Cybersecurity today.
Would like to thank Meter for their support in bringing you This podcast
Meter delivers a complete networking stack wired, wireless and cellular
in one integrated solution that's built for performance and scale.
You can find them at meter.com/cst.
Killin ransomware exploits, Ms. Paint and Notepad.
And three new open source offerings are trying to improve security.
Heisenberg software, bill of materials, open AI's Aardvark agent, and open PCC,
which encrypts enterprise AI data flows.
This is cybersecurity today.
I'm your host, Jim Love.
A major ransomware player has pulled off a sneaky trick using everyday
windows tools to help locate high value files before deploying encryption.
The group behind the attack is called Killen, also known
as Agenda or Gold Feather, and they've been quietly innovating.
In recent investigations, researchers at Cisco's Tali found that kill and operators
used standard windows utilities like Ms.
Paint and Notepad to open and examine files during reconnaissance.
They then exfiltrated selected data using Cyber Duck before launching encrypt.
Why this matters?
Well, these are legitimate tools most security teams allow without question that
makes detection that much more difficult.
Qlin's campaigns have hit dozens of targets across Canada, the us, the
uk, and Europe, and for companies from SMBs to enterprise IT teams.
and for companies, from SMBs to Enterprise IT teams, the takeaway is simple.
You can't just watch for exotic malware.
Watch for legitimate tools behaving.
Oddly, If Ms. Paint starts opening confidential files, that's a red flag.
A new open source tool called Heisenberg is helping developers and security teams
turn static software bills of materials into active supply chain defenses.
And frankly, given some of the supply chain attacks we've seen,
the need was never greater.
Built by app, Omni Heisenberg analyzes open source dependencies using data
from depths.dev, SBOs, and external advisories to measure package health,
detect suspicious changes and flag risks before code reaches production.
It works in two modes.
Check mode for single packages like NPM or pi, PI and bulk
mode to scan entire portfolios.
It can even alert developers directly inside pull requests.
As app Omni's, head of security, max Feldman says we wanted a practical
way to catch and block risky changes before they reached the main branch.
Instead of waiting for a CVE or a breach, Heisenberg highlights
dependencies with poor health scores.
Packages that are new unmaintained or just plain suspicious if your DevOps pipeline
relies on open source components and who doesn't, you might consider adding
a dependency health check like this.
Don't treat your software bill of materials as paperwork.
Make it part of your real time defense.
Open AI has unveiled a new AI agent designed to find and fix
software vulnerabilities before attackers can exploit them.
The system is called Aardvark, and it's described as an
autonomous security researcher.
Powered by open AI's GPT five model, it integrates directly into the
development pipelines, scanning repositories, monitoring commits,
identifying vulnerabilities, and proposing fixes automatically in testing Aard
correctly identified more than 90% of known and synthetic vulnerabilities.
It maps a project, validates exploitability in a sandbox and uses
the Codex engine to suggest patches, all with minimal human intervention.
Open AI says aardvark has already uncovered 10 confirmed CVE registered
vulnerabilities in open source projects, while it's in open beta.
For DevSecOps teams, this is a major advance.
Yes.
questions will remain about trusting automated patching, but this
seems to be progress in the right direction, automating tedious tasks
so humans can focus on strategy.
And finally, a new open source initiative is aiming to secure
the data that fuels enterprise ai.
It's called Open PCC, open Privacy and Confidentiality Channel.
Open PCC is designed to integrate directly into existing enterprise systems,
and it wraps every AI prompt, output, and login in end to end encryption.
It's built on the widely used model context protocol, embedding encryption
into data streams so companies can add privacy protection without
redesigning their architecture.
It is apparently a drop in upgrade with open source SDKs under the
Apache 2.0 license, and libraries for secure GPU Attestation.
Encrypted client to AI streaming and modern protocols like
binary, HTTP and oblivious HTT.
Crucially open PCC enforces stateless processing.
There's no data stored beyond the immediate request, and because it's
open source, enterprises can audit it to meet their own compliance standards.
the newly released technical white paper on GitHub details how open PCC uses
ephemeral encryption keys and aligns with NIST 800 dash 2 0 7 and GDPR Article 25.
Now if it performs as promised, open PCC could let enterprises protect
sensitive data end to end without slowing down their AI innovation.
I've been extremely critical on the show about what's been happening or rather what
hasn't been happening in security, and that's why I dug up these three stories.
I'm not endorsing any of them, but I do believe you might
wanna take a look at them.
Check the show notes@technewsday.ca or.com on the weekend.
You'll be able to find links to these white papers and the stories that
back them up, and that's our show.
Once again, we'd like to thank Meter for their support in bringing you this podcast
Meter delivers full stack networking infrastructure, wired, wireless,
and cellular to leading enterprises
Working with their partners, Meter designs, deploys and manages everything
required to get performant, reliable and secure connectivity in a space.
They design hardware, firmware build to software, managed
deployments, and run support.
It's a single integrated solution that scales from branch offices, warehouses,
and large campuses to data centers.
Book a demo at meter.com/cst.
That's METE r.com/cst.
We've got a great show for you this weekend, an interview with a former Black
Hat Hacker, and we have a great chat about security as seen from the other side.
I hope you can join us, but if not, we'll be back on Monday
with the cybersecurity news.
I'm your host, Jim Love.
Thanks for listening.