00:00:00:02 - 00:00:04:02
Martin
This is just the start of the vulnerability sooner. How do we fix it?
00:00:04:04 - 00:00:21:09
Adam
I won't say the name of the company works for him, but basically he was approached by a government contractor that said, hey, we have this program where we red team you with an agent swarm so that you can test your defenses. He was like, all right, sign me up. This contractor turned on the agent swarm. They were defending.
00:00:21:09 - 00:00:39:09
Adam
Defending? They were losing the whole time they were losing. It was bad. It was like a bloodbath in there. And then he called the provider and said, all right, guys, we're done. You can stop now. And they're like, we turned it off. And he's like, no, no you didn't. Your agent swarm got a new one and kept going.
00:00:39:10 - 00:00:51:13
Martin
No, that was a really shitty thing to do. This is ship talk brought to you by harness, where we break down how software delivery is actually changing in the area. I'm Martin Reynolds.
00:00:51:13 - 00:00:53:00
Adam
And I'm Adam Arellano
00:00:53:01 - 00:01:02:21
Martin
All right, let's get right into it. And I feel like we have to start with the vulnerability problem and what is now Black October. So tell me more.
00:01:02:22 - 00:01:28:26
Adam
So first of all, Vaughn Apocalypse started in October is in October. That PHP happened, which is the big one because it shocked everyone. But there's actually a ton of other stuff going on. But what happened, we believe, is that in September, sometime the open weight models caught up to the frontier cyber security models and are now as capable as fable, mythos, and I think Astra or something like that is the the other one.
00:01:28:26 - 00:01:53:25
Adam
And as a result, it took a couple of weeks, but the bad guys figured out how to use those models to find novel vulnerabilities everywhere. And so what's funny is that October is also Cybersecurity Awareness Month. Theories are out there. Maybe this was just an elaborate email phishing scam that somebody running to raise awareness for cyber security magic.
00:01:53:26 - 00:01:59:11
Adam
Or is it that it just happened to be the timing?
00:01:59:12 - 00:02:21:07
Martin
I feel like it's just the timing because I feel like it's been a drumbeat. It's been a drumbeat week after week after week. And actually I get a little bit frustrated by it because it's like, hey, we've created this huge problem and exposed all these security vulnerabilities because AI is great, but we want you all to fix it.
00:02:21:08 - 00:02:26:14
Martin
It's your problem to fix. But we made the problem and controversial.
00:02:26:15 - 00:02:40:13
Adam
Take that I read. I can't remember who wrote it, but it was basically like, this is the worst Mafia wreck in the world. Like AI companies went around, set a bunch of fires, and then pulled in with a dump truck full of fire extinguishers. We're like, hey, you want.
00:02:40:16 - 00:02:43:15
Adam
Some of these? They fill off a truck. I'll give it to you like two for one. Is that what.
00:02:43:15 - 00:03:02:22
Adam
You want? Like, they created the problem and now they're going to sell. Like, actually, if this is funny, going back to anthropic says S-1 filing, that is where they think they're going to make a ton of money is going to be in cybersecurity because they create a cybersecurity problem. Do you buy that? Do you think that's what do you think this was intentional?
00:03:02:24 - 00:03:08:21
Martin
A I get what you're saying. And you're right. That's all I'm going to say. Just say no.
00:03:08:24 - 00:03:11:00
Adam
Sorry one more time. What was it?
00:03:11:02 - 00:03:15:26
Martin
Just repeat. I'm not repeating. It's recorded. If you want to hear it again, you can rewind.
00:03:15:27 - 00:03:23:21
Adam
So narrator broke in and says. In reality, Martin said that one was right. Go ahead. Sorry, sorry.
00:03:23:22 - 00:03:43:28
Martin
Go ahead. So there was that warning. I know about a month ago from Jason Clinton, and he was saying, you know, that this is just the start of the vulnerability tsunami that's going to happen over the next few months. And we're saying Black October right now, but is Black October, what do we call the next one?
00:03:43:28 - 00:03:53:10
Adam
Well, I think October was the to take the metaphor too far. October was the water receding from the coastline in advance of the tsunami coming? Is what's happening?
00:03:53:12 - 00:03:56:19
Martin
Okay, so how do we fix it?
00:03:56:25 - 00:04:22:22
Adam
Get to high ground. Get to high ground. Run your ass up a hill. Something you can do. All right, so Jason Clinton sees what? Anthropic. Good, dude. Very scary person to talk to because he says things like Von Zero and you're like, what's volunteering? And he follows up on Twitter and then explains what is. So a lot of people think that volunteer means that software won't be shipped with vulnerability vulnerabilities.
00:04:22:22 - 00:04:49:16
Adam
So in other words, when we ship software, we'll have no vulnerabilities. That's actually not what he's saying. The distinction is that zero known vulnerabilities means that we haven't found any remaining issues. Zero exploitable vulnerabilities means there really aren't any left to find. And that's what Von Zero means. Jason's predicting that in the next 18 months, we'll get to a point where zero exploitable vulnerabilities will be left to find.
00:04:49:19 - 00:04:58:24
Adam
So it's not just that we won't ship any with known, it's that software will be so good that it will actually be unexploited. So this is controversial.
00:04:58:26 - 00:05:24:10
Martin
Like he is genuinely betting that, you know, AI scaling essentially will like shrink the cost of being able to do that into smaller, cheaper models. So essentially developers can find and fix bugs before they reach production. Right? And it is plausible for newly written code, I think. I don't think it does a lot for the backlog. You know, the code that's been there for 20 years and there's millions of lines of it.
00:05:24:12 - 00:05:25:25
Martin
I'm not saying that AI.
00:05:25:27 - 00:05:30:04
Adam
You're talking about the backlog of software that was bought for me. Yeah.
00:05:30:12 - 00:05:44:08
Martin
Yes. Yeah. Not the vulnerability backlog, the backlog of software, if you like. Is this the antidote to the Von Polyps? And I don't think I personally don't think it is. I think it's a destination rather than antidote.
00:05:44:09 - 00:05:58:05
Adam
I actually think that he's correct for fully SaaS based modern companies whose code started I don't know. 18, 20 months ago, maybe four years ago.
00:05:58:06 - 00:06:24:28
Martin
So I think there is nuance to this. So there is a stat that I that came up with because we talk about this like soon Army of Tsunami or the von clips and, you know, as we were calling it. But route evidence they did like some. They looked at all the CVS that have been created since 2018, and they found that attackers have never touched 98.5% of them.
00:06:25:00 - 00:06:48:22
Martin
So there's already a huge and I know what you're going to. I can almost hear what you're going to say. But if that's true, right. That argues that the answer is prioritization and fast remediation rather than necessarily the number. So not zero. But you know, that's my take on that. But I know you're going to challenge that data instantly.
00:06:48:27 - 00:07:16:19
Adam
Yeah. Well I wouldn't challenge it. I actually I know that data is true. I could have told you this before. AI because I was I bring this up. I brought this up a lot last episode, but I was prompted last week and I was passing by a full on, hacker like hoodie, crazy hair like mine, facial piercings, and the little snippet that I caught as I walked by was like, people are going to shit a brick when they find out that you can hack something without there being a CV involved.
00:07:16:19 - 00:07:41:03
Adam
And I was like, that's. Oh no. Like, oh no. You mean that the hackers aren't going and checking out CVS from the CV library and then using them for a while to hack? Oh, no. Yeah, you're correct, but I think that says more about the value of CVS up to this point. C is up to this point where an economic engine okay.
00:07:41:06 - 00:08:03:13
Adam
Economics because what was happening was if you can hit somebody website, find an exploitable vulnerability and reported to that company, you could get money. And so what does that mean. And that's like very either from beginning to super advanced. And you get paid based on whether you're beginner super advanced, can hit any website and find that vulnerability and get paid.
00:08:03:16 - 00:08:21:06
Adam
Here's what happens when shitty code. And this is where I do think it's shitty code. When shitty codes being shipped with the same problems over and over and over and over again, is that the same engineer that is lazy and uses the same like outdated library, but in a different part of the application will trigger a new CV with the same root cause.
00:08:21:07 - 00:08:25:01
Adam
And so of course 98% of them have never written hacked because.
00:08:25:02 - 00:08:56:07
Martin
Yeah, because they, they find out how to exploit one and then that gets attacked multiple times rather than putting the F, because that's lower effort. I get what you're saying. Okay, so this story has been going on for a couple of weeks, and it's genuinely one of my favorite stories. But this week, the FBI, Ceaser and three other US agencies warned on November the 5th that attackers are actively going after internet exposed refrigeration controllers in grocery stores, cold storage and healthcare.
00:08:56:07 - 00:09:24:03
Martin
And it follows the tax that hit an estimated 250 to 350 French supermarkets. Then they hit 150 stores in six European countries. And then this one just makes me angry. Temperature changes at three French blood story sites that that that last one just annoys me. So I have a bit more detail. But Adam, what's your initial reaction?
00:09:24:06 - 00:09:52:01
Adam
There are agents for good, actually. There's a there's a hierarchy of chaos. There's chaotic good, chaotic neutral, chaotic bad. When you take out a bunch of refrigeration units in grocery stores, to me that classifies Chaotic Good because you're you're like, hey, shot across the bow, you've got refrigerators connected to the internet. Maybe it's useful, maybe it's not useful that you have all these connected to the internet.
00:09:52:07 - 00:10:18:04
Adam
But are you thinking about their security? Three weeks go by. Not a huge response. The manufacturers actually didn't push out a release that was effective. And those same controllers are used by more critical infrastructure. And so I'm curious if it's the same group and if they're not trying to escalate slowly to wake people up in a kind of chaotic, neutral, chaotic evil type deal.
00:10:18:06 - 00:10:53:07
Martin
So I do want to get into that a little bit that you were saying they didn't roll out a patch effectively. They rolled out an effective patch to newer refrigeration units. However, a lot of these refrigeration units are at they stopped producing the software and firmware updates for them like a long time ago. So it's not even that they they specifically have a way to update them or, you know, they need to kind of bring back that code base and say, hey, I need to try and fix this vulnerability or go out and physically replace the board.
00:10:53:08 - 00:10:59:07
Martin
The, you know, the chip and put an upgraded refrigeration unit on it. So, you know and.
00:10:59:09 - 00:11:04:16
Adam
Thank you for agreeing with me. That was what I said. They did not rule out an effective pet because, okay.
00:11:04:18 - 00:11:10:24
Martin
Because I don't think it was that they didn't want to. It's they they didn't have the capability to
00:11:10:26 - 00:11:31:28
Adam
So first talk it unprompted was given by Caleb Sema. I won't say the name of the company works for him, but basically it was a very transparent, which was encouraging how transparent he was he and the company were being he was approached by a government contractor that said, hey, we have this program where we read Teemu with an agent swarm so that you can test your defenses.
00:11:31:28 - 00:11:55:03
Adam
And he was like, all right, sign me up. And they're like, do you want to notify your team? And he chose not to notify his team, which I still have itches about that. But I kind of agree with him. He didn't inform his team. This contractor turned on the agent swarm and everything. Like. Like everything caught fire. The team, like, dropped everything.
00:11:55:04 - 00:12:19:01
Adam
Everybody was like, on it, on and on it. They were defending. Defending. They were losing the whole time. They were losing. It was bad. It was like a bloodbath in there. And then Caleb was like, hey, that was a test. Everybody fire drill past. Except the fire drill wasn't past. Hold on, hold on. And then he called the provider after the stop time and said, all right, guys, we're done.
00:12:19:02 - 00:12:41:01
Adam
You can stop now. And they're like, we turned it off. And he's like, oh no, you didn't like it's it's still actively like it's still actively penetrating the network and actually still shucking and jive and moving around. And they're like, no, no, no, we we shut off the entire EC2 instance. Okay. But your agent swarm got a new one and kept going.
00:12:41:03 - 00:12:42:14
Martin
And so like.
00:12:42:16 - 00:13:12:21
Adam
Yeah, yeah. And so that that's what this reminds me of. I wonder if whatever group is doing this is going from high visibility, low impact to high visibility, moderate impact. And if nobody listens, they're going to go high visibility, high impact because they I don't know, there are people like this in the world that feel like every once in a while, you need to let a window break so that people hear the sound of it and remember, oh, that happens.
00:13:12:21 - 00:13:17:06
Adam
That can happen. Like see the actual effects of it. So they actually do something about it.
00:13:17:06 - 00:13:39:28
Martin
I'm genuinely shocked. I mean, not shocked that they would do this. I'm shocked that they would do this without any aware. And they made the whole team go through that bloodbath. I'm also shocked that I'm less shocked that the agents found a way to carry on hacking the system, even when they were disabled. That was less of a shock to me, but it just feels like the wrong way.
00:13:40:01 - 00:13:44:06
Martin
I you know, I try not to swear on these, but that was a really shitty thing to do.
00:13:44:12 - 00:14:07:09
Adam
I don't disagree with you, but let me tell you that the number of times that I went to bed exhausted and bloody in training was worth every time that I didn't bleed in combat. And like, I get what you're saying, but this is a situation where the team needed I'm. This is another reason why I'm a bad parent that I.
00:14:07:09 - 00:14:33:15
Adam
I feel like discomfort is the ideal situation when you're safe. Discomfort is is what we need. We need to feel this pain as a society. We need to feel this pain as individual teams to really understand the urgency behind what's happening. So yes, they felt shitty. Yes, they were stressed out. That is an important and valuable lesson. Inevitable pain is important, but it should be felt in manageable increments.
00:14:33:18 - 00:14:59:06
Martin
So this is okay. This isn't this hasn't been intentional for this episode, but for me, there is a bit of a theme here. So even if you, you know, you look at all the stories we've talked about so far today, all of them, you could you could describe, you know, ascribe to that that thinking of, you know, we know how to do this stuff better than we do.
00:14:59:07 - 00:15:25:15
Martin
We've chosen not to as a, you know, as a collective set of people, you know, organizations, they've assessed risk. They've decided it's not they're not going to do stuff about a lot of these things. Now, suddenly, you know, everybody's acting surprised or not. Everybody obviously, you you knew this was coming because of your, you know, security.
00:15:25:18 - 00:15:44:19
Adam
I know I have a good friend of mine that is the CISO at a company that makes audio devices and the companies like, hey, nerd, shut up. We just want to make audio devices. He's like, yeah, but they connect to the internet. They're like, shut up, nerd, give me your lunch money. Go away then. They've been doing this for years.
00:15:44:19 - 00:16:08:06
Adam
And then not three months ago something happened and he he went into the board and said, I didn't want to be here saying, I told you so, but I need to say it now because you need to understand this is the consequence of what we chose to do. And it wasn't securities choice. This was engineering's choice. And guess who's choice that has to be to fix it?
00:16:08:08 - 00:16:16:14
Martin
Okay, I'm going to instantly tell you that was not Engineering's choice and it wasn't securities choice. It was a collective decision.
00:16:16:16 - 00:16:17:10
Martin
It was a business.
00:16:17:10 - 00:16:37:22
Martin
Ultimately, it was a business choice. Yes. So, you know, you I know you want to blame engineering, but that is a business choice because it is the business's choice about how they spend their money in investing in the things that they build. And they had the information and they chose to not act on it because the risk was low.
00:16:37:28 - 00:16:51:02
Adam
Yeah. For business reasons. Yeah. So I, I am sufficiently chastised for blaming it on engineering. You are correct, Martin. It's not engineering's fault. It is a business problem. And I've been corrected about that several times, by the way, because I.
00:16:51:02 - 00:16:51:18
Martin
Love to say.
00:16:51:21 - 00:16:55:14
Adam
Engineering's fault. But you're right. It's a business decision.
00:16:55:16 - 00:17:20:27
Martin
No it is, and I've I've had some conversations recently with some of our own internal teams around, hey, they're talking about vulnerability management. And I've been trying to say, hey, yes, it's a security problem, but it's also an engineering problem. And it's a business problem because you need all three of those to work in lots lock step to actually solve it.
00:17:20:28 - 00:17:35:06
Martin
So much to talk about, so much going on. I know we need to wrap up right now, but I do know and I can see animations in my head, thanks to you, that there was a little something that you did want to mention.
00:17:35:08 - 00:17:51:25
Adam
Little nothing. It's the most important story of the week. Miss paint got hacked. You have no idea how much time I spent as a child, using Miss Paint to make animations and draw little bubbles above Cindy Crawford head. That said, I love Adam so much time. Anyway, we don't have time.
00:17:51:25 - 00:17:53:09
Martin
For that.
00:17:53:12 - 00:18:05:09
Martin
In the midst of the the foam lips. You know, it is important to note that that the high value applications like Ms. Paint still get vulnerabilities.
00:18:05:10 - 00:18:22:17
Adam
Well, that has been shipped. Talk brought to you by harness. If you are a fellow lover of Miss Paint or Martin's opinions got under your skin, let us know in the comments, like and subscribe or went out for a miss. Paint and stop talking. Start shipping.