Srsly Risky Biz: The ritual bitcoin sacrifices will continue until security improves

0:03Amberleigh Jack: Hey everyone and welcome along to Seriously Rescue Biz. This is our podcast all about cybersecurity policy and intelligence. My name is Amberleigh Jack and very shortly I'll bring in Tom Uren, our policy and intelligence editor, and we're going to have a bit of a chat about Tom's Seriously Rescue Biz newsletter that he has published this week. You can of course read and subscribe to Tom's newsletter over at our website risky.biz. But before we jump into that, I'd like to thank this week's sponsor, which is Sublime Security. And you can find them at sublime.security. Tom, it's great to see you again.

0:35Tom Uren: G'day, Emily. How are you?

0:36Amberleigh Jack: Feeling quite grateful, actually, that my money is sitting safely in an old-fashioned bank at the moment. Let's talk about finance being hacked for billions. I never thought I'd say, Tom, that last year's Bybit$1.5 billion hack feels a little bit cute. But North Korea sort of scuttled off with, what was it,$6.3 billion in this Binance hack. Tell me how this happened, I guess, to start with.

1:09Tom Uren: So it happened the usual way in that someone got compromised. So Binance has come out with an incident response post on Twitter. and they said that there was an initial compromise based on an engineer installing a malicious version of Homebrew, which is a package manager. Yep. And the engineer picked that up from malvertising. So that did not go very far. It was cleaned up pretty quickly, but apparently the North Koreans got a bit of intel about the org chart and who was important and had the authorities to do particular things. So as this is going on, it seems like constantly Binance is being attacked by North Korea.

2:00Tom Uren: They reckon that there was 57 attempts this year that have been foiled by Binance. Yeah. Social engineering attempts, interview attempts, different types of malware. Yeah. And they've been picked up and repelled, detected, remediated. But eventually a second, one of these got through. So the way Binance describes it, it was a very sophisticated fake interview attempt. And I mean, the tendency is for companies to always play up the sophistication of things that they've fallen for. In this case, it was a two round interview. the HR person showed a social media account personal photos I think that regardless of Binance's motivations to play up how sophisticated it was North Koreans are actually pretty good at this they do this all the time it's their bread and butter they're using fake interviews not only to try and install malware onto people's devices but also to get jobs so it's a thing that they've had a lot of practice in, I'm not really surprised at all that someone would eventually fall for it.

3:12Amberleigh Jack: Yeah. And that's the thing, right? I mean, for North Korea, I guess 57 attempts is nothing when the one successful one lands you a$6 billion payday. Yeah.

3:22Tom Uren: Yeah. And I think this is also in the context of their broader program. They've got the IT worker program where they're sending people on interviews all the time. So they've got the techniques and technology to appear to be a live video person. They would over time figure out, you know, these are the things that we need to do to appear legit. And so it's not just they pulled it off the one time. It's continual practice. What went wrong? How can we improve? Not at all surprising that you would eventually be successful. And so in this particular case, again, it's the coding challenge where they say, we've got this coding challenge install this piece of software and run it and see how you go and like that works and so actually not at all surprised uh there's a bit where they talk about how they immediately knew where they wanted to go because of the previous breach the one that had been detected and remediated and somehow they were able to get control of two other devices which they kind of skip over but and they mentioned an internal ai tool that was used for that and i'm like what

4:39Amberleigh Jack: what's going on is this the magic mysterious step two that's right yeah something with an ai agent

4:45Tom Uren: money yeah so there's a number of problems there like why was an engineer using their corporate laptop for an interview you would think that you would set aside uh have a bit of separation have a corporate laptop that you only use for work especially when you've got control over like Like apparently this engineer and a couple of others had the ability to move billions of dollars of Binance's money somewhere else without any checks or balances. Seems like you would lock that laptop up and use it only for particular purposes. Very strange.

5:17Amberleigh Jack: Yeah.

5:17Tom Uren: Anyway, regardless of Binance's security posture, what struck out to me or stuck out to me was the former, well, he's the founder, Changping Zhao CZ, he's commonly known as. He was actually indicted for money laundering and President Trump pardoned him. But part of the conditions of his sentencing was that he's not allowed to have anything to do with Binance. He's been very vocal about what's going on at Binance, curiously. And he said what this is is really a warning to the financial system writ large, not just to cryptocurrency exchanges.

6:00Amberleigh Jack: I wanted to ask you about that, Tom, because you've also got a line from him in the newsletter here. If a crypto exchange can be hacked, banks are in a worse position, in my opinion. Now, that's from CZ. That sounds ridiculous to me. Please explain.

6:15Tom Uren: I think the intent was for him to scare everyone and put Binance into some sort of, you know, perspective of, oh, if we can be hacked, anyone can be hacked. And I think probably, like, very, very narrowly, yes, banks are susceptible to hacking. my understanding from talking to people is that cryptocurrency exchanges understandably are concerned about security because they're being attacked all the time and they've got money and you can typically organizations like that have good security because they understand the threat they're attacked all the time they know they need to prioritize it it's not something that they can just ignore and it won't be a problem so i think in that sense he's probably right in that binance probably does have a better security posture than many, many banks.

7:09Tom Uren: Like there's probably hundreds of thousands of banks in the world. You can imagine that the top banks are actually pretty secure for those same reasons. But there's banks in Pakistan, Bangladesh, other countries where the internet has historically been less well-developed that are probably less secure.

7:30Amberleigh Jack: But you're still not going to... I mean, the hacking aside, you're still not going to get away with the kind of money as quickly and as easily. Yes, I think that's what I really take issue with.

7:42Tom Uren: You've hit exactly upon what I like. His sentence, if you think about it narrowly, yes, banks can be hacked. Yes, that's right. Are banks hacked and billions of dollars stolen? No, never. And I think the proof of the pudding is that North Korea is the actor which does this. They're not going around. They're not pursuing a mixed strategy of some real banks, some cryptocurrency exchanges. It's all crypto. So the last big real bank that they stole money from was back in almost over a decade ago, 2016. And that was the Bangladesh Central Bank. and i think it really illustrates why they don't attack banks they successfully stole a billion dollars perhaps adjusting for inflation maybe that's in the same order as this hack right it's it's not a 10 times difference but they only got away with in the end less than 10 percent so mostly what happened is that banks are a community they trust each other and they can unwind transactions so they just send the money back and so it's very difficult to very quickly steal money out of a bank and get it laundered so that it's unrecoverable yeah actually leave with it and so when he says that banks are just as vulnerable all the evidence is that no they're not just as vulnerable because otherwise north korea would be hacking them and making off with billions of and they clearly do not do that.

9:20To me, that's the message is that cryptocurrency,

9:24Tom Uren: it's fantastic for North Korea, but it's also fantastic for the rest of us in that they are sophisticated hackers. They do pull off very clever hacks. I think it would be terrible if they were actually going after real banks because then people would be losing money. As it is, they're going after, I would call cryptocurrency a speculative investment. If you're investing in cryptocurrency, you should be prepared to lose that money. And also those firms are highly incentivized to cover everyone because they get hacked all the time. They would go out of business if people lost trust in them. So Binance has pretty much said, yeah, no one's going to lose any money.

10:10Tom Uren: We're going to cover it.

10:12Amberleigh Jack: thank you for your sacrifice thank you for your service meanwhile tom uh tech executives are really sort of feeling the pressure of ai to speed up software development and and keep ahead of the competition and you've sort of taken a look at this and it's kind of been highlighted this week with a specific report from 404 with ProtonMail. Now, Tom, tell me about this Proton CEO's interesting approach to security that was published this week.

10:48Tom Uren: Yeah, so the story is Proton originally started out as ProtonMail. It's a security and privacy focused service that you can pay for. So it is kind of turning into a privacy focused equivalent of the Google WorkSuite. It's not as feature-rich or complete, but you pay for it and in exchange for paying for it, you don't get spied on. That would be the pitch.

11:16Amberleigh Jack: So it's the kind of thing you sign up when you expect security and privacy to be a top priority.

11:22Tom Uren: Exactly. Gotcha. And so 404 Media has published this report based on interviews and Slack messages and internal documents that someone gave them And it is really the tension between – it displays the tension between moving fast and being secure. And so the article talks about how the CEO, Andy Yen, is saying things like when people want to test new code, he's saying faster, faster, faster. It's possible to be fast and secure. stop thinking always of how to be slower and focus more on how to be faster. And he's described the idea of slowing down to do testing as loser thinking. So I thought this was -

12:15Amberleigh Jack: Tom, did that go down well with Proton's customers? Just out of interest?

12:18Tom Uren: Oh, yeah. Well, okay. So no, obviously not. So I think this is, it really does illustrate one of the strong driving forces. So 404 also talks about an internal document which says that Proton was not going to meet its annual revenue target due to insufficient velocity, is the phrase they used. And by all metrics that matter, we are an underperforming company. I mean, a lot of customers are saying, why do you need to perform? We just want a secure product. What's the driver to grow like that? Which I think is a statement about capitalism more than it is about security. or well it really is a statement about the tension between capitalism and security the drive to make money but i think this drive is not unique to proton at all yeah i think it's an interesting company because it is one that is explicitly privacy focused and so i feel like that's a universal pressure.

13:24Tom Uren: So also this week, Amazon, Michael Turkowitz, who's the VP for worldwide Amazon stores, he basically acknowledged the same motivation. We all need to embrace this change and take the time to learn. He's talking about adopting AI for coding, or we risk being left behind. So that's exactly the same that Proton management is expressing. If we don't move faster, we're going to get left behind and we've got no future. And so given the choice between being more secure and being out of business, like, well, actually, that doesn't seem like much of a choice, even if you do care about security, I think.

14:05Amberleigh Jack: Although Amazon, reading through your newsletter, you know, Amazon, it sort of looks like they're going to be fine. They're not quite sure, but they're in the process of figuring out how it's best going to work.

14:16Tom Uren: Amazon, AWS in particular, has spoken about security culture. And so its security teams report directly to the CEO. And it has a particular program where it distributes, I guess, security advocates throughout all their product teams. And those teams are explicitly responsible for the security of their products. So I imagine that they'll be all right. And in fact, I actually think that Proton will probably be okay because the consumer backlash, they'll need to refocus around what they're really selling, which is privacy and security. They're not in the business of selling speed. But I think that this illustrates a fundamental tension.

14:57Tom Uren: like if you uh everyone is adopting ai has adopted ai to code and it is unclear how to code faster and securely at the same time so that is also part of turkowitz's memo is that we're adopting this but we're adopting it at different rates we're not sure what best practices really look like and even if we knew best practices today that may not be relevant in six months time or a year or two years. So I think there really is a dilemma between we need to move fast. We need to also be secure. How do we do that? We don't know. We're trying to figure it out. And I think there's a space for effort to spell out what does that look like?

15:47Tom Uren: So we've got a very few companies, just a few small examples saying we're adopting AI to make our products more secure. This is how we're doing it. These are the pipelines. I'm thinking in particular of Google Chrome, which has spoken about that. Other companies have come out with different efforts to try and do the same thing. I'm kind of worried that other companies with less scale are just moving fast and not taking security into account. Because if you don't care about security, having AI turn up, I don't think it changes your attitudes at all. It just means you can code faster.

16:28Amberleigh Jack: Yeah. You've sort of summed that up perfectly at the end of your newsletter here. We think the main lesson here is a simple one. The companies that suck at security will continue to suck at security, but faster. The companies that take this stuff seriously will probably do well. And I guess that's kind of the takeaway here?

16:47Tom Uren: Yeah, I think the boosters of AI will say that at some point, AI will get good at writing code that is secure. I think that that may happen. I don't know. But in the meantime, it's worth applying pressure, I guess, incentives, encouragement, guidance on how companies should be using AI to write more secure code.

17:11Amberleigh Jack: On that note, Tom, we will leave it there. But thank you so much again for for joining me it's always a pleasure and you can of course read and subscribe to tom's newsletter seriously rescue business over at our website rescue.biz but tom have a great week and we'll catch you same time next week thanks amberley