D (2:49)

Yeah, so like you said, Vercel in context, another company involved here, they both disclosed these attacks over the weekend. That says a lot, I think. It doesn't happen often. Each of the companies are pinning at least some of the blame on the other vendor, which makes things a little more interesting. Supply chain attacks are always a winding tale, but this one is tougher to follow than most. The root of this attack, which has compromised systems and impacted customers of both companies, started in February when Context employee's computer was infected with infosteeler malware. This happened, according to researchers at Hudson Rock, after the employee was searching for Roblox game exploits. This is a common vector for infosteel deployments, right? A lot of mistakes were made here in this one. So attackers used that access to break into that Context employees AWS environment. That allowed them to retrieve tokens for some of Context users, including a token for a Vercel employees Google Workspace account. That Vercel employee was using a consumer version of context AIs AI agents and granted it full access. This was another critical mistake. The attacker used that access to take over the Vercel employees Google Workspace account, which enabled them to access all kinds of additional internal systems and data. So like you said, this one has a little bit of everything. Roblox cheat codes on a company owned computer. Shadow IT or shadow AI if you will. Poor security practices all wrapped into one big mess for multiple vendors and their users.

A (4:34)

You know, it is just so crazy because we spend a lot of time in the pages of cyberscoop and we spend a lot of time talking on Safe Mode about, you know, what's next in cybersecurity and what breaches do we have to watch out for. We spent a lot of time talking about Claude Mythos and a lot of people are worked up about the possibilities with Claude Mythos and for good reason. However, when it comes back to one of the biggest breaches of the week, we have a supply chain security event that happened because somebody was searching for cheats or a video game platform that is mainly pop. I'm going to say the average user just, I'm not even going to put an age number on it, just children. Like Roblox is a children's platform. This isn't exactly, you know, PlayStation 5 or somebody, you know, playing Valorant or League of Legends or whatever. We're talking about like my kids play Roblox all the time, like, and that's the only real audience that I can think of when it comes to Roblox. So we have what is essentially somebody looking for video game cheats for a kids platform that then gives access to third party workspaces that somehow the dominoes fall and we are suddenly in a dev environment for millions of applications and enterprises. And it just goes to show that, you know, just all of the concentration on what the future may be of security breaches, it just sounds like part and parcel that this is not sophisticated. And, and so many breaches start this way. And it just seems like we're going to be hearing this story again and again because we've heard it before as, as eye rolling and headache inducing as this story may be that this is sadly common.

D (6:45)

Yes, you're right. Unfortunately this is the case. I mean I think this attack, like many others we've covered recently, just it underscores the pitfalls of interconnected cloud applications and all these SaaS integrations with overly privileged permissions. In this case, both companies say a limited number of customers are impacted. But that's something we often hear in the initial wake of an attack. It's also just unexplainable why these tokens were there for the taking on their platforms. You would expect there to be more security in place to prevent an unauthorized user from gaining access to their users tokens for other applications. It's hard to imagine.

A (7:29)

And it really goes to show that while info stealers themselves may not be a sophisticated piece of malware, the damage that, that they wrought, I mean it's example a for what we've seen this week. I know that the info stealer that was involved in this incident was Llama Infosteeler, which we've covered. And we know that big time companies and law enforcement agencies, whether it is in the US or abroad, have spent a lot of time going after them to get them off the Internet. And this is an example of why there is such a concentration on ridding the Internet of info stealers. Because look at the damage that they wrought. Even though that they are not, you know, a sophisticated piece of malware, the information that can be stolen from them, hence the name, can be pretty powerful and cause a lot of damage.

D (8:26)

Yeah. And it allows an attacker to hop multiple levels downstream. Other applications that are connected to those. Right. So if those credentials weren't rotated before attackers used them to break into other systems, there's likely other victims that were hit and just are unaware they've been compromised because those applications were simply logged into. It looks like a regular user, legitimate user.

A (8:52)

So a lot of this unfolded on Monday, but I know Vercel has sort of updated things to look like they've stemmed the tide or this doesn't look like it was as bad as it could have been. Am I correct in that assumption?

D (9:10)

Yeah, I think it's still a bit early to say that with certainty, but both companies have updated, shared some updates. Their investigations are still ongoing, but they're both still insisting that a limited number of customers were impacted. We don't know what that means exactly. These are companies with pretty large user bases, especially Vercel. And if we one of those victims led to additional downstream victims, that's when it really just compounds. So it's hard to say. But yeah, they're looking into it and we're trying to learn more.

A (9:43)

Great. And as we learn more, I know you will keep us updated. And hey, I would say if one lesson among many is, hey, if you're out there, make sure your kids are in search of Roblox cheats on your work computers. That. Because otherwise we're going to be talking about stories like this again.

D (10:02)

That's right. Sage advice.

A (10:05)

All right, Matt, thanks for the update.

D (10:08)

Thanks for having me on, Greg.

A (10:09)

All right, and now to our interview with Aran Hajjaj, who we talked to at the RSA conference in San Francisco. And look, as you just heard, identity has become the center of gravity in how breaches and fraud are playing out, especially as AI makes a personation and account takeover faster and more convincing. In my interview with Aran, we talk about what CISOs are hearing right now, how agentic AI complicates trust and liability and what it'll take to prove intent in a world where software can act on your behalf. Check it out. All right.

B (10:45)

Welcome to this week's interview segment for Safe Mode. I'm here in San Francisco, the RSA conference, talking with Aran Hagiag, the founder and CEO of Glide Identity. Aron, thanks for joining us.

E (10:56)

Thank you for having me.

B (10:57)

So Glide had a really interesting week at rsa. I know you were part of the Innovation sandbox. Talk to me about that experience.

E (11:06)

Yeah, I mean, that was really, really fun. I think, you know, having three minutes to give the whole pitch is something that forces you to distilt the way that you tell the story. And I think that was like, very useful for us. It's extremely well produced and it was like, you know, a full huge room of more than thousand people coming to listen to innovation. So it was really, really fun. And yeah, we made it to the top two finalists. We got the judges to explain why what we're doing is great, which, you know, always feel good. And then, you know, the LinkedIn requests are just fantastic. Yeah, so it's good.

B (11:45)

So for those not familiar with Glide Identity, I'm sure you're tired of giving

A (11:49)

this, but I'll ask you one more

B (11:50)

time, give, give that pitch on what Glide Identity does.

E (11:54)

You know, I' excited talking about it because I think we are solving a very big problem, right? So I mean, it's crazy that we still get this like one time passwords, you know, and that we still use username and password, although we know they're always leaked, and that this is a feasible way and interceptible way of authenticating billions of users for sensitive transactions. And what we've been, you know, looking for is a hardware rooted trust anchor that we can use to authenticate these billions of people and remove all this like old and not relevant solutions. Also, with AI now becoming so good in hacking, you have this like, you know, deep fakes that are so convincing. You have this like voice clone that it takes like several seconds of recording to have somebody sounds exactly like the person you know from your bank or from your family or from your company and calling you and telling you, hey, can you just send me this six digit code? And boom, your account took over, your passkey is now with somebody else. Your funds are not with you anymore. So we decided to find a solution for this. We were looking for the perfect root of trust, and we found that inside every SIM or ESIM there is a cryptographic key. We use this cryptographic key to sign a cryptographic challenge to prove the possession and that becomes the perfect trust anchor. And you don't need to install any application, you don't need to download anything, you don't need to do a registration.

B (13:19)

You.

E (13:20)

We do all the hard work of integrating with every single telco across the world to make it very simple for every app developer, every bank, every insurance company to just integrate our SDKs and in one day have this magical authentication capability.

B (13:36)

So that is very fascinating and especially at a time when, you know, agentic AI is everywhere and identity is becoming more and more of the weak point in breaches. I know there were just a bunch of reports put out this year where cyber attackers have just stopped going after the vulnerabilities or anything that pops up on an edr, because the EDR software does its job, but now they've all focused toward identity, especially in an AI sense. How do you view the way that enterprises are really changing their threat models when it comes to identity? Because I feel like there is a weak point in no matter what. Until we get to products like yours, where this is like the, the new product. But we're still talking about like you said, SMS or you know, password reuse or things like that. So I'm wondering what you are hearing from CISOs as they really do try to wrap their hands around what they need to do to be ahead of the curve on identity.

E (14:45)

Yeah, so I think generally today it feels like a jungle and people are, you know, they're like CISOs that are very afraid and they just say don't get these agents into my organization. And yeah, just use this and just use that and do these settings. And there are other organization that understand that they need to provide a much more free way of using these agents and then they need to find a solution. What we've been focusing on is the question of how consumers will use agents and how will they interact with the different services, whether it's commerce, finance, making decisions, scheduling things, accessing sensitive medical records, all these kind of things. Because that's even a harder problem than within an organization because you can assume very little about people. If you solve that problem, you can solve it also for the enterprise in an easy way. And then we were looking at agents and one of the problem is that you have all this web firewall solution, all this kind of, you know, cloudflare, Akamai, all these kind of things. You, they need to decide which agents which are basically bots that they were blocking for the last 20 years, they will actually let in. That's one problem. Then the other problem is when you want to do an action, how do you really know that the original user have approved this action? And this is a very, very big problem that doesn't have a solution. And if you look at all the different standards that came out for agent E commerce, like you know, AP2 other other standards now recently like verifiable intent with the MasterCard they all say there needs to be some kind of identity signature on this agent but they don't say how because it's a difficult problem. What we found that this trust anchor, this hardware based private key that exists in every SIEM and ESIM can sign these transactions, can sign a cryptographic proof given to your agent that your agent carries throughout every transaction, throughout every firewall and prove that these agents represent you, that you have signed the intent of the agent to do something on your behalf. And this is a huge jump and a solution that can be used in a high scale.

B (17:06)

Yeah, that is really interesting because I know with agents it's look there is the identity part of it and actually from like a more Traditional credential base too. But then you get into the question of permissions and allowing it to act on your behalf. And I know we've covered it on cyberscoop. There's a case working through the courts right now between Perplexity and Amazon where Amazon has said we don't necessarily want Perplexities agents being used by people to buy stuff on our sites. Now, without obviously talking to the particulars of that case, it does present this interesting problem where how do you think about identity when it's not just credential based, it is also permission based.

E (17:48)

So generally I think the question is the liability question here, right? Like when an agent does something, who is liable? The developer of the agent, the original user that instructed the agent to do something. The service provider that is serving the agent. And this is a big problem. Like we have it also in self driving car, right? Who is responsible on something if Waymo is doing something wrong, if a robotaxi is, you know, having an accident. So our approach here is that you need to have the set of cryptographic proofs both from the user instructing the agent and also from the developer creating the code of the agent to make sure that they are liable for whatever they are doing. That's the only way. Otherwise you will get into so many of these like liability loopholes that will flood the legal system and will make, you know, agentic transactions very hard to do.

B (18:49)

So in the agentic side of things and dealing with identities, the agent just really has like sort of blurred the lines between the human and the non human identities. I feel like, like we were just talking about there. But beyond just an agent, you know, you're talking about service accounts, machine credentials, API keys, a lot of that stuff is already out there and they already outnumber humans when it comes to the actual processes and the accounts being used on the Internet. So why has the industry continued to treat non human identity as a secondary problem when it's already part of the larger attack?

E (19:31)

I think this is transitioning. I think that it was, you know, the industry always at large is in delay on whatever is happening. And I think non human identity is a big thing and agentic identity is now a big thing. And every ciso, every organization is trying to figure out the strategy and the tool set that they need to handle it. I think it's important to differentiate between this like you know, service accounts and API keys, which is one layer of things to like an agentic identity. Because when you have like an agent, you can have different type of scopes of agents. You can have ephemeral agents that are basically just doing one action on behalf of a user and then they disappear. And you can have this long term agents. These lobsters, right.

A (20:24)

Open claw, right?

E (20:25)

Yeah. All the, there's have so many claws now. You have the nano claw, you have the Nemo claw.

B (20:29)

Yeah, the claws are coming, right?

E (20:31)

Yeah, yeah. So. So these lobsters are basically are long term agents that are living with, you know, long term memory. They do multiple actions. They have a role. You know, you can look at a cowork, you know, from, from, from Claude as, as a, like a long term agent. And these kind of agents will need to have a different level of identity. They are more like humans than like nhis. Right. And there we're thinking like, you know, they can also use an ES team to have their credential, to have their public address, to be able to make calls, send text and all these kind of things. And this is where we feel like our technology is very appealing to this kind of, you know, lobsters and agents.

B (21:19)

Well, I would imagine too is because it gives it really, you can't flub that identity. I mean if the cryptographic key that it. It is what it is. I mean, I was going to ask you how does identity infrastructure really preserve audibility or accountability in an environment where there is no human that is explicitly authorizing any single action?

A (21:42)

But if you have a marker like

B (21:44)

the way that you do in glide, that's.

A (21:46)

You've answered my question basically.

E (21:48)

Yeah, yeah. In math with Rust.

A (21:50)

Right.

B (21:51)

So I'm wondering too if relying on those cryptographic keys and seeing what's coming down the pike with quantum security and post quantum encryption, like have you started to think about that? Like you are in the early stages of your company, but obviously three to five years from now it's going to be a different atmosphere. So I'm wondering what you, what are you thinking ahead as quantum computing and post quantum security begins to become part of the mainstream?

E (22:21)

We think that, you know, quantum safety is going to be table stake by the end of next year, like whatever.

A (22:27)

Oh. So okay.

B (22:28)

Even further quicker on my timeline than.

E (22:31)

Yeah, I mean, I mean again, you don't want to be there when that happens. Right. So you, and you don't want to like wait until that moment in time where you will become the target. So it's better to do it faster. And we used to say like when we started the company that we are, you know, building identity platform that is AI safe, quantum safe and agent ready. Yeah. And that was like from the beginning the three things that we care about. So for quantum safety we have a roadmap to make sure that whoever uses our software will not need to make any changes and that will become quantum safe once we release the feature. Also, the way that our cryptography works, we are not working with pki. It's a shared key. So it's already better from a quantum safety perspective. We just need to get the key size increased to be fully quantum safe.

A (23:28)

So with that I would ask just

B (23:33)

talking about how you don't want to be the enterprise that is late, but that's going to happen. That's just the nature of business. So if enterprise adoption for this stuff happens. But some enterprises do get left behind or they do drag their feet from the identity part. Like what is going to break first and how bad does it get before the industry will respond and follow your lead or somebody else from a different technological standpoint.

E (24:04)

Yeah, look, we, we cannot know for sure but it might be that by next rsac whoever will still stay with one time passwords will get, you know, their, their customer's identity stolen every day. Because you see two things are happening. The attackers are just becoming better and better and they are much faster to adopt the technology than the banks themselves. Right. They don't have procurement cycle of 18 months. They just try it out and they don't have any downside. And you have this like you know, open source Chinese models that are available that are doing amazing job and it's becoming so easy to kind of forge voices to make like very sophisticated multi step frauds into like SMS phishing, presenting you some advertisement that will, you know, make you think some stuff and the reasoning models are becoming so good. That's one thing. The other thing is as we are seeing more and more big banks and big payment providers and identity platforms and exchanging now working to integrate our technology in what will happen that whoever will not integrate this will become the easy target. So it's like there's two cat and

B (25:21)

mouse game just in a different part of the industry.

E (25:25)

I wouldn't say it's a cat and a mouse game because unlike, let's take deepfakes for example. So in deepfakes you have like companies that are trying to run an algorithm to analyze the picture or the video to say if it's a deep fake. Right. That's a cat and mouse problem because they will do something, they will analyze and then somebody will come with something that they cannot. What we do stops the cat and mouse problem because what we do is pure cryptography. So once you have that, you have nothing to fish. Either you hold this phone or you don't hold this phone. So if we are now talking but on a video call and you wonder, do you really talk to the real Aaron? Or this is a deep fake. You can run whatever algorithms, but they might fail you. Or you can send me a cryptographic challenge. Either I can sign it with my phone or not. If I can sign it, it's me, it doesn't matter what's the quality of the video. So we think this is exactly the way to escape from the cat and the mouse problem. And whoever will do it faster will have the other parties get all the attacks because it will be impossible to attack them. Or at least much, much harder. There's always some loophole that people leave.

B (26:36)

Yeah, great, Aron, really appreciate your time. Thanks for joining us.

E (26:41)

Thank you.

C (26:43)

Thanks for listening to Safe Mode, a weekly podcast on cybersecurity and digital privacy, brought to you by cyberscoop. If you enjoyed this episode, please leave a rating and a review and share it with your friends, your coworkers, workers, your CISOs, your sysadmins, your mom, your dad.

A (26:58)

Anybody that wants to know more about cyber security.

C (27:01)

To find out more information or to contact me, please look for all of our social media handles or visit cyberscoop.com thanks for listening. Check us out next week.