Cyber Resilience with Cohesity, When to use AI for Writing, and the News - Rob Sadowski - ESW #477
Ayman discusses concerns about AI-generated content replacing human writing, noting the risk of people losing writing skills and the potential for AI to create a feedback loop of AI-generated content consumed by AI. He also highlights the misuse of AI in cyber attacks, such as stealing credentials and harvesting API keys from apps, emphasizing the importance of securing keys and improving security practices in startups.
Transcript
Only Ayman's parts of this conversation are included, with the question before each answer for context.
All right, last but not least, joining us is the connoisseur of cloud security, our single origin co-host and resident coffee sommelier, Ayman Elsawah. How are you doing, Ayman?
I'm doing good. I'm doing good. I'm a little low on coffee, but I think I'm okay. Yeah, I'm doing good.
You know why this bothers us so much you know she talks about like at one point it was like okay you know this is fine and at some point it's just full-on rage when you come across something you realize it's written in ai and you know it feels like somebody's just stolen your time from you right they're just wasting your time and so really good post i don't know if any of you got a chance to read through this
Not entirely, but I, you know, but I definitely, it's, you know, The two things I would say on this. So one is like, you know, personally, as a writer, when AI was coming out, like, and was really good at it, I almost like, had a hesitation on writing again. I'm like, what's the point? You know, in a way, but thankfully, I've been able to overcome that. And now I write, I mean, I've always written all my articles 100%. And I feel good about writing something that's like, that I have written. 40:49 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Yeah, and the other thing that's really interesting, I don't know, so Amazon has a writing culture, or did have a writing culture, and where they have this like the concept of a one pager or two or six pager, and I've heard people telling me that, and it made sense, like it's a good methodology in general, where you write something and then everybody reads it and then they discuss it. 41:24 But now people are just like, hey, can you make a one pager or a six pager on this? And like instant turnaround, and like, I know you didn't write this. And so they're having so it's it's yeah anyway well and now you can't really have a conversation with them because they haven't read it themselves yeah you're right that's my favorite part is like i didn't know that was in there
Got it. And there's one, it's just like somebody gave it some drugs and it had some clarity and one sentence is clear and then it goes back to just pure mud after that. I write way better than that on drugs, just for the record. This is a different level, Jackie. This is AI drugs.
You know what's interesting is like, first of all, yeah, I mean, I get the offensive part, like it's offensive to see this, but there's a couple of like long-term effects here. One is people are just going to forget how to write. Just like our, you know, millennials or whatever Gen Z is or whatever it is, don't know how to speak, can't speak anymore, right? Yeah. And then the second part is we're nearing a world where it's just going to be AI generated content being consumed by AI bots.
So yeah, that I'm concerned about.
So like, at the end of the day, no one's reading, no one's writing, right? It's the AI. And so the AI is going to, like, somebody's going to probably take this thing, feed it to their AI and tell me what matters. So now we just have like this like kind of circular loop of AI bots talking to each other and the human somewhere is in there like, you know, I don't know where they are really.
Turns out there's more to do. There's always more to do.
Yeah. Always. Yeah. It's a combination of the top two. Same work, high expectations, more tasks, same hours. Because, you know, like I said before, I get this question all the time. How is security? How is AI change your job? I said two parts. One, I could do more things now, which is cool. But also on the other side, I'm getting more things inbound, and the surface area is expanded that I have more things to secure and review. So
I got some of that done because AI can build a website pretty easily. I've already got all the data and everything. I just need it to Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah,
The domain, I'm sure you guys are all domain hordes, right? You know, so, you know, I used to be that. I used to have like all these domains. Now, I've stopped. I've now, you know, I'm recovering domain horde, but... You let them expire?
I let them expire, yes.
It was hard, but I just let them do it. But now, I can still scratch that itch because I have a project. It's almost, it's like live. And now I need the domain. And I actually buy the, when I buy the domain, it's actually live.
Yeah, it's actually the last thing you do is buy the domain now. Yeah, it's not the first thing. That's awesome.
Exactly.
So yeah, that's massive. That's massive. United States based quantum computing cryptographic key generation platform, which, okay, sure. But $100 million grant. That's just here you go. We did. We expect nothing in return. No equity, no growth, no stake, no nothing. Here's a little money. Have fun. That's wild to me.
I mean, they must have hit something. They must have. It must be real, right?
Without truly understanding exposure prioritization, which one's to do first when you have only a limited set of capability, time, resources, etc. And without understanding attack path analysis, i.e. Where within the attack chain can you mitigate the risk. So I love the idea. I just hope that the execution is as good as the vision is on this one. And I mean, I jumped in front of you there. What do you think?
No, I think you're on point there. I would have liked, I mean, it would be cool if we actually had in the vulnerability exposure part of Tenable where I could actually find vulns. I mean, that's really where we could use some help. But yeah, I mean, it's a start. I think it's a start. It's nice to give access to a broader audience. So yeah, it's good, but I don't know. Let's see how it works, really.
Is that what it was called, Astra? Yep. That was also able to complete it. So they ran those tests and added an addendum to this report like four or five days later. So less than a week passed and they added another one on there. And they say they expect pretty much all models to be able to pass this test with flying colors within six months. You can get full marks.
Yeah, I like how it's simple. Can the model do the complete cyber kill chain? Do we have a text on that?
Tyler, you were shaking your head during that. Yeah, go ahead and finish, finish, Ayman.
Oh, no, I was just saying, do we have an index on... Anyway, I was just going to be... It's a bad joke. I'm not going to... I'm not even going to go there.
Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria.
That's a really good point. That's a really good point.
Wait, wait, wait. Defense contractors, Adrian. Defense. It's in the freaking title. Defense something.
You know defense doesn't mean defense. It means offense, really. It means war.
Clearly. We know that now. Department of War.
Yeah, yeah.
But it's not as easy as just put the energy in. God forbid we try.
Actually, they do have an article that says counter AI defeats AI adversaries. So maybe it'd be nice if they linked to that, but maybe they are doing some research. But yeah.
I was just joking. It'll take us at least three or four.
I'm looking for the domain now.
Yeah, it just needs to be something silly, something fun. Absolutely. Absolutely. All right, Ayman, let's move to one of your stories here. So I put in an AI summary of the video that you shared, the MIT video. But let's talk about what you published first, what you learned reading the latest Anthropic AI Misuse Report.
Yeah, it was a fascinating read. What, I guess, Anthropic Day, every once in a while they release a report on how AI, their AI is being misused.
This report is- Because they can't stop it, so they might as well report on it.
Yeah, yeah, yeah, yeah. And it's essentially seven reports in one. Cyber operations, surveillance, influence, conventional weapons. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 1:29:22 At the end it's all red but showing all the different things the attacker was able to capture everything from rce to zero days all these different exploits to traversing the network etc so it's it's really fascinating and the key takeaway the key takeaways but you know one main takeaway which is you know we kind of been talking about this for a while is now they're uplifted right so the attacker if you have a smart person Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. 1:30:06 Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria
But of course, like the thing I didn't think of was they'll just steal it. Just use somebody else's account.
Just steal somebody else's. Of course. Yeah, yeah. So, you know, you would think like, oh, cost could be a detriment. Nope. And so...
They're just using the Chipotle chatbot, right?
Yeah, yeah, yeah, exactly.
Which never happened. That was apparently a myth. Somebody's... Vibe coded a screenshot of the app, by the way. So I don't want to spread any myths, but it still is pretty funny.
Yeah, and you know, again, compromised credentials are still the majority of entry points. I highlighted a couple examples of people. Like one person had a distributed credential harvesting pipeline across a fleet of 10 AWS EC2 workers, downloaded like less than 2 million APKs from all different app stores, right? Decompiled them, scanned for hardcoded secrets with TruffleHawk.
Wow.
Yeah, yeah. And then, you know, took those keys, verified the keys are working, routed it to a Telegram group, which of course, the AI bots are probably listening in. It's just like, just mass, mass scale action here.
So that's a wild idea that you can just take all the apps out of the Google Play Store, and you will get working keys.
Yeah, and they took it from other stores because there's a lot of third-party stores all over the world that are not really, you know, we got to be careful.
That didn't have to pass some kind of, I don't even know if Google scans for that. They do.
The third-party stores? Yeah, I don't know.
Yeah, the third parties probably don't.
The third parties do not. Google does.
Yeah. F-Droid is one of the big ones.
One was like you know the talk and so you go through the different cases and people are stealing you know masquerading hotel wi-fi that's pretty straightforward another way was a third party well let's see other ai shops offering ai usage but there's actually clawed usage in the background So they're offering Claude and someone would go sign up thinking they're signing up for Claude and they would actually route it to Claude but they would get Claude yeah just not legitimately yeah so not only do they get the API key but then also getting the data that people are submitting right it's it's pretty gnarly so yeah thank you software vendors for subsidizing cybercrime good job secure those keys 1:33:31 Yeah, they also did talk about nascent. What was the word they used? I gotta find the word. But like, not nascent, but like, immature in a way, service providers. So because there's so many more startups now, their security is very low. Making all the mistakes. Yeah, making all the mistakes. Exactly.
But don't let your kids have any credit card saved, much less your business corporate credit card. Clear lesson, clear takeaway from there. So with that, Tyler, Ayman, and also thank you to Jackie, who we lost at the airport at some point. Airport Wi-Fi is just sometimes unreliable. Thank you so much for joining me today. This was a blast.
Yeah, you got fun. Thank you, guys.