AGENTS OUT OF BOUNDS | STATE OF CYBERCRIME EP. 53 - VARONIS SYSTEMS INC

Well, hello, everyone, and welcome to another episode of State of Cybercrime. How's it going this afternoon? I'm doing awesome. How are you? i'm good uh where are you uh where you where are you located i'm in delaware today yeah so it's an uh an unfrequent place that to visit these days um anyway my name is matt rock i'm one of our hosts i am joined by uh one of my esteemed colleagues david gibson and we're still here yeah we're so happy to have you here for another episode a state of cybercrime we're going to go through a bunch of our usual segments today For those of you coming to State of Cybercrime for the very first time, we always like to start the show with some good news, as oftentimes the outlook in our industry is completely doom and gloom. But the good guys are doing better, especially when it comes to coalitions of law enforcement, which is one of my favorite topics, David. And it looks like a coalition has struck again. Yeah, it well, you know, it's kind of interesting on this show because we'll talk about uh you know some threat actor activity or breaches and things like that and then often you know six months or a year later we'll talk about the arrests well this this one has been kind of compressed you know i think it was like last episode we talked about the big fbi breach it might have been too back but it's been really recent uh well it looks like shiny 100 has got the fbi's attention um because we've had some three arrests and some information about what happened with that breach since that happened um first of all it looks Like the breach happened because of a vulnerability in PeopleSoft that wasn't patched because a contractor didn't patch it, if I had that right. And they've had three arrests. And by the way, these are arrests, you know, innocent till proven guilty. I'll talk more about that in a second. But, you know. The Ray, I guess, Saif al-Din Khadr, who goes by Ray or RayXBF, Krebs, Brian Krebs had labeled him as one of three administrators of lapsus or scattered lapsus hunters actually um then another individual uh was uh he'd been employed apparently as a an offensive security lead at a dutch company neo security um named i i guess pepchin bond or strop i think it's uh supposed to be the second person uh and then the last one is uh and this is kind of hard to make it good news um because it's kind of like one of our own right it's uh this is a ransomware negotiator uh named edward dobrovsky um well respected um it he's been charged with conspiracy to impair confidentiality of information with the intent to extort money and interference with uh commerce by threats um so uh the i guess just some interesting stuff i there's a friend of mine who's also a ransomweight negotiator and i spoke with him after the story and you know he he suffice it to say he suspects there might be more to this and uh you know it's ransomware negotiations a pretty pretty fascinating topic there but uh anyway just always want to remind people to uh to not you know let's do let the due process happen and that's not the only story though we've got another one about a Chinese APT group. But you might be wondering, well, but why is it good news? What could be going on here? Well, Flax Typhoon, which the attacker group also tracked as Ethereal Panda and Red Juliet, has had seven domains seized that were associated with scanning and attacking US critical infrastructure. Now, what I find really interesting is they were using fake domains like Outlook3650.com, or YouTubeCard.com or LinkedIn.com.net. And what they did was carry out attacks on one South Carolina power company, an airport in Japan and in Poland, and even in Taiwan, critical infrastructure and universities. Now, this group is actually tied to a corporate entity in China called the Integrity Technology Group, which does contract work for the Chinese government, that very same group was responsible for the Raptor train botnet that we covered in a previous episode of home office routers and IoT devices, which was taken down in September of 2024. So while this is a win for the good guys, Integrity Tech is a for-profit company selling hacking tools and services and enabling Chinese threat actors and others to more quickly scale up their activities. So yeah, it's good news. Some domains were taken down, but this group is still at large. Now what's going on over at OpenAI other than, you know, a lot? Yeah, well, this one was interesting. I read about this in, I think it was the Wall Street Journal the other day, but an OpenAI engineer was arrested after the authorities allege he planted a hidden recording device behind a TV in an executive conference room where they apparently discuss research and strategy and, you know, plans and things like that. They charged him with trying to use an electronic, mechanical or other device to intercept oral communications. And, you Know, again, innocent until proven guilty. Absolutely. Always. However, they did They also released information that there was a chatbot account associated with the suspect's spouse that had been asking AI about building, customizing, installing audio recording, testing, obfuscating, and remote accessing a continuous audio recording device. That's in quotes. They also have a picture of the suspect entering the conference room where the device was hidden and looking behind the television where the advice was found. And security personnel also found the suspect's unattended bag in another room with his ID, wallet, and another recording device that was mostly identical. And again, innocent until proven guilty. Yeah, it sounds like there's kind of a big amount of evidence, though. I'm just giving my uncolicited third-party opinion here. I don't know. You know, it should always go either way. in our newest segment ai bay we promised it's surely going to leave you saying ai bay now there's some real irony in this story and i didn't prep david for this so i'm going to tell you now i'm counting on you david when i finish this one that you've got some really awesome pun or dad joke for the audience the dutch institute for vulnerability discovery or divid a non-profit volunteer organization of bug bounty hunters which has spent the large part of the last seven years, helping to find vulnerabilities in other systems, has suffered a breach due to nothing other than, drumroll please, a vulnerability. Specifically, 2ZeroDays and Zomod, an open-source ticketing software that they used for support cases. The AI agent that attacked them chained together two previously undiscovered Zomod flaws, CVE-2026-102489 and CVE2026102490, which allowed them to go from session hijacking to execution of code to root in just seconds. Now, Zomad, ZOMAD, ZOMAD, this open source support ticketing software, serves more than 2,000 customers around the world with 55,000 known users. However, both of these CVEs have been added to CISA's, you know, critically exploited vulnerability list. Wow. Yep. I, you Know, irony is kind of hard to define, but I know it when I see it. Cold. Now, you Now, sometimes cloud and AI can be a bit like fire and ice. Researchers at Zenity Labs found a weakness in AWS's Bedrock's AgentCore, which is Amazon's managed platform for deploying and running AI agents. One malicious prompt to a public-facing chatbot could let an attacker take over every other agent in the same AWS account and region, not just the chatbot itself. Now, how did they do this? AWS services have this internal metadata service, the IMDS, that hands out temporary credentials and configuration details. Agents on AgentCore weren't network isolated from it. So an agent that was able to make web requests could reach it. So I'm sure you're wondering, well, what exactly did the researchers do? I've got the answer for you. They asked a customer support agent to fetch credentials from the metadata service. And guess what? It did it. So maybe you should ask your agents if they can expose credentials from memory or metadata services that they run on just my opinion you know or use some type of automated red teaming solution on your ai agents that would ask the very same question so you don't become vulnerable to the same thing very interesting what's up with jade puffer hey well you know uh we um covered i think jade puffer uh or storm 36 81 is or 18 36 18 it's their friends call them in a recent episode um and they are i believe the first documented llm driven ransomware group uh so they're uh we're talking about them this week because they took down most of actually a couple azure tenants i think in about seven minutes uh so pretty devastating attack you know you think about it in these big eyes environments everything's connected everything's infrastructure is code apparently the the recon for this took longer um so talking you know like 15 hours or so um but the way they did this was they compromised a couple of service principles they have started with one but i think they got at least one other they mapped the entire environment all the bms all the resource groups once they did the recon they deleted just about all the storage accounts azure key vault function app app service plan they actually tried to delete some azure sql instances but they were using an unsupported api version so that they failed luckily at least on that um looks like the original service principles were compromised by secret stored in plain text in a public github uh repo actually in one of the issues um so you know i think it's uh some takeaways for this one, you know, the cloud infrastructure, you know, an attack that happens in seven minutes, that's hard to stop while it's happening, unless you've got some automation there. But it looks like there was a lot of opportunity to catch the recon while this happening. So, you know, some takeaways from this, make sure you're auditing the service principal permissions, alerting on bulk deletes. You know, there's also some resource locking, you soft delete immutability options that you can use to protect yourself there. But pretty crazy the speed that you combine AI and an IaaS infrastructure and some maliciousness, and it can be pretty devastating. Yeah, wow. Now I think it's time for us to cover some of those vulnerabilities that I talked about earlier, but in a little bit more detail. So Sysit added five vulnerabilities to the KEV, the known exploited vulnerabilities list, and all of them were associated with Flax Typhoon. Adding to those that they were already tracking, there were three that Flax Typhcoon was known to be using already. One, CVE-2015-3306, which allows remote attackers to read and write files on a File Transfer Pro server. CVE 2021-3199, which is in the only Office docs. It's a path traversal vulnerability where an image upload could lead to remote code execution, CVE-2023-22894, which is that a person that has administrative panel access can pull sensitive user data out of Strapi, and CVE 2016-3081, which is in Apache Struts, where a command injection could allow for remote code execution when a particular feature is enabled. The last one, which is in DNS, quite old if you ask me, CBE-2015-5477, which is a bind, which allows remote attackers to crash DNS servers. All five of these flaws were used in operations by that integrity technology group behind that Beijing contractor, behind Flax Typhoon. The others that weren't included but are also leveraged by them is Shellshock and Bash, Avanti, Pulse Connect Secure, as well as a vulnerability from 2021 and GitLab. Now, why am I mentioning all this to you? Well, there was a statement made by Chris Butera from CISA, which said that Chinese government-linked actors are positioning themselves inside of critical infrastructure, including IoT systems that run physical equipment. And they have the ability to disrupt critical functions in our infrastructure at a future time of their choosing. So this is considered a pre-positioning moment, I think, you know, a long-term strategic compromise, maybe even for potential espionage or sabotage. Yeah, and we'll talk a little bit more about taking over infrastructure remotely in another story. I was going to say, yeah, there's a max severity flaw in SonicWall. Attackers are exploiting CVE-2026-102255, which is a 10 out of 10 CVE in Sonicwall's SMA-1000 remote access appliance. This handles VPN and zero trust access to corporate networks. Now, what is the flaw? There is a bug in Workplace, which is the web portal that remote users log into. So an attacker with no login credentials could make that device send requests for them, reaching internal systems, performing unauthorized actions. And what this is called is an SSRF, or a server-side request forgery vulnerability. These devices sit between the internet and internal apps and identity systems and infrastructure. So, Sonic Radar, one of the companies that's talking about this, their point is that once that device can become a proxy into other services that were never meant to be reachable from the outside, that's what makes it so vulnerable. Now, they have released a hotfix, and SSL VPNs on SonicWall firewalls and the SMA 100 series are not affected. However, there was an interesting note by Joe Toomey from Coalition, which is an insurance company. They do underwriting for insurance. He said that perimeter devices and edge devices are where a large share of their claims come from. And he calls SSL VPNs almost uniformly bad, some being worse than others. And they mentioned that Coalition sets their premiums based on what companies exposed to the Internet and what vendors that they use. So a vendor that has bad claims history will lead to larger insurance premiums. Might have to start adjusting their quotes. Yeah, I wonder if we're going to pay different insurance based off of what I.I. providers that we use in the future. Now, hackers. Excellent question. Literally. We're goingto jump on to our next, our last segment, the danger zone. Sorry for not mentioning that, folks. I was just so excited that I came up with this punchy David Gibson type line. Attackers, the hackers in Europe are literally cooking. They cooked hundreds of European supermarkets. What happened was that they remotely took over the refrigeration controllers at hundreds of different European supermarkets. So overnight, they set fridges and freezers to defrost with a target temperature of 50 degrees centigrade for all of those folks in the U.S. That's 122 Fahrenheit. And in some stores, the temperature purportedly rose for about six hours before anyone noticed. One researcher despised it as employees were getting hit by a hot wave of air when they opened the freezers in the morning. Now, what happened was that the attackers took over these, you know, these Danfoss refrigeration units. So a fix has been deployed in a new firmware operation. But I think this what's what this points to is like that, you nothing is safe. Nothing on an interconnected network is safe, and if you're running some type of old hardware that has some type of ICS or IoT controller on it, you should really be thinking about how you segment it either from one store to another or just in general. Having all of your refrigerators across all your grocery stores be interconnected, I'm not sure what purpose that that might serve. However, if you isolate them, you might be able to stop something like this from happening as for all of the creators of all of the hardware that you might run that is interconnected it finding and fixing all those vulnerabilities might be hard you might be better off with like a zero trust or a micro segmented network approach John you killed me with the hot pockets thing I don't know if I'm going to be able to oh I gotta I gotta see that one I gotta find it I gotta fight it oh my god oh man we if we were giving stuff out today Frank we should give We should give some swag if you can capture that, Frank. I hope I can go on. Yeah, it's all right. You can take a break for a second and collect yourself, David, before you tell us about – also, one person thinks you have a webcam behind you, but maybe you could talk to us a little bit about this home security thing gone awry. Yeah, I read about this the other day as well. I guess, you know, I'm wondering as a security community, how many of us have home security cameras? um it uh apparently you know and and and i guess how many of how many folks uh you know like don't have mfa with for them i don't know it does it's not just that but apparently there are 2.3 billion webcams out there uh and you know i uh i i i've always been you know worried about you know somebody taking over any any kind of iot device that i have whether it's you know my interconnected internet connected hot pocket warmer or uh or a camera but uh apparently a lot of intelligence services around the world have been compromising these for a lot of military reasons right using them to spot troop movements and um it's uh it it ai has changed the game right you used to have to you know kind of watch the video feed um but now with ai it makes a whole lot more sense they can if they take over these cameras they can digest and analyze the feed and use that to for a lot of tactical advantages and intelligent services are running automated tools that test these uh devices for default password uh you know and hopefully people will chat in that they've changed the default password if they've got these devices um but uh it's uh then they they go out they find these things and uh then use a lot of the ai image recognition software to sift through it find vehicles you know weapons leaders you know all kinds of use cases there so this is this is kind of like something that i think we all probably saw coming um but you know it's it's being talked about now interesting now i know one thing a lot of people are wanting us to talk about david is these agents going out of bounds so do you mind maybe walking us through a little bit about like all this you know new agent mayhem that's going on i sure will so the uh we're learning about some stuff that's been going on for a while and it went on a while back so there was a wiki media outage in may that looks like it was caused by open ai agents um and uh they were you know the outage was because the ai agents were introducing a ton of load while they were editing mostly non-public wiki pages um they were making edits to the citation tool. And this is quoting, which we believe were potentially malicious edits that were intended to misuse this tool as a proxy for fetching data from remote services. They also tried unsuccessfully to exploit a public note-taking tool. And they're not the only one, right? More than 100 organizations have notified, they've been notified about problematic activity by some of these rogue AI agents. And an interesting one is we learned that OpenAI breached a medical portal in Australia back in June. And OpenAI discovered that in August, but waited until September 10th to notify the folks in Australia. So they went over in early October to apologize. OpenAI's chief strategy officer apologized in an Australia parliament session, which kind of brings us to the next part of our story is industry's reaction to all this mayhem. Yeah. And I think that like one, you know, an apology coming from open AI is a pretty big, you know, pretty big step in the right direction. You also have to think about, you know, like anthropic, you know, cutting internet access from internal AI evaluations and, you know, finding agents that are exploiting falls and bypassing paywalls and using URL shorteners, sending tips to the Philly police. Like there's, there's so many things that are happening like that we would all think in a sandbox is like out of control um and so there is you know we kind of often ask ourselves like where does where should regulation come from or where do we know we need more controls and so we also do see though like there's this new defender program um yeah and i think that's a step in the right direction and then you know this new and supposedly from anthropic sandbox um but according to them they really mean it's a real sandbox now that can't be broken out of but we'll see you know if i i had always suspected that they're going to like find their way onto a mobile device from someone in the sandbox and jump out of it but you know the raptors always find a way to get out of the enclosure as i'd say yeah well it it uh you know an air gap i i don't know i mean if if it's truly air gap anyone's going to be able to jump out it's an anthropic ai agent that's what i'm going to say that that that's for sure i mean smoke signals i you know i'm not sure but that uh you know at least we could start with a real air gap um and and of course industry is reacting but also government is reacting we saw like the the california attorney general subpoenaing open ai about the hugging base they are saying that they want developers that create the models that they can't control to even be legally accountable um You know, there's a coalition of attorney generals that want multi-states to report and respond to an FCC inquiry. So, I mean, I think this is pretty, pretty interesting, right? Like, and then now, like, David, there is even something going on in Congress. Yeah, I means, and just a little bit more on the California subpoena, we are not sure what the subpoENA is asking OpenAI to hand over. It is an investigative subpoONA. um so i think that'll be interesting to see what they get but it kind of makes them wonder like you know are they going to ask for communication about the dangers and things like that and you know all of this could kind of strengthen the case for a kill switch act or this thing that they're proposing hr 9917 um by the way i'm i was picturing more of a staples easy button for this frank um if we could maybe change that image well just kidding but um the uh i actually thought this kill switch idea was completely absurd until i read a little bit more about it um i still have some kind of concerns but i'll and i'll save them but in general if you earn over 500 million in annual ai revenue uh and by the way if that's you if you could identify yourselves in the chat And and you build models using more than one hundred million dollars in compute. Again, please identify yourselves in the chat. Then you are the target of this proposed act, this kill switch act. And you and your company, if this is you, must maintain the technical capability to to be able to shut down or suspend or throttle the system that you're running. And it gives DHS, in concert with some like CISA and some other folks, emergency authority to order a company to completely throttle or shut down a model that looks like it's out of control. So you also have to report, as AI developers have to rapport, major safety incidents and any kind of event that looks likes loss of control to the federal government. And there are some serious financial penalties associated with it, like 20 million a day, if you're not complying with this. So this has not passed. It's a proposal. I would volunteer to keep the kill switch in my house. I'm not sure where they're going to put the kill switch but i did have some questions about um what would happen if you know these models that were dangerous or out of control were not hosted in these oh you know this big providers right if they were you know if you're hosting them in amazon or your your house right you know on a on uh you know or or one of you know just a local compute or your phone because now you can host models on your phone and i feel like there needs to be a device like the football that has to get carried around to do the kill switch you know so that like a it's like always on the move and maybe harder for ai to track you know one of the more guarded secrets of society but we'll see well as always everybody i super appreciate you being here and i know david does as well um we we we love you guys tuning into state of cybercrime uh our producers are going to drop a link i do believe there's like an attack lab coming up where we're going to show a live exploitation of some AI systems run by someone from the Varonis Threat Labs team. So they're probably going to drop a link in for that. And thanks so much for being here. We hope you guys tune in again on the next episode of State of Cybercrime. Thanks so much, guys.