Latest / Privacy Please / S5, E220 - DEFCON and Black Hat Highlights: AWS Takeovers, Industry Insights, and much more!

Transcript

S5, E220 - DEFCON and Black Hat Highlights: AWS Takeovers, Industry Insights, and much more! · Privacy Please

• 0:01
  Speaker 1: All righty, then.
• 0:01
  Speaker 1: Ladies and gentlemen, welcome back to another episode of Privacy, please.
• 0:06
  Speaker 1: I'm here with Gabe Gumbs.
• 0:08
  Speaker 1: This is Cameron Ivey speaking to you in your ear holes, if that's what you listen out.
• 0:16
  Speaker 2: They have one of those microphones that like the jaw bones and they're listening to us through the reverberations in their jaw.
• 0:24
  Speaker 1: Is that for people that are deaf, deaf?
• 0:29
  Speaker 2: I don't know if that works for like if you're completely deaf.
• 0:31
  Speaker 2: But, like some of the old school military silent comms work that way.
• 0:39
  Speaker 2: I'm certain they have better things than that.
• 0:41
  Speaker 2: Now I would know.
• 0:41
  Speaker 2: And then there was a company literally called Jawbone that came out with a microphone product like that.
• 0:47
  Speaker 2: Yeah, no affiliation no.
• 0:49
  Speaker 1: Affiliation I don't even know if the product works or not.
• 0:52
  Speaker 2: So don't, don't, don't listen to me was that?
• 0:55
  Speaker 1: like, was that a headset with us?
• 0:57
  Speaker 2: like was a headset, yeah, yeah, yeah yeah, plug the camera kind of ran down along your jaw and then they moved to just like a regular headset and just kept the brand name Interesting.
• 1:09
  Speaker 2: Yeah, that's not what we're here for, though.
• 1:11
  Speaker 1: What are we here for?
• 1:12
  Speaker 1: Well, welcome back to the show guys.
• 1:16
  Speaker 1: Thanks for being here.
• 1:18
  Speaker 1: Gabe, how are things going on?
• 1:20
  Speaker 1: Your end?
• 1:21
  Speaker 1: Everything good.
• 1:21
  Speaker 1: I know that there was a pretty big couple of events that just passed us this last couple of weeks in the security realm.
• 1:29
  Speaker 2: Yeah, yeah, I'm decent, no complaints here.
• 1:32
  Speaker 2: I did not get to make it to Hacker Summer Camp, which is what I assume you're referring to, aka DEFCON, aka Black Hat.
• 1:40
  Speaker 2: Black Hat yeah, they're not the same, but they happened same week.
• 1:43
  Speaker 2: Black hat.
• 1:47
  Speaker 2: They're not the same, um, but they happen same week defcon first leading into the I'm sorry black hat, first leading into the defcon weekend.
• 1:51
  Speaker 1: So, uh, we're not referring to def comedy jam.
• 1:53
  Speaker 1: No, no better, probably much well depends.
• 1:58
  Speaker 2: I mean a lot of hilarity definitely ensues at defcon, make no mistake about it.
• 2:03
  Speaker 2: Some Some very amusing things happen during the show, during the conference in general.
• 2:09
  Speaker 2: But I did not get to make it to the desert this year, but, man, it looks like a lot of fun was had in the desert, as usual.
• 2:16
  Speaker 2: There's a number of things that happened right.
• 2:19
  Speaker 1: Yes, there actually are.
• 2:20
  Speaker 1: Well, I'll let you.
• 2:22
  Speaker 1: There's one in particular that comes to mind.
• 2:25
  Speaker 1: I mean I wasn't there, but I think it was Black Hat.
• 2:27
  Speaker 1: There was a.
• 2:28
  Speaker 1: There was this big thing that I saw on LinkedIn, that kind of blew up where Palo Alto.
• 2:35
  Speaker 1: Oh that thing.
• 2:36
  Speaker 1: Yeah, the marketing mishap with the women in the dresses or the nightgown or the gowns I think it was the lampshades that did it yeah, well, that was the.
• 2:48
  Speaker 1: That was the degrading part about it, I presume so I guess, yeah, it's um, it's interesting.
• 2:54
  Speaker 1: I the thing that I'll tell you one thing that I loved about it.
• 2:56
  Speaker 1: I loved how so many women and like men and in the industry actually spoke up about it.
• 3:02
  Speaker 1: And defense, because obviously you've been in security a lot longer than I have, and we're going to pull up in three decades.
• 3:14
  Speaker 1: So yeah, it's been.
• 3:15
  Speaker 1: It's been a very masculine run industry so dominantly.
• 3:24
  Speaker 1: Yeah, male indeed.
• 3:27
  Speaker 2: Still true of IT in general but yeah no, yeah, no, it still very much is there's.
• 3:29
  Speaker 2: Yeah, it has changed a lot since then and I'm very, very happy and proud to see the countless number of ridiculously talented individuals, both male and female, but the women in this industry in particular incredible, incredible, absolutely incredible.
• 3:43
  Speaker 1: Incredible.
• 3:44
  Speaker 1: I mean, I think that there's still a lack of women and diversity.
• 3:48
  Speaker 1: We've been to local seminars about this kind of stuff and security.
• 3:52
  Speaker 1: True, it's obviously evident.
• 3:56
  Speaker 1: I think there's a lot of things that factor in and why the industry is still dominantly men and usually white men, but it's definitely changing, it's getting better.
• 4:07
  Speaker 1: I think it just depends on you know people in the industry and local areas that are pushing others to get in the industry and just being voicing their.
• 4:18
  Speaker 1: You know, yeah, there's a lot of it, but there is, there is so do you?
• 4:23
  Speaker 1: think?
• 4:23
  Speaker 1: Do you think that it would have been as as demeaning if it were just mannequins and not real people, not real women, um, or does that even matter?
• 4:32
  Speaker 1: That's a great question.
• 4:33
  Speaker 2: That's a darn good question.
• 4:34
  Speaker 2: I'm not certain I know the answer.
• 4:36
  Speaker 2: I think the easy answer is yes, it may have still raised an eyebrow to like what, why?
• 4:43
  Speaker 2: But that they were actual humans creates a different problem too.
• 4:48
  Speaker 2: Right, those are two people that needed a job, took a job, and this is I presume they didn't do it because they wanted to.
• 4:56
  Speaker 2: I'm not knocking people not to do it because they wanted to.
• 4:59
  Speaker 2: True, there are those.
• 5:01
  Speaker 2: Yes, there's absolutely nothing wrong with that.
• 5:03
  Speaker 2: No shame, no kink shaming whatsoever on privacy policing.
• 5:10
  Speaker 2: However, I have to ask myself I just don't, I don't understand like I could sit and say things like it's 2024, but here's the real thing.
• 5:18
  Speaker 2: It's like I don't get it.
• 5:19
  Speaker 2: Like what was the?
• 5:20
  Speaker 2: What was the draws, the connection?
• 5:22
  Speaker 2: Like what was, I guess?
• 5:22
  Speaker 2: Was it just like it's vegas?
• 5:24
  Speaker 2: Like I don't fucking get it.
• 5:25
  Speaker 1: I don't get it.
• 5:25
  Speaker 1: I don't know.
• 5:26
  Speaker 1: I mean I'm not sure if they have had.
• 5:28
  Speaker 1: I mean I know the ceo had a response to it.
• 5:30
  Speaker 1: Sounded like it was a mistake and it wasn't what you know.
• 5:34
  Speaker 1: The CEO had a response to it.
• 5:35
  Speaker 1: It sounded like it was a mistake and it wasn't what the company represents and all that kind of stuff.
• 5:37
  Speaker 2: All right, that's cool.
• 5:38
  Speaker 1: Mistakes are forgivable.
• 5:39
  Speaker 1: Yeah, I don't know.
• 5:42
  Speaker 1: I think sometimes this stuff can get definitely blown out of proportion too.
• 5:46
  Speaker 1: There's two sides to it, for sure, yeah well, it's easy.
• 5:54
  Speaker 2: I mean, every industry loves some drama.
• 5:55
  Speaker 2: And'll tell you, infosec is no different.
• 5:57
  Speaker 2: Boy, do we love some drama?
• 5:58
  Speaker 2: We love crowd strike there was crowd strike drama, right like that was a few weeks ago.
• 6:01
  Speaker 2: So, speaking of black hat, also um or defcon, they won the uh the pony award, for you know, biggest fuck up.
• 6:08
  Speaker 2: Um.
• 6:09
  Speaker 2: Crowd strike proudly earned that pony.
• 6:11
  Speaker 2: Yeah, again, we love some drama so much so we give, we give out an entire award for it every year, like who's deserving of the most amount of drama.
• 6:20
  Speaker 2: But a lot of other fun things happen in the desert, like all the really good stuff, like all of the beautiful red teamers, blue teamers, purple teamers, just straight up, hackers and hackresses.
• 6:31
  Speaker 2: Hackresses, hackresses I shouldn't try and gender the word, but I was having fun with it Either way.
• 6:37
  Speaker 2: There was a lot happening in the desert last week.
• 6:40
  Speaker 2: That was pretty cool.
• 6:40
  Speaker 2: Everything from security researchers unveiling more flaws they discovered in a lot of IoT devices floating around in everyone's home, right.
• 6:49
  Speaker 2: So they hacked a couple of vacuum cleaners and some other things via their Bluetooth and used their cameras and microphones to spy on them.
• 6:56
  Speaker 2: Suggestion If you have a wireless modem that you've bought in the last couple of years, you probably can create multiple different, if not straight networks, like at least virtual LANs.
• 7:09
  Speaker 2: You should totally separate those things.
• 7:11
  Speaker 2: Take your IoT devices and if you don't actually need to have them connected to the internet, just don't.
• 7:17
  Speaker 2: Just don't, right, just don't.
• 7:19
  Speaker 2: And second, if you're going to put them on their own damn network and that probably wouldn't stop all of the things because, like in this case, you know, hacking it via bluetooth means that within proximity, somebody might still be able to, and just from being on the other side of your wall, and that's the problem with these devices right Like being on the other side of the wall that you just gave that outside world an immediate camera right into your house right, crazy talk, crazy talk.
• 7:47
  Speaker 2: Some other fun stuff.
• 7:48
  Speaker 2: The Lockman Ransom Group got infiltrated.
• 7:50
  Speaker 2: That was pretty awesome, right.
• 7:51
  Speaker 2: So John DiMaggio researcher.
• 7:55
  Speaker 2: He'd used just some kind of OSINT activities to try to identify members of that ransom gang ransomware, of course, being ever-present at Black Hat right.
• 8:09
  Speaker 2: Some of the other cool ones I saw related to ransomware or tangentially related to ransomware.
• 8:15
  Speaker 2: There were some talks from some of the researchers at Northwestern.
• 8:18
  Speaker 2: They wanted to test their backup solutions.
• 8:21
  Speaker 2: They were like huh, is it actually immutable?
• 8:23
  Speaker 2: The answer nope.
• 8:25
  Speaker 2: Honed.
• 8:26
  Speaker 2: I've been for those of you that follow my grumpiness online, but like a few months ago I posted that meme.
• 8:33
  Speaker 2: It's like prove to me your mutability isn't just an access control the guy sitting at the table, because I have yet to find other mutability capabilities that are a little other than an access control man.
• 8:48
  Speaker 2: There was so much fun stuff happening, so so many fun things.
• 8:52
  Speaker 2: A lot of stuff, a lot of stuff.
• 8:55
  Speaker 1: Laser microphone deavesdropping.
• 8:57
  Speaker 1: Yeah, these are just some of the highlights.
• 9:00
  Speaker 1: What's this?
• 9:01
  Speaker 1: Prompt injection on Microsoft Copilot.
• 9:04
  Speaker 2: So it was a new vector of attack against Copilot that allowed you, based on the prompts that you put in, to have the system return sensitive information, which was I didn't get a chance to see that one.
• 9:20
  Speaker 2: So the presentation materials and the videos are starting to trickle in online, as well as all of the other information as people get back home.
• 9:27
  Speaker 2: So I haven't I haven't had a chance to pour through it all, but uh, but it looks, looks fascinating.
• 9:33
  Speaker 2: I'm.
• 9:33
  Speaker 2: I'm slightly disappointed now that I didn't get a chance to make this year, so looks like it was a good time I've yet to experience a black hat.
• 9:43
  Speaker 1: Yeah Well.
• 9:44
  Speaker 2: I would say you definitely got to do it at least once in your life.
• 9:46
  Speaker 2: You absolutely must.
• 9:49
  Speaker 1: Wait, maybe I did go to one.
• 9:51
  Speaker 2: I don't know.
• 9:51
  Speaker 1: They all start to mesh together.
• 9:53
  Speaker 2: They do Trust me, they do.
• 9:54
  Speaker 1: Maybe it was DEF CON is the one I've never been to.
• 9:56
  Speaker 2: Okay, that's possible.
• 9:57
  Speaker 2: A lot of folks, especially if you're in the solution side of the industry, so to speak, will typically attend just Black Hat.
• 10:07
  Speaker 2: That's the more commercially oriented part of it.
• 10:11
  Speaker 2: Def CON predates Black Hat.
• 10:13
  Speaker 2: I don't know, by about five, six years, maybe I don't remember how long now.
• 10:17
  Speaker 2: That is the hacker gathering.
• 10:21
  Speaker 2: That is the hacker gathering.
• 10:22
  Speaker 2: It's still a cash-only event.
• 10:24
  Speaker 2: You don't need to tell anyone who you are, you just show up, put some money on the table, go participate.
• 10:31
  Speaker 1: That's cool.
• 10:31
  Speaker 2: Walking Village, some satellite hacking villages, all kinds of cool stuff.
• 10:36
  Speaker 1: Yeah, I remember you were pretty excited.
• 10:37
  Speaker 1: I think it was a few years ago when you got to take I think you took your son.
• 10:42
  Speaker 2: Yeah.
• 10:42
  Speaker 1: Which must have been a pretty fun experience.
• 10:44
  Speaker 2: Yeah, it's good stuff.
• 10:45
  Speaker 2: It's good stuff.
• 10:46
  Speaker 2: A rite of passage.
• 10:49
  Speaker 2: I tell you A rite of passage.
• 10:53
  Speaker 2: See if you can figure out how to get around the parental controls.
• 10:55
  Speaker 2: If you can do it, you've earned it.
• 11:00
  Speaker 2: You can keep it.
• 11:00
  Speaker 2: If you can't, that's it.
• 11:02
  Speaker 2: You're back to watching just barney.
• 11:05
  Speaker 2: Sorry, but I'm a teenager, I don't care that's right, that's right.
• 11:10
  Speaker 2: Watch barney until you can get around the exit well, is there anything else that stood out?
• 11:16
  Speaker 2: that was pretty major um that people should know about that you I think one of the other significant ones was there was some research around hacking AWS accounts using shadow accounts, which is huge.
• 11:28
  Speaker 2: Huge, absolutely huge.
• 11:29
  Speaker 2: Some topics that we haven't spent a ton of time talking about on this show, but I've been researching offline.
• 11:36
  Speaker 2: There's just so much assumptions made about how AWS works by a lot of people leveraging the platform, and this platform isn't necessarily inherently secure, although it has its issues, like anything else.
• 11:48
  Speaker 2: A large part of the problem is just how people assume it works.
• 11:53
  Speaker 2: And it is complicated is the other side of that coin.
• 11:56
  Speaker 2: It's really difficult to know all of the inner workings and even if you knew many of the inner workings, you'd be far from ever knowing enough to really feel comfortable, in my opinion, that you know it all.
• 12:09
  Speaker 2: And yeah, these researchers they demonstrated how you could take over AWS accounts using ShadowGap.
• 12:20
  Speaker 2: It was interesting, it was very good.
• 12:22
  Speaker 2: Again, that's another one I want to dive into a little bit further.
• 12:24
  Speaker 2: But AWS has become another place where folks are starting to leverage it more, not even just for all of its many capabilities to automate infrastructure and things of that nature, but for simple cloud storage.
• 12:39
  Speaker 2: Even.
• 12:39
  Speaker 2: It has become a very significant part of a lot of people's infrastructure, even in the very uncommon even as just an archival place for them to put data.
• 12:49
  Speaker 2: And I hear on a daily basis statements made about how AWS works that always.
• 12:54
  Speaker 2: I spend not less than an hour a day educating people on what they think happens when you do certain things in AWS and how they think it otherwise keeps them protected.
• 13:05
  Speaker 2: For example, you know, keeping their data immutable in an object storage bucket by simply turning on object locked inversion control.
• 13:12
  Speaker 2: Like the first thing they don't realize is, their cost starts going up like tremendously.
• 13:17
  Speaker 2: And the second thing they don't realize is it's an access control right.
• 13:21
  Speaker 2: And so then you walk them through any number access control right like it and, and so then you walk them through any number of ways to bypass it and or poison it first, and they're like huh, I didn't think you could do any of that.
• 13:30
  Speaker 2: It's like.
• 13:30
  Speaker 2: It's not that I'm a magical unicorn I mean, this pretty little horn in my head might suggest that, but there is so much to be learned and to understand about how the infrastructure works.
• 13:39
  Speaker 2: And so, yeah, there was some great talks.
• 13:41
  Speaker 2: That was probably for me, one of the bigger ones too was the AWS account takeover stuff.
• 13:47
  Speaker 2: Just think of how much AWS rules the world from IT infrastructures.
• 13:54
  Speaker 1: How many SaaS products are built on top of it.
• 14:02
  Speaker 2: How many individual organizations are using it as part of their overall IT strategy?
• 14:04
  Speaker 1: How much?
• 14:04
  Speaker 2: just relies on it.
• 14:05
  Speaker 2: How much of the internet period relies on it.
• 14:07
  Speaker 2: These days it's a fairly high number.
• 14:10
  Speaker 1: Is it more I don't even know what I'm trying to say here compared to google?
• 14:14
  Speaker 2: is it more important to our oh, definitely they have way more, way more market share from an from an infrastructure perspective, than google.
• 14:21
  Speaker 2: I'd say, you know, in if you were stack ranking the three hyperscalers as they get referred to the three hyperscale cloud vendors, it would definitely be, you know, aws, then microsoft, then google wow, yeah, google was used to be.
• 14:39
  Speaker 1: Did google not used to be one of the tops before, or?
• 14:42
  Speaker 2: they never really got their cloud platform to take off quite the same way it's I mean it's, it's in use, it's, it's a solid platform.
• 14:52
  Speaker 2: It has its pros, like anything else.
• 14:53
  Speaker 2: It has its cons, yeah, but it's never quite gotten the same kind of adoption that aws has.
• 14:59
  Speaker 2: Why there's a number of different reasons, but the number one thing that everyone points to is the truth is they were kind of late to that game.
• 15:05
  Speaker 2: They were a little late to to the, the uh, cloud infrastructure as a service, platform, as a service.
• 15:12
  Speaker 2: You know the is has all that stuff game.
• 15:15
  Speaker 2: So interesting.
• 15:16
  Speaker 1: Okay, well, um any other highlights um from black hat that we didn't touch on.
• 15:24
  Speaker 2: Maybe there's so many, I think we should probably uh, probably hit a little blog, cast the action up, maybe on it.
• 15:30
  Speaker 2: We'll see, um, we'll decide if we want to post some more.
• 15:33
  Speaker 2: We'll drop some links and chat to some other resources, though, uh, I'll definitely drop some of my the talks that I thought were were really worth noteworthy they certainly all make the list, but there are a few that really floated to the top of my list that I want to highlight for folks.
• 15:48
  Speaker 2: So, um, yeah, otherwise, I was it another year in the desert, glad everyone made it back safe.
• 15:55
  Speaker 2: I may try and get there next year.
• 15:57
  Speaker 2: It's hard to say knowing this far.
• 16:00
  Speaker 1: Yeah, we'll see.
• 16:00
  Speaker 1: I know, Trinson.
• 16:03
  Speaker 1: We made an appearance at Black Hat for the first time, so maybe I'll get a chance to be there next year.
• 16:08
  Speaker 1: But some notable events that are coming up PSR, iapp in LA in September, nice, I'll be there.
• 16:18
  Speaker 1: So if anybody's going to be there, let me know.
• 16:19
  Speaker 1: Right on you signing shirts?
• 16:21
  Speaker 1: Yeah.
• 16:22
  Speaker 1: I'll sign some shirts, ball caps, whatever babies whatever you got, babies, you know man boobs, shirt, sleeves, yeah, shoes, yeah.
• 16:33
  Speaker 1: I'll take some pictures with you, righteous, if I'm feeling you know friendly enough.
• 16:39
  Speaker 1: Security, security.
• 16:43
  Speaker 1: Who is this guy?
• 16:45
  Speaker 2: Move this man.
• 16:46
  Speaker 2: Tell him to stop tugging at my hem.
• 16:51
  Speaker 1: This guy's trying to sign me.
• 16:52
  Speaker 1: I don't like it.
• 16:54
  Speaker 1: All right, gabe.
• 16:56
  Speaker 1: Well, thanks, man, and thanks for everyone.
• 16:58
  Speaker 1: If you guys got questions or anything that we missed, it was big that we weren't there.
• 17:03
  Speaker 1: You were there, shoot it our way, love to highlight it and all that kind of stuff.
• 17:08
  Speaker 1: So love you guys, until next week.
• 17:10
  Speaker 1: Until next week, toodles.