D
I think we're seeing a little bit of both. It's very difficult to make this kind of a change overnight. So we're seeing organizations that feel it's better to have more control and you know, under one organizational structure. We see organizations that are global in nature, where you can't have a single organizational structure, where you need to have more collaboration between teams that are sitting in different parts of the world. So we're seeing both of these structures come into play. I think the biggest piece that perhaps is missing today is the governance model and the operating structure that these teams now need to follow. It's one thing to say that we're going to exchange information, but again, you have to have that taxonomy, the common language, to be able to say this is what we're going to exchange. And how does that actually make sense for both sides of the organization, not just one?
- [46:33]
A
Now, you mentioned MasterCard threat intelligence. Obviously the reason that MasterCard is sponsoring the Risky Business podcast is because you have launched MasterCard threat intelligence, which I believe. I mean, I'm guessing this is just an assumption nobody's told me, but I believe that would be begat from the recorded future acquisition. Is that about right?
- [46:50]
D
That is correct. So the recorded future acquisition was obviously very strategic, but it was done because we were seeing changes in how fraud was being perpetrated. So it was going from what I said, you know, earlier, analog to being more digital. And as a result of that, we were seeing similar things that were happening from an enterprise or corporate security perspective happening in that fraud space. And the more cyber enabled these attacks have become, we obviously needed to understand how to move perhaps a little bit left of boom to get more visibility, to be able to apply the same types of principles that threat intelligence offered at a corporate or enterprise security level into that payment space. And so that's how it came about. We believe that having that level of visibility across not just MasterCard threat intelligence, but also being able to embed that in some of our other solutions, gives us the ability to be a lot more predictive and proactive in some instances around helping our customers stop fraud from occurring, but also then taking appropriate action based on the information that they see, that they're able to understand about their organization, the threat landscape that they face, and just better be able to better structure how they respond. To things. So we know that, you know, reported Future obviously has a very large customer base. They talk to the CISOs, they work with the CISOs, and they provide information to the CISOs. Again, as I was pointing out earlier, even though threat intelligence is consumed by an organization doesn't mean that it is actually shared across the organization. So we do want to broaden that base because ultimately, security of the organization, security of the ecosystem, the payments, the customers, it is ultimately the responsibility of the organization that has that customer base. So we want to make sure that the ecosystem is better secured. We want to make sure that there's more trust or a higher level of trust within that ecosystem so that when folks are looking to make transactions, they're not faced with potential loss of their credit card data or their personal information through a digital skimming infection on some popular merchant site that they're, you know, cars that have been stolen, if they're being tested, that we can actually identify those and decline the transactions. This actually helps stop fraud before it occurs. And so the intent is to, again, as I said, be a bit more predictive. The intent is to be ahead, or at least abreast of where the attacks and threats are coming from so that we can change the way things happen today. Right. The numbers around the losses are huge, trillions, billions of dollars. And if we can, if we can make even a little bit of a dent, then I think, you know, we've done good. By the consumers.
- [50:05]
A
Yeah. I mean, one of the reasons I was happy to do this sort of sponsor arrangement is because when I saw the news that MasterCard was buying recorded future, I think, you know, a lot of us had the reaction of what that seems. That seems strange. But it's been great having it explained to me by various MasterCard people. So, Arush, Bernie, thank you so much for joining me to talk through all of that very interesting stuff.
- [50:28]
D
My pleasure. Thank you so much for having me.
- [50:31]
A
That was Aroosh Bernie there from MasterCard. Big thanks to him for that. And that is it for this week's show. I do hope you enjoyed it. I'll be back in a couple of days with a soapbox edition with Mr. Andrew Morris from Grey Noise. But until then, I've been Patrick Bray. Thanks for listening.
- [50:50]
E
Hello, I'm Claire Eyre, and three times a week I deliver the biggest and best cyber security news from around the world in one snappy bulletin. The Risky Bulletin podcast runs every Monday, Wednesday and Friday in the Risky Bulletin podcast feed. You can subscribe by searching for Risky Bulletin in your podcatcher. And stay one step ahead. Catch you there.