Security Serengeti

This week we discuss serving lawsuits using the Blockchain, the SEC's poor Twitter security practices, LLM's as bug hunters, and an update to the 23andMe saga!

Article 1 - Here’s Some Bitcoin: Oh, and You’ve Been Served!
Supporting Articles:
email-on-blockchain
Court Grills Government Over $86M FBI Raid On Security Deposit Boxes

Article 2 - After hack, X claims SEC failed to use two-factor authentication
Supporting Articles:
Capacity Enhancement Guide

Article 3 - How AI hallucinations are making bug hunting harder

Article 4 - 23andMe blames “negligent” breach victims, says it’s their own fault

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

This week David and Matthew sit down to discuss Modern SOC, as defined by Netflix, Facebook, Meta (and more!), and described by Anton Chuvakin.  

We talk about what constitutes "SOC Classic" and "New SOC", some pros and cons, and finally, a 6 step mid-level plan (over a couple of years) to get there.  

Original Article that sparked the conversation - WTH is Modern SOC, Part 1

We HIGHLY recommend reading the article and the many, many, internal links.  There's an enormous amount of information behind that single link.

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

This week we discuss Microsoft shutting down a bot network that created millions of fraudulent accounts, the coming AI Drone Overlords, OAuth Abuse, and 23andMe losing 5.5 million folks genetic information.

Article 1 - Microsoft seizes infrastructure of top cybercrime group
Supporting Articles:
Disrupting the gateway services to cybercrime

Article 2 - A.I.-controlled killer drones become reality
Supporting Articles:
Kill Decision by Daniel Suarez

Article 3 - Threat actors misuse OAuth applications to automate financially driven attacks

Article 4 - 23andMe says, er, actually some genetic and health data might have been accessed in recent breach

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

This week we did something a little different.  There's been a list of Security GPT's that's been making the rounds, so we tested a few of them, and checked out the custom GPT creation functionality, and tried to create a custom SerengetiSecGPT to provide information about the podcast!

Links:
Awesome GPTs (Agents) for Cybersecurity
Introducing GPTs

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

This week we talk about a Ransomware gang reporting a victim to the SEC, the CyberSecurity Skills shortage is not what it seems to be, and the disconnect between Threat Intelligence and Detection Engineering.

Late breaking news article about Microsoft Defender for Endpoint adding Deception

Article 1 - Ransomware gang files SEC complaint over victim’s undisclosed breach

Article 2 - A Simple SOAR Adoption Maturity Model

Article 3 - Cybersecurity talent shortage: not the lack of people, but the lack of the right people

Article 4 - Frameworks for DE-Friendly CTI (Part 5)

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

We had originally planned on a discussion about Threat Intel AI this week, but after some discussions with a few vendors, I don't think that the current "state of the art" is worth discussing yet.  Still Alpha products.

So instead, there were a couple of really big announcements this week, so we discuss those in some depth.  We will get back to Threat Intel next episode! 

Article 1 - SEC Charges SolarWinds and Chief Information Security Officer with Fraud, Internal Control Failures
Supporting Articles:
SEC sues SolarWinds and CISO, says they ignored flaws that led to major hack

Article 2 - FACT SHEET: President Biden Issues Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence
Supporting Articles:
Cyber pros praise Biden executive order on artificial intelligence
Eliezer Yudkowsky on the Dangers of AI
Your phone vs. Supercomputers
Why Biden’s AI Executive Order Only Goes So Far

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

This week we discuss Malware stored on the Blockchain (coming soon to a theater near you!), how to stop Heroes in your SOC (common discussion topic amongst villains!), US Gov requesting governments stop paying ransoms, and a slightly over excited paper on using ciphers to bypass alignment restrictions in LLMs.  

I actually personally found the language issues introduced by chatting with LLMs in ciphertext more interesting personally, but...

Article 1 - The Fake Browser Update Scam Gets a Makeover

Article 2 - How to Banish Heroes from Your SOC?
Supporting Articles:
Does Your Company Lurch from Crisis to Crisis?
Delivering Security at Scale: From Artisanal to Industrial
6 ways to keep your top performers from jumping ship

Article 3 - The US wants governments to commit to not paying ransoms

Article 4 - GPT-4 IS TOO SMART TO BE SAFE: STEALTHY CHAT WITH LLMS VIA CIPHER
Supporting Articles:
Manna: Two Visions of Humanity's Future

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

This week we discuss Avogadro Corp - The Singularity is Closer Than You Think.  This book, written in 2011, was very prescient, and predicted a number of things that AI seems capable of, or on the cusp of, doing.  We re-read the book, and go through some security related discussions on how to prevent the corporate takeover that occurs in the book, and then talk about the most and least believable capabilities of ELOPe.  Spoilers abound, but we tried to stay away from them.  If you truly care about spoilers, read the book first!

Supporting Articles:

Amazon.com - Avogadro Corp: The Singularity is Closer Than It Appears
Introducing Microsoft 365 Copilot
OpenAI Chat GPT Solved Problem with TaskRabbit - Business Insider Article
How Many Emails are Sent Per Day - Zippia Article
Number of Text Messages in the United States - Statista Article

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

Title 1: Russian infosec boss gets nine years for $100M insider-trading caper using stolen data

Summary: Vladislav Klyushin, owner of Russian firm M-13, was sentenced to nine years in the US for stealing corporate financial data and making $93 million through insider trading. He was only arrested because he flew to Switzerland for a Family Holiday. His four co-conspirators are still out there, probably still hacking.

Supporting Articles:

• US Justice Department Article
  
• SEC Complaint Document
  
• ZDNet Article on SEC Data Breach
  

Title 2: FBI, CISA Issue Joint Warning on 'Snatch' Ransomware-as-a-Service

Summary: The FBI and CISA issue an advisory on the Snatch ransomware-as-a-service operation, highlighting its targeting of critical infrastructures and unique ability to force Windows systems to reboot in Safe Mode, evading antivirus detection.

Supporting Articles:

• 
  
• DarkReading Article
  

Title 3: Retool blames breach on Google Authenticator MFA cloud sync feature

Summary: Retool suffered a security breach after attackers compromised 27 cloud accounts through social engineering, exploiting a new Google Authenticator feature. This breach may be linked to the theft of $15 million from Fortress Trust.

Supporting Articles:

• 
  
• ArsTechnica Article
  

Title 4: Centaurs and Cyborgs on the Jagged Frontier

Summary: Wharton School of Business partnered with BCG to conduct an experiment on the efficiency of consultants using ChatGPT 4. AI-assisted tasks were completed faster and rated higher. The impact varied based on skill level, and the article discusses the implications of AI in the workforce.

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

Today we take a look at some tools that provide "Detection Posture Management", which is the fanciest way I found to describe it.  These tools provide content for SIEMS, a Management Platform, data validation, and make SIEM engineering easier.  We take a look at three vendors, do some comparison and contrasting, and discuss the overall capabilities of these tools.

Vendor 1 - Cardinal Ops

Vendor 2 - SOC Prime

Vendor 3 - Anvilogic

Supporting Links:
Hype Cycle for Security Operations, 2023
Can We Have “Detection as Code”?
Detection as Code: How To Embed Threat Detection into Code

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!