WEBVTT

1
00:00:07.142 --> 00:00:08.764
Good morning, hackers.

2
00:00:08.884 --> 00:00:12.409
Welcome back to the best podcast on the internet for hackers.

3
00:00:12.610 --> 00:00:13.771
The Lowdown presented by Maze.

4
00:00:14.172 --> 00:00:20.681
We are here in Las Vegas at Sentinel One's OneCon having a great time talking about the world of hacking and AI.

5
00:00:20.821 --> 00:00:22.103
We're obviously here at OneCon.

6
00:00:22.143 --> 00:00:22.824
We're in Las Vegas.

7
00:00:22.844 --> 00:00:23.986
We're at the ARIA Conference Center.

8
00:00:24.006 --> 00:00:24.566
It's been beautiful.

9
00:00:24.586 --> 00:00:25.628
It's our first time both here.

10
00:00:25.648 --> 00:00:26.209
This is great.

11
00:00:26.229 --> 00:00:26.910
We had a great week.

12
00:00:27.330 --> 00:00:30.114
We got to interview some cool people from Sentinel-1.

13
00:00:30.214 --> 00:00:31.777
I'm going to be honest.

14
00:00:31.857 --> 00:00:37.545
I didn't have, I truly didn't have low expectations, but they blew my expectations out of the water, the interviews that we did.

15
00:00:37.565 --> 00:00:37.725
Yeah.

16
00:00:39.027 --> 00:00:40.549
They gave us some really good people to talk to.

17
00:00:41.370 --> 00:00:47.319
They also ran an e-sports-esque competition of threat hunting, CTF.

18
00:00:47.339 --> 00:00:50.063
And I've seen people try to do e-sports, CTF-type things before.

19
00:00:50.183 --> 00:00:51.345
Hacking is pretty boring to watch.

20
00:00:51.365 --> 00:00:52.206
Hacking is so boring.

21
00:00:52.867 --> 00:01:18.415
wasn't even hacking this was threat hunting so i was like again my expectations were like uh i don't know how this is gonna go it was awesome it was great it was awesome they did a great job tight 30 minute uh on stage they had live commentators switching between monitors of like which flag people were working on they were explaining the process of like what people were looking at and working on fantastic fantastic we got to interview the winner of this the top threat hunter of the world right that's good it was they ran regional world uh

22
00:01:19.095 --> 00:01:36.983
contest to do this they fed into this and then they did a live final here on stage super super cool so we're gonna cut the interviews into this podcast that we had uh and i don't think we're gonna do the full interviews in this episode we're gonna cut in clips of good stuff i really highly recommend you guys stick around for the rest of the podcast um but

23
00:01:37.463 --> 00:01:40.224
We're going to figure out a way to get these full interviews out, right?

24
00:01:40.344 --> 00:01:42.444
Because they were just so, so, so good.

25
00:01:42.464 --> 00:01:52.547
We talked about the head of Sentinel Labs, talking about what their research that they've been doing and how they're looking into 2027 and the future and everything we just talked about.

26
00:01:52.847 --> 00:01:57.409
And also one of their execs and what they're seeing amongst all their customers and data and all this kind of stuff.

27
00:01:57.449 --> 00:01:58.309
But geez, man.

28
00:01:58.529 --> 00:02:08.295
We had a lot of really good conversation and some unique perspectives, too, that are both, you know, they were different to me and helped me kind of reframe my mind from like the attacker mindset to the defender mindset.

29
00:02:08.756 --> 00:02:15.340
But also good conversation about the future of career and if it's important to even know the stuff anymore.

30
00:02:15.400 --> 00:02:15.900
Super cool.

31
00:02:16.080 --> 00:02:19.463
Like, you know, a lot of stuff we talked about is like we're very nervous about.

32
00:02:20.103 --> 00:02:26.268
how do we grow the next senior cohort for the current juniors and how do we get the current juniors into the industry?

33
00:02:26.568 --> 00:02:31.853
And with all three interviewees, we had a really good conversation about what it even means to be in the industry right now.

34
00:02:31.913 --> 00:02:32.073
Yeah.

35
00:02:32.093 --> 00:02:33.314
It was a really, really good conversation.

36
00:02:33.334 --> 00:02:34.315
I highly recommend you stick around.

37
00:02:34.795 --> 00:02:35.656
Super interesting on that.

38
00:02:36.777 --> 00:02:38.438
One of the other, so these are teasers, right?

39
00:02:38.518 --> 00:02:39.799
The other interesting bit

40
00:02:41.000 --> 00:02:47.646
that we asked both of the Sentinel one leaders, the attacker versus defender asymmetry question when it comes to AI.

41
00:02:47.726 --> 00:02:53.232
Yeah, they both answered in a way that I did not expect and that most people do not answer today.

42
00:02:53.652 --> 00:02:54.993
That's my little teaser on that.

43
00:02:55.394 --> 00:03:01.760
And then there's also a few just like sound clip earworms that I'm going to be saying for the rest of my career.

44
00:03:02.060 --> 00:03:12.908
that come out that I want you guys to try to point out on what those were and why Matt has just been infected with phrases that I now need to enter into my vocabulary.

45
00:03:13.108 --> 00:03:13.768
Matt, I have a problem.

46
00:03:14.089 --> 00:03:15.430
A bit of a personal issue to deal with.

47
00:03:15.450 --> 00:03:15.790
Just one?

48
00:03:16.210 --> 00:03:16.891
Well, a couple.

49
00:03:16.951 --> 00:03:23.956
But the one in the question today, every time I leave my house for a long period of time, something strange happens where...

50
00:03:24.636 --> 00:03:50.864
a vulnerability or two or three or ten drops and that happened this week so I are you aware of what's going on this week is this a pretty boring week in cybersecurity or what no what happened uh so so everything so so there may have been a major 10.0 CVSS and PHP there may have been a certificate authority where one of the private keys of their CA or of their intermediates was four uh and then the kernel of Linux has a couple bugs we're talking about as well and there's a long tail after that as well yeah we're gonna run out of

51
00:03:50.864 --> 00:03:52.425
We're not going to have enough time to cover it all.

52
00:03:52.445 --> 00:03:55.446
But yeah, dude, it's so crazy week in the world of cybersecurity.

53
00:03:55.466 --> 00:03:57.827
We're talking on Thursday, October 22nd.

54
00:03:57.887 --> 00:04:00.248
I'm sure more will come out after this podcast.

55
00:04:00.288 --> 00:04:02.830
Yeah, but hey, I mean, this is just super cool.

56
00:04:02.970 --> 00:04:03.410
We're here.

57
00:04:03.930 --> 00:04:08.032
We're being spoiled by high quality video footage that we can't afford.

58
00:04:09.093 --> 00:04:27.315
little youtube land so uh this is great um i i heard you like put out a video on php while we're i mean php stuff obviously we're gonna spend a lot of time talking about you went up to your hotel room and recorded i was recording in a booth downstairs making videos about this stuff um what like what the hell is going on what happened

59
00:04:27.495 --> 00:04:31.116
Yeah, so I mean, we, like I said, whenever I leave the house, big bug comes out.

60
00:04:31.216 --> 00:04:32.756
Okay, so we're talking about PHP to shell.

61
00:04:33.136 --> 00:04:36.417
We land on Monday, get here Monday, and I think it was like Tuesday morning.

62
00:04:36.437 --> 00:04:42.378
There's rumblings on Twitter that a big 10.0 CVSS PHP bug comes out.

63
00:04:42.578 --> 00:04:45.258
And this is not a vulnerability in Drupal.

64
00:04:45.518 --> 00:04:47.239
This is not a vulnerability in WordPress.

65
00:04:47.619 --> 00:04:52.960
This is a vulnerability in the underlying PHP daemon that processes user requests.

66
00:04:53.100 --> 00:04:53.540
Excuse me.

67
00:04:53.720 --> 00:04:53.880
Yeah.

68
00:04:53.940 --> 00:04:54.220
Excuse me.

69
00:04:55.220 --> 00:04:56.401
No one uses PHP anymore, though.

70
00:04:56.481 --> 00:04:57.042
I heard that.

71
00:04:57.342 --> 00:04:57.823
I heard that.

72
00:04:57.843 --> 00:05:01.486
I did a little investigating a la asking Gemini or Google or whatever.

73
00:05:01.966 --> 00:05:07.972
Turns out 70% of the Internet's forward-facing HTTP is processed in some form or fashion by PHP.

74
00:05:08.172 --> 00:05:15.398
So if, again, rumors, if a 10.0 CVSS were to come out on PHP, that would be very bad.

75
00:05:16.259 --> 00:05:16.799
Tuesday...

76
00:05:17.580 --> 00:05:18.821
We learned that this is real.

77
00:05:18.941 --> 00:05:30.787
There is a small group of people, very close hold, that work in the InfoSec industry that are trying to figure out how to quietly and safely get a patch out for this bug that's very real.

78
00:05:30.807 --> 00:05:33.589
It is a use-after-free in the PHP daemon.

79
00:05:34.229 --> 00:05:43.698
Some leaks occur, some videos go viral, and eventually Kalief.io drops their report on how the bug works, and it truly is a remote on-off vulnerability.

80
00:05:43.758 --> 00:05:44.759
Not easy to exploit.

81
00:05:44.779 --> 00:05:51.045
I think the 10.0 got downgraded to a 9.2, but a vulnerability in PHP as a result of it used after it freeing it in.

82
00:05:51.125 --> 00:05:55.508
So I think we got to talk about a few different pillars of this and how this week is gone.

83
00:05:55.548 --> 00:05:55.848
Right.

84
00:05:55.908 --> 00:05:57.409
I mean, we're laughing about it.

85
00:05:57.549 --> 00:05:57.750
Right.

86
00:05:57.810 --> 00:05:58.190
Whatever.

87
00:05:58.250 --> 00:05:58.930
It's kind of crazy.

88
00:05:59.171 --> 00:05:59.731
Laugh pain away.

89
00:05:59.911 --> 00:06:00.111
Yeah.

90
00:06:00.211 --> 00:06:03.674
I think we have to talk about the vulnerability and exploitation.

91
00:06:03.934 --> 00:06:04.154
Right.

92
00:06:04.254 --> 00:06:08.237
Vulnerability, exploitation, exploits, AIs, you know, usage and creating all that.

93
00:06:08.357 --> 00:06:09.658
I think we have to talk about the leak.

94
00:06:10.438 --> 00:06:10.598
Right.

95
00:06:10.798 --> 00:06:11.799
And like all of that.

96
00:06:11.919 --> 00:06:22.164
And then I think we have to talk about what this pattern is showing us and like how this is going to impact the industry, because I do not think this is the last time we're going to see a week like this.

97
00:06:22.305 --> 00:06:22.825
No, not at all.

98
00:06:22.945 --> 00:06:25.446
I think this is the beginning of many more of these.

99
00:06:25.466 --> 00:06:26.927
And that's not I'm not trying to like doom and gloom.

100
00:06:26.947 --> 00:06:32.230
I think this is just the nature of vulnerability research until we make code secure.

101
00:06:32.250 --> 00:06:35.812
And how that's even possible is a philosophical debate for a different podcast.

102
00:06:35.872 --> 00:06:37.153
But like, I agree.

103
00:06:37.173 --> 00:06:37.673
This will continue.

104
00:06:37.693 --> 00:06:37.833
Yeah.

105
00:06:37.933 --> 00:06:42.457
So how about we, like, let's get on a level set of what the actual vuln is first.

106
00:06:42.497 --> 00:06:42.678
Yeah.

107
00:06:42.898 --> 00:06:48.603
And then I want to talk about kind of like, I'll go into the leak and the coordinated disclosure conversation and all this kind of stuff.

108
00:06:49.044 --> 00:06:49.985
Can you walk me through?

109
00:06:50.005 --> 00:06:53.007
I know you dove into the actual vuln, right?

110
00:06:53.248 --> 00:06:54.929
I think it was rumors of it was 10.

111
00:06:54.989 --> 00:06:59.373
It's been downgraded to a 9.2, probably because of the ASLR stuff I think you're probably going to go into.

112
00:06:59.413 --> 00:07:00.114
Yeah.

113
00:07:01.916 --> 00:07:03.496
let's all get on the same page.

114
00:07:03.516 --> 00:07:03.917
What's the bug?

115
00:07:03.977 --> 00:07:05.338
So PHP to shell, right?

116
00:07:05.378 --> 00:07:11.061
This is the thing we give names to vulnerabilities when if you have that service, you can get a shell.

117
00:07:11.081 --> 00:07:12.162
Congratulations, it's free.

118
00:07:12.222 --> 00:07:14.223
Now, exploitation of this is fairly complicated.

119
00:07:14.523 --> 00:07:15.383
What is the bug?

120
00:07:15.904 --> 00:07:16.664
The bug is...

121
00:07:16.684 --> 00:07:17.565
There's two, right?

122
00:07:17.585 --> 00:07:18.705
Yeah, so there's actually two.

123
00:07:18.926 --> 00:07:22.688
The Kalief researcher that found this was doing some research with LLMs

124
00:07:23.248 --> 00:07:28.834
looking for use after free kind of like failure invariants in PHP.

125
00:07:28.854 --> 00:07:32.757
So the first bug that he found only works on PHP 7.3, but effectively...

126
00:07:34.080 --> 00:07:48.707
If you cause the PHP memory allocator to go out of memory, there is an issue where the teardown of that connection, the teardown of that session is not complete and the PHP session continues to run, which causes a use after free in some areas of the PHP daemon.

127
00:07:49.247 --> 00:07:55.069
So we took that pattern of something, something, fails halfway through, non-complete teardown, keep working.

128
00:07:55.089 --> 00:08:02.393
And he wrote that into a skill.md file and said, hey, LLM, I think this pattern may be effective in more modern versions of PHP,

129
00:08:03.033 --> 00:08:03.593
go find it.

130
00:08:03.673 --> 00:08:04.094
And he did.

131
00:08:04.114 --> 00:08:06.455
The vulnerability here is the one we're talking about.

132
00:08:06.495 --> 00:08:13.180
The big one that dates back all the way to PHP 5.3, 5.2, I believe, which is July, 2004.

133
00:08:13.400 --> 00:08:16.101
So this bug has been dormant for coming up on 22, 23 years.

134
00:08:16.121 --> 00:08:17.442
I don't want to know where you were.

135
00:08:18.123 --> 00:08:18.823
I know where I was.

136
00:08:18.843 --> 00:08:19.724
I don't want to know where you were.

137
00:08:19.744 --> 00:08:19.864
Yeah.

138
00:08:19.884 --> 00:08:19.984
Yeah.

139
00:08:20.004 --> 00:08:20.404
Fourth grade.

140
00:08:20.844 --> 00:08:21.025
Um,

141
00:08:21.825 --> 00:08:24.167
So the bug, the way it works, right?

142
00:08:24.207 --> 00:08:27.090
There is a lot of code, obviously, in PHP that deals with sessions, right?

143
00:08:27.110 --> 00:08:34.658
So in internet world, if you have a session, this is a way for the daemon to associate a request with an already existing set of metadata.

144
00:08:34.678 --> 00:08:39.963
So if you log into a server, you're given a session ID, and that session ID associates this packet to the context behind the scenes.

145
00:08:39.983 --> 00:08:40.203
Okay.

146
00:08:40.343 --> 00:08:45.585
There is code in PHP that allows you to initialize a session with a file upload.

147
00:08:45.605 --> 00:08:52.188
Okay, so you're doing a multi-part data form, and there can be multiple requests that push up data to the server in the establishment of a session.

148
00:08:53.029 --> 00:08:55.190
If that file upload is to fail,

149
00:08:55.670 --> 00:09:10.415
during the establishment of a session, there is a bug where there are pointers in global that still point to your request related to the session that get freed, but then later dereferenced in the teardown of the session at the end of the file upload.

150
00:09:10.435 --> 00:09:12.876
This is the classic case of the use after free.

151
00:09:13.176 --> 00:09:17.557
We can have a whole separate class on like a use after free as I go into it in my video a little bit, I like what that actually means.

152
00:09:17.898 --> 00:09:23.980
But ultimately a use after free is obviously a primitive that can be turned into exploitation, but there are two problems with it.

153
00:09:25.300 --> 00:09:26.060
Not easy to do.

154
00:09:26.100 --> 00:09:31.661
You have to have another type that you put into the slot of the memory that is being used after it's being freed.

155
00:09:32.101 --> 00:09:34.302
And two, this is a use after free in the heap.

156
00:09:34.502 --> 00:09:34.762
Okay.

157
00:09:35.082 --> 00:09:40.563
So you have to do this thing called heap grooming where effectively the next allocation is deterministic in the shape that you want.

158
00:09:40.923 --> 00:09:42.664
This is very difficult for two reasons.

159
00:09:42.804 --> 00:09:45.724
One, heap implementations vary across different platforms.

160
00:09:45.784 --> 00:09:47.905
I think PHP even has their own allocator.

161
00:09:48.365 --> 00:09:49.605
But two, this is a network daemon.

162
00:09:49.805 --> 00:09:50.005
right?

163
00:09:50.045 --> 00:09:56.192
So this means that there are other requests that are running in the background that are manipulating the heap of the worker while you're doing your exploitation.

164
00:09:56.573 --> 00:10:01.118
So that adds to difficulty of even getting the user after Free Primitive to execute.

165
00:10:01.518 --> 00:10:05.243
On top of that, modern systems, looking at you, Citrix, um...

166
00:10:05.703 --> 00:10:07.224
Have ASLR enabled, right?

167
00:10:07.304 --> 00:10:12.267
ASLR is address space layout randomization where effectively every page is allocated for a process.

168
00:10:12.667 --> 00:10:20.232
It's a randomized base address from the kernel so that if an attacker gets an arbitrary write primitive, for example, they don't know where to write the thing.

169
00:10:20.632 --> 00:10:28.635
Now, the problem with this is you have to free is apparently there are rumors of the POC enables you to do a relative read, which reads the heap addresses out, thereby bypassing ASLR.

170
00:10:29.396 --> 00:10:33.677
But that being said, you know, back kind of to Matt's, we'll get into the rumor in the drama scenario.

171
00:10:33.697 --> 00:10:36.098
There's no actual public POC that confirms any of this.

172
00:10:36.118 --> 00:10:45.162
The only real like hard evidence we have is the video of the Kalief researcher running the exploit where they leak some addresses in there, but no one is able to reproduce that so far.

173
00:10:45.482 --> 00:10:47.282
Yeah, but a lot of people think they have.

174
00:10:47.463 --> 00:10:52.684
And this is the pattern that I want to get into that I think that we're going to see a whole lot of from now on, right?

175
00:10:52.904 --> 00:10:57.885
Is this kind of thing has been going on a long time in vulnerability research, right?

176
00:10:57.985 --> 00:11:03.526
Where high-skilled attackers will find stuff and then low-skilled, well, not attackers, sorry, researchers, right?

177
00:11:03.867 --> 00:11:13.449
High-skilled security researchers are going to find things and then kind of the lower-skilled side of things are going to kind of clamor and try to latch onto it, reproduce, whatever it is.

178
00:11:14.349 --> 00:11:27.178
This has been going on in vulns forever, and now in exploits, because LLMs are actually really good at helping in exploit dev, these low-skilled people are going to think that they reproduce the exploit.

179
00:11:27.579 --> 00:11:34.043
Right now, as it stands today, Thursday, October 22nd, in the afternoon, because this could be completely false tomorrow, right?

180
00:11:34.063 --> 00:11:36.685
We're one tweet away from everything we're saying being out of date.

181
00:11:36.705 --> 00:11:37.346
Yeah.

182
00:11:37.966 --> 00:11:46.926
Where we are right now, even with the frontier model capability of exploit dev, which is very good, which is very good, I've only really seen

183
00:11:47.960 --> 00:11:57.264
high-skilled security researchers be able to actually produce exploits for bugs like this using LLMs, even using LLMs.

184
00:11:57.304 --> 00:11:59.085
Yeah, look at the example for Kalief, right?

185
00:11:59.145 --> 00:12:04.748
The researcher that did this had to know, oh, this is the invariant pattern for a UAF.

186
00:12:05.268 --> 00:12:12.431
He had to document that pattern knowing it was a sane way to even look for bugs and then command the LLM to do it.

187
00:12:12.451 --> 00:12:16.073
Yeah, the LLM found the bug, but the researcher knew what he was looking for.

188
00:12:16.093 --> 00:12:16.433
Right, totally.

189
00:12:16.453 --> 00:12:16.673
Totally.

190
00:12:17.414 --> 00:12:21.897
I've seen the expo team talk about like their platform and like using it to find vulnerabilities.

191
00:12:21.917 --> 00:12:25.380
And one of the slides that he has is kind of like how they do it.

192
00:12:25.420 --> 00:12:30.325
And one of the core pillars of using AIs in security research is gaslighting it.

193
00:12:31.125 --> 00:12:33.787
And it's like, yeah, you got to tell it that this phone is there.

194
00:12:33.888 --> 00:12:34.068
Right.

195
00:12:34.508 --> 00:12:36.210
And then it actually can go find the vault.

196
00:12:36.250 --> 00:12:40.173
So even if you don't know it exists, you're like, oh, in this file, there is a use after free vulnerability.

197
00:12:40.454 --> 00:12:42.395
You've now gaslit the model.

198
00:12:42.435 --> 00:12:43.116
Oh, I'm so sorry.

199
00:12:43.136 --> 00:12:43.957
I'm going to go find it.

200
00:12:43.977 --> 00:12:45.038
I'm so sorry.

201
00:12:45.138 --> 00:12:46.079
And it actually works, right?

202
00:12:46.459 --> 00:12:48.601
But even just that little...

203
00:12:49.642 --> 00:12:56.589
bit of like knowing the specific thing, how to look for it and where to look for it is still a, a thing of skilled researchers, right?

204
00:12:56.629 --> 00:12:57.890
For now, for now, for now, for now.

205
00:12:58.551 --> 00:13:02.054
Um, so the, the pattern being that I think that we're going to start seeing, right?

206
00:13:02.335 --> 00:13:06.259
More and more of that happened this week is the vuln info leaked.

207
00:13:06.639 --> 00:13:08.561
And now everyone in the planet is,

208
00:13:08.761 --> 00:13:14.124
has a super-powered electron microscope that they can point at PHP now that they know that this is going on, right?

209
00:13:14.705 --> 00:13:18.707
And there's tons of ripple effects that happen because of this.

210
00:13:19.287 --> 00:13:25.911
One, we're gonna find other issues in PHP because the tool that we are pointing at it is good at finding these issues, right?

211
00:13:26.231 --> 00:13:27.272
So even if they don't reproduce

212
00:13:27.532 --> 00:13:32.255
the thing that we know that this researcher found and has an exploit for, they're going to find other stuff, right?

213
00:13:32.275 --> 00:13:37.178
Number one, number two, a whole lot of people are going to get gaslit in the other direction.

214
00:13:37.478 --> 00:13:42.201
And their LLM is going to tell them why look at this, uh, siren emoji.

215
00:13:42.522 --> 00:13:44.163
I have reproduced this exploit.

216
00:13:44.403 --> 00:13:44.923
Here you go.

217
00:13:45.123 --> 00:13:45.704
And it's wrong.

218
00:13:45.944 --> 00:13:48.205
It's a, it's, it's, it's the AI slop exploit.

219
00:13:48.325 --> 00:13:48.505
Yeah.

220
00:13:48.805 --> 00:13:48.966
Um,

221
00:13:49.986 --> 00:13:53.869
And this is what's been happening all week is these people are posting fake videos.

222
00:13:53.909 --> 00:13:55.230
They don't know if they're fake or not.

223
00:13:55.410 --> 00:13:57.051
Maybe some of them do, and they're just chasing clout.

224
00:13:57.131 --> 00:13:59.773
Alarm emoji, confirmed vulnerability, exploitation, like...

225
00:14:00.073 --> 00:14:00.273
Right.

226
00:14:00.373 --> 00:14:05.697
And so now, and then, but the issue is because we were all on such high alert on this...

227
00:14:06.758 --> 00:14:10.943
And the normie media has no idea how to verify if any of this is going on.

228
00:14:11.123 --> 00:14:16.830
I'm still, as of right now, I was just reading stuff to get ready for this show and writing notes.

229
00:14:16.910 --> 00:14:22.237
I'm still reading headlines that there is successful exploitation, that there's POCs out there and all this kind of stuff.

230
00:14:22.357 --> 00:14:23.879
And none of it is verified.

231
00:14:24.019 --> 00:14:25.020
Yeah, there's no truth to that.

232
00:14:25.080 --> 00:14:29.984
We don't have a single verified actual exploitation of this PHP bug yet, right?

233
00:14:30.364 --> 00:14:33.987
I do believe that the original researcher has a POC that works universally.

234
00:14:34.487 --> 00:14:42.453
Or at least in some broad fashion in order to spin up the mechanism that has been spun up with this whole industry on coordinated disclosure and fixing it and all this kind of stuff.

235
00:14:42.473 --> 00:14:48.598
To be clear, the Kalief researcher, or excuse me, the Kalief write-up claims that they have a POC that they have gotten successful exploitation on PHP.

236
00:14:49.498 --> 00:14:54.599
WordPress, Drupal, PHP, my admin, like basically any modern CMS.

237
00:14:54.639 --> 00:14:55.280
A big one.

238
00:14:55.340 --> 00:14:56.500
They have gotten exploitation, all of them.

239
00:14:56.740 --> 00:14:58.480
If it's the same script or not, I do not know.

240
00:14:58.720 --> 00:15:00.461
Again, this is a heap exploitation thing.

241
00:15:00.481 --> 00:15:04.902
So it may be a different exploit script depending on the shape of the heap per CMS.

242
00:15:05.162 --> 00:15:07.603
But someone somewhere has this bug.

243
00:15:07.843 --> 00:15:07.983
Yes.

244
00:15:08.003 --> 00:15:08.303
This pock.

245
00:15:08.863 --> 00:15:14.045
I agree, but I think a lot of the stuff going around Twitter is slop, right?

246
00:15:14.105 --> 00:15:16.346
And it's been verified is not working and all this kind of stuff.

247
00:15:16.747 --> 00:15:19.868
But the headlines are saying that it's actively exploited, right?

248
00:15:19.888 --> 00:15:20.508
And this is hard.

249
00:15:20.528 --> 00:15:23.189
This makes this makes this whole week harder, right?

250
00:15:23.530 --> 00:15:28.552
Because you've got, I saw a comment on LinkedIn calling them narcissistic exploitation pimps.

251
00:15:29.412 --> 00:15:35.677
the low skilled people running around with these AI generated videos of exploits that aren't real.

252
00:15:35.917 --> 00:15:43.462
And I think that we're going to start to see this pattern more and more and more and more, because if we're going to get, you know, what, what's, what's the next, what's next week Citrix bug that's going to come out.

253
00:15:43.502 --> 00:15:47.064
And we're going to get a bunch of people pointing LMS at Citrix and be like, Oh, I've got a POC.

254
00:15:47.104 --> 00:15:47.264
Right.

255
00:15:47.765 --> 00:15:49.966
And, and it's just going to happen over and over and over again.

256
00:15:50.206 --> 00:15:50.386
Yeah.

257
00:15:50.707 --> 00:15:58.712
Um, the other bit that we can talk about here is how this whole thing went down and coordinated disclosure and all of that.

258
00:15:58.932 --> 00:15:59.132
Right.

259
00:15:59.793 --> 00:16:03.337
Hey, hackers, before we keep going, I want to take a quick break and say a quick thank you to our sponsors.

260
00:16:03.597 --> 00:16:07.121
Today's Lowdown episode is sponsored by our friends over at Maze.

261
00:16:07.601 --> 00:16:12.887
Maze has spent the last couple of years using AI to find and remediate vulnerabilities in the cloud.

262
00:16:13.007 --> 00:16:19.775
And now they've released Maze Code, AI agents that find and deeply investigate vulnerabilities in your code.

263
00:16:19.995 --> 00:16:20.796
Now, we all know the deal.

264
00:16:21.196 --> 00:16:27.438
Software composition analysis tools and SaaS toolings are all historically really bad at just making more noise.

265
00:16:27.478 --> 00:16:34.340
They find issues that may not actually be real and just create a lot of problems for your engineers to deal with that don't solve real security vulnerabilities.

266
00:16:34.440 --> 00:16:34.840
I get it.

267
00:16:34.880 --> 00:16:35.460
We've been there.

268
00:16:36.120 --> 00:16:41.482
Maze code is a really cool tool because Maze code actually knows how your code works.

269
00:16:41.822 --> 00:16:46.887
MazeCode investigates every finding with the context of how your code is actually deployed.

270
00:16:47.287 --> 00:16:54.874
Sure, you're using a version of libxml2 that's vulnerable, but the actual code path to hit that vulnerability is not exposed in your Docker image.

271
00:16:55.155 --> 00:16:58.658
MazeCode can find that and won't show you that that vulnerability is a big deal.

272
00:16:58.838 --> 00:17:03.403
Every vulnerability that Maze code reports comes with evidence that it's real and a way to fix it.

273
00:17:03.743 --> 00:17:08.107
Check out Maze at go.thelowdownpod.com slash Maze.

274
00:17:08.227 --> 00:17:11.911
That's go.thelowdownpod.com slash Maze.

275
00:17:12.091 --> 00:17:12.692
Thanks again, Maze.

276
00:17:12.832 --> 00:17:13.653
Let's keep going.

277
00:17:14.404 --> 00:17:22.471
So the way that this works, if you guys don't know, used to run vulnerability management for large financial institutions, large social networks.

278
00:17:22.591 --> 00:17:29.257
I've been on the other side of this, right, where these volumes come out and it's my job to get the information, go find it on a network the size of France.

279
00:17:29.737 --> 00:17:34.360
And tell the CISO when he calls my personal cell phone where it is, if it's on the Internet, if it's exploitable.

280
00:17:34.720 --> 00:17:35.300
This was my job.

281
00:17:35.521 --> 00:17:35.701
Right.

282
00:17:36.141 --> 00:17:44.786
So the stuff that goes on behind the scenes here is there there's information sharing groups of trust when a big bug comes out, not publicly.

283
00:17:45.706 --> 00:17:48.008
There's there's these groups that can kind of circle up.

284
00:17:48.568 --> 00:17:58.299
share information on it, get a plan of action in place, get a patch in place, work with the PHP foundation in this case, get a patch in place, and then work with some critical parts of the internet, right?

285
00:17:58.319 --> 00:18:06.628
Some companies that run the backbones of the internet in order to try to get this fix out to the big swaths of like, holy crap, if this hit, right.

286
00:18:07.268 --> 00:18:17.279
not PHP, but if another volunteer, if it hit Google or if it hit Akamai or Cloudflare or Nginx or whatever, could we get some of the critical stuff moving?

287
00:18:17.320 --> 00:18:22.325
Just give the insiders a bit of a head start is really what goes down.

288
00:18:22.465 --> 00:18:23.867
It's called coordinated disclosure.

289
00:18:24.087 --> 00:18:26.650
It's kind of part of the responsible disclosure ecosystem.

290
00:18:27.090 --> 00:18:27.551
What happened is

291
00:18:28.807 --> 00:18:30.247
Uh, there's a member.

292
00:18:30.527 --> 00:18:33.268
What happened in this case is there's a member of that trusted group.

293
00:18:33.748 --> 00:18:36.849
That's the head of a cybersecurity vendor called chain guard.

294
00:18:37.369 --> 00:18:47.851
What chain guard does is they put out pre hardened builds and images of packages so that their customers are pulling from not the public repo of stuff.

295
00:18:47.971 --> 00:18:55.692
When you like include a package in your code, you pull the chain guard one, or if you include a Docker image, you, you pull from the chain guard Docker image repo.

296
00:18:55.852 --> 00:18:56.052
Right.

297
00:18:56.073 --> 00:18:58.153
And they're, they're, they're pre hardened and all this kind of stuff.

298
00:18:58.313 --> 00:18:58.493
Right.

299
00:18:59.174 --> 00:19:10.868
So the CEO of Chain Guard, and I have his LinkedIn post up right here kind of explaining his thought process, and we can kind of cut this on the screen, is that he got word about this bug.

300
00:19:11.469 --> 00:19:13.191
They started to try to reproduce it

301
00:19:13.892 --> 00:19:19.215
The way that he said that he was able to reproduce it is the frightening part here, right?

302
00:19:19.255 --> 00:19:21.896
There's some clamoring about how accurate this is.

303
00:19:22.096 --> 00:19:26.099
There's a lot of drama and ripple effects having to do with this LinkedIn post that we can get into.

304
00:19:26.599 --> 00:19:33.923
But he said that, hey, we got read in that something was coming in PHP last Friday by one of the original researchers.

305
00:19:34.323 --> 00:19:43.448
That night, we were able to independently discover the same issue using our harness and a frontier model, which I've now since learned was Mythos 5.1, by the way.

306
00:19:44.569 --> 00:19:49.574
with a basic prompt of, quote, find bad vulnerabilities in PHP.

307
00:19:49.854 --> 00:19:50.234
Incredible.

308
00:19:50.675 --> 00:19:51.896
Was the prompt, okay?

309
00:19:52.437 --> 00:19:54.479
Obviously, his harness is doing a lot of work there.

310
00:19:54.519 --> 00:19:55.379
Yep.

311
00:19:55.680 --> 00:20:00.424
But we're getting to the point now with Frontier Models that I think

312
00:20:01.205 --> 00:20:06.048
Even just a few months ago, harnesses were more important than the model when it came to security research.

313
00:20:06.508 --> 00:20:10.550
We're getting to the point that I'm seeing some people deleting a lot of their ClaudeMD files.

314
00:20:10.570 --> 00:20:13.411
A lot of the skills and setup, they're like, hey, start fresh.

315
00:20:13.992 --> 00:20:20.875
Because the models have changed so much that you should try to raw use the model and see what can come up.

316
00:20:21.275 --> 00:20:22.296
That's not what happened in this case.

317
00:20:22.396 --> 00:20:23.757
I think the harness did some heavy lifting.

318
00:20:24.117 --> 00:20:25.678
But he looked at that.

319
00:20:26.598 --> 00:20:28.640
Then he said, we fully got read in Saturday.

320
00:20:28.660 --> 00:20:32.162
So Friday night, he thinks that they independently discovered the same thing.

321
00:20:32.422 --> 00:20:40.468
They fully got read in on Saturday and confirmed that some of their findings from that really basic prompt were these findings.

322
00:20:41.029 --> 00:20:44.551
And he looked at that and said, I got to get a fix out.

323
00:20:44.831 --> 00:20:47.253
Like, this is too easy to find.

324
00:20:47.653 --> 00:20:48.394
I'm going to get a fix out.

325
00:20:48.614 --> 00:20:49.535
The issue here.

326
00:20:50.355 --> 00:20:54.662
And I don't think anyone... You know, there's like the... Did Dan do anything wrong here?

327
00:20:54.862 --> 00:20:58.127
Is kind of this whole comment thread.

328
00:20:58.388 --> 00:21:03.355
The issue is he was read in under the agreement of embargoed information, right?

329
00:21:03.736 --> 00:21:05.098
So I think just like in general...

330
00:21:06.159 --> 00:21:06.459
I don't know.

331
00:21:06.479 --> 00:21:18.442
I think we can pretty much all agree he should not have broken embargo unilaterally without asking or talking to anyone or anything like this, because what this now did is force PHP to up their timeline by a full day.

332
00:21:18.462 --> 00:21:28.985
A lot of the coordinated disclosure people who are waiting for that patch and had pre run incidents to roll the patch out as soon as they could downtime, maintenance windows, whatever it was that all those schedules were out the window.

333
00:21:29.065 --> 00:21:31.905
So the ripple effects of Dan's decision were wide.

334
00:21:32.265 --> 00:21:33.606
This has 147 comments.

335
00:21:35.546 --> 00:21:37.246
on it and a lot of them are not very happy.

336
00:21:37.266 --> 00:21:38.407
Most of them are not good.

337
00:21:38.687 --> 00:21:41.827
Yeah, a lot of them are not very happy with Dan or Chain Guard and I do understand that.

338
00:21:42.327 --> 00:21:50.209
The question I have, okay, and I truly, truly, truly understand the frustration with Dan and his decision and all this kind of stuff, right?

339
00:21:50.269 --> 00:21:51.149
So I just want to say that.

340
00:21:51.609 --> 00:21:56.490
I've been on the other side where this would have ruined my schedule and whatever, right?

341
00:21:57.071 --> 00:21:59.111
I'm looking at this and I'm...

342
00:22:00.371 --> 00:22:03.572
It's so hard for me because it's like I think we're in a different world.

343
00:22:04.332 --> 00:22:14.258
I think we're in a different world now, and we all have to realize that the old ways of doing a lot of this coordinated or responsible disclosure and vulnerability management in general are dead, dead, dead.

344
00:22:14.579 --> 00:22:22.664
The timelines are so compressed from the time that any sniff of a vulnerability exists to the time that exploitation is going to start existing.

345
00:22:23.084 --> 00:22:30.409
I think this dream of having 90 days or even a few weeks in this case to get your ducks in order, I think that's behind us.

346
00:22:31.029 --> 00:22:31.850
Where do you land on this?

347
00:22:33.588 --> 00:22:35.529
I don't know how to feel about this.

348
00:22:35.709 --> 00:22:41.251
Like, I think it's easy to be like, oh, Dan broke a rule, so Dan bad, like, Chaingard bad.

349
00:22:41.391 --> 00:22:44.773
But at the same time, I agree with your point, right?

350
00:22:44.813 --> 00:22:57.258
Like, we are in a different world where it is not a small group of, like, a hundred or a thousand people on planet Earth who are capable of, like, finding and exploiting this, so there is value in keeping it to a small group.

351
00:22:57.338 --> 00:22:59.899
It is once literally a rumor that,

352
00:23:00.739 --> 00:23:03.141
of a vulnerability in something goes public.

353
00:23:03.241 --> 00:23:12.568
It takes like a nation state with a GPU farm or Billy with GLM53 at his house can point a model at the code base in question and find the vulnerability.

354
00:23:12.588 --> 00:23:20.895
And so, you know, whether it's bureaucracy or there's still a belief in a disclosure timeline, I don't know if it is the net positive anymore.

355
00:23:21.155 --> 00:23:21.355
Yeah.

356
00:23:21.595 --> 00:23:29.477
So here's another post that I think this post by Kyle Pauly, who's the CISO at Perplexity AI, really, really helped me solidify my stance on this.

357
00:23:29.497 --> 00:23:32.118
Because I, like I said, I've sat on the other side of this.

358
00:23:32.158 --> 00:23:33.538
I've been a security researcher.

359
00:23:33.558 --> 00:23:34.779
I've disclosed vulnerabilities to vendors.

360
00:23:35.079 --> 00:23:38.580
And I've been the guy that got the warning that I had to go find all this stuff.

361
00:23:38.600 --> 00:23:39.860
I've sat on both sides, right?

362
00:23:40.620 --> 00:24:01.106
uh even back then i it didn't quite sit right with me that like you had to know somebody to be in this little circle to like get invited and all this kind of stuff i made this video about the php thing pretty early right i had some people kind of mad at me that i made it pretty early like pandora wasn't already out of the box i understand okay maybe some people thought it wasn't helpful i don't think i i don't think i moved the needle i don't think i moved the

363
00:24:05.467 --> 00:24:09.910
I got so many DMs from people thanking me that they got a heads up.

364
00:24:10.030 --> 00:24:10.671
Sure.

365
00:24:11.151 --> 00:24:14.974
They were like, man, this impacts me or some people at MSPs.

366
00:24:14.994 --> 00:24:16.275
This impacts so many of my clients.

367
00:24:16.495 --> 00:24:19.457
This gave me a little bit more time to prep for what this week was about to be.

368
00:24:19.677 --> 00:24:19.897
Right?

369
00:24:20.478 --> 00:24:23.500
And those kinds of people are not in that trusted room.

370
00:24:23.980 --> 00:24:24.200
Right.

371
00:24:24.760 --> 00:24:25.401
So that's hard.

372
00:24:25.661 --> 00:24:32.003
But I do understand like giving PHP time to fix, giving like the backbone of the Internet time to figure it out.

373
00:24:32.103 --> 00:24:32.343
I do.

374
00:24:32.423 --> 00:24:33.003
I do understand it.

375
00:24:33.043 --> 00:24:37.605
But OK, this post from Kyle sees so perplexity helped solidify my opinion on this.

376
00:24:38.045 --> 00:24:38.485
He says it.

377
00:24:38.525 --> 00:24:39.785
I think he words it really well.

378
00:24:39.825 --> 00:24:44.087
I 100 percent agree that the embargo period for O days should never be broken by a trusted party.

379
00:24:44.507 --> 00:24:44.847
Period.

380
00:24:45.767 --> 00:24:46.227
I just agree.

381
00:24:46.387 --> 00:24:47.508
I completely agree.

382
00:24:48.028 --> 00:24:55.690
But I think the security industry needs to reevaluate how much time these embargoes could realistically afford to wait now that the cyber models exist.

383
00:24:55.930 --> 00:24:57.110
Also completely agree.

384
00:24:57.350 --> 00:24:59.851
He's saying during the KVM escape, you made a video about this, right?

385
00:25:01.031 --> 00:25:02.931
They were some researchers on his team.

386
00:25:02.951 --> 00:25:10.113
They were able to independently discover the vulnerability within a few hours simply by giving a redacted tweet from the security researcher to a model.

387
00:25:10.633 --> 00:25:13.755
He's like, we, of course, respected the embargo period, didn't share details.

388
00:25:13.775 --> 00:25:19.559
But if you can imagine if we were able to do it, any attacker could have done that as well.

389
00:25:19.939 --> 00:25:23.782
So ultimately, he said, ultimately, I think the embargo periods need to be measured in hours, not weeks or months.

390
00:25:23.882 --> 00:25:25.283
Completely agree.

391
00:25:25.543 --> 00:25:26.283
Completely agree.

392
00:25:26.443 --> 00:25:30.466
At this point, the hard part in vulnerability research is knowing what to look at.

393
00:25:30.586 --> 00:25:30.766
Right.

394
00:25:30.786 --> 00:25:32.229
You can find bugs in anything.

395
00:25:32.249 --> 00:25:34.532
The hard part is what thing do you choose to find bugs in?

396
00:25:34.572 --> 00:25:34.752
Right.

397
00:25:34.872 --> 00:25:35.573
Oh, is it PHP?

398
00:25:35.613 --> 00:25:36.114
Is it Nginx?

399
00:25:36.515 --> 00:25:41.142
The minute you find out a bug is real in a platform, it just takes the right.

400
00:25:41.222 --> 00:25:44.707
We talked about this previously, the gaslighting of the model into find me the bug.

401
00:25:44.747 --> 00:25:45.268
No mistakes.

402
00:25:45.668 --> 00:25:46.630
It will find you the bug.

403
00:25:46.890 --> 00:25:47.090
Yeah.

404
00:25:47.310 --> 00:25:51.451
So I think that, uh, I think this, this compressed timeline is really important.

405
00:25:51.592 --> 00:26:01.975
I think on the other side, I think if you're not like a security researcher or part of these embargo teams or anything like this, if you're running a security program for not one of the insiders that get added to this, right.

406
00:26:02.475 --> 00:26:10.584
I think you need to really, really evaluate your security stack and your layers of defense and think, did this ruin my day?

407
00:26:10.644 --> 00:26:20.355
Like, if these kinds of zero days drop and they break you entirely, you need to really be looking at what kind of layers you have because I think zero days are going to be more and more and more and more common, right?

408
00:26:20.695 --> 00:26:22.537
So we were talking today over breakfast about...

409
00:26:23.138 --> 00:26:29.661
This volume in particular is a little weird because what layer could you have put around like a PHP, internet-facing RCE?

410
00:26:29.941 --> 00:26:31.342
Like, that's hard, right?

411
00:26:31.742 --> 00:26:34.103
But other kinds of zero days, right?

412
00:26:34.624 --> 00:26:37.145
Citrix ones or gateway ones that we talk about a lot.

413
00:26:38.171 --> 00:26:48.174
If those don't go through a responsible disclosure type thing, if next week there's an Avanti Zero Day and it didn't go through a responsible disclosure and you didn't get a patch, what's your answer?

414
00:26:48.414 --> 00:26:49.154
You need an answer.

415
00:26:49.535 --> 00:26:50.355
Like, you need an answer.

416
00:26:50.375 --> 00:26:51.775
It can't be, well, don't use that.

417
00:26:51.815 --> 00:26:53.796
It can't be pull that off the internet and it can't be,

418
00:26:54.636 --> 00:26:57.819
Yell on LinkedIn comments until people do responsible disclosure better.

419
00:26:58.020 --> 00:26:59.321
None of those are valid strategies.

420
00:26:59.761 --> 00:27:00.642
So what is your strategy?

421
00:27:00.662 --> 00:27:05.247
What are the other layers that you're going to put in place so that zero days don't just topple your entire stack?

422
00:27:05.307 --> 00:27:05.507
Yeah.

423
00:27:05.807 --> 00:27:06.008
Right?

424
00:27:06.568 --> 00:27:07.689
There's no universal right answer.

425
00:27:08.030 --> 00:27:10.192
Your answer is going to be different based on your environment, all this kind of stuff.

426
00:27:10.412 --> 00:27:10.793
But like...

427
00:27:11.614 --> 00:27:12.495
This is our new reality.

428
00:27:12.775 --> 00:27:15.700
I want to talk about the kind of the zero-day fallout from all this, right?

429
00:27:15.740 --> 00:27:25.734
So we mentioned a lot of this kicked off because there were rumors publicly after this small group kicked off that PHP was working on a bug to fix a large vulnerability, right?

430
00:27:25.754 --> 00:27:25.854
Yeah.

431
00:27:26.275 --> 00:27:34.358
When that rumor went live, obviously, we had the entire planet point their LOMs, DeepSeek, you know, 4.1, GLM 5.3, whatever, at the PHP code base.

432
00:27:34.578 --> 00:27:42.881
And so after the, you know, a couple of pocs were floating around, there are no public pocs, but there are rumors people have codes or scripts that could work.

433
00:27:42.901 --> 00:27:45.262
And there are people that exercise the code path in PHP.

434
00:27:45.822 --> 00:27:50.704
People got the patch and then said, wait, there's a vulnerability that works for this patch.

435
00:27:51.124 --> 00:27:52.285
So two things are going to happen, right?

436
00:27:52.926 --> 00:28:00.274
One, there are likely going to be people who, while looking for this bug during the rumor, found other vulnerabilities in PHP.

437
00:28:01.055 --> 00:28:04.359
And two, LLMs are very good at finding patterns, right?

438
00:28:04.379 --> 00:28:05.160
That's kind of like all they do.

439
00:28:05.180 --> 00:28:09.785
It's like you give it some data and it looks around in this little, you know, matrix cube and it gives you other data.

440
00:28:10.405 --> 00:28:10.566
Um...

441
00:28:10.946 --> 00:28:18.874
You know, the way that the Kalief researcher found the 5.3 bug, the 5.2, whatever the 5 version bug, is he said, hey, this is a pattern for an invariant, go and find it.

442
00:28:19.374 --> 00:28:24.820
It is likely now that other people have found other invariants that match that same pattern.

443
00:28:24.840 --> 00:28:28.624
If you consider the LPE things from back in like May of this year...

444
00:28:28.964 --> 00:28:35.867
There was this one big bug called dirty frag where effectively a researcher found a new pattern in how Linux LPEs can execute, right?

445
00:28:35.887 --> 00:28:44.752
Local privilege escalations where you have a socket and a file descriptor for a privileged file like bin su, for example, or sudo or something.

446
00:28:45.492 --> 00:28:58.294
And then via a syscall that does an out-of-bounds write, not maliciously, just like the way the code was written, you can overwrite the page cache entry for your binary bin suv so that the kernel thinks while you're doing exec VE, it has different codes.

447
00:28:58.354 --> 00:28:59.755
You run your code as root.

448
00:29:00.235 --> 00:29:08.096
That pattern of bug that the researcher found was then used by other researchers with LLMs to find new kernel vulnerabilities.

449
00:29:08.136 --> 00:29:12.457
So in that same two, three-month period, they found six different CVEs that fit that pattern.

450
00:29:12.937 --> 00:29:17.219
So similarly, this PHP to shell is a interesting bug pattern.

451
00:29:17.259 --> 00:29:26.565
It's a use after free caused by something non-fatally failing during a session establishment, but then it continues to do work with that metadata.

452
00:29:27.145 --> 00:29:37.231
It is likely that new bugs will be found not only in PHP that fit this model, but also Nginx, Apache, and name a network-facing daemon that parses requests.

453
00:29:37.571 --> 00:29:41.153
There are going to be new bugs, which is not super great.

454
00:29:41.598 --> 00:29:44.119
Yeah, and there's some other drama going around this one.

455
00:29:45.179 --> 00:29:45.779
Can you go through?

456
00:29:45.799 --> 00:29:47.740
I kind of missed this part of the news cycle.

457
00:29:47.840 --> 00:29:48.720
What happened with Wiz?

458
00:29:49.140 --> 00:29:52.521
Yeah, this is more me trying to downplay this story.

459
00:29:52.701 --> 00:29:58.483
I really want to emphasize that it is so important for researchers not to infight.

460
00:29:58.823 --> 00:30:07.826
So what happened here is apparently Wiz got caught trying to buy the domain for PHP to shell and claim that they found the bug.

461
00:30:08.186 --> 00:30:10.747
like two or so days before the bug actually got dropped.

462
00:30:10.767 --> 00:30:13.227
And there is this whole thing of being like, oh, screw you, Wiz.

463
00:30:13.507 --> 00:30:17.968
This is you guys trying to like buy up all the marketing for the bug and claim that you found it, okay?

464
00:30:18.408 --> 00:30:18.829
Two things.

465
00:30:18.889 --> 00:30:22.229
I think everyone now publicly acknowledges that the researcher from Kalief found the bug.

466
00:30:22.449 --> 00:30:24.790
That is kind of just like, they are like patient zero for this bug.

467
00:30:25.290 --> 00:30:37.673
But to your point before, it is important to highlight that like, if you're a large company like Wiz, like Chain Guard, like somebody else that probably has access to a frontier, maybe unguarded model, like Daybreak or something,

468
00:30:38.593 --> 00:31:00.242
all you have to do is take the code base and say find me bug no mistakes and you're going to find it and so this may have just been whiz trying to capitalize on that which again likely is some form of like content marketing but either way i don't think this is them trying to say like we found it first it's just i think it was another researcher finding the bug that being said tldr here is like we're all in this together guys let's take it easy on the on the mudslinging we're trying our best

469
00:31:00.462 --> 00:31:01.884
Yeah, I saw some pitchforks, right?

470
00:31:01.984 --> 00:31:07.789
People were like, oh, we're just trying to take, you know, claim responsibility on this or credit for this.

471
00:31:07.849 --> 00:31:09.251
And yeah, I just don't think that's what's actually happening.

472
00:31:09.271 --> 00:31:09.892
Yeah, it's not useful.

473
00:31:10.532 --> 00:31:11.133
All right.

474
00:31:11.693 --> 00:31:13.095
Are we good on PHP for now?

475
00:31:14.495 --> 00:31:15.456
Yeah.

476
00:31:15.656 --> 00:31:16.376
I think, okay.

477
00:31:17.117 --> 00:31:18.418
Like I said, we're recording this Thursday.

478
00:31:18.438 --> 00:31:22.740
There's probably going to be some exploitation type stuff.

479
00:31:23.100 --> 00:31:23.981
The POC is going to come out.

480
00:31:24.321 --> 00:31:24.501
Yep.

481
00:31:24.561 --> 00:31:26.903
Like the POC is going to come out soon, right?

482
00:31:27.663 --> 00:31:35.168
Patches are not going to be 100% applied across the internet, especially I think 40% of that 70% is WordPress sites.

483
00:31:35.989 --> 00:31:39.111
They're going to have a bad couple days here, right?

484
00:31:39.131 --> 00:31:39.551
Yeah.

485
00:31:39.791 --> 00:31:48.238
There was another just absolutely crazy foundational internet technology besides 70% of websites that had a really weird week.

486
00:31:48.599 --> 00:31:49.840
The analogy I made...

487
00:31:50.560 --> 00:31:52.562
So the next one we're going to talk about is the certificate of authority.

488
00:31:52.602 --> 00:32:00.729
The analogy that I made is like, this is like finding out that cement has a flaw in the world and needs to be remediated.

489
00:32:00.749 --> 00:32:02.951
Oh, you're on a bridge right now, by the way.

490
00:32:02.971 --> 00:32:03.712
Yeah, by the way.

491
00:32:03.752 --> 00:32:05.113
And so is your grandma, right?

492
00:32:05.153 --> 00:32:06.274
Like, yeah.

493
00:32:06.514 --> 00:32:06.774
So...

494
00:32:07.475 --> 00:32:12.859
A certificate authority out of India, eMudra, messed up a little bit.

495
00:32:13.340 --> 00:32:14.120
And... Slightly.

496
00:32:14.401 --> 00:32:15.581
Used a private key.

497
00:32:15.782 --> 00:32:17.023
You made the joke at the beginning.

498
00:32:17.363 --> 00:32:20.906
Private key is usually tons of entropy, all this kind of stuff.

499
00:32:21.246 --> 00:32:23.808
This one was the number four, I believe.

500
00:32:24.108 --> 00:32:24.308
Yeah.

501
00:32:24.709 --> 00:32:26.210
What the hell happened?

502
00:32:26.490 --> 00:32:33.796
And so it's not like the number four, like 10 to the power, like 1024 to the power of four, or it's like four D96 bits of entropy.

503
00:32:33.876 --> 00:32:34.717
All zeros...

504
00:32:35.617 --> 00:32:35.718
4.

505
00:32:35.738 --> 00:32:36.138
4.

506
00:32:36.519 --> 00:32:38.502
I don't even know how you would run a command to do this.

507
00:32:38.562 --> 00:32:38.862
Yeah.

508
00:32:39.343 --> 00:32:43.930
So again, there isn't a lot of detail that I can find about exactly how this went down.

509
00:32:44.070 --> 00:32:47.415
And I'm going to be kind of loosey-goosey on details because I don't know exactly how this works.

510
00:32:47.435 --> 00:32:48.616
I don't run a certificate authority.

511
00:32:49.037 --> 00:32:50.339
But a certificate authority...

512
00:32:50.679 --> 00:32:52.780
is this thing in the architecture of the internet, right?

513
00:32:52.800 --> 00:32:55.102
Where you have TLS, you have encryption, right?

514
00:32:55.122 --> 00:33:03.426
You do a public key exchange when you're connected to a server, you authenticate via a certificate that the cert you get from the site is the site, right?

515
00:33:03.466 --> 00:33:06.728
Like Google sends you a thing that is signed by a company that is signed by a company.

516
00:33:06.748 --> 00:33:09.510
The top of that is a certificate authority, okay?

517
00:33:09.530 --> 00:33:09.630
Okay.

518
00:33:10.230 --> 00:33:16.894
It's very important that the private keys for those certificate authorities, those certificates in the middle, they're called intermediate certificates, are not leaked.

519
00:33:16.934 --> 00:33:21.917
The reason being, if you had the private key, you therefore could issue arbitrary certs at a lower level, right?

520
00:33:21.937 --> 00:33:32.784
So intermediate goes down one level, lower level, and you could use that key, that certificate that is trusted by the chain of trust to intercept traffic via TLS, okay?

521
00:33:33.365 --> 00:33:36.206
Now, how do you get a private key to be the number four?

522
00:33:36.587 --> 00:33:36.947
I don't know.

523
00:33:37.367 --> 00:33:42.810
As far as I understand it, the certificate authorities, when they do key generation, they do what is called the key generation ceremony, right?

524
00:33:42.850 --> 00:33:44.031
These things are very trusted.

525
00:33:44.051 --> 00:33:48.094
It is very important that there is not a malicious third party, an insider threat.

526
00:33:48.754 --> 00:33:55.178
So there is a ceremony of multiple people that are pressing buttons, that are storing these keys in what are called an HSM, right?

527
00:33:55.198 --> 00:33:56.499
A hardware security module.

528
00:33:56.599 --> 00:33:57.339
Candles are lit.

529
00:33:57.359 --> 00:33:58.380
Candles are lit.

530
00:33:58.520 --> 00:34:00.441
You got some funky jazz going on in the background.

531
00:34:01.502 --> 00:34:03.083
Tarot cards are pulled.

532
00:34:03.143 --> 00:34:03.383
Right.

533
00:34:03.703 --> 00:34:25.644
yeah i was going more the central route but i like yours better ceremony yeah um eventually an hsm is a hardware security module does two things one it creates cryptographically secure random numbers right a private key ideally is a secret random number that in the naming that in naming ceremony in the key generation ceremony none of us know it's in the hsm and it was generated securely

534
00:34:26.685 --> 00:34:29.247
The problem is, how could it possibly be the number four?

535
00:34:29.387 --> 00:34:39.353
My guess is that, you know, ultimately the HSM is literally a PCIe card that's in a rack mount thing, and you have to write a script that interfaces with the HSM to issue the cert.

536
00:34:40.734 --> 00:34:45.578
I would imagine it was, like, a bug in their bash script that, like, just...

537
00:34:46.278 --> 00:34:54.107
Instead of using the number from the HSM as a private key, it was like the index of the private key, like I instead of K or something.

538
00:34:54.648 --> 00:34:55.669
Again, I have no proof of this.

539
00:34:55.689 --> 00:35:01.536
I haven't seen the script, but it's just like that is the only way I could fathom a private key of four being issued either that.

540
00:35:02.337 --> 00:35:06.643
Or like in the manual of the HSM, you had to like seed the RNG.

541
00:35:07.044 --> 00:35:10.148
And if you didn't seed the RNG, like the seed was bad.

542
00:35:10.188 --> 00:35:12.992
So you just got like linear one, two, three, four numbers, maybe.

543
00:35:13.012 --> 00:35:14.093
But that sounds like bad product design.

544
00:35:14.113 --> 00:35:14.794
I doubt that's the case.

545
00:35:15.195 --> 00:35:18.720
Either way, it's insane that that happens now.

546
00:35:19.040 --> 00:35:30.492
Yeah, it looks like it was an HSM wrapper script that during this key ceremony, that script just literally grabbed the wrong file that was labeled something different.

547
00:35:31.032 --> 00:35:35.737
The label was close, grabbed the wrong file, and gave that as the private key.

548
00:35:36.238 --> 00:35:39.160
The bigger issue here is that this was in 2025.

549
00:35:39.181 --> 00:35:39.281
Yeah.

550
00:35:40.982 --> 00:35:41.402
Oh, right.

551
00:35:41.422 --> 00:35:42.162
We talked about this.

552
00:35:42.422 --> 00:35:42.642
Yeah.

553
00:35:42.682 --> 00:35:46.483
They did this key ceremony in 2025 and someone just figured it out.

554
00:35:46.583 --> 00:36:05.888
I think that we need to now include brute forcing private keys as just part of like our normal hygiene things to because we cannot verify that trusted certificate authorities are using secure algorithms and like you said, ceremonies to actually create these private keys.

555
00:36:06.088 --> 00:36:09.789
We brute forcing private keys was not a part of anyone's toolbox.

556
00:36:09.849 --> 00:36:10.009
Right.

557
00:36:10.789 --> 00:36:18.094
It is like accepted that like to brute force a private key, it would like you have to achieve the heat death of the universe in time to break like RSA 4096 or something like that.

558
00:36:18.134 --> 00:36:18.314
Right.

559
00:36:18.494 --> 00:36:26.119
And so now we have to just do that really quick to make sure that, you know, in some really, really unreasonable fashion that this didn't go down.

560
00:36:26.199 --> 00:36:26.859
That's kind of crazy.

561
00:36:26.899 --> 00:36:34.143
Yeah, I think the timeline of this, like, literally a researcher for fun was just, like, messing around with, he said, quote-unquote, I got some new toys and wrote a script to try to crack some stuff.

562
00:36:34.483 --> 00:36:37.305
So I pulled down some certificates from my trusted, like, search store.

563
00:36:37.725 --> 00:36:40.727
And then a couple hours later, I was like, oh, wait, whoa, whoa, whoa, I broke this?

564
00:36:40.787 --> 00:36:44.309
And he, like, spent three more hours confirming that he cracked a certificate.

565
00:36:44.569 --> 00:36:47.211
And then he reported it to Mozilla and Google from there, which...

566
00:36:47.791 --> 00:36:55.877
It's kind of like the XZ backdoor where a researcher didn't like their 500 milliseconds of latency and discovered a global supply chain compromise.

567
00:36:55.917 --> 00:36:56.437
Kind of the same thing.

568
00:36:56.457 --> 00:37:00.340
This guy was just fucking around and he's like, oh my God, the private key is four?

569
00:37:00.380 --> 00:37:00.920
What do you mean?

570
00:37:01.160 --> 00:37:01.620
This is bad.

571
00:37:01.821 --> 00:37:10.406
So the reason this is bad is that these trusted certificate authorities, if you guys aren't familiar how this whole system works, get preloaded into your browser, right?

572
00:37:10.646 --> 00:37:15.610
So just the fact that this is like some random intermediary in India really doesn't matter.

573
00:37:16.090 --> 00:37:24.015
It really doesn't matter because this becomes a signing certificate that anyone could use in your browser would be like a little green lock up at the top left.

574
00:37:24.556 --> 00:37:26.377
A-OK. You can go on through.

575
00:37:26.497 --> 00:37:26.717
Right.

576
00:37:26.737 --> 00:37:27.878
So these are loaded into your browser.

577
00:37:27.898 --> 00:37:31.120
That's what the Trusted Certificate Authority system is doing.

578
00:37:31.180 --> 00:37:31.380
Right.

579
00:37:31.921 --> 00:37:36.263
In Google and Mozilla's credit, this was killed within hours.

580
00:37:36.504 --> 00:37:36.704
Right.

581
00:37:37.004 --> 00:37:41.507
So no actual like impact from this one was very realistic.

582
00:37:41.687 --> 00:37:41.907
Right.

583
00:37:42.167 --> 00:37:43.028
This was nuked.

584
00:37:43.708 --> 00:38:02.505
Uh, the other, like just absolutely insane part is that Emudra has now like put out a statement and they're basically blaming the social media craze about this as like the bigger risk or the bigger part of like what actually went on.

585
00:38:03.025 --> 00:38:03.245
Right.

586
00:38:03.546 --> 00:38:07.129
So they like in their statement, they're like, however, the level of the.

587
00:38:07.729 --> 00:38:12.772
social media amplification around this incident has brought scrutiny that is out of proportion.

588
00:38:12.792 --> 00:38:18.175
It's like, they're like, a significant amount of our revenue is from our certificate authority status.

589
00:38:18.235 --> 00:38:19.635
And like, this is making us look bad.

590
00:38:19.695 --> 00:38:20.156
Stop that.

591
00:38:20.176 --> 00:38:21.937
And it's like, brother, yes, correct.

592
00:38:22.097 --> 00:38:23.598
Your private key was four.

593
00:38:23.658 --> 00:38:25.559
I'm not sure what else you would like me to say about that.

594
00:38:25.599 --> 00:38:25.919
Complete.

595
00:38:26.219 --> 00:38:30.883
So incompetence, right, is the actual thing and has nothing to do with social media amplification.

596
00:38:31.143 --> 00:38:43.555
I'm also seeing that we think that this statement came out and like why they're starting to say a lot of this is it seems like Google is going to revoke their ability to be a trusted certificate authority, which I think is completely valid at this point.

597
00:38:43.575 --> 00:38:46.217
That's crazy that this has existed like this for a few years.

598
00:38:46.397 --> 00:38:47.038
Matt, I have a question.

599
00:38:47.518 --> 00:38:49.100
Are coffee shops dangerous or no?

600
00:38:49.120 --> 00:38:55.567
Yeah, so this is... We were sitting at a coffee shop, and I was, like, trying to wargame in my head how this is actually exploited, right?

601
00:38:55.627 --> 00:38:56.328
Obviously, this is bad.

602
00:38:56.368 --> 00:38:57.149
We know this is bad.

603
00:38:57.169 --> 00:38:58.030
We understand this is bad.

604
00:38:58.050 --> 00:38:59.571
I was like, what's the exploit, right?

605
00:39:00.032 --> 00:39:03.435
So I very regularly dunk on...

606
00:39:05.097 --> 00:39:10.960
social media creators in the security space that just still push the public Wi-Fi bad, but right, right, for clicks.

607
00:39:11.981 --> 00:39:14.182
TLS has been around for a very long time.

608
00:39:15.322 --> 00:39:22.126
We have both said we will not take VPN sponsors because like they their marketing is very much like you need us to be safe.

609
00:39:22.726 --> 00:39:24.146
Yeah, on public Wi Fi.

610
00:39:24.206 --> 00:39:24.907
I've made videos about this.

611
00:39:24.967 --> 00:39:32.228
Unless we're literally in like a totalitarian authoritarian government where you needed to like view the public Internet, you're not getting much out of it.

612
00:39:32.348 --> 00:39:41.991
And is a VPN helping in any situation that you're talking about, like a real risk is the VPN actually adding any additional layers of help for you.

613
00:39:42.051 --> 00:39:42.231
Right.

614
00:39:42.551 --> 00:39:45.552
Because at that point, your your endpoint has spyware and it doesn't matter.

615
00:39:45.592 --> 00:39:45.752
Right.

616
00:39:45.792 --> 00:39:46.332
Like you're toast.

617
00:39:47.232 --> 00:39:53.639
So, uh, this is one of those situations that's very rare, but like, oh, wait, dot, dot, dot.

618
00:39:53.859 --> 00:40:00.185
Like if this kind of stuff happened, this does actually pose a risk for public wifi.

619
00:40:00.225 --> 00:40:08.814
Not necessarily public, like, like I wouldn't be really, really too worried about like, oh, people are like, oh, the airplane wifi is, uh, the hacker's playground, uh, you know, all this nonsense.

620
00:40:08.834 --> 00:40:09.394
God, I hate it.

621
00:40:09.474 --> 00:40:09.775
Um, yeah.

622
00:40:11.056 --> 00:40:14.719
But the Wi-Fi pineapple attack is basically this works, right?

623
00:40:14.759 --> 00:40:21.283
This helps the Wi-Fi pineapple attack actually work without social engineering or without captive portal tricks or anything like that, right?

624
00:40:21.363 --> 00:40:21.523
Yep.

625
00:40:21.924 --> 00:40:26.046
The other scenario is a bit scarier, right?

626
00:40:26.247 --> 00:40:27.948
You were helping outline it to me, right?

627
00:40:28.328 --> 00:40:31.351
What is like the internet-wide actual attack here?

628
00:40:31.872 --> 00:40:33.194
It's more nation state though, right?

629
00:40:33.954 --> 00:40:40.301
It's not like me, Matt, decides to be a bad guy today and want to exploit this E-Mudra thing that I found.

630
00:40:40.662 --> 00:40:42.364
My avenue is Wi-Fi Pineapple.

631
00:40:42.404 --> 00:40:43.165
What's the other avenue?

632
00:40:43.185 --> 00:40:43.545
Yeah.

633
00:40:43.685 --> 00:40:52.514
Yeah, I mean, if you look at historically big attacks on like, I'm talking global level routing protocols, like BGP, for example, right?

634
00:40:52.534 --> 00:40:58.199
There are several instances of countries, and again, I'm not trying to get political, but like China is like one of the biggest perpetrators of this.

635
00:40:58.219 --> 00:41:04.906
They do BGP attacks where literally they have an ASN that does not serve an IP range.

636
00:41:05.426 --> 00:41:26.935
advertise that they do what they're doing is they're diverting the traffic of that internet through an area that you know the idea is that they can collect it right it's like suck it all down or whatever and ideally somebody's not encrypted or maybe they're like you know uh down or now store now to crypt later but in this case what could be done is an asn could use a now and the rogue is a wrong word but like a compromised certificate authority that your browser still trusts

637
00:41:27.275 --> 00:41:33.058
They can man in the middle of that traffic and issue a certificate that matches your site that is now interceptable by them because they have the private key.

638
00:41:33.378 --> 00:41:37.060
And now your traffic is routing through an ASM that is malicious and they could be serving bad content to you, right?

639
00:41:37.080 --> 00:41:38.540
They can serve a browser exploit, they can do whatever they want.

640
00:41:38.561 --> 00:41:44.603
Like that, that is the world of, you know, insane global level things that could occur from this.

641
00:41:44.623 --> 00:41:45.244
And that being said,

642
00:41:46.024 --> 00:41:49.066
China also has a lot of CAs themselves, so probably a different conversation.

643
00:41:49.267 --> 00:41:51.348
But still, that is the kind of thing that could occur.

644
00:41:51.508 --> 00:41:51.768
Totally.

645
00:41:51.949 --> 00:41:52.169
Okay.

646
00:41:52.309 --> 00:42:05.799
So yeah, in this regard, it's like, if this got found before Google and Mozilla were able to nuke it from orbit, a Wi-Fi pineapple type thing was a little bit more possible, basically, for the past year.

647
00:42:06.159 --> 00:42:06.460
Right?

648
00:42:06.720 --> 00:42:07.460
Is that what this sounds like?

649
00:42:07.540 --> 00:42:07.740
Okay.

650
00:42:07.901 --> 00:42:08.581
Yeah.

651
00:42:08.761 --> 00:42:09.382
Yep.

652
00:42:09.482 --> 00:42:13.245
Just kudos to Google and Mozilla for absolutely, like,

653
00:42:13.845 --> 00:42:15.506
Yeah, this had zero impact.

654
00:42:15.586 --> 00:42:18.647
This was a funny meme on the Internet today.

655
00:42:18.907 --> 00:42:20.067
Zero impact as far as we know.

656
00:42:20.347 --> 00:42:20.747
Yep.

657
00:42:20.807 --> 00:42:23.088
I see Cloud Flares is all over it, too.

658
00:42:23.188 --> 00:42:24.008
It's just kind of crazy.

659
00:42:24.168 --> 00:42:25.009
And funny story.

660
00:42:25.049 --> 00:42:30.370
The tool men in the middle proxy now some more supports dash dash e Mudra mode.

661
00:42:30.390 --> 00:42:36.312
We're able to intercept TLS and on the fly issue a cert for that site using the Mudra CA.

662
00:42:36.652 --> 00:42:36.852
Great.

663
00:42:36.992 --> 00:42:37.413
Incredible.

664
00:42:37.653 --> 00:42:37.833
Great.

665
00:42:38.033 --> 00:42:38.233
Great.

666
00:42:38.373 --> 00:42:38.553
Yeah.

667
00:42:39.473 --> 00:42:40.734
There were a ton of volumes this week.

668
00:42:40.914 --> 00:42:42.375
We don't have time to talk about all of them.

669
00:42:42.395 --> 00:42:43.375
That's how much there was.

670
00:42:43.395 --> 00:42:46.137
So we're going to play a little catch up on next week's podcast of all the volumes.

671
00:42:46.717 --> 00:42:49.899
But we did want to talk about one more because near and dear to your heart, right?

672
00:42:50.339 --> 00:43:00.325
We were just talking about the number of Linux kernel vulnerabilities coming out, changing the security paradigm of containerization versus KVM and all this kind of stuff.

673
00:43:00.745 --> 00:43:04.827
What are actual security boundaries in virtualization and containerization today?

674
00:43:05.167 --> 00:43:05.848
And what happened?

675
00:43:06.368 --> 00:43:07.850
on new Linux kernel vulnerability.

676
00:43:08.911 --> 00:43:10.493
Obviously, you've been doing a lot on this.

677
00:43:10.553 --> 00:43:11.034
What's this one?

678
00:43:11.234 --> 00:43:11.514
Yeah.

679
00:43:11.755 --> 00:43:15.820
So first of all, I want to highlight kind of a pattern happening in like the world of AI vulnerability research, right?

680
00:43:15.840 --> 00:43:19.984
So this is a yet again, you know, another use after free vulnerability.

681
00:43:20.105 --> 00:43:20.465
Low level.

682
00:43:20.485 --> 00:43:22.467
Why do we keep seeing so many use after free vulnerabilities?

683
00:43:23.088 --> 00:43:24.970
The problem with the, what?

684
00:43:26.011 --> 00:43:26.332
Low level.

685
00:43:26.372 --> 00:43:26.952
Why do you...

686
00:43:52.370 --> 00:43:57.411
If a buffer overflow, something simple like a mem copy with a user sourced end is there, you're going to find it.

687
00:43:58.091 --> 00:44:00.832
Those are what we call spatial vulnerabilities, right?

688
00:44:00.852 --> 00:44:06.353
It is a buffer or a number exceeding the space of what is allocated for it.

689
00:44:06.873 --> 00:44:10.934
A use after free vulnerability is a temporal vulnerability.

690
00:44:10.954 --> 00:44:22.057
It is literally a vulnerability in time where the program needs to execute two different states that are different, that overlap, that use the same code path, the same objects.

691
00:44:22.677 --> 00:44:36.248
fuzzers are not optimized for uafs they're literally optimized for just code coverage right but it's not it's not going to be like oh i want to optimize for go down this tree and then also in the same execution go down this tree and hope that those two overlap very bad

692
00:44:37.181 --> 00:44:57.075
And LLMs are very good at pattern matching, which is a thing that we're seeing in the UAF world where it's like, okay, if I can describe the ways this program can free over here in the same state, use that memory, if I can come up with this pattern, a lot of the, you know, the Kalief researcher, I can ask a LLM to go identify if that pattern of invariance can be violated in a code base, right?

693
00:44:57.695 --> 00:44:59.197
So we're seeing a lot of UAFs fall out of the sky.

694
00:44:59.517 --> 00:45:05.463
And the two we're talking about today are vulnerabilities in the kernel SMB daemon for Linux, right?

695
00:45:05.503 --> 00:45:18.617
So two of them, one of them not super, you know, it's obviously a remote code execution bug, but it requires you to already have credentials within that network, I believe, to be able to actually, I think, mount a network device via SMB onto your Linux server.

696
00:45:19.157 --> 00:45:21.559
But the second one is full on remote on auth, right?

697
00:45:21.579 --> 00:45:32.288
It has to do with basically during session establishment, if you tear down the session in the right way, there's a use after free race condition where as you're like walking a list, you can insert another node to the list and make it do arbitrary read, write stuff.

698
00:45:32.348 --> 00:45:33.609
So not great.

699
00:45:34.049 --> 00:45:36.751
Again, I don't have a ton to say about this because it's like, you know,

700
00:45:37.612 --> 00:45:39.533
Yet another vulnerability in the Linux kernel.

701
00:45:39.573 --> 00:45:46.377
But I think at a higher level, what's more important to recognize is like, we're going to keep seeing more UAFs kind of fall out of the woodwork.

702
00:45:46.457 --> 00:45:55.283
Because I think people are learning more and more that LMs are very good at identifying that code pattern better than automation tooling like fuzzing has been for a long time.

703
00:45:55.623 --> 00:45:55.803
Yeah.

704
00:45:56.083 --> 00:45:56.243
Yeah.

705
00:45:56.263 --> 00:45:56.764
This is crazy.

706
00:45:57.164 --> 00:45:57.904
We're living in a new world.

707
00:45:57.964 --> 00:45:59.245
It's changing, changing super fast.

708
00:45:59.585 --> 00:46:01.406
Anything else before we get there, guys, do us a favor.

709
00:46:01.426 --> 00:46:03.427
You know, if you're listening to this podcast, hit that sub button.

710
00:46:03.447 --> 00:46:05.908
If you're on Spotify, give us a five star rating on Spotify.

711
00:46:05.928 --> 00:46:07.609
I've gotten some words from our friends.

712
00:46:07.629 --> 00:46:10.751
We're popping up organic in their algorithm, which is huge for the podcast.

713
00:46:10.771 --> 00:46:11.971
We appreciate your support there.

714
00:46:12.352 --> 00:46:15.933
And as usual, thank you, Mays, for sponsoring the podcast, helping us get this thing off the ground.

715
00:46:15.953 --> 00:46:17.094
Guys, we wouldn't be here without you guys.

716
00:46:17.134 --> 00:46:17.774
We appreciate that.

717
00:46:18.695 --> 00:46:21.696
Stick around for the interviews and we'll see you in the next one.

718
00:46:21.776 --> 00:46:22.117
Later, y'all.

719
00:46:22.137 --> 00:46:22.577
Happy hacking.

720
00:46:31.311 --> 00:46:32.993
Good morning, hackers.

721
00:46:33.093 --> 00:46:37.657
Welcome to The Lowdown, the best podcast on the internet for hackers.

722
00:46:37.678 --> 00:46:42.202
We are joined today by Tom Hagel of Sentinel One, the lead of Sentinel Labs.

723
00:46:42.222 --> 00:46:43.003
Tom, how are you doing, man?

724
00:46:43.223 --> 00:46:43.784
How's life today?

725
00:46:44.044 --> 00:46:44.645
I'm doing good.

726
00:46:44.725 --> 00:46:46.106
Going to the conference.

727
00:46:46.126 --> 00:46:46.446
Playing?

728
00:46:46.767 --> 00:46:47.107
Busy?

729
00:46:47.407 --> 00:46:48.288
Welcome to the fishbowl.

730
00:46:48.448 --> 00:46:51.912
Yes, the fishbowl is definitely a fishbowl everyone's staring at you, which is great.

731
00:46:52.372 --> 00:46:53.833
As long as they don't tap on the glass.

732
00:46:54.654 --> 00:46:55.074
Exactly.

733
00:46:55.094 --> 00:46:55.734
I'm doing good though.

734
00:46:55.774 --> 00:46:56.275
Keeping busy.

735
00:46:56.455 --> 00:47:06.861
So on attacker tradecraft, like hype versus reality, where are you seeing the most impactful differences in attacker tradecraft?

736
00:47:07.121 --> 00:47:10.003
Obviously time to exploit and stuff like this that we're talking about.

737
00:47:10.663 --> 00:47:11.844
We watched the keynote yesterday.

738
00:47:11.864 --> 00:47:13.286
You guys were talking about React to Shell.

739
00:47:13.306 --> 00:47:14.807
You guys were talking about a bunch of different stuff.

740
00:47:15.087 --> 00:47:19.051
Yeah, it's like going to zero or negative numbers, right?

741
00:47:19.111 --> 00:47:22.374
Like the time to exploit a volume from when patch comes out.

742
00:47:22.394 --> 00:47:25.017
It's like zero days are super common now.

743
00:47:25.057 --> 00:47:30.262
Besides time to exploit, what are you seeing be the most impactful differences versus hype that we're reading about?

744
00:47:30.562 --> 00:47:35.043
Yeah, the biggest thing right now is the reconnaissance capabilities for actors.

745
00:47:35.463 --> 00:47:46.247
Now they can have a prompt where they can figure out every organization that's responsible for being involved in this political case or every organization that's signed a contract with this software supplier.

746
00:47:46.607 --> 00:47:51.408
So the reconnaissance capabilities are extremely robust now.

747
00:47:51.708 --> 00:47:56.669
And it's really hard to block that at a guardrail perspective from the LLMs themselves.

748
00:47:56.850 --> 00:47:57.950
Because you're just kind of...

749
00:47:58.450 --> 00:48:00.771
exploring the internet like, hey, who uses software?

750
00:48:00.791 --> 00:48:05.753
It's not like something that's going to trigger a normal guardrail that they can prevent an exploit generating.

751
00:48:06.674 --> 00:48:07.834
I don't think we talk about that enough.

752
00:48:07.934 --> 00:48:09.015
Yeah, exactly.

753
00:48:09.075 --> 00:48:10.596
I don't read about a whole lot of that.

754
00:48:10.756 --> 00:48:20.160
Yeah, you look at the actors that are using it for that and automating that capability and then intertwining it with automated probing to see what's actually publicly accessible.

755
00:48:20.641 --> 00:48:25.483
And then once that's all said and done, then they go to the exploit route and think if they actually can do things.

756
00:48:25.943 --> 00:48:28.284
The reconnaissance side is half the battle.

757
00:48:28.304 --> 00:48:30.305
You know, you think about, like, Chinese actors.

758
00:48:30.705 --> 00:48:34.207
They do a lot of insanely sophisticated hacks.

759
00:48:34.287 --> 00:48:36.508
Like, you think about, like, Salt Typhoon and all that stuff.

760
00:48:37.148 --> 00:48:41.070
Very, very sophisticated and well orchestrated and executed.

761
00:48:42.110 --> 00:48:45.732
But to do that properly, they had to do a ton of reconnaissance to learn about these environments.

762
00:48:46.212 --> 00:48:47.033
It was accessible.

763
00:48:47.613 --> 00:48:50.954
Now they can automate all that stuff so they can find those little nuggets that are everywhere.

764
00:48:50.974 --> 00:49:00.818
This little contractor that's in Maryland that also supplies the cafe coolers for the Pentagon or whatever.

765
00:49:01.339 --> 00:49:05.800
Those little details are now able to be surfaced and that I think is the juiciest part right now.

766
00:49:06.141 --> 00:49:06.521
You can't

767
00:49:07.121 --> 00:49:07.622
prevent that.

768
00:49:07.642 --> 00:49:08.643
Yeah, super interesting.

769
00:49:08.683 --> 00:49:23.204
We're getting lucky though because a lot of these actors are at least like the ones that are trying to figure it out are in the stage of doing it in a very sloppy way where you see like open directories with like all of their reconnaissance knowledge and tools and the prompts and all that stuff.

770
00:49:24.305 --> 00:49:26.227
That was the South Korean stuff that happened.

771
00:49:26.247 --> 00:49:35.733
That was an open directory and pop it up in like census or valid in and you can see like literally their entire like lot MD file and everything they've been doing.

772
00:49:35.793 --> 00:49:39.856
So having a tool that documents everything that they're trying to do is pretty cool.

773
00:49:40.496 --> 00:49:42.798
I was actually had to spell it out like Steve was saying last night.

774
00:49:44.180 --> 00:49:45.040
But that's going to change.

775
00:49:45.060 --> 00:49:46.682
You know, these guys are going to figure out like, oh, you know what?

776
00:49:46.702 --> 00:49:50.585
I probably shouldn't put this on a publicly accessible server with an open directory and whatnot.

777
00:49:50.725 --> 00:49:55.850
And then there's the sophisticated actors out there that are already doing this, but know better to like not make those mistakes.

778
00:49:56.410 --> 00:50:00.654
So, yeah, long story short, I think the reconnaissance side is the best, but that's a good answer.

779
00:50:00.814 --> 00:50:13.922
Yeah, the exploitation side is interesting too, because it really started as like a phone apocalypse where like there's tons of vulnerabilities and like, you know, CVs are spiking right now and your iPhone gets like a thousand new updates every day or whatever.

780
00:50:14.822 --> 00:50:19.645
We're starting to now see that shift where, okay, exploitation is now happening faster too.

781
00:50:19.705 --> 00:50:22.467
It's a more recent thing than like the actual discovery itself.

782
00:50:22.927 --> 00:50:24.429
I mean, that's the mythos, right?

783
00:50:24.489 --> 00:50:25.390
And we all knew it was coming.

784
00:50:25.730 --> 00:50:29.574
We all knew that mythos was good at exploitation and that everything else was six months behind it.

785
00:50:29.654 --> 00:50:31.536
And I think it was actually only four months behind it.

786
00:50:31.617 --> 00:50:32.718
Yeah.

787
00:50:32.958 --> 00:50:37.403
My question is, how has AI affected the landscape of malware?

788
00:50:37.843 --> 00:50:45.573
From the diversification and signature diversity standpoint, and also from the malware analysis standpoint, right?

789
00:50:45.653 --> 00:50:54.585
Are those leveling up symmetrically, or is there so much more malware now to RE that you don't have enough smart people and LLMs to deal with it?

790
00:50:55.188 --> 00:51:03.832
Yeah, I wouldn't say that malware itself has really hit its stride with a huge evolution in terms of sophistication because of LLMs.

791
00:51:04.072 --> 00:51:12.156
People are experimenting with it, and it's definitely speeding up the ability for people to generate custom malware based off of certain targets and stuff like that.

792
00:51:13.237 --> 00:51:17.639
So, you know, the old saying of a hash is useless beyond the first time it seems you can regenerate a hash?

793
00:51:17.699 --> 00:51:17.859
Right.

794
00:51:18.139 --> 00:51:20.100
I think it's even more strong now that, like...

795
00:51:20.740 --> 00:51:27.303
you know, hashes and indicators of compromise around malware themselves are, you know, used once and it's kind of burnt at that point.

796
00:51:27.423 --> 00:51:29.504
So I think it's speeding up that process.

797
00:51:29.984 --> 00:51:37.927
But the reversing side and malware analysis side, I think, has evolved to new heights that I'm like super excited about.

798
00:51:38.827 --> 00:51:44.490
You may have seen our research on like Fast 16 and some of the other stuff out there that

799
00:51:45.430 --> 00:51:53.576
More on the malware paleontology side, using these new models to do analysis and reversing on the samples themselves leads us to whole new discoveries.

800
00:51:54.056 --> 00:51:58.479
Especially like FAST-16 being like, was it 25, 6 years old or something like that?

801
00:51:58.499 --> 00:51:59.659
Yeah, it says 2005 sabotage.

802
00:51:59.719 --> 00:52:00.380
Yeah, yeah.

803
00:52:00.840 --> 00:52:04.042
That discovery was just like, it blew our minds.

804
00:52:04.082 --> 00:52:06.264
It's like our favorite thing that we've ever done as a team.

805
00:52:06.584 --> 00:52:14.230
And that was purely because of LLMs helping us find these new things and looking at it in new ways.

806
00:52:14.710 --> 00:52:15.471
But they're not perfect.

807
00:52:17.272 --> 00:52:25.735
Reversing is being automated in a way for us with LLMs, but the real reversing and analysis skills still exist.

808
00:52:25.775 --> 00:52:30.017
But it's still, it's opening a lot more doors for us and whatnot.

809
00:52:30.057 --> 00:52:35.539
And then obviously the detection side, if you're like actually trying to detect this product or write like our rules or SIGs or whatever.

810
00:52:35.559 --> 00:52:39.460
You know, like Steve mentioned yesterday, that's a huge important piece now.

811
00:52:40.060 --> 00:52:41.641
It leans best to like the behavioral side.

812
00:52:42.061 --> 00:52:43.742
The actual malware itself, it's a,

813
00:52:44.322 --> 00:52:47.124
It's a messy game that we're all still trying to figure out at this point.

814
00:52:47.525 --> 00:52:51.728
And I think it's going to lean closer into reversing anything tools that have come out.

815
00:52:51.768 --> 00:52:54.030
I think you guys talked about those recently.

816
00:52:54.711 --> 00:52:56.052
Ah, fan.

817
00:52:56.352 --> 00:52:57.333
Yeah.

818
00:52:57.533 --> 00:52:58.194
I listen to that.

819
00:52:59.855 --> 00:53:09.620
Being able to reverse engineer somebody's really cool malware and make your own version of it, that's going to make attribution and like clustering based off of like what malware is like, it's going to screw it off.

820
00:53:09.640 --> 00:53:12.861
Yeah, so we're in this world where we're hearing a lot about these AI attacks.

821
00:53:12.981 --> 00:53:17.864
And I think in this industry, we've acknowledged that typically defense lags attacking a little bit, right?

822
00:53:17.884 --> 00:53:20.265
We kind of figure out what the attackers are doing and make technology remediate it.

823
00:53:20.645 --> 00:53:26.208
Going into the future long term, and obviously this is a philosophy question, a Tom's take, right?

824
00:53:26.228 --> 00:53:26.428
Yes.

825
00:53:26.988 --> 00:53:30.789
Does AI favor attackers or defenders?

826
00:53:31.069 --> 00:53:33.950
And with that being said, where does this go long term?

827
00:53:34.090 --> 00:53:36.570
Do we make a more secure internet or does everything fall apart?

828
00:53:37.771 --> 00:53:41.771
I think right now we are helping defenders more than attackers.

829
00:53:43.112 --> 00:53:50.914
Being able to vibe code my own toolkits or auto intake, like what's happening in the world right now to make it relevant to our organization.

830
00:53:51.254 --> 00:53:56.475
I think that's so far beating what the benefits are to hackers, I think, today.

831
00:53:57.095 --> 00:54:10.120
I think long term, though, like it totally depends on on how things are going to unfold around the availability of open weight models and restriction of frontier model capabilities and hardware availability.

832
00:54:10.621 --> 00:54:13.482
If we want defenders to continue to have that advantage.

833
00:54:14.222 --> 00:54:16.123
need to give them the capabilities to do it.

834
00:54:16.403 --> 00:54:20.285
You know, every nation state actor out there is building their giant GPU warehouse right now.

835
00:54:20.765 --> 00:54:33.432
If we start limiting defenders, let's say random people from being able to run an open weight model or guardrail them to defend their organization, like you're slowly taking away their capability.

836
00:54:33.932 --> 00:54:37.774
So I think right now we're in a good spot, but over the next...

837
00:54:38.494 --> 00:54:45.700
oh gosh, let's say like a month to two years, it's going to, that changes and decisions we make forward are going to dictate how we go about it.

838
00:54:45.780 --> 00:54:53.947
But for me personally, I've never felt more capable as a researcher or anybody working in the cyber world.

839
00:54:53.967 --> 00:54:59.712
I think there's a lot of fear around like, oh, it's going to take our jobs and it's giving bad guys all the superpowers, but like

840
00:55:00.372 --> 00:55:03.737
I've been building tools that I've dreamed about building for like decades now.

841
00:55:04.458 --> 00:55:09.206
And, you know, things that have cost a lot of money to try and get engineering resources to do and builds.

842
00:55:09.226 --> 00:55:09.987
I'm not a dev guy.

843
00:55:10.007 --> 00:55:14.293
I can go buy above some crappy web app now and it gets what I need done.

844
00:55:14.333 --> 00:55:15.375
And, you know, it's private to me.

845
00:55:15.455 --> 00:55:15.555
And.

846
00:55:16.216 --> 00:55:18.419
And I've never felt more empowered from that perspective.

847
00:55:18.459 --> 00:55:20.962
So I feel very lucky on that side.

848
00:55:21.002 --> 00:55:24.347
But I'm also talking about DGX Sparks and Access to Frontier Labs.

849
00:55:24.367 --> 00:55:26.509
I'm very fortunate on that aspect as well.

850
00:55:26.549 --> 00:55:30.675
Like somebody getting started isn't going to go drop 10 grand on a piece of hardware to run an LLM.

851
00:55:31.595 --> 00:55:32.856
Let alone paying $200 a month.

852
00:55:33.237 --> 00:55:35.158
Nor can a company a lot of the times afford to do that.

853
00:55:35.298 --> 00:55:38.821
Especially the small mom and pop water municipality in Minnesota, for example.

854
00:55:38.901 --> 00:55:39.442
Exactly.

855
00:55:39.562 --> 00:55:40.683
Yeah, so it's interesting.

856
00:55:41.023 --> 00:55:45.887
We can't be waiting for a day or two after the intrusion to get access to Daybreak, for example.

857
00:55:45.927 --> 00:55:48.209
Where does that go with regulations, though, is kind of the question.

858
00:55:48.229 --> 00:55:48.749
Yeah.

859
00:55:48.969 --> 00:55:55.014
And I think a lot of this is going to make us challenge how we think about defense overall.

860
00:55:55.234 --> 00:55:57.937
Because there's the long...

861
00:55:58.577 --> 00:56:05.799
long history of us doing things where it's like antivirus, firewall, general security vendor technology.

862
00:56:06.359 --> 00:56:12.961
I think we now have the capability to use this power to like really overhaul what we look at as like security tooling.

863
00:56:13.361 --> 00:56:25.524
You know, if it's like a whole new way of securing things before they get out, shipped out like PLCs, or if we want to get into like active defense where we start hacking things for defense across our country.

864
00:56:25.844 --> 00:56:27.765
Like these are all possibilities though.

865
00:56:28.446 --> 00:56:41.104
Um, and I think we just need to like challenge the way we look at defense and not, and lean a little bit away from like the vendor categorization and naming and all that stuff and lean into like, how do we actually stop bad guys from doing this?

866
00:56:41.445 --> 00:56:42.326
How do we benefit defenders?

867
00:56:43.167 --> 00:56:43.467
All right.

868
00:56:43.487 --> 00:56:44.428
Thanks for your time, man.

869
00:56:44.468 --> 00:56:45.289
Thanks, guys, for having me.

870
00:56:45.309 --> 00:56:45.609
Awesome.

871
00:56:45.649 --> 00:56:45.990
It was great.

872
00:56:46.030 --> 00:56:46.450
Thank you, man.

873
00:56:46.490 --> 00:56:50.494
We're here with Steve Stone, the chief customer officer of Sentinel One.

874
00:56:50.514 --> 00:56:51.134
Steve, how are we doing?

875
00:56:51.154 --> 00:56:52.235
Are we having an okay week right now?

876
00:56:52.255 --> 00:56:52.936
We're having a great week.

877
00:56:52.976 --> 00:56:53.196
Yeah.

878
00:56:53.316 --> 00:56:53.716
Great week.

879
00:56:53.736 --> 00:56:54.657
Thanks for coming out, guys.

880
00:56:54.677 --> 00:56:56.519
It's awesome to have folks like you here with our event.

881
00:56:56.659 --> 00:56:57.700
So really happy to see everybody.

882
00:56:57.720 --> 00:56:58.160
It's been a good time.

883
00:56:58.180 --> 00:56:58.621
It's been a good time.

884
00:56:58.641 --> 00:56:58.981
Yeah, I know.

885
00:56:59.121 --> 00:57:03.343
Yeah, one of the phrases I keep saying a lot is that zero days are in invisibility cloaks.

886
00:57:03.463 --> 00:57:08.967
And now that zero days are getting cheaper, detections are more and more important than they ever were.

887
00:57:09.247 --> 00:57:13.629
Because once the attacker gets on a system, they still have to behave like an attacker at some point.

888
00:57:13.909 --> 00:57:14.089
Right.

889
00:57:14.610 --> 00:57:17.071
And so if volumes are cheap, detections are more important.

890
00:57:17.311 --> 00:57:17.791
Right.

891
00:57:17.811 --> 00:57:18.632
I agree that completely.

892
00:57:18.872 --> 00:57:21.854
We right before one con, we had our CISO advisory board.

893
00:57:22.134 --> 00:57:23.955
It's our customer advisory board, but it's all CISOs.

894
00:57:24.495 --> 00:57:28.698
And one of the things we spent a lot of time talking about was our experiences with Frontier AI.

895
00:57:28.938 --> 00:57:31.900
Sentinel one, we have access to all the major Frontier AI models.

896
00:57:32.440 --> 00:57:33.821
We use it in a range of ways.

897
00:57:33.841 --> 00:57:37.224
And we have learned an immense amount of things in the last year.

898
00:57:37.304 --> 00:57:38.725
Some things have really surprised us.

899
00:57:39.005 --> 00:57:39.825
Some things haven't.

900
00:57:40.226 --> 00:57:42.067
But very much to your point is that is...

901
00:57:43.198 --> 00:57:49.422
One thing the Frontier models in particular are really good at that I doesn't get enough credit is it can find volumes all day long.

902
00:57:49.922 --> 00:57:51.063
You can read the marketing material.

903
00:57:51.503 --> 00:57:53.525
I don't think that was ever the bottleneck for attackers.

904
00:57:53.605 --> 00:57:55.346
I know that's probably a hot take in the industry right now.

905
00:57:55.386 --> 00:57:55.786
I agree.

906
00:57:56.406 --> 00:58:06.533
But as a defender, we're able to do the exact same thing attackers are using these models for, which is find a very specific attack path that is a high degree of success.

907
00:58:06.653 --> 00:58:09.415
It's able to understand layers and paths that...

908
00:58:10.215 --> 00:58:12.317
That's troubling as defenders.

909
00:58:12.357 --> 00:58:16.400
That's a capability that used to be the remit of high-end government programs.

910
00:58:16.480 --> 00:58:19.442
And now anyone with open AI can go do a lot of that.

911
00:58:20.103 --> 00:58:21.004
Well, we get the same thing.

912
00:58:21.164 --> 00:58:29.470
The frontier models are incredible at saying this is the, let's call it a vulnerability path or an exploit path, but that entire process to get to the end goal.

913
00:58:29.991 --> 00:58:34.174
And it's good at saying, if you pull this one piece out, the whole path collapses.

914
00:58:34.615 --> 00:58:38.157
So now we don't have to remediate a thousand vulnerabilities to be secure.

915
00:58:38.197 --> 00:58:38.498
We can...

916
00:58:38.998 --> 00:58:44.000
do honest high end prioritization and say, I can't fix a thousand things.

917
00:58:44.120 --> 00:58:45.061
I can fix two things.

918
00:58:45.461 --> 00:58:47.602
And now I know the exact right two things.

919
00:58:47.962 --> 00:58:49.543
And I have removed that attack path.

920
00:58:49.583 --> 00:58:51.824
The attacker spent so much time developing.

921
00:58:52.464 --> 00:58:54.645
We've never had a tool that did that before.

922
00:58:54.725 --> 00:58:55.805
And it it's real.

923
00:58:55.845 --> 00:58:56.906
We've seen it with our own eyes.

924
00:58:56.946 --> 00:58:57.166
Yeah.

925
00:58:57.186 --> 00:58:58.506
I completely agree on the bottleneck too.

926
00:58:58.526 --> 00:58:59.367
I say that a lot is, uh,

927
00:59:00.307 --> 00:59:04.068
that the number of vulnerabilities has been going parabolic, right?

928
00:59:04.088 --> 00:59:05.329
We've been seeing that in CVEs.

929
00:59:05.629 --> 00:59:14.972
Then even now kind of lagging exploit code on GitHub or exploit DB or any of these things is also going through the roof because we have models that can help write exploits.

930
00:59:15.332 --> 00:59:19.153
But the number of vulnerabilities that actually get used in data breaches in a year has been flagged.

931
00:59:19.653 --> 00:59:25.396
So it's like, what is that telling us about what's actually happening to your customers or just the industry at large?

932
00:59:25.556 --> 00:59:26.316
We talk about that a lot.

933
00:59:26.376 --> 00:59:27.457
And I want to be upfront.

934
00:59:27.477 --> 00:59:29.538
This is an area where I could very well be wrong on.

935
00:59:29.558 --> 00:59:30.919
We're still very much in the front end of this.

936
00:59:30.979 --> 00:59:37.782
But my position is having a gazillion new vulnerabilities changes almost nothing.

937
00:59:37.902 --> 00:59:41.424
We were behind on vulnerability and exploits as long as I've been doing this.

938
00:59:41.484 --> 00:59:44.565
So what's it matter if we're five behind or 500 behind?

939
00:59:45.046 --> 00:59:45.386
So that...

940
00:59:45.826 --> 00:59:46.447
That's part one.

941
00:59:46.467 --> 00:59:48.528
And part two is I completely agree with what you say.

942
00:59:49.029 --> 00:59:50.910
If we, and we do, we measure this.

943
00:59:50.970 --> 00:59:55.574
We say what actual exploits are being leveraged in AI-driven attacks?

944
00:59:56.063 --> 00:59:58.204
they're almost never new exploits.

945
00:59:58.244 --> 01:00:01.145
They're exploits we've known about for years.

946
01:00:01.305 --> 01:00:08.509
So we're talking about this in one way, and that's not exactly the reality that we are seeing in intrusions.

947
01:00:08.569 --> 01:00:13.591
We're in some ways solving the wrong problems because it looks really good on a conference stage.

948
01:00:13.771 --> 01:00:14.531
And it is amazing.

949
01:00:14.691 --> 01:00:16.512
We found a thousand vulnerabilities in five minutes.

950
01:00:17.253 --> 01:00:17.973
That's cool.

951
01:00:18.413 --> 01:00:20.914
That didn't change the physics of what we have.

952
01:00:21.074 --> 01:00:22.015
And the other part I'll say is,

953
01:00:22.675 --> 01:00:25.556
Here's what has not happened with all this fancy AI talk.

954
01:00:25.936 --> 01:00:27.736
There's not one new technique, not one.

955
01:00:28.177 --> 01:00:31.317
There's not one new methodology we have never seen before.

956
01:00:31.437 --> 01:00:37.959
Now, maybe tomorrow I'll be wrong, but there are sheer physics of how cybersecurity and IT works.

957
01:00:38.619 --> 01:00:39.800
AI doesn't change that.

958
01:00:40.480 --> 01:00:42.500
You can't change the scope of the box.

959
01:00:43.201 --> 01:00:44.121
And we're seeing that.

960
01:00:44.241 --> 01:00:45.981
We're seeing it not change.

961
01:00:46.181 --> 01:00:49.002
So we know what to do in a bunch of ways.

962
01:00:49.462 --> 01:00:51.043
We just got to find new ways to come at it.

963
01:00:51.723 --> 01:00:52.544
That's super interesting.

964
01:00:52.804 --> 01:00:57.847
So the question I was going to ask was like, you know, does, in your opinion, AI favor the attacker or the defender more?

965
01:00:57.947 --> 01:01:01.169
I feel like I've learned the answer you're going to give to that.

966
01:01:01.390 --> 01:01:04.692
And so I think I'm starting to come on your side with that, right?

967
01:01:04.712 --> 01:01:12.537
Where it sounds like from what you're seeing in the data that you have, attackers aren't doing much differently with AI at this point.

968
01:01:12.617 --> 01:01:14.058
Like, you know, obviously we are finding more bugs.

969
01:01:14.078 --> 01:01:18.061
That's like a big thing on Twitter and all like the kind of the infosec like software security spaces.

970
01:01:18.361 --> 01:01:26.646
But from an actual operationalization of offensive AI, we're not seeing a ton of new fancy doom and gloom type technology.

971
01:01:26.766 --> 01:01:27.086
Correct.

972
01:01:27.286 --> 01:01:31.629
We are not seeing like, you know, the ghost come out of nowhere that no one's ever even heard of.

973
01:01:31.669 --> 01:01:33.510
And we don't have a model or a concept for it.

974
01:01:33.530 --> 01:01:35.612
Like that's happened exactly zero times.

975
01:01:35.692 --> 01:01:35.872
Yeah.

976
01:01:36.252 --> 01:01:40.414
Now, so here's where I see AI deeply benefiting attackers.

977
01:01:40.994 --> 01:01:44.355
And then I'll kind of talk about why I think that's important and then answer your actual question.

978
01:01:44.375 --> 01:01:45.116
Sure, sure.

979
01:01:45.876 --> 01:01:51.238
I think AI, the biggest thing that AI is giving attackers is speed and scale.

980
01:01:51.538 --> 01:01:52.259
And that's hard.

981
01:01:52.599 --> 01:01:56.921
Speed and scale is, as a cybersecurity vendor, we understand speed and scale.

982
01:01:57.381 --> 01:01:58.701
It is really difficult.

983
01:01:58.941 --> 01:01:59.782
It requires...

984
01:02:00.562 --> 01:02:01.763
Thousands of experts.

985
01:02:01.803 --> 01:02:03.826
It requires constant R&D.

986
01:02:04.346 --> 01:02:07.049
And that used to be the remit of big government programs.

987
01:02:07.109 --> 01:02:14.937
We used to differentiate the threat landscape, not just on a particular piece of code, but it's like this threat group can crank out code all day long.

988
01:02:14.997 --> 01:02:19.282
They can understand and synthesize stolen data.

989
01:02:19.362 --> 01:02:20.923
They can do all these things.

990
01:02:21.424 --> 01:02:23.585
Well, now an individual can do that.

991
01:02:24.105 --> 01:02:27.347
It has raised the floor in dramatic ways.

992
01:02:27.908 --> 01:02:34.371
And then the other thing it's done, and it's very much in that same vein, it's given capabilities that used to belong to very few.

993
01:02:34.451 --> 01:02:36.712
And the example I always use is language.

994
01:02:37.013 --> 01:02:38.293
And I don't mean coding languages.

995
01:02:38.313 --> 01:02:40.294
I mean written, spoken languages.

996
01:02:40.875 --> 01:02:41.095
Okay.

997
01:02:41.875 --> 01:02:46.496
The very first Iranian event I ever worked in my career, we were actually chasing a Chinese group.

998
01:02:46.976 --> 01:02:49.437
And we also found an Iranian group in the exact same environment.

999
01:02:49.757 --> 01:02:55.158
And ironically, the Iranian group actually had better technical access, but they couldn't read English.

1000
01:02:55.738 --> 01:03:02.640
And they essentially wasted the intrusion where the Chinese group maximized their access because they could understand.

1001
01:03:03.020 --> 01:03:04.420
They could identify the right file.

1002
01:03:04.480 --> 01:03:05.000
It was language.

1003
01:03:05.040 --> 01:03:06.560
It was just they could literally read.

1004
01:03:06.900 --> 01:03:09.001
And that sounds simple, but it is.

1005
01:03:10.030 --> 01:03:11.791
AI solved the language problem for everybody.

1006
01:03:12.331 --> 01:03:15.973
And it's now a capability that used to belong to linguists.

1007
01:03:16.093 --> 01:03:21.256
And you, you got to spend years training someone to speak Arabic and Mandarin and, you know, just go down the list.

1008
01:03:21.736 --> 01:03:23.077
And now you do it with two tokens.

1009
01:03:23.437 --> 01:03:26.199
That, that is a massive shift for the attackers.

1010
01:03:26.639 --> 01:03:30.141
So I think those things really helped them on our end.

1011
01:03:31.168 --> 01:03:33.509
We don't have to worry so much about all the languages.

1012
01:03:33.569 --> 01:03:34.529
It makes it complicated.

1013
01:03:34.569 --> 01:03:37.349
It makes it more effective with phishing and some of those things.

1014
01:03:37.670 --> 01:03:39.350
But we're back to the physics of an intrusion.

1015
01:03:40.170 --> 01:03:41.790
The physics of the intrusion have not changed for us.

1016
01:03:41.951 --> 01:03:44.251
And AI has allowed us to move faster through that.

1017
01:03:44.751 --> 01:03:49.292
It's allowed us to understand environments much quicker than we could before.

1018
01:03:49.312 --> 01:03:50.252
And that's half the battle.

1019
01:03:50.292 --> 01:03:52.853
That is, in my opinion, at least half the battle.

1020
01:03:53.393 --> 01:03:56.354
And it's allowed us to move at a speed as well.

1021
01:03:56.854 --> 01:04:00.295
And I think that's been probably the biggest limitation in cybersecurity.

1022
01:04:01.275 --> 01:04:04.918
The hand on our scale, I think, is pushing that scale down farther.

1023
01:04:05.058 --> 01:04:06.079
And the attackers are benefiting.

1024
01:04:06.119 --> 01:04:07.480
I do not want to say they're not.

1025
01:04:08.161 --> 01:04:11.544
But the capabilities it's delivering to them weren't their limitations.

1026
01:04:11.564 --> 01:04:13.346
And I'll go back to the vulnerability example.

1027
01:04:13.726 --> 01:04:14.507
That was never the issue.

1028
01:04:14.847 --> 01:04:16.588
That was never the problem for attackers.

1029
01:04:16.829 --> 01:04:18.130
So they can do it way better.

1030
01:04:18.470 --> 01:04:18.750
Awesome.

1031
01:04:18.990 --> 01:04:19.251
Cool.

1032
01:04:19.671 --> 01:04:20.632
It didn't move the needle for them.

1033
01:04:20.892 --> 01:04:35.175
Yeah, I love the use of the word cyber physics that that is one of my favorite terms in this industry, because it's it's a fun way of normalizing a lot of the verbiage we're going to throw around all over the place where it's ultimately like only a set of things can happen on a target.

1034
01:04:35.275 --> 01:04:35.395
Right.

1035
01:04:35.415 --> 01:04:39.396
And if we define things around that set of words, it helps normalize our conversations.

1036
01:04:39.756 --> 01:04:45.877
And so on that, I think what you're also saying is that, you know, they may be able to move at a faster speed and scale.

1037
01:04:50.818 --> 01:05:12.945
it's not effective correct there's just so many there's so many paths in there's so many options there's so many toggles and that hasn't that has not changed yeah um so in order for your customers to meet the actual change which is speed and scale right uh their security programs need to look like the security programs that we've been trying to get

1038
01:05:13.865 --> 01:05:15.406
you know, the industry to build forever.

1039
01:05:15.726 --> 01:05:16.127
Absolutely.

1040
01:05:16.147 --> 01:05:17.568
On steroids, right.

1041
01:05:17.728 --> 01:05:23.111
Is now there's, there's a whole lot less leeway on the speed that we've been trying to get everyone to move.

1042
01:05:23.351 --> 01:05:23.572
Right.

1043
01:05:23.972 --> 01:05:29.396
So you being the, you know, one of the main customer facing people at Sentinel one,

1044
01:05:30.076 --> 01:05:40.765
Like what percentage of the customer base, or you don't have to give an exact percentage, but just like your experience around your customers are actually kind of doing the whole AI adoption thing.

1045
01:05:41.365 --> 01:05:48.131
The more I go out in the industry, the more I'm kind of nervous because a lot of people made up their mind about AI too long ago, right?

1046
01:05:48.151 --> 01:05:52.895
They tried ChatGPT a year and a half ago, .com, right?

1047
01:05:53.075 --> 01:05:58.680
Never really got into the cloud code, the agent space, whatever, kind of made up their mind about its capabilities.

1048
01:05:58.700 --> 01:05:59.080
Yeah.

1049
01:05:59.380 --> 01:06:04.142
and are now maybe waking up to like, oh, you know, this is going too fast.

1050
01:06:04.582 --> 01:06:07.283
I've also just been talking to people that are allergic to it.

1051
01:06:07.603 --> 01:06:10.124
They don't want AI agents touching prod.

1052
01:06:10.545 --> 01:06:12.906
You know, they don't want a whole bunch of things.

1053
01:06:13.266 --> 01:06:22.409
And I'm nervous that people that have been allergic to it or made up their mind too long ago aren't going to be able to meet that speed challenge without leveraging the good parts of this technology.

1054
01:06:22.569 --> 01:06:23.230
Are you seeing that?

1055
01:06:23.310 --> 01:06:24.070
Can you talk about that?

1056
01:06:24.130 --> 01:06:25.291
Yeah, yeah, yeah.

1057
01:06:25.451 --> 01:06:25.911
What's going on?

1058
01:06:26.111 --> 01:06:28.132
Yeah, I'll give you an example, and let me give you, like,

1059
01:06:28.852 --> 01:06:35.794
The kind of the two big things that keep me awake at night when we think about the totality of organizations on the operational defender side.

1060
01:06:36.474 --> 01:06:38.455
The first example I would give is very much to your point.

1061
01:06:38.615 --> 01:06:44.497
We have customers asking us contractually to guarantee AI will not be used in their environment.

1062
01:06:44.537 --> 01:06:45.837
We can't do that Sentinel one.

1063
01:06:46.318 --> 01:06:47.798
AI is in our DNA.

1064
01:06:47.958 --> 01:06:50.279
So we've never had people ask that before.

1065
01:06:50.379 --> 01:06:51.859
We didn't start using AI last year.

1066
01:06:51.879 --> 01:06:53.100
We've been using it for 12 years.

1067
01:06:53.900 --> 01:06:58.943
That was not a contract challenge we had before essentially the last 12 months.

1068
01:06:59.363 --> 01:07:10.870
And that's essentially an organization saying, for whatever reason, we are going to intentionally exclude a really powerful tool for securing our organization.

1069
01:07:11.350 --> 01:07:12.191
That's a hard problem.

1070
01:07:12.251 --> 01:07:13.771
Like, we can't solve that.

1071
01:07:13.912 --> 01:07:15.472
That's a decision.

1072
01:07:15.853 --> 01:07:16.893
And that's a decision they get to make.

1073
01:07:17.494 --> 01:07:19.475
And maybe they'll be correct down the road, but we don't.

1074
01:07:19.915 --> 01:07:20.955
We just approach it a different way.

1075
01:07:21.475 --> 01:07:23.156
So I see two big concerns.

1076
01:07:23.976 --> 01:07:38.381
One, I think there's going to be, and I think we're already seeing this, there's a rapid delta between organizations that understand AI and are using it smartly and organizations that don't, whether they're not using it, they've got inefficient models, they're using it for the wrong reasons.

1077
01:07:39.081 --> 01:07:39.261
And...

1078
01:07:40.181 --> 01:07:45.343
That level of effort that it takes, I think, to be a great organization using AI, that's a high bar right now.

1079
01:07:45.423 --> 01:07:48.003
That's not accessible to mom and pop trucking company.

1080
01:07:48.363 --> 01:07:50.524
They do not have the resources to do that well.

1081
01:07:51.124 --> 01:07:53.565
And that delta is getting bigger every single day.

1082
01:07:53.665 --> 01:07:58.186
That is, AI has just taken that traditional problem and thrown gas on that fire.

1083
01:07:58.746 --> 01:07:59.867
That delta concerns me.

1084
01:08:00.327 --> 01:08:03.808
I think we will see, if we fast forward five years...

1085
01:08:04.528 --> 01:08:08.732
two completely different classes of organizations, and it's going to be hard to catch up at that point.

1086
01:08:08.972 --> 01:08:10.794
So I think that's big concern number one.

1087
01:08:11.594 --> 01:08:17.079
Big concern number two, people tend to approach AI as we interact with them.

1088
01:08:17.499 --> 01:08:18.600
They want to go to the high end.

1089
01:08:18.620 --> 01:08:19.641
They want to go to Frontier.

1090
01:08:19.661 --> 01:08:19.761
They

1091
01:08:21.803 --> 01:08:24.384
Let me tell you a problem I've never had in my career before, but I have now.

1092
01:08:24.984 --> 01:08:31.166
For the first time in my career, we have CISOs and CIOs coming to us and saying, I have to use Frontier AI.

1093
01:08:31.186 --> 01:08:32.246
My board told me to.

1094
01:08:32.766 --> 01:08:34.067
I've never heard that before.

1095
01:08:34.127 --> 01:08:36.887
I've never heard a board say, you better use MFA.

1096
01:08:37.107 --> 01:08:38.568
You better, like, build a board.

1097
01:08:38.628 --> 01:08:39.808
It's never happened.

1098
01:08:39.948 --> 01:08:41.109
It's been the other direction.

1099
01:08:41.569 --> 01:08:43.949
So there's this race to go to the high end.

1100
01:08:44.490 --> 01:08:45.310
And that high end is...

1101
01:08:45.890 --> 01:08:47.231
Highly expensive to begin with.

1102
01:08:47.331 --> 01:08:50.013
It's not sustainable for most organizations.

1103
01:08:50.634 --> 01:08:52.936
It's difficult to deploy and understand.

1104
01:08:52.996 --> 01:08:56.139
And if you use it in the wrong way, you can actually do some real damage.

1105
01:08:56.499 --> 01:08:59.701
And the third part is it's a risk generating machine.

1106
01:08:59.822 --> 01:09:04.746
If you point a frontier AI model at a code repo, you're going to get findings.

1107
01:09:04.766 --> 01:09:05.206
Yeah.

1108
01:09:05.266 --> 01:09:07.788
you may not be prepared to synthesize that down.

1109
01:09:07.888 --> 01:09:16.275
And now you've got a document that says you are now legally obligated to fix all of these things and you're not qualified to understand that document.

1110
01:09:16.375 --> 01:09:18.017
We see that happen all the time.

1111
01:09:18.057 --> 01:09:18.537
That's wild.

1112
01:09:18.677 --> 01:09:23.882
So we actually see organizations taking a step back with the best of intentions

1113
01:09:24.362 --> 01:09:26.443
where we would openly advocate for the opposite.

1114
01:09:26.603 --> 01:09:29.204
Start with, we're back to what can we do with automation?

1115
01:09:29.584 --> 01:09:31.004
What can we do with basic LLMs?

1116
01:09:31.224 --> 01:09:32.705
That's very cost sustainable.

1117
01:09:32.745 --> 01:09:33.945
It's very reliable.

1118
01:09:34.085 --> 01:09:35.566
It's very high efficacy.

1119
01:09:36.066 --> 01:09:39.827
Now let's move into open-weight models, and let's start moving up the stack.

1120
01:09:40.227 --> 01:09:42.028
And the example I would give here at SentinelOne,

1121
01:09:42.748 --> 01:09:44.210
We AI is not new to us.

1122
01:09:44.250 --> 01:09:47.574
I keep saying that, but like it really we've been in the space from the beginning.

1123
01:09:47.654 --> 01:09:49.737
We have lots of AI experts.

1124
01:09:49.757 --> 01:09:51.900
We have multiple AI teams.

1125
01:09:51.960 --> 01:09:52.621
We sell it.

1126
01:09:52.741 --> 01:09:53.402
We use it.

1127
01:09:53.802 --> 01:09:57.928
We provide I and AI to every one of our employees for their daily use.

1128
01:09:57.948 --> 01:10:00.371
There's nothing we do that does not use AI.

1129
01:10:01.452 --> 01:10:10.858
And we run into limitations because the models are changing so fast and the cost requirements, we're having to constantly evaluate models and swap them out.

1130
01:10:11.018 --> 01:10:14.560
The multi-model is the only way we believe it can be effective.

1131
01:10:15.341 --> 01:10:16.722
That's a rare skill set.

1132
01:10:17.122 --> 01:10:19.543
Harness builders, most people don't have a bunch of harness builders.

1133
01:10:19.964 --> 01:10:25.027
They don't have people that can effectively measure models, especially against a specific workflow.

1134
01:10:25.547 --> 01:10:26.728
That's grown up work.

1135
01:10:26.748 --> 01:10:27.928
This hasn't existed.

1136
01:10:27.948 --> 01:10:29.589
This hasn't existed 12 months, right?

1137
01:10:29.669 --> 01:10:36.013
I mean, even new tools like JEV that just came out that is super cost efficient and fast to do model picking.

1138
01:10:36.033 --> 01:10:37.233
They've only been out weeks.

1139
01:10:37.714 --> 01:10:38.134
You know what I mean?

1140
01:10:38.154 --> 01:10:41.476
It's like, yeah, how could you possibly hire people that have experience doing this?

1141
01:10:41.516 --> 01:10:43.056
Yeah, exactly.

1142
01:10:43.437 --> 01:10:45.718
We have access to the main frontier models.

1143
01:10:46.298 --> 01:10:49.300
We took two different models that came out within a week of each other.

1144
01:10:49.820 --> 01:10:52.062
We pointed them at the exact same code repo.

1145
01:10:52.482 --> 01:10:54.263
We gave it the exact same commands.

1146
01:10:54.744 --> 01:10:57.946
We only had a 30% overlap in findings.

1147
01:10:58.106 --> 01:10:59.948
70% of the findings were unique to one of the models.

1148
01:11:00.488 --> 01:11:10.236
So now, not only do we have to deal with the findings, we now have to go study these models and understand and then eventually make decisions on which one we use for what purpose.

1149
01:11:10.276 --> 01:11:10.997
Right.

1150
01:11:11.677 --> 01:11:15.018
There are not a lot of people walking around that are qualified to do that work.

1151
01:11:15.139 --> 01:11:20.241
And if we are struggling with that as a native AI cybersecurity vendor, we're in the ivory tower.

1152
01:11:20.281 --> 01:11:21.381
Like, let's not be cute.

1153
01:11:21.841 --> 01:11:23.762
We have the budgets to do these things.

1154
01:11:24.082 --> 01:11:28.964
If this is hard for us, it's got to be impossible for 90% of the organizations.

1155
01:11:29.024 --> 01:11:29.825
And that concerns me.

1156
01:11:29.925 --> 01:11:31.406
Like, we have to solve that.

1157
01:11:31.526 --> 01:11:34.727
We have to find a way to solve that for mom and pop trucking company.

1158
01:11:34.947 --> 01:11:40.612
I'm going to quote you for the rest of my life now that I've never heard of a board mandating MFA.

1159
01:11:40.632 --> 01:11:42.213
It's such a good point.

1160
01:11:42.293 --> 01:11:46.476
I've never heard of a frontier model stopping a data breach yet.

1161
01:11:46.636 --> 01:11:47.177
You know what I mean?

1162
01:11:47.217 --> 01:11:48.918
Maybe they have, but you know what I mean?

1163
01:11:49.259 --> 01:11:52.761
But MFA would have stopped so many data breaches and yet...

1164
01:11:53.662 --> 01:11:59.428
Because of the hype and the headlines and everything, you've got the ear of the board saying, are you using Daybreak?

1165
01:11:59.489 --> 01:12:00.349
Are you using Mythos?

1166
01:12:00.790 --> 01:12:01.491
I read about Mythos.

1167
01:12:01.551 --> 01:12:04.574
I'm getting asked about Mythos at my daughter's soccer games, right?

1168
01:12:04.594 --> 01:12:07.337
I mean, we are fully out of the echo chamber here.

1169
01:12:07.838 --> 01:12:09.219
I was referred to like the mom test.

1170
01:12:09.940 --> 01:12:12.883
I grew up in the Midwest, great Midwestern family.

1171
01:12:13.284 --> 01:12:14.906
My mom knows nothing about technology.

1172
01:12:15.426 --> 01:12:19.129
She has asked me almost nothing about what I do for 25 years.

1173
01:12:19.250 --> 01:12:20.170
I get asked about AI.

1174
01:12:20.771 --> 01:12:22.913
I did an interview with the Reader's Digest on AI.

1175
01:12:22.993 --> 01:12:24.654
Like, what are we talking about?

1176
01:12:24.674 --> 01:12:25.255
That's amazing.

1177
01:12:25.295 --> 01:12:27.257
But that wasn't happening six months ago.

1178
01:12:27.297 --> 01:12:29.239
Like, this is the world we live in.

1179
01:12:29.259 --> 01:12:29.999
And I...

1180
01:12:30.920 --> 01:12:36.024
At this point, I'm not sure we have enough of the right experts to institutionalize it at the scale we need to.

1181
01:12:36.044 --> 01:12:37.665
And that's a hard problem.

1182
01:12:37.745 --> 01:12:38.946
I'm really concerned about that.

1183
01:12:39.046 --> 01:12:40.027
And we have to solve it now.

1184
01:12:40.227 --> 01:12:40.707
Really good point.

1185
01:12:40.868 --> 01:12:43.470
Do you have anything we haven't covered that you'd love to get out?

1186
01:12:43.650 --> 01:12:46.312
Like, you know, exciting stuff this week at OneCon.

1187
01:12:46.332 --> 01:12:48.453
Exciting stuff that you're looking at to 2027.

1188
01:12:49.374 --> 01:12:50.875
Really excited to work on here?

1189
01:12:51.215 --> 01:12:53.637
Yeah, I would say the one thing I would leave.

1190
01:12:53.757 --> 01:12:55.459
And I'll kind of keep beating this AI drum.

1191
01:12:55.499 --> 01:12:56.259
It's so hard to not.

1192
01:12:56.459 --> 01:12:57.700
Yeah, put a dollar in the jar.

1193
01:12:59.422 --> 01:12:59.782
I think.

1194
01:13:01.260 --> 01:13:06.985
The things that we are bad at in cybersecurity before AI are all now all caps challenges.

1195
01:13:07.005 --> 01:13:08.326
And I'll pick two as an example.

1196
01:13:08.927 --> 01:13:13.291
I think the industry and organizations have universally struggled with identity.

1197
01:13:13.531 --> 01:13:13.892
Identity.

1198
01:13:14.232 --> 01:13:14.392
Yeah.

1199
01:13:14.412 --> 01:13:19.637
And like now with AI, like the number and types of identity, it's off the charts.

1200
01:13:19.697 --> 01:13:19.817
Yeah.

1201
01:13:19.957 --> 01:13:24.538
We were awful at that day in and day out as a whole industry before.

1202
01:13:24.978 --> 01:13:26.539
We didn't get better at it with AI.

1203
01:13:26.739 --> 01:13:27.699
So we need to solve it.

1204
01:13:27.899 --> 01:13:30.119
And AI is going to actually help us solve that a lot.

1205
01:13:30.579 --> 01:13:31.960
And the other is data security.

1206
01:13:32.180 --> 01:13:34.921
And I'll go back to like, I talk with CISOs and CIOs all day.

1207
01:13:34.961 --> 01:13:36.221
That's part of what I do.

1208
01:13:36.881 --> 01:13:40.062
If I walk in and talk to a CISO and say, how many endpoints do you have?

1209
01:13:40.522 --> 01:13:41.442
That CISO can tell me that.

1210
01:13:41.642 --> 01:13:42.982
Plus or minus probably 2%.

1211
01:13:43.462 --> 01:13:45.983
If I say, how many cloud instances do you have?

1212
01:13:46.323 --> 01:13:48.644
They'll have a pretty good idea, but they can be ephemeral.

1213
01:13:48.664 --> 01:13:49.544
There's a little give there.

1214
01:13:50.585 --> 01:13:57.109
If I ask how much data are you securing and how much of it is critical or regulated, the room gets real quiet.

1215
01:13:57.510 --> 01:14:00.772
And AI is powered by the most data you can put in front of it.

1216
01:14:01.032 --> 01:14:07.597
So we have these two historical widowmaker problems that were always on the top of the list.

1217
01:14:07.757 --> 01:14:15.063
And I think we have to just ruthlessly focus on these things that kind of sound boring because these will be the things.

1218
01:14:15.103 --> 01:14:17.745
If we don't solve these now, we will never catch up.

1219
01:14:19.506 --> 01:14:20.566
This is what the attackers want.

1220
01:14:21.286 --> 01:14:23.427
Always and nevers are dangerous in the threat business.

1221
01:14:23.887 --> 01:14:27.748
I have never worked an intrusion that did not use illicit valid access.

1222
01:14:27.988 --> 01:14:28.368
Not one.

1223
01:14:28.588 --> 01:14:30.769
There's always a race to become a valid user.

1224
01:14:31.369 --> 01:14:34.370
We just made that far more difficult to secure.

1225
01:14:34.850 --> 01:14:42.752
And the end goal is access data, to steal it, to manipulate it, to lock it, fill in the blank, to understand it and change world events.

1226
01:14:42.772 --> 01:14:43.432
Yeah.

1227
01:14:43.512 --> 01:14:47.794
We just doubled that pile that we couldn't suss through as an industry before.

1228
01:14:48.274 --> 01:14:52.356
So it's so tempting to race to innovation.

1229
01:14:52.376 --> 01:14:54.117
And I think we actually have to do the opposite.

1230
01:14:54.137 --> 01:14:55.638
We have to race to fundamentals.

1231
01:14:56.018 --> 01:14:57.559
And this technology will help us do that.

1232
01:14:57.719 --> 01:14:59.560
It can really help us solve these problems.

1233
01:14:59.940 --> 01:15:25.304
steve stone thank you for your time thanks for having me a lot of fun awesome good times we are at set in the ones one con with the current winner the world champion of threat hunting they just won the world tournament for threat hunting at one con jason how we doing man doing good yeah i'm playing how do you feel has the has the adrenaline from winning a ctf purge from your body yet are you relaxed i think the sign for that is starting to get hungry again and i'm not there

1234
01:15:25.504 --> 01:15:26.606
Okay, so no, not yet.

1235
01:15:26.707 --> 01:15:27.127
Very cool.

1236
01:15:27.608 --> 01:15:28.570
Well, man, tell us about yourself.

1237
01:15:28.610 --> 01:15:30.134
So, you know, you just won the CTF.

1238
01:15:30.314 --> 01:15:33.380
I guess my question for you is like, how long have you been in cybersecurity?

1239
01:15:33.400 --> 01:15:35.244
And have you been like a CTF for a long time?

1240
01:15:35.264 --> 01:15:36.086
How did you kind of get into this?

1241
01:15:36.459 --> 01:15:39.760
So I'll go back to when I kind of started going towards cybersecurity.

1242
01:15:39.820 --> 01:15:40.580
It was COVID.

1243
01:15:40.680 --> 01:15:44.381
I was doing graphic design previously, but I didn't really find my...

1244
01:15:44.861 --> 01:15:45.821
There was like no passion in it.

1245
01:15:45.841 --> 01:15:46.742
It was mostly just a job.

1246
01:15:47.142 --> 01:15:51.643
So I went to community college, started in like IT, but eventually found like a cybersecurity program there.

1247
01:15:51.903 --> 01:15:58.945
Founded a pool, went down it, eventually found myself in a SOC role, another SOC role, and now I'm doing protection and response stuff at a SaaS company.

1248
01:15:58.985 --> 01:16:00.045
So that's where I am.

1249
01:16:00.445 --> 01:16:01.025
That's awesome.

1250
01:16:01.125 --> 01:16:07.227
I've been doing CTF stuff for the past two years or so in the downtime, doing it with my team and some other friends.

1251
01:16:07.487 --> 01:16:07.727
Nice.

1252
01:16:07.787 --> 01:16:08.267
That's awesome.

1253
01:16:08.547 --> 01:16:12.288
And so CTF, I think, kind of covers a wide variety of content, right?

1254
01:16:12.308 --> 01:16:15.429
So you have CTFs that are like, oh, ponables, or like, oh, recon challenges.

1255
01:16:15.549 --> 01:16:20.711
Was this CTF similar to ones you've done in the past, or kind of unique in the way that it's like a threat hunting CTF?

1256
01:16:20.945 --> 01:16:23.586
So I spend, I don't do a ton of red teaming CTFs.

1257
01:16:23.686 --> 01:16:30.388
I'm definitely more like forensics, some crypto, mostly MISC, just mostly defensive stuff for sure.

1258
01:16:30.468 --> 01:16:31.489
So this like lined up perfectly.

1259
01:16:31.509 --> 01:16:32.729
It's like what I do.

1260
01:16:32.909 --> 01:16:33.389
Okay, awesome.

1261
01:16:33.469 --> 01:16:36.751
And so at your current company, this is generally in the same wheelhouse as like your day-to-day.

1262
01:16:36.831 --> 01:16:37.211
Exactly.

1263
01:16:37.431 --> 01:16:37.991
That's awesome.

1264
01:16:38.651 --> 01:16:43.315
Can you explain a little bit about how this one ran with like the regional versus today?

1265
01:16:43.375 --> 01:16:45.816
Obviously, we just, you know, got off stage for the audience.

1266
01:16:45.876 --> 01:16:49.199
We just were in like the big keynote room here at OneCon.

1267
01:16:49.239 --> 01:16:54.342
You're on stage in front of hundreds of people, live competing for half an hour, finding all these flags.

1268
01:16:54.362 --> 01:16:58.505
But it seems like you've competed in a few regionals, at least one to get here.

1269
01:16:58.545 --> 01:17:01.067
Can you kind of explain the process of how you got here?

1270
01:17:01.367 --> 01:17:03.508
Yeah, absolutely.

1271
01:17:03.528 --> 01:17:09.410
So there's a few rounds of qualifiers before you then have to make it to the regional finals.

1272
01:17:09.510 --> 01:17:15.591
The qualifiers you can compete in up to, but pretty much everyone does all four different qualifiers.

1273
01:17:15.611 --> 01:17:21.213
They're kind of a similar style, like a 30-minute capture the flag in the same threat ops thing you saw on stage.

1274
01:17:22.634 --> 01:17:24.934
They're the four different qualifiers.

1275
01:17:24.974 --> 01:17:29.936
You work towards your communal points, and they're

1276
01:17:30.436 --> 01:17:31.657
four different categories.

1277
01:17:31.777 --> 01:17:39.424
There's endpoints, there's cloud, there's AI security, and then there's their purple AI agentic STEM thing.

1278
01:17:40.585 --> 01:17:50.675
So once all four of those qualifiers were done, they tallied up everyone's points, and the top 100, I believe, from each region there was a cutoff that got invited to a regional finals.

1279
01:17:51.235 --> 01:17:53.377
That was, again, a similar...

1280
01:17:54.458 --> 01:17:58.859
Same Throne Ops portal, except it was very similar to what happened today.

1281
01:17:59.259 --> 01:18:02.440
They had all four of the different categories combined together.

1282
01:18:02.860 --> 01:18:12.022
And then the winner of that regional finals was me, Jody, and John Paul, who got flown here to compete in the World Championship.

1283
01:18:12.542 --> 01:18:12.842
Awesome.

1284
01:18:13.002 --> 01:18:13.282
Awesome.

1285
01:18:13.582 --> 01:18:14.803
And let me check my notes here.

1286
01:18:15.203 --> 01:18:20.544
I saw a slide on screen that you got 97% of your flags in your qualifying rounds.

1287
01:18:20.604 --> 01:18:21.724
Is that accurate?

1288
01:18:21.904 --> 01:18:24.005
I'm very hesitant to put in a wrong answer.

1289
01:18:24.945 --> 01:18:25.265
Nice.

1290
01:18:25.706 --> 01:18:26.406
I like that.

1291
01:18:26.506 --> 01:18:27.666
He's very sure of himself.

1292
01:18:27.806 --> 01:18:29.607
I feel like that worked out today, too.

1293
01:18:29.827 --> 01:18:30.908
Yeah.

1294
01:18:31.268 --> 01:18:40.031
So for the crowd who didn't get to watch it, it seemed like there was easy flags, about 100 points, all the way up to fiendish, which was 1,000 points.

1295
01:18:40.091 --> 01:18:42.432
What was the most points you got in a single flag?

1296
01:18:43.243 --> 01:18:44.864
I think today was 500.

1297
01:18:44.924 --> 01:18:45.264
Nice.

1298
01:18:45.284 --> 01:18:47.686
I didn't go for any of the finish.

1299
01:18:47.706 --> 01:18:51.068
I looked at them, and I knew that they were going to take at least like five or ten minutes.

1300
01:18:52.589 --> 01:19:04.616
Some of the intricacies of the Sentinel Run portal I'm not super familiar with, so if I wasn't sure I could go find it, especially with those finish, I was like, I'll come back to that later if I somehow finish all of the other 20 questions or something.

1301
01:19:05.277 --> 01:19:06.498
I kind of knew I wouldn't get to them.

1302
01:19:06.598 --> 01:19:07.658
Yeah, yeah, that makes sense.

1303
01:19:07.678 --> 01:19:10.240
I was just hoping the other contestants weren't getting to them.

1304
01:19:10.400 --> 01:19:21.665
Yeah, I think Ryan, the MC, said one of the fiendish was like a 30 line or 30 parameter query on their platform that someone who works at Sentinel One, it took them five minutes to write, like five whole minutes.

1305
01:19:21.965 --> 01:19:26.748
So someone new to the platform, not necessarily doing this every day, I probably wouldn't spend the 10 minutes on that.

1306
01:19:26.788 --> 01:19:27.468
I'm glad I didn't.

1307
01:19:27.608 --> 01:19:28.289
Yeah, exactly.

1308
01:19:28.329 --> 01:19:28.689
For sure.

1309
01:19:28.810 --> 01:19:38.602
Yeah, it seemed like maybe one of the other ones was more of a data aggregation, like you would have had to pull a lot of data out and then compile it like out of the contest and actually do it like add some numbers up and all sorts of stuff.

1310
01:19:38.622 --> 01:19:42.086
And it's like, okay, are we popping calc exe in this ETF area?

1311
01:19:42.106 --> 01:19:42.407
Yeah.

1312
01:19:43.431 --> 01:19:43.692
Cool.

1313
01:19:43.872 --> 01:19:44.072
Yeah.

1314
01:19:44.652 --> 01:19:44.793
Yeah.

1315
01:19:44.813 --> 01:19:45.793
So what was your favorite category?

1316
01:19:45.813 --> 01:19:52.058
I mean, we had the four, we had the what endpoint, the cloud ops, the AI operations, and then I think automated stock, right?

1317
01:19:52.078 --> 01:19:59.284
And what was kind of like your, I think the go to for most people started as endpoint, which makes sense, because that's kind of where, you know, we're all kind of native on the endpoint.

1318
01:19:59.504 --> 01:20:02.207
But other than endpoint, what was kind of your go to after that?

1319
01:20:02.247 --> 01:20:02.567
And why?

1320
01:20:03.206 --> 01:20:07.711
Definitely cloud, just because I'm more familiar in that area.

1321
01:20:08.112 --> 01:20:10.054
Where I work, we don't use that cloud function.

1322
01:20:10.174 --> 01:20:11.715
We only really use the endpoint one.

1323
01:20:11.755 --> 01:20:18.182
And so most of my experience in that cloud portal has been from the other qualifiers and from last year's qualifiers as well.

1324
01:20:18.202 --> 01:20:18.322
Yeah.

1325
01:20:19.579 --> 01:20:20.720
I just felt more comfortable with it.

1326
01:20:20.840 --> 01:20:21.040
Sure.

1327
01:20:21.060 --> 01:20:21.560
That makes sense.

1328
01:20:21.640 --> 01:20:21.840
Yeah.

1329
01:20:21.980 --> 01:20:22.320
Go to work.

1330
01:20:22.340 --> 01:20:23.221
Go to where you know what you're doing.

1331
01:20:23.421 --> 01:20:26.582
I think I did see, you know, you said you're hesitant to submit flags.

1332
01:20:26.602 --> 01:20:28.903
I think you did get dinged on one today.

1333
01:20:28.983 --> 01:20:33.845
So for the, how the scoring system worked was you get 20%, right?

1334
01:20:34.045 --> 01:20:35.766
And was that a fiendish that you tried?

1335
01:20:35.946 --> 01:20:36.566
I don't think so.

1336
01:20:36.787 --> 01:20:37.467
Okay.

1337
01:20:37.907 --> 01:20:38.487
Yeah.

1338
01:20:38.707 --> 01:20:39.028
Okay.

1339
01:20:39.148 --> 01:20:40.028
And what, what happened?

1340
01:20:40.708 --> 01:20:41.469
Um, do you remember?

1341
01:20:42.828 --> 01:20:43.669
I do remember.

1342
01:20:44.149 --> 01:20:53.713
So when you're inputting an answer, they give you like a wild card fake answer to kind of, so you know the answer you're putting in kind of matches linguistically or whatever.

1343
01:20:54.494 --> 01:20:59.516
But the answer that I came up with was the same as that example answer.

1344
01:20:59.556 --> 01:21:01.457
And I wasn't sure if they were trying to throw us off or not.

1345
01:21:01.477 --> 01:21:02.818
And it felt like something they might do.

1346
01:21:02.838 --> 01:21:04.619
And so I input it.

1347
01:21:04.719 --> 01:21:05.239
It was wrong.

1348
01:21:05.279 --> 01:21:07.260
And I was like, okay, I don't know where I'm going with this question.

1349
01:21:07.360 --> 01:21:08.380
Did you wind up getting it?

1350
01:21:08.440 --> 01:21:08.881
No, no.

1351
01:21:08.921 --> 01:21:09.601
I was like, I'm done.

1352
01:21:09.841 --> 01:21:10.501
Got off of that one.

1353
01:21:10.641 --> 01:21:11.042
Okay, cool.

1354
01:21:11.862 --> 01:21:18.644
So, I mean, this is a after the flag about threat hunting kind of, you know, positioned towards like the world of AI, right?

1355
01:21:18.704 --> 01:21:22.025
We talk a lot about AI in our podcast, talk about AI in general.

1356
01:21:22.505 --> 01:21:25.246
What's your AI hot take, right?

1357
01:21:25.286 --> 01:21:31.728
Do we think that like AI truly is the end of the world in like the the threat landscape?

1358
01:21:31.788 --> 01:21:32.729
Is it kind of overhyped?

1359
01:21:32.749 --> 01:21:33.729
Like, what do you think about it?

1360
01:21:33.749 --> 01:21:37.430
And are you, you know, for whatever you can say, are you seeing it in your day to day activities at work?

1361
01:21:37.776 --> 01:21:40.298
I'm definitely a long-term AI Doomer.

1362
01:21:41.078 --> 01:21:41.699
In which direction?

1363
01:21:41.719 --> 01:21:42.539
Doomer is what?

1364
01:21:42.639 --> 01:21:46.162
That it's going to do bad things or that it's marketing doom?

1365
01:21:46.282 --> 01:21:48.904
It's definitely going to do bad things.

1366
01:21:49.444 --> 01:21:53.267
But how bad things are or what direction that goes, I don't think we know.

1367
01:21:53.528 --> 01:21:55.010
Okay, that's interesting.

1368
01:21:55.090 --> 01:22:00.615
I feel like we're at the part where all of the current advances are somewhat obvious.

1369
01:22:00.655 --> 01:22:06.762
It's clear that Red Team stuff is going to get incredibly optimized and incredibly...

1370
01:22:07.623 --> 01:22:13.289
If you have a public-facing endpoint, etc., it might get popped pretty confidently, but unsure long-term.

1371
01:22:13.700 --> 01:22:15.101
Yeah, that's a conversation we have a lot.

1372
01:22:15.141 --> 01:22:21.083
It's like, you know, the first thing people say is like, oh, these models are so good at finding vulnerabilities, exploiting vulnerabilities.

1373
01:22:21.443 --> 01:22:23.284
The logical follow up is like, OK, well, cool.

1374
01:22:23.304 --> 01:22:25.865
Well, they're probably also as good at defending.

1375
01:22:26.165 --> 01:22:33.888
Follow up to that is then that like there's kind of like this asymmetric thing that we argue about a little bit where like attackers kind of go first and then defenders kind of do the thing after.

1376
01:22:33.908 --> 01:22:37.649
So, you know, is that gain that the defenders get symmetric?

1377
01:22:37.689 --> 01:22:41.271
Is it going to truly remediate the issue that the models present?

1378
01:22:41.291 --> 01:22:41.911
What do you think on that?

1379
01:22:43.772 --> 01:22:45.314
I just don't, I don't think it starts.

1380
01:22:45.374 --> 01:22:48.037
I definitely still think it starts with like corporate posture.

1381
01:22:48.257 --> 01:22:55.505
It's like as a, as a stronger foundation, reducing attack surface is probably more important than having good forensic tools.

1382
01:22:56.226 --> 01:22:56.386
Okay.

1383
01:22:56.526 --> 01:22:56.966
That makes sense.

1384
01:22:57.527 --> 01:22:57.847
Yeah.

1385
01:22:58.128 --> 01:22:59.189
We talk about that a lot, right?

1386
01:22:59.309 --> 01:23:02.873
Like a, an AI proof security program is just a security program.

1387
01:23:03.353 --> 01:23:08.519
Yeah, we've been doing all the things we've been trying to get you to do forever, right?

1388
01:23:08.560 --> 01:23:11.083
You just actually have to do it because there's like steroids in the room now.

1389
01:23:11.263 --> 01:23:12.925
What was the meme you literally just showed me?

1390
01:23:12.965 --> 01:23:17.971
If you have the editor put this in, it was like, you know, the soldier over the bed protecting the person.

1391
01:23:18.231 --> 01:23:21.855
And it's like AI monitoring solutions and just knives coming in from the other direction.

1392
01:23:21.875 --> 01:23:22.356
And it's like...

1393
01:23:22.496 --> 01:23:28.001
you know, default password, like mini cats on exe, like all the basic things are still happening regardless of AI.

1394
01:23:28.161 --> 01:23:31.084
It's just now we have a new threat to also worry about.

1395
01:23:31.264 --> 01:23:34.166
And the AI attack dart in the back was like a suction cup dart.

1396
01:23:34.307 --> 01:23:35.167
Right, right, right.

1397
01:23:35.868 --> 01:23:36.528
Yeah.

1398
01:23:36.589 --> 01:23:39.791
So I also put a dollar in the AI jar and had an AI question.

1399
01:23:39.871 --> 01:23:48.279
And so like besides the doom and gloom and all this, how has AI actually changed your job in terms of like detection engineering or anything like that that you're doing?

1400
01:23:48.706 --> 01:23:58.619
So prior to getting a lot of budget for AI, I've definitely spent a lot of my day manually tuning, manually doing thresholding, writing queries.

1401
01:23:59.039 --> 01:24:02.363
And most of that is like a thing of the past in terms of that skill.

1402
01:24:03.024 --> 01:24:07.250
I definitely feel like some skill atrophy when it comes to a lot of that stuff.

1403
01:24:07.810 --> 01:24:17.273
I have the know-how and the thought bank on how this stuff needs to be done, and I can write it out all in natural language and have it done like how I know it needs to be.

1404
01:24:17.753 --> 01:24:24.255
But I feel like the actual meat and potatoes and the tradecraft, it's lost in there, for sure.

1405
01:24:24.275 --> 01:24:32.757
And that's where I'm finding myself, because I can adapt it for almost anything, at least for an internal detection and response role, where I don't have to worry as much about...

1406
01:24:34.038 --> 01:24:36.503
detections at scale, like at something like Sentinel-1.

1407
01:24:36.744 --> 01:24:45.160
Like I can go throw any detection for the most part at my internal company with 3K endpoints and I can deal with the ramifications if it's not tuned quite right or whatever.

1408
01:24:45.925 --> 01:24:47.446
Oh, man, I can resonate with this, right?

1409
01:24:47.466 --> 01:24:50.687
I've stared at like a big query, like box for way too long.

1410
01:24:50.707 --> 01:24:53.027
I'm like, oh, man, I'm going to write this sequel.

1411
01:24:53.087 --> 01:24:53.908
It's going to be wrong.

1412
01:24:54.008 --> 01:24:55.108
It's going to cost real money.

1413
01:24:55.188 --> 01:24:56.288
It's going to take way too long.

1414
01:24:56.529 --> 01:25:00.550
And it's like, well, I can naturally like language talk about what I want to do.

1415
01:25:00.650 --> 01:25:01.530
So, yeah, that makes sense.

1416
01:25:01.590 --> 01:25:03.531
That translates to the detection stuff as well.

1417
01:25:04.371 --> 01:25:12.777
Um, so that kind of leads in nicely to like my last question that I had was what would you tell anyone trying to get into this field right now?

1418
01:25:12.797 --> 01:25:12.958
Right.

1419
01:25:12.998 --> 01:25:16.921
It's obviously changed a lot even since you've been doing it because of everything that you just said.

1420
01:25:17.561 --> 01:25:22.765
Um, so like what, like, what would you tell someone trying to become the world's next best threat hunter?

1421
01:25:23.370 --> 01:25:28.372
I would say make sure you enjoy what you do because things are going to keep changing.

1422
01:25:28.472 --> 01:25:32.414
And if you're not passionate about learning, it's going to be a slog.

1423
01:25:32.974 --> 01:25:33.154
Yeah.

1424
01:25:33.174 --> 01:25:38.457
Because I think just the rate of change is so insane, like Moore's Law doubling every year, etc.,

1425
01:25:39.437 --> 01:25:40.178
Yeah, I agree.

1426
01:25:40.298 --> 01:25:41.839
And how about the actual learning part?

1427
01:25:42.059 --> 01:25:43.720
Do you have any like favorite resources?

1428
01:25:43.780 --> 01:25:44.580
Was it like school?

1429
01:25:44.600 --> 01:25:45.201
Was it search?

1430
01:25:45.221 --> 01:25:47.562
Was it just kind of reading about it?

1431
01:25:47.582 --> 01:25:48.123
Hands on.

1432
01:25:48.283 --> 01:25:52.886
CETFs, blogs, just kind of taking whatever I can get my hands on and then talking with friends on Discord.

1433
01:25:53.306 --> 01:25:55.968
Yeah, this is how I, this is what I tell everybody, right?

1434
01:25:55.968 --> 01:25:56.988
Some things haven't changed.

1435
01:25:57.028 --> 01:26:01.190
It still sounds like CTF is the best way to learn how to hack or to defend, man.

1436
01:26:01.210 --> 01:26:01.971
That's awesome.

1437
01:26:02.111 --> 01:26:06.012
I just tell people, I'm like, just learn as much as you can as publicly as you can.

1438
01:26:06.032 --> 01:26:06.493
Right.

1439
01:26:06.513 --> 01:26:09.414
I mean, like you just did an ultimate public learning experience.

1440
01:26:09.454 --> 01:26:09.614
Right.

1441
01:26:09.674 --> 01:26:15.677
But just like, yeah, be able to prove that you know it, like, you know, instead of a certification or anything like that.

1442
01:26:15.697 --> 01:26:15.957
Exactly.

1443
01:26:15.977 --> 01:26:16.157
Right.

1444
01:26:16.177 --> 01:26:16.337
Right.

1445
01:26:16.757 --> 01:26:20.463
I feel like I will know already the answer to what I'm about to ask from you.

1446
01:26:20.523 --> 01:26:26.612
But like if someone comes up to you and they say, like, is it still worth learning the fundamentals if AI can do it automatically?

1447
01:26:26.632 --> 01:26:27.293
What do you say to that?

1448
01:26:27.908 --> 01:26:36.231
You need to understand the fundamentals to understand the follow-up actions or the deeper, correct way to do things, I just could say.

1449
01:26:36.431 --> 01:26:36.631
Yeah.

1450
01:26:37.091 --> 01:26:47.155
I have a fundamental concern about, we have people that are very talented right now that know the before times and the after times of AI, but it's like, okay, when that next generation has to come online, what happens?

1451
01:26:47.295 --> 01:26:51.116
And I feel like this is kind of the sentiment that, oh, we don't need to know things because AI can do it for us.

1452
01:26:51.136 --> 01:26:52.876
And it's like, no, you have to know the fundamentals.

1453
01:26:53.037 --> 01:26:53.477
Exactly.

1454
01:26:53.837 --> 01:26:54.057
Yeah.

1455
01:26:54.657 --> 01:27:17.119
yeah yeah cool that's all i had any more questions oh cool well jason thank you for coming and hanging out with us on the lowdown and thank you for participating and winning the you know competition for uh the world's best threat hunter man this is an insane trophy yeah congrats you're like i do not envy you getting that through tsa i think they said they were gonna help me out okay like yeah something like that

1456
01:27:17.359 --> 01:27:21.445
Because that would be a bludgeoning weapon on an aircraft for sure.

1457
01:27:21.586 --> 01:27:24.630
This would solely put you over the checked bag weight limit.

1458
01:27:24.750 --> 01:27:25.472
This is insane.

1459
01:27:25.652 --> 01:27:25.812
Yep.

1460
01:27:26.313 --> 01:27:26.834
Cool.

1461
01:27:26.854 --> 01:27:27.214
Good job.

1462
01:27:27.234 --> 01:27:27.635
Congrats.

1463
01:27:27.835 --> 01:27:28.196
All right.

1464
01:27:28.216 --> 01:27:28.697
Fine at all.

1465
01:27:28.897 --> 01:27:29.217
See y'all.