{ "version": "1.0.0", "segments": [ { "speaker": "Joana", "startTime": "0.0", "endTime": "8.4", "body": "Right now, there is a very high probability that a third party catering company is holding the Master Keys to your corporate boardroom." }, { "speaker": "Tim", "startTime": "8.4", "endTime": "15.235", "body": "Yeah. And worse, they've probably had it for, you know, five years, And your security team has absolutely no record of it." }, { "speaker": "Joana", "startTime": "15.235", "endTime": "23.794998", "body": "Which is just terrifying. Welcome to this deep dive, everyone. Today, we're looking at a wave of cyber breaches where hackers didn't actually need to break in." }, { "speaker": "Tim", "startTime": "23.794998", "endTime": "27.480001", "body": "Right. Because they just used the active keys you completely handed out in the first place." }, { "speaker": "Joana", "startTime": "27.480001", "endTime": "37.08", "body": "Exactly. So for our source material today, we are examining this incredibly dense, highly revealing audio log and live report from the Breach Desk." }, { "speaker": "Tim", "startTime": "37.08", "endTime": "44.575", "body": "And they do fantastic work. They meticulously track confirmed cybersecurity breaches, as well as ongoing investigations." }, { "speaker": "Joana", "startTime": "44.575", "endTime": "52.975", "body": "Yeah. And we are focusing on a very specific, highly volatile window in their reporting, specifically June 9 through 07/01/2026." }, { "speaker": "Tim", "startTime": "52.975", "endTime": "53.935", "body": "It was a busy few weeks." }, { "speaker": "Joana", "startTime": "53.935", "endTime": "65.99", "body": "It really was. And our mission today is to translate all this raw threat intelligence to actionable insights for you and your organization. We want to uncover those hidden, ignored attack surfaces in the modern corporate tech stack." }, { "speaker": "Tim", "startTime": "65.99", "endTime": "75.205", "body": "Because when you analyze this raw intelligence from the Breach Desk, a massive overarching theme emerges. Like it's impossible to ignore." }, { "speaker": "Joana", "startTime": "75.205", "endTime": "76.725006", "body": "Right. The connective tissue." }, { "speaker": "Tim", "startTime": "76.725006", "endTime": "85.44", "body": "Exactly. The connective tissue across all these incidents is the fundamental vulnerability of trusted third and even fourth parties." }, { "speaker": "Joana", "startTime": "85.68", "endTime": "92.4", "body": "Because we've built all our digital infrastructure on this intricate layered web of micro services and integrations." }, { "speaker": "Tim", "startTime": "92.4", "endTime": "99.665", "body": "Right. And attackers have realized that going head to head with a company's primary security apparatus aratus is just, well, it's inefficient." }, { "speaker": "Joana", "startTime": "99.665", "endTime": "100.705", "body": "It's way too hard." }, { "speaker": "Tim", "startTime": "100.705", "endTime": "106.305", "body": "Yeah, it's mathematically easier to exploit the trust you have already implicitly granted to someone else." }, { "speaker": "Joana", "startTime": "106.305", "endTime": "114.8", "body": "Okay, let's unpack this. Let's jump right into the first confirmed case study from our source because it is the glaring perfect example of this forgotten key problem." }, { "speaker": "Tim", "startTime": "114.8", "endTime": "115.6", "body": "It really is." }, { "speaker": "Joana", "startTime": "115.6", "endTime": "132.075", "body": "We're looking at a platform where the entire business model is predicated on absolute security, which is LastPass. Right. Now according to The Breach Desk, the attackers who are this extortion crew operating under the label Icarus, they didn't actually breach LastPass through its main vault infrastructure." }, { "speaker": "Tim", "startTime": "132.075", "endTime": "135.91501", "body": "No. They didn't. They compromised a connected SaaS tool called Glui." }, { "speaker": "Joana", "startTime": "136.32999", "endTime": "141.37", "body": "And the mechanics of this are just critical for anyone managing a tech stack today, right?" }, { "speaker": "Tim", "startTime": "141.45", "endTime": "148.89", "body": "Absolutely. The Icarus crew didn't need to crack zero knowledge encryption or you know brute force user master passwords." }, { "speaker": "Joana", "startTime": "148.89", "endTime": "150.17", "body": "Because that would take forever." }, { "speaker": "Tim", "startTime": "150.27501", "endTime": "155.315", "body": "Right. Instead they compromised Glui and just found a forgotten legacy credential." }, { "speaker": "Joana", "startTime": "155.315", "endTime": "155.955", "body": "Wow." }, { "speaker": "Tim", "startTime": "155.955", "endTime": "165.55501", "body": "And that single credential gave them access to an active OAuth token, which was essentially a live standing bridge directly into LastPass systems." }, { "speaker": "Joana", "startTime": "165.97", "endTime": "180.825", "body": "Okay. Let's break down the architecture of that OAuth token for a moment, just When to be an organization sets up an integration between two cloud services, they use OAuth so that basically human beings don't have to manually log in every single time. Right." }, { "speaker": "Tim", "startTime": "181.06499", "endTime": "184.42499", "body": "Every time data needs to move back and forth, it's a machine to machine passport." }, { "speaker": "Joana", "startTime": "184.42499", "endTime": "186.105", "body": "Right. So it's constantly active." }, { "speaker": "Tim", "startTime": "186.105", "endTime": "195.21", "body": "Precisely. An O token is a standing delegation of access. It just operates quietly in the background, allowing one application to interact continuously with another." }, { "speaker": "Joana", "startTime": "195.21", "endTime": "203.77", "body": "And when you grant that access, you define a scope, right? Like maybe it's read only access or maybe it's the ability to modify data." }, { "speaker": "Tim", "startTime": "203.85", "endTime": "214.43501", "body": "Yeah, exactly. But the structural flaw here is that a token with no one actively monitoring it is a token you cannot revoke because you don't even know it's there." }, { "speaker": "Joana", "startTime": "214.43501", "endTime": "216.115", "body": "Oh right, because you forgot about it." }, { "speaker": "Tim", "startTime": "216.115", "endTime": "230.31", "body": "Exactly. The Icarus crew used that live background key to step right through a side door. Nobody on the LastPass side was watching that door because nobody actively remembered the Glui integration was holding that specific level of access." }, { "speaker": "Joana", "startTime": "230.31", "endTime": "233.91", "body": "But the automated systems handling the API calls, they definitely remembered." }, { "speaker": "Tim", "startTime": "233.91", "endTime": "237.495", "body": "Yeah, they remembered perfectly and they let the attackers write in." }, { "speaker": "Joana", "startTime": "237.495", "endTime": "242.455", "body": "This just completely upends how most companies handle their compliance. I mean, about DORA." }, { "speaker": "Tim", "startTime": "242.455", "endTime": "244.375", "body": "Oh, the Digital Operational Resilience Act." }, { "speaker": "Joana", "startTime": "244.375", "endTime": "256.42", "body": "Yeah. Specifically Article 28. It mandates that financial entities and critical service providers manage their third party risks. And most compliance officers, they solve this by just creating a massive vendor register." }, { "speaker": "Tim", "startTime": "256.42", "endTime": "261.7", "body": "Right. They list out Salesforce, AWS, Microsoft, and they basically just call it a day." }, { "speaker": "Joana", "startTime": "261.7", "endTime": "264.1", "body": "Which is a complete illusion of control." }, { "speaker": "Tim", "startTime": "264.1", "endTime": "273.45502", "body": "It really is. A vendor register mapping out your primary contractors does absolutely nothing to map the fourth party layer." }, { "speaker": "Joana", "startTime": "273.45502", "endTime": "274.575", "body": "The fourth party layer." }, { "speaker": "Tim", "startTime": "274.575", "endTime": "284.29", "body": "Yeah. It doesn't track the thousands of OOTH grants, API keys and live service tokens that those primary vendors are holding inside your internal systems." }, { "speaker": "Joana", "startTime": "284.29", "endTime": "286.93", "body": "It's a massive structural blind spot." }, { "speaker": "Tim", "startTime": "286.93", "endTime": "293.69498", "body": "And regulators and auditors, as the Breach Desk source points out, are finally beginning to zero in on this layer." }, { "speaker": "Joana", "startTime": "293.69498", "endTime": "295.85498", "body": "Which means the pressure is really on you." }, { "speaker": "Tim", "startTime": "295.85498", "endTime": "296.25497", "body": "Yeah." }, { "speaker": "Joana", "startTime": "296.25497", "endTime": "303.055", "body": "If you are sitting in an organization running connected cloud applications, you need to have a very uncomfortable conversation with your CIO this week." }, { "speaker": "Tim", "startTime": "303.33", "endTime": "306.13", "body": "Definitely. And do not just ask them if you have a vendor register." }, { "speaker": "Joana", "startTime": "306.13", "endTime": "309.49", "body": "Right, because they will just hand you a spreadsheet of billing contacts and say you're good." }, { "speaker": "Tim", "startTime": "309.49", "endTime": "312.61", "body": "Exactly. You need to ask a highly specific architectural question." }, { "speaker": "Joana", "startTime": "312.61", "endTime": "322.49503", "body": "You have to ask, does our vendor register actually inventory the OOTH grants, the scopes, and the live service tokens those vendors hold inside our systems?" }, { "speaker": "Tim", "startTime": "322.815", "endTime": "329.215", "body": "And if they look at you blankly, or if the answer is just a flat no, well, you have an unmonitored attack surface." }, { "speaker": "Joana", "startTime": "329.24", "endTime": "336.12", "body": "Yeah. You basically have a digital master keys floating in the ether attached to companies whose own security posture you do not control at all." }, { "speaker": "Tim", "startTime": "336.12", "endTime": "337.24", "body": "It's a scary thought." }, { "speaker": "Joana", "startTime": "337.24", "endTime": "348.215", "body": "It really is. And if forgotten cloud APIs are the unmonitored backdoor, what happens when attackers move further upstream, like right into the very tools your developers use to build the software in the first place?" }, { "speaker": "Tim", "startTime": "348.215", "endTime": "354.215", "body": "Ah right. This brings us to the second confirmed incident in our source, the NPM supply chain attack." }, { "speaker": "Joana", "startTime": "354.215", "endTime": "360.11002", "body": "So for some context, the NTM or Node Package Manager is basically a foundational for the modern web." }, { "speaker": "Tim", "startTime": "360.11002", "endTime": "367.07", "body": "Right. Developers download pre written packages of open source code from NPM so they don't have to write basic functionalities completely from scratch." }, { "speaker": "Joana", "startTime": "367.07", "endTime": "373.745", "body": "Right. Why reinvent the wheel? A single modern application might rely on what? Thousands of these open source dependencies?" }, { "speaker": "Tim", "startTime": "373.745", "endTime": "389.73", "body": "Oh, easily thousands. Mhmm. So on 05/25/2026, two specific packages were uploaded to this registry. HTML to Gutenberg version four point two point one one and fetch page assets version one point two point two point nine." }, { "speaker": "Joana", "startTime": "389.73", "endTime": "397.65002", "body": "Okay. And usually, in a supply chain attack like this, the malware triggers during the actual installation process. Right?" }, { "speaker": "Tim", "startTime": "397.875", "endTime": "398.755", "body": "Yeah. The" }, { "speaker": "Joana", "startTime": "398.995", "endTime": "407.315", "body": "developer types npm install, the package downloads, and a malicious install script runs the payload right then and there." }, { "speaker": "Tim", "startTime": "407.315", "endTime": "415.97", "body": "That has been the standard vector for years. But the threat actors behind this specific campaign bypassed that mechanism entirely." }, { "speaker": "Joana", "startTime": "415.97", "endTime": "417.65002", "body": "Here is where it gets really interesting." }, { "speaker": "Tim", "startTime": "417.65002", "endTime": "425.17", "body": "Yeah, the malicious code did not trigger upon installation at all. Instead it was deeply embedded inside a Visual Studio code task." }, { "speaker": "Joana", "startTime": "425.375", "endTime": "434.015", "body": "Wait. I have to push back here because developers are generally paranoid by nature. Visual Studio Code or Versus Code is an incredibly popular environment for writing software." }, { "speaker": "Tim", "startTime": "434.015", "endTime": "435.05502", "body": "Very popular. Yeah." }, { "speaker": "Joana", "startTime": "435.135", "endTime": "439.855", "body": "You are telling me a seasoned engineer just opens a project folder and gets compromised." }, { "speaker": "Tim", "startTime": "439.93", "endTime": "441.12997", "body": "That's exactly what happened." }, { "speaker": "Joana", "startTime": "441.12997", "endTime": "448.25", "body": "Without seeing a single warning prompt, without running an executable or compiling any code, how does the software even allow that to happen?" }, { "speaker": "Tim", "startTime": "448.25", "endTime": "465.77502", "body": "It allows it because of developer convenience. Inside a Versus Code workspace, there is often a hidden folder called .vscode and it contains a file named tasks. Json. This file tells the editor how to handle repetitive tasks like, you know, building the project or running unit tests." }, { "speaker": "Joana", "startTime": "465.96", "endTime": "467.0", "body": "To save time." }, { "speaker": "Tim", "startTime": "467.0", "endTime": "478.91998", "body": "Exactly. So the attackers utilized a specific configuration within this file that instructs Versus Code to automatically execute a task the exact moment a specific folder is opened." }, { "speaker": "Joana", "startTime": "478.91998", "endTime": "486.57498", "body": "Okay. So the developer clones repository, double clicks the folder just to start their work day, and that simple action alone pulls the trigger." }, { "speaker": "Tim", "startTime": "486.57498", "endTime": "498.22", "body": "Yes. The trigger is completely silent and immediate. That is wild. But the execution mechanism gets even more sophisticated. Because the initial code hidden in that task didn't actually contain the malware payload." }, { "speaker": "Joana", "startTime": "498.22", "endTime": "498.94", "body": "Oh really?" }, { "speaker": "Tim", "startTime": "498.94", "endTime": "508.62", "body": "Yeah. If it had, typical antivirus software might have flagged the file on the hard drive. So instead, when the task fired, it initiated a network request out to public blockchain transactions." }, { "speaker": "Joana", "startTime": "508.62", "endTime": "515.475", "body": "Wait, stop right there. How does a local folder task read a Blockchain? And why would an attacker even use a Blockchain for this?" }, { "speaker": "Tim", "startTime": "515.555", "endTime": "525.97", "body": "It's a brilliant evasion tactic, honestly. The automated task simply ran a command to query a public Blockchain Explorer API, like Etherscan for example." }, { "speaker": "Joana", "startTime": "525.97", "endTime": "526.93", "body": "Yeah, okay." }, { "speaker": "Tim", "startTime": "527.08997", "endTime": "539.195", "body": "It looked up the transaction history of a specific attacker controlled wallet address. The real malware payload was hidden inside the hex data or the memo fields of those immutable blockchain transactions." }, { "speaker": "Joana", "startTime": "539.195", "endTime": "548.715", "body": "That is just insane because traditional security tools, they look for malware reaching out to known bad IP addresses or, you know, suspicious domains." }, { "speaker": "Tim", "startTime": "548.715", "endTime": "554.08997", "body": "Right. But querying a public blockchain explorer just looks like normal, legitimate web traffic." }, { "speaker": "Joana", "startTime": "554.08997", "endTime": "558.81", "body": "Exactly. And you can't exactly issue a takedown request to a decentralized blockchain." }, { "speaker": "Tim", "startTime": "558.81", "endTime": "569.245", "body": "No, you can't. The data is permanent. Yep. So the task pulled that data down, reconstructed the payload in memory, opened a backdoor, and dropped an info stealer directly onto the developer's machine. Wow." }, { "speaker": "Tim", "startTime": "569.245", "endTime": "576.045", "body": "Yeah, and it immediately began harvesting browser passwords, vault credentials, authenticator data, and git access tokens." }, { "speaker": "Joana", "startTime": "576.045", "endTime": "582.95", "body": "This represents a violent shift in the trust boundary. For decades, the entire security industry taught people that the boundary was execution." }, { "speaker": "Tim", "startTime": "583.11", "endTime": "586.87", "body": "Right. Do not click the bad link. Do not run the suspicious file." }, { "speaker": "Joana", "startTime": "586.87", "endTime": "596.93506", "body": "But almost no organization governs the simple act of a developer opening a project folder. The boundary has moved completely upstream into the developer's daily workflow." }, { "speaker": "Tim", "startTime": "597.015", "endTime": "606.375", "body": "And this exposes another massive layer of liability that is entirely invisible to the boardroom. We talked about DORA requiring you to know your ICT providers." }, { "speaker": "Joana", "startTime": "606.375", "endTime": "606.53503", "body": "Yeah." }, { "speaker": "Tim", "startTime": "607.06", "endTime": "615.3", "body": "But compliance frameworks do not ask which of the thousands of open source packages your engineers casually import into their environments every single morning." }, { "speaker": "Joana", "startTime": "615.3", "endTime": "616.57996", "body": "No, they definitely don't." }, { "speaker": "Tim", "startTime": "616.57996", "endTime": "622.25995", "body": "And they certainly do not ask how your internal development teams configure their IDE auto execution settings." }, { "speaker": "Joana", "startTime": "622.685", "endTime": "635.64496", "body": "So, based on the Breach Desk's intelligence, what is the actionable mandate for our listener here? You need to instruct your engineering teams today to disable automatic task execution on folder open within Versus Code." }, { "speaker": "Tim", "startTime": "635.64496", "endTime": "636.365", "body": "Absolutely." }, { "speaker": "Joana", "startTime": "636.365", "endTime": "649.87", "body": "Furthermore, you need to mandate that Workspace Trust is set to manual across all developer machines. When a developer opens a new folder, the system must force them to explicitly confirm they trust the authors of that code before anything is allowed to run." }, { "speaker": "Tim", "startTime": "650.02997", "endTime": "658.995", "body": "Yes. And crucially, you have to enforce this programmatically by policy not just by sending a memo and assuming developers will comply." }, { "speaker": "Joana", "startTime": "659.155", "endTime": "663.235", "body": "Because an assumption in cyber security is simply a vulnerability waiting to be discovered." }, { "speaker": "Tim", "startTime": "663.87", "endTime": "664.91003", "body": "Well said." }, { "speaker": "Joana", "startTime": "664.91003", "endTime": "676.27", "body": "So we have traced the supply chain threat from the vendor level in the cloud with LastPass down to the developer's local laptop with the NPM attack. Now let's follow this stream all the way to the" }, { "speaker": "Tim", "startTime": "676.27", "endTime": "676.605", "body": "end" }, { "speaker": "Joana", "startTime": "676.605", "endTime": "676.925", "body": "user." }, { "speaker": "Tim", "startTime": "676.925", "endTime": "677.805", "body": "The final mile." }, { "speaker": "Joana", "startTime": "677.805", "endTime": "682.52496", "body": "Exactly. Our source's third confirmed incident is the breach of Polymarket." }, { "speaker": "Tim", "startTime": "682.52496", "endTime": "693.78", "body": "Right. Polymarket is a highly active prediction market platform and their compromise followed the same thematic pattern of exploiting third party trust, but it happened at the endpoint the user's screen." }, { "speaker": "Joana", "startTime": "693.78", "endTime": "697.22003", "body": "Okay. So they didn't crack Polymarket's back end databases?" }, { "speaker": "Tim", "startTime": "697.22003", "endTime": "704.74", "body": "No. They didn't. Instead, third party JavaScript was injected directly into the live sessions loaded in the user's actual browser tabs." }, { "speaker": "Joana", "startTime": "704.895", "endTime": "714.015", "body": "How does that actually happen mechanically? A user types the Polymarket URL into their browser, the page loads, but somehow malicious code is running alongside the legitimate site." }, { "speaker": "Tim", "startTime": "714.015", "endTime": "724.43005", "body": "So to understand this, you have to understand how modern web applications are assembled. A web page today isn't a single static document served from one server anymore." }, { "speaker": "Joana", "startTime": "724.43005", "endTime": "725.79004", "body": "Right. It's not the nineties." }, { "speaker": "Tim", "startTime": "725.87006", "endTime": "736.475", "body": "Exactly. It is a dynamic assemblage. When you load a site, your browser is simultaneously pulling down code from dozens of external domains in real time." }, { "speaker": "Joana", "startTime": "736.475", "endTime": "741.755", "body": "Oh, like pulling analytics groups from Google, payment processing frames from Stripe, things like that." }, { "speaker": "Tim", "startTime": "741.755", "endTime": "744.875", "body": "Yeah. Customer support widgets, advertising trackers, you name it." }, { "speaker": "Joana", "startTime": "744.875", "endTime": "757.17", "body": "So if an attacker manages to compromise one of those peripheral third party providers, say, a small company that provides a visual widget for the site, the attacker can alter the JavaScript hosted on that provider's servers." }, { "speaker": "Tim", "startTime": "757.17", "endTime": "786.01", "body": "And because Polymarket's code instructed the user's browser to trust and execute whatever came from that third party domain, the malicious JavaScript just ran natively inside the user session. And once JavaScript is executing in the browser, it can read the document object model or DOM. It can scrape passwords, type into form fields, it can steal section cookies or, you know, in the case of financial and crypto platforms, it can manipulate transaction hashes right before the user signs them." }, { "speaker": "Joana", "startTime": "786.01", "endTime": "798.675", "body": "It is staggering when you look at architecture of this. You do not actually control the code running on your own user's machine. The browser is assembling the application on the fly using pieces from all over the Internet." }, { "speaker": "Tim", "startTime": "798.675", "endTime": "805.52", "body": "And if we connect this to the bigger picture, the overarching lesson across all three of these confirmed breaches is that the perimeter doesn't exist anymore." }, { "speaker": "Joana", "startTime": "805.52", "endTime": "806.80005", "body": "It's everywhere and nowhere." }, { "speaker": "Tim", "startTime": "806.80005", "endTime": "821.435", "body": "Exactly. You cannot defend a boundary line when the application itself is distributed across SaaS APIs, open source developer registries, and dynamic browser injections. You have to monitor the internal behavior and the permissions of the components themselves." }, { "speaker": "Joana", "startTime": "821.435", "endTime": "830.21", "body": "That requires a massive philosophical shift in how we architect defense. But I want to pivot here because the second half of the Breach Desk report deals with something equally complex." }, { "speaker": "Tim", "startTime": "830.21", "endTime": "832.05005", "body": "Ah, yes. The fog of war." }, { "speaker": "Joana", "startTime": "832.05005", "endTime": "838.53", "body": "Right. How do organizations deal with threat intelligence when the attacks are still entirely unconfirmed?" }, { "speaker": "Tim", "startTime": "838.77", "endTime": "850.065", "body": "Because threat intelligence is inherently noisy. It is polluted with rumors, exaggerations, and threat actors trying to artificially inflate their own reputations just to extort money." }, { "speaker": "Joana", "startTime": "850.14496", "endTime": "858.68", "body": "Yeah. And the Breach Desk Log explicitly separates their confirmed technical facts from their ongoing, unverified investigations." }, { "speaker": "Tim", "startTime": "858.84", "endTime": "864.68", "body": "Which is such an important discipline. There are two specific items in the report that are strictly classified as claims." }, { "speaker": "Joana", "startTime": "864.68", "endTime": "870.645", "body": "Right. First, a group calling itself Shiny Hunters claimed a massive data theft against the Council of Europe." }, { "speaker": "Tim", "startTime": "870.645", "endTime": "878.72504", "body": "And second, a Portuguese engineering firm named Condurial, sometimes transcribed as Gundurial, appeared on a ransomware leak site." }, { "speaker": "Joana", "startTime": "878.72504", "endTime": "883.68506", "body": "The language the source uses very deliberate there. They claimed a theft. A firm appeared on a leak site." }, { "speaker": "Tim", "startTime": "883.68506", "endTime": "884.325", "body": "Exactly." }, { "speaker": "Joana", "startTime": "884.325", "endTime": "906.565", "body": "In a corporate environment that is is frankly obsessed with reacting to breaking news, the Breach Desk exercises intense restraint. They refuse to promote a claim to effect just for dramatic effect. As of the time of the log, there were no victim statements, no confirmed technical indicators, and no forensic proof regarding the Council of Europe or Condurial, they remain just claims." }, { "speaker": "Tim", "startTime": "906.72504", "endTime": "926.77", "body": "And this restraint is an absolute operational necessity. The mechanics of modern ransomware rely heavily on public relations. Dread actors will post a company's logo on a dark web leak site before they have even stolen sensitive data simply to create media pressure and panic the board into paying an extortion demand." }, { "speaker": "Joana", "startTime": "926.77", "endTime": "936.72504", "body": "So if a security team treats a dark web listing as an absolute confirmed breach before conducting a forensic investigation, they are essentially doing the attacker's PR work for them." }, { "speaker": "Tim", "startTime": "936.72504", "endTime": "948.13", "body": "Worse, it leads to the massive misallocation of defensive resources. You have incident response teams burning out, tearing systems offline, and scrambling to patch a hole that might not even exist." }, { "speaker": "Joana", "startTime": "948.13", "endTime": "951.97003", "body": "While entirely ignoring actual documented vulnerabilities." }, { "speaker": "Tim", "startTime": "951.97003", "endTime": "970.945", "body": "Exactly. Not to mention the severe unforced reputational damage you inflict on your own company by publicly declaring a breach. Prematurely. Critical thinking, rigorous investigation, and immense patience are required when dealing with live threat intelligence. A listing on a dark website is a prompt to investigate." }, { "speaker": "Tim", "startTime": "971.185", "endTime": "972.305", "body": "It is not an indictment." }, { "speaker": "Joana", "startTime": "972.51996", "endTime": "989.455", "body": "So synthesizing all of this from live OFF tokens, bridging cloud systems, to malicious code executing silently in developer folders, to poison JavaScript running in user browsers, and the murky operational reality of unconfirmed claims. What does this all mean?" }, { "speaker": "Tim", "startTime": "989.455", "endTime": "990.895", "body": "Yeah. It's a lot to take in." }, { "speaker": "Joana", "startTime": "990.895", "endTime": "995.215", "body": "If you have to report to your board of directors tomorrow morning, what is the ultimate directive?" }, { "speaker": "Tim", "startTime": "995.215", "endTime": "1016.75", "body": "Well, the source gives us a primary uncompromising mandate. You must actively manage a living ecosystem of permissions. Okay. It is no longer enough to maintain a static spreadsheet of the big vendors you pay. You must ensure your organization can produce an exact comprehensive inventory of the OAuth tokens, the open source packages, and the third party scripts executing within your environment." }, { "speaker": "Joana", "startTime": "1016.75", "endTime": "1021.52496", "body": "And confirm ownership of them. And if an organization cannot produce that level of visibility." }, { "speaker": "Tim", "startTime": "1021.765", "endTime": "1030.965", "body": "Then you do not just have a documentation issue. You have a massive live attack surface and the upcoming regulatory environment is going to be unforgiving." }, { "speaker": "Joana", "startTime": "1030.965", "endTime": "1031.6849", "body": "Oh, absolutely." }, { "speaker": "Tim", "startTime": "1032.12", "endTime": "1043.08", "body": "Frameworks like DORA and parallel upcoming cybersecurity directives like NEW are specifically designed to penalize organizations that are blind to their fourth party layer and their software supply chains." }, { "speaker": "Joana", "startTime": "1043.24", "endTime": "1055.995", "body": "Which leaves us with a final thought to consider as we wrap up this deep dive. We started by looking at how attackers are bypassing traditional defenses by exploiting the trusted connections we rely on every single day." }, { "speaker": "Tim", "startTime": "1055.995", "endTime": "1056.4751", "body": "Right." }, { "speaker": "Joana", "startTime": "1056.4751", "endTime": "1066.02", "body": "The underlying reality of our source material is that third party code completely dictates our security posture from the developer's IDE all the way down to the end user's browser tab." }, { "speaker": "Tim", "startTime": "1066.02", "endTime": "1084.945", "body": "It forces us to ask a very uncomfortable question. Building on all this, if every single modern business inherently relies on thousands of connected third party micro services and external open source packages simply to exist, excuse me, simply to function. Is the traditional concept of a secure perimeter completely dead?" }, { "speaker": "Joana", "startTime": "1084.945", "endTime": "1092.76", "body": "It really feels like it. I mean you can't build a wall around an ecosystem that is specifically designed to be open and constantly communicating." }, { "speaker": "Tim", "startTime": "1092.92", "endTime": "1102.04", "body": "Exactly. And if that perimeter is dead, does true security in the modern age mean we must abandon the illusion of ever being fully impenetrable?" }, { "speaker": "Joana", "startTime": "1102.04", "endTime": "1103.4", "body": "That's a sobering thought." }, { "speaker": "Tim", "startTime": "1103.765", "endTime": "1114.2451", "body": "Are we now required to architect our systems under the paranoid but mathematically highly likely assumption that we are always operating in a state of partial breach?" }, { "speaker": "Joana", "startTime": "1114.3502", "endTime": "1124.2703", "body": "It completely redefines what it means to defend a network when you assume the calls are already coming from inside the house. Thank you for joining us on this deep dive into the source material. We will catch you next time." } ] }