Cybersecurity today, we'd like to thank Meter for their support in bringing you.
This podcast Meter delivers a complete networking stack, wired, wireless and
cellular in one integrated solution that's built for performance and scale.
You can find them at meter.com/cst.
We've got an interview for you this week following up on an interesting story about
a malware that was authored by an ai.
It certainly wasn't the first malware that's been written using
ai, but it was a little different.
Now, just to refresh your memory, here's the story I did.
It's only a couple of minutes long.
Void.
Link appears to be one of the first clearly documented cases of
advanced malware authored almost entirely by artificial intelligence.
Checkpoint says void.
Link represents a break from earlier example of AI assisted malware, which
were usually tied to inexperienced threat actors, or simple rewrites
of existing open source tools.
In contrast, they say void.
Link shows evidence of structured engineering, including documented
development sprints and coding guidelines suggesting deliberate disciplined design
rather than simple experimentation.
what makes this discovery unusual is how early it happened.
Researchers believe they caught Void Link largely by chance after a compiled
test version was uploaded to virus.
Total, very early in development, One recovered artifact timestamped.
December four, roughly a week after the project appears to have begun,
shows the framework already functional with more than 88,000 lines of code,
That early submission gave the defenders a rare look inside the project.
That likely would've been far harder to analyze once it was fully operational.
Checkpoint notes that while the project was presented as a 30 week engineering
effort, the available evidence suggests it was built much faster.
Highlighting how AI can dramatically compress development timelines for even
complex malware, and despite the listings of various teams in the documents, it's
quite likely according to Checkpoint, that this was actually done with
AI and perhaps a single individual.
So the concern isn't just speed.
It's also originality and technical innovation.
This wasn't a remix of known tools.
It was a custom framework produced that scale.
This doesn't mean that AI written malware is suddenly everywhere, but Void.
Link shows what happens when capable developers use AI as a force multiplier,
shrinking the time between concept and deployment, and leaving defenders with far
less warning than they might be used to.
we put a link to the checkpoint paper in our show notes.
Check tech newsday.com or do ca under podcasts, and we've reached out
to Checkpoint to see if we can get an interview for our weekend show.
And thanks to a very responsive PR person at Checkpoint, I was able to
get an interview with the researcher who found the malware and the head of
the team, because as you'll find out, this is pretty much a team effort,
it not only gives you some deeper insight into the story, but I think
it might give you an idea of how some of this type of research is done.
My guests are Pedro Dremmel, who heads the cyber crime research
team at Checkpoint and Ro, who is a security researcher based in Vienna.
Sven is on Pedro's team and did the initial research.
I reached them on Friday morning, my time, which is late
afternoon for them on Friday.
Thanks for sticking around guys, and we'll jump into the discussion.
My name is Pedro Dral and I'm, team leader at the best research team at Checkpoint.
we call ourselves the Cybercrime Research Team, which is Venice part of.
And, we basically, track, emerging threads.
We try to find, new potentially unknown threads, that we
can learn for that we can.
Better provide protections to our customers and also through, our
research community, via our blog and also at, security conferences.
Great.
What's your role at Checkpoint?
sure.
Yeah.
I'm a security researcher at Checkpoint.
I joined just a few months ago, before I've been working on offensive security.
So I've seen, I've written malware, I've used malware, and I'm on the other side.
I'm hunting malware and I don't emulate for actors anymore.
I hunt for them basically.
I can't let you get away with that.
you used malware, now you're hunting malware.
Tell me more about that.
Yeah, so before doing the security research of Fred Research at Checkpoint,
I was doing pen testing and red teaming.
So essentially, yeah, emulating the bad guys.
and we, of course, we wrote a lot of malware because we have to
simulate what the Fred actors do.
so I, I know both sides, of the spectrum.
It's an interesting thing.
I have other friends who are researchers and they say the same thing and one
of them was talking about you can, and it's, she's not going to, but
you can almost get sucked into the mentality because you have to start
to think like they do to do research.
that fair?
Is that a fair comment?
I would say so, yeah.
It definitely helps to know how the other side looks like.
Yeah.
Pedro, somebody told me you were with.
Blackberry at one point.
you've had a fairly long career.
I was.
Exactly.
Yeah.
I was, I even, was part of the Blackberry security team when
they use it to sell, cell phones.
initially it was, mal analysts at the, Blackberry Security search team.
So basically analyzing potentially mware uploaded to the Blackberry store.
when it was introduced to Blackberry 10?
Not sure if you remember, like earlier around 2012.
Remember?
I remember it thoroughly.
I did a lot of work with Blackberry myself.
Yeah.
it was, we had some, it was an amazing team we had out there.
It was really good.
and later also rejoined when Blackberry hired Silence, which
was a, And AV engine sort of thing.
but that was, the research was different.
It's pretty, pretty similar to, to, to the research we currently conduct here,
which is more understanding the landscape.
So in a nutshell, but initially, yeah, my first time was as a
MO analyst, so pretty much.
We, evaluated apps submitted to the Blackberry store, trying to find signs
of malicious activities, any sort of malware or any app that was, behaving,
in a way that was unintended for privacy reasons, for example, leaking your phone
number, your contacts and stuff like that.
So it's a bit a mix of looking for signs of malicious activity and also privacy
related concerns on the Black Bear store.
I
gotta bring you back and talk about apps at one point, but let's
talk about Void Link right now.
But before we, we get dive into Void Link and I do wanna do that.
I can you share with our audience what your job is like, what you know,
what you do in this research area.
it's very creative and I don't think there's a definite answer to that because
every researcher has their own style.
so essentially the goal of my role is to find interesting campaigns,
interesting malwares, interesting stories, so to speak, in the cyber
crime ecosystem, and then analyze them.
easily with like in the technical analysis, into it, and then, wrap it
up in an article that is potentially interesting, for the community to read.
this of course has the byproduct of improving our products, right?
Because Checkpoint also does detection products and so on.
but mainly it's about, finding new interesting campaigns in
new malware and how to do.
Completely, undefined so everybody can do what they want, so to speak.
the classic way would be to use, something like virus total, right?
Which is like a crowdsource repository of, or a feed of malware where everybody
can submit malware and you can.
You can filter these samples and you can look for interesting samples,
depending on some capabilities of the binary or whatever.
and then hope to find something interesting.
But you can also, for example.
look for ways that Fred actors could distribute Myra, right?
Because recently we looked at, the YouTube Ghost Network, which was a network of
compromised YouTube accounts and these YouTube accounts uploaded videos with Lu
to, to fake installers for software, for example, a correct Photoshop version,
free download, Photoshop, and so on.
And this would be another approach to find a malware campaign, uncover
the actors behind it, uncover the malware behind it, and so on.
But, yeah, the possibilities are really endless and it's
what's, so fun about this job.
We covered that, and I'll go back to my reminder to anybody
or to our security audiences.
you have to reinforce the people that they don't find their software on YouTube.
They can research it there, but for God's sakes, don't download it.
Yeah, you can read our article then, what's, what's expected.
And I can second the van's opinion on this because every researcher
we have, it's ultimately today.
Most interest area they have a passion for, and that's why they usually
find the most interesting stuff.
So we of course, try to use similar systems and similar tools and everything,
but at the end of the day, the researcher passion and, the way they
think about a given specific topic is what ultimately matters to finding,
these new stories, these new tools.
And the reason I wanted to say that is, and I've had a long history.
I know the people at Checkpoint very well.
and so I'm not, but our audience is the most suspicious about vendors.
They always are.
They always will be.
That's just the way it's going to be, but.
The research areas are largely independent in my understanding and
produce the research, yes, to improve the product, but also to inform the public.
And so I think, we want to enter it with that piece.
now if it happens to be that makes your product better good for everybody.
, and the reason I've prepped this so much is because it is a pretty bold
claim to say that that the era of advanced AI generated malware has begun.
That title got me, and then I started to dig, I went, these
guys might be right, and I've been following this for quite some time.
Can you tell me what Void Link is, first of all?
and then we'll jump from there.
Yeah, sure.
so Void Link is, a Linux malware.
So maybe I can tell the story how I found it because it's also funny.
That'd be great.
so essentially I was doing what I said earlier, I was looking on virus total.
Through various, hunting route, looking for suspicious binaries.
And my goal that I set myself was to find some interesting in no malware
because, most malware is based on Windows.
Linux has a little bit less of a share in the malware ecosystem.
but it doesn't mean that there's no interest in Linux malware.
So I set up for the Quest to basically find something interesting, and then.
I had a rule which was looking for like root kit components and there
were a few samples coming in each day.
I was looking at them.
and mostly it's just like open source malware compiled
and uploaded to Vivir total.
So it was not interesting, but this one binary stood out, which was the
voiding binary, and there were a few things that were special about.
So the first thing was it was written in a very unorthodox programming
language, which is Zig, it's like a rather new systems programming language.
this was the first thing that popped out to me because it was very unusual.
And then I, decided to analyze it further.
And it had the really big feature set.
Like it had loads of different modules.
It had the plugin system, it had a development, API for plugins.
It was very modular, it was very well engineered.
And also it had this Cloud and container focused that you very rarely see.
So it had like modules for enumerating, different cloud providers for moving
laterally in container ecosystems.
and in addition to that, it had multiple root kits, like not one root kit, but
multiple root grids, integrated into it.
It had a focus on EDR detection and EDR evasion.
And now that might not be special if you're talking on Windows malware.
But on Linux, the EDR ecosystem is not as sophisticated as it is on Windows and it's
not as prevalent to find EDRs on Linux systems, especially container systems.
So this was also very special.
Like this malware was engineered specifically to
evade security products on ux.
All these components together were like, very special.
and you can say there's nothing really groundbreaking, like there's
not a new technique, in this whole framework, but it's just very well
engineered and, it has a lots of features and that's what stood out.
yeah, and the part of the cloud as well was something that stood out right then
where it's not very common, even on the Windows side, especially because
then it would, target potentially software developers that, that use
their, development, environment on a daily basis, which could lead to
potentially more interesting attacks.
So the victims was also.
More widespread and we didn't really know which victim could
be at our first analysis.
Right?
Yeah, exactly.
, If you found it, there's evidence that people are trying to use it.
is that fair?
it's not really clear because.
Oftentimes you find malware developers uploading binaries to various
total, because various total also shows this, this statistic, how
many engines detected in malware.
So it's a classic way you're writing a malware, you're
uploading it to various total.
It has five detections out of, I don't know, 40 engines.
and then you as a developer, okay, I have to refine this because I want
zero detections, or, the product that I want to detect doesn't detect it.
According to the scanner.
So it's fine.
So you, it doesn't mean it was found in the wild.
It could at well be, yeah.
That the developer himself or herself uploaded it.
So you found a piece that developers were working on and they're testing it out
to see using virus total to test it out.
likely you, we, you don't know, right?
It could be somebody found it on the internet, somebody was
infected, could also be possible.
You don't know, but.
At the same time, it doesn't mean somebody was infected.
Ven and virus Total.
Yeah.
okay.
It could be coming from anywhere.
So how did you know it was, you've, and we've said this
before, it was sophisticated.
It had a number of modules, had a lot of functions that it could do.
It had a, a real architecture to it.
And I can't, I.
Display of its architecture.
It's pretty sophisticated.
How did you know it was AI generated?
Yeah, that's where the funny part of the story comes in.
so I felt the malware, it had a string, like it's a piece of text in it, which
said void link implant core version 3.0.
So this was suggesting to me, okay, version 3.0, this
is sophisticated framework.
It's a big framework.
It's already in deferred iteration, and I've never heard about it before.
I'm onto something big, I was, analyzing it, so I was writing down
my notes for the technical analysis.
And at the same time, also because in the malware, usually you have.
Baked in the IP of a commander control server, right?
The server connects back to, so I was also looking at the server and you could
pull the new versions from it basically.
so I pulled up new versions and it had even more features than yesterday,
and I analyzed this and I could barely keep up because the next day
they implemented even more features.
so I was bled like how fast they can actually develop this thing.
Then I gave the IP to our, threat intelligence team, and I said,
Hey, can you please monitor this?
Because I'm going on Christmas vacation now, and I was two
weeks on Christmas vacation.
I was like, ah, man, I hope no one publishes about this before we do this.
Really interesting.
I couldn't wait to get back to work.
And then I got back to work and basically our threat intelligence team
was like, Hey man, glad you're back because we have, Access to the panel.
So the command and control panel that, the actors would use.
We have the source code.
We have 37 plugins downloaded, and we have the documentation for the framework.
because the threat actor or the developer of avoid linked editor,
very big mistake, which was.
For a small window in time, they had, their server open unauthenticated,
so you could access the web panel where you would, administer void link.
And they also had the misconfiguration in their server, which is called an
open directory, which essentially just means you could list all the files
on that server and download them.
And in there was the source code, there was the documentation, the
plugins, and basically everything.
From this documentation to come back to your original question,
we could infer that it was, yeah.
In fact, completely written by ai.
and part of what I was reading through your paper, you said that it looked,
it had all of these different teams and all of these different stages and stages
of development, but basically had done this work in next to no time at all.
So it became obvious that it was AI developed.
And do you have an idea of how many developers they have working on it?
We're pretty much sure that it's one developer.
and that's the crazy thing.
we initially, we were like, we read the documentation where it says
there's three teams working on this.
and it's like in sprints, like sprint one, implement this and that week
10, implement this and that feature.
So this is all very thoroughly documented.
So we fell into the trap and we thought, oh, this is like a team of developers.
But then we realized the timeline in this documentation doesn't.
Match the extra development pace at all because I pulled the binaries and
they were moving much quicker than it was implied in this documentation.
So something weird was going on.
and then.
Essentially we found out that this documentation was just the documentation
that the developer gave to an AI agent.
And this AI agent is then simulating these teams.
So basically, running through the documentation and implementing
the framework by itself according to the specifications.
This is known as spec driven development.
it's a software development methodology and it's basically how
modern software development works.
but yeah, looking at the timestamps, we then realized this whole thing
has been written in six days.
So
what you're saying is one of the thing, and as a former development guy myself,
one of the things you're saying is your suspicion was raised because they
actually adequately documented it.
Basically.
Basically
the
interest.
I joke, but I've spent a lot of time trying to get people to document
their work and these guys seem to have done a pretty good job at it.
Yeah, the thing is that Gwen is Van left for vacation and was, going through the,
all the analysis and everything, we had one idea where, oh, maybe they could
be creating a new competitor for other MAR frameworks as a commercial product.
They could be potentially be associated with nation state as
well, given how advanced it was.
How, maybe a big group was creating this.
And then when we were found, it was AI created and likely a single author
that was like, okay, that fooled us because we thought could be something
fully, advanced by a big group.
And at end of the day, it was very likely just single, individual creating it.
I would say that AI fooled us as researchers as well in our
initial thoughts, before we had access to the remaining, of
the source code and everything.
So just to recap the you found this, it's interesting, the
thank heaven the developer is.
Sloppy on their own server and leaves it open so that you can get this.
'cause otherwise you may not have seen this type of window.
And that was the thing that, that most amazed me was to say, I, we
don't know how much of this is going on in the real world, but
we've seen this in real life now.
Exactly.
and that's a very good point, Jim, because.
Just to stress it.
Again, this is not the first malware that was fully AI created.
We see fully AI written malware scripts all the time, like power share scripts.
You can see all the hallmarks of LLM generated stuff.
You see all the documentation, like the comments in the power share
scripts with emojis and everything.
No, Fred actor would do that, but because it's generated by Che GPT or whatever
you can spot it almost immediately.
What's new about Void is that we're not talking about the power share script
or a simple loader or drop or whatever.
We're talking about the whole framework with like multiple
components, plugins, and so on.
It's fully written end to end by ai, but also this is likely, and this is the
point we also make in the article, this is likely not the first time a malware
was written like this, but it's the first time, at least to our knowledge, that
we could actually see the development artifacts and we could basically
prove that it is written this way.
And you don't know what other sophisticated malware was fully
written by ai, because it's just the state of software development.
But what's special about this research is that we actually have insights into all
these, and proofs for all these documents, processes, dev development processes.
Is there any way to tell what tools they were using?
I
mean, there should have been, there should have been guardrails
that kept them from being able to do something this sophisticated.
So we have evidence that they use the tray ai,
Okay.
Which is like an IDE, so a development environment similar to VS code
or Google anti-gravity or coor.
So it's just an IDE, with agent support.
I think it's by, by then.
So it makes sense that somebody from China uses this software.
We don't know which model exactly they used, but you're right.
Usually the models they have guardrails to not help people in malware development.
but we found a document which basic basically, Could
potentially, or was likely used as a jailbreak for these models.
so what they did was they have this document, which they also feed to the
agent, and they basically brainwashed the agent to think that this is not
malware, but a legitimate framework.
I don't have it.
Perfectly in mind right now, but it basically says this is not malware.
This is a legit remote administration tool.
It is compliant to all, all legal, implications, whatever, and so on.
So it's basically whitewashing the language so that the agent afterwards,
or the model afterwards, accepts that this is not malware development,
but legitimate software development.
So if it's doing this, and the reason I bring this up is because if we say
we really are at a point where we might see , a wave of malware developed,
sophisticated malware developed by ai, this case, they're jailbreaking.
I've heard from other researchers that you can find ais that are pretty
sophisticated in development, that are, that have no guardrails at all.
Yep.
That, that many of them work with.
that's true, but usually you have to run this locally and this, if you wanna have
a good model, this replies, requires a lot of computation power, a lot of
GPU memory, which not everybody has.
I think we know this was written on a MacBook, which has good chips for ai, but.
To have a real estate of the art coding model, you would need a
dedicated GPU cluster so it, it's easier or it's, not easier, but it's
costs less money to daybreak and, an externally hosted model than to
run your own state of the art model.
Absolutely.
But bike dance is open source as well, right?
you could run it, couldn't you?
I guess you could.
But as I said, not everybody has 20 GPUs in the cluster at home, so
lying around,
yeah, I couldn't
personally, although eight MacBook Minis stacked together, you'd be surprised.
Yeah.
Not bad.
But I also don't have eight MacBook Minis,
Yeah,
but yet it's,
it's possible.
But the reason why I'm trying to get this is because we're trying to assess the
sort of threat that we're working with.
And in understanding this, we know that we're now seeing a more sophisticated
form of malware that can be created.
And I've done research interviews with people to, they've gone from,
from really up a zero day to a threat in 15, 20 minutes being able
to get something simple together.
Yeah.
But this is a sophisticated piece of software.
How well would this work in your opinion?
How well would it work to write something like that?
Yeah,
no, if Yeah, would, how big a threat is this?
if they actually successfully pulled this off?
I think it, it ups the ante, it means it lowers the barrier.
It means, customer work can be developed quicker.
So this could also mean that signature based detections are gonna
be pretty much useless soon, right?
Because signature based detections, they signature basically, or they
write signatures on the code base.
But if the threat actor just has to tell them all, Hey, rewrite this, in
another programming language or whatever, all these detections become useless.
And if the cost of that refactoring is near zero, then yeah.
As I said, signature based detections become more and more useless, which
would mean defenders would've to switch to more behavioral, detections.
I think this is an implication.
And the other implication is, that it's easier to develop malware, but this
is only partly true because, this, the author of Void Link is not somebody
who's not knowledgeable in all this.
Yeah.
Do the spec driven development.
You have to be really good at actually writing out these specs.
You have to know system engineering.
You have to know malware.
You have Linux, you have to know all these things.
You don't have to code it manually anymore, but you still have to design
it and write the specifications.
So it doesn't mean just everybody can go there and say, Hey, she GPT, write
me a Linux Commander Control framework because, yeah, that's not gonna work.
can I challenge you on that?
'cause if we're talking about development with a friend of mine who's another
developer And he was, we were testing out, Opus 4.5 and he shrugged at me and said,
of course, I did the specs with Chatt.
yeah,
definitely.
And you can give pretty, he, now, it wasn't malware, but he had, he was doing
a pretty sophisticated Linux application.
and he wrote, he just, he used.
Cha to write all the specs.
Yeah, the specs and voiding are also LLM generated.
that's clear from the language.
It's in Chinese, but it has also all the hallmarks.
It has these grandiose statements and so on.
So this actor also wrote the specs, with the assistance of LLM.
I would still argue you cannot just say, chat, GBT, write me specs for
Linux Commander Control Framework.
You still need to know, Hey, I want this feature, I want that feature.
the validation as well, has specific validation requirements to check if e
every stage is working fine and all that.
because I would say, in terms of when we started looking for potential threats
use within AI usage are created by ai, we knew that at some point anything major
would come from major threat actors, because all we've seen before, like Ven
mentioned, were like those scripts or even functions created by ai, which were
very random functions, like something very simple that anybody could write.
but these.
Was a way more advanced than we've seen before, and the same way that
we still believe when AI will become much higher threat to security.
it's coming from experiencing threat actors.
This is proves a little bit this case because.
It needed some sort of experienced developer, not a very junior one
would be able to write such code.
I think proves a little bit what we thought before come those AI threads
would be very, would be more dangerous coming from most experienced actors or
developers, not from the, the script kids, if we can call it them this way.
But still being able to use and modify and, we talked about signature based,
detection, being more or less overwhelmed by the ability to make changes.
And apparently they're pretty good at, they may be crappy at maintaining
their servers, pretty good at knowing they should test their stuff
against signature based detection.
But if you can modify your software fairly rapidly, doesn't that give
you an advantage as a hacker to be able to constantly be coming up
with new generation, new variations?
I think it goes both ways.
Yeah, definitely.
so AI is just a force accelerator, right?
The bad guys get quicker and get better, but it also works the other way, right?
The good guys, they get better.
This goes in many, areas of the blue teaming side or the defender side.
There's AI detections, which.
Obviously, benefit from advancements in ai.
but there's also our security researchers, regarding the reverse engineering.
we as reverse engineers when we analyze malware, We definitely leverage ai.
So for a framework like Void Link me using AI to, to analyze it and to have, have it
interpret the decumulation or whatever, it, it speeds up my process as well.
and this goes in for every role.
It just, I. The pace of everything just gets faster, but I don't think
any site really has the bigger advantage, maybe slightly, but
it's not a big step, I would say.
Pedro, I don't know if you agree with me on that one.
No, I totally agree with you.
I think it's, it just demonstrates like the, if we compare to the
software engineer award as well.
if you hear from senior developers, the AI just make their.
Job much faster, better in a certain way.
The same will be for the trajectory.
The same will be for defenders, but I guess we are in the same pace.
Wow.
So what does this mean in terms of, I know what it means in terms of research,
but in terms of the people who are out in the field working on this right now, what
should they be knowing about the this and how it's gonna have an impact on them?
that's actually.
Not an easy question.
I guess everybody was more or less aware that the AI malware
development age is already here.
This is essentially just the proof that it is, which was something
that we haven't had before.
What you can take away from White, white Link specifically, I would say is, that
it shows that Linux is also threat.
just to move away from AI for once.
because as I said, traditionally most mobile focuses on Windows.
but with the age of the cloud, a lot of.
interesting services for every company.
All the interesting data lies in the cloud.
and this is different from the classic active directory, two domain controllers,
one file server enterprise that we have.
It's all distributed.
It's in cloud systems, it's on Linux servers.
It's not necessarily even on the same network.
it's, in VPNs and the different cloud clusters and so on.
So attackers obviously have to modify their toolkits, and adapt
to the Linux age, although.
I don't wanna say Linux, edge, the cloud and container edge.
so I would say that's definitely a takeaway.
Just don't try to keep your focus on your own windows.
also look at your cloud system, which is
easy because there's a lot happening there.
But this week in particular, this is the second one for me this week, came up with
a story from, you're looking at Void Link.
And then we did another story about an 11-year-old bug.
In Linux this week that could give root access.
So it's, we might, we're proud of Linux and how well as an
open source development, it's kept to be fairly secure.
but I think it's something that we really need to be look, taking another look at
saying, are we a little too confident?
Is that fair?
Too confident on?
Maybe, every system has their vulnerabilities.
I think a big part is not, that's why you have to assume breach mindset, right?
you can assume everything gets compromised.
Every actor can compromise anything if they have enough resources.
so the way you should look at security is not, can I be compromised,
but will I be com when I will be compromised, how will I see it?
How will I react?
I would say.
There's no, you cannot be confident in the security of any system,
but you have to be confident in to your visibility into it and in.
That's the, also the offensive security pentest red team speaking out of me.
I always assume.
That there's two types of people, those who have been hacked already and those
who haven't found how they got hacked.
Yeah,
exactly.
So it, it's happening all the time.
The question is how severe is it?
How long did they stay?
And how much of a problem did they cause you?
And I think that's a pretty fair.
What
you guys working on
next?
Oh, sorry.
Sorry, just one last thing 'cause I wanted to mention this as well.
So we've been talking about how AI makes it so easy for
developers to create malware.
but the funny thing is, AI is also very bad at operational security.
So if you look at void link, every build chip with debug symbols,
so essentially you put the binary in a decompiler, you saw all the
function names, all the information.
Usually you strip that away.
So it's not easily reverse engineered, but the AI.
Thinking because it was brainwashed at this is legitimate software.
It doesn't do any of that.
It doesn't strip away debug symbols or, if you were talking to the HTT P
server, avoid link, it answered with I'm the void link C two server, which
is also very bad operational security.
And then there's the open directory because, yeah, the Fred actor
just open the random web server.
There's other things which AI is not good in, or the things
that people still do manually.
yeah, it's, it doesn't necessarily make the people smarter just
because their tools get smarter.
That's what I wanna say.
But we have to count on the fact that they're gonna learn too.
Maybe, let's see.
Hopefully not too much.
I'm hoping, I would rather have stupid hackers, believe me, but I don't
really count on that, particularly if they're nation states or some of the
groups that are pretty sophisticated.
I know it makes lazy, so maybe they're even aware, but they
don't care because I know when I'm coding and I'm like, ah, come on.
I don't want to go there.
Do this manually.
So let's see.
yeah, I totally agree with you.
What are you guys working on next?
What do, what's up?
What's, what do you think is interesting that you're gonna be
pursuing, I'm not telling you to give away your next paper, but what are
the areas you're most looking at?
I believe, I, we believe that void link puts in, us in
perspective that, all right.
Threat actors use AI rapidly.
Develop their software and they are advanced, they're capable and everything.
what I'm looking to see now is.
When are we going to see AI being used by threat actors to really
make their operation quicker?
So for example, in, in a case of a compromise, how they can
use AI to speed the time between compromise to, a lateral movement
and transfer deployment, for example.
so the.
The AI generated malware.
We've seen that.
we've seen simple examples and this of course the real example with Void Link.
But, what about using AI to adapt?
Within the code, for instance, or after ex after compromise is made
to quickly assess which victims is interesting or which victim is not.
I believe that's what we, we should be looking for next, in the horizon.
It's going to be interesting and I'm also following up on, I'm not gonna say
too much because I don't wanna give it away, but, I'm also following up on,
on Void Link and focusing on container ecosystems right now and different dangers
that are, inherit in those ecosystems.
But I'm not gonna say more.
Maybe it's gonna be fruitful, then you're gonna read an article, but maybe not, you
never know with the research and before
or you'll come back and talk to us.
Yeah.
Maybe.
Yeah.
No, I think the container piece is an interesting piece and something
that I can't say I know a lot about the security of, I just know that it
is an area that probably may not get as much attention as it needs and,
I believe so.
Yeah.
Cool.
And the, the, also the idea of lateral movement.
If they get faster at that's a problem.
I still don't, I still want to talk about networks and I'm gonna do a try and do
a show on networks and how people can stop lateral movement because I hear
so much that people find ways to move around, and I'm always mystified by that.
How can they stay that long?
How can they have the time to find.
The lateral movements and nobody spots them.
Now, that's already something.
But if they get faster and better at it, that's even worse.
Yeah.
Good stuff.
Thank you gentlemen.
I appreciated this.
this was great.
I, is there anything else you want that I've missed that you want
tell the audience or that you want, you think you wanna share with it?
not from my side.
I guess we, we covered well, what we have found out.
I just wanted to acknowledge the rest of other teams within Checkpoint research,
the threat intelligence team and other research team and other people as well.
If I say names, we'll likely be forgetting someone maybe not worth it.
it's a team effort and Van is the main research of this, but it was a
pretty much a team effort analyzing everything we found, debating on the
conclusions, on the findings and all that.
it's, pretty much a big team effort.
Yeah, it was great teamwork.
yeah, I don't have anything to add.
Thanks to him for having us.
It was very fun.
Yeah.
thank you.
And I'll post a link to this and I urge people to go and read it.
It's very accessible.
I, and I do, I compliment you on that.
it's a very readable document and it'll at least bring you up to date
and fill in anything that we missed.
Thanks a lot guys.
Appreciate it.
Thank you.
Good one.
Yeah.
Thank you
very much.
Have a good one.
And that's our show.
There's a link to the research report in the show notes.
I wasn't just being polite.
I've read a lot of reports and this was well written and it will fill you
in on the story if you want to dive a little deeper and see some of the
research processes and diagrams as well.
You can find the link@technewsday.ca or.com.
Take your pick, look under podcasts, and if you're watching this on
YouTube, there's a link right under the video in the show notes.
Love to hear what you think.
Use the contact us form on the site when you're there, or leave a comment
under the video, or as a number of you do hunt me down on LinkedIn.
I'm always pleased to talk to you, and if you find stories or things where
you'd like to see us do a deeper dive.
Let me know.
I'm pleased to reach out and thanks to people like Anna at Checkpoint who put
this together so quickly, we can do a little deeper dive into the topic.
I'd also like to thank Meter for their support.
We're totally supported by your donations and sponsors who will only ask for a
mention and no editorial control at all.
All we offer them is a description of what they do, and in this
case, lemme go ahead with that.
Meter delivers a full stack networking infrastructure, wired, wireless and
cellular to leading enterprises.
Working with their partners, meter designs, deploys and manages everything
required to get performant, reliable and secure connectivity in a space.
They design the hardware, the firmware, build the software.
Manage deployments and run support.
It's a single integrated solution that scales from branch offices,
warehouses, and large campuses all the way to data centers.
Book a demo at meter.com/cst.
That's METE r.com/cst and that way they'll know you found them through our show.
I'm your host, Jim Love.
Thanks for listening and have a great weekend.