Thanksgiving Cyber Threats and AI Risks
Key Points
- The hosts emphasize that while AI is often celebrated, it can also pose serious security threats, reminding listeners that “AI is not always our friend.”
- The Thanksgiving‑themed panel expresses gratitude for reduced major incidents, increased collaboration among enterprises, and the fact that security is finally being prioritized in the AI-driven technology wave.
- Upcoming episode topics include IBM X‑Force’s new public GitHub repository, a dark‑web job‑market trends report, an AI‑powered fraud campaign, and a case of someone attempting to convert wind turbines into cryptocurrency mines.
- The show warns listeners that the holiday shopping season, starting with Black Friday, also brings a surge in scams, setting the tone for the episode’s security‑focused discussions.
Sections
- Thanksgiving Reflections on Cyber Threats - The IBM Security Intelligence podcast opens with a caution about AI, a Thanksgiving theme, and a panel of security experts sharing what they’re grateful for—acknowledging recent incidents like SolarWinds and Colonial Pipeline while noting an increasing collaborative effort across enterprises.
- Black Friday Scams Target Brands - The speakers explain how Black Friday‑time phishing domains threaten corporate brands and outline the need for security teams to partner with marketing to vet malicious domains and protect enterprise reputations.
- AI‑Enabled Domain Threat Landscape - The speaker explains that while organizations have boosted monitoring, AI‑driven attacks such as domain hijacking, fraudulent checkout sites, and automated scamming agents now amplify the security burden, forcing enterprises to protect customers and coordinate takedowns with hosting providers.
- Layered Payment Protection & Work Device Advice - The speaker stresses using multiple fraud‑prevention tools such as tap‑to‑pay, Apple/Google Pay, and PayPal, avoiding holiday shopping on work devices, and highlights the increasing burden on security teams to manage rapidly evolving threats.
- Advocating Open‑Source Security Transparency - The speaker argues that security work should be done openly in the light rather than hidden, emphasizing collaborative benefits while acknowledging the inherent risks of open‑sourcing.
- AI Tools, Trust, and Dark Web Jobs - The speakers discuss AI and open‑source software as neutral tools whose impact depends on user intent and safeguards, emphasize speed over secrecy in defending against AI‑enhanced threats, and then highlight Kaspersky’s findings that the dark‑web job market mirrors legitimate hiring practices, becoming more selective and expanding during broader economic layoffs.
- Economic Pressure Fuels Moral Flexibility - The speaker contends that financial desperation and harsh work environments cause otherwise decent individuals to compromise their morals, highlighting the need for governments and corporations to mitigate such pressures.
- AI Fraud as Critical Infrastructure Challenge - The speaker highlights AI‑driven fraud as an expected growing‑pain, stressing the need for governance, policy, and infrastructure‑level safeguards against human‑exploited AI vulnerabilities.
- Prioritizing Speed Over AI Safety - A speaker argues for launching AI products quickly to meet market and financial pressures, dismissing essential safeguards, testing, and non‑functional requirements.
- Misusing Corporate Resources for Bitcoin - The speakers discuss employees exploiting company assets—like green energy systems and laptops—to mine Bitcoin, highlighting the need for better anomaly detection and heightened vigilance against insider threats.
- AI Meets Operational Technology Threats - The speakers explore how modernizing smart grids and AI intersect with legacy operational technology (OT), highlighting emerging security risks like energy theft and the need for increased compute power.
Full Transcript
# Thanksgiving Cyber Threats and AI Risks **Source:** [https://www.youtube.com/watch?v=x1yRb5_PVro](https://www.youtube.com/watch?v=x1yRb5_PVro) **Duration:** 00:39:52 ## Summary - The hosts emphasize that while AI is often celebrated, it can also pose serious security threats, reminding listeners that “AI is not always our friend.” - The Thanksgiving‑themed panel expresses gratitude for reduced major incidents, increased collaboration among enterprises, and the fact that security is finally being prioritized in the AI-driven technology wave. - Upcoming episode topics include IBM X‑Force’s new public GitHub repository, a dark‑web job‑market trends report, an AI‑powered fraud campaign, and a case of someone attempting to convert wind turbines into cryptocurrency mines. - The show warns listeners that the holiday shopping season, starting with Black Friday, also brings a surge in scams, setting the tone for the episode’s security‑focused discussions. ## Sections - [00:00:00](https://www.youtube.com/watch?v=x1yRb5_PVro&t=0s) **Thanksgiving Reflections on Cyber Threats** - The IBM Security Intelligence podcast opens with a caution about AI, a Thanksgiving theme, and a panel of security experts sharing what they’re grateful for—acknowledging recent incidents like SolarWinds and Colonial Pipeline while noting an increasing collaborative effort across enterprises. - [00:03:09](https://www.youtube.com/watch?v=x1yRb5_PVro&t=189s) **Black Friday Scams Target Brands** - The speakers explain how Black Friday‑time phishing domains threaten corporate brands and outline the need for security teams to partner with marketing to vet malicious domains and protect enterprise reputations. - [00:06:15](https://www.youtube.com/watch?v=x1yRb5_PVro&t=375s) **AI‑Enabled Domain Threat Landscape** - The speaker explains that while organizations have boosted monitoring, AI‑driven attacks such as domain hijacking, fraudulent checkout sites, and automated scamming agents now amplify the security burden, forcing enterprises to protect customers and coordinate takedowns with hosting providers. - [00:09:57](https://www.youtube.com/watch?v=x1yRb5_PVro&t=597s) **Layered Payment Protection & Work Device Advice** - The speaker stresses using multiple fraud‑prevention tools such as tap‑to‑pay, Apple/Google Pay, and PayPal, avoiding holiday shopping on work devices, and highlights the increasing burden on security teams to manage rapidly evolving threats. - [00:14:52](https://www.youtube.com/watch?v=x1yRb5_PVro&t=892s) **Advocating Open‑Source Security Transparency** - The speaker argues that security work should be done openly in the light rather than hidden, emphasizing collaborative benefits while acknowledging the inherent risks of open‑sourcing. - [00:18:45](https://www.youtube.com/watch?v=x1yRb5_PVro&t=1125s) **AI Tools, Trust, and Dark Web Jobs** - The speakers discuss AI and open‑source software as neutral tools whose impact depends on user intent and safeguards, emphasize speed over secrecy in defending against AI‑enhanced threats, and then highlight Kaspersky’s findings that the dark‑web job market mirrors legitimate hiring practices, becoming more selective and expanding during broader economic layoffs. - [00:21:52](https://www.youtube.com/watch?v=x1yRb5_PVro&t=1312s) **Economic Pressure Fuels Moral Flexibility** - The speaker contends that financial desperation and harsh work environments cause otherwise decent individuals to compromise their morals, highlighting the need for governments and corporations to mitigate such pressures. - [00:25:31](https://www.youtube.com/watch?v=x1yRb5_PVro&t=1531s) **AI Fraud as Critical Infrastructure Challenge** - The speaker highlights AI‑driven fraud as an expected growing‑pain, stressing the need for governance, policy, and infrastructure‑level safeguards against human‑exploited AI vulnerabilities. - [00:29:26](https://www.youtube.com/watch?v=x1yRb5_PVro&t=1766s) **Prioritizing Speed Over AI Safety** - A speaker argues for launching AI products quickly to meet market and financial pressures, dismissing essential safeguards, testing, and non‑functional requirements. - [00:33:49](https://www.youtube.com/watch?v=x1yRb5_PVro&t=2029s) **Misusing Corporate Resources for Bitcoin** - The speakers discuss employees exploiting company assets—like green energy systems and laptops—to mine Bitcoin, highlighting the need for better anomaly detection and heightened vigilance against insider threats. - [00:36:55](https://www.youtube.com/watch?v=x1yRb5_PVro&t=2215s) **AI Meets Operational Technology Threats** - The speakers explore how modernizing smart grids and AI intersect with legacy operational technology (OT), highlighting emerging security risks like energy theft and the need for increased compute power. ## Full Transcript
I'm going to say everybody's two favorite letters here, which
it you know I'm a huge fan and an early
adopter of AI, but I am going to say that
this is one of those times when AI is not
our friends. All that and more on Security Intelligence. Hello
and welcome to Security Intelligence, IBM's weekly cyber security podcast
where we express our undying gratitude for the many tools,
tactics and people who keep us safe. Safe from ransomware,
shakedowns, rogue AI agents and sundry other maladies. I'm your
host, Matt Kaczynski. It's Thanksgiving time here in the US
and I am thankful for this wonderful panel in front
of me today featuring Suja Viswasen, VP Security Products, Dave
McGinness, Global Partner, Cyber Threat Management Offering Group, and Nick
Bradley of X Force Incident Command and the not the
Situation Room podcast. And to start us off, I wanted
to ask you all what you are thankful for in
cyber security world. Or maybe not cybersecurity. Maybe you don't
feel very thankful about that stuff right now. Nick, let's
start with you. What are you thankful for? I'm thankful
that we did not have another Solar Winds, Move it
or Colonial Pipeline level event. I mean we had some,
we had some bang up outages. I mean aws, East
One and Cloudflare sure tried to take some trophies there.
But I'm going to knock on wood and leave it
at that. I like that. Sujay, how about you? I'm
really thankful that many enterprises are coming together to fight
this. Right? It's not a competition anymore. It's like cooptation,
everybody coming together to fight. So I'm really grateful that
companies are coming together. I like that too. I think
we'll need more of that. Dave, how about you? I'm
just thrilled and thankful that security is not being left
behind in this latest technology revolution. So we're always the
last dog at the trough. So it's good to know
that, you know, AI is changing the world and security's
being spoken about, which is great. But I will echo
with Nick because usually it's the Internet emergencies where Nick
and I spend most of our time together. So tis
the season. So yeah, I'm with you on that one
too, Nick. That's great. I feel like we just jinxed
ourselves and we're going to get off this call and
there's some kind of terrible incident, but we can wait
until that happens. Dave and I have been meaning to
hang out again for a while, so I guess it's
time. You know, Silver I like that. The silver lining.
You're always such an optimist on the show, Nick. Here's
what we're talking about today though. We got IBM X
Force's new public GitHub repository, a dark web job market
trends report factory catches, an AI powered fraud campaign, and
a man who tried to turn wind turbines into crypto
mines. But first, it is holiday scam season. Now, as
everybody knows, Black Friday marks the unofficial start of everyone,
someone's least favorite holiday tradition. And I'm not talking about
waking up early for those doorbuster deals. Although on side
note, I don't know that anybody does that anymore. And
I might just be aging myself, but I'm talking about
scam season. Around the holidays, scam incidents tend to skyrocket.
Often impersonating real retailers, scammers will set up fake websites,
fake ads, fake promotional texts and emails, all to steal
people's money or personal data. Now, according to a report
from Checkpoint, hundreds of new Black Friday related domains have
been registered in October and November. And an estimated 1
out of every 11 of those domains is malicious, which
has a decent number. Now, a lot of coverage of
these scams looks at how they affect everyday people, which
makes sense. But you know, we at IBM, we deal
a lot with enterprise security. And so I wanted to
talk about it from that angle. How do these scams
affect organizations? What do they do to the enterprise? Suja,
let's start with you. How does the holiday scam season
affect us here in corporate world? Two things, right? One,
it has changed. It becomes a threat to the brand.
Right? First of all, it's threat to a business, but
it's also threat to a brand because from the user
perspective we have learned that just educating the user is
not enough. So every company has a brand to protect.
So from IBM perspective, how do we help our enterprise
so that their brand is protected? So educating the enterprises
to work closely with that marketing. Now security needs to
work with marketing and branding to make sure that if
there is an anomaly, they are able to catch it
ahead of. The second one I would say is when
a bunch of domain get created closer to these, we
should be like vetting them much more closely as part
of our security wedding than anything else. Yeah, I like
that you mentioned security and marketing and branding should kind
of work together because I think that we don't necessarily
think of that as being a common pairing, but especially
at this time of year, you're going to need to
do that kind of thing, right? Because that Checkpoint report
also found that when it comes to those malicious domains,
a lot of them are masquerading as like real places,
everybody's two favorite letters here, which, you know, I'm a
huge fan and an early adopter of AI, But I
am going to say that this is one of those
times when AI is not our friends because AI has
made it so easy for them to set up these
mimic domains like that. And it's not like it used
to be where it looks hokey or quirky and you
could tell this does not look like the Home Depot
normal website. No, it looks exactly like it because AI
created it for them. So it's gotten more dangerous. I'm
going to add one thing to what Nick said is
thinking about on one side, AI is making it easy.
AI is making it difficult for the consumers too, if
you're a bot. Because we are telling everybody that you
need to get on board with AI. If you're having
an AI bot created to go buy stuff for you,
it can get spoofed by these AI websites too, and
then give your information without you realizing it. So it
is a big problem. The enterprise trying to just sell
their wares, right? So they've already got, they've made all
of their changes. They're in their change freeze. It's their
biggest time of the year. They're not getting people trampled
anymore. They're getting trampled online. To your point there, Matt.
Right. So you know, they've already increased their monitoring of
their environments and their applications. Now they have to worry
about their domains being stolen. Right? And it looking really
good to, to the points you guys have just made.
They got to watch their, their checkouts and their secure
payments. They got to educate to your point, Suja, not
just their employees. They got to worry about their, their
customers, their clients. Right. And then how do you fix
it? Are you going to go to your hosting providers
and take down the sites? Like what, what are you
going to do to take care of those sorts of
things? So yeah, I mean the burden that's now on,
you know, you know, on them is just. It's skyrocketed.
Yeah, it's, it's, it's like you folks are reading my
mind because you all just systematically answered all the questions
I was about to raise about this stuff. But I
want to go back to something that Suja had mentioned
real quick, which was how it's not just the way
that the AI can be used by the kind of
attackers to spin up these websites, but it's also, like
you said, rendering a world where people are kind of,
they're starting to set up their own agents and they
go and they buy stuff for you and that stuff
can get scammed. I was kind of hoping you would
expand on that angle just a little bit more for
us. You know, how, how is this kind of complicating
the terrain for, for enterprises right now? I think the
one thing is you can create, like you said, you
can create an agent to go say find me the
best deal in the Internet for, for me to go.
And for an agent, it doesn't know if it's a
legitimate or not because as a user, if I, if
my prompt is not engineered correctly, I might be misleading
this agent to go do stupid things. Right? Which I
might not have done by myself, which I'm capable of
doing it, but less capable now I'm enabling my agent
to be more stupid. These are all. So the biggest
thing for me is the payment systems. The transaction processing
need to get more intelligent to avoid this because like
I said, we are going to do stupid things inadvertently.
How do we stop from happening is the payment system
has to become very, very intelligent to know that it's
doing something. So it's not just the enterprises and brand.
Even our transaction processing needs to become more intelligent and
be fraud resistan. Absolutely. And it goes back to what
you were saying earlier about how we need this increased
kind of collaboration. I mean, we're talking about so many
different players here. Nick, I saw you starting to say
something. You want to jump in here? One of the
things that I think a little bit differently on now
than I used to because I used to really be
a non supporter of all of the cybersecurity education courses
that we've all been forced to go through that we
just want to click through it so that we can
get the certificate so our manager can stop telling us
to get it done. But this is one of those
cases where user education is actually still a little bit
important and that's just because the landscape has changed. There's
so many things that people need to understand and the
basic one first is don't do your holiday shopping on
your work laptop. I know it's tempting and it's easy,
but let's just take that out of the equation. You
already have a phone, just use your phone. So part
two to that now is obfuscation, right? There's new levels
of obfuscation that people aren't used to. Or that they
just might not even realize is a bad thing. The
little URL shorteners, those things are just traps waiting to
happen. And then you also have your own safety. You
can take measures to be safe yourself, right? If you
usually shop on Amazon or you usually shop and I
mentioned them again before, maybe, maybe they'll sponsor me. I
don't know. Home Depot. But go to the site that
you're used to going to, right? Don't go through an
email that, wow, Home Depot never emails me. But this
time they sent me an email with a cute little
shortened URL to take me to this special offer. Sure
they did. Go ahead. That's gonna work out well. Don't
do that. Just like you do with your bank, right?
And then lastly, I'll throw. On top of that is
just protecting yourself through more than one level of fraud
protection, right? Using Tap to pay at the grocery stores.
The stores like that are safer. Using a Google Pay
or an Apple Pay, when you're buying something online, something
that gives you one extra level or even PayPal, right?
I know that's old school, I'm aging myself now, but
those things give you an extra level of protection other
than just using your debit card and just getting completely
ripped off, right? So just other ways that you can
protect yourself. There's. I say this all the time, there's
no silver bullet, but in this case, these are some
things that could help. Maybe it's a ten bullet, I
don't know. Almost as effective. I do like though, that
you point out something that's so extremely simple, but it's
like one of the most important things you can do
is don't do your holiday shopping on any of your
work devices, man. Just don't do it. Never do that.
And if you don't do that, you're not gonna be
the one who gets your company breached. It's gonna be
someone else and you don't have to worry about it
that much. But to round out the segment though, I
wanted to go back to something that you had said
earlier, Dave, which is how the burden now is so
much higher on kind of security teams to deal with
this stuff as it comes faster and it comes at
greater scale and it maybe is more convincing. Do you
have any thoughts on how they deal with that burden?
I mean, I mean, how do you respond to this
landscape when scamming is so fast? And so easy. It
just feels like the answer to everything these days is
AI, and you have to fight AI with AI, but
you're not going to solve it with people. I mean,
it's, it's, it's. I mean, yeah, sarcasm, but it is
the answer. It's. If you can, if you can't generate
it with humans, you're not going to be able to
fight it with humans. Right? And you're not. This isn't
being generated with humans. Right. So if there's a zillion
permutations, you need something that can handle a zillion permutations
and suss through it. You know, it's going to have
But then I think, you know, the point that Sudra
made just a moment ago around, you know, some of
the responsibility, going back to the payer systems, right. If
they're not allowed to process the transaction, I really don't
care that it's a fake Home Depot site and I
want Nick to get sponsored really bad. So I don't
know why, but I mean, if the transaction can't go
through because the payer system has decided, hey, you know
what, that's a fraudulent site and we've taken it offline
that there's more due diligence or whatever that entails. Maybe
the first couple get through and then, hey, flagged. And
I know that that's what happens, but maybe there's some
there that could be sped up or something along those
lines, so. And maybe I could help that too. I'm
sure they're working on it. I wish we go to
this place where something is too good to be true.
It's probably not true. Thank you. I'm glad somebody said
it. I was trying to avoid saying that because I
think I said that like five times in a row
on my podcast. I'm like, don't say it again. You
know, I mean, we've said this so many times on
the show. So much of cybersecurity is just teaching people
basic, like human common sense kind of lessons, you know,
about certain things. And I also just. Wonderful tagline. If
it wasn't generated by humans, you can't fight it with
humans. That's great. I mean, Dave, if you ever want
a second career in copywriting, you got the chance. Yeah,
you need to copyright that for somebody else. But I
don't know about that. Let's move on then to our
next story. X Force introduces a public GitHub repository for
malware threat research tools. The new GitHub is intended to
host every project the X Force thread research team contributes
to or creates for public use. It's currently home to
X Force's fork of dragotis, a framework for a universal
dissembler script that helps reverse malware code so researchers can
analyze it. X Force's fork of NSIS reversing suite, a
Python library for analyzing the null soft scriptable installer system
installers often used by malware. The Goo Loader Dumper. I
don't know if I said that right, but the Goo
Loader Dumper, a tool developed by X Force to dump
Goo Loader payloads and dotnet utils, an X Force created
library for parsing, emulating and patching.net executables. Now, again, this
goes back to something that Suja mentioned all the way
up top, talking about the more collaborative kind of landscape
in threat intelligence. And this seems like an extremely collaborative
move to me. Open sourcing these tools, putting them out
there for other security professionals to use. So, Dave, I
want to start with your reaction here. How do you
feel about this kind of open source collaborative approach to
security that we're seeing? I think the good here outweighs
the bad. And look, I know that we can fall
on. There's good, there's bad. I like the open collaborative.
I think security should be done out in sunshine. Right.
I think the dark corners, right. I mean, I've been
doing this a long time. It doesn't help to hide
stuff. You know, we all win together. And if I've
got something good. It doesn't. It does. No, it does
no benefit that I keep it to myself. Right? So
I'm all for this. I think this, I think the,
the benefits here, you know, just far outweigh. I hopefully
others line up behind us and go, you know what,
it's about time, right? I really do think this is
the right thing to do, so. Absolutely, absolutely. You just
learned to work in the dark. I was born. So
this. Was that a, Was that a Bane reference? That
was my Bane, Dave, I mostly agree with you, actually.
And the funny part about that is I didn't want
to because I am not a fan of open source,
just about anything. But in this case here, I have
to agree with you. I have to agree with you
because I think this is the way we're going to
work together. And I think we saw a little bit
of that with some of our earlier tools that didn't
go. Go all the way to this level. And this
I'm kind of looking forward to it. I'm not gonna
lie. I really hope it's successful and I look forward
to messing around with it myself, to be honest. You
know, Nick, I'm kind of glad you said that you're
a little skeptical of open source stuff because I had
a feeling you'd be the one I wanted to ask
this question to, which is open sourcing stuff does kind
of come with certain risks, doesn't it? And especially when
you think about. We've seen GitHub be like an attack
surface for some serious attacks this year. Right. And I'm
kind of wondering how you balance benefits of open sourcing
security tools like this with the need to defend this
as like a new part of an attack surface. Right?
Like, how do you, how do you, how do you
deal with people? I don't know, you know, cloning your
GitHub and pretending to be you, for example. We've seen
that happen before. Any thoughts there? You might not be
referring to a shy hallude or other types of. Other
types of attacks of that nature. So that, that's the
problem. Right. But the, the issue is not the open
source itself. The issue is the easiest way I could
say the issue is being lazy because open source can
be secured better. And that's where the problem comes into
play. It's not the open source itself, it's the inability
to enforce regulation on keeping it secure. When it's open
source, there's so many people with their, with their hands
in the pudding and there's so many people that, that
aren't doing things the right way. And there are methods
that can be used to keep open source more safe.
It's just in non open source situations that is. That's
forced, you have to follow these rules. And that's not
perfect either, but it's a little better. It's the hygiene.
Thank you. There was the professional word I was looking
for. Well, good. Let's get Suja. I want to bring
you in here too to get your thoughts on that
hygiene. But also just in general the open sourcing of
this stuff. Does anything stand out to you? How are
you feeling about it from security perspective? Competitive edge isn't
secrecy anymore, right? It's speed. So it's important to go
share these with the industry. Like I said, it's a
team sport. But how fast the SoC and all the
companies can adapt to it and then build their defenses,
that is where the secret competitive edge is for companies,
for enterprises, to make money and also to get the
defenses up. So it's important to Open source these things
and share the technology. But how fast we can adopt
it and then get our systems more sharp. And just
like we have talked to that on this one. Right.
Where AI or any of these are, I mean it's
a tool that can be weaponized or can be used
for good. So on both sides it is there same
thing applies for open source. We need to make sure
mean a tool is a tool is a tool. It's
not the tool doing the, it's not how the or
the tool itself, it's how it's used and who is
using it. These open source tools are a trust experiment.
If you really, really look at it. It's a trust
experiment and trust cuts both ways. So we need to
have these hygiene in place and everything to make sure
that we are protecting it and then upping our defenses.
Absolutely. I really like too what you said about how,
you know, it's not secrecy that's the competitive edge, it's
speed. Right. Like I do think especially in this moment
when we're dealing with this AI, these AI generated threats
we're talking about, these AI amplified threats we're talking about
speed really takes the cake. I think that sounds good.
How about we move on to our next segment here
folks. Kaspersky released a report about the Dark web economy
based on an analysis of two years worth of job
posts on dark web forums. Overall, we get the picture
that the dark web job market operates a lot like
the legitimate one, including the fact that Dark web employers
are getting pickier. They're increasingly demanding that candidates pass tests
and security checks. And dark web recruitment efforts tend to
increase when layoffs in the legitimate markets increase. So there's
a kind of very interesting connection there that I want
to probe. But first, initial reactions. Let's start with you,
Nick. How you feeling about this Dark web job market
report? I mean not surprised in the least. I mean
we have seen this developing for years now as we
have watched bad actor groups become more organized. The way
they work, you know, with each other and the way
that they work with affiliates. I mean it's just another
enterprise. So why would another enterprise not just hire just
like we do? It's fascinating. Right. Dave, how about you?
Any thoughts there? Disgruntled folks are going to turn where.
Right. So do, do the countries that have social safety
nets not have a as robust safety? Like it's just
a fascinating like I, I when when we threw this
out, Matt, as a topic. I was just like, we
could talk the entire time about this and I would
love to get like sociology experts in. And economics experts
in. Like, this is, this is so much bigger than
a cyber security problem. It's just really, this is fascinating
to me about, about, like, where does this go? And,
and the data that that was in the report just
did not. It just scratched the surface around like, yeah,
it's happening. Like, well, yeah, it's happening and it's been
forming. And to Nick, to your point, like, no, no
big surprise at all. But I, I would love like
the Freakonomics guys to do something on this. Like, this
would be fascinating. Well, then the other issue is none
of us here are of questionable moral character. So most
of us would probably think, I would never do that.
Right? It wouldn't even cross my mind. But we tend
to see, especially in the security industry, that you don't
have to have someone with that questionable of a moral
character. If you put them in a bad enough place
where eventually their morals will flex and bend because, well,
survival first and then high morals, moral second. And that's
just where some people, I think, are being pushed. And
so if you have people that already had a questionable
moral character, well, then it just got a lot easier.
I think that is the biggest thing, right? It's not
about what, what is, what is your line where you
will be pushed over that edge, right? We were having
this conversation about morality with somebody that if you want
to put food on your table for your children, what
comes first at that point? What do you choose? I
think that is what dictates a lot of things. And
this is not something which is happening today. We have
seen that in different parts of our country, in different
times, when there is a depression, when there is. I
mean, with mafia drug cartels, it's no different than this,
right? When you have a huge unemployment and then people
are trying to figure out their living, this is bound
to happen. The bad actors are bad actors. That's going
to happen no matter rain or shine. The good people
who are pushed into that is very easy when they
have no other choice. So that's why it becomes extremely
important for governments and corporations to think about how are
they going to reskill, how are they going to make
sure that human beings. To me personally, this is Suja's
opinion, which is we are up to no good when
we have nothing to do. We need to be busy.
Oh, idle hands, idle hands. One of the things that's
interesting to me is it's like a two way flow
in some ways. Right. Because we're talking about how when
we have layoffs or people are in difficult positions, they
might that, you know, use their legitimate skills for legitimate
ends. I'm thinking about how we talk about layoffs and
we talk about how we've seen, you know, a handful
of them happen recently and some of them have been
connected to oh, we're hiring less or we're letting people
go because now we have AI to do more things.
Anybody have thoughts on that? I'll keep it basic as
far as that goes. In my opinion, AI is going
to happen. It's not going away, you're not going to
stop it it. So embrace it. To me, it's the
next industrial revolution. I think I might have said that
last time. And to try to fight it just means
you're just going to get run over. So the best
you can do is learn it, learn to take advantage
of it. I mean, those of us here in technology,
we know, learn the new stuff. If you just sit
with the old stuff, you halt, you catch fire. That's
how it works. Now do I think we're trying to
move forward a little too fast in some cases maybe.
And let's end it there on that note of a
happy middle ground and move on to our next story.
Factory breaks up an AI fraud ring. In this case,
the attackers built a sophisticated infrastructure to exploit some free
and reduced AI compute from malicious ends. It worked kind
of like this and I'm a little bit impressed with
how the scheme worked. So you've got, you know, these
coding agents like factories and many others. They offer free
trials or reduced rates for new customers. So what these
scammers did is they use their own kind of AI
infrastructure to scam up a bunch of, to spin up
a bunch of fake organizations and sign up for accounts
and get these free and reduced rates from a bunch
of different assistants, not just factories. And then they pulled
it all together as like their own little, little pool
of tokens and then they bundled that and sold it
to other users who could then use it for things
like vulnerability research or funneling attack traffic, generally malicious ends.
Like I said, I'm just, I'm a little bit impressed
almost by the kind of elegance of it and the
sophistication of it. And I just want to throw to
you first, Dave, your thoughts on this kind of fraud,
this AI fraud we're seeing. I don't think it's terribly
new. Right. I think clever people are going to find
clever ways to break in, right. It. If you go
to any new thing, they're going to find, oh, they
didn't think of this. What's the, what's the slick way
to sneak in? Right. I mean pay walls were evaded
before they were figured out how to get around them.
Right. I mean anything, right. So I mean they'll fix
it. It's governance and it's policy and it's audit and
Right. So yeah, not terribly surprised. It's just growing pains.
It's one thing we have been talking about. How do
we stop AI from harming us as a society and
all those things. There is a lot of talk this
is about humans harming AI, right? Arming it out and
then how do we prevent AI from being harmed by
humans? Right. So it's in both sides and this is
one case of hey, how do they when used AI
to cause more harm and who did it? It's humans
who did it. It's not like AI harming us, it's
humans who did it. How do we bring that protection
and how do we make sure that this becomes a
critical infrastructure? Now AI is not something pretty on top.
It's part of the critical infrastructure. Critical infrastructure which was
not exposed is now exposed thanks to AI. How do
we protect it? How do we make sure the right
controls are in place? I think zero, like free tier
became a zero day vulnerability. Now that's what this start
is. That's a really good point. Right. The free tier
became a zero day vulnerability. I like how you put
that. And I also. You took the words right out
of my mouth when you said that this was about
humans attacking AI. Right. Like it's very interesting to me.
The anthropic story that I compared it to was very
much about AI being used to attack and now we're
talking about attacking AI. And sometimes I wonder if in
our conversations around AI security we often focus a lot
on the AI powered threats and even how AI, how
defenders are using AI but not necessarily on the fact
that you have to also defend the AI. Right. Like
it's part of your system. It needs protection too. So
I think that this, you know, it raises the salience
of that point. Nick, any thoughts on your end? I
with it. So we spend so much time finding out
what we can do without asking ourselves what we should
do. And. And it happens. And as someone said earlier,
I think it was you, Dave, it's growing pains and
it is what it is until we figure out how
to put better guardrails around this thing. And for every
guardrail we put up, somebody's going to figure out a
way to circumvent that guardrail. So we've got to keep
trying. It's just going to be continuous rat race, as
the security industry has always been. So welcome back to
the club. One of the things that was really interesting
to me was the way that factory kind of responded
to this after they found it. They talked about the
coding assistant itself to create a set of fraudulent traffic
classifiers so it could spot when someone was coming through
this little network, evaluate traffic against those classifiers, and then
block it. Right? So that's a clear use of like
AI being used to stop AI. I thought that was
extremely nifty. And I want to just go back around
the circle real quick to get some thoughts on how
we protect our AI. Like such said, I'm going to
throw. Shade on that really quick because if they were
able to fix it and do that so fast, why
didn't they do it in the first place? That's a
good point, Nick. That's a good point. That's like me
figuring out, wow, if I lock the door, the bad
guy has a harder time getting in. Maybe I should
have locked it in the first place. You know? No,
that's. That's fair, right? That's fair. Maybe those traffic classifiers
should be there in the first place. Maybe it shouldn't
take an attack. I don't know. I guess you're right.
Or maybe, I don't know, maybe Tyneside is 2020. It's
one of those things of throwing it out there to
use it before it's ready. Any other thoughts on that,
Dave, you have any thoughts there about the AI classification
or just protecting our AI in general? I agree with
Nick. I think, I think there's just, there's a. There's
a. We got to get it out there, right? And
it could be. We got to be first to market,
right? Because I'm competing, right? Or my CFO says I
have to, right? Because we're going to save, you know,
12 cents or $10 million or whatever the, whatever the
business case is, and it doesn't matter if it works,
right? Because I'm going to make my date, right? And
so what's going to get cut? This stuff, right? Guard
rails, audit oversight, security, robust testing. Boring. I didn't hear
anything. Those are all non functional requirements, right? None of
that stuff. I'm not putting any of that in my
commercial. Right. None of that's going in my super bowl
commercial. None of that's it. I do have a chicken
and a monkey, though. Those things are going in, right?
So. I guess. Yeah, I mean. I mean, I think.
I think, like, there's such speed, and we. It's got
to get out there. You got to get the press
release. You got to get the clicks. Right. They want
to get the. The free trials used. I love that.
I mean, su. Beautifully said, right? Their zero day was
their free trials. Like, that's like. Yeah, that's awesome. Right?
So someone found a way through it. That's a good
one. We are. I mean, I'm telling you, this is
a tagline machine, this episode, folks. Suja, I just want
to give you a chance. Any last thoughts on this
topic to round us out before we move on to
the next one? This is where AI Combating with AI.
I think one of our podcasts where JR was talking
about the red agent and the blue agent. Red being
bad, blue being good. And then we. We figured out,
how do we make sure? Because as Dave just pointed
out, you need AI to combat AI the same, just
like how you need humans to do that. So we
need to be thinking about it day one, day zero,
rather than after the fact. Absolutely. Let's move on then,
to our final story for the day, something much lighter
than the things we were just talking about. A wind
farm worker who tried to use turbines to mine cryptocurrency.
An employee at a Dutch wind farm was caught installing
crypto mining rigs on his employer's network, including blockchain nodes
inside of the actual wind turbines themselves. You know, crafty,
but, you know, he did get caught. Of course, it's
comical, but it is also a good reminder of the
dangers of insider threats. For example, we did see a
more serious insider threat last week at CrowdStrike, where the
cybersecurity firm found out one of their employees was selling
screenshots of internal systems to our friends at Scattered Lapses
Hunters. And the hackers said they agreed to pay this
insider $25,000 for that activity. So, you know, it can
be a lot more serious. But to start off again,
I just want to get some initial reactions to either
this wind farm scheme or insider threats in general. And,
Nick, like I said, I know you folks tackled this
on your latest episode of not the Situation Room. So
start us off here. What are your thoughts? Well, first
off, I want to say hats off to CrowdStrike for
catching that person before their dastardly scheme was able to
take hold because they. They caught him and stopped it
before access was granted to. To our shiny Lapsis hunter
friends. And this, this one, it's hard to tell it
with a straight face. I mean, just like I said
before on. On our podcast, the idea of windmills mining
bitcoin is just. It's just pure comedy. And the salt
in the wound is the fact that they did it
while they were. The. The individual did it while they
were in the process of already trying to recover from
a ransomware event. Event. It was like, really, dude? I
mean, come on. And so, yeah, I mean it highlights
the threat of, you know, that insiders can pose. But
this one, I never would have thought of that. But
he, like, he, he. He did get busted and he
did have. He has to perform a certain. I forget
the number amount of community service hours and he has
to pay a fine back to the company for damages
and to enter the state. It's creative though. It's innovative.
You know, he was, he was thinking. Never heard of
that before. I have to give him credit for that.
Using. Using green energy to mine bitcoin. I was just
thinking what Nick was going to say. He didn't want
anybody to be using their laptop or doing holiday shopping.
Here is a guy. Yeah, it's like that on steroids,
right? It's like, don't use your laptop to go holiday
shopping. Don't use the company's wind turbines to mine bitcoin.
These are simple things. Really, folks. These are simple things.
Things. But Suja, no, I wanted to give you some
space too. Any thoughts on your end about this or
also just again, insider threats in general, things to be
vigilant about. What are your thoughts? This guy knew what
he was doing. So obviously. So we need to figure
out, even operationally, what are the alerts there where you
are looking at anomalies to say something? Because anomalies can
be that your customers like what you're doing or it
could be something that is happening in the system. So
we need to have better tools to detect these anomalies
so you can catch it. But inadvertently people doing it.
Right. Because just like what the shopping thing that Nick
talked about where people use their laptops for shopping all
the time or you just took a stapler home or
like sticky home. People are used to that. They don't
think it is wrong. So this can become an extension
to it where when they are using these tools, they
don't think that they are doing anything wrong and then
they end up doing it. So that's why the tools
need to be there to prevent us from doing some
of these things. And the landscape is evolving every day,
so we just learn from it. As Dave was talking
about, we are in growing pains. We have to learn
and then make mistakes and then put guardrails and keep
doing it. It's an iterative process. That's an extremely good
point. And when we say a word like insider threat,
it sounds very evil. And me. And sometimes it is
kind of malicious. But like you said, you know, shopping
on the company laptop, as we keep saying, that's also
a version of insider threat, right? It's negligent, it's not
malicious, but it's still a version of that, and it's
worth being, you know, aware of that kind of thing.
Dave, any thoughts on your end here? Yeah, I mean,
I know, shocking. And I'm not kidding, right? So, like,
this is the first. First time we've said ot. This
is good. I mean, now, granted, we don't have an
outsider attacking ot, and it's not really an attack, but
this is real, right? I mean, we've got a very
large portion of our world that is not it. In
fact, it doesn't exist without the ot, right? It is
not running without juice. It needs the power, and that's
just a simple part of it, you know, So I
think OTs and, and the securing OT, I mean, that's
a. That's a couple of weeks of podcasts. Yeah. Dave,
I was actually never a fan of calling it something
different because to me, one doesn't exist without the other.
So it's it OT however you want it Iot. Right?
There we go. Now that's another thing, right? New, cool,
different names to make it something different. But yeah, you
know, I'm getting that for sure. For sure. But I
mean, it's. It's a whole nother realm of. Of things
that are. Are currently being modernized, right? Smart everything, grids,
etc. Etc. Etc. Right? And AI is just sitting there
looking at it, waiting to get its gritty little pause
on it. It could be opposite ends of the spectrum,
right? Because you're talking about AI, which is the newest
of all things we're talking about, and then ot, which
is probably one of the oldest. And OT was never
meant to talk to those other things. That's the. It's
the first kind of story that we've had here that
has OT in it. So I was kind of like,
oh. Kind of interesting with all these AI and everything.
Energy becomes a key thing, right? So energy theft has
become easy because of what we have today. So we
need more compute power for anything good, bad and ugly.
So how are people going to tap into it? That
becomes a huge threat like threat vector now. And as
Dave pointed out, that is now exposed to the world
for easy for grabs. And you know, I, I, you're
right, Dave. This is the first time in this episode
we've talked about ot, which operational technology for people listening
who aren't aware of that. The producers have yelled at
me in previous episodes for not clarifying that. So OT
is operational technology. But yeah, it's a good point though
that this is the first time we've talked about it
in this episode. But it is a massive attack service.
And like you said, Nick, you know, it's, it's weird
that we treat them as separate things, right? And, and
in treating them as separate things with different names or
whatever, we also create this kind of gap where like
we know that that OT is patched less regularly than
IT and, and you know, there are various reasons for
that, but at the end of the day it does
create like a two tiered system. And I don't know,
we're leaving ourselves kind of open in some ways. So,
you know, this is, and this is one of those
examples of how we leave ourselves open. Maybe people weren't
paying as much attention to these turbines as they might
have been to a work laptop. I don't know. You
know. Well, I'm sure that the, I'm sure that the
guy was hoping that no one was paying attention and
mystery van was outside? That's all the time we have
for today. Thank you to our panelists, Nick, Dave and
Suja. Thank you to the viewers and the listeners. As
always, subscribe to Security Intelligence. Wherever podcasts are found, stay
safe out there. And if you haven't yet, thank your
IT security people. I hear they really like fruit baskets.
And keep an eye on your audio feeds this Friday,
November 28th for a special audio only bonus episode of
Security Intelligence. We've got a malware reverse engineer coming on
to tell us the story of what it's like to
discover a new strain of malware. Right in your inbox.
Again, that's Friday, November 28th. Coming to Spotify, Apple Podcasts
and wherever else you listen to the show. Thank you
folks. folks.