Fromage-Gate: Old-School Hacking Tactics vs. French Supermarkets

[00:14.4] Hello, I'm Daniel Cuthbert, long-standing member   of the Black Hat Review Board, and welcome to the  very first episode of the RE:BRIEF podcast, where   we invite the cybersecurity industry's leaders  and challengers to discuss what's impacting our   industry and, more importantly, what's next. With  me today is a pioneer in security research and   longtime friend, cited by major outlets like  the New York Times, the Washington Post, BBC,   and Wired, and many others. [00:39.0]  And his two-decade long career makes him the  perfect guest for this inaugural episode. Welcome,   the Grugq. Hey, Daniel. Thanks for having  me. It's good to see you again. Good to see   you again. And and we start this one off with yet  another story I feel that every week happens and   [00:56.6] we were talking before we went live,   fromage gate. French supermarkets getting  nailed and cheese getting really hot and,   you know, the attack forcing temperatures up and  destroying food and and in some cases reportedly   causing fires. [01:12.6]  It's I guess, yet another elevation of what  people are doing when it comes to offensive   operations and capabilities. But when you read  this, what was your immediate reaction? Is it,   Is it surprising these days or is it you know  just a "oh here we go again type thing?"   [01:28.7] Well, it's it's more   disappointing. Assuming we find out, I guarantee  you it's going to be a phishing attack or someone   was using credential stuffing or there was  a VPN that hasn't been patched since 2021.   So even though the the consequences get more and  more extreme as computers get their way deeper and   deeper into society. [01:54.6]  The the level of competence seems to be stuck at  about 1996. It's just like it hasn't changed in   30 years. It's the same old stuff and it's I think  it's disappointing. I'm with you. I think you know   a big chunk of this podcast moving forward and  indeed now is going to be us looking at research   and security research. [02:11.7]  And I think for me a lot of security research  is the precursor to the attacks that eventually   happen. You know, You and I have been involved  in this industry a very long time, and you would   do your research, you'd do your POC. Maybe if you  were totally irresponsible, you would release some   exploit code. You know, we don't do that anymore. [02:27.6]  Right, that's really bad up until but you know,  then then bad things happen. And I guess I I   wonder if we've kind of got to the point where  billions are being spent on security. You know,   you could just walk around any con these  days and look at all the thought leaders.   [02:44.8] The vast majority is is I feel I, I've   not read deep into it. I bet you know this was  a credential stuffing attack. As you said, maybe   they use some kind of agentic hacking, but I guess  like is it is it is it is it getting better?   [03:01.1] Well, so for for quite a   long time I would have said yes, incrementally,  right? So I my my controversial opinion is that   ransomware has improved security. Tremendously.  Prior to ransomware, everyone was basically like,   why would anyone care about me? [03:20.4]  You know, I'm I'm not a defense contractor or I'm  not a bank or whatever. Ransomware proved that as   long as you have data you care about and you have  money, you're an interesting target. And so, that   forced, sort of, and forced is the right word. [03:37.8]  Like it it coerced people into improving security.  So I'd say that overall that's a good thing. like   the the the outcome from that was beneficial. It  did it did more to improve security than all of   the talks we've ever given, right? [03:53.4]  Like we we didn't have the reach to get to the  sorts of people who now have better security   thanks to ransomware. However, like I don't  I don't think that's true anymore. I I don't   think that like even ransomware was limited in  scope, and I think that that's no longer true.   [04:11.6] Because you don't need even the skills   of the very, very basic ransomware people, you  don't need those anymore. Like agentic hacking,   but these frameworks out there do all of the  mistake hunting that you used to have to train   a long time to be able to do. [04:27.7]  Right. So I think that things are getting worse  now, or will be getting worse. The question is,   does it stop? Like is is there a bottom?  Right, I guess do we breach a floor?   [04:42.9] Do we get to a point where it's like   by default it doesn't matter because we're secure  enough that agentic hacking doesn't raise the bar?   I don't know. I mean it it's an interesting one. [04:59.4]  I think the agentic stuff reminds me of the  early days of the script kiddie. The The I   was just dangerous enough to know how to do that  flag to GCC. THC had just dropped this really cool   O day or potentially one day, seven day,  month day, and I kind of know what I'm doing.   [05:21.1] I feel like you know like you said we're back   in 96 where again people are running these agentic  harnesses and I hold my hand up like I help write   Raptor. You know I'm I'm probably part of a  problem. But it's a case of they're still hacking   like it was back then and if if this cheese hack  was indeed default credentials, yeah, really bad.   [05:43.2] But also, we should   know better by now. Like, let's be brutally  honest. If if it wasn't this, it would have   been someone else. Yeah, you feel like, right?  I know one of the things that people are going   to say is like, how come these grocery stores  have their fridges online? And there's a very,   very good reason for that, and it's Neither of us  like getting salmonella when we buy food, right?   [06:07.2] And if you're a grocery store, you need,   like, first of all, you want regulations. Like we  as consumers want regulations that make sure that   grocery stores store their food properly.  And if you're a grocery store, you have so   much food that the only way you can monitor it  is by having computers doing things like, oh,   the temperature is at the right. [06:29.6]  Level all the time, and then you want  that enforced by having a a government   agency every now and then coming through and  saying, prove that for the last six months the   chicken has always been below whatever,  and that's what you can do now, right?   [06:46.1] Like you that you need that to exist. So like as   a society, we're better off for knowing that our  chicken is never like stored above 50 degrees. On   the other hand, it means that hackers can store  chicken above 50 degrees when they feel like it.   [07:03.0] Yeah. So you know, hackers make terrible   shopkeepers. I'm I'm learning. And yeah, I guess  also, why can't we put stuff on the internet?   Like why is it a problem that you shouldn't be  able to put stuff? Why can't we design stuff that   is okay to put on the internet? [07:18.6]  Like you know, default grid shouldn't be a thing.  Let's be brilliant. But I guess. That ties into   my next thing. We as an industry, especially in  the research industry and all the cons, we're   very good at talking about technical capability  and we spend a lot of time in it. But I don't   feel we're talking enough about understanding  how these capabilities are actually used.   [07:40.4] And I think that's a a big chunk   with research itself. You will find a problem,  you'll have that itch, you'll scratch that itch,   you'll push it out there. And everybody does  a deep dive in that technical aspect, but it's   not how Igor or somebody in Belarus is going to  take that technique and then operationalize it.   [07:59.2] Like, are we are we hitting a   tipping point with that, or we still stuck in our  ways? There's a bunch of things going on here. One   of them is like, just like most technical fields,  we're not necessarily like as technical people,   we're not necessarily concerned with. [08:16.2]  How does the business benefit from the technology  that we're so excited about, right? We'll be like,   oh, I want to change the stack that we're using  because there's something better that's come out,   and it won't be the business case of like by  changing the stack, we'll improve sales by   14% over the next two years, and you know,  improve like that's not what comes out.   [08:37.2] It just goes like, this is more fun than the   other thing that I've been you know dealing with  for a few years. I want the new fun thing, and.   I think that that's the same sort of thing. It's  that we're we understand capabilities as exciting   things, but we don't necessarily understand the  business of malicious hacking, right, of criminal   hacking, because it's a business, right? [08:58.7]  It has it has requirements of like things  that you can do that are easy enough to   make enough money overall through specific  business processes that it's worth. doing.   The days of it's worth doing because it's  worth doing are essentially gone, right?   [09:17.8] Like that that's the the   very the very old day of like, as a person excited  by technology, I'm excited by technology enough to   just break in and play with new technology. Like  that's an exciting thing. I think that plus the   the business angle has sort of killed off a lot  of that old curiosity hacker and now what's left   is people who just want to. [09:38.4]  make this part of their business process so they  have a vision of like I will do this I will steal   the data and then I will sell the data that  makes money so they're just looking at what is   the easiest way for me to get to the data yeah and  they don't care what we're doing where we say like   oh we've discovered a new like we figured out how  to hack a car yeah right these guys are not going   like oh great now we can ransom cars they're going  how does that help me dump An Oracle database.   [10:06.6] Yeah. Like it doesn't. It's not.   It's not really in their worldview. Yeah. And  I think there's a disconnect. On the one hand,   that's good because it means that the things we do  can be just interesting and exciting on their own   without the fear of them being abused. [10:23.5]  On the other hand, it means that we're not  necessarily aware when we pick research   topics. That will become operationalized. So  if you remember ClickFix, yeah, when it like   it like now it's a big thing, but when it came  out, it was very much it was look at this cool.   [10:40.1] Yeah, yeah,   like well it was it was just like, oh, I found  this cool clever little trick and people are like,   no one's gonna fall for it. Yeah, no one's  gonna like, no one will do this too. Yeah, yeah,   like how are you gonna get my grandmother to open  a command prompt and paste something in? Like,   come on. Yeah, and then it turns out, oh. [10:56.2]  It's very easy because you just give them  directions and they'll do it. Like, or how   many people today literally take a command on the  web ending in a .sh URL and pipe that into bash,   and that's just the okay thing now because  that's what you do with agents, right?   [11:15.3] Yeah. You know, we're sort of   seeing like that sort of supply side exposure has  always existed. Like SolarWinds revealed like the   You know, publicly made it clear that this exists.  Right now there's a sort of the ledger gate going   on where all of these. [11:31.7]  I'm loving that. Right. So like, you know,  initially it was like there's here's one   one vendor that got bought out in Malaysia  and they're doing it. And now it's like,   I bought this in an official store in  Singapore Airport and it's also hacked.   [11:48.6] And then it's like, yeah, I bought   it from like a European distributor and it's also  hacked. And it's like, this is really cool, right?   Like that sort of thing used to exist for like, if  you go to China, you need to watch out that your   laptop's going to be backdoored like this, right? [12:04.6]  Now it's just, oh, you spent, you know, a couple  hundred bucks on a hardware wallet, and you need   to worry out, you need to worry that it's going to  be backdoored. Like that's, like that's insane. I   want to say it's this generation's grain of rice. [12:21.8]  But yeah, fair play to the- deep cut. That  just still still rings strong. So yeah,   for those of you who still have your hair  and it's not grey, grain of rice means- Well,   we'll leave the thing in the footnote for  that one. Talking about grey hair, right?   [12:38.6] So, you and I have been involved in research   for a very long time. What do you genuinely  miss about the early days when we were staff,   when we're doing stuff, and? What do you actually  really rejoice in the fact that we've left behind?   So there's a few things. One of the things that  I miss is that the fields were all a lot smaller,   so you could you could know a bit about  everything and specialize in just one thing.   [13:03.9] These days there's just like there's been so much   work, right? So like when when I was starting out,  there's sort of like exploits and forensics was   a thing that the police did. And that was about  it, right? Like there's there's writing rootkits,   which no one sort of took particularly  seriously because it was very, very easy.   [13:21.7] Like there were just a very   limited number of things. So anything you did was  research, like greenfield research on like a new   thing that no one had ever thought of before. And  that was wonderful because you could just discover   all of this new stuff. [13:37.1]  It was also very like stressful and painful  and slow because you had to discover. All of   the stuff on your own and the tooling was just  absolutely awful. Most of it was written by us,   so it was very kludgy and still is. [13:55.2]  So like I I miss there's a community back then  that seemed a lot smaller and a lot tighter,   and so that was great. Things I do not miss  is the community back then was very toxic. Oh,   just Yeah. [14:11.7]  It yeah and I think we were young and dumb enough  to not realize just how bad it was. Yeah. Like we   would know, this doesn't like, it seems wrong that  when someone shows up to a party, your first thing   is like, oh, you said you run FreeBSD. [14:27.7]  What version? What modules do you include in your  kernel? Yeah. You know, prove it. Like demonstrate   that you know sufficient like technical stuff to  hang out with us, which is dumb. We we gatekept   too much. Like Fnet back in the day was was I  learned a lot from it, but it was also ugly.   [14:46.9] Like I think anybody   who talks about it being an amazing period, I  don't think they were on the tail end of the   abuse because it wasn't incredibly abusive period.  No, it was. And so, I mean, I I was around. I like   to think that I wasn't part of the abuse. It's  very hard to remember specifics from back then.   [15:05.2] Particularly because one it was very long ago,   but the other thing is it was all so normalized  that nothing stood out. Yeah. Yeah. Like it,   but yeah. So I I like I I remember incidents where  now I would have said something, but at the time I   was like, oh, that's that's kind of rough. [15:24.6]  Like that's oh like I don't think you can say  that. So yeah, I'm I'm quite glad that's gone.   I'm also glad that the tooling has gotten so  much better. I mean, particularly just in the   last year, thanks to LLMs, like it's it's now  at the point where I don't necessarily look to   GitHub for a solution. [15:46.8]  I'll just say, Claude, here's the thing I'm  trying to do. Here's what I think the solution   would look like. Write a spec, review the spec  for a bit, tweak it a little, and you know,   then I'm like, okay. Write this, and there  you go. I've got exactly what I wanted.   [16:03.3] It's like it's absolutely amazing. There's   a downside to that, I think too. Yesterday,  what was Anthropic's September release, where   they were mentioning that the Houthis were using  the Frenchmen to build warheads, which is which is   interesting, but inevitable abuse of the tooling. [16:23.6]  But I think you're right. I think. The ease of  building proof of concepts now is heartwarming,   and I think we've lowered that barrier to  entry. And I'm actually seeing a lot with   the research that's been submitted to Blackout  and other cons I'm involved in. It's it's almost   raised the bar where I can articulate what I  want and how I want to build it, and then have   somebody else build it. [16:44.5]  I think that's a phenomenal period of us being,  and we're actually seeing it with a lot of the   research that we we've submitted this and accepted  this year. Yeah, and I I think one of the other   things that it's done is it's it's allowed someone  who didn't have a team to do so much more, right?   [17:01.8] So before the research used to be,   okay, I want to figure like if you wanted to do  Oracle research, step one after figuring out how   to get Oracle licenses and stuff, you had to set  it up, configure it, and get it actually working.   [17:18.0] And that's a huge slip. I like that's   a that's a huge skill jump. That's gone. So now  if you've got like I have a basic set of skills   for breaking things, but I don't necessarily  have all the skills to set up this environment,   you can have the environment set up for you and  then you can focus on what you specialize in.   [17:39.5] So one of the   like one of the sayings I like is only do what  only you can do. Yeah, LLMs. Make that possible,   right? Like you you can start delegating all of  the scut work and end up being able to focus on   the things that you know you excel at. [17:58.7]  I think that shows up in the research now is that  just small small teams like even solo people can   do huge amounts of work to produce things that  was just not happening before. And I think it   also weaponizes teams. [18:14.2]  I'm thinking here of Ty, Ty and Calif who are  just They are he he he's unbelievable first up,   right? But I think they as a a cohesive unit are  incredibly powerful and I think leveraging LLMs   has just made them a whole new level. [18:29.9]  I want to I want to push you on the research side.  So we've seen a massive upskill in capabilities   from people using LLMs. What and I guess this is  a question I've been pondering myself. Like what   today makes genuinely research. [18:46.0]  Cool and useful research to you. Here's here's  part of the difficulty is as you know I'm doing   a a PhD which means I'm no longer a technical  person I'm a a stinking intellectual yeah yeah   the things that I find very interesting tend to be  like they're less technical and they're more about   processes organizations I don't want to like  disappear into my my thesis, but allow me to   disappear into my thesis. [19:19.8]  So like there's a bunch there's a bunch of stuff  I find very very interesting. So like there's a   thing called absorptive capacity, which I think  is relevant here. So absorptive capacity is the   ability of an organization to innovate  based on learning from external sources.   [19:38.4] And if you're talking about   how does research happen, like how do you do  research that becomes useful, it becomes how   absorptive a particular organization is to that  research. And there's several stages to this.   [19:53.9] So one of them is an organization needs to be able   to recognize that something is actually useful to  it. So you need a base level of knowledge about   this thing so that you could recognize. Oh, this  is a useful innovation, or this is a promising   direction of research, or this is going to be  big because it's very related to our thing here,   and we can, you know, do whatever. [20:16.6]  But you need the sort of base level  of skill to recognize it. Otherwise,   it's it's meaningless. You can't tell what's  good from what's bad, and so on. Then there's   acquisition. So you need to be able to. [20:32.0]  Take this new thing and bring it inside the  organization. Like you need to be able to learn   it to a degree that you could then pass it on to  the other people because that's the next part,   which is assimilation or transformation.  Basically, you need to integrate it by   assimilating it, or you need to transform it  to something that fits with what you're doing.   [20:52.4] And so, once you've done that,   then there's exploitation, which is now you  can start taking advantage of it. And I think.   Like that process is very, very fascinating to  me because it shows up in cyber a lot. Yeah.   [21:07.4] Right. And I think this is one of the things   that shows up, which is that, as we were saying,  like we, we're wondering how come research doesn't   get adopted by criminals and then sometimes it  does. And it's, this is absorptive capacity,   right? Like they look at something and they go,  this is like the recognition is like this is not   a useful thing to me. [21:29.1]  So they let it go, but when something is useful,  they acquire it rapidly, they transform it into   what they need, and then they get to exploiting  it very, very quickly. So they're very,   very like they have a high absorptive capacity  for this domain. So that's the sort of thing I   find interesting. [21:46.4]  So it's not necessarily the technical research,  but it's understanding processes like that. So   that's the thing I find exciting to me. It does  actually tie into something that I track. On a on   a regular basis is when research is pushed out and  it's accepted at a conference and it's delivered,   what's that time to exploitation look like? [22:08.5]  And I think you've summed it up really well.  There's been a number of talks over the years   of nearly 30 years of Black Hat now where  you can see they, yeah, it makes us feel old,   where criminals or organized groups have  really capitalized on the exploitation part.   [22:27.3] Probably the most recent one would be Orange Tsai,   phenomenal researcher. Like genuinely, this  dude just find bugs like everything. And his   Exchange stuff, it was really interesting to see  world-class research presented, talked about,   and then how quickly that was adapted. [22:44.4]  Obviously, Exchange, incredibly important  cog in any organization. And you know,   everybody's running it on-prem and they  should really not do that. And there's been   a few others and we've actually got a few this  year at Black Hat EU which kind of I feel are   gonna be one of those where it's very rapidly  picked up by groups to do the exploitation.   [23:09.1] One is by Andy Davis. I love   this one because it it builds upon USB abuse for  Windows. We did a lot with SensePost and USaBUSe,   and you have the whole rubber ducky. And what  Andy's done is managed to find, a vulnerability   in the way that MIDI, is presented. [23:30.8]  I mean, we're talking like old, old music  protocols now, and he gets PrivEsc on Windows   11. And it's amazing because like everybody  blocks USB stills and stuff. The other one is.   From Chinese researcher Yuan Zhang, and I I have  to admit, I find the Chinese research pipeline   utterly fascinating. [23:52.8]  I I think they are levels above of  what the West are doing at the moment,   and I know that's probably another episode there.  But what he's managed to do is a complete taxonomy   of memory attacks on Linux against modern EDRs,  and you know for a fact that this is going to be   picked up and exploited. [24:11.4]  Very, very quickly, because it lends itself into  being that kind of research where, you know,   a group's going, all right, Linux is more widely  used now. It's embedded everywhere. It's in a   fridge. We're going to have somebody selling an  EDR for it. Let's go. Where do you think people   today, if they were looking at past research,  should they go back and read or watch, especially   around what you talk about the absorption part? [24:36.4]  All right, so I was just going to say in 2004.  Well, maybe 2003. I I wrote a Phrack article   on on how to bypass EDR on Windows, and I did a  taxonomy of all the memory attacks you can do.   [24:53.4] I'm very aware of it, and we will include   a reference in the footnotes for that because it's  it's a great piece. Not so much saying like what's   old is new again, but I think that you can save  like like one of the old jokes is six months in   the lab can save an afternoon in the library. [25:11.7]  Right, so like you could do it all  yourself, or you could find out if   anyone's done stuff beforehand, and then you  can just build on that, saying, "All right,   like I don't need to do these basic things  because they're they're already out there.   [25:27.2] Now I can do something more exciting." Yeah,   you know, because I I mean, I'd be the last person  to say that like that was the that was the end-all   and be-all of of EDR bypasses, considering it's.  20 something years old. They weren't even called   EDR back then, right? [25:42.5]  That was Next Gen AD. Intrusion- IPS, Intrusion  Prevention Systems. Oh God, yeah, that that   lovely period. Yeah, that was HIPS when it was the  host-based intrusion prevention systems. I mean,   this was this was long, long ago. Okay. But  yeah, so like I guess I guess the point I'm   making is that. [26:03.5]  There's a huge amount of research that's been  done, and as a community, we're very, very bad at   cataloguing it and making it available in a way  that can actually be accessible. Like a lot of   the time, things will only appear as a talk at a  conference where it becomes one of 36 videos that   came out for that particular. [26:29.4]  You know, that venue that year, you know,  you're supposed to know that, you know,   I don't know, some like jokey title is actually  going to have deep insight into, I don't know,   like the the USB subsystem on, you know, the  Casio keyboards that happens to allow blah blah.   [26:47.5] Like, you know, this is, it's very, very hard to   do that research. So, yeah, I, maybe we are doomed  to just reinvent the wheel all the time because.   We don't have a real storage. Real catalogue. I  have a question for you. Bear in mind, next year   is the 30th anniversary of Black Hat, which is  really weird because we're both in our 20s still.   [27:09.4] It's shocking how that   happens because I remember going to Black Hat  in in Boston back in the, okay, it was the 90s,   so that was probably a couple months ago.  Yeah. Yeah. Yeah. Yeah. Anyway, I'm sorry.   [27:24.4] Over that period, can you think of a piece of   research from a Black Hat briefing that genuinely  changed the way you thought and saw security? And   I know that's a fairly deep question. So  like I remember, I remember I was at the   Black Hat Amsterdam, I want to say 2005. [27:48.2]  I think you and I were there. To it was it 2004  was it? Yeah, 5 or 6. It was the Kras the hotel   in the square. Krasnopolsky. Krasnopolsky. Yeah.  Yeah. Yeah. I I would say that one of the things   for me is that just as a speaker what's what I've  always found very very useful is being able to   talk to the other speakers. [28:06.7]  Yeah. And get the the sort of summary of their  talks because like attending all of the talks   is impossible even back then but these days even  more so you know you have to You have to plan out   a top 10 and then figure out which three you  can see, yeah, because of the the whatever.   [28:28.2] But what was very very useful then was being able   to talk to people about the the research that they  had they had done and what they were presenting   and just I I learned a great deal from that  because my focus has never really been on bugs   and so I've never worried that much about them. [28:45.2]  It's I've always found other things more  interesting, but then speaking to people   who like did care about bugs, like learning that  fuzzing was going to be big. I remember, you know,   talking with Dave Aitel about that way back  in the day, or when like the first kernel   exploits started coming out, and it was very  much like, oh yeah, that's a program as well.   [29:09.1] Like of course you could do that. Yeah. Like   there's just so much you know and then of course  there's the Halvar Flake and Mark Dowd. Who else?   Neel Mehta was it? With the the integer overflows,  like they just sort of discovered a new type of   memory corruption, like a new way of doing it. [29:30.3]  You know, like I think I think one of the things  is like when you're doing research, a lot of the   time you're just trying to make things work so  that you can make something else break. Yeah. And   so you can sometimes forget that like undefined  behaviour, which is very frustrating when your   thing doesn't compile, is actually. [29:47.4]  Someone else's, yeah, someone else's like, bag of  tricks, right? So, just that I think was very very   interesting to me. And like as I said, it did,  it changed a lot of the way I understood things   of like, oh yeah, like it's not just a problem  because of a you know bit shifting off the end.   [30:09.1] That's actually a problem   that can be abused. Like just. Agreed. I I think  if I had to think of my two. Charlie and Chris's   Jeep hacking one because for me that was kind of a  culmination of really good hardware research that   Joe was involved in to exploitation to real world  impact to actually the vendor and the manufacturer   going oh crap this is a big problem like it  closed the circle and then probably one of my   most inspiring talks that has genuinely shaped my  research for the last 10 years Was Halvar Flake,   who I've got utmost love and respect for. [30:46.7]  It was his Black Hat 2016 keynote of why we aren't  building a defendable internet. And he had, I I   will will leave the the link in the notes, but  it is one of those talks that genuinely shaped   the last 10 years of my life. And and just in true  Halvar fashion made you rethink a lot of stuff.   [31:06.7] Yeah, so I I cite him   in I cited him in my master's that specific talk.  And I cite him in my my dissertation now. Like,   this the guy has a lot of insight. He he  needs to be protected at all costs, but yeah.   [31:21.8] Yeah, national treasure. Yeah, of   Germany. He needs to have a statue. Yeah. I I want  to look into the future now, and I think because   you and I are getting on and towards the end of  our careers, I guess, what excites you about this   next generation of security researchers? [31:39.2]  And is there a an area of research at the  moment that you're looking at going, wow,   that's pretty damn cool. So one of the things  that I think is kind of amazing is just how much   more skilled they are than than we were.  Yeah, all day long. Yeah, we were crap.   [31:54.2] It's it's you know, I'd say like to be fair,   we had to invent everything ourselves. But like  on the other hand, it was super easy back then,   right? Like it's just so. You know, one  thing is you you look at just doing like   memory corruption. [32:13.0]  There are so many protections and so much you have  to overcome these days. I always think like how   can anyone ever start this? It's just amazing that  people can do this. And then you find out that   like speedrunners have been doing it with like  what was it Pokemon where you have like it's it's   joystick inputs to write shell code. [32:35.5]  And it's like oh okay like well like we weren't  even playing at it like we we don't even count   we're not in the same league at all like that's  not that's a different game they're they're and   so yeah I think the the thing that amazes me  is just how how much more skilled the the next   generation is but I think that like the agentic  thing is going to be a huge boon to them because   On the one hand, it means that they can focus on  the things that they're actually interested in,   and on the other hand, I think it's going to  level everyone up equally to a degree, right?   [33:16.8] Like it's it's going to give everyone a   good baseline to work from. So I'm I am very very  excited about where things are going next. The big   question is I think Halvar. Half a phrase it is,  as is this the Vuln-pocalypse or the bugger side?   [33:35.1] So, are we looking at the end of   days where memory corruptions are just going to be  so cheap and easy to make that anyone can do them,   and therefore everyone's permanently at risk from  O days, which to me just sounds like the late 90s   where you could. [33:55.4]  Sit down on a Friday and be hacking things by  Saturday and it would be a zero day for months   because the vendors didn't care. Yep, Apache 1.x  any of the OpenSSH stuff because it was fun to   pick on Theo and co. Any of that kind of stuff  where, like you said, you had a a while before a   patch came out because it was hard. [34:16.6]  Yeah, I mean, this was an era where you  literally had to pressure vendors into   patching things that were being exploited  in the wild. I I think you still have to do   that today a little bit, possibly. Yeah,  it hasn't gone away, but so two things.   [34:34.3] I guess one wish you you had a cybersecurity   genie. What would the wish be? I would say get  rid of memory corruption exploits because then   we can do more interesting things. So here's my  argument is I I think there's a lot of talent.   [34:52.1] and and effort and   all that that goes into exploiting things and when  it's all focused on memory corruption it gets more   and more niche and more and more specialized and  I feel like that's great but I'd I'd love some   of those minds to be on like other things in in  the space and it like that like if we could solve   misconfiguration properly I think that would do  more than fixing all of the buffer overflows ever   yep I I'd go one up, sandboxing. [35:24.6]  It's funny how an old technique, an old idea, has  now really come home where it's a hard problem   to solve. And I I'm going to go up to all the  the people. Oh, just sandbox is so easy. Cool,   go ahead. [35:40.4]  Like genuinely go ahead and build a modern  sandbox that's usable and prevents and detects   and yeah. Yeah, like sandbox a browser, right?  Give give me a browser that has access to only   the file it needs, like only the the files  it specifically needs, and if it's abused,   can't do anything malicious. [36:02.5]  And it's like, well, it needs access to your home  directory, but then other than that, it's fine,   right? It's like, well, so you know, other than  the crown jewels, it's it's okay, but What you   and I are both getting at is that they're like if  you're in security long enough, you'll learn these   security fundamentals, right? [36:22.1]  And it's the things that everyone knows and sort  of wishes they did, but they don't quite have   time for it or the budget for it. And they're  absolutely definitely going to get to it soon,   maybe next year. It's things like you  know at least privilege, segmentation,   separation of privileges into like you know the  roles that like You're teaching some crazy stuff.   [36:43.5] Negative X, you're gonna talk about zero   trust. No, we're not gonna get on that.  We're not gonna do that. All right. So yeah,   yeah. But it's it's like those things become  more important now because all of the like all   of the stuff we could rely on of like oh no  one knows no one knows how to set this up.   [37:01.6] No one is that interested in us. No one is going   to find no one's going to spend the effort to find  an O day in this obscure thing just for us. With   that gone away, it's like the only thing left is  actually doing the fundamentals properly. Yep. To   to wrap it all up, if if people listening to this  need to remember one thing from the conversation   you and I have had, what should it be? [37:24.2]  So my my first thought is they should they should  remember to send me money. So I'm going to give   you my Bitcoin address and keep this in mind. Have  you got a ledger? I've heard they're really good   at storing stuff these days. Yeah, yeah, yeah. I  picked one up in Malaysia recently. Quite cheap.   [37:41.0] So I, I I think it's to   like everyone's talking about AI stuff, learn the  fundamentals and then remember how AI can give you   more powers rather than replacing things. So, one  of the things I use as an example here is for the   KGB, they think about an operational environment  which is the The situations that they have to   operate within, as whether it's sort of a high  security and it's it's hard, or whether it's low   security and it's very lax and easy. [38:14.4]  And the temptation is when you  have a lax operational environment,   you can relax as well. You don't need  to take as much effort to be secure,   because they're not spending as much effort to  look for you. So, you know, ease up. But instead.   [38:32.4] What they say is like   if it's a lax operational environment, you don't  relax the security you're doing. Instead, you just   increase the number of operations. So that's how  you take advantage of it. And I think that that's   sort of the approach to take with LLMs. It's like  it allows you to now take advantage much better.   [38:50.8] You can do more things. So I say   it's like it's a very exciting time to be doing  research. It is. Thank you Grugq, thank you. Again   for spending time with us. Thanks a lot. Thanks. I  appreciate it, man. And we'll speak soon. Thanks,   man. Really appreciate it. Thank you for joining  us on the first ever episode of RE:BRIEF.   [39:09.4] If you'd like to hear more about the topics   we've discussed today, and even hear from the  researchers directly about where cyber is going,   you can register now for Black Hat Europe. It's  where the security community comes together to   understand what's changing before anybody else  does. Thanks again, and we'll see you next time.