S1: In the standalone sponsored episode I speak with Ismael Valenzuela.
S1: Ismael is the VP of threat research and Intelligence at
S1: BlackBerry silence. We talk about modern threat intelligence, the shifting
S1: attention of attackers, how JNI can be used for attacks.
S1: How defenders are adapting to deny threats. And many other topics.
S1: And with that, here is the conversation with Ismael Valenzuela.
S1: All right. Hello. Welcome, Ismael, to unsupervised learning.
S2: Thank you. Thank you, Daniel, for having me.
S1: Yeah. Perfect. So I will have already introduced you. I
S1: just want to get a brief, uh, sort of overview on, uh,
S1: on yourself and and how you got into security and, uh,
S1: what you do there at BlackBerry.
S2: Sure. So I've been doing, uh, well, cybersecurity since, uh,
S2: it was called, uh, something different, right? Information security. We
S2: didn't call even cyber back then, but I started to do, um,
S2: you know, cybersecurity related things back in 98, 99. And
S2: I founded, uh, a company, a consulting firm doing, uh,
S2: information security in at the end of 2000, beginning of 2001,
S2: in Spain. That's, uh, where I come from. I moved
S2: here to the States about ten years ago. But, yeah,
S2: I've been doing cyber security for, I guess, like 24 years.
S2: And what I do for BlackBerry is, uh, I lead
S2: the threat research and intelligence team. So essentially I lead, uh, uh,
S2: a team of, uh, very smart people that they not
S2: only understand, uh, you know, the malware. I like to
S2: talk about attackers weapons more than just like malware. Just
S2: this just one subset of it. Um, I understand these
S2: these attackers weapons, but they also understand the motivation. They
S2: understand the geopolitics around, uh, you know, why attackers started
S2: doing something. And that's more like what we call the
S2: intelligence piece, right? So we cover all the aspects from
S2: the more technical, the reverse engineering, the malware analysis, the, uh,
S2: you know, helping to tune our machine learning models. I
S2: know that your show is, you know, mostly about that.
S2: So we, we, we work with the data scientists to
S2: make sure that we, we tune these models for our products.
S2: But we also, um, you know, do research on the
S2: threat actors and their motivations.
S1: Yeah, it's it's very interesting you say that the name
S1: implies that I'm mostly about machine learning. It's actually kind
S1: of a play in words. My background is actually almost
S1: exactly 24 years in security. So about the same time. Yeah. Yeah.
S1: So so it's not uh, it wasn't originally I my
S1: whole career has been in security and then I sort
S1: of transitioned into AI. So I think we probably have
S1: a lot to talk about there. Um, I think it's
S1: the right framing because I like to think about what
S1: are the attackers doing, what techniques are they using and
S1: inside of what context like global context, like you said, uh,
S1: geopolitical context. And that's why I find threat intelligence so fascinating.
S1: And yeah, maybe we can sprinkle some AI in there, but, uh,
S1: not necessarily if it doesn't belong. Right. Um, so so
S1: what would you say the, the primary things that are
S1: happening right now, what are the trends like what are
S1: attackers doing? Why are they doing it? Who who are
S1: these different groups. What does that look like?
S2: Well, I guess if I had to summarize it in
S2: just one phrase, it's like the internet is a mess. Mhm.
S2: It's a lot of everything and there is more of
S2: everything on a daily basis. Um, we, we do this
S2: quarterly thread reports. Uh, that they're very interesting for us specifically. Right.
S2: And we, we're thrilled when we see, um, you know,
S2: law enforcement agencies and uh, we even got like, you know,
S2: United Nations and the Senate and a lot of other like, uh,
S2: very important, you know, organizations coming to us and saying, oh,
S2: you know, we're reading your third report and it's very awesome. Like,
S2: we have these questions which, you know, it's fascinating, but
S2: we do this primarily for us to understand the trends.
S2: And one of the things that we just, uh, see
S2: regularly is that there is a, uh, the regular constant
S2: increase in the number of unique malware that we see, uh,
S2: on a, on a per minute, right. So, for example,
S2: I'm just looking at the last listings we have. Uh,
S2: if you look at where we were about a year ago,
S2: we were seeing from December 2022 to February 23rd, 1.5
S2: unique hashes per minute. That's what we see with our telemetry, right?
S2: Based on our products. And right now, the last number
S2: I have is about 3.7 unique hashes per minute. Mhm. Uh,
S2: targeting uh targeting you know our customers. Right. But it's
S2: obviously everybody has different visibility, different angles. Uh, but this
S2: definitely tells you that there's a lot more, there's a
S2: lot more of unique malware that is being thrown out
S2: there to organizations per minute. What else do we see?
S2: I usually say attackers are lazy, right? When? When something works.
S2: Why would you change it?
S1: Yeah, absolutely.
S2: In many cases it's a business for them, right? If
S2: we're talking about cybercrime, uh, so we still see a
S2: lot of old school stuff like the phishing attacks. Right. Uh, with, uh,
S2: you know, embedded, uh, links or embedded, uh, PDFs. We're
S2: seeing a lot of PDFs again, like these things coming.
S1: Oh, interesting.
S2: Come and go. Like, we haven't seen PDFs for a
S2: long time. Now we're starting to see a lot of
S2: PDFs again. And this usually has to do with, you know,
S2: maybe some defenses that Microsoft has built into, uh, into
S2: office lately that, you know, maybe sometime it will be
S2: bypassed again and there will be a resurgence in, you know,
S2: maybe macros or, uh, or other weaponized, um, uh, office documents.
S2: And we also see a clear trend in the use of, uh,
S2: cross-platform malware. Again, with this premise of attackers. See if
S2: I can obtain more return on investment by crafting a
S2: piece of malware that will will work across different platforms windows,
S2: Linux and Mac OS by using, uh, you know, uh,
S2: go or, you know, rust or other, um, cross-platform languages.
S2: I'm going to be doing that. Right, because I'm going
S2: to be able to reach out to a larger, uh,
S2: population or get more victims. So there's just like, you know,
S2: a brief summary of 50,000 foot overview of some of
S2: the things that we see.
S1: Okay, that that makes sense. Yeah. I'm looking at the report.
S1: I pulled it up when you mentioned it. Uh, interesting.
S1: And you got some breakdown by industry as well.
S2: Yeah, I'm showing, by the way, some numbers that haven't been,
S2: you know, published yet at this time that we're having
S2: this conversation, but we publish very soon. So yeah, I'll
S2: give you a heads up on that.
S1: Yeah. Very cool. What about like, origins or types of attackers, like,
S1: you know, hacktivists versus like a government versus, you know,
S1: I don't know attacker types. Is it like is it
S1: Eastern Europe? Is it Asia? Is it us versus us
S1: like those types of things?
S2: That's that's a good question. And again, like if you
S2: look at this from a global perspective, unbiased perspective, you're
S2: going to see that everybody's attacking everybody right. Everybody has motivation.
S2: And cyber is just a weapon. It's just the how right. Uh,
S2: but this has been done. If we look at governments,
S2: for example, this has been done for many years, uh,
S2: you know, in other areas. And it's still, you know,
S2: done in other areas. And that's why there is not
S2: only like cyber threat intelligence or CGI, but also human intelligence, right,
S2: or open source intelligence and, you know, physical threats. And so, um,
S2: but from a, from a CTI perspective, Cyberthreat intelligence, uh, we,
S2: we have seen, you know, in the past that there
S2: was a clear distinction between the so-called apts, the advanced
S2: persistent threat nation, uh, states, um, attacks where the motivation
S2: is stealing intellectual property or doing espionage. And, and then
S2: the other world on the other side of the spectrum, right,
S2: which is cybercrime. So this is the criminals are just
S2: going after the money for financial gain.
S1: Yep.
S2: Um, and then the hacktivists. Right. That's kind of the
S2: other group, uh, the people that are just like going
S2: to hack into a company. And just because I don't know,
S2: you sell, you make profit by selling records or music
S2: and that's bad, right? That's evil. Right? Like that. Um,
S2: they want to make a statement, right? A political statement
S2: or socialist statement. These lines are more blurred than ever. Uh,
S2: one of the reasons of that is because we, um,
S2: we're more interconnected, right? And everybody has more of a
S2: digital presence. And also because these weapons that attackers are
S2: using in the past were like hard to craft or, uh,
S2: it require a lot more skills maybe to do these
S2: things these days. A lot of these are public, right.
S2: And there's been a lot of, uh, red teaming tools
S2: that have been leaked. Cobalt strike is one of the
S2: common offenders, right. In that in that list, uh, but
S2: also Metasploit, a bunch of other frameworks that are frameworks
S2: are open, uh, they're available that people can just like,
S2: go and modify. There's a lot of rats. One of, uh,
S2: the rats, the remote access tools that we have been
S2: discussing in one of our recent reports is a zinc rat.
S2: And anybody can go online and just look at the
S2: source code of a sink rat and then maybe modified
S2: and use it, uh, for these, uh, nefarious purposes so that, um,
S2: availability of these tools, attackers, weapons. Right. Makes it a
S2: lot more difficult because sometimes you may have an apt
S2: a nation state using these tools. And it's very hard
S2: to attribute exactly who's behind this unless you have more information,
S2: you know, you have context, geopolitical context in many cases,
S2: and you can understand the motivation behind why somebody is
S2: doing this.
S1: Yeah, that makes sense. So it's all kind of blurring together.
S1: I've seen that a lot with a lot of Russian
S1: groups where someone was like, oh, apt related or whatever,
S1: but really it's kind of like a cybercrime group, but
S1: they are kind of given a little bit of a
S1: go ahead by the government to not come after them
S1: because they seem to be doing good things for the country,
S1: but it's not a formal relationship. So it's like, are
S1: they affiliated? Are they not affiliated? It's it's hard to say.
S2: Right. You have initial access brokers now, right? You have affiliates, uh, contractors.
S2: Like I could be an independent contractor and offering my services. My, uh,
S2: you know, my skills, my time, uh, on behalf of
S2: different groups. And one day, I could be working for
S2: a cybercriminal group that has financial gain. The next day,
S2: I could be working as part of a, um, you know,
S2: maybe a nation state or some other type of, um, uh, group.
S2: We have also seen and this is a trend that
S2: we've seen recently, commercial organizations behind some of these campaigns. Um, and,
S2: you know, large multinationals that that might be in the
S2: process of a merger and acquisition and, you know, there's
S2: the traditional way of doing a due diligence, uh, by
S2: looking at, you know, the financial health of an organization
S2: that is also like unofficial ways of doing due diligence. Sure. And, uh,
S2: it's interesting we're seeing some of that. Uh, so when
S2: I say that the internet is a mess, it's it
S2: really is.
S1: Yeah. Interesting. And what are some of the specific techniques
S1: or tactics that people are using? It seems like with,
S1: with proliferation of AI, it seems like spearfishing is one
S1: of the things that's getting really easy, really easy to
S1: target specific people, especially if you put in a whole
S1: bunch of context information about a particular target. You can
S1: really make the email compelling. One of my favorite examples
S1: of this is somebody who just, uh, has a big ego.
S1: I don't know, sometimes happens in security, but you could
S1: just be like, hey, I saw your last talk. It
S1: was amazing, right? I really agree with your point about this.
S1: And I wrote an article about your talk and I'm
S1: going to. Actually send it on to the New York
S1: Times or something. You send that in a phishing email,
S1: like you're going to get a lot of security people.
S1: And it's one thing to handcraft that email, right? But
S1: that's pretty difficult. But what if you have a crawler
S1: who can pull all the security people and then pull
S1: all the people who have given talks recently, then you
S1: could pull a particular point out of the talk and
S1: then craft the email and send it to them. Well,
S1: now you can maybe do that at scale, you know,
S1: at the level of like a criminal organization or even
S1: at the level of like an apt group for like
S1: government to target more important people. So I feel like
S1: that is one of the use cases that's getting really bad.
S1: Are you guys seeing a lot of spear phishing type stuff?
S2: Well, we have seen reports right over the last couple
S2: of years of a specific threat actors. I'm thinking, for example,
S2: North Korea, that that has been involved in this type
S2: of targeting, cyber security researchers specifically, uh, specifically working for
S2: certain companies that may have access to certain information that
S2: might be useful for, for them. Uh, but, yeah. And and,
S2: you know, we have actually data that supports what you're saying.
S2: For example, uh, in our report, uh, the report that
S2: we released, uh, a few months ago, we again, we
S2: do this every quarter. Right. But we have seen an
S2: increase since last year, coincidentally or not, with the release
S2: of ChatGPT and all these, uh, generative AI tools, we
S2: have seen a surge in phishing attacks against Japan. And,
S2: you know, Japan is a very interesting, uh, area because
S2: we usually see some malware in Japan that we don't
S2: see in other places. Again, everything is is every region
S2: has like, their own characteristics. Right? But in Japan we
S2: have seen like for example, uh, Emotet, some variants that
S2: we haven't seen anywhere else. And, you know, they come
S2: and go. But now with these tools, guess what? Like,
S2: everybody can speak fluent Japanese, right? Yeah. And Japanese is
S2: not really easy, right? At least for for us foreigners.
S2: And it's just a very particular region of the world. Now,
S2: these has opened up the possibility of any threat actor
S2: out there to craft really, you know, legit looking, uh,
S2: phishing emails to, to target this specific area of the world,
S2: which is also, you know, a wealthy country with a
S2: lot of industries and could be profitable. So, yes, the
S2: data supports that attackers are using generative AI for these
S2: type of, um, purposes.
S1: Yeah. It's a really interesting point that you make. So
S1: you've probably seen this conversation a million times in your
S1: career because you've been doing this so long. It's like
S1: somebody talks about how, you know, you can't hack Linux.
S1: Linux is the most secure operating system. Windows is so insecure.
S1: And I'm guilty of this. Back at, you know, 20
S1: years ago, I used to think I was on the
S1: most secure operating system because I only run Linux or
S1: I only run whatever. And it's like, actually, if people
S1: actually pointed a little bit of the attention that is
S1: pointed at windows for the last 20 years, and they
S1: pointed that at Linux it would be a nightmare. It
S1: would be an absolute nightmare. And the reason windows appears
S1: to be so bad because it's so targeted. And so
S1: the point that you bring up about Japan is really interesting.
S1: It's like maybe they're very vulnerable to spear phishing, but
S1: no one's been able to get the email through because
S1: they don't speak Japanese. So now you have an area
S1: that's not hardened against these types of attacks. But the
S1: door is now open where it was closed for the
S1: last 20 years.
S2: It's a window of opportunity. Right. And that's that's one
S2: of the key things in the whole impact equation. If
S2: we look at risk management oh now we're going to
S2: put people to to sleep. Now risk management.
S1: Not me I'll be awake.
S2: But uh but yeah the impact right at the end
S2: of the day it's all about that. You can usually
S2: say you can just like, try to protect against everything
S2: you need to define. What is that? What is the
S2: problem you're trying to solve. Right. And it can't be everything.
S2: You cannot protect all of your assets. Um, like in
S2: the physical world, you have to assume, okay, you know,
S2: some things can go and it's okay. You just, you know,
S2: go and replace them. But other things can't, right? Because
S2: they have a high value to us. Yeah. Uh, that's
S2: what we need to, to define and. Yeah. Linux. Uh,
S2: I remember a couple of years ago we released a
S2: paper on symbiote, which was a Linux implant that we
S2: saw targeting organizations in Latin America, especially financial organizations. And
S2: it was a very interesting piece of software, right, of
S2: malware in this case, uh, doing command and control over DNS, etc..
S2: We see a lot of web shells right on Linux, uh,
S2: servers essentially, um, uh, program, um, programs that are supposed
S2: to run, uh, commands or do execution on these, uh, boxes.
S2: And think about it like the cloud. What is the
S2: cloud made out of, right? Linux box boxes. Yeah, yeah.
S2: And and we have everybody has more cloud presence. So absolutely.
S2: I had a conversation a few days ago about the
S2: importance of looking at these, uh, systems. You know, miter
S2: has a miter attack matrix for Linux. And, uh, if
S2: you look at the government, uh, agencies, the documents, recommendations
S2: from NSA, from CSI, everybody says, you know, you need
S2: to look at these, uh, systems because they're often overlooked.
S2: People do not run endpoint protection on them. And, you know,
S2: you trigger memories. Uh, I'm probably all right. But you
S2: probably remember this when setting up Linux systems back in
S2: the day. And all ports were open by default.
S1: Oh, absolutely.
S2: You have to close them like manually. Yeah. Uh, so
S2: there's a lot of implicit trust that sometimes we put into,
S2: into these systems making assumptions that are not necessarily true. Yeah.
S1: Yeah. I just I really love that idea of, um,
S1: language being a barrier that has stopped attacks from getting
S1: through before and with Lmms open opening up. Translation. So
S1: that barrier comes down. What about, uh, deepfakes? Are you
S1: seeing much around that where it's easier to convince people
S1: of things?
S2: Well, it's a natural next step, right? And I remember
S2: months ago I was in a close meeting with some
S2: government agencies and, um, the head of this agency who
S2: was mentioning that they were really seeing these type of
S2: deep fakes, uh, with, uh, you know, calls, uh, where
S2: they were imitating the voice of somebody and using that
S2: to essentially for financial gain. Right. The typical business email compromise.
S2: But now with with voice. And that's what we're seeing
S2: on the news right now. We're seeing these, uh, deepfakes
S2: using voice, using video, like jumping on a on a
S2: zoom call. Oh, it's it's a CFO calling.
S1: Yeah, I saw that one. That was so crazy.
S2: Exactly. And, uh, it's just, again, one more iteration on, um,
S2: something that we have known for a long time, you know,
S2: same motivation. Just the tools are changing. And with the, um, the, the, uh,
S2: democratization right, of these tools, as they become more available
S2: to people out there, these things are going to just,
S2: you know, make the environment, the internet, even a lot more, uh,
S2: noisier than they are. It is today.
S1: Yeah, absolutely. And then you have the issue of, like,
S1: if you have a whole bunch of AI bots or
S1: agents operating and they're, they're taking all these actions against APIs,
S1: how how do you know if it's a real human
S1: on the other side, or if that's automation or it's
S1: AI or it's an agent or some sort?
S2: That's a good question. And that's actually one of the
S2: the uses of, uh, of email. Right. One of the
S2: best things that we can use ML for is to
S2: create patents. And, uh, by looking at the behavior of, uh,
S2: the normal behavior of a, of how users interact with
S2: an application, uh, you would, you know, kind of, uh,
S2: infer whether that's normal or not, because typically these botnets
S2: will behave in a, in a different, in a different way. Um,
S2: as usual, you know, it's we usually talk about attackers
S2: tools or attackers weapons. Sorry. And I like to talk
S2: also about defenders weapons because, you know, this is at
S2: the end of the the day, we're talking about technology
S2: that can be used for good or for evil. And
S2: many times we just focus on on the tools itself.
S2: But we don't talk that much about strategy. Right. Um, uh,
S2: somebody that has been doing this for a long time,
S2: I started on the what we call the red side. Right.
S2: The red teaming.
S1: Yep. Same here.
S2: Hackers and pentesting and all of that. I'll tell you
S2: what you got boring. You got at some point where
S2: it was boring because it was easy to get into
S2: the organizations.
S1: And you come back to the customer the next year
S1: and they haven't fixed anything.
S2: They don't care. Yes we know. Yeah. For a water
S2: plant in a, you know, country in Europe, I'm not
S2: going to say more. And uh, I, I joined, you know,
S2: I connect to the network 9:00 and by noon I
S2: already had local admin and one of the boxes that
S2: control the OT environment. Right. So that's it. At that point,
S2: you know, you're a consultant. What do you do? You
S2: write the report, take screenshots, do everything. I create my
S2: own local admin account right on that box. So I
S2: was called six months later to come back and do
S2: a retest. Hmm. Guess what? The first thing I checked
S2: is that is that my user, you know, is still
S2: there on that box.
S1: Oh, yeah. Nice. Nice.
S2: Six months later. So that's that was probably the defining
S2: moment for me when I was like, you know what,
S2: I need to I need to help these people in
S2: a different way. So that's when I moved to the
S2: cyber defense side. And I find fascinating to talk about
S2: several different strategy because, you know, you cannot fight these
S2: people because at the end of the day, the other
S2: side of the spectrum is not AI, right, or bots.
S2: It's people doing this. You cannot fight that with just tools,
S2: with just products, right? You need those. You need the weapons,
S2: but you also need the strategy, the human brain to. Yeah.
S2: And what you're doing and justify why you're doing something
S2: and change tactics if needed. Right. Like in any sports
S2: game you get to, you get to change tactics. If
S2: they're not working. Yeah.
S1: Yeah. Interesting. You mentioned a water plant. I had an
S1: eye opening assessment as well, assessing a water system for uh,
S1: for a state. Um, yeah. Really really interesting. We seem
S1: to be, uh, brothers. También hablo espanol.
S2: So también si si si podemos seguir en espanol. Si quieres. Si.
S1: It won't be very smooth.
S2: Uh.
S1: My vocabulary is bad, but you'll play though. Um, so
S1: what about supply chain attacks? Are you seeing that or
S1: do you have that stuff in your, uh, in your report?
S1: Is it one of the things you talk about, like, like,
S1: essentially it seems to be getting worse and worse like these.
S1: The breaches keep happening and you keep realizing, oh, wait,
S1: but they're vendors. Oh, but what about their vendors? And
S1: it's like, how do you secure the chain all the
S1: way down?
S2: Yeah. No, absolutely. And I think we have a. We
S2: have a paragraph there or a comment on, on these uh,
S2: in the, in the latest report that we're publishing. Um,
S2: and we talk about the secure by default approach, rather
S2: the government, especially here in the US with the, uh,
S2: executive order, uh, they're trying to push for these, right?
S2: Cisa pushing for these as well, especially with, um, you know,
S2: protection of critical infrastructure. So, so important. But other countries
S2: as well, the United Kingdom, Canada, EU, the G7, they're
S2: all issuing guidelines on, on, uh, on on this topic
S2: of like creating secure software. But but here's the thing.
S2: Are we ever going to fix that problem? No. There's
S2: always going to be something. Right? Can we do something
S2: to fix it and use, you know, you know, for example,
S2: programming languages that make better use of memory. Yeah. So
S2: we have less buffer overflows. Yes. Absolutely. Right. Technology is
S2: going to help there. But we're never ever going to
S2: end up creating like 100% secure software because there's no
S2: such a thing in the world. Right? There's no 100%
S2: secure with anything. Yeah. Um, but so that's, that's what the,
S2: the laws and regulations are pushing for in my team as, as,
S2: you know, researchers, uh, what we do is to analyze
S2: what we, what we're seeing out there. And what we
S2: see is attackers obviously doing the supply chain attacks in
S2: the SolarWinds style. This is like very highly targeted attacks
S2: that we don't see on a daily basis. Right. Mhm. Um,
S2: but you also see. Like pseudo supply chain attacks. What, uh,
S2: what we see is, uh, for example, imagine these small.
S2: Company in. I'm going to pick a, I don't know,
S2: another region of the world that say, the Nordics write
S2: something about language. Uh, so you have, you know, Finnish
S2: and Swedish and Danish and not a lot of people
S2: out there in the world speak these languages. So there
S2: is this little company out there that they have this freeware. Right.
S2: And it's a dictionary of, uh, Nordic, you know, terms,
S2: something like that. And a lot of companies that want
S2: to do business with the Nordics, they actually download this
S2: freeware software. So let's put the bad guy hat on. Right. So, uh,
S2: if I want to target these organizations, what do I do?
S2: Very simple. I just either attack this website and replace
S2: that freeware dictionary with something else that is, that has
S2: an extra piece of code in it, right, to compromise
S2: these organizations that are going to be downloading it. Or
S2: I try to, um, um, essentially clone that side, right?
S2: Scrape it, clone it, and instead of, uh, Nordic. Dictionary.com
S2: is Nordic. Dictionary.com. Yeah. And or Nordic. Uh, hyphen dictionary.com.
S2: And I'm going to be, uh, cloning all of that.
S2: And I'm going to be serving this type of dictionary
S2: that has this extra code. We see that a lot. And,
S2: you know, through emails now we get the phishing factor
S2: right through or any other type of communications. Hey, download this,
S2: use this little thing. Uh, now we're targeting specific location
S2: specific region. It's not really a supply chain attack as we,
S2: you know, think of it, but there's a lot of that, uh, happening.
S1: Interesting. And where do you see these attacks sort of going,
S1: I guess involving AI or not involving. I guess it's
S1: probably the biggest switch. So what happens with threat intelligence
S1: when both the attacker and the defender are powered with AI? Like,
S1: does everything get faster, like the window for attack and
S1: the winter window for fixing things? Uh, closes faster? Uh,
S1: what do you think?
S2: You know, that's a that's a good question. And from
S2: a technology perspective, I like to assume that everybody has
S2: access to the same. Right. Um, it's just a matter
S2: of how well you can implement something like we all
S2: have access to pretty much the same type of knowledge
S2: about technology. Uh, the difference is, you know, how fast
S2: can you do something, build it or weaponize it and
S2: how effective it is, how well built it is. And
S2: tested proved. And even if you if you assume that
S2: everybody has the same weapons. Right. So it's a it's
S2: a Sam zero kind of a game. The difference is
S2: on the tactics and the strategy, right? The human, the
S2: humans behind it. So that's why I think I love
S2: to talk about the human in the loop. Right. When
S2: we talk about AI. Uh, the brain, somebody that can,
S2: you know, observe what's going on, assisted by these bots
S2: or AI and then make a decision based based on that.
S2: For a small, for a lot of small organizations that
S2: will probably require some sort of a, you know, a
S2: third party, uh, a partner, somebody that can help, right, to,
S2: to provide that guidance. But there's never going to be
S2: a substitution for the business itself, knowing the business like,
S2: you know, your business, right? A manufacturing plan, they know
S2: their business. They they know things that nobody else is
S2: going to be able to know. So I think that's
S2: that's where the key of this is, is making security accessible,
S2: making intelligence accessible to those making the key decisions. This
S2: is not just the SoC analyst, right. Or the incident
S2: responder or the threat hunter, which is, you know, probably
S2: at the level that we operate, um, that we like, right,
S2: because we like technology and the toys and all that.
S2: But but no, more importantly, it's to making these intelligence
S2: accessible to decision makers, to the sea level executives so
S2: they can understand what's happening right in, in with their business,
S2: for example. Um, we do a lot of business in Asia-Pacific,
S2: and we see manufacturing plants in Taiwan that are being
S2: targeted with very specific pieces of malware that have geofencing.
S2: So they're only going to execute. If they execute within
S2: that region. Right. In that that geolocation. Those are geo coordinates.
S2: So what that means is that it's highly targeted, of course.
S2: And who has a vested interest in what's happening in
S2: manufacturing plants in Taiwan? Well, you can think of a,
S2: you know, one country, for example, that that has extensive
S2: operations in terms of, uh, uh, espionage in the, in
S2: the region. Yeah. Um, well, if you're an executive of
S2: a manufacturing company in the US and you want to
S2: open up a plant in Taiwan, don't you think that
S2: you would like to know that? Right. But the thing
S2: that that affects your business operations, um, we have seen
S2: threat actors going back to Russia right? In the past,
S2: targeting law firms here in the US, looking at mergers
S2: and acquisitions and using that information to play the stock exchange. Mhm. So,
S2: so all of these things have implications in the, in
S2: the real world. And I think that that's something that
S2: I'm particularly I want to say obsessed with. But, but
S2: I try to work with and it's trying to make
S2: this type of intelligence more. Digestible, more, um, strategic. Right,
S2: for those that are making these type of decisions.
S1: That's interesting. I, um, I, uh, built the, uh, security
S1: measurement program over at Apple, uh, for a number of
S1: years in the past, and that was a big part
S1: of my I also was in the military. So I
S1: was thinking in these same exact terms that you're describing.
S1: So I was thinking data. Information and then, uh, insights
S1: and then intelligence. And at the very top of that
S1: is the decision maker. So I'm trying to figure out
S1: what is the most work that I can do for them,
S1: to enable them to make a decision. So they're not
S1: processing logs, they're not even looking at log summaries, which
S1: would be like the next level up, but instead they're
S1: being told a story. Um, so it's a narrative. So
S1: the narrative is something like, you know, um, this enemy
S1: tends to attack between the hours of two and 3 a.m., right?
S1: They tend to come in a small group of 3
S1: to 4 people wearing dark clothing. They carry light weapons.
S1: They don't come on full moon. But tonight is not
S1: going to be a full moon. It's actually a new moon.
S1: So there's no moon whatsoever. So therefore we think it
S1: might happen tonight. And here's why we think that. Right.
S1: So that brings them all the way up to the
S1: decision point. And that's what that's my favorite type of
S1: threat intelligence where it it gives you data but it
S1: doesn't drown you in the data. It actually does analysis
S1: that brings you right up to the point that they
S1: can make a decision. So what does that look like
S1: for you? I see this report here which looks quite good,
S1: but what else do you have within your philosophy and
S1: your product that helps you do that for the decision maker?
S2: Yeah. So so when we look at for example, this
S2: report is it's a mix. Right. We have some more, um,
S2: narrative in the beginning. Um, high level introduction. Uh, so
S2: I said before, we have, you know, from people in
S2: the Senate to, uh, uh, you know, CSOs reading these
S2: to also city analysts. So one of the things that we, we,
S2: we do is to, you know, do like a high level,
S2: you know, executive summary for anybody out there that wants
S2: to share these type of things with, with, uh, executives
S2: just know they're not going to read a lot of things, right.
S2: If anything, they may just steal a few infographics. Um,
S2: and one page. Right. No more than that. So we
S2: try to to stick to that rule, uh, and then
S2: we go into more statistics. Uh, a lot of people,
S2: you know, love to see these, like, trends. Uh, this
S2: also gives us the opportunity to talk to, you know,
S2: media and journalists. They love the numbers. Yeah. And and
S2: it helps right to, to also identify trends. And then
S2: we look at cyber attacks per industry. So for example,
S2: if you are in what we call critical infrastructure, right.
S2: And this could be, you know, hospitals, this is a
S2: manufacturing plant. This is a power plant. Uh, what are
S2: some of the top threats for your industry? Right. Sure.
S2: If you're in health. What do you want to look at?
S2: If I'm if I'm in healthcare, I don't want to
S2: see all these, you know, malware that is targeting financial organizations,
S2: for example. Because that's not what I may what I
S2: may see. Mhm. And it's also very interesting talking about trends.
S2: What we have seen is that, um, traditional cybercrime against
S2: financial organizations tend to reuse the same malware over and
S2: over again. Mhm. It's less targeted versus attacks against healthcare
S2: and government local governments. We're not talking about you know
S2: the large large government facilities in many cases we're talking
S2: about small government, you know, estate uh, agencies uh, or
S2: schools even. Right. Education. Yeah. And we see more highly targeted. Right.
S2: Because they're going after specific, uh, objectives. Mhm. So that's,
S2: that's the idea of uh, this is data that I
S2: would like to have to be able to build my
S2: threat model. And then finally something that we would like
S2: to include, there's a geopolitical analysis and common. So we
S2: have people that are experts in geopolitical analysis uh looking
S2: at what's going on. Like for example, a few months ago,
S2: December 23rd, uh, the US. Japan and South Korea. They
S2: signed an agreement to defend against North Korea attacks. Mhm.
S2: That's that's on the news. Right. So you see that
S2: how is that going to influence what we're going to
S2: be seeing in Asia Pacific over the next few months.
S2: Well there's definitely an impact right. Yeah. Um so if
S2: you're operating again you have business in that area. You
S2: want to have that type of context and information. And
S2: then the rest of the report is more maybe a
S2: little bit more, uh, technical. So if you want to
S2: learn more about the CVEs that are getting exploited, uh,
S2: this is more like the information that a SoC may consume,
S2: you know, threat hunters, uh, maybe incident responders, uh, at
S2: a more tactical level.
S1: Yeah, that makes sense. Uh, so looking for like a
S1: year or two, do you expect AI advancements to help
S1: attackers or defenders more?
S2: Again, very good question. I think that eventually it's going
S2: to be a net net right. For for everybody, for
S2: both attackers and, and defenders. I think the key it's
S2: going to be not that much on the technology but
S2: how you use it when you. But I love to
S2: talk about the factor of time. If you look at
S2: an attack chain. Mhm. Some people just they, they believe
S2: there's always going to be like a cyber bullet right.
S2: Uh silver bullet sorry a cybersecurity silver bullet that. Oh
S2: this is the only thing I have to install. Right. Just.
S2: Install these. And sometimes vendors, you know, the marketing could
S2: be a bit, you know, confusing and could give you
S2: the illusion that if you just do this, you're going
S2: to be you're going to be good. No, it's a
S2: lot more complicated than than that. That's why you need
S2: the human factor. But if you look at an attack chain,
S2: you know, we usually say this thing that attackers, they
S2: have to be the right ones and defenders. We have
S2: to be right all the time. Uh, well, if you
S2: look at it from an endpoint perspective, then yes. Right.
S2: And we see attackers are trying different things and that's
S2: what we try to build, you know, predictive models. And
S2: you know, you had shield in your, in this, uh,
S2: your show talking about the math behind all of these
S2: and why these predictive models work. So we have to
S2: be right there every single time and how we do that.
S2: But if you look at attack Chain, you step out,
S2: you zoom out as a defender. All I need to do.
S2: Is to detect the presence of the attacker once. Mhm.
S2: That's right. So I have a whole attack chain I
S2: have like all the way from the attacker is, you
S2: know maybe doing some reconnaissance or trying to get some
S2: information from my organization to the initial access, which could
S2: be email or it could be, you know, some sort
S2: of exploitation of a service all the way to the
S2: attacker's objective. Right? Which is what either to hold hostage
S2: of your environment or to where the valuable data is.
S2: This takes time, right? Sometimes in a targeted attack, it
S2: could be. It could be days. It could be weeks.
S2: So you have multiple opportunities across that attack. Interesting. Successful.
S2: So that's why I say, you know, we don't talk
S2: that much about cyber defense strategy. But if you look
S2: at it from that perspective, all I need to do
S2: is to have the right sensors and the right, uh.
S3: And.
S2: You know, policy enforcement points in the right places to
S2: be able to disrupt that activity. As long as the
S2: attacker doesn't get to the final, you know, stage of
S2: the attack. Those actions and objectives I'm I can win.
S1: I love I love that I've never actually heard that
S1: put in a positive light. You're basically inverting the whole thing, saying, yeah,
S1: the the attacker only has to be right once, but
S1: look how many opportunities the defender has to see what
S1: they're doing because they have to go through this whole chain.
S1: And those every point on that chain is an opportunity
S1: to detect.
S2: Exactly. And look, it's like the physical world, right. It's
S2: not that hard if I, if I'm trying to protect
S2: a defend my, my, my house, right. My home and
S2: I have my valuables, I'm not going to put them
S2: like close to the, to the front door where somebody
S2: could just smash the door and grab it and quickly leave.
S2: If I do that and I get stolen, like, look, it's,
S2: you know, shame on me. Yeah, I have a really,
S2: really poor defensive security detector, right? I put my valuables
S2: next to the front door next to a perimeter window. Yeah. Uh,
S2: what do you do? Like a bank does, right? You
S2: have the safe in the basement. And what you do,
S2: you architect with a lot of preventive mechanisms. Those are walls, right?
S2: The access control systems, then. But do you know that
S2: in the absence of any detection response, what's going to happen?
S2: Somebody's going to, you know, come with a huge drill
S2: or explosives or it's just a matter of time. But
S2: if you architect with the right sensors and you also
S2: in parallel, you add security cameras, right? You know, motion sensors, um,
S2: you know, thermal sensors or vibration sensors, whatever. And you
S2: orchestrate all of that in a way that you can
S2: have a fast response with the big guys, with the
S2: big weapons showing up quickly, you're effectively now building a defensible,
S2: secure architecture that where you have prevention, but also in parallel,
S2: you know, sensors for monitoring, for visibility, for detection and
S2: for response. When you combine all of these things, which again,
S2: is technology plus people and processes then have a lot
S2: more chances to be successful. And all you need is
S2: once right, the attacker will have to commit the perfect
S2: crime and to be, you know, right every single time
S2: to bypass absolutely everything you have architected with. And that's usually,
S2: you know, it usually doesn't happen.
S1: Yeah, I really love that positive spin on it. Like
S1: I said, I've never actually heard it put that way. Um,
S1: so what about the short term though? I feel like
S1: in the short term that AI attacks are so new with,
S1: you know, deepfakes and spearfishing that the attacker is going
S1: to be able to move faster to use all these techniques.
S1: But I agree with you that over time it's going
S1: to equalize. In fact, because the defender has more context,
S1: I think it actually might switch towards the defender maybe later,
S1: but it'll mostly equalize. Do you agree that though early on,
S1: like the next couple of years, the attacker might have
S1: the advantage because they could just move so fast and
S1: they don't care about like production readiness?
S2: Yes. And that's typically the case. Right. We on the
S2: defender side we have to now look at how we
S2: responsibly use this technology. Right. And yeah that may involve
S2: like lost regulations. And that's that's always like you know
S2: uh slow. Yeah. Uh, in the meantime there's, there's things
S2: that we urge people to do, which is like, you know,
S2: to protect themselves with products that are using, you know,
S2: the latest and greatest technology. Um, you know, we we
S2: all know that defending with signatures is like playing whac-a-mole. Yeah,
S2: but but still, we see a lot of companies out
S2: there that they feel safe because they have a traditional
S2: antivirus just defending with signatures. Right. Or.
S1: Well, maybe that's why PDFs of attacks are coming back,
S1: because the malware detection stuff like antivirus, old antivirus can
S1: only hold so many signatures. So as they move through time,
S1: they kind of take out the old ones. Maybe they
S1: took out some PDF ones. So now the attacker goes
S1: back to the PDF ones. Right? Right. Yeah.
S2: So so yes, it's uh, it's always an arms race.
S2: But that's why it's important to raise awareness. Uh, that's
S2: that's why it's important to have that's what we try
S2: to do with these reports. Right. To communicate. Look, this
S2: is what's happening. And, you know, these are the tools
S2: and this is the strategy, the tactics that you should
S2: be using. And.
S3: Um, but.
S2: But yeah, just assume that attackers, they know. Like, you know,
S2: the products that are out there and how the majority
S2: of people use them. So I'm always a big proponent
S2: of like add your own little strategy there. Right. Mhm.
S2: You know that attackers are going to go after your
S2: organization and do reconnaissance and scrape your website like add
S2: a little decoy somewhere, something that will give you an
S2: early warning, something that will help you to get that
S2: indicator towards the beginning of that attack chain. That can
S2: give you an advantage over the adversary that takes the
S2: adversary by surprise. How many times will the adversaries, you know,
S2: take us by surprise? How many times can we get
S2: them by surprise, by doing something that they were not expecting? Yeah.
S2: I think that's that's an area where we still have
S2: to to do more and. Well, that's what I hope
S2: that we are contributing with these type of, uh, applications.
S1: No. That's perfect. I think that is a good place
S1: to start. But where can we learn more about what
S1: you and your team are doing and, uh, your latest research, uh,
S1: when is it going to come out and when can
S1: we get a link to that?
S2: Sure. So, uh, of course, uh, the best way to, uh, uh,
S2: you know, look at our reports is to go to
S2: our website, blackberry.com. Uh, we have a section for our, uh,
S2: threat research, a threat center. And it's typically, you know,
S2: front in the, in the in the main page. Uh,
S2: there's going to be a link to, to our reports. Uh,
S2: but also, you know, I'm very active on social media, LinkedIn, um,
S2: you know, x, uh, my handle is about security.
S3: So that's also, oh, very nice username.
S2: I still don't know how I got that one. But again,
S2: like this is an advantage of being on this field
S2: for a long time, right. Yeah. About security and, um, yeah,
S2: I'm happy to, uh, connect with any of our, you know,
S2: the audience here. And, you know, you have a fantastic show.
S2: So thanks for for having me.
S1: Yeah, absolutely. Thanks for coming on. And we'll put all
S1: those links, uh, in the show notes so people can
S1: find them. Thanks a lot.
S3: Excellent. Thank you. Danny.