{ "version": "1.0.0", "segments": [ { "speaker": "Bronwen Aker", "startTime": "0.48", "endTime": "32.07", "body": "Welcome to AI Security Ops, a podcast where we cut through the hype and explore the real world intersection between artificial intelligence and cybersecurity. Each week, we examine how AI is reshaping both sides of the landscape, both in terms of the threats we're facing and in terms of defenses that we're building. I'm Bronwen Aker. Today, joining me are doctor Brian Fehrman and mister Ethan Robish. Today, we're gonna talk about Black October." }, { "speaker": "Bronwen Aker", "startTime": "32.55", "endTime": "43.59", "body": "It seems like this week, half of the Internet decided that the Internet is over. It's dying. Tons and cats living together. Oh my god. It really isn't that bad." }, { "speaker": "Bronwen Aker", "startTime": "43.59", "endTime": "81.104996", "body": "Trust me. So, we're gonna talk about what's really going on and and what you can and should do in response to all of the hype flying around. This show is brought to you by Black Hills Information Security and Antisyphon Training. BHIS helps organizations identify and close real world security gaps through penetration testing, adversary emulation, purple team engagements, SOC as a service, managed detection and response. We really are a, full service shop." }, { "speaker": "Bronwen Aker", "startTime": "81.585", "endTime": "115.275", "body": "Antisyphon is the teaching branch where we deliver hands on practitioner led training that is built around real attacks and real solutions with real tools so that as soon as you complete a training, you can go and apply these new skills to your life, to your work, to hopefully make things more secure and make the world a better place. So with that, Black October... I mean, how many Black things are there? There's Black Friday. There was Black..." }, { "speaker": "Bronwen Aker", "startTime": "116.21", "endTime": "121.649994", "body": "Was it Black Tuesday or Black Thursday when the stock market crashed? There" }, { "speaker": "Brian Fehrman", "startTime": "122.85", "endTime": "132.535", "body": "was the black there was the black plague. I'm gonna it Let's keep going back. Yeah. Feel feel like we need to come up with better chance. Mean, we have a, we could..." }, { "speaker": "Brian Fehrman", "startTime": "132.535", "endTime": "142.135", "body": "We can we can workshop this. There's gotta be a better term. I don't know. I'm lacking. We'll call it Stocktoger." }, { "speaker": "Brian Fehrman", "startTime": "142.5", "endTime": "145.62", "body": "The stock is getting around for for their money, probably. So" }, { "speaker": "Bronwen Aker", "startTime": "146.26", "endTime": "157.095", "body": "So if you're not familiar with what Black October is, it is a... I... I'm tempted to call it a meme, but it's it's tradition" }, { "speaker": "Ethan Robish", "startTime": "157.095", "endTime": "158.455", "body": "that goes back to the pilgrims." }, { "speaker": "Bronwen Aker", "startTime": "158.455", "endTime": "202.41", "body": "Right? Something like that. It's it's, what mainstream media is calling the fact that in a short span of days between October 19 and October 22, there were multiple significant cybersecurity related incidents that involved AI. So AI, for example, discovered that there is a significant flaw in PHP that impacts many versions of the language. And since about 70% of the Internet is built on PHP, you know, roughly, that, there's there's a lot of potential for for exploitation there." }, { "speaker": "Bronwen Aker", "startTime": "202.56999", "endTime": "225.955", "body": "So p p... PHP to Shell is one, which, again, it's an authentic remote... Two unauthenticated remote code execution flaws. There's a certificate authority in, India, eMudra, that their private keys turned out to be trivially get... Guessable." }, { "speaker": "Bronwen Aker", "startTime": "226.54001", "endTime": "251.04501", "body": "There was a poisoned light LLM release, breaches at railway and Zebra, a GitHub... A GitLab flaw that scored a perfect 10 and has been in existence for twelve years. Those are just the highlights. So you can kinda see why mainstream media is having kittens, because they really don't know which way is up. And I don't blame them." }, { "speaker": "Bronwen Aker", "startTime": "251.365", "endTime": "254.965", "body": "It's, it's been a roller coaster. Wouldn't you say, guys?" }, { "speaker": "Brian Fehrman", "startTime": "256.74", "endTime": "265.69998", "body": "Yeah. Yeah. Yeah. It's been a lot. And, you know, the the community and companies certainly, feed into that, and, some of that is certainly well founded." }, { "speaker": "Brian Fehrman", "startTime": "265.69998", "endTime": "282.15503", "body": "But just as an example, I was getting, ready to start on a fusion engagement for a customer, and I had some time. They were scheduled to start, like, a couple weeks out, and I got ahold of them. And I was like, hey. Can can we start now? And the conversation went from, oh, well, I'll chat with the team, and maybe we'll start next week." }, { "speaker": "Brian Fehrman", "startTime": "282.15503", "endTime": "291.28998", "body": "And then I got a message later. Hey. Actually, can you start, like, tonight or tomorrow? And then it went to, hey. Is there any way that you can cross scanning, like, right now?" }, { "speaker": "Brian Fehrman", "startTime": "291.28998", "endTime": "297.53", "body": "We can figure out if we've got any, any of the PHP to shell issues, within within our environment." }, { "speaker": "Bronwen Aker", "startTime": "297.53", "endTime": "299.28998", "body": "Wow. They were that nervous." }, { "speaker": "Brian Fehrman", "startTime": "300.625", "endTime": "308.78497", "body": "I think I think the whole industry was. I think that was, like, hair on fire moment for for everyone. Yeah. Well," }, { "speaker": "Ethan Robish", "startTime": "308.78497", "endTime": "336.125", "body": "looking back, I mean, this type of serious vulnerability is not unheard of. But each time it's happened has been kind of been isolated. Like, there's one thing going on usually, and everyone focuses on that. And, yes, it's scary and bad, but one at a time, it's more the norm. Like, we've got Shellshock a few years ago, Heartbleed, and Log Forward Shell." }, { "speaker": "Ethan Robish", "startTime": "336.28497", "endTime": "349.87", "body": "Is that... That that was the name of it. Right? Yep. The remote code execution remote code execution and private information disclosure, those are kind of the the big the big problems here." }, { "speaker": "Ethan Robish", "startTime": "349.87", "endTime": "370.94", "body": "And now in... Within the span of a week, we've got all of them with multiple times. It's depending on, like, what you're running if you have something vulnerable. One that we didn't even talk about, I think it might even have fallen outside of that week, but just adding on and started out node to shell. Now it's HTTP to shell." }, { "speaker": "Ethan Robish", "startTime": "370.94", "endTime": "380.46", "body": "It's that remote code execution, again, in a compression library, bro... Bodie... Bod... Bodily. I don't know how to say it." }, { "speaker": "Ethan Robish", "startTime": "380.46", "endTime": "393.605", "body": "But if anything... If any thought in, like, an underlying, like, fundamental library that's deployed everywhere is... And and exposed remotely is not great. Mhmm." }, { "speaker": "Bronwen Aker", "startTime": "393.78", "endTime": "418.665", "body": "No. Well, it's it's similar to... And and this is me dating myself when the severe security flaws in SSL were first brought to light. You know, that impacted almost every secure transaction on the planet, so people were freaking out. I think what has caused the the panic response, though, is, like you said, it's multiple things happening at once." }, { "speaker": "Bronwen Aker", "startTime": "418.905", "endTime": "452.8", "body": "And, of course, all of this has been accelerated by the vulnerability discovery programs that are now in existence because of the innovation of artificial intelligence. I still think that the emphasis on the, quote, crisis is on the wrong thing. And we were discussing earlier, I I came from a development environment. So I know very well just how buggy code can be with... Without AI intervention." }, { "speaker": "Bronwen Aker", "startTime": "453.19998", "endTime": "490.12", "body": "And it's it's unfair. What's... What I see is that what's happening is unfair to the developers who now have to go and find fixes for all of these things because the vulnerabilities would not exist in as high a degree as they do if business had taken security and well crafted code more seriously before now. So it's... I'm I'm having a hard time feeling a lot of sympathy over all the vulnerabilities." }, { "speaker": "Ethan Robish", "startTime": "491.64502", "endTime": "521.635", "body": "Yeah. It it does seem that sounds... Feels are a bit unbalanced, though, because attackers are very at the forefront of using AI to weaponize and find these vulnerabilities, which is accelerating the or compressing the discovery timeline. But but defenders still have to think about, okay, I I gotta fix this, which some some may be better at others at using AI to close the issues. But then deploying..." }, { "speaker": "Ethan Robish", "startTime": "521.635", "endTime": "545.54004", "body": "I mean, it's one thing for the upstream library to fix the issue. But it's another for everywhere it's deployed to massively get get the new version up to date. Patching and updates has always been kind of a risky procedure. And there's checks and balances and control groups or canary groups. You roll out here first to make sure there's no problems." }, { "speaker": "Ethan Robish", "startTime": "545.54004", "endTime": "572.57", "body": "And it's a thing that happens over a long period of time for stability and company, like, infrastructure and just operations. I don't know that we're gonna have that luxury anymore. So I I wonder if just out of necessity, defenders are going to have to be... Not not not only use AI to, like, fix the issues, but to help roll out deployments. Like, to speed up deployments." }, { "speaker": "Ethan Robish", "startTime": "572.57", "endTime": "592.5", "body": "Like, okay. Do we still have this test group? But immediately, AI is used to, like, badger that test group to look for any problems to spot them before maybe something that, human operators would spot over a period of time. Maybe rollouts get more risky. Like, just, hey, AI." }, { "speaker": "Ethan Robish", "startTime": "592.89996", "endTime": "608.83496", "body": "Excuse me. Go go roll this out. Like, update everything. Like, we can't have this vulnerability exposed, and it it causes downtime. But using AI to fix it then would be faster than traditionally, like, going to figure out what's wrong." }, { "speaker": "Ethan Robish", "startTime": "608.83496", "endTime": "618.69", "body": "So I don't know. I'm kinda spitballing here, but I I I really think, like, AI is gonna have to be used on both sides to kinda fight fair." }, { "speaker": "Brian Fehrman", "startTime": "619.49", "endTime": "627.955", "body": "Yeah. Yeah. I agree. And I think we're certainly already seeing seeing that happen. And going going back to that that example I mentioned, the fusion test with the..." }, { "speaker": "Brian Fehrman", "startTime": "627.955", "endTime": "668.69995", "body": "And the PHP customer, our Antisyphon team, CPT team, however you would like to call them, within less than a day, like, literally, like, between the the time I signed off and the time I came back in the morning, they had art, and so they had leveraged AI to put together, scripts to help discover potential, endpoints that were vulnerable to the PHP, not just to paste... What was mainly out in the community were version checks. So they put together a whole thing that looks for all the different products that are known to use PHP to give a little bit further dive into like, hey, we couldn't find a PHP version, but you have this service running and the service is known to use PHP. And they were able to turn that. I..." }, { "speaker": "Brian Fehrman", "startTime": "668.77997", "endTime": "688.595", "body": "They're wicked smart, so I'm not taking anything away from from their... From how incredibly smart the team is. But leveraging AI helped them to, augment that and accelerate that much faster with it. I mean, a turnaround that I could go to the customer and be like, hey. Our awesome team was already able to put this together, so we're able to to check your environment and do this." }, { "speaker": "Brian Fehrman", "startTime": "688.595", "endTime": "701.56", "body": "So we certainly are seeing, the defense side leveraging it more, and I and I completely agree. I mean, that's absolutely what what has to happen. There's just no... There... I just don't see any other way that it could keep pace." }, { "speaker": "Bronwen Aker", "startTime": "702.36", "endTime": "703.88", "body": "No lies detected." }, { "speaker": "Ethan Robish", "startTime": "706.92", "endTime": "721.085", "body": "So... Okay. I just have to go back to this because my first reaction to... So, Bronwen, you mentioned this in passing, but Light LM was breached and a poisoned release. Like, it was probably a crypto miner." }, { "speaker": "Ethan Robish", "startTime": "721.085", "endTime": "724.445", "body": "But I was like, wait. What? Again? If you... Did we already do this?" }, { "speaker": "Ethan Robish", "startTime": "724.99", "endTime": "727.87", "body": "Like, back in March or something?" }, { "speaker": "Bronwen Aker", "startTime": "728.83", "endTime": "743.45496", "body": "Well... And and I get... That's one of the things. We're we're jaded. We've seen these things so many times, and I understand that mainstream media, they they have to make the news as exciting as possible." }, { "speaker": "Bronwen Aker", "startTime": "743.45496", "endTime": "779.85504", "body": "So if it bleeds, it leads, all of that. But I I don't think that they're doing anyone a service by focusing only on the vulnerability discovery. And, yeah, I I really think the emphasis is on the wrong thing here, because what we need to be doing is shift our focus to helping make sure that what is developed is more secure before it ever gets to production. And and we need better ways of vetting the dependencies in that supply chain. And I agree with you, Ethan." }, { "speaker": "Bronwen Aker", "startTime": "779.85504", "endTime": "808.445", "body": "I think that's a a perfect opportunity for... Well, both of you. I think it's perfect opportunity for AI to help defenders, whether it's in the SOC or, you know, hopefully, it would be nice to see actual software developers incorporating security testing in a meaningful way from the ground up. So I I don't disagree with your take on, hey, the software needs to be more secure," }, { "speaker": "Ethan Robish", "startTime": "808.925", "endTime": "826.285", "body": "but I think it's a good opportunity to practice defense in-depth, Like, assume compromise. These are all mindsets. We've mantras we'd say in that security community. But assume that there's going to be vulnerabilities in software that you deploy. What do you do?" }, { "speaker": "Ethan Robish", "startTime": "826.285", "endTime": "856.995", "body": "How how do you prevent that? I mean, we already talked about one thing Brian mentioned. Like, okay, PHP. After we knew that it was vulnerable, like, okay, knowing where is it deployed. So asset inventory, it sounds boring, but just knowing where your attack surface is, what things are running ahead of time so that when something does drop, it's a quick query away to know everywhere that you're affected or could be affected so that you can focus your efforts on remediation." }, { "speaker": "Ethan Robish", "startTime": "857.875", "endTime": "873.94", "body": "For for, like, upstream packages, like LiteLm dependencies, slow down your dependency adoption. Put put a delay. This is the same recommendation we gave back in the first time this happened. Right? Like, put put a delay." }, { "speaker": "Ethan Robish", "startTime": "873.94", "endTime": "893.435", "body": "Whatever you're comfortable with. In in this case, the package was live for under two hours. Still got pulled 49,000 times. Add a add a day delay to to any updates, like package updates. I mean, obviously, keep on the pulse of, like, actual security issues like the ones we're talking about." }, { "speaker": "Ethan Robish", "startTime": "893.435", "endTime": "905.23004", "body": "Maybe those get fast tracked. But just, you know, routine updates the dependencies, adding a delay costs almost nothing and can prevent you from earning someone else Bitcoin." }, { "speaker": "Bronwen Aker", "startTime": "905.79004", "endTime": "937.39496", "body": "Oh, there's also version pinning. I mean, version pinning is is recommended for a lot of different things. I know it's a a common security tactic in mobile apps. Why not do it in other applications too for that same reason? And if anything, I would think version pinning might make patching easier because if you know that you've got this version pinned across these applications, then you have a known state, and you should be able to know, okay." }, { "speaker": "Bronwen Aker", "startTime": "937.39496", "endTime": "953.56006", "body": "If I need to upgrade from this version to this version, it's... You know what that delta is gonna be in advance. That I believe in measure three times before cutting one's foot. I'm an ailing." }, { "speaker": "Brian Fehrman", "startTime": "953.56006", "endTime": "956.92004", "body": "And writing down the measurement too. Yes. Yeah." }, { "speaker": "Bronwen Aker", "startTime": "958.12006", "endTime": "959.16003", "body": "Very much so." }, { "speaker": "Ethan Robish", "startTime": "959.56006", "endTime": "994.98", "body": "We... We've talked a lot before about pacing the frontier, pacing, like, AI and its ability to to find these vulnerabilities. And we've kind of joked and tongue in cheek about, like, how the frontier, while calling for, you know, government and vet intervention for mandatory slowdowns, like voluntary slowdowns, whatever, but but while putting their foot on the gas still going forward. So what I found... Because one of our points when we've had this discussion before is like, okay." }, { "speaker": "Ethan Robish", "startTime": "995.45496", "endTime": "1023.1", "body": "The US frontier model, government intervention, great. That's only one side of the coin. There's all these open weight models coming out of China, and we're never gonna get them to do anything. Well, what's fascinating is, Kimi k 3.1 pro just got announced. And one of the things that they call out in their, material is they actually held back training data that was cyber related training data." }, { "speaker": "Ethan Robish", "startTime": "1023.515", "endTime": "1032.875", "body": "And they show benchmarks of, hey. Here's what our model could have been with that data at the end. Like, no no restrictions. Here's the benchmark. It's up here." }, { "speaker": "Ethan Robish", "startTime": "1033.035", "endTime": "1054.4751", "body": "And, you know, Opis and Ant Astra and stuff are up here. And then there's DeepSeek right underneath it, which DeepSeek got banned basically recently from the usage in government and government contracts. Here's where we stand now. Like, we're actually lower than some of these other ones that are already being used. Be..." }, { "speaker": "Ethan Robish", "startTime": "1054.4751", "endTime": "1071.7", "body": "Even though it's like they're brand new model, they're like top of... Like, almost every benchmark, they voluntarily voluntarily, like, kind of neutered themselves on Security Benchmark. And I I... It's fascinating. Like, I I wonder what the strategy is, the motivation." }, { "speaker": "Ethan Robish", "startTime": "1071.7001", "endTime": "1088.945", "body": "I mean, maybe they saw what happened to DeepSeek, and they were... They decided to not not poke the bear, to try to see if they could skirt by and gain some of that market share. I I don't know. But it's it's kinda it's kinda mind boggling." }, { "speaker": "Bronwen Aker", "startTime": "1089.985", "endTime": "1093.6649", "body": "It's it's kinda like they've got a big sign up saying, we're not like them." }, { "speaker": "Brian Fehrman", "startTime": "1094.3049", "endTime": "1098.39", "body": "Yeah. Yeah. And that's certainly what it seems like. So" }, { "speaker": "Ethan Robish", "startTime": "1099.5901", "endTime": "1136.7001", "body": "while I don't think we're gonna see any slowdown anytime soon of finding vulnerabilities, it it may have been a fluke that, you know, all of these critical ones happened, like, within the span of a week. I I don't I don't think that's the last of them. I don't know that we'll keep that pace every single week, but there there will definitely be more. And we're gonna have to get better about defending and shore up on, like, just basic bedrock, like, foundation security practices. Because if we build on fast and loose foundation, I mean, it's it's gonna keep tumbling." }, { "speaker": "Bronwen Aker", "startTime": "1137.355", "endTime": "1151.72", "body": "Yeah. I'm sorry. Move fast and break things has never been a recipe for success in my book, but, you know, I'm an alien. I like solving problems before they happen. So, yeah, there is a lot of hype." }, { "speaker": "Bronwen Aker", "startTime": "1151.72", "endTime": "1166.175", "body": "Yes. There are lots of vulnerabilities being discovered. Yes. The rate of discovery is accelerating, and there are more vulnerabilities out there that have been there for a long time. And I suspect that's part of why people are are freaking out." }, { "speaker": "Bronwen Aker", "startTime": "1166.175", "endTime": "1191.87", "body": "I mean, the the GitLab vulnerability has apparently been around for, like, twelve twelve different versions as it's it's moved forward, but it wasn't detected back then. And... Okay. Fine. The reality is the only reason that vulnerability is more severe today than it was yesterday is the fact that more people know about it." }, { "speaker": "Bronwen Aker", "startTime": "1192.795", "endTime": "1209.26", "body": "Not insignificant, but it's been there for a long time. So now the trick is how do we fix these? How do we respond appropriately? I think the biggest thing is don't panic. These things are not gonna get better anytime soon." }, { "speaker": "Bronwen Aker", "startTime": "1209.26", "endTime": "1230.595", "body": "Panicking is not going to help matters. But, yeah, do your do your supply chain inventories. Know what your assets actually are so you can manage them responsibly. And it's... I I keep coming back to this thing in in many different aspects of life." }, { "speaker": "Bronwen Aker", "startTime": "1231.875", "endTime": "1245.9099", "body": "Doing stuff well is boring. Doing the needful stuff is boring. It's not flashy. It's not dramatic. There aren't, you know, big celebrations with fireworks and all that." }, { "speaker": "Bronwen Aker", "startTime": "1245.9099", "endTime": "1253.005", "body": "It's mostly maintenance. And when you do that and you do it well, a" }, { "speaker": "Ethan Robish", "startTime": "1253.005", "endTime": "1253.3251", "body": "lot of" }, { "speaker": "Bronwen Aker", "startTime": "1253.3251", "endTime": "1258.445", "body": "the other problems solve themselves, or when they come up, they're a lot easier to manage." }, { "speaker": "Brian Fehrman", "startTime": "1259.165", "endTime": "1259.5651", "body": "Yes." }, { "speaker": "Bronwen Aker", "startTime": "1261.36", "endTime": "1267.44", "body": "So unless you gentlemen have something more to throw in, I think that we may go ahead" }, { "speaker": "Brian Fehrman", "startTime": "1267.44", "endTime": "1268.32", "body": "and think we'll" }, { "speaker": "Bronwen Aker", "startTime": "1269.2799", "endTime": "1276.445", "body": "go ahead and wrap this. So, yeah, definitely. Don't panic. It's gonna be okay. It is gonna get worse before it gets better." }, { "speaker": "Bronwen Aker", "startTime": "1276.445", "endTime": "1291.6978", "body": "But, hey, we're here in the trenches with you, honest. So with that, I'm Bronwen Aker. Thank you, Brian and Ethan, and this is AI Security Ops. We'll see you next time. Keep on prompting." }, { "speaker": "Bronwen Aker", "startTime": "1299.4578", "endTime": "1300.0177", "body": "Ops." } ] }