S1: Welcome to Unsupervised Learning, a security, AI and meaning focused
S1: podcast that looks at how best to thrive as humans
S1: in a post AI world. It combines original ideas, analysis,
S1: and mental models to bring not just the news, but
S1: why it matters and how to respond. All right, Jason,
S1: welcome to Unsupervised Learning.
S2: Thanks for having me. First time on unsupervised learning. Super excited.
S1: Yeah, absolutely. So as most people know, we know each
S1: other very well. And you've also started your own business recently.
S1: You've got Arcanum Security up and running. So congrats on that.
S1: Thank you.
S2: I mean, you were you were the one who pushed
S2: me to do it. So I got to thank you
S2: on that one.
S1: Yeah. Yeah. Really exciting to see that. And, uh, you're
S1: also field CSO for, uh, for flare, which is super exciting.
S1: So I'm sure you've got a million companies, like beating
S1: down the door to try to, like, be associated with
S1: you and like, get you on the team and everything.
S1: So what was, uh, the thing that stood out and
S1: made you want to do it with flair.
S2: Yeah. So that's actually a really great question, I think. Um,
S2: so but between leaving Ubisoft, which, you know, actually wearing
S2: the merch right now, um, between leaving Ubisoft, the video
S2: game company, and being CSO there and then coming back
S2: into Red team, there was a year where I worked
S2: with a buddy of mine at another consultancy before I
S2: started my own thing. And so over the past couple
S2: of years, I've been on the red teaming side, um,
S2: a lot of red teaming, a lot of pen testing.
S2: And what I noticed was that kind of adversary methodologies
S2: had changed a little bit from what the very known
S2: penetration testing methodologies and red teaming methodologies, um, had, uh,
S2: you know, had consistently shown, at least from, you know,
S2: me talking to peers and, you know, reviewing reports. And
S2: I did a bunch of research in the last two years.
S2: And so that shift was basically, um, adversaries are not
S2: using hacking methods, at least in the traditional sense as
S2: their first stop shop right there, looking on the dark
S2: web for pre-owned accounts and credentials for organizations. And so
S2: I had to figure out a way to add that
S2: to my methodology when we did red team tests. And
S2: so I baked off, you know, all of the companies
S2: that did this because I wanted to, you know, provide
S2: the best, uh, you know, adversary emulation that I could.
S2: And so when I looked at all these companies, I
S2: stumbled upon flair, um, at a conference, met one of
S2: their reps and started using their trial and, uh, used it.
S2: And it was it was an order of magnitude better
S2: than any other vendor as far as finding creds for
S2: an organization. Um, and they do it in a, you know,
S2: a CRM, you know, kind of way, a credential exposure
S2: management threat, Intel management way. I mean, they sell that,
S2: but they also let pen testers and red teamers use
S2: the data as well for their customers. So if I
S2: have a customer for Arcanum, you know, I can use
S2: the I can use my relationship with them to look
S2: up creds on that company in the red team test.
S2: And so, um, like five out of the last six
S2: red team engagements that I had done in 2023, uh,
S2: flare credentials, which are pulled off of the dark web,
S2: telegram channels and stuff like that. Um, they came from
S2: the success came from the credentials that came out of flare. Um,
S2: and so I started talking to them and I was like, hey, um,
S2: you know, like, really like what you guys are doing.
S2: I ended up doing like a, I think one podcast
S2: with them. Um, and then that transitioned to them being like, hey,
S2: would you like to come work part time as our
S2: field CISO? And I was like, yeah, absolutely. So that's
S2: how that relationship started. And and now, you know, I
S2: do content for them. Um, I advise them on product.
S2: I do all kinds of stuff like randomly, you know,
S2: it's a startup. Everybody wears every hat. So yeah, that's
S2: that's how that started.
S1: No, that's very cool. And it flows really well with
S1: what you're doing in Arcanum. Right. Because you're doing red
S1: team over there. You're doing training over there. You're doing
S1: all kinds of stuff.
S2: Yeah, I mean, it comes in handy with the red teaming.
S2: The purple teaming. Um, you know, the, you know, the
S2: times when we do consult a little bit on blue
S2: teaming as well, which is, you know, threat intelligence and
S2: exposure management and um, yeah, really, it's been awesome. And
S2: they've been really receptive to from, you know, when I
S2: am a customer asking for, you know, features, they're on it,
S2: they're like, hey, like we'll build that soon. It's on
S2: the roadmap. So um, and they're one of the only players,
S2: I think that also works with, um, like those pentesting companies, right,
S2: where you can redistribute that threat Intel data and that
S2: exposure data to use it in your engagements. So I
S2: think that's really cool too.
S1: Yeah, I really like that red team focus that that's
S1: really powerful. Um, so what what would another protection scheme
S1: look like for a customer? So let's say you're a
S1: regular customer and you buy a flare. Is this essentially
S1: threat Intel that's coming down to you to notify you
S1: that a credential has been compromised? So, you know, to
S1: rotate it? Is that like the main use case?
S2: Yeah. So in in kind of the dark web world. Right.
S2: That attackers kind of go through there's, there's really the
S2: stepping stone or like I call it levels of, of
S2: data that's exposed via the dark web. Right. And so
S2: this is part of that research I did in my
S2: last two years. And so the first level is creds
S2: that have already made it to the clear web. Right.
S2: So this is stuff that you will see. And have
S2: I been pwned and leaked X. And you know some
S2: things like this. Right. Um, and so these things are
S2: already on the public web. They're posted via paste sites,
S2: they're already on torrent listed sites and stuff like that.
S2: And so that's the first place an adversary will go, okay, um,
S2: to look for creds. Now, uh, there are several other intermediaries,
S2: but eventually you get to one of the higher tiers,
S2: the higher levels. And that level is looking on telegram, discord, WhatsApp. Um, and,
S2: you know, some of the dark web forums that are
S2: invite only to find really fresh what we call, um,
S2: you know, basically they're the result of Steeler malware. Um,
S2: and so these packs of, um, you know, data from
S2: Steeler malware end up being sold, and they include, uh,
S2: credentials and cookies, um, from a user that might be
S2: associated to your business. And so that's where attackers will
S2: end up. And then right after that is the step
S2: where they actually try to hack you. Right? Um, but
S2: they'll do all the easy stuff first.
S1: Okay. And then so we hear a lot about like
S1: toufar bypass or whatever. So is this where the Toufar
S1: bypass comes in with the cookie stuff?
S2: Yeah, exactly. So, um, you can have your credentials stolen
S2: in a myriad of ways, right? Uh, and that is
S2: stymied by kind of traditional, um, you know, traditional security
S2: advice of using toufar. Right. And I think that what
S2: a lot of people miss out on is that most
S2: of the time when credentials are stolen, other than from, like,
S2: a breach, right? They're stolen via credit stealer malware. which
S2: owns your whole computer. And that means that the cookies
S2: in your browser, like Chrome or Firefox, are stolen from,
S2: you know, from that malware and sold as well. And
S2: so that means that you can just inject a cookie
S2: into a website and never be asked for a password
S2: or a cookie. You know, the cookie. You know, for
S2: those who aren't really, um, you know, aware of the,
S2: you know, technology or I'm sure most people who watch
S2: your show, you know, are aware of what cookies are,
S2: but in most senses, authentication cookies. Just tell the website
S2: that you are already authenticated, and you can view a
S2: page for a certain amount of time or an authenticated
S2: section of an application. So you have you have Netflix, right.
S2: And so, you know, you leave Netflix logged in for weeks, months,
S2: years sometimes. Right. And that's controlled by the cookie. When
S2: your browser visits Netflix, the first thing it does is
S2: it looks for the Netflix authentication cookie. And it says yes,
S2: Daniel has that one. It's it's hasn't set to expire yet.
S2: And so we know this is Daniel coming from this
S2: cookie and we'll let them in without asking for username
S2: and password.
S1: Yeah, that totally makes sense because like in the course
S1: of a session or even, you know, half a day
S1: or a day, you're hitting hundreds of things, right? And
S1: you can't be re-authoring each time. So you're just sending
S1: a cookie. So that makes sense. So I imagine in
S1: the forums they're going to have like decay numbers for
S1: how long this token is going to be valid.
S2: Yeah. And the dark and the dark web forums, you know,
S2: they'll they'll sell the packs of, you know, like Red
S2: line is the biggest credential stealing malware right now. In fact,
S2: I think Cisa came out with an advisory just yesterday that, uh,
S2: or the DoD just came out with an advisory saying
S2: it's their number one, like focus is to fight, um,
S2: Red line, which is one of the credential stealer malware
S2: and um, and yeah, so that'll steal the cookies and
S2: the credentials and a whole bunch of other stuff too.
S2: Like when you see one of the packs being sold,
S2: it's usually, uh, you know, sold. And it has a
S2: whole bunch of zips in it, and the zips in
S2: it have the result of the malware. You get a
S2: screenshot of the desktop, you get that person's stored Chrome
S2: credentials for all the sites they visit. You get the
S2: cookies for all the sessions that the browser is logged into.
S2: So all of their consumer apps, you get a full
S2: hardware listing of every app that's running on the infected machine. Yeah.
S2: It's crazy. I mean, I mean, Red line is a
S2: pretty advanced infostealer. So yeah.
S1: Yeah, I saw a thing yesterday. I got it marked for, um,
S1: for the show later. Uh, Russian national Roudometof, uh, just
S1: got captured for the red line. Yeah. And evidently they've
S1: got full source code and everything, and, uh. Yeah, bad
S1: OpSec was, uh, which has never happened before. Bad ops
S1: never happened. Yeah.
S2: Yeah.
S1: I mean, yeah. That's interesting. So. So you just really
S1: like the flow that flare is using here to like,
S1: are they, are they better at going deeper into these forums.
S1: Like what do you think sets him above right? Because
S1: there's a lot of people playing in this space.
S2: Yeah. For sure. So, um, I mean, I don't recommend
S2: a product unless I, I review like kind of the
S2: whole space, right? So, um, you know, like, in another life,
S2: I probably could have been a Gartner analyst or something
S2: like that, you know, but, uh, uh, but yeah, it
S2: is the level at which, um, they go for their credentials.
S2: It's really the research team. They're finding other novel ways
S2: to of surfacing the data that ends up on the
S2: dark web. Um, you know, I'm, uh, I may, may
S2: or may not be aware of a new feature that's
S2: going to launch pretty soon around this whole thing of cookies. Um,
S2: coming out in, uh, in a couple of weeks. But, um,
S2: to help people just. Yeah, in mass invalidate, um, cookies
S2: from B2C companies. Right. So, like, Netflix is a great example, right?
S2: So we could, you know, flare could work with Netflix
S2: and give them a list of all cookies that have
S2: been compromised, and then they can feed that into a
S2: script that will invalidate those sessions. Oh yeah, and in
S2: real time over API too. So, um, so those are
S2: some exciting things. And that's the kind of stuff like,
S2: you know, we talk about internally, they're building quickly, but
S2: it is really the, the depth of the, um, you know,
S2: the threat research or whatever you want to call it, right?
S2: That the team that gets into the forums and, and
S2: the telegrams and the discords is better than any other
S2: I've seen. So, I mean, it's really at the end
S2: of the day for any of those platforms, it's how
S2: deep can they get into the ecosystem. Um, you know,
S2: so bad that, you know, sometimes, you know, we see
S2: people talking about flare on the dark web and like
S2: lamenting the fact that we're, you know, like exposing all
S2: their stuff. So yeah.
S1: That's cool. Yeah, yeah. Uh, what what other stuff are
S1: you thinking about right now? Um, in terms of, like,
S1: malware activity that that, um, flare already catches or you're
S1: looking forward to them catching like other types of, like,
S1: forward leaning malware or attacks.
S2: So exposure of, you know, exposure of, um, malware that
S2: is like infostealer malware or credential stealer malware, um, is
S2: is kind of what flare started with. But, you know,
S2: that's part of a sub, you know, category of threat Intel. Right.
S2: And so like threat Intel includes a whole bunch of
S2: types of IOCs, right. Um, and so over the course of,
S2: you know, this last year and this next year, we've
S2: really been focused on also providing traditional threat Intel or
S2: forum monitoring or brand monitoring for a business when a
S2: campaign might start against them. Or we've been working with
S2: the US government and several branches of government, you know,
S2: tracking even, you know, some high profile threats to the nation,
S2: election integrity, you name it. We're working with big companies
S2: who I can't mention, you know, but AI companies and,
S2: you know, fraud and abuse and AI based on threat
S2: actor like IOCs and recognition. So there's that There's also
S2: we did an acquisition really recently for Attack Surface Management,
S2: which I know you're an expert in. Um, and so
S2: for eternal attack surface management, that'll be something we also
S2: move into offering in 2024 or 2025. Um, and so,
S2: you know, my dream of what I've told flair is that,
S2: you know, I feel like external attack surface, like kind
S2: of this brand monitoring or campaign monitoring on top of
S2: the credential exposure. Um, really great stuff that they do already.
S2: I feel like this can fit into, um, like a
S2: dashboard and a flow of, you know, general threat intelligence
S2: that I think no one else really offers. And I'm
S2: really excited to see when we can put it all
S2: together in, you know, for one, one person to access
S2: it in one place.
S1: Yeah. That's fantastic. So basically, you'd be able to look
S1: at your entire attack surface, see where you have like
S1: exposures or whatever. It's almost like outside in and then
S1: inside out. Right.
S2: Yeah. Yeah. I mean imagine Imagine logging into a dashboard
S2: and seeing all your assets. Everyone that has a login understanding.
S2: If you breach credentials, work on that login, understanding how
S2: to defend against that B2C or corporate app. You know,
S2: invalidate sessions. Also understand, you know, what kind of threat
S2: actors are targeting, which apps on your infrastructure. And you
S2: can do that both externally and potentially internally as well.
S1: So yeah starts to tie in a little bit with
S1: like IAM type stuff where you're just you just understand
S1: all the logins and how those logins work and which
S1: ones are federated, like which ones have or have not
S1: been compromised or whatever, maybe even like which ones haven't
S1: been used, like they might be more vulnerable, you know? Yeah.
S2: I mean, we already have filters for freshness. And you
S2: asked earlier like kind of like how I consume it
S2: since I'm a red teamer. Right? I use the credential
S2: browser feature the most for flare. And so you log
S2: in and you just put in a domain. So like,
S2: you know, unsupervised learning.com or something like that. And then
S2: it just filters down. You know what types of credentials
S2: have been on the dark web for it? So what
S2: do they come from? Breach lists or they come from
S2: stealer logs, or they come from some other chatter or whatever.
S2: And then you get that immediately and you can export
S2: that to just start using. Um, but but yeah, that's
S2: the way I use it. But organizations, you know, obviously
S2: have a more holistic kind of want there as well.
S2: So we're continuing to develop a whole bunch of features.
S2: And you know, my my big pie in the sky
S2: view will, you know, you know we're still working towards that.
S2: The bread and butter has been the, the uh, the
S2: exposure management, um, both GUI and API. Um, and that's
S2: what we've been focusing on for a majority of it. But, um,
S2: you know, we recently, um, you know, extended the team
S2: and hired a bunch of new researchers as well. You know,
S2: there's there's whole areas that, um, we want to get
S2: deeper in and build more features for. So I think that, um,
S2: the sky's the limit, honestly, for for flair.
S1: Yeah. That's fantastic. Now is everything, um, kind of like pull.
S1: You go to the portal to get the latest updates. Like,
S1: what if someone forgets to go to the dashboard, they
S1: just lose their login or they're just busy or whatever?
S1: Is there also, like a push, like notifications or email
S1: or that type of thing? Yeah, we have.
S2: We have full API access. So you could use Chatops
S2: to remind you with a webhook to remind you via
S2: slack or Teams or whatever you use at your organization.
S2: In fact, a lot of really forward facing companies are
S2: using Chatops to do this kind of stuff, right? For
S2: a lot of security data, not just us, but, you know,
S2: for everything, right? Where, you know, you log into slack
S2: in the morning and there's a whole channel that would
S2: be like flare ops or something like that, and it
S2: gets pushed like here, the new, you know, six credentials
S2: that we found between the time you went to sleep
S2: and the time you woke up and you know that
S2: that have appeared on the dark web, here's where they
S2: come from, you know, and then you can add that
S2: to your teams, you know, um, list to check to
S2: see if those sessions have been compromised or whatever. So.
S1: So I know you're doing a whole bunch in AI
S1: as well. And AI automation on the Arcanum side. Have
S1: you all been thinking about any sort of chatops sort
S1: of optimizations, like something drops into the channel? Can we
S1: actually go in and validate that credential or something? Yeah.
S2: So that is usually in the, in the B2C kind
S2: of world, like like a Netflix or an Amazon or
S2: anything like that, right. Um, that is usually up to
S2: the client, you know, to, to implement. Right. Because each
S2: app is different. And we would have to know, you know,
S2: kind of the general app login flow. So usually that
S2: part is left to them. But for the for the
S2: corporate logins, you know, where a lot of people need
S2: to log in via an identity provider or SSL or
S2: something like that, that is more easily for us to find. And,
S2: you know, maybe in the future that could be something
S2: that we offer an automated service for, you know. So, um,
S2: testing the credentials of.
S1: An agent there, listening, watching that channel, taking actions. right?
S2: And it could easily be done with some of the
S2: AI that exists right now. Honestly, it's just, uh, you know, like, um,
S2: I think that a lot of people I mean, the
S2: features we have right now in the platform for AI
S2: are more based around translation and correlation of data. So
S2: we do have an AI agent that's built into flair.
S2: And so when you go into any of the views, um,
S2: first of all, the first great thing about it is
S2: let's say you're dealing with a threat actor post that's
S2: in Russian. Well, you know, I can translate your ROI,
S2: which is called, I think it's called Alexandria internally we
S2: call it. But, um, it can it can translate that instantly.
S2: So you can read the context of the conversation, um,
S2: about your company. And then it can also tie together
S2: disparate sources of information, whether something showed up in a
S2: steamer log. And then there's also conversation about it in
S2: a forum, conversation about it in a chat channel, you know,
S2: something like that can tie those things together. Um, so
S2: those are, those are all things that, you know, were
S2: the first really easily automatable things. And then we're going
S2: to continue to, um, to deploy, I'm sure more and
S2: more AI features. Yeah.
S1: Yeah, that makes sense because I mean, it's kind of similar. Um,
S1: threat Intel is kind of similar to vulnerability management. It's
S1: like you do the cool thing, which is you surface
S1: this thing. But then on the other side of the threat,
S1: Intel and the other side of the vault management is fix, right?
S1: Take the action. So I could imagine, like we were saying,
S1: some sort of agent that sits there and is like
S1: it's hooked up to Jira, it's hooked up to these
S1: different control systems. It can actually push ACLs, you know,
S1: invalidate credentials, stuff like that. But, um, it's also early
S1: days for AI, so you don't want to be hooking
S1: up too much power for AI on production systems, right? Yeah.
S2: I mean, definitely a double edged sword, right? Like for
S2: every AI feature you put out has to be tested
S2: against a multitude of things, right? Um, yeah. So. Yeah, definitely.
S1: Yeah, totally. Um. Well, not going to let you get
S1: off without talking about Arcanum. What are you doing over there?
S2: Yeah. Yeah, absolutely. So, uh. So Arcanum is my company.
S2: The name comes from a fantasy book that you and
S2: I have both read. But if anybody else hasn't read it, uh,
S2: name of the wind is probably one of the best
S2: fantasy books of our generation. And, um, The Arcanum in
S2: that book series, which doesn't have a conclusion yet, which
S2: is really sad. Um, is is the school of magic.
S2: And so, uh, you know, we're we at Arcanum do
S2: a ton of training. So we have two classes. One
S2: is an offensive security based course. Uh, and it's my
S2: 20 years of experience in doing penetration testing and web
S2: app hacking through bug bounty. Um, and so it's my
S2: experience there, uh, high focus on reconnaissance and some Osint stuff,
S2: some red teaming techniques, and then also just a lot
S2: of web hacking. Um, and it's, that's a three day
S2: course that we run. And so that was the first
S2: thing that we launched Arcanum for, was that training. And
S2: then shortly after that, this year we launched an AI training.
S2: But it's not a how to hack AI training. It's
S2: a how to use AI in your security role training.
S2: And so we call it red blue, purple AI. And
S2: and that, you know, that training basically is teaching people,
S2: whether you're a red team or a blue team or
S2: a purple team or how to scale yourself, um, you know,
S2: with AI and so that's a two day course. And then,
S2: you know, usually, I mean, just being honest, we're very
S2: small still early days, but, um, but, you know, usually
S2: we'll do those trainings. And what will happen is, you know,
S2: someone will be like, oh, that was excellent. Can you
S2: come do some consulting for us? Whether they want us
S2: to do their red team or a purple team engagement
S2: or a pen test or, you know, do some AI
S2: consulting and then, um, so we'll do custom consulting too, um, for,
S2: for a lot of places.
S1: Yeah, yeah. And I can say for myself, I've, I've
S1: attended both and they were absolutely fantastic. Honestly, I think
S1: you're the best trainer in security. Oh, I know, I know,
S1: we're best friends, so, like, I'm going to be biased, but, um,
S1: I think I'm good at being objective. And I really
S1: think you're the best trainer in security, so thank you.
S1: Encourage people to check that stuff out. Yeah. Um, yeah.
S1: And the I class was absolutely fantastic. Even better the
S1: second time. Just absolutely loved it.
S2: Yeah, I think I think I learned a lot from, um, well,
S2: from you and some other people too, about creating very
S2: fresh content. Right. So, um, you have augmented, which is
S2: an AI course that focuses on more than just security. Um,
S2: but I think what I learned is that there is
S2: a craving for training that stays up to date. Right?
S2: Because like a lot of the training organizations that exist
S2: right now, they just create a training and then it's
S2: out there and then they never update it. Right. And
S2: security and I move so crazy fast and it's like
S2: it's like, okay, so by the time you take that training.
S2: A lot of the tools are outdated. A lot of
S2: the methodologies are outdated, especially in the AI. Like AI,
S2: AI by far is like, you know, every class I teach,
S2: which is once a quarter live, I have to basically
S2: re dev the whole class because there's new, you know,
S2: advents in prompt engineering, there's new advents in rag, new
S2: advents and agents, all that stuff. And so I think
S2: that's what makes my trainings different than other people's. Right. Um, because,
S2: you know, I'm doing that. And then also, I think
S2: one of the crazy cool things was while cohort one,
S2: you were in, um, as a guest. And so in
S2: all my courses, whether it's the offensive security one or
S2: the AI one, every day I bring in 1 or
S2: 2 guests who offer either like a different viewpoint than me,
S2: or who are specialists even above me in some cases.
S2: And we will talk for about 30 to 40 minutes
S2: as like an interview included in the class, and I
S2: will ask some very hard questions to them that only
S2: you know, like that only really like a homie would
S2: give you the answer to in a small group setting,
S2: and I think that has also made the classes great.
S2: So like last one in the offensive security class, we
S2: had Sam Curry Zls come on talking about his hacking methodology,
S2: and he's the guy who just did the big Kia
S2: hack with his group of, you know, hackers, which was
S2: Ian Carroll and some other people too. We've had some, uh,
S2: subs come on, Shabaam Sha. And he talked about, uh,
S2: like pretty hardcore reconnaissance methods that weren't talked about anywhere else.
S2: And so luckily, I know people. You came on cohort
S2: one and talked about your philosophy for agents flows and
S2: everything like that. Um, from, you know, from augmented. But
S2: you gave away some secrets there too. So that's how
S2: I like to run a class. Like it's like a small,
S2: intimate group. And yeah, it does.
S1: It feels extremely close knit and intimate. And after like
S1: the second hour and definitely after like the first day,
S1: you feel close with all the other people because it's
S1: a very sort of welcoming thing, like it's just discussion
S1: happening and everyone's listening to you, but it's also just
S1: a yeah, it's just a really good vibe. It's the
S1: best training vibe. And I've been taking sand since, you know, whatever,
S1: early 2000. And it's like it's the best training vibe
S1: I've ever seen.
S2: Yeah, I think, I think one of the cool things
S2: too is that like, um, I don't ever consider myself
S2: that I'm going to be the absolute master. I think
S2: overall my methodologies and the structure of the training is
S2: very well put together. But if someone comes in chat,
S2: you know, for one of the courses and is like, hey,
S2: have you thought about this thing? You know, sometimes we'll
S2: divert and look into like a new tool or a
S2: new piece of methodology right in the class and you know,
S2: you can't get that anywhere else. Um, so, so I
S2: think that vibe is I'm never going to consider myself
S2: the ultimate expert in that vibe is helpful for people
S2: who also come to the course and are experts. So.
S1: Yeah, totally.
S2: Yeah.
S1: Awesome. And, uh, what is next for flair? Like you
S1: talked about? You hinted at a few different things, but
S1: what do you see happening? Like you talked a little
S1: bit about your pie in the sky version of mixing
S1: like C10 and all the different stuff altogether? Yeah. And
S1: any features that might be coming out end of the
S1: year or first part of next year.
S3: Yeah.
S2: So I think that's, um, I actually don't know what
S2: I'm allowed to talk to you about, but hopefully it's fine. Uh, is, uh,
S2: is there's going to be some new features, um, around
S2: cookie exposure because a lot of people are getting really,
S2: really great at, uh, mitigating breached credentials, but less good
S2: on the cookie exposure stuff. So some APIs there that'll
S2: help you track cookies which are fresh, which have been
S2: exposed via malware campaigns or a whole bunch of stuff.
S2: Right now, we focus a lot on the stealer log data,
S2: but we're starting to focus more and more on career
S2: phishing campaigns by threat actors. Um, and taking that too, right?
S2: Because the two methods that adversaries use to steal your
S2: creds and cookies, one is stealer malware. They'll get malware
S2: on your machine. Some bot somehow, either via drive by download,
S2: you download a torrent, your kid downloads a Fortnite, you know,
S2: X or something like that, you know, or you get
S2: spear phishing with credit capture and cookie capture in the
S2: middle right, which is predominantly what red teams do. This
S2: is what I do in my campaigns, right? We'll set up,
S2: you know, something like Evil Jinx and fake an Okta portal,
S2: and then phish all your people, and eventually they will
S2: log in with credentials and will capture both the credential
S2: and the cookie. So that's the same thing bad guys do.
S2: I think the stats are, you know, it's like 54%
S2: of initial access for breaches. Is them just buying a
S2: cookie from stealer malware. And then 33.8% is still phishing
S2: these days to do to do credit capture. Um, I'm
S2: looking at the CSA stats that I had in a
S2: browser window over here. So, um, yeah, so we want
S2: to get more into that data as well. We do
S2: some of it already, but we want to get even
S2: better at it. Um, and then yeah, more traditional threat
S2: Intel features coming for flare. Um, and better visualizations, better dashboards,
S2: better filters like these are all things that, you know,
S2: are table stakes for a threat intelligence platform. Um, and
S2: then we haven't we haven't implemented yet a ton of
S2: the attack surface. We just, um, you know, uh, Nick
S2: Ascoli is one of the guys that we purchased his, um, ESM, um, product.
S2: And so we haven't implemented a ton of it yet. But,
S2: you know, over 20, 25, we're going to implement a
S2: ton of it. And then like you said, it bleeds
S2: into vulnerability management too, right? So at what point do
S2: you know, at what point do companies like us or
S2: even other ESM companies what at what point do they
S2: consider exposing vulnerability information like, you know, doing scanning of
S2: some sort for vulnerabilities, you know, and including that in
S2: the visibility? Because at the end of the day, as
S2: a consumer of something like this, I really don't like
S2: to be logging into so many disparate platforms. Right? I
S2: would love all of this to be in one place. Um, but, um,
S2: you know, no one's no one's perfected that out. Everyone's
S2: trying it, but no one's perfected that yet, so.
S1: Yeah, that makes sense. Um, cool. Well, where can people
S1: learn more about flare?
S2: So if you go to the main flare page, there's
S2: a free trial. This is also something that made it
S2: really easy for me to benchmark them. Was that flare
S2: actually offers a like a free trial. Anybody can sign up.
S2: They just have to be approved by, you know, a
S2: flare representative internally for legitimate use. But, um, yeah, flare
S2: was the only one that was easy to access and
S2: really start taking off. Um, so I think that, um,
S2: you know, our wonderful staff gave you a link, um,
S2: in the doc, but I don't have it in front
S2: of me. So do you have the free trial link?
S3: I do, yeah.
S1: So it's trifler.io/unsupervised learning, and. Oh, there you go. Free
S1: seven day trial.
S3: Oh, awesome.
S2: So that's even better than the regular free trial. So yeah.
S3: Yeah. Okay.
S1: Very cool. And where can people learn more about Akana?
S2: So Akana, our our website is Arcanum. Arc. Arc. Arcanum. Arc. And, um. Uh. Dash. Sex.com. Um.
S2: And then, uh, you can follow me on Twitter. I'm
S2: AJ Haddox and so I'll talk about all this stuff
S2: randomly on there.
S1: Awesome, man. Well great conversation. So glad to have you
S1: on the show and, uh, talk to you soon.
S2: Awesome. Thanks, man.
S1: Unsupervised learning is produced and edited by Daniel Miessler on
S1: a Neumann U87 AI microphone using Hindenburg. Intro and outro
S1: music is by Zomby with a Y, and to get
S1: the text and links from this episode, sign up for
S1: the newsletter version of the show at Daniel Missler Comm
S1: Slash newsletter. We'll see you next time.