Adrian Sanabria (@[email protected])

🏢 The Defenders Initiative,
🎙️ @secweekly,
🤝 @bsidesknoxville,
🗣️ @IANS_Security,
💥 Destroyed by Breach,
💀 I am 70 apocalypses old.

[Adrian Sanabria (@[email protected]) @sawaba]

I've been working on a talk tentatively titled "Myths and Lies in InfoSec"

Some of the research I'll be referencing in the talk was inspired by one particular stat: "60% of small businesses go out of business within 6 months of a data breach"

How do we know a stat is fake? 🧵⏲️

[Brett Callow @BrettCallow]

Anybody know where this iffy stat came from? I’ve seen it attributed to several organizations, but its actual origin remains murky.

[Adrian Sanabria (@[email protected]) @sawaba]

@MikeTalonNYC @UK_Daniel_Card @TimMedin Haha

[Adrian Sanabria (@[email protected]) @sawaba]

@UK_Daniel_Card @TimMedin And they've corrected the CVSS score. Attack vector is now LOCAL and user interaction is required.

I'm guessing this translates to "open this malicious file with ms paint"

That's VERY different from "RCE with no creds or user interaction"

[Adrian Sanabria (@[email protected]) @sawaba]

@UK_Daniel_Card @TimMedin The only time I saw it talk on the network was when I logged into the Copilot feature (which generates images and pulls them into paint, I can't imagine why it would need a local network listener)

[Adrian Sanabria (@[email protected]) @sawaba]

@UK_Daniel_Card @TimMedin I spent way too much time poking at MSPaint today. It's not listening on any ports by default, and even if it did, the Windows firewall still defaults to blocking

MSPaint does have Copilot built in, and I don't have a Copilot license, so maybe the vuln is there?

[Ryan McGeehan @Magoo]

I did a whole lot of IR last month. Much of it was helping companies affected by compromises at their neocloud providers.

I wrote up the lessons and practical steps teams can take to reduce their exposure and make incident response less painful.

https://t.co/PNvxsYzGUk

[Adrian Sanabria (@[email protected]) @sawaba]

@UK_Daniel_Card @ramimacisabird It's nice (again, not for the folks on the list) that enough people know about Destroyed by Breach that people spot these incidents and report them to me!

[Adrian Sanabria (@[email protected]) @sawaba]

Had an excellent convo with @caseyjohnellis on the podcast this week

Can't think of a better time to discuss the state of vuln discovery and disclosure.

Can't think of a better person to discuss it with.

https://t.co/L2XvIBWXKn

[Doxxnet @DoxxnetHQ]

What does it take to build a parallel internet? @BarrettLyon joins Enterprise Security Weekly to discuss private connectivity, network infrastructure, and security buzzwords worth retiring.

🎧 Listen: https://t.co/3KXSFSLps9

[Barrett Lyon @BarrettLyon]

This was fun. Thanks for having me on @sawaba @coffeewithayman @txs @PyroTek3 !

[Adrian Sanabria (@[email protected]) @sawaba]

@JasonDClinton @RothRottweiler Vulnzero is pointless unless we first solve asset management, remediation difficulties, vendor management, etc

Companies are largely getting hacked through code they didn't write and have little control over. Zero vulns in their own code doesn't move the needle.

[Adrian Sanabria (@[email protected]) @sawaba]

@TimHaines @feross definitely an open question now

[Adrian Sanabria (@[email protected]) @sawaba]

@mattjay @feross @SocketSecurity I think they might have just risked not being trusted with pre-disclosure information in the future

[Adrian Sanabria (@[email protected]) @sawaba]

@robertgraham Jurassic Park. Very different from the movie. Seems more prescient every time, like every re-watch of Office Space or Idiocracy.

[Adrian Sanabria (@[email protected]) @sawaba]

@blackroomsec @UK_Daniel_Card That said, AI worms taking over hardware and spreading like Mirai is absolutely possible but I'd almost be less worried about it than deterministic botnets because you can be like

"stop it"

and it will say

"you're totally right to call that out"

[Adrian Sanabria (@[email protected]) @sawaba]

@blackroomsec @UK_Daniel_Card I don't think they're conflating anything, they just didn't think it through. If I was going to pitch AI IoT worms with distributed inference, I'd pick an IoT device with a lot more compute and storage, like a DVR or a NAS.

Choosing smartTVs makes it hard to take seriously

[Adrian Sanabria (@[email protected]) @sawaba]

@UK_Daniel_Card @blackroomsec Exactly - proxy relay is an ideal use case. If it goes offline, no problem. Small workloads the user of the tablet would never notice

but Anthropic is like, AI is gonna do the equivalent of playing GTA6 on your 1Ghz, dual core, 1GB RAM smart TV while you're streaming Hulu

[Adrian Sanabria (@[email protected]) @sawaba]

@blackroomsec @UK_Daniel_Card These things are designed with the bare minimum compute necessary to stream Netflix - the idea they have the additional capacity for LLM inference is laughable.

IoT devices are attractive for botnets because sending network packets can be scaled to where it isn't noticeable

[Adrian Sanabria (@[email protected]) @sawaba]

@blackroomsec @UK_Daniel_Card The average smart TV has way less RAM and only a tiny fraction of that RAM will be usable by an inference engine if the idea is for the worm to not completely brick the IoT device in the process (which would likely get it turned off)

[Adrian Sanabria (@[email protected]) @sawaba]

@blackroomsec @UK_Daniel_Card It is pure vibe-hypothecized fantasy. No one tested or built anything with smart TVs. The assumptions and estimations are also wrong.

[Adrian Sanabria (@[email protected]) @sawaba]

@anton_chuvakin That's what the evidence suggests, yes.