Srsly Risky Biz: Data extortion is booming. Hooray!

0:04James Wilson: Hey everyone, I'm James Wilson and welcome to this week's Seriously Risky Biz. This is our cybersecurity policy and intelligence podcast and it is based on the amazing newsletter that my colleague Tom Uren writes called Seriously Risky Business, which you can find at our website, risky.biz. Not only can you read Tom's newsletter there, but you can also subscribe to it so it lands in your inbox each week. Tom will be along shortly to have a chat with me about his newsletter. But first, big thanks to this week's sponsor, which is Island Security. Island makes a enterprise browser, which when you think about it, so much of the work we do, if not all of the work we do these days in an enterprise, is in the browser.

0:43James Wilson: So having a browser that is designed for that enterprise environment that you can secure it like an endpoint, it makes a lot of sense. And that's exactly what Island does. So on to Tom's newsletter. Tom has two topics for us this week. The first one is data extortion is booming and hooray. And so in this, we look into how data extortion is, I guess, an extension or evolution of ransomware. But, you know, whether by design or whether just by dumb luck, attackers have discovered that you don't need to lock up the files. You just need to find a target that is going to be sufficiently concerned about you having their data and will pay big money for you to delete that data.

1:30James Wilson: And, you know, as cynical as it sounds, if that forces attackers to go and target people with very deep pockets to pay very large ransoms because they have a very nation-specific reason to want to keep that data quiet and off the streets, lawyers were looking at you, then, well, maybe that's not a bad thing if it ends up attacking industry folks where, you know, the ransom could really just be, if not insured, a cost of doing business. Who knows? But either way, Tom makes the great point here that, you know, even if this creates a data extortion system that is more targeted, we cannot, governments cannot, policy cannot take its eye off the ransomware problem, because as Tom says, this is our opportunity to squeeze the last bit of air out of the ransomware bubble.

2:20James Wilson: The second topic for this week is secure by design is more realistic in the AI age. Now, this is one that I initially disagreed with Tom a bit on, and we talked about this throughout this episode, but I think we both arrive at the same place, which is secure by design was very well intended, but when an initiative depends on changing the behavior of humans and that change in behavior could be at odds with corporate or other incentives, then that's a major uphill battle to climb. And even then, if that wasn't enough, the sort of not canceling of the initiative, but the deprioritization of secure by design kind of has left it to wither on the vine.

2:59James Wilson: But what if AI gives us a chance to rethink this? Maybe it's not secure by design, but it's secured by prompt, secure by harness. Surely there's something we can do here with AI generating so much code it you know it doesn't necessarily get it secure every time or straight away but what if we had some minimum standards of the ways you had to prompt or the harnesses you had to run your agents through and that gave us the the rising tide that lifted all the boats but anyway look back to data theft extortion hooray I'm going to drop you in here where Tom starts off by talking about first of all the differences between ransomware and data extortion and how this has all come about.

3:42Enjoy. I'm going to step right back and encrypting ransomware is ransomware that locks up files.

3:51Tom Uren: And that was a huge shift in cybercrime. And over the last couple of years, that's become a steady, constant, very disruptive force in the world. And in the last couple of years, there's been the rise of also stealing data and threatening to extort companies by saying, we'll publish it. So if you've got sensitive data, some firms don't want that to be published and they'll pay ransom for that. And my thought had always been that, yeah, that's kind of interesting, but it doesn't seem like it's as powerful a lever as locking up your files. What can be worse than getting your files locked up? And in recent months, I guess it's gradually dawned on me, in fact, that for the right victims, that is more powerful than locking up files.

4:46Tom Uren: So the news in recent weeks has been that a couple of law firms have paid very big ransoms in the order of 18 million US dollars, 10 million US dollars. These are big multinational American firms. And when you think about it, they're the perfect victims in the sense that they're very motivated to protect their reputation. They've got a lot of sensitive client attorney privileged information that if it is published, that is really bad for your client. And these firms exist on their reputation. Like you don't, for many people, it's a one time, you know, you shop around for a lawyer when you need a lawyer and you go to a lawyer because they have a good reputation.

5:34Tom Uren: And so they're extremely motivated to basically make it go away by paying a ransom. And so what's happened is that these firms, not the firms, but the cyber criminal groups have gradually sort of shifted targeting. And over time, they've realized that they're particular firms where reputation is important, and that's where we need to go. So there's been over the last couple of years, one particular firm has focused on lawyers, they've even done things like send people to pretend to be IT support and try and get access to systems by physical access.

6:18James Wilson: Right. I remember we covered this on the main show. This was silent ransomware, right? Silent ransom. Yep.

6:25Tom Uren: So as ever, that's got several different names. They're the group that was paid those huge ransoms I spoke about at the beginning. And so now the interesting thing as well is that we're seeing a shift in the cyber criminal ecosystem where there's more data theft extortion going on and less actual encrypting ransomware so that's that's the hooray part

6:53James Wilson: and and to pick apart why that's a hooray I think there's um it's funny how this always all comes down to similar sort of trade-offs that you'd have in any sort of business environment it's like there's a quality versus quantity aspect to this which is you know ransomware seems to be largely indiscriminate. You know, if you've got access, why not ransom it? Then you can work out what you might be able to charge for it. But this is going for more the, you know, it's also a specialization versus generalization, right? It's a very, very targeted attack on very specific people. And those people seem to have very large coffers and the motivation to pay, which so overall, a net positive for everyone.

7:33Tom Uren: Well, it's, you know, mixed feelings when describing this as good news, definitely, because it's clearly not good for the victim firms, right? And it's a big problem for them. However, in comparison to encrypting ransomware, it's less of, I think it's less of a public policy problem, because it doesn't cause the same widespread impact. So we, you know every year it seems like there's at least one huge incident where some big systemically important firm that no one had any idea was that important gets attacked by encrypting ransomware so for example last year we had the jaguar land rover attack which was economically a huge deal like you could see it in the uk's gdp figures the year before that we had united health in the states which impacted a lot of healthcare.

8:29Tom Uren: And so those are so damaging that I think it is important for the government to step in and do something. And we've argued on the show for many years that one of the steps is to disrupt them with offensive cyber capabilities. And I still think that makes sense. Those are the targets that you want to try. And the cybercrime gangs who are carrying those out are the targets you want to try and deter, stop, get them to do something else. So I mean, it's a bit hard to say that encouraging to do data theft extortion is the right thing to do. But from a policy point of view, we'd all be better off if encrypting ransomware went away and they all focused on data theft extortion.

9:16James Wilson: Right. And I mean, who ultimately is the victim here? Like you said you've got mixed feelings about saying hooray when you know it's not good for the victim of these things but i mean if this was legitimately limited to and primarily targeting the kind of firms that a have exceptional profit margins a huge amount of money uh they're probably insured up the wazoo i don't know if this is even covered in insurance but like for a lot of these large floor firms you're talking about something that is already a contingency on a balance sheet and is a plan for sort of event. And it's like to the extent where you could almost imagine this is a cost of doing business, whatever.

9:54James Wilson: We retained our reputation. That's what it costs.

9:57Tom Uren: You're even more cynical than I am, James. Congratulations. I think you're right in the sense that it's, what's the old line from The Simpsons? You know, it's a victimless crime when you punch someone in the dark. So they're suffering, but they're doing it silently. no one else is being impacted. I guess the victim is everyone because you have to pay more for those services. Now, to be fair, I'm not sure that lawyers services are set based on their cost. I think it's based on how much they can charge. And it doesn't really have much to do with how much they've paid in ransoms for any given quarter.

10:40Tom Uren: So I think you're right. It is a much better problem because the secondary impacts are just a lot less. There's less of them.

10:49James Wilson: And before we sort of get to your sort of take on, I guess, the policy and government angle here, you did also mention another group in the newsletter, aside from Silent. And there were some interesting subtle differences there. And I think it's worth sort of just taking a quick detour into that because we don't want people to think this is just Silent Ransom where they're a unique operator and, you know, that they'll just continue doing their things. There's already two groups that are quite at the fore. So talk us through the other one and what sort of sets them apart.

11:16Tom Uren: Yeah, so the other one was a group called Blackfile. What I thought was interesting about them is they've kind of speed run the same process though. So they only in terms of victim or target selection. So they appeared at the beginning of this year, so not that long ago. And there's a report which talks about how they've shifted across different target sectors or industries. and so you know they started in just big companies then it was entertainment uh people who had vip lists that were sensitive and and but then they've also then most recently they've shifted to financial firms law firms wall street firms anyone with intellectual property that they think is important and they want to keep so it's it's very quickly they've by process of trial and error it probably.

12:06Tom Uren: They've just honed in on here are the companies or sectors or industry verticals that are most motivated to pay. So I think it's, I guess, what is it, convergent evolution where they've both arrived at the same set of victims that really work. There's a difference in their tactics, silent, what were they called silent? Silent ransom. Yeah, not ransomware, silent ransom. so there's a difference in the way that they extract data. So silent ransom is kind of like a smash and grab. So they'll go in, grab whatever they can, get out, and then almost immediately send the ransom message. So the Google report talks about them doing an entire operation in a single day, like from target, getting onto the target, extracting data, sending the extortion message.

12:57Tom Uren: And you can imagine if you get$10 million in a single day, that's a pretty good that's a pretty good payday.

13:02James Wilson: Yeah I loved your line that's a pretty good hourly rate. Speaking of people that charge a good hourly rate that's a good hourly rate.

13:07Tom Uren: Yep so Blackfile by contrast spend is more comprehensive so they basically do the same thing they're both phishing outfits get credentials but then they pivot out as far as they can so they'll try and get credentials for other software as a service applications and just grab everything. So different I guess tactical approaches, but the whole strategy of finding someone who really cares about their reputation and then holding them over a barrel, that's the same. And both of them work.

13:40James Wilson: But let's get back to, I think the thing that I found most enlightening towards the sort of, as you were rounding up this article in the newsletter was, your sort of recommendation for what government needs to do here, right? Because there'd be a tendency to say, well, wow, this is a huge amount of ransom being paid. We need to jump on that. And oh ransomware is not a problem anymore we'll just let that slide but i think you've got a very nuanced point here around hey don't let this long tail continue to be a long tail the the balloon's deflating squeeze it let's let's kill this off right yeah that's right i think

14:15Tom Uren: anything you can do to stop encrypting ransomware that's got to remain the priority because just because of the damage it causes and it's kind of unpredictable when you're going to get a big outsize event that causes massive impact because no one knows beforehand that they're going to cause that. So I think the encrypting ransomware is very opportunistic. And so it's not as if you can try and I mean, we should do this as well, try and keep them away from hospitals. But it seems that those big attacks, like beforehand, you would not have guessed that those big attacks would have caused such economic or healthcare damage.

14:59Tom Uren: And so those huge impacts, we want to try and stop them. You've just got to keep trying to disrupt ransomware operators, keep the pressure on them. As we discussed, the data theft extortion just causes less societal damage. And so the ransoms may be huge. Lawyers, I think, are often very good lobbyists. They may be arguing for government action, I think just ignore them. Stick to the encrypting ransomware.

15:30James Wilson: Okay, so a good point to pivot to your second story, which is the secure by design is more realistic in the AI age. And specifically, what you're talking about here is I think this is an initiative that was spun up a while ago, it was a Biden era thing, Trump then kind of let it languish, wasn't necessarily cancelled. But, you know, when we talk about secure by design, that's always been something that's felt like, you know, yeah, but you've got to train that into people and they've got to learn the techniques, et cetera. And now along comes AI and large language models, and they can do a pretty good job at generating secure code if they're so prompted.

16:04James Wilson: And so am I right in saying that's sort of the core of your thesis here is that now's the time to bring this back?

16:11Tom Uren: Yeah, I would frame it or say it a bit differently. It seems like AI is very good at generating code, not necessarily secure, but if you literally harness it the right way, you can get it to review its code so that it iteratively gets more secure. And so it seems like any bloke and his dog can, you know, type in, please write me software to do whatever, and you can get some sort of code. But it takes a bit more mouse or experience or skill, I guess, to take that initial cut and make it secure. And so there's Google blog posts last week or the week before where it talks about, hey, in Chrome, we're using several different agent workflows to different parts of triage.

17:09Tom Uren: So they, I guess, in essence, break the problem down into many small steps and get AI to do all those steps. And together, you get a workflow where out the end, you get code that is much more secure than went in in the first place. And I suppose at this point, I always thought the secure by design was a good idea. Like the fundamental problem is that companies don't really care about or haven't historically cared about making code secure. Many companies, not all companies. And they just weren't the economic incentives, like security wasn't a selling point. It was hard for consumers to know what was more secure.

17:52Tom Uren: And when I mean consumers, I mean like businesses, everyone, it was hard to assess software or products. So it seemed like, yes, we need to change that and give companies those incentives. Part of the idea at the time was we'll have software development standards. They'll involve these processes. They would be relatively heavyweight and require a fair bit of software development expertise. And then the other part was we'll gradually change laws so that companies can't just put in their end user license agreement. We have no responsibility if anything goes wrong. It's entirely at your own risk.

18:33Tom Uren: Use our product or not. But if anything goes wrong, you're carrying the can, not us. It's on you. All right.

18:39James Wilson: So before we get to sort of the EULA and the liability aspect, because I think that does end up being quite a powerful argument, there was a line in the newsletter here that when I read it, I was like, I'm not sure about that, Chief. But then the more I thought about it, I was like, okay, no, what we're disagreeing with actually leads us to the both, to the same point, I think, which is just where you said that, you know, things have since changed. You were talking about the sort of the history of Secure by Design. You said things have since changed. The rise of very capable AI now means that it is possible to take advantage of AI's capabilities to produce secure code from the get-go.

19:16James Wilson: It's just tokens, not real world blood, sweat and tears. Now, that made me go, I'm not sure because I can tell you I've shed many a tear and exerted a lot of effort in getting AI to produce very reliable code, code that is ready for production, code that's not a whole bunch of attack surface. And then on the flip side, right, starting to do security vulnerability research with AI, it's a hard slog, right? The surface, the little sort of, the low-hanging fruit, oh, plentiful. But that's not where the real interest is, right? There's still a lot of work you've got to do to either get a worthwhile vulnerability, let alone an exploit, and or create code that is truly secure.

19:57James Wilson: But what I realized was we're not really in disagreement there because I think we're both getting to the same point, which is AI as an enabler, but it's sufficient but not essential, right? Or is it the other way around, right? It's essential but not sufficient to create code. There needs to be something else or secure code, and that probably should be something along the lines of secure by design. But my challenge back to you is, is it secure by design or do we need something more that is like AI specific, like a reference standard for harnesses? I don't know. Yeah, yeah.

20:26Tom Uren: So that's what I'm thinking is that there's, so Google speaks about, you know, we've got several harnesses that do different things. Microsoft has M-Dash, which is a harness which is meant to help make your code more secure. I think it's great.

20:42James Wilson: Still the most brilliantly named AI tool in the modern era.

20:46Tom Uren: So it's great that some big companies have tools that are probably appropriate for them and maybe no one else. I think Microsoft is meant to be a product. But there's a whole swath of all sorts of developers who would like to be able to say, I'm writing something, I'm vibe coding something, I kind of know what I'm doing a little bit. What's the right way to try and use AI to help me do it better, to do it more securely? Right.

21:15James Wilson: Because as you say, this is not just tell Gemini and make no mistakes. That's right. There's got to be more to it.

21:21Tom Uren: Yeah, and I think, you know, at the very basic level, it might be something like you need to get, you know, your agent to write the code, you need to review it with, say, I don't know, this prompt, which is, you know, assess it for security vulnerabilities, I don't know. but it could be at the very base level something as simple as that you know check these things get it to do these things and at a more sophisticated level it might be here's this harness you put in your code or whatever at one end and you should get here are a list of problems here's some suggested solutions here's how you would make sure that the test cases you've got are fit for purpose and, you know, etc.

22:04Tom Uren: So a sort of pipeline of things to do that would help the average software developer go from, I've got no idea how to get it to do secure coding to at least, here's a process of things that I should consider and do after I've done the initial coding in before I push it out the door. So I think there's a real space for some expertise to say, here's different types of I want to say pipelines that you could use based on how sophisticated you are what your risks are and and so just getting people to normalize that I think would be great

22:41James Wilson: yeah yeah I mean I don't disagree and and uh well I think I think I came around and realized I was actually agreeing I was disagreeing at first but the the other line that you said here that goes back to what you were just saying which is that they're you know what we've seen happen in industry is a huge gap created between almost like the haves and the have-nots. You know, folks like Microsoft and Google and all the rest that are using these very custom harnesses, that's taken a heck of a lot of engineering and they've got that capability. What you've just talked about there is doing something that puts a level of knowledge or some degree of baseline tooling in the hands of the smaller player that is vibe coding.

23:18James Wilson: My, I guess, argument back to you would be, I don't think it's as simple as saying we need secure by design to help the little player because the little players doing the vibe coding, they are dependent on the big players in some way, shape or form. Either they're using a vibe coding platform that's hosting their vibe coding app or they're writing code that is compiled and ends up being run on a runtime. Those runtimes are all mostly sponsored or owned now by large corporate entities. And so I think maybe what I'm asking here is if there was a secure by design iteration here for AI, right secure by design in the ai era where do you think it deliberately from a policy perspective needs to be targeted at is it at the small players or is it at is it going to be at the larger players for the benefit of the smaller players i think that in part is a philosophical

24:10Tom Uren: question about what you believe and so my instinctive reaction was that i want everyone to be involved. So I don't, what I like about, what your question naturally suggested is perhaps the answer is to say to the big players, you need to have these pipelines yourself, Anthropic, OpenAI, Google Gemini. When you're spitting out code to someone, you need to have a process internally that analyzes it and makes it more secure than it is as it sort of comes out by default. Like you need to internalize those pipelines. What I don't like about that is that's a very centralizing concept, right? That centralizes power in just a few big organizations.

24:57Tom Uren: I think those organizations, OpenAI and Anthropic probably love that idea. Everyone else hates it. And so I think from a policy point of view, it actually makes more sense to try and democratize the technology and make everyone available, make it available to everyone. So the advantage of the centralized approach is you only need to do it in a couple of places. The advantage of the decentralized approach is that it gives people lots of different options. It encourages competition. So for example, here's a framework that can help your code be more secure. You plug whatever model you want into it.

25:33Tom Uren: You can use an open source model. You can use a frontier model, whatever. So I think I've convinced myself that that democratising approach, I think it is better. It's more in line with what the Trump administration believes. I don't think it really wants to centralise power anywhere, except in itself, maybe. Except in itself, yeah. Yeah.

25:57James Wilson: Okay. So whether it's a decentralised or a centralised, the small players, the big players, all of this will come down to liability remains one of the biggest forms of leverage in all manner of things, right? You want to understand the behaviors, follow the incentives. And software has a long and storied and I think probably wrongheaded history of not following product liability standards and there's just EULAs and everybody clicks them. You're saying, you know, you're taking all the responsibility and absolving the vendor of all responsibility. And you put an interesting point in here in the newsletter around, you know, the current status quo is the software vendors can absolve themselves entirely of liability via NGOs license agreements, a situation that probably made sense when expertise to discover vulnerabilities was rare.

26:51James Wilson: And of course, that's what we're talking about, that shifting. But if we get to the concept of revisiting the EULA and liability itself, almost like on a conditional basis of did you follow the secure by design practices, it sounds good. But where it sort of falls off for me is that the artifact, the software that's produced doesn't really attest to the process that was created for it. So help me, I guess, overcome my... Initially, I was excited. I was like, revisit EULAs and liability. Yes, that'll make something happen. But how? How do you conditionally relax or change the enforcement of those based on how something was built, not the end result?

27:30Tom Uren: I think the American process is to write the law and then lawsuits sorted out. And so I imagine that if you're a company in that space and you realize that you're liable, if you don't follow a process, you just document what you're doing. And I would have thought that that would not be too hard. like people like just, you know, what's the word, GitHub commits and stuff. You would have in that a record of why you made that commit. Ah, such and such model suggested this was a terrible security decision, so we fixed it. I think that would be like, to me, that seems like perfect evidence for we followed a particular process.

28:10Tom Uren: You'd have, you know, planning timelines. You know, this is the point in which we fix up all the problems that our code has. Maybe not all the problems, but we at least make a determined effort to figure out if we've made mistakes and what to do about them. So I think that that's a case of if there's a huge problem which results in a lawsuit, that's the sort of discovery phase. so that is probably an expensive way to sort that out in terms of the time and money for everyone involved which provides like an incentive not to have those mistakes in the first place which you know maybe is not bad yeah yeah yeah it might just work and

28:58James Wilson: maybe one thing again sticking to the theme here that ai actually makes this more applicable and more important than ever. To your point there around, you know, discovery through Git commits is one thing. You can get sort of a snapshot of the incremental process to build something. You still don't quite know why, you know, I sat down at my computer and arrived at that commit. You know, did I do it because I just dreamt something up and quickly typed it out? Or was this a multi hour effort with many people involved helping me? But AI could help us here. Today, you know, we've got this idea of the transcripts, we could attach the transcripts to the commit or somehow I'll link those together in a discovery process.

29:31James Wilson: That could be quite helpful. The one thing that I'm so surprised this hasn't come to light yet or is not a thing yet is attestation of, or verifiable attestation of which model actually produced which entries in the transcript. Like, I don't know why OpenAI and Anthropic doesn't provide some sort of signature that you can then actually verify and say, oh, yeah, that really was a message. It really came from Claude, Opus 4.8, not, you know, the tiny little model running on potatoes in the basement. But maybe that comes full circle and helps us out here. Well, Tom, you've painted a pretty interesting picture of two incredible shifts that we could see, if not from encrypting ransomware to extortion ransomware and only the big deep-pocketed folks getting hit.

30:12James Wilson: That'd be one nice outcome to see, but also the idea of maybe, just maybe, we don't only start to see better secure from the get-go and by design or by intent or by harness, but maybe the liability shifts to make that really important. It's been an awesome read this week for the newsletter. Thank you very much, mate. I really enjoyed it.

30:30Tom Uren: Thanks, James.