S1: Unsupervised Learning is a podcast about trends and ideas in cybersecurity,
S1: national security, AI, technology and society, and how best to
S1: upgrade ourselves to be ready for what's coming. All right,
S1: welcome to Unsupervised Learning. This is Daniel Miessler, and we
S1: have with us today Slava Konstantinov from Threatlocker.
S2: Thanks for having me.
S1: Yeah, yeah, yeah. Great to have you here. So, um,
S1: wanted to just jump right into it. Um, can you
S1: start off by telling us what's going on with Threatlocker overall?
S1: Like what? What does it address? What is the, um,
S1: the main the main product and what it does?
S2: Yeah. So Threatlocker were a cybersecurity company and we're protecting endpoints.
S2: And our main approach is a zero trust. Zero trust
S2: means that that we don't trust anyone Except what we trust.
S2: I mean, we have a lot of policies. We can
S2: talk about this like deep dive a little bit later.
S2: But yeah, in general we're working on a zero trust
S2: with zero trust approach.
S1: Yeah. So and that means by default nothing is allowed
S1: in general. Right. And then you poke poke little holes
S1: for what's allowed.
S2: Yes we we have multiple different products in thread locker.
S2: So basically we have one big thread locker machine as
S2: if I can say that. And also we have like
S2: different products. First of all like we have an application control.
S2: It's this basically is allow listing. Allow listing that we
S2: only allow to run specific software that it's basically in
S2: our list. Everything else, everything else gets denied. So what
S2: does it mean for for the enterprise it means that
S2: every company they have set of software they use. Everything
S2: else should not be allowed. And there is a lot
S2: of examples out there on the internet and in real life. Basically,
S2: when people are losing their jobs or company got hacked
S2: because someone installed something that was not supposed to be there.
S1: Yeah, yeah, that makes sense. And so how was the
S1: what's the process look like for. And I believe we
S1: talked to someone else from your company as well. So
S1: I heard about this before, and I remember being impressed
S1: with the way that you handled it. But how do
S1: you handle that allow list.
S2: So we have a set of rules. And rule can
S2: be like you can put like a path to the rule.
S2: You can. But mostly we use hashes. So basically we
S2: know what every executable in your system, every executable hash
S2: in your system. So we know that we have big
S2: database of these hashes. We also know the hashes of
S2: the apps and how we do that. If if there
S2: is unknown hash trying to execute on your computer, which
S2: is basically block it. So it's pretty straightforward and it's
S2: pretty easy, sometimes you need to maintain it because there's
S2: a we have two sets of applications we have built
S2: in applications. So basically we maintain them. We also check
S2: for updates for that applications. We update hashes. But there
S2: are sometimes specific requests from the customers. So they need
S2: to maintain it themselves. But it's not super hard. It's
S2: just it's just small inconvenience for as I would say,
S2: better security.
S1: Sure. And then like you were saying something for like
S1: a windows environment, like a very big, uh, software operating system,
S1: lots of updates coming out, lots of application updates coming
S1: out When those updates come out, I assume they come
S1: to you and you do. Hashes for those. And then
S1: you give the hashes to the customers so that. They
S1: can ensure that they can install them or.
S2: No, no. Basically what we do. We have a portal.
S2: So it's a web website and everything managed from there. So.
S2: We the customers, they have like admin pages and all
S2: of this so they can set it up. And when
S2: the update come up we have a whole team basically
S2: looking for that updates like running them, learning the new
S2: hashes and after update. So they just basically update the
S2: existing policies when the policy got get updated, they basically
S2: after that what they do is it's automatically updated on
S2: every customer we have. So we'll and there's also new
S2: product coming out that's batch management. So we're gonna basically
S2: we're gonna see if there's an old application not patched
S2: application installed on your computer. And you can install and
S2: you can patch it on the fly basically without even
S2: asking user to do that.
S1: Oh very cool, very cool. Okay, so you have the
S1: application one. You have this new one that's coming out
S1: which is patches.
S2: Patch management. Yep.
S1: Patch management. So what are the other products that you have.
S1: You mentioned other ones.
S2: Yeah. So the one we talked about it was application control.
S2: We also have storage control. So storage control is a
S2: is a product that basically can uh protect your file
S2: system from unwanted access. What I mean by that, you
S2: can stop some application from accessing your, uh, folders that
S2: may that may have some information, like a specific information
S2: that needs to be secured. We also have we can
S2: block USB devices. We also can block network shares, so
S2: this product helps users to protect their data from being
S2: accessed from unknown apps, for example, or even USB drives.
S2: So if your if your company's policy does not allow
S2: to USB drives, which can block USB drives from accessing
S2: your computer at all.
S1: Hmm. Interesting. Okay, so it's controlling like the media that
S1: can come in. It can handle network shares as well. Yes.
S1: You could basically you could block off things that are, uh,
S1: super sensitive. You don't want it to look at it
S1: at all.
S2: Yes, yes. So we have for example like specific uh,
S2: folder with uh, super secret data, your company data, and
S2: you have only 1 or 2 apps that allow to
S2: access that, like for example, like Word or Excel or
S2: something like that. So and you will allow only this
S2: helps to access that folder if some other app like
S2: malicious app for example, like lurking in your system and
S2: it tried to access that folder which is going to
S2: block it. So it means like zero trust, we don't
S2: trust anyone except with the ones we trust.
S1: Gotcha. Okay. So that's application control and storage control. Any others?
S2: Yeah. So we have ring fencing. Ring fencing basically means
S2: if we allow app to run. But we what we
S2: can do is we can say we can put this
S2: app into if we can say that sandbox. So saying
S2: like okay, you're allowed only you're not allowed to run
S2: other applications or you're allowed to run specific applications or
S2: you can you cannot access network or you can access
S2: the network, but some specific websites.
S1: Oh that's right. Yeah. So this is um, same.
S2: For.
S1: The stores are round in application.
S2: Yes, around the specific application. So for example you have
S2: I don't know like a file zilla or I don't
S2: know or something like that. So you will you can
S2: access FTP servers, but you have specific set of FTP
S2: servers that allow that you allow to connect to or
S2: any other app. I'm honestly right now.
S1: Netcat or terminal or something like that.
S2: Oh yeah. Yeah. Terminal for example. So you can ring
S2: fence terminal and say like oh terminal can run this,
S2: this and that and it's not allowed to run curl
S2: for example. So if it yeah, if it can't run
S2: curl if uh, some specific attacks.
S1: Or something like yeah, a way to download additional malware or.
S2: Yes, yes.
S1: Or outbound SSH or something.
S2: Yeah. Or you downloaded some app and you're not sure
S2: you need this app, but you're not sure what it's doing.
S2: And you can basically put it into that sandbox and
S2: saying like, oh, you're not allowed to access internet. So
S2: even if it it will try malicious software, it will
S2: try to download some like payload from the internet like
S2: obfuscated executable and run it. First of all, even if
S2: it's downloaded, we're not going to allow it to run
S2: it because of default deny application control. But at the
S2: same time, it's even if it stole something from your computer,
S2: it will now don't have access to internet to send
S2: it over.
S1: Right.
S2: Yeah. Same. Same for the. I'm sorry. Same for the storage. Uh, storage.
S2: Because we can reinvent storage access to specific apps. So
S2: storage control, we can control whole system, whole computer, different applications.
S2: But ring fencing, we can specifically say this application allowed
S2: to access that folder, that folder, that folder. Okay, so.
S1: And then can you define all these different policies in
S1: one place, or are they defined in the separate products?
S2: Yeah. So it's a separate product. So application control is
S2: one product storage control. And it's all different products. But
S2: it doesn't mean you're not allowed to reuse them between products.
S1: Okay. Yeah that makes sense. So a lot of this
S1: has been very windows focused. Is that right.
S2: Yeah yeah windows. But we also have Mac agent now
S2: for for a couple of years. And Linux we have
S2: version 1.4 I guess Linux right now. So it's pretty
S2: early stage.
S1: Okay. So tell me tell me about the Mac agent.
S2: Yeah. So I'm a mac lead architect. So, um, yeah,
S2: I'm basically I've been there since day one of Mac
S2: agents starting POC, and now we have version 4.2 coming
S2: out soon. So it's been quite a journey. We don't
S2: have all of the products windows has for now, but
S2: we're trying to keep up. So we don't have we
S2: don't have detect. I mean, we haven't talked about that yet,
S2: but yeah.
S1: Tell me about detect.
S2: Okay. So there's also multiple there's a couple more products
S2: that we haven't talked about.
S1: Yeah yeah.
S2: Yeah. So first oh not first. So one of the
S2: products is elevation control. Basically it's it's in some way
S2: it's a little bit different from zero trust because we
S2: can what we can do is we can allow applications
S2: or user to elevate uh specific actions in the system. Uh,
S2: as a, as an admin user. So without asking actual
S2: admin permissions. So basically you have a standard user on
S2: your computer that is not allowed to elevate anything, but
S2: your admin wants you to install some update, and for
S2: that update you need elevation or to access some folder.
S2: That's if we're talking about Macs that protected by root,
S2: for example. And what we can do, we can set
S2: up specific rules for that application. So if application tries to, uh,
S2: install update for itself and it requires root so users
S2: user is not, uh, basically user does not enter any password.
S2: So it would just automatically elevate user for admin privileges
S2: for for that specific request not whole system. Some specific requests.
S2: We can allow for application for user interaction with a
S2: system and a windows. It's UAC in a mac world
S2: or Linux world that you can. It's pseudo or it's
S2: just privilege elevation.
S1: Interesting. Okay. So that's an interesting layer. So it's basically
S1: a layer in between the actual um pseudo or admin capability.
S1: It's it's like a shim in between.
S2: Yes, yes. So basically if you're not allowed to run
S2: pseudo on your computer, for example, on Mac, any standard user.
S2: So we have admin user and a standard user, any
S2: admin standard user doesn't have access to pseudo at all.
S2: But what we can do, we can we can get
S2: this access to standard user, but just for some specific
S2: specific amount of time or a specific amount of actions.
S2: Like if you want to run pseudo uh, Linux apt
S2: get or something to update your packages.
S1: Right. So so it's like a policy based granular control
S1: when that actually doesn't exist with sudo. If you have sudo,
S1: you have everything.
S2: Yeah. Yeah.
S1: If you're taking that away. Yeah.
S2: Yeah. If you're admin it doesn't make sense. You can
S2: just type in a password or click like elevate privileges
S2: or something like that. It's not a problem. But if
S2: we have a yeah if user doesn't have any privileges
S2: on the computer, we allow user to have some of
S2: them if user needs to.
S1: Sure. Okay. So that's elevation. Uh, what's what's the next one. Yeah.
S1: What about detect.
S2: Yeah. So there's a detect. It's not on the Mac.
S2: It's not on Linux yet. It's just windows product for now.
S2: But we're working on getting it into Mac at least. Okay, so, uh,
S2: this is our MDR solution. So we have EDR that's automated,
S2: automatically detect and block something or make any decisions. We
S2: have MDR, we have whole MDR team and Threadlocker Threatlocker
S2: headquarters they basically check for, so you can set up
S2: rules and policies for your organizations to see, like, oh,
S2: someone like scanning my entire network or doing something. So
S2: and we have alerts for that. So our MDR team,
S2: they have alert and so they can lock your computer down.
S2: If there's some suspicious activity they can lock your network
S2: down or they can notify you like call you call
S2: your admin like saying, oh there's some suspicious activity. What
S2: what what do you want it to do with with that.
S2: Because there's a lot of we it happens. There's some
S2: false positives. But and that team, they basically monitor all
S2: of these events from all of our customers. And they
S2: and they make decisions by that okay.
S1: Okay. Great. So so essentially the agent is talking up
S1: to a centralized location. You could see centralized alerts. Like,
S1: for example, someone scanning the entire network or something, and
S1: they can they could choose to respond to that.
S2: Yeah. Yeah, yeah. Uh, also, the customer or our team,
S2: we can help customers with that to set up specific
S2: policies because every organization may have different policies. So we
S2: can set up their policies like in the way they want.
S2: So we can check something. We can skip something, something else.
S1: Makes sense is that, um, is that all the products
S1: you still got?
S2: Yeah. We have one more. Okay. One more old ones.
S2: We have three more new ones.
S1: Okay.
S2: So we have, uh, we have network control. Network control
S2: is basically we can, uh, and we also have default
S2: deny on the network if you want this. So basically
S2: we're not allowed and, uh, endpoint is not allowed to
S2: access anything except what you allow to do. Or you
S2: can just you can allow everything but block specific websites
S2: like even like if we're talking about protection default deny
S2: is better because you can say like, oh, you can
S2: go like to to access Microsoft.com, you can access like
S2: some other Adobe updates or something like that, uh, obviously
S2: like specific websites for your organization. But if we're talking
S2: about even controlling what your user does, like blocking Facebook or,
S2: or something like pretty simple. So we can we can
S2: do all of that with the network control. It's basically, uh,
S2: protecting your environment and your network. We also have a
S2: thing called objects and challenges. So the, uh, the multiple
S2: computers can talk to each other with specific challenges and
S2: objects and saying like, oh, this computer, I know this computer,
S2: it's allowed to access my network. Mhm. Doesn't matter where
S2: you are. So it means like because for firewall you
S2: need to set up your IP like you can, you
S2: need to like or VPN or you have to call
S2: someone like your admin. Can you allow this IP to
S2: access our network. But if you're like on on the
S2: go somewhere like basically traveling, you can your network control
S2: will send specific objects to your to your network and
S2: you will uh, and they will respond. It's, it's a
S2: double check between like if it's legit or not. And
S2: it will allow your computer from any location to access
S2: that network in this rain.
S1: Interesting. Okay. Okay. I have a question before you go
S1: into the new products, is is anyone thinking about I
S1: have to assume the answer is yes. Is anybody thinking
S1: about a single policy editor where you go in as
S1: an organization. And you basically define the policy of like,
S1: here's what we care about for network overall for this
S1: particular host, it's like like a more centralized single policy. Um,
S1: in that single policy, which you like, write in English,
S1: gets translated down to the specific rules that apply to
S1: the specific products. So it's still being implemented inside the
S1: separate products. But really it's like this like abstracted up.
S2: Um, yeah.
S1: So we need policy editor.
S2: So we need to, uh, implement some AI stuff for,
S2: for that obviously.
S1: Yeah.
S2: Yeah. To translate from human language to that one. We
S2: don't have it yet. It could be our next product.
S2: We'll see.
S1: Yeah. Yeah, that makes sense. So what are the new products?
S2: Yeah. So there's, um, at least three new products. Uh,
S2: so there's, uh, if we're talking about agents because there's
S2: one more product called Cloud Detect, It's a little bit
S2: different kind of product. I'm working on the agent side.
S2: So it's it's not agent related products. It basically means
S2: product that can, uh, allow access to your, uh, cloud
S2: services from, like, Microsoft or like AWS or something like that,
S2: with a specific app on your phone. And it connects
S2: to same as, uh, and wherever you go with this app,
S2: it knows your IP address, and it basically can allow
S2: you access from that location to your cloud services. So it, uh, and, uh,
S2: but other three products is, uh, web control. So it's,
S2: it's not. Net so it's similar in some way to
S2: a network control still. Uh, but it only works for browsers.
S2: So if you want your organization to block like all
S2: gambling websites or poor websites or something like that. You
S2: just can choose category that you can block or allow.
S2: And we basically will do that. So this this one
S2: of the newest products, it's it's for someone who doesn't
S2: want to deal with network control. It's much more simpler
S2: and it's much more it's more uh, just uh, it's
S2: more restrictive. Not not protective, I would say.
S1: Gotcha. Okay. And is that is that all of them?
S1: One more. Right.
S2: No, no. Two more. Two more. Yeah. We have a
S2: lot of products. So we all, we all we also
S2: have patch management. It's coming soon. So this this three
S2: products coming soon. So it's in beta now and it's
S2: coming live. Uh, maybe months maybe a couple of weeks. Okay. So, uh,
S2: the patch management. So as we spoke with you about
S2: this a little bit earlier so we can patch. We
S2: can have set of policies and we can check versions
S2: of the apps that that's on your computer. And if
S2: it's if the app is outdated, we can alert your
S2: admin saying like, oh, there's a new there's a new thing,
S2: there's a new update for the app, and you can
S2: basically press the button on the portal and it's going
S2: to automatically patch your, your, your application. So, so it's,
S2: it's much easier way and simpler way of patching, especially
S2: in some cases if you want to allow or uh,
S2: some specific version to run on your computer.
S1: Okay.
S2: There's one more called insights. The insights is basically we have, uh,
S2: a database that stores all of the applications and interactions
S2: with applications, uh, from all of our clients. It's totally anonymous.
S2: So it's it's different. It's different set of data from
S2: our customers data. But what it can do basically see
S2: every app that was allowed or denied or set of rules,
S2: specific set of rules that apply to that app. And
S2: we can show user oh, if some app got blocked
S2: on your computer and you will see the small statistics
S2: like the admin on your organization can look at the
S2: statistics saying, oh, this app got denied or got allowed.
S2: This is how many times this is how many times
S2: this domain was accessed. This how many times it was
S2: denied a lot of times. So it's like it's a
S2: small insight of like what others do. And you can
S2: create interesting set of policies, especially ringfence policies on what app.
S2: Some specific app. Oh, usually this app goes to that
S2: folder or access that website and you can automatically press
S2: like create a ring fence policies for this app so
S2: it makes life of our customers a little bit easier.
S1: Yeah, that's that's smart. That's smart. Because like a ring
S1: fence policy could be like 12 different rules to like
S1: 12 different things. Right?
S2: Yes.
S1: And that might take a little while to figure out.
S1: And each time it's like a manual add versus somebody else.
S1: Or hundreds of other customers already figured that out. So
S1: now there's a template.
S2: Yes. Yeah. Exactly.
S1: Yeah. That makes sense. That makes sense. Um, well, what
S1: can you say more about the, uh, the Mac agent? Um,
S1: how how are things different, like threat wise right now
S1: with Mac versus windows? Are you seeing different threats? Like,
S1: is the installation process different the management of it? Is
S1: it different?
S2: I mean, like the threat, the attack vectors, they pretty
S2: much the same everywhere. Like, yeah, it's the same thing
S2: like Linux, Mac, windows. Most of them are social engineering.
S2: Some of them are like zero day vulnerabilities. Some of
S2: some of them is, uh, supply chain attacks. Right. But like,
S2: it's still the same, like how how Apple and Microsoft
S2: approach this is a little bit differently because Mac they
S2: I mean the windows they have Windows Defender, they have UAC.
S2: So they have their own protections. Apple goes a little
S2: bit further with that because there's a lot of more
S2: protections like uh, uh, TCC. It's uh, I forgot how it's, uh,
S2: consent and something. Consent and control. I was honestly, I forgot,
S2: but basically there's a specific set of rules for each app.
S2: It's what we do. But from from Apple standpoint, it's
S2: a little bit simpler. So they can deny access for
S2: any app to access to file system, for example. So
S2: it runs in its own small sandbox or or user
S2: have to approve if app wants to access your documents
S2: folder for example. Right.
S1: Yep.
S2: And Apple has X protect. It's like Windows Defender X protect.
S2: Their probably it's built in antivirus but it also runs
S2: only for uh known malware. So it works only for
S2: it can block only known malware. It's not like it's
S2: not even reactive.
S1: It's not looking at behavior for all applications. Okay. So
S1: you're hooking into the the Mac functionality and doing your
S1: own functionality or.
S2: Yeah. So what we do Apple restrict us from accessing kernel.
S2: It happened like five years ago I guess or something
S2: around that time. So and we have a lot of
S2: complications because of that. So they, they have their own
S2: driver running in and we basically see what this driver
S2: sends us events and we can apply to that events
S2: like allow or deny. But what driver can do it
S2: can access other processes memory. It can access, uh, other
S2: low level things that we can do to make protection
S2: a little bit better, I would say, but we're not
S2: allowed to do that. And there's also a lot of, uh,
S2: because they tried to make it for everyone. So there
S2: is a trade off between speed and some of the
S2: things they send to, uh, to us. So we need
S2: to approach some things differently, especially hashes. So we need
S2: to have our own cache for hashes and all of
S2: these things, because what Apple sends us is a little
S2: bit different. They call it KD hash. It's called directory.
S2: It's assigning hash. But we need to know hash for
S2: specific executable and it's a little bit different. And we
S2: need to calculate it like basically each time application runs.
S2: And there's some complications with that I would say. But
S2: it's we found workarounds for that. It's for network. The
S2: same thing. We don't have access to kernels so we
S2: don't have access to some low level packets. So we
S2: only work with Apple's gives us and we have complications
S2: with that either. So and also recently I guess it
S2: was 15.1 recent update. They broke third party firewalls. Uh
S2: not just us everyone. Yeah. If you run in built
S2: in firewall, if it's on, uh, we never got any, uh,
S2: events from the system, so it's like.
S1: Little snitch and all those.
S2: Yeah, yeah, yeah, yeah, yeah. Everything was broken. Like, for
S2: one specific Apple update. They broke it. Yeah. So we
S2: get events from the macOS. Everything. Every time someone tries
S2: to connect like a two or packet to send a
S2: packet or something like that, and we never received them
S2: as if built in firewall was on. Right. So this
S2: is a downside about that. So Apple Apple broke something.
S2: We couldn't do anything about that.
S1: Now they fixed that or it's just broken from now on.
S2: No no no it's it's fixed. But I was like
S2: you see everything is in apple hands basically.
S1: Yeah. Yeah that's that's a good point. They do do
S1: hold all the cards there. Yes. Um, okay. So, um,
S1: so the question I have for you is it seems
S1: like the product overall is the zero trust concept, and
S1: you're simply applying it at all these different module stages
S1: because they all need something slightly different. Yeah. So it's
S1: yeah that makes sense. Yeah, that's really interesting.
S2: Yeah. So, like, your system is not just simple applications.
S2: It's more complicated than that. So. And so we try
S2: to apply this to every single level to, to make
S2: better protection.
S1: Yeah that makes sense. And how different is the Mac
S1: side of it from the windows other than like the
S1: permissions and stuff that we talked about is the installation
S1: is pretty standard Mac installation. What about administration? Is it
S1: all look the same inside of the portal and everything?
S2: Yeah. So basically we're talking about like business logic of things.
S2: It's all the same obviously like paths are different right?
S2: Like windows, Mac, Linux like like we're talking about file
S2: system or something like that. So it's all this network
S2: completely say like for for from the user perspective it's
S2: the same thing like application control ringfencing is all the
S2: same thing. You can. You need to understand Mac OS
S2: to make better policies for in some cases. But in general,
S2: we're trying to make this seamless for all of the users.
S2: So they should not distinguish oh, I have windows, I
S2: have Linux. If they have specific app like Adobe app, right.
S2: They want to install it. We have built in policy
S2: for windows. We have built in policy for Mac, and
S2: there's nothing distinguishing that from user perspective. So they just
S2: can add this policy to their system and it's going
S2: to work.
S1: Yeah. That makes sense. Um, so when are these new
S1: products coming out?
S2: Yeah. So new products they coming out like pretty soon
S2: I hope I hope in a couple of weeks. But
S2: we'll see. Okay. Yeah. It's not it's not up to me.
S2: So there's QA stage. There's also but yeah, uh, I
S2: honestly I don't know. It's not on the Mac. On
S2: the Mac. Web controls coming pretty soon. But we have
S2: a couple of problems with the Chrome to browsers except Safari, Safari,
S2: Safari and Mac works a little bit better, and it's
S2: easier to handle some things from that standpoint. But other browsers,
S2: we we need to figure some things out.
S1: Yeah, browsers are tough because they're always changing their security stuff.
S1: And just it seems like it moves a lot, especially
S1: with like extensions and stuff. So. Yeah, that makes sense.
S2: Yeah.
S1: And so um.
S2: But on the Mac patch management and insights will come
S2: a little bit later. Uh, because we have like Mac,
S2: it's not as huge as windows. So we have a
S2: little bit smaller team, but we're trying to keep up
S2: as fast as we can. So it's gonna come out like,
S2: I hope, until the end of this month. Web control
S2: and insights patch management. I really hope it's gonna come out, uh,
S2: at until the end of the month.
S1: Okay. Well. Very cool. Um, anything else you wanted to share? Uh,
S1: where can we find more information about the products?
S2: Oh, we have we have YouTube, we have LinkedIn, we
S2: have website. So you can go anywhere. We're we're everywhere.
S1: Awesome. Well, it was great to chat with you and, uh,
S1: enjoy the conversation.
S2: Thank you.
S1: All right. Take care.
S2: Take care.
S1: Unsupervised learning is produced on Hindenburg Pro using an SM
S1: seven B microphone. A video version of the podcast is
S1: available on the Unsupervised Learning YouTube channel, and the text
S1: version with full links and notes is available at Daniel
S1: Mysa.com slash newsletter. We'll see you next time.