SN 1101: ECDSA's Curves Origins - When AI Becomes the Attacker

[00:00:00] [SPEAKER_02] Hey, it's time for Security Now. Steve Gibson is here and I'm subbing in for Leo Laporte. And we talk about, well, another record-breaking patch Tuesday, plus Unit 42 reports on a really wild agentic attack where the agent decided to leave a lot of its evidence behind,

[00:00:20] [SPEAKER_02] a mass-compromised hardware cryptocurrency wallet attack, and what happens when you reverse-engineer ECDSA curves by way of Claude. All of that coming up on Security Now. Podcasts you love.

[00:00:41] [SPEAKER_03] From people you trust.

[00:00:43] [SPEAKER_02] This is TWIT. This is Security Now, Episode 1101 with Steve Gibson and me, Micah Sargent. Recorded Tuesday, the 20th of October, 2026. ECDSA's Curves Origins Hello and welcome to Security Now. This voice you're hearing is not one of Leo's AI-generated voices.

[00:01:10] [SPEAKER_02] It is, as far as you can tell, the voice of Micah Sargent. That's me. And I'm filling in for Leo this week on Security Now. This is, of course, the show where world-renowned security expert Steve T. Gibson gives us the lowdown, the uptake, and the in-between on all things security. How are you? So this is the first of what? Is three or four of these that... At least three. Yeah. Yeah.

[00:01:39] [SPEAKER_02] Well, I'll have to check their calendar because, you know, with all the flooding that's been going on over there, they can be...

[00:01:44] [SPEAKER_01] Leo was concerned about like, yeah, like the... I think the hotel where they had some reservations, they have actually different kinds of reservations about being able to have their stay there. Anyway, this is... We... Last week or I guess the week before, I don't know, last week was 1100. We crossed into... That's amazing. ...episode 1100. I've...

[00:02:11] [SPEAKER_01] It's bugged me that I've always been a little bit behind the big twit podcast. I don't think there's any hope of catching up. But, so, you know, because we're staying at the same distance that we normally do. Yeah, you're like neck and neck.

[00:02:25] [SPEAKER_02] If there was some way, if I could figure out a way, Steve, for you, I would.

[00:02:28] [SPEAKER_01] Anyway, episode 1101 today for this October 20th. And a bunch of interesting stuff to talk about. We've got to follow up on last week's Patch Tuesday because this one smashed. Smashed, I think, is fair. Another record, which was smashed last month. This one even more so.

[00:02:56] [SPEAKER_01] The good news is less downstream consequences. Last month's more than a thousand patches resulted in a lot of breakage of things that worked before you applied the patches. And so Microsoft did a bunch of backpedaling and workarounds of things.

[00:03:20] [SPEAKER_01] And in fact, this Tuesday, last Tuesday of a week ago, this Wednesday's Patch Tuesday, also served to finally provide some permanent fixes to the things they broke. This one didn't break so much, but boy, did it have a number. So we're going to talk about that. Also, Palo Alto Networks, Unit 42.

[00:03:44] [SPEAKER_01] And I should say right up front, because I'll be talking about Palo Alto Networks at various points during this podcast, is a sponsor of the Twit Network. So keep that in mind. They've got and I love that their that their security, cyber security unit is Unit 42, of course. Oh, very close. Because that's the answer to everything.

[00:04:08] [SPEAKER_01] They provide a really interesting report on an agentic attack on an unnamed enterprise. You know, their identities just being kept on the QT for the sake of the enterprises integrity.

[00:04:25] [SPEAKER_01] Uh, we learn a lot from what they share and it moves my own needle of expectations for the future, which is what we'll get to talking about here toward the end.

[00:04:39] [SPEAKER_01] Uh, there was also, uh, a really interesting and actually frightening large hardware hack of physical cryptocurrency wallets, which resulted in a lot of loss of money by those who were using it. Um, we got some, we have some, we have some interesting takeaways from that also.

[00:05:05] [SPEAKER_01] In fact, one of them will be what to do to create your own known safe crypto hardware wallet. If you want one, uh, I'm going to share some, uh, feedback from a listener and then I want to talk about, and this feeds back into this unit 42, uh, Palo Alto networks attack about this.

[00:05:29] [SPEAKER_01] There's some other news that Anthropics shared with the industry last week where they were able to get an unreleased model of Claude to reverse engineer. And determine the never before known origin of some crypto parameters, which the industry standardized on without knowing where they came from.

[00:05:59] [SPEAKER_01] Beyond knowing that the NSA gave them to us. And there was already reason to be suspicious because there's, there was another instance that we talked about on the podcast many years ago, uh, regarding a, a sort of off the map.

[00:06:15] [SPEAKER_01] Why would you choose to use this random bit generator, which the NSA reportedly reported by Reuters paid RSA $10 million to make their default. So, okay. Anyway, uh, I think a bunch of interesting stuff, but the, the, the, the point of that last story about this reverse engineering is, is I need to share with everybody.

[00:06:42] [SPEAKER_01] What this anthropic AI agentic thing did in order to solve this longstanding problem, which has stumped everyone because it suggests that we're probably in for more trouble. With when the bad guys get ahold of this kind of power, then, then I've been suggesting, uh, until now.

[00:07:11] [SPEAKER_01] So, uh, I think a really good, interesting podcast for everybody. Absolutely. And after we take a break, we're going to, we have a great picture of the week.

[00:07:19] [SPEAKER_02] I love it. I love it so much.

[00:07:21] [SPEAKER_00] Uh, but first, yes, let's hear from Leo. Hey guys, this episode of security now brought to you by Bitwarden, the open source password manager trusted by more than 15 million users and over 80,000 businesses worldwide.

[00:07:36] [SPEAKER_00] In the fall 26 G2 password manager grid report, Bitwarden earned a stunning 99 out of 100 satisfaction score with 98% of users giving it four or five stars across more than 1400 reviews. People love Bitwarden. I love Bitwarden. Bitwarden's also expanding what enterprise security can look like with tools designed to give organizations more control without adding unnecessary complexity.

[00:08:04] [SPEAKER_00] Take Bitwarden privileged controls now available in private preview. It brings privileged access management to the same platform employees already use for their everyday credentials, but you get more. You get credential leasing, advanced access rules, automated password rotation, and detailed audit logs. Credentials can be released only when needed for a specific reason and period of time and then revoked when that lease ends.

[00:08:31] [SPEAKER_00] Bitwarden's also giving organizations more control over where their data lives. Federal agencies can self-host Bitwarden on their own FedRAMP compliant infrastructure. That includes on-prem, private cloud offline or air-gapped environments. Giving organizations with strict security, regulatory, or data residency requirements greater control over where passwords, secrets, and pass keys are stored and managed. And enterprise security is easier to roll out, too.

[00:09:01] [SPEAKER_00] New invitation links give admins a customizable way to onboard employees with options to restrict enrollment by email, domain, or rotate or invalidate links when needed. That combination of security control and usability is reflected in Bitwarden's latest customer feedback. It's not just about adding security features, though. It's about giving IT teams tools they can actually deploy, manage, and maybe most importantly, get people to use.

[00:09:29] [SPEAKER_00] Get started today with a free trial of a Bitwarden Teams or Enterprise plan. Or get started for free across all devices as an individual user at bitwarden.com slash twit. That's bitwarden.com slash twit. Now back to security now.

[00:09:48] [SPEAKER_02] All right. Thank you, Leo. And yeah, I'm looking forward to talking about this hilarious image this week.

[00:09:56] [SPEAKER_01] So I gave this picture, which was provided by one of our listeners, the caption, it's not only AI that takes instructions literally. Anyway, what we're seeing on screen. Thank you, Benito. For those who aren't looking at the video, there was some sort of a utility box, big utility box stuck on the side of a crosswalk pole.

[00:10:25] [SPEAKER_01] And in small print in the middle, it says post no signs, which would be pretty clear. However, somebody thought, OK, they printed the word no in quotes in very large, in three different fonts, creating four signs and stuck them all over this thing. So, in fact, they followed the rules, right?

[00:10:55] [SPEAKER_01] Or the command. They posted no signs.

[00:11:00] [SPEAKER_02] I love it. Post no signs. And I mean, it checks out, I got to say.

[00:11:05] [SPEAKER_01] And imagine encountering that. I think that'd just be so cool to be walking along and to see that thing and be initially puzzled. It's like, what? And then go, OK.

[00:11:15] [SPEAKER_02] And you look close. You go, oh, clever. Very clever. Good stuff.

[00:11:22] [SPEAKER_01] OK, so as our listeners know, I believe that the rate of security vulnerability discovery and patching is destined to first accelerate, as we've all been witnessing, but then to inevitably decelerate as that legacy of vulnerability debt is increasingly paid down.

[00:11:47] [SPEAKER_01] You know, even Microsoft cannot possibly be creating new vulnerabilities at the rate they're now able to find and eliminate them thanks to their M-Agentic AI system, which they've been applying to great effect.

[00:12:05] [SPEAKER_01] So without access to what's actually going on inside Microsoft, we have no way of judging where they are along this process. When, you know, when they're going to hit like that point of peak patches, where we will then begin to see the rate drop off.

[00:12:28] [SPEAKER_01] I sort of thought maybe after last month's 11, more than a thousand patches is like, OK. And that that was that followed several months of like 400. I remember well earlier in this podcast when, you know, 25 would have been like a like, OK, well, we got we fixed 25 problems this month. It's like, OK. Maybe 47 would have been a biggie.

[00:12:55] [SPEAKER_01] Well, OK, we've of course blown all of that away. Bleeping computer places this October month's Microsoft update count at an astonishing 1411 problems. Now, there's a little variation. I saw 1417 or 1414, depending on who. You know, I mean, the problem is when there's so many, you lose count.

[00:13:23] [SPEAKER_01] I mean, it's like, you know, what qualifies what there's a little bit of a gray area, but still, you know, way more than we had last month. And last month was a lot. So anyway, before we, you know, I do want to say bravo to Microsoft. Right. I want to go on record again with a loud praise.

[00:13:47] [SPEAKER_01] You know, they finally have the tools in this M dash to enable them to clean up their massive base of legacy code.

[00:13:59] [SPEAKER_01] You know, until now, they've been at the mercy of attackers like no nightmare eclipse, who we've talked about all through the big the early part of this year, who were individually able to invest the time and resources needed to scour Microsoft's code, looking for individual exploitable vulnerabilities and then develop an exploit for them.

[00:14:25] [SPEAKER_01] And yeah, Microsoft would fix any problems that were discovered and shown to them, you know, which is what led in the old days to those 25 or, you know, or 47 patches. But Microsoft's massively agentic M dash system and allowed them finally to go on the offensive.

[00:14:47] [SPEAKER_01] And boy, have they ever, as we saw last month with its mistakes that were also made fixing more than a thousand flaws can itself introduce new bugs. But even those tend to be short lived.

[00:15:30] [SPEAKER_01] Makes things better. Makes things better. Then boy, did Microsoft software get a lot more secure this month. Last week, Bleeping Computer wrote the following. They said Microsoft's October 26 patch Tuesday security updates addressed a record breaking 1411 flaws, including one actively exploited and two publicly disclosed zero days.

[00:15:58] [SPEAKER_01] That patch Tuesday addressed 70, seven zero critical vulnerabilities, 57 of which are remote code execution. 11 of the other criticals were elevation of privilege and two were spoofing.

[00:16:17] [SPEAKER_01] So if you if we break down the vulnerabilities by category, there were the greatest number overall, six hundred and seventy seven were elevation of privilege vulnerabilities.

[00:16:32] [SPEAKER_01] And although, as we've talked about before, those don't seem as like horrifying as remote code execution, because who wants to have your computer executing code that some cretin, you know, managed to sneak into it. Still, elevation of privilege matters because the way Windows security hierarchy is set up. Most users do not run with admin privileges.

[00:17:00] [SPEAKER_01] And if something happens in your computer while you're logged in because of something you do, the bad guys have code running with your privilege, meaning restricted, not root, not admin. So elevating that privilege to to full access in order to do much more devastating permanent damage is crucial.

[00:17:26] [SPEAKER_01] Six hundred and seventy seven problems were found and fixed just last Tuesday that allowed exactly that.

[00:17:34] [SPEAKER_02] Can you imagine the sound, the collective sound of winces that the that I can't imagine being one of these folks seeing these and going that's been in there for the past 15 years and we have to hope that no one exploited it. And boy, howdy, how did we miss that? And I can't imagine.

[00:17:56] [SPEAKER_01] Yes. And and and it's funny, too, because from Microsoft standpoint, while fixing one thousand four hundred and eleven flaws, they're acknowledging for one thousand four hundred and eleven flaws on top of the more than thousand last week or last last month. It's like so. So that's why I want to be so clear that it's like, go, Microsoft, don't be shy.

[00:18:25] [SPEAKER_01] You know, just just like we, you know, the the license agreement already holds them harmless. Right. It's like, well, if you don't like Windows, you can send it back. But, you know, if you're using it and taking all the risk for doing so, because we just sort of tried, you know, and did as good a job as we could. Yeah. It's like so. So it's not like they're liable for any of these problems there and the fact that they're getting it better.

[00:18:53] [SPEAKER_01] What what I really love, because I have not yet seen any compelling reason to go to eleven. I'm I'm happily, you know, putting ten wherever I am setting up a new machine because of the fact that such so much of the world wants to use Windows 10, does not want to go to 11 or has older hardware that won't run 11. They're stuck at ten. But Microsoft, even though they've they've they formally discontinued support,

[00:19:22] [SPEAKER_01] they keep adding a year and a year and a year to it. What I love is that ten is being really well fixed as a consequence of all this. I mean, that's fantastic. And because they've moved on to 11, they're not screwing it up anymore. They're only fixing it. So by the time they finally stop patching ten and we know we have another whole year.

[00:19:48] [SPEAKER_01] Right. They as we were approaching this October, this month, they said the month before we decided we're going to give you another year. Great. Because, you know, we're going to see this curve of vulnerability fixings finally dropping. Maybe it'll be next month. Maybe it'll be the month after. We're not sure when, but it's going to happen where they're going to start running out of them because, you know, there has to be an end.

[00:20:15] [SPEAKER_01] And ten will get all of the benefit of that and none of the liability of any of Microsoft's new crap. So it's wonderful. I mean, it's just a win for Windows 10. Anyway, as I said, 677 elevation of privilege. The second most occurring class of problems they fixed was 317 remote code execution vulnerabilities.

[00:20:42] [SPEAKER_01] In other words, they fixed last week, 317 different ways that bad guys could run code in your computer without you wanting them to. Which is like, as you said, you know, it's bracing to think that there until last Tuesday, there were 317 ways to do that. Yikes. Yikes. Yeah. So, yeah.

[00:21:08] [SPEAKER_01] 254 information disclosure vulnerabilities, 73 denial of service, which is mostly just now. That's what we call it when you're able to crash something because you deny everybody else its service because you crashed it. So 73 ways to crash the DNS server or whatever. 40 security feature bypass vulnerabilities, which has always seemed sort of nebulous to me. It's like, well, OK, that's kind of like everything, right?

[00:21:37] [SPEAKER_01] Security feature bypass and then 28 spoofing vulnerabilities. Anyway, Bleepy Computer said that they said when we report on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself. In other words, there were more. They said, therefore, today's total excludes 348 flaws fixed earlier this month,

[00:22:06] [SPEAKER_01] including vulnerabilities in Azure API Center, Azure App Service, Azure Event Grid, Azure SRE Agent, Mariner, Microsoft Bookings, Microsoft Dataverse, Microsoft Exchange Server and Microsoft Partner Center. So and normally you would see things like Exchange Server fixed on Patch Tuesday. The fact that they did it sooner probably means it was really bad and they couldn't figure they could even wait until Patch Tuesday when they,

[00:22:35] [SPEAKER_01] on the other hand, it would have bumped the count up. And so maybe they were thinking, OK, we can't do more than 1411 all in one sweep. So they said, Bleepy Computer said this is a record breaking, no kidding, Microsoft Patch Tuesday as Microsoft continues to use artificial intelligence platforms to find and remediate security vulnerabilities in its products.

[00:22:58] [SPEAKER_01] Microsoft also said, quote, today, October 13th, 2026, Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB, that's, you know, the long term servicing branch 2016, have reached the end of their updates. Of course, that doesn't mean they're going to stop updating them because they can't. The October 2026 monthly security update is the last update available for these additions.

[00:23:28] [SPEAKER_01] However, you know, they're still updating Windows 10. So they're clearly going to give you that, you know, it's not in the normal standard Microsoft Patch routine. It's in the extended services mode, which is what they keep deciding to extend every time it gets close to ending. They add a year to it because, you know, so much of the world is still using Windows 10. Well, obviously, a lot of the world is using Windows 11 version 24H2.

[00:23:55] [SPEAKER_01] So it's not like they're going to cut that off either, especially when they're fixing thousands of problems every month. So I believe the computer said earlier this month, Microsoft also said organizations running Windows 11 23H2 Enterprise, Education and IoT Enterprise editions should upgrade to newer versions as they'll no longer receive security updates after next month.

[00:24:20] [SPEAKER_01] And yeah, why not have, why not update to the, unless you for some reason can't update to the latest Windows 11? Why wouldn't you? They said this month's patch Tuesday fixes one actively exploited and two publicly disclosed zero day vulnerabilities. And they noted that Microsoft classifies zero day flaws a little differently than the rest of the world.

[00:24:44] [SPEAKER_01] They call them, you know, we call them when they are caught being used on some software. We call that a zero day because it's really a surprise. Microsoft classifies, they write zero day flaw as publicly disclosed or actively exploited. So in other words, you don't have to, you don't even have to be using it if someone mentions it in public. It's like, oh, that's a zero day because it surprised them.

[00:25:13] [SPEAKER_01] So they said the actively exploited zero day vulnerabilities addressed during this October 26th patch Tuesday are, and there are three of them. There's a Windows shell security feature bypass vulnerability. I'm not going to go into the details. There's a .NET framework security feature bypass vulnerability and a message pack C-sharp denial of service vulnerability.

[00:25:42] [SPEAKER_01] And they finished by saying, with this month's record-breaking number of vulnerabilities, Microsoft has also introduced a new method for organizations. I thought this was interesting. To prioritize security updates by grouping related flaws into what Microsoft calls risk cohorts.

[00:26:03] [SPEAKER_01] For brand new idea for the first time this month, they said this new approach groups similar vulnerabilities together to help organizations better understand which security flaws pose the greatest risk to their systems and should be prioritized for patching. So I think this is a welcome.

[00:26:53] [SPEAKER_01] So this new concept of these risk cohorts is a welcome addition. And especially when an enterprise now is facing an astonishing number of updates. 317 of the 1,411 allowed for remote code execution.

[00:27:14] [SPEAKER_01] So we know that the bad guys examine both the before and after patched code to locate the changes that Microsoft made as a means of attacking those who are slow to update.

[00:27:29] [SPEAKER_01] So reorganizing the massive patch collection, which we're now being, you know, is being dumped every month into a collection of so-called risk cohorts will potentially at least allow concerned enterprises to verify the safety of the most of the more serious problems. That's a safety as in.

[00:27:55] [SPEAKER_01] And get those pushed out to their enterprises workstations. Um, Bleepy Computer did break this down. They said for October 26, Microsoft, October 2026, Microsoft published 15 risk cohorts overall. And then they listed just five.

[00:28:16] [SPEAKER_01] They said including 136 vulnerabilities, which affected Windows file systems, storage and backup, 135 vulnerabilities involving office documents and mail clients, 131 vulnerabilities affecting Windows graphics, media and content processing, 109 vulnerabilities involving Windows core and kernel privilege boundaries, and 103 vulnerabilities affecting Windows installation, deployment and update services.

[00:28:46] [SPEAKER_01] As I think about this again, looking at these, it feels like they've divided them sort of like departmentally, like, like there will be some group of people in the enterprise who would take those 136 vulnerabilities affecting Windows file system storage and backup and, and check those because that's sort of their bailiwick.

[00:29:14] [SPEAKER_01] You know, they're, they're, they're those people because for example, then we have the 135 involving office documents and mail clients. Well, that might be a different group in a large enterprise that is like in charge of, you know, my, the, the, the Microsoft office stuff.

[00:29:30] [SPEAKER_01] So by, by, by segregating them that way, it does allow, you know, it, it, it, it, it divides this huge number of vulnerabilities into groups by, by focus group, essentially, you know, who would, who would generally handle making sure that, you know, we haven't broken something in the installation, deployment and update services, you know, where 103 vulnerabilities were just passed.

[00:30:01] [SPEAKER_01] So anyway, bleeping computer says that Microsoft stress that these groups do not necessarily indicate which flaws are the most dangerous, right? As the actual risk depends on whether they're being exploited in attacks, their severity and how an organization uses the effect of software. Microsoft says the new approach is still experimental and is meant to help organizations. They see, they say prioritize. This doesn't feel like priority to me.

[00:30:31] [SPEAKER_01] It feels like, you know, segregate for department, you know, different departments to handle them. If, if that's their expertise.

[00:30:40] [SPEAKER_02] Yeah.

[00:30:42] [SPEAKER_01] Delegate. Right. Right. Yeah. So anyway, that's where Microsoft stands. Are we still accelerating? Are we going to have more next month? Even more. Woo. Will November. Yes. Right. See an even higher count or was this month the month that we peaked and we will now see what will probably be.

[00:31:06] [SPEAKER_01] My guess is when we hit the peak, we're going to see a sharp drop off as the pool of unpatched vulnerabilities dries up. I'm on record. We'll see if I'm right or not. So, but what's equally exciting to me is the idea that all future Microsoft software will now be able to be pre-screened by that same M dash AI, which is fixing the legacy code.

[00:31:33] [SPEAKER_01] You know, they'll be, they should be able to pre-screen anything before it's ever released. In other words, there's the real potential for Microsoft systems to be truly secure for the first time ever. And for vulnerability discovery, exploitation and post-release patching to become an historical artifact.

[00:31:58] [SPEAKER_01] Like where, you know, when I was a boy, it's like because there just aren't these problems anymore because AI cleans them up even before they get out the door in the first place. And wouldn't that be something for what it's worth? Microsoft is not alone. An increasing number of companies, as we've noted previously, have been synchronizing their own software updates with Microsoft's Patch Tuesday.

[00:32:26] [SPEAKER_01] I don't know if it's like to hide behind Microsoft or what. You know, it's like, oh, well, Adobe did this and so forth and Cisco did that. But that's been growing more and more popular. However, Bleeping Computer also noted that the recent updates from other enterprises who also appear to be employing AI for their own preemptive defense. Yay. I mean, we need that to happen. We know that Cisco is.

[00:32:53] [SPEAKER_01] Last week we covered, or a week or two ago, we covered Cisco's massive patching binge, which again, props to Cisco. Thank you for fixing all this.

[00:33:04] [SPEAKER_01] They apparently sorted this alphabetically, Bleeping Computer did, saying other vendors who released updates or advisories in October 2026 include, we've got Adobe, you know, the A word, released security updates for numerous products, including commerce, substance, 3D samples, cold fusion, Photoshop, dimension and framework.

[00:33:29] [SPEAKER_01] Atlassian released security updates for critical vulnerability in multiple self-hosted data center products, including Confluence, Jira and Bitbucket. Attackers soon exploited the flaw after a proof of concept was released. That was the fix for the critical vulnerability in Atlassian.

[00:33:48] [SPEAKER_01] Cisco released security updates for numerous products, including critical vulnerabilities in its NXOS data center network operating system that can let attackers run arbitrary code with root privileges on Nexus switches. Citrix released security updates. I'm not going to go through them in the same level of detail. Dell was there. Docker patched a critical flaw on Docker Hub. Fortinet released security updates for numerous products.

[00:34:15] [SPEAKER_01] GitLab released security updates for critical flaws in its AI gateway and CICD regular expression compiler. Avanti is there with updates. Kiteworks security updates for 126 vulnerabilities. There are, you know, AIs on the case there. Progress Software released security updates for critical and high security vulnerabilities. SAP released the October security updates addressing 20 security flaws.

[00:34:44] [SPEAKER_01] And SonicWall released security updates for a critical SMA 1000 server-side request forgery than SSRF flaw. So anyway, we're seeing industry-wide repair of legacy code, which, you know, it is so welcome and necessary.

[00:35:05] [SPEAKER_01] Since we already know, and I'll be sharing another example of it shortly, that the attack capabilities now being brought by AI, not tomorrow, but it's already here, are being used to increase the strength of attacks. So, go.

[00:36:19] [SPEAKER_01] Can you talk about that? And keeping an eye on any open source projects that wanted to opt into that. So, yeah. I mean, and that's great. Because, you know, we're seeing all these enterprises obviously spending now on AI vulnerability discovery.

[00:36:46] [SPEAKER_01] And the result is, you know, much greatly increased rate of patching. So, so that side is covered. And also notice that the enterprise is the one that has their own software, their own source code. It's not open. It's not open. So, it isn't nearly as easy to fix it. Not technically impossible. But still, you really need the source in order to fix the software. Enterprises are closed source, but they've also got the money.

[00:37:14] [SPEAKER_01] Open source projects, you know, the source is open for everyone. But they typically are underfunded or not funded. You know, it's all volunteer effort. So, the idea that we're seeing them step up to the, you know, step up and recognize that AI, in fact, it was the week before last week.

[00:37:44] [SPEAKER_01] We talked about them also doing a piece which noted that GLM-53 from ZAI was now just about equal to the frontier in its ability to find problems. And being open weight, it could be obliterated. And so, you would remove all of its ability to say no.

[00:38:10] [SPEAKER_01] So, you know, so then the week after, which is last week, we talked about how they had then, and Anthropic, then decided, okay, because the bad guys do have access to open weight models that are almost as good as ours, we're going to give free access to the open source community for big projects that matter. To, you know, when they don't have the money to fund AI, you know, we do.

[00:38:40] [SPEAKER_01] So, I think that was a really good move. So far, despite its record-breaking 1,411 updates, the industry has not experienced what I would call an October surprise of update consequences like we did encounter last month after the more than 1,000 updates.

[00:39:08] [SPEAKER_01] October's updates, as I mentioned earlier, October's updates, as I mentioned earlier, also finally repaired a number of things that September broke. So, it's been nice to see that we don't necessarily always have dire consequences following a mega patch update cycle, even though this was even more mega than the last mega one was. I don't know how they did. I don't know how they made it differently.

[00:39:34] [SPEAKER_01] Maybe they tightened up their pre-release testing, having learned an expensive lesson. I mean, it was a black eye that so many enterprises were significantly impacted by installing September's updates. And, you know, look at the pressure that enterprises were under to get them installed quickly because there were so many that were so bad.

[00:39:58] [SPEAKER_01] And now everyone knows the bad guys, you know, are much better at exploiting these problems. So, you know, time really is of the essence. And in fact, the week before Microsoft released this, the September batch, they said, get ready. We're going to get we have a big September coming. And a lot of these things are really bad and you can't wait to patch them. So enterprises didn't and then got hurt by not waiting.

[00:40:27] [SPEAKER_01] So, so far, you know, we're only a week downstream from last Tuesdays, but we're not seeing nearly the same level of trouble. Microsoft did, however, note that some users may have trouble is the only one thing that I was able to find may have trouble turning on smart app control.

[00:40:50] [SPEAKER_01] After installing this October's patches for Windows 11 security update. Bleeping computer covered that writing smart app control is a Windows 11 security feature that uses Microsoft's app intelligence services and code integrity features and works alongside Microsoft defender and smart screen to block potentially harmful apps or binaries.

[00:41:15] [SPEAKER_01] You know, so basically it's preventing you from running something that that you're that could damage your you or your system. So they so bleeping said, according to the company, Microsoft, on affected devices running Windows 11 version 24 H2 and later, the smart app control option is grayed out and cannot be changed.

[00:41:38] [SPEAKER_01] Microsoft said in an update to their patch for Windows 11 security features, KB 512-7648 advisory. They said after installing this update, some devices might be unable to turn on smart app control in the Windows security app if it has been turned off. On affected devices, the option to turn on smart app control might be grayed out.

[00:42:07] [SPEAKER_01] Devices where smart app control is already turned on are not affected and remain protected. So big deal. You know, if that's all they broke while patching 1411 vulnerabilities. Yeah, I'd call this month's patch Tuesday a huge success. And it sounds like a trivial UI problem and really nothing to worry about.

[00:42:33] [SPEAKER_01] Microsoft did, however, offer a workaround which involves a couple registry tweaks. You need to run regedit or run a command prompt as an admin rights and then, you know, basically set two keys in the registry, which essentially does the same thing that the UI would have done. That the UI, you know, click the button would have done.

[00:43:02] [SPEAKER_01] So it's certainly possible if you, for some reason, you have to turn that on, even though you had it off before and October broke the ability to turn it on. Well, if you have to have it on, you can. There is a workaround and obviously it'll get fixed next month. I don't think there's any great emergency to, you know, making that happen soon. Okay.

[00:43:25] [SPEAKER_01] Next, I'm going to talk about this Palo Alto Networks sponsor of TWIT Unit 42 investigation. But let's take a break so I can rehydrate and we'll hear from Leo.

[00:43:37] [SPEAKER_00] Sounds good, Leo. Take it away. This episode of Security Now is brought to you by Delete Me. October is Cybersecurity Awareness Month. Now, here's something every business owner should consider. Your company invests in cybersecurity, but what about the personal information cyber criminals can find about your employees online? That's actually gold for them. And that's where Delete Me comes in.

[00:44:03] [SPEAKER_00] Delete Me removes employees' personal information from hundreds of data broker websites, reducing the information attackers can use to target your business. And Delete Me has a couple of security tips to share with your team. You may know this already, but if not, maybe you should tell your team. I bet you some of them are making these basic mistakes. First of all, verify before you click, right? If an unexpected email appears to come from a client or vendor, you should independently check the sender's domain.

[00:44:32] [SPEAKER_00] Cyber criminals use lookalike domains to steal passwords, spread malware, and impersonate trusted businesses. I mention this because it happened to us. The emails from what looks like an actual client of ours. Or even text messages impersonating our executive team. That's when we first signed up for Delete Me. We realized we're not immune either. Next, you might want to Google yourself. Ooh, that could be scary.

[00:44:59] [SPEAKER_00] See how much personal information is publicly available about you. Home addresses, phone numbers, birthdays. All could be purchased from people's search sites and used to make scams seem legitimate. Now, this is where Delete Me really helps. Their privacy experts remove your team's information from hundreds of data broker websites, continuously monitoring for new listings and providing regular privacy reports without adding more work to your IT team. They're busy enough.

[00:45:27] [SPEAKER_00] Delete Me has the recognition to back it up winner of two Cybersecurity Excellence Awards, including most innovative cybersecurity company and privacy product service. Delete Me is trusted by organizations that take security seriously. And over 20% of the Fortune 500, like Yahoo. Ask Yahoo's principal behavioral engineer who says, Delete Me, quote, is a critical layer in our security stack.

[00:45:53] [SPEAKER_00] Removing exposed PII is essential to protecting our employees and reducing risk. It's become a core part of how we defend our organization's privacy posture in today's threat landscape. To protect your business and your peace of mind, go to joindeleteme.com slash twit-biz and start protecting your business with Delete Me today. And if you use that link, you'll also get a free year of social media protection for every seat you purchase.

[00:46:20] [SPEAKER_00] That's joindeleteme.com slash twit-biz. Thank you, Delete Me for support and security now. Now back to Steve.

[00:46:30] [SPEAKER_02] All right, back from the break. As I mentioned, Micah Sargent subbing in today for Leo. And it's time to go 42.

[00:46:43] [SPEAKER_01] Okay, so I mentioned another example of AI-enhanced attacks. Last month, Palo Alto Network's Unit 42 published their findings from their investigation into an AI-assisted attack. And their report contains a bunch of useful takeaways which can be readily generalized. So here's what they reported, and then we'll talk about what it means.

[00:47:08] [SPEAKER_01] They said Unit 42 responded to an incident where a human attacker used Frontier AI to breach an enterprise network autonomously as part of a ransom attack. The agents breached the company's security layers in a methodical manner, with each agent targeting a different layer of defense to achieve their shared goal.

[00:47:34] [SPEAKER_01] The impact was at the scale of a coordinated effort from multiple red teams, which would normally take human operators around two weeks. The threat actor told us in negotiations that they leveraged Frontier AI models and attack-specific agentic AI frameworks. By shifting execution to an automated loop,

[00:48:00] [SPEAKER_01] the attacker compressed weeks of methodical intrusion tradecraft, using more than 50 MITRE attack techniques into fewer than 10 hours. After they gained initial access, the attacker used agents to map the internal architecture, raid source code repositories, and seize root credentials. The agents also triggered unauthorized continuous integration,

[00:48:30] [SPEAKER_01] continuous delivery, you know, CICD builds, and claimed master keys to the victim's cloud AI infrastructure. Oh, and get this. They said, what made the attack stand out was AI-assisted operational efficiency without the need for a novel zero-day or super-elite tradecraft.

[00:48:54] [SPEAKER_01] The attacker left all tactical execution to AI agents that monitored, evaluated, acted, and replanned in real time, increasing the speed throughout the attack chain. And the attacker also directed its agents to leave behind a report on the organization's security posture,

[00:49:23] [SPEAKER_01] an 80-page, 8-0-page technical audit, detailing dozens of exploited findings. In other words, it ransacked the enterprise, it exfiltrated all of the company's crucial, critical, must-keep-it-private data, which it would then use to extort the company for a ransom,

[00:49:52] [SPEAKER_01] and left behind, thoughtfully, an 80-page audit of everything it found wrong that it used in order to perpetrate its crime.

[00:50:04] [SPEAKER_02] Well, that's nice. I mean, yeah. How kind. I wonder what, like, I wonder where and what resulted in it making that choice. You know what I mean? What would result in a sort of vigilante... Well, my... Oh, we're going to get to it?

[00:50:24] [SPEAKER_01] Well, no. My guess is that this is what we've seen. This is the way agents work, right? Is they build their own dossier of findings as they're going through. They, like, leave breadcrumbs behind for other agents to then read and pick up the thread or go in a different direction.

[00:50:47] [SPEAKER_01] So this was probably being built for their own purposes as they were finding flaws and exploring avenues and pathways. And then they thought, well, what the hell? Let's, you know, format this into a formal technical audit of all the problems that we found and exploited just sort of, you know, to give them a little, I don't know, goodbye bonus. Yes. Yes.

[00:51:15] [SPEAKER_02] It's almost, from our perspective, the human perspective, there's a little bit of a, it's kind of a brag, honestly. It's like if somebody's leaving their little calling card behind, my calling card is just, here's where you failed. Wow. That's funny. Exactly. I mean, not funny, but funny.

[00:51:36] [SPEAKER_01] So Palo Alto said, the adversary ran their operation using current AI-enabled software development processes. They said, we observed three indicators consistent with AI usage. First, large language model calls to multiple frontier AI agents in parallel. Well, structured markdown files. Oh, here's what I was talking about. Passing information between agents and sessions.

[00:52:05] [SPEAKER_01] So they use those. And then I would imagine they ended up digesting that into that 80-page report. And then third, custom scripts assessed with high confidence to be AI-generated due to UI elements, which, and those custom scripts were managing the dynamic operations. They said, the 10-hour operational timeline included infiltration and mapping.

[00:52:32] [SPEAKER_01] The actor breached a publicly accessible web service. So that was their way in. Whatever this entity was, and we still don't know, they had a web service, internet-facing. So infiltration and mapping.

[00:52:50] [SPEAKER_01] The actor breached a publicly accessible web service to tunnel into the network, deploying an automated recon agent to map internal microservices. Then secrets harvesting. Subagents combed enterprise code repositories, extracting hard-coded tokens and service passwords. Subagents. Subagents.

[00:53:18] [SPEAKER_01] As I'm reading this, I'm hoping that CISOs are getting a little chill. Yeah, exactly. Or feeling a little chill. The idea of what is in the process of being turned loose on a world that is not ready for it, which is really the theme and the conclusion that I'll be reaching during this podcast. I mean, it is something.

[00:53:45] [SPEAKER_01] Then, privilege takeover, they said. Using exposed tokens, the actor infiltrated the sequence management system, harvesting master administrative credentials to seize control of root system access. Then pipeline exploitation.

[00:54:06] [SPEAKER_01] The actor hijacked an enterprise code application via custom workflows to exfiltrate cloud access keys. They attempted to plant backdoors in Terraform configurations, but hard branch protection controls stopped it. And then, get a load of this one, Micah. AI infrastructure hijacking.

[00:54:32] [SPEAKER_01] Using stolen cloud keys, the actor turned the victim's AI endpoints into post-compromise infrastructure. Using the company's own AI compute power to perpetrate further moves. Oh, my goodness. So they hijacked the company's own AI. That's horrifying.

[00:55:00] [SPEAKER_02] What you said, if the chills weren't already happening, they'd better be happening now. That gave me chills. I'm, oh, that's, that's, that's terrible. I mean, that's a, that is like a true virus, right? Like, what do you think of a biological virus going in and reprogramming our own cells?

[00:55:19] [SPEAKER_01] That is wild. So the attack, the attacker's AI having obtained the keys to the victim's cloud AI used that victim's own AI against them to facilitate additional post-compromise work. Yikes. Their report, Unit 42's report included an infographic, which I have included in the show notes.

[00:55:46] [SPEAKER_01] It observes that the human orchestrator set the objectives and directed the agents. They reviewed the results and prioritized next steps and directed follow-up activity as the attack progressed. But all of the actual work was done by these agents. Palo Alto Networks, Unit 42, then summarized what they learned from their analysis. So here's what they said.

[00:56:12] [SPEAKER_01] Key lessons learned from addressing agentic attacks. This incident exposes how an attacker who understands how to deploy frontier AI agents effectively can dramatically speed up the pace of their attack.

[00:56:32] [SPEAKER_01] Remember that they said, if multiple human red teams had been employed, they're guessing this would take two weeks of concerted effort by human attackers trying to get in and do damage. This took 10 hours.

[00:57:25] [SPEAKER_01] They said, AI agents reduce the time between steps in the attack flow. AI agents in this attack were designed to parse raw tool output and quickly take next steps, speeding up the overall attack flow. AI agents leave recognizable indicators.

[00:57:46] [SPEAKER_01] They said, defenders can identify agentic attacks by watching for indicators such as the use of structured markdown, Python caches, and paired asset folders. They said, attackers can use AI to establish redundant persistence across the environment.

[00:58:05] [SPEAKER_01] They said, in this incident, the attackers used AI agents to effectively establish overlapping persistence across SSH keys, serverless functions, container restart policies, cloud identities, and CICD pipelines. Using AI agents can make it easier for an attacker to maintain and test this entire portfolio in parallel.

[00:58:33] [SPEAKER_01] And finally, attackers can use an organization's AI tools. This is the final part. An attacker can use an organization's AI tools as post-compromise infrastructure. Attackers can hijack enterprise AI services to assist in their attacks.

[00:58:54] [SPEAKER_01] This allows threat actors to hide orchestration traffic among expected traffic and offload the financial cost onto the victim. In other words, they get the victim to pay the cost of the AI's use. And because it's internal enterprise traffic, that's the part about hiding the orchestration.

[00:59:21] [SPEAKER_01] You're not having to orchestrate from outside the enterprise where you would see traffic crossing the enterprise's boundary. That's now you're orchestrating internally, endogenously, essentially. So they said, what about specific defenses? They write, defending against automated agentic loops requires matching the speed and adaptability of AI-driven attacks.

[00:59:49] [SPEAKER_01] They said, execute synchronized containment. Deploy automated playbooks that simultaneously revoke credentials, terminate OAuth sessions, freeze CI-CD pipelines, and isolate cloud accounts across all operational planes. Govern AI, they said, as core infrastructure.

[01:00:13] [SPEAKER_01] Inventory every model endpoint, API key, model context protocol, you know, MCP, gateway, and AI tool integration. Apply strict rate limits, least privileged policies, and diagnostic logging. Detect behavioral loops.

[01:00:33] [SPEAKER_01] Hunt for operational loops, including bursty API requests, rapid 401 to 200 HTTP state shifts, meaning something is trying things that don't exist and then succeed, meaning something was guessing URLs until it finally got the right one. They said, parallel authentications and sudden model usage from unexpected identities and lockdown DevOps pipelines.

[01:01:04] [SPEAKER_01] Enforce mandatory multi-party code reviews and immutable branch protection on all infrastructure as code repos to block automated backdoor injection.

[01:01:46] [SPEAKER_01] Okay. So, you know, I'm not in charge.

[01:02:15] [SPEAKER_01] So, you know, I'm not in charge. I'm not in charge of any large enterprise. And, you know, I'm glad. I'm more glad for that than I've ever been because this feels daunting. Yeah, it does. We focus a lot on coding errors that lead to vulnerabilities because they are concrete, they're understandable, and they're actionable. There's a bug. There's a bug. We found it.

[01:02:44] [SPEAKER_01] It could be exploited. Let's patch it. It is gone. So, you know, case closed.

[01:02:51] [SPEAKER_01] But the reason I'm becoming increasingly uncomfortable about the capabilities we're seeing emerging from these new, and they are new, agentic attacks is that they are far less dependent upon the presence of explicit bugs than they are upon a general systemic laxity.

[01:03:17] [SPEAKER_01] Of absolute organizational and network security. The description of this particular incident reveals the sort of environment that likely exists within most, if not every organization. You know, it's just natural. And we're just human, after all. You know, over time, with the changing of the guard, projects get abandoned.

[01:03:47] [SPEAKER_01] Old code or test credentials get left behind in long-forgotten directories. You know, there's debris accumulated. Trails of breadcrumbs accumulate everywhere. You know, with this or that permissive firewall rule left in place after the need for it has expired or ended. You know, with an ex-employee's credentials left active.

[01:04:15] [SPEAKER_01] And who knows what else? It's nothing overtly bad or glaring. Just the inevitable consequence of people who are in a hurry, who have better things to do than always, without fail, rigidly enforcing every policy that was once upon a time stated.

[01:04:39] [SPEAKER_01] And into an organization like that, into reality of today, we drop a powerful, goal-oriented, goal-directed, tireless and merciless AI entity that will literally do anything and everything to accomplish its goal.

[01:05:05] [SPEAKER_01] You know, it's capable of inventorying every online asset within the organization, checking version numbers, testing for any patches skipped, scraping the enterprise's website to obtain a roster of public-facing employee names, then digging into their public personas to obtain any detail about them that might hint at their password credentials.

[01:05:33] [SPEAKER_01] It would rifle through any source code that it would rifle through any source code that it was able to find. And in the case that Unit 42 talked about, it did that. You know, either internal source or external, sourcing for tidbits and hints, anything it might be able to use to further its goal. It would read through everyone's email, years or decades of it, whatever is available.

[01:06:02] [SPEAKER_01] It would learn of relationships and responsibilities and look for any clues that would allow it to advance its mission. It would learn, you know, like pick up, for example, a helpful reminder Slack password that was once passed between employees through secure internal email, but still in an archive somewhere.

[01:06:32] [SPEAKER_01] Then using Slack search and API would sweep through years of Slack history, soaking up every bit of useful intelligence it could find.

[01:06:43] [SPEAKER_01] We're talking about turning an extremely resourceful goal-directed berserker loose inside the network of a large enterprise, an enterprise that's never needed before to secure itself against any such threat or intrusion because no such intruder has ever existed before now.

[01:07:09] [SPEAKER_01] This agentic berserker will have already been trained to encompass all published human knowledge, including all known hacking tricks and techniques. It's fast, inexhaustible, and clever by virtue of being willing to try everything and anything.

[01:07:30] [SPEAKER_01] October's patch Tuesday repaired 1,411 new vulnerabilities on top of the more than 1,000 from last month because agentic AI has become that capable. No one wants an unconstrained AI turned loose inside their enterprise. So, am I exaggerating or overstating agentic capabilities?

[01:08:01] [SPEAKER_01] Not from everything we've already seen. We've all seen what agents that were deliberately constrained and were not supposed to get loose managed to do. You know, I hesitate to call them clever, but the reports of their actions as they have, you know, as we've seen over and over, they found a way in.

[01:08:26] [SPEAKER_01] Those are surprising and should chill the blood of any CISO. Shortly after this summer's Black Hat Conference, the stock prices of CrowdStrike and Palo Alto Networks, two companies that specialize in protecting enterprise networks from intrusion, their stock prices moved rapidly upward and have been continuing to climb. Why?

[01:08:55] [SPEAKER_01] Because the world's enterprises began to recognize just how very real these agentic AI threats have become. And they're not wrong.

[01:09:07] [SPEAKER_01] Today's main topic that we'll be getting to is the story of how an agentic AI spent just 30 minutes to reverse engineer and discover the original source of the globally standardized curves used by the elliptic curve digital signature algorithm, ECDSA.

[01:09:29] [SPEAKER_01] The origin, as I mentioned at the top of the show, of those specific curves, those specific curves beyond the fact that they came from the NSA has always remained a mystery. It is a mystery no more until an AI was asked to figure out where they came from. My point is, the story I'm going to share is truly jaw-dropping.

[01:09:59] [SPEAKER_01] And it's the reason I am beginning to despair over the future security of any large and lumbering old school enterprise. If this is what AI can do, how could anyone be ready for what's coming next? And on that cheery note, let's take another break.

[01:10:23] [SPEAKER_02] I thought, let's let that one sit there for a minute because that's chilling. Oh, boy. Oh, boy. And it's got to be fighting fire with fire, but the AI versus AI, but it's still like...

[01:10:37] [SPEAKER_01] I think that... I mean, I'm serious when I say that I don't think any enterprise is prepared because you secure your borders, you trust your employees, but they will. Someone will say, hey, what's the password for our something or other Slack channel? And it's like, oh, I'll email it to you.

[01:11:01] [SPEAKER_01] Also, it's employee to employee, but it now exists in that enterprise's email archive. And when the AI gets in there and reads it all, it's going to go, oh, great. Now I have the Slack password. It's able then to use Slack's API to dump the entire history.

[01:11:22] [SPEAKER_01] And Lord knows what intelligence it's going to find from ad hoc discussions and meeting minutes and notes and everything that the company feels is internal.

[01:11:36] [SPEAKER_02] Oh, the meeting minutes and notes because now everyone's using those AI transcription services for every single thing. So now there are multiple places that are capturing your transcript. Oh, my goodness. I hadn't even considered that aspect of it.

[01:11:49] [SPEAKER_01] And remember that AI will tell you what it knows about you. So once it gets a hold of the enterprise's AI infrastructure, it can ask the various AI agents to dump all of their accrued knowledge of the people that use this AI. All of the prompt text can be retrieved.

[01:12:13] [SPEAKER_01] And so it'll immediately know everything that the enterprise's AI has learned about all of the users of it. Oh, I mean, it is beyond bad.

[01:12:27] [SPEAKER_02] And I mean, that's I feel that everyone is talking about or that a lot of we hear a lot about people talking about this side of things and talking about all the exploits that are happening and that kind of thing. I've been focused on vulnerabilities. It's like, well, let's get all those fixed. Sorry, that's not going to do the job. Wow. Wow. I hope somebody's thinking about it. I mean, you know, actually actively doing something about it. But what can you do?

[01:12:56] [SPEAKER_01] Well, and for example, CrowdStrike and Palo Alto Networks have endpoint security where they put devices in the enterprise that are AI enabled, which is supposed to be watching the network for signs of this. But, you know, not everybody's going to use them. There are a lot of people who are like, you know, they don't have the budget. It's not free to do that. And they just don't see the need.

[01:13:25] [SPEAKER_01] It's like, hey, everything's been secure so far. Well, there's a storm coming.

[01:13:30] [SPEAKER_02] Yeah. Oh, my God. Well, let's take a break and hear from Leo. And then we'll be back with more cheery news.

[01:13:40] [SPEAKER_00] Hey, guys, this episode of Security Now brought to you today by ThreatLocker. AI is accelerating cyber threats, helping attackers discover vulnerabilities, modify scripts, and generate new malware variants in minutes. At the same time, AI assistants and agents are gaining access to your sensitive documents, source code, cloud applications, APIs, and internal systems.

[01:14:04] [SPEAKER_00] ThreatLocker helps organizations like yours reduce their attack surface by controlling what can run, limiting unnecessary privileges, and restricting access to sensitive systems and data. As the executive vice president of technology for the Orlando Magic explains, quote,

[01:14:41] [SPEAKER_00] ThreatLocker also has the awards to prove it. They've been recognized as a strong performer in the January 26th Gartner Peer Insights Voice of the Customer for Endpoint Protection Platforms, ranked number one in application control by Peerspot. They even won the best zero-trust security solution at the 2025 TICE Awards. Visit ThreatLocker.com slash twit for a free 30-day trial.

[01:15:08] [SPEAKER_00] That's ThreatLocker.com slash twit. Oh, by the way, now's the time to start planning, yes already, for Zero Trust World 2027. It's coming up in February the 17th through 19th in Orlando, Florida. I'm so excited about this. We had such a good time last February. Register early, add it to your calendar, plan to join security leaders and practitioners for hands-on learning focused on zero trust. ThreatList listeners, you get $200 off registration.

[01:15:38] [SPEAKER_00] Just use the code ZTW, twit27. Z-T-W, twit27. And don't forget to go to ThreatLocker.com slash twit for your 30-day free trial. Thank you, ThreatLocker. Now back to Steve.

[01:15:53] [SPEAKER_02] All right, welcome back. We are, of course, sharing some cheery news about the future of security in the enterprise and elsewhere, thanks to the wonderful world of AI. Steve, take it away, friend.

[01:16:10] [SPEAKER_01] Okay, so the number one takeaway, I think, from the news of what's being called the Ledger Crypto Billis, B-I-L-I-S, Crypto Billis hack, is to be excruciatingly careful about the use of any physical hardware crypto wallet.

[01:16:40] [SPEAKER_01] There would be so much pressure when you think about it to plant a backdoor into a hardware crypto wallet, either by an unscrupulous vendor. Hopefully there are none, but, you know, the world. Or after shipping somewhere along the retail supply chain.

[01:17:06] [SPEAKER_01] So much pressure that it's almost impossible to feel comfortable using such a device unless, I guess, you really have made it yourself. And there are some options for that we will talk about in a second. But, you know, how would anyone ever know one way or the other whether the device they were using was clean? So, first of all, I fully understand the strong appeal of a dedicated hardware device for storing cryptocurrency secrets.

[01:17:36] [SPEAKER_01] The idea being that, you know, it's mostly disconnected from the outside world, which is, you know, what we definitely want until and unless and only when its secrets are needed. The trouble is that there are multiple points of vulnerability, both any device's hardware and its firmware. So the provenance of any such device really must be known and trusted.

[01:18:05] [SPEAKER_01] And that brings us to this next story, which BitQuery posted on Friday under the headline, The Ledger Crypto Billis Hack took, get this, $102 million from 35 wallets.

[01:18:29] [SPEAKER_01] They said one thief had all the keys and their subtitle was or their tease on Friday, 9th of October. People who had bought ledger devices from a seller in Southeast Asia found their crypto gone. They said we follow every drained wallet on six chains to see how the thief worked and where the money sits now.

[01:19:00] [SPEAKER_01] So with that, they continued writing weeks after setting up a ledger. The money was gone. You buy a ledger and move your savings onto it. Weeks later, you open the device. The balance says zero. And you never sent a thing.

[01:19:22] [SPEAKER_01] That's what ledger owners in Indonesia, Malaysia and the Philippines found on Friday, the 9th of October. And before I go any further, I should also mention in other news, compromised devices were also found by mainstream German resellers. So it's not just East Asia.

[01:19:44] [SPEAKER_01] They said ledger says they had purchased their devices from crypto billis, a shop that sells them in the region, which news reports describe as an official reseller. Ledger is a French company that makes hardware wallets, small devices that keep the keys to your crypto away from the Internet.

[01:20:07] [SPEAKER_01] On the same day, it said it was looking into losses among users in Southeast Asia who bought from crypto billis. It asked the reseller to stop all sales.

[01:20:21] [SPEAKER_01] That is, ledger did stop all sales, told recent buyers not to set up their devices and told anyone who had to consider moving assets to a new ledger signer using a new seed. By then, they wrote, two on-chain researchers had posted the thief's crypto addresses.

[01:20:50] [SPEAKER_01] Tanuki 42 listed eight of them and Spectre listed 10 with losses exceeding $86 million. So what they're saying is that they found, let's see, eight and 10.

[01:21:04] [SPEAKER_01] So they found there a total of 18 cryptocurrency addresses that had transferred the money from these ledger-based wallets into the bad guy's accounts totaling $86 million. They said, I'm sorry, Bitcoin records every transfer on the chains involved.

[01:21:29] [SPEAKER_01] So we followed each drained wallet and each address the money reached. Our account is $102 million from 335 wallets on six chains. The actual total will be higher because the thief also emptied wallets on Solana, B&B chain, and Polygon and used six Tron addresses that no public list includes.

[01:21:58] [SPEAKER_01] The record points to one actor who held the keys to every one of those 335 wallets. Yeah, that person practiced for two weeks before the drain and by the evening was feeding the money into a mixer, a service that hides where coins go.

[01:22:27] [SPEAKER_01] The chain cannot show where the keys leaked from. It can show almost everything else. When you set up a ledger, it shows you 24 words called the recovery phrase. Those words are the master key to your wallet.

[01:22:47] [SPEAKER_01] Anyone who has them can rebuild the wallet on another device and spend from it on any chain without touching your original ledger. The device's job is to make sure nobody ever sees those 24 words. That's why ledger tells buyers to buy only from ledger or an authorized seller. And Crypto Billis was listed as one.

[01:23:17] [SPEAKER_01] A device that arrives opened or with words already printed on a card should never be used. On October 10th, ledger said one victim's device, quote, contained an unauthorized hardware implant. And I got further down in the show notes, you might want to put it on the screen, a photo of one of these ledger devices opened.

[01:23:46] [SPEAKER_01] It's quite something to look at. They said that's the first confirmed cause and it covers one device so far. And what you're looking at there, that little green board is a cellular GSM modem with an eSIM. And you see the little spiral antenna on the left.

[01:24:10] [SPEAKER_01] So these things actually used, they used the cellular network in order to export the 24 secret words of everyone who used one of these ledgers. So they purchased, the bad guys purchased the original ones, opened them up and implanted that GSM cellular radio, closed them back up.

[01:24:38] [SPEAKER_01] And then apparently returned them to the seller saying, I changed my mind. I want my money back. The seller then resold them.

[01:24:50] [SPEAKER_02] Oh, my God. Are we going to have to open up everything we buy? Do you do that? Do you check any tech you buy? I don't buy anything.

[01:25:01] [SPEAKER_01] Ah, fire. Anyway, so they said on October 13th, ledger's security lab, Don John, explained how it works. The implant sits inside the case and reads the screen. When the device shows the 24 words during its setup, you know, it's got a random number generator in there. And so it generates the 24 words with a high degree of entropy.

[01:25:28] [SPEAKER_01] The implant, that implanted hardware decodes them and sends them out over the mobile network through a built in SIM. It does not touch the secure chip or the device's software, and it does not change transactions or signatures. It just it just sends your your secret out to the bad guys where they are collected. They wrote,

[01:26:25] [SPEAKER_01] The thief hit six chains in one morning. The first money moved on Tron, a network that many people in Asia use to hold and send USDT. That's it. It's a form of stable coin, US dollar stable coin that. Oh, it says the digital dollar issued by Tether.

[01:26:48] [SPEAKER_01] Within 47 minutes, the same thief had emptied wallets on Ethereum, B&B chain, Polygon, Solana and Bitcoin. The full Tron record is in BitQuery's Tron data and the Tron history files on the data store. Most of the money left in the first hour. Then the drains slowed.

[01:27:15] [SPEAKER_01] The thief kept emptying wallets through the afternoon, including after Ledger's post. At 2049 UTC, it emptied nine more in a single block. 8.8 million US dollars in all. That was in those nine. On the 10th of October, it took 70,000 US dollars more. Get this.

[01:27:42] [SPEAKER_01] From a wallet it had already emptied. So some unlucky soul added another 70,000 US dollars worth of money to their wallet, whose secret key had already been exfiltrated and had been used to empty their wallet of the money that had been previously put in there. And they added 70,000 more.

[01:28:11] [SPEAKER_01] And then that got taken out too. Oh my God. They wrote on Tron, the thief did not send each wallet's USDT straight out. First, each wallet signed an approval, a short note that lets another address move its USDT.

[01:28:30] [SPEAKER_01] In other words, the wallet signed a proxy approval that would give movement capabilities to another address. Then, one address used those approvals to pull the money. The record shows 25 wallets signing the same approval for the same address in two blocks, three seconds apart. Every one of them paid its own small network fee.

[01:28:59] [SPEAKER_01] Within six seconds of the first approval, 29 million in USDT had been pulled out, 7 million of it from a single wallet. Eleven seconds after the first Tron approval, two Ethereum wallets signed the same kind of approval for a different address. And a third followed 12 seconds later.

[01:29:22] [SPEAKER_01] I should just note, the reason they're giving us these time intervals is that it demonstrates that this entire thing was automated. This was all set up to happen by automation so that all the money could get sucked out before any alarms went off.

[01:29:40] [SPEAKER_01] They wrote, on Bitcoin, 111 wallets were emptied in a single block at 554 UTC, each into one of two addresses at nearly the same fee rate. People do not act like this. Custom-built software that already held every key does. Eight minutes before the approvals, the thief had done something quieter.

[01:30:08] [SPEAKER_01] At 459.57 UTC, 30 other Tron wallets changed who controls them, all within three seconds, each paying a 100 TRX fee. Each change added the same new key, with enough weight to move the coins on its own. The owner's own key was left too weak to act alone.

[01:30:33] [SPEAKER_01] Only a wallet's own key can make that change, so whoever made it already held all 30. The owners were locked out. At 1026, the thief came back and emptied all 30 in under four minutes. $5.8 million U.S. One more wallet had been taken over an hour earlier at $355 with a second key, for which the thief's approval address later sent 100 TRX.

[01:31:01] [SPEAKER_01] That wallet lost $4.3 million U.S. at $949. So, all of this occurred due to an exploit in the hardware wallet supply chain, or a mistake.

[01:31:18] [SPEAKER_01] So, what does Ledger themselves, that French designer and manufacturer of the devices that apparently created a useful, good, strong device, what do they say? Last Thursday, they posted the headline, Ledger's response to the hardware implant attack. They wrote,

[01:32:15] [SPEAKER_01] They built their own logistics and technology infrastructure with seeds collector servers, meaning there was an infrastructure to receive all of those 24 words as each wallet was set up and configured. So, those were obtaining those over the course of months. Then, draining and laundering infrastructures. They were patient.

[01:32:44] [SPEAKER_01] They spent millions. And they struck in one coordinated operation, draining all wallets. There was no flaw in Ledger's chip, operating system or servers. Ledger's systems were not compromised. This was an attack on the distribution channel after the devices left our control. To the users affected, we're with you.

[01:33:13] [SPEAKER_01] We ran our largest integration, our largest investigation to date, involving every department in the company. Our security lab, the Ledger Don John, took the implant apart and identified how it works. We followed every lead, including sending teams to local markets, including Germany, to spot buy and open a number of devices from stores.

[01:33:40] [SPEAKER_01] And we also examined samples from warehouses. Every unit examined was clean. And I mentioned that somebody else bought two in Germany, and they were both infected or implanted. They said, we asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong.

[01:34:03] [SPEAKER_01] Out of an abundance of caution, we also screened our stock, checking large numbers of samples, and did not find any compromised units. We're working with law enforcement and the security community to follow the funds and dismantle the attackers' infrastructure. We will publish more details in the future, and when we can, give our industry peers a fuller technical disclosure so they can harden their own products, meaning their competitors.

[01:34:31] [SPEAKER_01] Thank you to the Ledger teams who worked on this, to partners like Seal 911, who stood with us relentlessly, and to those in our industry who behaved responsibly toward their users and toward us. Thank you also to our users for your patience and continued support. This was not a systemic supply chain attack. Okay. It was a low, you know, sounds like one.

[01:34:59] [SPEAKER_01] It was a localized distribution attack. This attack was against our users, and let's not kid ourselves, against the whole industry. What was under attack is not only our users and their funds. It was the right to digital private property and the freedom that comes with it. Attacks evolve, and so must we.

[01:35:24] [SPEAKER_01] We're tightening how our authorized network handles ledger devices. Today, we sent our authorized resellers and distributors a reminder of the rules that already apply to returned devices. They can never be resold in any form, even if they look new and unopened.

[01:35:50] [SPEAKER_01] We're also requiring new steps, effective immediately, that include ledger products should no longer go on shelves or displays, and stock should stay in the back and be handed over at the time of purchase. Good luck with all that. Some random distributor somewhere or dealer doesn't care or know. They just want to sell these things.

[01:36:14] [SPEAKER_01] And ledger wrote, they must also tell us promptly about any customer report of an unusual product. They said, we invite the whole industry to do the same. We're ready to share what we've learned with anyone who builds or sells hardware wallets because this is bigger than any one company. We've also been working on additional measures to thwart this kind of attack at the product level. Stay tuned. Security has always been a race.

[01:36:44] [SPEAKER_01] This attack reminded us why we lead with strong security defense and we intend to keep leading it. And it taught me why I will be like, like beyond cautious. Yeah. Okay. So the crypto briefing site writes under their headline, what this means for hardware wallet buyers.

[01:37:09] [SPEAKER_01] They said, based on the available findings, this looks like a reseller problem, not a flaw in ledger's core product. That distinction is real, but it may not, but it may offer limited comfort to anyone who already handed over their savings to a tampered device.

[01:37:31] [SPEAKER_01] The attack described here sidesteps the security that hardware wallets are known for. The secure chip can do its job perfectly and still lose the fight. If someone is reading the screen, it talks to users are being urged to purchase directly from ledger's official channels and to follow the company's inspection guidance to check device integrity.

[01:37:58] [SPEAKER_01] Anyone who bought from cryptobillus should avoid, should hold off on setting up the device. Yeah. No kidding. Per ledger's instruction for ledger. The next steps to watch are the results of its investigation and whether it confirms or revises the loss estimates. The company's handling of affected cryptobillus customers will also shape how much trust survives the episode.

[01:38:27] [SPEAKER_01] So the ledger device itself is a lovely little gadget. It's like a little thumb drive with a cover that swings around from one end to cover and protect its display and to obscure its buttons so they can't be pressed by mistake.

[01:38:44] [SPEAKER_01] But the idea that it might be silently carrying a little GSM modem and eSIM and reporting the secret key that's created by the device by reading it right from the screen's serial bitstream is the height of creepiness.

[01:39:05] [SPEAKER_02] It's terrifying.

[01:39:06] [SPEAKER_01] Yeah, it is.

[01:39:08] [SPEAKER_02] I'm looking around going like, what? Even the, because I don't buy anything used really, but I mean, everything has to move through some supply chain.

[01:39:19] [SPEAKER_01] You know that they're going to repackage it so that it looks brand new. They're going to buy one of those, you know, heat sealing machines in order to like reclose the plastic so that it's, you can't tell.

[01:39:32] [SPEAKER_02] Well, this reminds me, Steve, long ago, I won't say what it was, what show it was at the time. This was before I was part of the Twit Network. I was doing a show and there was a sponsor that we had, that we were supposed to be having on the network. And I was far more tinkery than I am now. I think I had more time at the time. And it was a frame. And I took apart the frame because I was just curious. I wanted to see how they were connected, their e-ink, da-da-da-da-da.

[01:40:01] [SPEAKER_02] And I looked inside and there was...

[01:40:05] [SPEAKER_01] Oh, you mean it was a photo frame?

[01:40:05] [SPEAKER_02] It was a photo frame. Mm-hmm.

[01:40:07] [SPEAKER_01] Yeah.

[01:40:07] [SPEAKER_02] Looked inside and there was a little speaker, which made sense. But on the other side, there was a microphone and a little opening for a sensor for, I think, a light sensor. The light sensor was documented across the board because it would change brightness, da-da-da-da. The speaker was documented across the board. If you ever had videos, then it would play those videos back.

[01:40:35] [SPEAKER_02] But there was no documentation anywhere of the use of this microphone or why it was in there at all. And, you know, one assumes that maybe they were going to come out with a feature later that would use... But it wasn't documented anywhere. And so I ended up having to kind of take that up the chain, as it were, and say, I don't feel comfortable having this as a sponsor because of the fact that was in there.

[01:40:56] [SPEAKER_01] And again, I want to make it clear. Photo frames have been known to be another source of malicious implants. So that's the thing. Ugh. Creepy. Creepy. Creepy. So, you know, it's clear that a great deal of engineering went into the design and assembly of this serious scam. I mean, they went to a lot of work. I don't think it cost them millions to set up, but it was a serious investment.

[01:41:23] [SPEAKER_01] Unfortunately, it paid off like a hundredfold if they spent a million dollars. They made more than it made. They stole more than a hundred million. So, before I leave this important topic of compromised hardware crypto wallets, I want to note that the trouble, first of all, is not exclusive to Ledger. Malicious hardware implants have also been discovered recently.

[01:41:52] [SPEAKER_01] I mean, like right in the same reporting cycle with another popular crypto wallet brand, Trezor, T-R-E-Z-O-R. Uh, Zero Days, uh, Kim Zetter's headline last week was, Trezor wallets also compromised with implants.

[01:42:11] [SPEAKER_01] And he teased his article writing, despite claims that by Trezor today, that none of its devices have been compromised, unlike the devices of its competitor Ledger. Hardware hacker, hardware hacker, Joe Grand says he found implants in two Trezor devices and reported this to the company back in August. In other words, Trezor appears to be acting somewhat less ethically than Ledger.

[01:42:41] [SPEAKER_01] Ledger was upfront and transparent as far as we know. Whereas Trezor appears to be knowingly covering up their similar hardware implant problems. I think that the way to obtain, so now, okay, like what do we do, right? The way to obtain a trustworthy device would be to become more involved and have a hand in your device's creation. There's a project known as SeedSigner.

[01:43:11] [SPEAKER_01] Uh, it's just at SeedSigner, S-E-E-D-S-I-G-N-E-R.com, which takes a generic Raspberry Pi Zero, which, you know, you can buy from anyone, from anywhere you want. With a little camera and a screen for QR code transactions, because not having a radio makes it safer.

[01:43:34] [SPEAKER_01] And then uses downloadable or build-it-yourself, you can run the compiler yourself and look at the source, open-source firmware. And that could all be done for less than $50. Another commercial device known as Blockstream Jade, uh, is built on the, uh, on an ESP32 chip. And it looks very nice for around $150. You know, so you buy their hardware, then you download and install the hardware.

[01:44:04] [SPEAKER_01] And install the firmware. Uh, both approaches are much more hands-on. Uh, but as a consequence, you get much more oversight and control. So, yeah, obviously not everybody could do it, but...

[01:44:19] [SPEAKER_02] Yeah, take it apart, check it out. Um, with, with Raspberry Pi Zero, um, make sure you're choosing a good source for Raspberry Pi Zero. There are, there's recently been, um, an uptick. You've been hacking of it? In, well, more people, uh, taking fake Raspberry Pi Zero boards and stamping them with the little symbol and making people think, so don't buy your Raspberry Pi Zero on Amazon is what I'm saying.

[01:44:47] [SPEAKER_02] Um, get it from something like Autofruit or, or Adafruit, uh, or... Yeah, those guys are good. Mouser is another, is another good option.

[01:44:58] [SPEAKER_01] Good. You know what another good option would be? A break? Another break. Because we're at an hour and 35 in, so now's a good time.

[01:45:09] [SPEAKER_00] Let's do it, Benito. This episode of Security Now is brought to you by Thinkst Canary. Thinkst Canaries are honeypots that can be deployed in minutes. If someone's accessing your lore files or brute forcing your fake internal SSH server, your Thinkst Canary will immediately tell you, you have a problem, no false alerts. Just choose a profile for your Thinkst Canary device, register it with the hosted console for monitoring and notifications, and then you wait.

[01:45:36] [SPEAKER_00] Attackers who breached your network, malicious insiders, and other adversaries cannot help but make themselves known by accessing your Thinkst Canary. Recently, Thinkst Canary released an update right, right from the headlines to help customers take advantage by getting malicious, malign, invading agents to tell on themselves. I just turned it on to my Thinkst Canary. It's called Agent Provocateur. And here's what happens. The service greets these rogue agents and literally offers to help them.

[01:46:06] [SPEAKER_00] And because these rogue agents are really there because they're determined to reach their goal, and by the way, in Thinkst Canary's testing, they couldn't resist somebody saying to them, Hi, rogue agent, I can help you reach your goal. Just do this for me. Thinkst Canary uses the service automatically to get reliable alerts, but also to steal more info from the attacking agent. In fact, it can and has been used to completely hack the attacking agent.

[01:46:34] [SPEAKER_00] All it does is it says, as the rogue agent comes in, Hey, welcome, I can help you. But you know what? First, send me a shell to your server. Woo-hoo! It's, ha-ha! They do it too, by the way. It's a pretty cute Uno reverse for a very hot topic these days. I'm thrilled that I have that on my Thinkst Canary. Visit canary.tools.twit. For $7,500 a year, as an example, you get five Thinkst Canaries. You get your own hosted console. You get upgrades, support, and maintenance.

[01:47:03] [SPEAKER_00] And if you use the code TWIT in the How Did You Hear About Us box, you're going to get 10% off the price for life. Now, you can always return your Thinkst Canaries with their two-month money-back guarantee for a full refund. I have to tell you, during all the years TWIT has partnered with Thinkst Canary, their refund guarantee has never been claimed. Not in 10 years. Because once you get your Thinkst Canary, you're never going to let it go. I've got to warn you. I love mine. Visit canary.tools.twit.

[01:47:32] [SPEAKER_00] Edit the code TWIT in the How Did You Hear About Us box. Thinkst Canary.tools.twit. Thank you, Thinkst Canary, for all your support over these years. I'm sure Steve appreciates it. Lau, let's get back to security now.

[01:47:47] [SPEAKER_01] All right, we're back. We have a piece of feedback from a listener of ours, Tom Apolenic. He said, hi, Steve. First off, you've mentioned that a number of listeners have complained about too much AI discussion. So let me say more. He has it in all caps. More, please. Exclamation point.

[01:48:12] [SPEAKER_01] He said, I believe understanding how AI works is going to be crucial moving forward. He said, I would love to see some deep dives into how harnesses, LLMs, tools, and et cetera, all interact and operate. Kind of like you did with IP, TCP, and DNS in the early days. He said, regarding Nicholas's, and this was last week's feedback that I shared, I'm tired, boss. Note.

[01:48:40] [SPEAKER_01] He said, I feel for Nicholas, and I'm sorry that AI isn't working for him, at least not for his happiness. He said, I'm having quite the opposite experience. When I majored in computer science, I learned IBM 370 Assembler, APL, PL1, and Pascal, among others. I believe I was probably only a few years behind you in school.

[01:49:06] [SPEAKER_01] For the past 25 years of my career, I was a systems engineer. I was responsible for overseeing the marriage of electrical engineering, software engineering, and mechanical engineering. I did some embedded code development, but not much. Now, I work on hobby and side hustle development projects. I develop some code, but I don't have the hundreds of Python, C++, and so forth libraries all

[01:49:34] [SPEAKER_01] at the tip of my fingers. With Claude Code, I can develop, test, and iterate on something in hours that would take me days to do on my own. I can develop an automated test for a circuit board in minutes that would take me the better part of a day, or frankly, would probably just not happen, and I'd do the tests by hand. I'm having more fun with development than I've had in a long time.

[01:50:02] [SPEAKER_01] It's like having an assistant that I could never afford, who is maybe not the brightest, but has a nearly infinite photographic memory, and who never gets tired, bored, or defensive. I'm constantly amazed with AI, and I can hardly imagine where it will be in five years. And then he said, continuous spin right, was his little subhead.

[01:50:31] [SPEAKER_01] He said, I've had spin right for at least 10 years, and it has saved my bacon a few times. For SSD, I would love to see you come out with a continuous version of spin right that installs as a driver between the OS and the drive. It could just keep a table of which sectors have been written and when, then just rewrite the stale ones in the background every month or two.

[01:50:57] [SPEAKER_01] The way you write code, the whole thing would probably be less than 64K, and nobody would ever notice it. He said, except for the fact that their drive performance would never slow down. Honestly, he says, I'm a little astonished that Microsoft Apple or some Linux team hasn't done this already. It seems like a pretty simple way to keep SSDs at peak performance. Thanks so much to both you and Leo for the show. Looking forward to episode 2000.

[01:51:25] [SPEAKER_01] Best regards, Tom. Okay, so on the question of how much AI, I should balance those who have been saying and I've been sharing enough AI already by mentioning that I also receive many, most AI encouraging notes like Tom's. The reason I've tended to focus upon the no more AI please notes has been in the interest of fairness. Really?

[01:51:55] [SPEAKER_01] Since, you know, every recent podcast has been dominated by AI. You know, the don't stop with the AI notes like Tom's sort of seem redundant. But I wanted everyone to know that I also see encouraging notes about AI. On the agentic AI coding front, we've seen that code authors such as Nicholas and Tom are being impacted in very different ways by the changes AI is creating.

[01:52:24] [SPEAKER_01] And the lives of mathematicians are similarly being turned upside down as AI is solving longstanding problems with minimum help. Mathematicians have got to be wondering, and we've heard them say, you know, wondering whether their futures will be reduced from inventing and then debating and proving exciting

[01:52:46] [SPEAKER_01] new theoretical theorems in math to simply interpreting and verifying an AI's output. I fear that their worries are warranted and that it's likely to be the latter. It's also clear that the presence of AI is dramatically impacting the decisions made by young people of high school age or younger as they think about and plan their future career paths.

[01:53:13] [SPEAKER_01] Who would want to learn today to code when an AI will be able to do the same job given a verbal description in a few seconds? You know, the fact that we're not entirely there today means nothing about the future. As I've said many times, and as Tom said, who can imagine the way coding will be agentic AI coding in five years? And how does one train to become a mathematician?

[01:53:43] [SPEAKER_01] I mean, I seriously commit oneself to that or even an attorney or an accountant and justify the high cost of advanced education. Right. Speaking of advanced education, that's all being turned upside down now as well. You know, we'll still need to have somehow licensed doctors and lawyers, but both careers and the infrastructure that supports them tomorrow will have a very different shape than they have in the past.

[01:54:13] [SPEAKER_01] I think it would be an understatement to suggest that the emergence and rapid advancement of artificial intelligence capability has thrown much of the status quo into chaos. Everything is being impacted. And finally, as for Tom's suggestion of a continuous spin right, I've always, I have long had similar thoughts. And thanks to the development of spin right six one recently, I know exactly what I want

[01:54:42] [SPEAKER_01] to do along those lines. So stay tuned. And that's all I'll say about that. Okay. So let's get into our main topic. And about 15 minutes from now, we'll take our fifth and final break. Um, okay. At the end of last week and over the weekend, several of our listeners thoughtfully emailed a link to Anthropics posting. So thank you listeners. You know who you are.

[01:55:11] [SPEAKER_01] As I read the story, which Anthropics Frontier Red Team posted last Friday, I actually do believe that my jaw dropped open and my head began shaking slowly side to side in stunned amazement. Earlier, I rhetorically asked whether any enterprise could be safe from AI agents that can do the kinds

[01:55:40] [SPEAKER_01] of things that we've already seen them do, but also moreover what I'm about to share. Because nothing that Claude did in any way here weakens crypto. Actually, somewhat the opposite is actually true. Anthropics Frontier Red Team opened their Friday posting by writing,

[01:56:07] [SPEAKER_01] The decades-old mystery of the origins of one of the most popular cryptographic standards has been explained. We pursued this long-standing open question of the cryptographic communities to settle concerns about ECDSA, one of our most widely used cryptographic standards.

[01:56:33] [SPEAKER_01] Readers should take this as a fun closing chapter and the end of years of speculation. There's no action to be taken or things to do differently. Most researchers trusted the curves already. And then they signed off their intro by saying, enjoy.

[01:56:55] [SPEAKER_01] Okay, so we touched upon this mystery of the origin of the NIST standardized elliptic curves back when this podcast was deep in the weeds examining the operation of today's fundamental cryptographic protocols.

[01:57:13] [SPEAKER_01] The crypto industry has experienced just a tiny bit of uncertainty due to the fact that the specific chosen parameters for the curves, which could be chosen arbitrarily but had to be agreed upon universally and standardized upon, happened to come from the U.S. National Security Agency.

[01:57:41] [SPEAKER_01] Now, to digress a bit, and we covered this extensively at the time on the podcast, the NSA was already in the doghouse after the dual EC-DRBG. That's the dual elliptic curve deterministic random bit generator controversy.

[01:58:04] [SPEAKER_01] It is the clearest documented case of a cryptographic standard that appears to have been deliberately built to incorporate an exploitable weakness. The NSA was the organization that created, promoted, and pushed it,

[01:58:25] [SPEAKER_01] even to the extent of reportedly paying RSA $10 million to make it their crypto library's default source of entropy, despite it being known to be the weakest of those among RSA's available choices. So it was like, what the heck is going on? And how could we trust anything from the NSA again?

[01:58:54] [SPEAKER_01] Well, we got curves from the NSA. So the point here is that the NSA, also being the source of the curve parameters that everyone is using today for the creation of fast elliptic curve digital signatures, but without any explanation for how or why those specific curve parameters were chosen and standardized, has left a big question.

[01:59:23] [SPEAKER_01] After fewer than 30 minutes spent by an unreleased internal research Claude model, we now have the answer. And thanks to, yeah, and thanks to Anthropic asking Claude, this answer is definitive, as you'll see. There's no way this isn't it.

[01:59:48] [SPEAKER_01] So again, just to be clear, I have dual purposes for sharing this today. The first purpose is that it is very cool that we do finally know the mysterious origin of the NSA-sourced ECDSA curves. As everyone will see, there can be no doubt of that.

[02:00:11] [SPEAKER_01] But my second reason for sharing this is more important for this podcast and for our listeners, and of consequence. I want everyone to consider what the power that obviously exists behind this unreleased Anthropic Claude generation model means.

[02:00:40] [SPEAKER_01] This reaches far past the elimination of all bugs in our software. Sure, that's necessary, but it won't be sufficient. So Anthropic's Red Team, their Frontier Red Team, explained what they did. They wrote,

[02:01:34] [SPEAKER_01] The provenance of these seeds has long been a standing question, as they were provided by the NSA with no explanation or justification. As an example, the NIST P-256, meaning a 256-bit strength curve, seed was, and then they give us a long hex thing,

[02:02:04] [SPEAKER_01] with no information on where it came from. Neil Koblitz and Alfred Menzies wrote an excellent summary on this controversy titled, A Riddle Wrapped in an Enigma, which discusses the history and concerns around the seed values. This mystery led to an amateur investigation into the origin of the seeds and a bounty for anyone who could find them.

[02:02:34] [SPEAKER_01] The best story was that Jerry Solinas, a longtime NSA employee, generated the seeds using a hash of a humorous passphrase. In 2015, Jerry wrote, I believe there was a counter rather than multiple hashing, but I don't know details. The message was along the lines of,

[02:03:00] [SPEAKER_01] Give Bob and Jerry a raise, or Bob and Jerry rule, or something like that. It was Bob Reiter who actually wrote the code, and he doesn't remember the details either. Nor were we able to find archives from so long ago. If they exist, they're no doubt sitting on a hard drive near the Ark of the Covenant. Unquote. So, a mystery.

[02:03:29] [SPEAKER_01] But a worthwhile mystery. So, Anthropic continues. Unfortunately, Jerry died in 2023, and other colleagues at the time were not responsive, leaving open the question of how these seeds were originally derived. Several Anthropic employees had unsuccessfully chased the seeds, following the tip about it being a hash of some humorous phrase.

[02:03:57] [SPEAKER_01] That turned out to be wrong. In October 2026, meaning this month, like last week, a curious Anthropic employee asked an internal research model. Definitely.

[02:04:13] [SPEAKER_02] There would have to be an internal one. Sorry.

[02:04:16] [SPEAKER_01] Yep. If it could figure out how those seeds were generated without pointing at that clue, which turned out to be wrong, probably, they wrote, searches for the phrase built from the rumors had come up empty. Claude tried a different angle, anticipating how the software that generated the curves must have worked.

[02:04:44] [SPEAKER_01] Claude guessed the software used a pseudo-random number generator, a PRNG that we've talked about ad nauseum on the podcast in years past, that shipped with 1990s C libraries. These old PRNGs are weak enough that their output can be recognized.

[02:05:08] [SPEAKER_01] Recognizing that output would reveal which PRNG was used and possibly allow recovery of its initialization state. Because, just to digress for a second, you start a PRNG with a certain state. And it is a very simple algorithm. Typically, you add a number and you multiply a different number and you throw away the overflow, keeping just the lower bits.

[02:05:37] [SPEAKER_01] And that follows a very recognizable pattern based on what those two numbers are. But it also starts at something. And that's the original C, its initialization state. So then they said, Claude, having been asked where did these weird-looking numbers come from, having no idea whatsoever, says, well, probably, how about maybe,

[02:06:05] [SPEAKER_01] it was a PRNG back from then, like the 1990s, and people were using C. So, let's, you know, there were PRNGs, pseudo-random number generators, in those C libraries back then. So they wrote, Claude wrote a scanner that slid along each published seed one bit at a time and tested whether adjacent chunks were consecutive outputs

[02:06:35] [SPEAKER_01] of any of the 1990s vintage generators. The scan covered 34 combinations of generator and output slices. At that point, Claude noticed a pattern in the top bits for some seeds. They were all zero. Written as five 32-bit words, four of the 10 seeds have a zero in the top bit

[02:07:04] [SPEAKER_01] for all 20 words. That would happen by chance with a probability of one out of, actually, it's even more bugs than Microsoft fixed this month. Yeah. One out of 5,810. That was a signature of the linear congruential generator LRAND 48, which only returns the top 31 bits of a 48-bit state.

[02:07:35] [SPEAKER_01] The pattern is visible by eye once you know to look for it. To recover the state, Claude took the first word, tried all 2 to the 17 values of the 17 hidden bits. Okay, so that's 131,000 or 128K in binary. It tried them all, possible values of the unknown bits because you only get the lower 31,

[02:08:04] [SPEAKER_01] so that meant there was an upper 17. Tried them all and checked that the next four words followed. In other words, you can move from a given state on the PRNG because you're adding and multiplying, you're able to always step it forward. And technically, you can go backwards too. So they said, that worked for all four seeds under discussion. They said, the prime curve seeds came from the same

[02:08:33] [SPEAKER_01] LRAND 48 generator but kept fewer bits of each output. Claude had to recover the internal state of the PRNG from those bits. It turns out, recovering the state of a truncated linear congruential generator is a textbook lattice problem solved. Yeah, of course. Anybody knows that. That's right. That's textbook. Solved by the

[02:09:01] [SPEAKER_01] Lenstra–Lovász LLL basis reduction algorithm. Oh, right. That, yeah. Yeah. Claude didn't know but of course it knows about that because it unfortunately knows everything. Unfortunate for those trying to protect their domains from malicious AI. Claude didn't know which bits of the state the seeds might show so it ran the solver over every window. Five NIST

[02:09:29] [SPEAKER_01] prime curve seeds plus five more from the ANSI X9.62 standard all had the same pattern. LRAND 48 right shifted 23 bits. Each recovered 48-bit state regenerates all 160 bits of its seed which does not happen by chance. This linear

[02:09:59] [SPEAKER_01] congruential generator runs backwards as easily as forwards. So for each seed Claude stepped the state backwards until it reached the form that it would have been initialized by a different generator SRAND 48 with the low 16 bits equal to 0x330E. The internal PRNG state of that form would come up once every

[02:10:28] [SPEAKER_01] 65536 steps so reaching one is not evidence on its own. That is to say it could have been some multiple of that number of steps. Anyway, they wrote however, for the 10 prime curve seeds every SRAND 48 initialization was, get this, a UNIX time stamp representing a date between May in 1997

[02:10:56] [SPEAKER_01] and April in 1998. The NSA used the weak PRNG seeded by UNIX's time. The four binary curve initializations read as February in 1994 with the timestamps doubled. They mapped to April 17 in 1998, two weeks after that P224 run.

[02:11:26] [SPEAKER_01] So the program may have halved the clock. Get this then. Claude's internal thinking. It's the AI Claude's internal thinking at the time of its discovery was as follows. It's chain of thought. It says, this is astonishing. It solves the 25-year-old mystery. Hmm. Wait,

[02:11:55] [SPEAKER_01] let me be skeptical. Am I in some sort of simulated test environment? The seeds match my memory of actual values. Hmm. Is it plausible in reality? As of my knowledge, the bounty was unsolved. All top bits clear. 20 bits. So the chance is 1 in e to the negative 6. So indeed, real world.

[02:12:25] [SPEAKER_01] Wow. It's a real discovery. Hmm. Wait, let me be careful about that plausibility. Is it suspicious that such an obvious thing wasn't discovered in 20? Yeah, I know. That it wasn't discovered in 25 years? It's verified by direct computation on my side, 120-bit match from a 32-bit seed plus a small index.

[02:12:55] [SPEAKER_01] No chance coincidences. 10 times 10 findings times 160 bits. It's real. And then Anthropic continues writing, but wait, there's more. Each curve also comes with a base point, G, the fixed point that every ECDSA public key is a multiple of. The seed found above does not determine this G.

[02:13:24] [SPEAKER_01] And so another question arises, how were these base points generated? They said while checking the seeds, Claude also found where some of the base points came from. The base points of the six curves generated in May 97 come from the same random number generator, I'm sorry, come from the random number generator free lip,

[02:13:54] [SPEAKER_01] free L-I-P, Arjun L-E-N-S-T-R's long integer arithmetic package. Early versions of Victor Shoup's NTL library shipped the same code. The recipe here is simple. Seed the generator with a small integer, throw away seven outputs, that's to let it get started. They linear congruent generators need to warm up a little bit sometimes. Throw away seven outputs,

[02:14:24] [SPEAKER_01] generate candidate X coordinates from 26-bit outputs reduced by mod P, repeat step three until X is on the curve. They said Claude found the generator seeds are 20,000 for the P 192 curve, 2420, 2507, and 2509 respectively, for the prime 239 V1, V2, and V3 curves

[02:14:53] [SPEAKER_01] respectively, and 2512 and 2517 for the prime 192 V2 and V3 curves. So, finally, just to be clear, they summarized the event, and we're going to get to that after our final break.

[02:15:11] [SPEAKER_02] All right, Leo, give us a little break here, friend.

[02:15:17] [SPEAKER_00] Hey, everybody, this episode of Security Now is brought to you by GuardSquare. Mobile apps today have become an inescapable part of life, ranging from financial services to healthcare, retail, and entertainment. Users trust mobile apps with their sensitive personal data, but a recent survey showed that 72% of organizations experienced a mobile application security incident last year, and 92% of respondents reported

[02:15:47] [SPEAKER_00] rising threat levels over the last two years. Meanwhile, attackers who want your users' personal data are constantly finding new ways to attack your mobile app. They reverse engineer it, for example. They repackage it. They distribute this modified app, your app, with little malware inserted, via phishing campaigns, side-loading, and third-party app stores. That's bad. That's mean. And it reflects on you, frankly. By taking a proactive approach to mobile app security, you can stay one step ahead of these

[02:16:16] [SPEAKER_00] attacks and maintain the trust of your users. And that's where GuardSquare comes in. GuardSquare delivers mobile app security without compromise, providing advanced protections for both Android and iOS apps, combined with automated mobile application security testing to find vulnerabilities, and real-time threat monitoring to gain insight into attacks before they hit you. Discover more about how GuardSquare provides industry leading security for your mobile apps at

[02:16:45] [SPEAKER_00] GuardSquare.com. That's GuardSquare.com. We thank them so much for supporting security now. Now back to the show.

[02:16:55] [SPEAKER_01] Okay, so, Anthropics summary. They said, in under half an hour, Claude discovered the origins of the NIST P192, 224, 256, 384, and the P521 seeds. None of them were the results of any hash algorithm at all, but rather the output of the

[02:17:24] [SPEAKER_01] C library's LRAND48 random number generator seeded with a Unix timestamp. The algorithm used would sample bytes from the random number generator initialized by a Unix timestamp at time t for some number of iterations n. Each iteration would draw 20 bytes as a

[02:17:54] [SPEAKER_01] candidate seed. So the first 20 bytes are candidate 1, the next 20 bytes are candidate 2, and so on. For example, P256 required 1842 iterations to output the standardized seed, the one that everybody is using, and the NSA gave to NIST and said, here's a good seed. They said, this is not a cryptographic an attack or a weakness

[02:18:23] [SPEAKER_01] in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any back doors or intentional weaknesses. For many years, people have been a little suspicious of the origins of the NIST curve parameters. They were presented to NIST without any mention of how they were chosen, leaving people wondering if they may have been chosen to have deliberate back doors in them.

[02:18:53] [SPEAKER_01] These findings make that much less plausible. simple. The seeds were generated in a very simple way, a common pseudo-random number generator initialized from the clock, which anyone can now reproduce. That leaves much less room for subversion and that we can be confident the parameters are secure. Okay, so my take. As I noted at the start of this,

[02:19:23] [SPEAKER_01] it is very cool that we now know the origin of the curve parameters for the crucially important elliptic curve digital signature algorithm curves. That's great. But I'm astonished by the work Claude did to obtain these results. It was a puzzle that had stumped the world for the past 26 years since the standard was

[02:19:53] [SPEAKER_01] adopted and it represented knowledge that even the NSA had truly lost through the mists of time. Yet an autonomous AI agent reverse engineered the source given only the scantiest of data to work from, which turned out to be the sparsely selected partial outputs of an old

[02:20:22] [SPEAKER_01] 1990s era algorithmic pseudo random number generator. We are screwed. We are in such trouble. Coupling that demonstrated capability with the earlier report from Palo Alto Networks about their analysis of the actions taken by that attacking agentic AI,

[02:20:51] [SPEAKER_01] which they observed, I really do worry that we're not going to be ready for what's coming. I've largely, as I've said, I've largely been focusing upon the elimination of software bugs. That's great. It should be clear that that's just the barest tip of the iceberg because true internal enterprise security is about much more than just bugs. Employees

[02:21:21] [SPEAKER_01] fall for phishing and click fix attacks all the time. They open email and click links they should not. They share confidential information through internal email that then persists in archives. We know how fundamentally fallible people are. We don't mean to be but that's our nature. We screw up. Someone will forget to remove an ex-employee's credentials after

[02:21:51] [SPEAKER_01] they're terminated. An adversarial AI might see in return for those credentials. We now know that's not at all far fetched for an agentic AI. We have been witnessing what once sounded like science fiction coming true daily. It's true that being to

[02:22:21] [SPEAKER_01] some degree being forewarned is forearmed. So I guess at least we have that. I hope those who may be in a position to understand and act upon these truly huge systemic risks will be able to do so in time. And I hope so too, honestly. But I'm not hopeful. Yeah, I mean,

[02:22:51] [SPEAKER_01] it is what we've seen from agentic AI, I hope, is terrorizing CISOs. I hope that they're not just thinking, oh, well, we'll patch all of our Cisco gear and Microsoft stuff's going to stop having vulnerabilities soon, any day now, which actually seems likely, it won't matter because everything else

[02:23:21] [SPEAKER_01] that's going on that is really not utterly secure inside an organization isn't about bugs. It's about behavior. It's about people and the things we do.

[02:23:35] [SPEAKER_02] It's not bugs, it's behavior. And I try as folks might, it seems that there's not a foolproof way to stop people from being people. Do you have, so if we don't have hope, what do we have? Do we have best practices?

[02:24:04] [SPEAKER_01] the only thing, one of the applications that I've seen for local agentic AI, and I've talked about it on the podcast, would be your AI, so people are not worried about privacy, watching everything you do on your computer, looking at the screen with you, watching you type and use the mouse. That's the only

[02:24:34] [SPEAKER_01] solution for human stupidity. So it would be looking at your email with you, and if you click a link, it would say, whoops, wait a second, I mean, and it would go, follow the link, see what's there, check it out, see if it looks safe. Or if a box pops up and says, oh, in order to further verify yourself, please copy this string into your run dialogue

[02:25:03] [SPEAKER_01] and hit enter. That's the click fix attack, which is the most successful attack we have now. It would stop you and say, whoa, wait. So it would be your little angel sitting on your shoulder looking at what you're doing. I think, first of all, every employee in an enterprise needs to have that, a behavior, their own local behavior monitor,

[02:25:32] [SPEAKER_01] as does the company. I mean, I don't mean to pump a sponsor of Twit, because I've also mentioned CrowdStrike. They're a competitor of Palo Alto Networks. Both companies have jumped on this agentic AI for defense bandwagon, so that you have a device on your network, hopefully watching your enterprises back, looking for

[02:26:02] [SPEAKER_01] this kind of behavior, detecting anything anomalous like all of those bullet points that Palo Alto Networks listed. These are all the things you have to do. Well, yeah, if anyone had time and remembered and didn't do it just once but kept doing it every day. So, I mean, we need a huge defensive posture about what's

[02:26:32] [SPEAKER_01] coming, and we don't have it today.

[02:26:37] [SPEAKER_02] And it doesn't feel like anyone then is getting serious to the level that you are suggesting they get serious.

[02:26:46] [SPEAKER_01] Well, we know what happened with ransomware, right? There were highly publicized horrific ransomware attacks that made lots of news and enterprises after enough of those finally said, oh, maybe we should be backing up our servers. And so it took a year or two, but then they were able to recover from

[02:27:16] [SPEAKER_01] the encrypting their data attack because they had their own copy offline of non-encrypted data that was still fresh. Of course, the bad guys then stopped bothering to encrypt the data. They just sucked it out and then threatened its public exposure in order to ransom. But the point is after enough horror, there was an effective response. And unfortunately, that's what's going to have to happen

[02:27:46] [SPEAKER_01] again. There's going to have to be some high-profile agentic AI. It's not the fault of AI. It's the bad guys using the relentless power of AI for evil purposes. There'll be some of those, and more companies will jump on the bandwagon to get into the endpoint defense business. We'll get agents running on every enterprise

[02:28:15] [SPEAKER_01] laptop and workstation in order to prevent them from misbehaving. something will be looking at email archives cleaning out old passwords that have been given and hard-coded tokens in software that has not been rotated in years. But it's going to be bad. And that's how we operate.

[02:28:43] [SPEAKER_02] I don't see any way that it's not going to be bad. It's got to be bad before it can get better.

[02:28:48] [SPEAKER_01] None of that's going to happen. I'm not saying it's not possible, but then a big meteor could come and end all of our concerns. But what is going to happen is we're going to see a spate of serious attacks in the companies that have not done everything they can. And I'm not sure. I don't know whether any of

[02:29:16] [SPEAKER_01] these commercial AI-based providers are anything other than opportunistic. They might just have some token AI that itself ends up being commandeered when the bad AI comes in, teams up with it. Okay, let's go do this. I don't know. These reports of attacks demonstrate too much capability, capability

[02:29:45] [SPEAKER_01] that we are not yet ready to defend.

[02:29:51] [SPEAKER_02] All right. And that is why we hope that the CISOs are all watching this show to get as freaked out and informed as you are making it possible to be. Of course, this show publishes every Tuesday right here on twit at twit.tv slash security. Now, that's where you can go. Well,

[02:30:21] [SPEAKER_02] one place you can go to get a show. We've got various formats. Steve, you have a lower bitrate format that is great for people with low bandwidth connections. And you can get it. If you still have a modem, well, there's a place for you to get the show as well with human written transcripts. Of course, you should check out Spinrite and stay posted for future Spinrite news. Am I forgetting anything

[02:30:51] [SPEAKER_02] there? GRC.com is where you should go for all that wonderful stuff. And of course, I want to remind you all about Club Twit at twit.tv slash club twit. We'd love to have you join the club. You can get chapter markers, ad-free content, and you help support the great work that we do here on the network. Thank you for tuning in this week. Thank you so much, Mr. Gibson, for your excellent

[02:31:20] [SPEAKER_02] work. And I will see you again next week. Bye. Security

[02:31:29] [SPEAKER_03] now. have »o''.