ShinyHunters’ FBI Breach, OpenAI’s Bug Bounty Drama, and the Rise of ClickFix

0:00 I'm also really sick of normie media talking about cybersecurity issues. Ah! Breaking news, and this is huge. Hackers now say that they have gotten into the FBI and secured data and information. These threat actors known as shiny hunters come out and said that they have stolen information about every FBI agent and anyone who's ever applied.

0:22 No way. I'm getting hacked. Now we have this graph that shows we are literally thousands of high-confidence events of the models doing hacking-adjacent activity, right? No one was looking at this? The trend, at least in software security, before AI was like, the bus is driving software security. Things are written in Rust, like shift left.

0:43 More awareness of software security trends. And then the train is just to AI, dude. Good morning, hackers. Welcome back to the lowdown, the best podcast on the internet for hackers. Matt, I know we were riffing before and you were a little mad at me. You know, you had a little bit of a bit of a tiff.

1:06 I woke up this morning to the crisp Maryland air, brother. It was 59 degrees outside. Okay. Autumn is upon us. And by us, I mean, I mean, I mean me, not, not you. What's going on in Tejas? Oh, brother, 97, 97. 97 is unholy. 90, yeah, I heard, someone put the Austin cold front is coming next week. 80, 80 is the cold front.

1:32 Put on your hoodies, dude. Put on your hoodies for the 80. Yes. Yes, I might put a hoodie on like mid-show here because my office building where my studio is just cranks the AC. I like this over the alternative. I can't complain. But I walk out of here, like I can't feel my fingers sometimes. I'm like, oh man, it's like cold in here.

1:51 Yeah, that's bad. But yeah, no. I mean, I got the blanket. I'm good. I'm good. If it makes you feel any better, I record in my home's basement, and there's, like, no output of heat down here. So come this winter, I will also not feel likely my fingers or my toes. Fun fact for all you YouTube enjoyers, I mostly have – I have numb feet most of the winter when I'm on my videos.

2:08 I can't feel my fucking legs. It's pretty bad. He's also not wearing pants below that as well either. He's, you know, what can we say? The channel is called Low Level for two reasons. Anyway, speaking of which, Matt, can you explain your shirt? Oh, yeah. This is my homie. Jay Kranz Company is Mallory.

2:29 So Alice, Bob Mallory, Eve Trent. So, you know, if you've ever read a book on computer science, these names will sound familiar to you on the diagrams or whatever. No, Mallory's doing cool, like, Threat Intel attack service management with, of course, AI-powered stuff. Yeah, yeah. But Jay Cran's a homie here in Austin.

2:49 Dude, the Austin founders, Austin cybersecurity scene is on a hot streak right now. I don't have the list in front of me, so I'm sure I'm going to, like, forget somebody. But in the last, like... two quarters. We've had like five or six startups that like founders are homies of mine in Austin get acquired.

3:05 Nice. Pretty cool. H.D. Moore is here, RunZero. Tom Page is here, NetRise. They were part of that Dragos deal that Accenture kind of like rolled them all up together. RunReveal is a sim shop that ClickHouse just bought. KeepAware is a browser security company that Ryan, the founder is here in Austin.

3:23 They just got bought by Jamf. I'm definitely forgetting a few. InQuest got bought by Opswot. InQuest is here in Austin. But yeah, it's a bit of a hot streak. As Duke Nukem would say, that's a lot of words. Like, I don't know a lot of those companies, but that's pretty awesome. So I will just say, like, I'm passionate about Austin being awesome.

3:44 Otherwise I wouldn't tolerate the 97 degree September heat. And the reason it is awesome is because of a lot of what I just said, right? Like the entrepreneurial spirit here, like, is high. And so we have a lot of founders. We all kind of like help each other out, do like founder kind of group therapy.

4:03 actually here in my office. And we like, we put people in the hot seat and they like bring up slide decks about how their business is doing, like struggles they're having. And like the, like we have people in the room that have IPO'd gotten acquired. I've never taken VC money. I've taken tons of VC money.

4:18 So it's like a lot of perspectives and not a lot of like, nah, F that guy. You know what I mean? Like I've lived in other cities where that same, like, I don't know, camaraderie doesn't exist. It's like much more adversarial almost. Super cool. Super cool. So yeah, the energy is high in the city. Whenever anyone...

4:36 Someone was just here visiting... Oh, our sponsor sales guy. We share... Ed and I share a sponsorship team. And was just here in Austin. And he was like, man, I was out on the trail. It's like, everyone is hot and doesn't wear a shirt. It's like, yeah, it's just... That's the city for sure. It's like...

4:53 Oh, that's funny. You know who else is hot? I guess. Sponsor today's video. No, just kidding. The FBI. They're a little hot today. Apparently, the FBI has been has been hacked. Matt, did you hear about this? Of course I heard about this. Bro, it was my third, count them, three million view video in the last two weeks.

5:13 Nice. Third and two weeks. Casual little million views. Love that. Love that. Third and two weeks. Third and two weeks. This one is kind of banana pants. All right? Yeah. A lot of people have already made videos about it. So I kind of want to, like, get into it a little bit deeper than you've probably read in some of the headlines and stuff and, like, talk a little bit about this.

5:29 But let's set the stage for the people that have not heard about it. The FBI... is investigating a compromise. Like, I would like to say that, right? They are investigating it. But it seems real. These threat actors known as shiny hunters have come out. and said that they've stolen information about every FBI agent and anyone who's ever applied to be someone of the FBI, which that should, before you read anything else, give you a clue about what they compromised, right?

6:00 Because what would I have information about? Everyone that works there and everyone that applied to work there, right? Probably some sort of third-party HR slash recruiting software, if I was to put on my thinking cap. Software for people, potentially? People software? Whoa, you must be an Oracle with that kind of vision.

6:20 Okay, sorry. That's pretty good. So, yes, they came out. They said they found a zero day in PeopleSoft. But, but... you should say, but there was some posts going back to June about some vulnerabilities in Oracle's PeopleSoft that shiny hunters were using the, uh, the infamous crowd over at UWU underground.

6:47 I don't have the tweet up. I'm trying to pull it up really quick. Tweeted back in June about shiny hunters and PeopleSoft, specifically that combo. I was like, whoa, this tweet aged incredibly well. They said, yo, we got to talk about shiny hunters versus PeopleSoft. Um, Let me get this right. 113 of you said, let's pack HR, payroll, finance, procurement, supply chain, student records, employee identities, and every business process with a pulse all into one giant loot pinata with an ugly Oracle logo stamped on it.

7:18 Love me a place where the leadership finally discovers mission critical means too important to patch, too entangled to isolate, too expensive to replace, and too embarrassing to explain. Yeah. Congratulations, Kings. You all running a threat actor Costco and gave Shiny Hunters an executive membership.

7:36 Tweet of the year? Yeah, it's pretty good. And so that kind of begs the question. If this bug came out in June and the FBI got compromised in Czechoslovakia September, one of two things occurred. Either the FBI, like, didn't patch their stuff, which, like, it's the government. Big bureaucracies are hard to move fast, so potential.

7:55 Or maybe shiny hunters hacked them five months ago. You know what I mean? There's a couple of different ways this could go. It's very, very interesting. Yeah. Yeah, so I did some digging. I tweeted a CVE that came out around that June timeframe where the whole Shiny Hunters PeopleSoft drama started. There was a CVE.

8:14 It did get added immediately. The day that it entered the NVD, it also entered the CISA Kev. So it's like, oh, we know about this vulnerability because it was being exploited and the government added it to the known exploited vulnerability list, the Kev. which does start a timer for federal agencies to patch it.

8:32 That's what the Kev is for. That's what CISA and Kev... CISA and Kev are not for us, homies, right? Yeah. That's for federal agencies so that they have a stick that says, you are now on a timer to patch vulnerabilities that we know are being used by threat actors in a malicious campaign right now, right?

8:51 So, like you said, either this is the same vulnerability And they didn't patch it until now. Or this attack actually happened way back then. The feds never realized it. Shiny hunters are now using the data to leverage. And we're going to get into their motives in a second, because they released a bit of a manifesto.

9:13 about what's going on. Or there's a new people-solve vulnerability that none of us have the details on yet that Shiny Hunters said in their statement that they used a zero-day. They reached out to journalists. They're on like a PR kick, right? They're like, journalists, please reach out to us. They're like happily giving quotes about this attack and like their motives behind it.

9:34 And they are kind of saying that it's a zero-day. So, yeah. Who knows where we're at? That PeopleSolvo VOLN from June that was known and exploited lined up a little too perfectly for me. I kind of went like, all right, this looks like it could be the one. So maybe timelines are off or maybe the patching is off.

9:53 But yeah, this very well could be a VOLN that we do not have the info on right now. Yeah, I want to kind of dive a little more into the actual exploit here. So to be clear, we have a CVE number potentially associated. What I don't have as a person who does like kind of more exploitive research is like a POC, right?

10:09 I made a video on this incident. I looked online for POCs of this CVE on GitHub, could not find anything. There were two repos that stood out, but both looked very highly AI generated. So no real way to know that they're actual POCs. And I'm not going to install Oracle PeopleSoft and Tested because I'm not doing that.

10:26 But we do have details from Rapid7 and an article that came out also in June of this year talking about the details that we know of the CVE itself. The indicators of compromise are two endpoints that have to do with Java deserialization, right? So Oracle PeopleSoft obviously being Oracle is a Java application.

10:45 Because Java is not really a compiled language, you're not going to have your traditional like, oh, buffer overflow or, oh, like integer overflow attacks kind of stuff. You're going to have these things that are known as like deserialization attacks, right? So when you're trying to transfer information about an object from point A to point B within Java, you can pack up that data in a serialized called marshaled object.

11:05 What can happen, though, is if you don't un-serialize that the right way, you can kind of, in certain cases, add your own code or do what's called a deserialization chain to use other code in the system to do malicious stuff. If you Google one of the endpoints, which is called HTTP Listening Connector, there's this random piece of documentation from a site called Cedar Hills Group.

11:26 It's like a book. It talks about the fact that this endpoint is used to create message objects, create service objects, create service operation objects. So what likely is happening is there's an SSRF in this system that allows you to point a request at this endpoint, thereby bypassing off, and then in that object creation, there is a deserialization attack.

11:48 Now, to Matt's point, these endpoints that do, like, multiple object instantiations probably have multiple deserialization attack vulnerabilities, right? So even though we found one in June, there's probably N more that Shiny Hunters may be sitting on if they didn't exploit it back then, if they exploited it recently.

12:08 Yeah, I will go, you know, an observation I'm having right now in this very moment is that during the whole Project Glasswing thing, I did not see any really awesome transparent blog posts come out of Oracle about their great successes in the Mythos program in finding their own vulnerabilities. Yeah.

12:27 Whether or not it happened and they weren't transparent about it or not, I'm just saying, like, out of every other major shop that was part of Project Glasswing, not every other. I'll walk that back. Out of lots of the other big tech shops that were part of Project Glasswing, we saw just tons and tons of blogs and research come out about...

12:46 the harness that they put it in and the CVE number going through the roof and basically how they were leveraging their opportunity of being part of Project Glassman with this injecting steroids into their vulnerability research department. Haven't read anything at Oracle about that. And you would think with as much software that they have kind of tendrilled into large enterprises that they would kind of be ripe for this.

13:10 I don't know. Not saying that they weren't doing it, but just saying I'm realizing right now I didn't read a cool post from them about it like I did at Mozilla or Cloudflare or even Microsoft. Yeah, no, I agree. That's the issue with applications that are written in Java and Python, right? Just the overall attack surface kind of security thought process is just different, right?

13:33 You're not looking for the buffer overflow that Broadcom is in their baseband firmware. You're looking for object unsafety serialized, which is much different. Yeah, but like... not to be too AI-pilled here on this, the 2026 internet, you know, out of fear of my own life. But we do now have a tool that is, like, incredibly good at finding these kinds of... Oh, I totally agree.

13:58 Like... incredibly good at finding these things at scale. It just costs a little, you know, money in API and tokens. And obviously you need to like still send like a skilled security team and harness at it in order to like do so efficiently and actually do something with the results. Yeah, and also a large company is like Oracle, right?

14:20 There's a question of like, who really owns this product? You know what I mean? We've talked a lot about like, a lot of the times, the technical solutions are easy. It's like the bureaucratic solution of like, whose job is it to secure PeopleSoft? Like, I don't know the details of this internally at Oracle, but like, it could be like at Cisco in some cases that like PeopleSoft is a platform they bought from another company.

14:37 And it's like, whose job is it to even secure that? Do they still, you know what I mean? Like, there's a whole other like, internal inertia issue that could be at play too. Yeah. Oh, we know that, right? Like a company's that size, you don't, you don't have that not exist, right? Like there are little fiefdoms over all of these little products.

14:55 And I don't know many companies that don't have more little different products than Oracle, right? It's like, it's, that's what it is in a trench coat pretending to be one company, right? It's crazy, crazy, crazy how much is going on there. All right. Should we get into the attackers motives a bit? Because why would you hack the FBI map?

15:13 What's going on there? How could you dare do that? I don't know, because it's like everything is cool. It's 1999 again in cybersecurity, and that's what you do? Because that's what you did, right, back then? Hack the planet. Hack the planet. As a teaser to what Matt's about to go into, I will say, when I found out the motive that Shiny Hunters had, I actually giggled a little bit.

15:32 You think, oh, hacking the FBI, they're going to get the mainframe. No, they have a much different reason for getting in. So Matt, why did they do this? It happens to be, again, we mentioned it, they're on a PR kick, right? So, okay, we have to, like, put ourselves in the mind of the threat actor, okay?

15:49 Let's see, let's see. How do I, like, best embody... a threat actor who hangs out with my homies in the, oh, dude, I need one. I need one. I'm here. I got the wizard cap on. Oh, I don't have anything even remotely that cool. I'm in your mainframes, hacking your bits. All your base are belong to us. I need it.

16:06 I need it. I need a matching wizard cap. You remember that old copypasta meme and I put on my wizard cloak? Yeah. Oh, God. That's like one of the hardest I've ever laughed on the internet. Okay, so like embodying the threat actor with our wizard tats, right? Putting ourselves, we are shiny hunters, right?

16:25 How do they make their money? How do they pay their bills over in threat actor, a stand or wherever it is that they live? How do they pay their bills? Besides in cryptocurrency? I'm not going to say the word they don't want me to use, but ransom. How about that? Sure, right? And in order to successfully...

16:45 word that rhymes with a Schmeck store companies, it turns out this is like mafia movie 101. Okay. When you're the big, muscly Italian guy in like a real nice jumpsuit coming down to the corner store to ask nicely, not extort for some money out of the corner store or the flower shop or Like, your reputation is all that you have, right, in this thing.

17:15 So it turns out the shiny hunters is very sensitive to their reputation because that's how they pay their bills. It's like how I'm reading this, right? Sure, sure. And so I think they suffer from a few things, right, that... The average person on the street has no idea the, like, dynamics in threat actor-ville, right?

17:40 Between these groups. Like, what's a scattered spider? I've heard of this comm thing. Like, maybe I read about 764, and they're pretty gnarly. And then I hear shiny hunters. But then there was this lapsus thing. And then at some point, it was like shiny lapsus spider was, like, a name that they were using because, like, a few of them broke off and, like, all hung out together.

17:59 Yeah. They were like combining forces, like the Avengers of threat actors into like one name. And it's like, hey man, I do this for a living. It's really hard to stay on top. And I'm confused. Yeah. Really hard to stay on top of like, which of you are hanging out in which others telegrams and discords, like, you know, doing threat actor things really hard to keep on top of.

18:20 Right. Nevermind like the average Joe. Right. Right. Nevermind the average head of IT who would have to respond to your threats. Right? Like, you expect them to have any idea about any of that? No. But that's what Shiny Hunters is really concerned about. And that's why they hacked the FBI. Because the FBI put out a FLASH report.

18:40 I think FLASH is an acronym, too, in all caps. Do you know what it stands for? I don't. Yeah. But they put out these FLASH reports. And it's like a bunch of... Basically threat intelligence, but like at a very normie level of like, hey, the feds are just like yelling at people to watch out for this thing that they're seeing.

19:00 Right. They put out a flash report during the flash report. There's some quotes. We can read them directly. threat actors often use their real or exaggerated claims of access to sensitive or personal information to prompt payment from the victims. That's the number one thing in the shiny hunters like manifesto that they pulled out of the flash report, which they answer below.

19:22 We wish to state unequivocally our threats and claims are very real, not exaggerated and never a bluff. This PSA today is living evidence of that. They're basically saying, like, you use the word exaggerated. You use the word exaggerated. Don't do that, please. We mean it. Exaggerate. We mean it. But to the Fed's, like, defense on a lot of this, they're just trying to get the words out for people to, like, protect themselves from things that they're seeing.

19:51 there's no possible way that like the head of IT at some random, you know, midsize company is going to have any idea about any of this, right? So it is a true statement that some threat actors do exaggerate. Period. And there are threat actors that pretend to be shiny hunters, not real shiny hunters.

20:10 And there's no way for people to discern this, right? Their next two bullets, to exert pressure on victims, they harass, threaten, SWAT people. They come out and they're like, we have never conducted SWATing attacks against corporate victims' personnel, nor we have ever texted victims' personnel, family members on any threats.

20:29 We don't do that. We don't do the threat or SWATing thing. And then they also talk about sextortion. They may falsely claim to have sensitive or compromising information, including embarrassing photographs. And they're like, we are not sextortionists. They go on to say, we state unequivocally, we are not the comm.

20:44 We've never been a part of the comm. The comm is propaganda started by information security community. They basically are coming out and they're like, we are not them, those people that you keep reading about that are doing all that stuff. We are... upstanding threat actors that steal information and we are not exaggerating and you need to pay us to not get rid of... to leak this information.

21:04 But we're not going to, like, swat you or pretend we have some information about you. But... Again, like, I hate to be the, like, in the Fed's defense, like, you can very, very easily, if you Google, like, shiny hunters sextortion, you can find countless examples of emails claiming to be shiny hunters in the wake of shiny hunters leaking data targeting the victims that were in that data leak, that shiny hunters did actually leak that data, then victims of that data breach then get sextortion, emails, exaggerated claims, all this kind of stuff that the FBI is saying they're doing.

21:43 But that's it. This is what they're like. We're not financially motivated on this. We want the feds to correct the record on this flash report is what they say. It's so funny, dude. It's like you think when someone hacks into a system, there's like an espionage play or like there's like a, you know, just, yeah, like you're saying, like they want, they're just going to mine Monero on the FBI's computers or whatever.

22:03 But no, they are just so upset with like the verbiage used in a flash report that they hacked them. To and that's kind of where the thing comes in there. They're on this whole like tirade that they don't do extortion. Well, first of all, they say two things. They say we don't do sextortion comma and we don't do extortion.

22:24 We just use and protect our First Amendment rights. Okay, well, then why did you steal all that data? Like, are you not trying to use this as leverage? What is that by definition if not extortion? And again, if I'm wrong, tell me. You know what I mean? But I don't know what else you can call this. Yeah, I feel like it's weird to say you're not doing extortion in the extortion letter, right?

22:44 Like, you have four days to respond to FBI. Or what? Or what? You know, anyway. So kudos 404 on breaking this, by the way. And there was a bit of a follow on from 404 that actually, they went through a bunch of the data. They have some of the data. I know some people that have some of the data that the Shiny owners just put out kind of as a sample to prove that it's real.

23:06 Um, it's real according to everyone that I've known that has seen it. And, uh, 404 went on to say that some of the people listed are part of the remote operations unit, which is the FBI's hacking unit. And some of them are marked as like intelligence against China and Russia type people. This is like, Making these people obviously very unsafe right now, right?

23:29 Is that this is even potentially public. I mean, it's public. For all intents and purposes, if you want this data, you can go get it. And now, yeah, severely endangers those people, right? Yeah, it's not great. You know, we're kind of laughing at, like, the shiny hunter's motive here, and I find that in and of itself kind of comical.

23:47 But you have to remember, like, in any compromise, right, there's, like, real people with, like, real damage, and now these people have to, like, live with the fact that they're outed, right? So not great for them, you know. And this is, like, irrelevant to your thoughts on the FBI, right, or, like, the administration.

24:02 It's like they're just human beings with, like, likely family and kids, you know. Yeah, obviously we can all laugh about the leadership and stuff that's been going on in a lot of federal agencies, but I've met a fair amount of career-long cyber FBI agents that have been there through every administration.

24:20 Sure. Right? So it's like... this is just somebody's job, right? Like, just their job happens to be, you know, doing forensics for someone that, you know, pays them to do forensics at federal crime level scale. Like, period. Is like what a lot of these people are. And, yeah, that sucks. Yeah. It sucks for them.

24:41 You know what doesn't suck, Matt? The sponsor of today's video. Hey, Maze, take it away. Bro. Bro. I know. Hey hackers, before we keep going, I wanna take a quick break and say a quick thank you to our sponsors. Today's Lowdown episode is sponsored by our friends over at Maze. Maze has spent the last couple of years using AI to find and remediate vulnerabilities in the cloud.

25:02 And now they've released Maze Code, AI agents that find and deeply investigate vulnerabilities in your code. Now we all know the deal, software composition analysis tools and SaaS toolings are all historically really bad at just making more noise. They find issues that may not actually be real and just create a lot of problems for your engineers to deal with that don't solve real security vulnerabilities.

25:24 I get it, we've been there. Maze code is a really cool tool because Maze code actually knows how your code works. Maze code investigates every finding with the context of how your code is actually deployed. Sure, you're using a version of lib.xml2 that's vulnerable, but the actual code path to hit that vulnerability is not exposed in your Docker image.

25:44 Maze code can find that and won't show you that that vulnerability is a big deal. Every vulnerability that Maze code reports comes with evidence that it's real and a way to fix it. Check out Maze at go.thelowdownpod.com slash Maze. That's go.thelowdownpod.com slash Maze. Thanks again, Maze. Let's keep going.

26:03 And we're back, professional podcasters. Let's go. Yeah, FBI stuff's interesting, man. You know, weird world, FBI's getting hacked. It kind of makes you question how far this goes, right? You know, how many zero days is Shiny Hunters sitting on and what else can happen from there, you know? Yeah, it's also, I mean, I will say just like MO-wise, it's kind of interesting.

26:23 I know Shiny Hunters is like, we are very specifically not the comm. But like there has been a point where some people from Shiny Hunters have teamed up with... calm people with lapses people. There was like a shiny lapses something or other that came like there is a co-mingling of threat actors and the tools and the MOs that they use.

26:44 I will say zero days aren't necessarily in this level of cyber criminals. MO because they are really good at like the, Vishing stuff, click fixie stuff. Social engineering is definitely the larger swath of their MO. I wonder if this is like saying something to us that we should be listening to here that maybe we're getting lost in the noise.

27:10 Is that like, hey, cybercrime, not nation state backed cybercrime. is getting their hands on some zero days. Yeah. Wonder why. Wonder what could have changed in the last few years to allow somebody without a infinite budget and a team of literal scientist hackers in a lab that some of, you know, the nation states have.

27:37 I wonder how they got zero days. The trend, at least in software security, before AI was like, you know, the train meme where it's like the train, or no, sorry. Is it a bus or a train? It's a bus and then a train hits it, right? The bus is driving and it's like software security. Oh, things are written in Rust.

27:52 Oh, like shift left. Oh, like more... more awareness of software security trends, and then the train is just AI, dude, knocking that bus off the road. Yeah, I think with the commoditization of exploits, either through the frontier models or even just self-hosted models, right, you can spend... 20 grand, which I'm sure these actors have, to get a couple NVIDIA Sparks and run GLM-53 quantized.

28:18 And you can do some pretty easy vault hunting, you know? It's not that complicated. And so, yeah, maybe this is a message from them that they're suddenly, hey, we have zero days to throw, so back off, you know? You just said the name of my keynote. Oh, yeah. I was like, why did that feel so fresh in my brain?

28:34 Because we literally just talked about it. Yeah, so I gave a keynote this summer, and I'm giving kind of an updated version of it soon to be announced, keynoting another AI-related conference about the commoditization of the nation-state hacker. And this is really what we're seeing, right, is like stuff that used to take – tens, if not hundreds of millions of dollars, years and teams to develop are now literally falling out of the sky.

28:59 Yeah. Like literally falling out of the sky. We even, I just saw Dark Sword. Dark Sword was one of like the first glimpses of this that I had of like, oh, iOS exploits are being used by petty cyber criminals and crypto scammers. Wait a second. Like, that is a tens of millions of dollar exploit kit. Like, that is not crypto scammer, like, Chinese phishing website type stuff.

29:26 That is, like, nation-state targeted spyware kind of stuff. Darksword just reared its head again this week. Like there was an updated version of it, working on a more modern version of iOS. Like I saw a bunch of people being like, update your iPhones because DarkSword's out there again, right? DarkSword and Karina, I have a video on my channel.

29:43 I interviewed the guys who found it like in the wild and they called it a $40 million exploit kit when they were talking about it. And I was like, whoa, okay. So now you got... I mean, I don't want to put an iOS exploit in the same galaxy as a PeopleSoft. Right. Yeah, yeah. Java deserialization attack, yeah.

30:04 Not even in the same galaxy, right? Obviously. But that being said... zero day level research out of these kinds of groups we haven't seen in a while. That like social engineering kind of took over, right? Because everyone moved everything to SSO. All you needed was to steal one OAuth token and like you got access to every SaaS app.

30:23 And guess what? Every SaaS app has is all the PII that your company cares about. So like why zero day onto an endpoint? Why? Who cares? Like your C colon documents folder isn't where the juicy stuff is anymore. Right. It's like on a web app. So like that you can access with an OAuth token. So why bother with the other stuff?

30:44 Matt, you have actually flawlessly transitioned into our next topic. You want to move on? Because that actually like is the crux of the OpenAI hack. I am so, oh God, we are such good podcasters. Yes, we've been doing this for a couple months but we're getting good at this shit. If you think we're good at this, rate us five stars on Spotify because my friend found us organically on Spotify and I think it's because you guys have been rating us so you should do that too.

31:07 Oh man, podcast so hard. Podcasts go hard. Listen, so I don't know if you're aware of this. If you've been on the internet the last couple of months, actually, I guess now, just a week or two, OpenAI got hacked, right? And just to be clear, this is not getting hacked in the sense of like shiny hunters got in and stole a bunch of stuff.

31:24 It was a pen test, or not even a pen test. It was a bug bounty style compromise, right? Warranted, maybe not advertised, but like they were allowed to do this, right? This company called Haktron did two things. They chained one bug together with an SSO misconfiguration and were able to use that combo to make a pull request into the official OpenAI code base.

31:48 Pretty magical. Pretty magical stuff. We can dive kind of deep into this. I want to start here by highlighting... The comedy of the XKCD meme, which is now six years old, but it's still, mwah, XKCD 2347. It just basically shows a graph, and we'll put it up here in the video podcast, of, you know, all modern digital infrastructure.

32:12 A variety of building blocks on building blocks on building blocks. And then underneath all these building blocks is a... It's a tiny little peg that holds up the entire thing that if you knock it out, the whole thing falls over. And it says a project some random person in Nebraska has been thanklessly maintaining since 2003, right?

32:28 This project or this meme catches a lot of wind whenever a big bug comes up in like this little no name, no name in quotes, piece of software that people kind of forget about, right? And people use every day, but forget is important. So this is like back in the two years ago, and we're talking like centuries ago in cybersecurity world, the XZ backdoor, right?

32:47 Someone put a backdoor in lib-LZMA, which could have backdoored every open SSH server on the planet. And then today we're talking about lib-hyfe. If you're not sure what hyfe is, hyfe is an image format. It's actually the default image format used on Mac devices. Ironically... LibHive is used in this tool called ImageMagic, which is a tool used for resizing and unresizing and moving around images.

33:12 The text in the XKCD comic literally says, title text, Someday, ImageMagic will finally break for good and we'll have a long period of scrambling as we try to reassemble civilization from the rubble. OpenAI was compromised because of vulnerability in LibHive, which compromised image magic, which compromised discourse.

33:34 Okay. We're talking about the world of software security, right? Is software getting more secure? Is the buffer overflow finally going to go away? Unfortunately, no. The bug we're talking about today is, what is this? A heap overflow in libhife. So, you know, we don't have a ton of the details on exactly which bug, but there was basically a heap buffer overflow that led to an out-of-bounds read-write In the process of decoding a hike image, which is a format parsed by libhife, so that if you ask ImageMagick to resize this malicious image, it will give you an arbitrary read-write in the context of the process.

34:14 So what HatchTron was able to do was use that to land a shell on the OpenAI community forms. Okay, so there's community to OpenAI, which is run on the stack called Discourse. Discourse uses the image magic libraries to do all the image processing, which is very common, right? You're not going to rewrite all of your image processing library logic.

34:32 You're going to use somebody else's, which is totally fine. So they got a shell via this buffer overflow. But back to Matt's point about SSO vulnerabilities, the really big issue here is the SSO tokens used to log into OpenAI's community forms are the same SSO tokens to log into ChatGPT. So if you land on this Discord server, what you're able to do, what Hacktron did, is find an SSO token for an OpenAI employee, use that token to log into ChatGPT, and then now you have access to ChatGPT and Codex, where they have agents running an OpenAI infrastructure, and they use that to open a PR on the OpenAI codebase.

35:19 hacking into and completely compromising a, you know, supposed billion-dollar company, multimillion-dollar company. $6,300. They got probably two months' worth of rent out of that, which I think is fucking criminal. The other side of the coin there, the counterargument is that they didn't really find a bug in OpenAI.

35:36 They found a bug in LibHive that just happened to be in the supply chain of OpenAI. You know, you could make the argument that, like, the SSL vulnerability was arguably worse, but... That being said, kind of a neat little tale of the buffer overflow and how in the Lord's year of 2026, man, it's still good.

35:52 It's still well and good, you know? Never going away. I think the bigger story on this one is kind of how this got handled by these research, like by the researchers and by open AI, right? There's been like a lot of discourse publicly about this because basically the researchers came out and were like, Hey, this entire experience, like zero out of 10 would not recommend doing vulnerability research with open AI.

36:18 We could talk about the bounty payout, which I agree is just criminally low for the, like for the work. Whether or not where the, the bone in the code was meant very little to me when I saw the PR opened up against their repo. Right. Right. It's like, cool. But like you were using the package that let them into that.

36:41 Hence like, ta-da. Right. Yeah. Um, These guys got incredibly disrespected during a lot of this research. People were calling them like three random dudes using AI, found vulnerabilities, like whatever. These three random dudes are finding vulnerabilities everywhere over and over. These are legit security researchers.

37:03 Yep. Then also, apparently the CISO was really not happy with them and all of that. found them in Vegas. Someone was like telling them in Vegas that the team was like super unhappy with them. And let's, let's, why? Why would a security team be unhappy about security researchers doing this. I've run bug bounty programs.

37:29 I'm not unhappy when people successfully find things. I might like have to go run an incident, might cost me some cycles, might, you know, cost me spinning up some, you know, Slack channels and being like, hey, we got to respond to this. We got to get this fixed fast. Why would they be unhappy about this?

37:46 Any, did you catch this part of it? I did not. I saw the discourse on Twitter, a little bit of it, but I didn't get spun up on the nitty-gritty of why, in particular, that says it was mad. I did not. So they got upset because... of the last part of this whole story, the opening of the PR internally. Basically their stances, and this is like, we've been talking about this all year it feels like, and it just feels like a topic that should have been put to bed years ago, right?

38:15 About security research. This is like what's going on with Microsoft and Nightmare Eclipse. This is what's going on with a lot of people on Apple right now. There's a lot of like security teams and security leadership that are like, are not really being great citizens in the world of security research.

38:28 Oh, I see. With this, they got mad that they were basically saying, that is no longer security research. You now moved laterally with the vulnerability that you identified in order to prove your point. You took it one step too far. You didn't need to open that PR against our code base. And the CISO was pissed.

38:49 And, like, they weren't even, like, going to pay. Like, there was, like, all sorts of stuff about it, right? The CZO, I think, has since, like, apologized and, like, figured it out with these guys. But it's, like, spurred this whole, like, conversation online about, like, this. Is that too far? Right?

39:06 Right. Yeah, I mean, so is the argument truly about moving laterally? Because I would say the moving laterally piece is the SSO replay. Like that's where you're moving laterally and that's where you can make that argument. But I would say opening a PR is proof of rights or just proof of authorization.

39:20 Like you're testing, can I use codecs via this SSO to do something that could be malicious, right? Because I mean, you could make the argument that like in the bug bounty program, you have to prove how critical the bug is, right? If you just can log into ChatGPT as that employee, who cares? But if you can have, like, an actual action, like, I can open a PR, I think before you submit the bug, maybe you want to prove that, right?

39:41 Maybe you want to make sure you actually have the access you think you do. It'd be different if they, like, merged code into OpenAI, right, and it went out into prod. So I could see that angle, but they didn't. They opened a PR. Now, you could also make the argument that... And, you know, for like GitHub Actions, for example, even opening a PR does fire off compute, does fire off tests and even potentially like deployments to develop, like the development environments.

40:04 But that's that's much different than like pushing the prod. You know what I mean? I'm not sure if those are the same. Yeah. So, I mean, but we can go follow some of the threads from like Live Overflow was involved in this somehow, right? And this guy, Sirius, is his handle. And he even said, like, here's this tweet, you're all riling up over the 6,500.

40:27 That's not even the issue for us, even though, you know, it's kind of an issue. Yeah, I agree. He said the disclosure process itself was nightmarish. We had to get input from lawyers and eventually go to journalists and all this. And then another popular thread reposting that said, unpopular opinion, when you find an ODA in a public service, you do RD responsible disclosure, not LM lateral movement.

40:50 The GitHub PR and OpenAI repo is a bridge too far. And this is like... 157,000 view tweet, right? So yeah, this lateral movement, this like opening the PR is like spun up a bunch of people. It's definitely part of it. Yeah, I can see both sides. I really don't think, I mean, what is the issue with the lateral movement?

41:11 You're worried about damage, right? I don't think the hackers did anything truly that could have caused a lot of damage. I think it's more of just like a caught with your pants down moment that like, you know, now everyone who has access to the code base sees that they got compromised. And again, compromising air quotes, like, you know, penetrated, if you will.

41:26 So I see that argument, but also I do see kind of the fear, right? It's like, hey, we really need to prove that we have this bug because, as you mentioned, MSRC back a few months ago, and then Apple recently has kind of been dicking around with the responsible disclosure conversation, so maybe they just didn't want to get screwed on that end.

41:43 But on top of that, they also, again, only, that's a lot of money for anybody, but for this level of bug, I think only is fair. Only got $6,500, which is insane. It's not a good situation in either direction, unfortunately, but a cool bug. Yeah, there's an interesting thread. Sorry to keep pulling this.

42:00 It's a really, really deep, interesting conversation. But Alex Stamos even was talking about this. He reposted that lateral movement. Post saying this is unpopular, but correct. Modern bug bounty participants have gotten spoiled by super chill responses to CFAA violations like this one. He's calling this a violation of the Computer Fraud Abuse Act.

42:24 And he said, the whole edifice is a house of cards. Want to know why OpenAI asked for detailed logs? Just Google Sullivan plus Miss Prison of a Felony, talking about the ex-CISO of Uber, Joe Sullivan, who actually got charged for something like this. Then there's some additional other security researchers.

42:42 Ian Carroll is a security researcher. Ian and his crew routinely take... vulnerability research to its boundary. They do some pretty gnarly far stuff. So, of course, he's got opinions about this. And he's like, I'm sure you're aware of the DOJ's guidance on good faith security research. I think it's pretty clear that this activity falls under it.

43:01 He's saying Sullivan's irrelevant. And this is like, there's a deep... topic here about, well, what's too far, what's security research, whatever. I think for this, they eventually reported it, right? So it's like, and the PR, did you see the PR that they opened? No. It's in the thing. The screenshot of the PR is just a readme.md edit.

43:28 It's a readme.md edit. It says, Hacktron AI team POC. It's a text edit of an MD file was the PR, right? Yep. I have the problem with that I understand where you could Say that it's a bridge too far but no damage Was done and I would argue that's just them Confirming they had the access they thought they wanted Like they wanted to make sure they had the access They thought they did before they called out to open AI And what other Than committing to a repo Could you claim is critical Right This is a Man, the back and forth on this thread is actually super interesting.

44:03 I want to make sure that we include it, right? So Alex is basically saying that this course platform is probably in scope, even though it's not their code, but the pivot to GitHub is absolutely out of scope and clearly an attempt to create more pressure for payment. These guys are lucky that OpenAI is being chill.

44:20 I mean, I'm not sure I agree. I don't agree with that at all. So, okay, I'd have to read the bug bounty description. And if GitHub is out of scope, then it's out of scope. But I don't think it's a pressure play at all. I think they're trying to see, hey, I have an SSO token for discourse. What does that get me?

44:40 What does this SSO token do for me elsewhere in the infrastructure? That's like common pen testing. But again, if... So Alex's point is bug bounties are for dot, dot, dot reporting bugs. They are not for red teaming. Ian's like, clearly we disagree. Like, you know, they were pointing out that the secrets that they found could be used to get into GitHub.

45:02 Yeah. Right. Alex's point is the target doesn't know that they didn't steal data or take an IP or break anything without doing a full incident response, which is why we have rules and why OpenAI asked lots of questions. Basically, now they are on the hook for proving that these security researchers are actually security researchers and didn't do anything.

45:23 because the GitHub pivot was actually a true compromise at that point, not finding a vulnerability. Listen, this is a complicated topic. And like they're saying, it's like that is a violation of CFAA as the rules are written, regardless of any of our feelings about if that's hacking or not or it's too far.

45:41 It's like you went into their prod GitHub and changed something without permission, right? So like that is CFAA abuse and everyone's being real chill about it. And we've all gotten used to everyone being really chill about it. Yeah, but exactly. As we all know, like CFAA is just vibes like it's it's a it's a wide open net that like we've kind of just played with to make whatever the current the current cultural agreement is work.

46:06 You know what I mean? It's never been a thing we actually like legally abided by. Yeah. I mean, so he's saying pressure for payment. I get that too, right? Because, hey, security researchers don't want to do a lot of this stuff for free. The responsible disclosure, I just hate that term in general because that means that other things are irresponsible.

46:22 And I don't think that that's true. I think at the end of the day, all of our goal as a security community is a more secure internet than... And if there was a possibility for someone to implant malicious code into prod chat GPT, prod chat GPT could have served malicious code before people realized. It's like, what happened here?

46:42 Right? Boil this whole bug down into what could have happened. Yeah. Prod, Chachabit, or Codex could have pulled up very, very subtle malicious code before anyone realized. Yeah. And like, that is a, what, 900 million user product? That is, this is terabad for internet security. And as we know, it's also 900 million user product people are disclosing very personal information to on a regular basis, right?

47:09 Right. And so, like, the true lateral movement would have been pivoting into, like, a database and all this kind of stuff. But to Alex's point, there's no way that the team knows that they didn't do that. without doing full IR. But I think you should have to do full IR if you have this vulnerability that was open for long enough for these people to find.

47:28 Like you should be doing IR because who knows who did that before them. You should, okay. If I have been the head of application security at companies larger than OpenAI and if this shit happened, I would be doing IR regardless of that pivot if that pivot was possible. Yeah. Because guess what? If it was possible, it's possible that a security researcher wasn't the first one to find it.

47:53 And this could have silently been exploited before we realized. And of course you have to do IR. Yeah. So, like, thank you, security researcher, for forcing me to do IR on something that was possible and could have possibly been exploited before you got here. Here's a singular month's rent. It's crazy.

48:10 It's frustrating because, like, without them laterally moving, they may not have known that SSO on Community also worked on their internal – on ChatGPT, right? And, like, that's also a thing you need to know about. That is a good thing that was discovered. Yeah. Well, and security researchers are just burned over disclosure process over and over and over again.

48:31 That's why responsible disclosure is a two-way social contract. And corporations are failing over and over again that end of the social contract right now. So are researchers. Don't get me wrong. There's tons of people throwing slop into bug bounty pipelines. It's why people are burnt out on the other side of this, right?

48:47 But like... I'm sure that these seasoned security researchers have realized they kind of have a sense for how far they need to prove their issue in order for them to get compensated for their work. I'm sure they have a sense for that because they've probably reported very similar issues and got a pat on the back and maybe a t-shirt before.

49:06 You know what I mean? Sure. And it's like, well, no, can we please prove to you that we could have gotten code into prod because we could have gotten code into prod. Like, you know what I mean? We've all been, like, I've been there, right? Like, yeah. It's like, oh, you didn't prove that this could survive a restart.

49:20 And we've already patched it. Sorry. Now, if you do any other research, it would be a dupe or your bug wouldn't work anymore or whatever. And so it's like... I guess that's why I side with the researcher because this literally just feels like them trying to prove the impact of the bug, right? Like getting a shell on a community forum is much different than pushing code to prod, obviously.

49:38 But they prove that with this one access, they could with no additional exploitation. Yeah. I think that's worthy research, in my opinion. But also, I don't own the risk for a billion-dollar company. Yeah. Ian literally said kind of what I said to Alex about that, well, now you've got to run IR. It's like, you have that problem with any sort of critical report.

50:00 Like, if someone finds RCE or SQL injection, pivoting or not, you are hopefully going to be a bit worried in running IR, right? Like, yeah, of course. Yeah. All right. This one, like I said, there's like a bigger conversation on this one besides just this particular bug that like spurred about like, where do you draw the line on security research?

50:18 I think these guys did a great job. This is a fantastic write-up. Yep. I think that they were patient with the disclosure process being as rocky as it was because of everything we've now talked about. I think they were patient and thorough in their write-up. And they could have... pulled the pin out of this grenade a lot differently.

50:38 Yep. Totally agree. Before we could record this podcast today, you were like elbow deep in some other research about containers and KVMs, which, uh, to this smooth brained application security, uh, specialist over here who certified ass, by the way, um, that, uh, the, uh, that didn't understand the research that you were talking about.

51:01 You had to explain it to me a little bit. We said we should have hit record because you were explaining it to me. So interesting. But we have two stories back to back right now that kind of conflict. Yeah, it's pretty funny. It's like there's this world where containers aren't enough of a security boundary anymore because of the number of kernel vulnerabilities coming out in Linux in the post-AI land.

51:27 And so you're pushing people to KVM instead of container. And then there's a KVM escape and vulnerability and weakness and all this kind of stuff. Can you go through these two for me? Yeah. So I want to say that Matt and I were having a good conversation offline. And so Matt, if you have questions as I'm riffing, I think we had a good discussion going, so please feel free to ask questions because I also tend to gloss over details.

51:47 But yeah, I mean, so the kind of... The thesis here is that containers are no longer a security boundary, right? And this is an article by Depth First that I was scrolling my news sources and I saw another, yet another LPE... in Linux kernel, right? As we're all aware, AI has made vulnerability research a lot more commoditized, easier to do, and people that are maybe like hypervisor experts or browser experts can now be LPE experts, right?

52:17 So you have this kind of shift where everyone can do anything, and as a result, We're seeing a lot more LPEs, local privilege relations, kind of fall out of the sky. And so Leo Lin, who is a security researcher at Depth First, wrote this article that I really, really agree with called Containers Are No Longer a Security Boundary.

52:36 it's a good conversation about how for a long time, the cybersecurity industry has depended on containerization to be a meaningful security boundary between multi-tenant scenarios, right? So you have like code base A and code base B, and you don't want them to be able to interact, right? So we may be in the security research scenario or malware research, you're running some malware and you want to sandbox it, okay?

52:57 You have a couple solutions. One of them very cheaply is a container which uses the clone syscall to use Linux kernel to create this thing called namespaces. And the namespaces give the new process the illusion that it's in a different either set of process IDs, user IDs, file system, et cetera, okay?

53:19 And for a long time, this did the job. This was very, very good at keeping code base A and code base B separate, and you could use that to meaningfully separate them in a multi-tenant environment where you don't want them to interact. The problem is with containers, people, I think, a lot of the times get the sensation that they're in like a virtual machine almost with a container because it feels so much like a separate computer.

53:39 But the problem with a container is it all shares the same kernel, right? They are all the same kernel all the time. So if there's a vulnerability in the syscall interface of the kernel that container A is using, that's the same kernel as container B. So by exploiting into that kernel, you've now broken the...

53:58 security boundary that the containerization platform gives you. And so the argument here is like containers can no longer meaningfully hold up this boundary because there are so many LPEs that defenders can't act fast enough to either update them or patch them. Even when LPEs come out, some distros of Linux don't get patches for like several days.

54:18 There's just no remediation because it's so complicated and so hard to patch. And so he talks a lot about this in the article and brings up this new thing that is becoming a lot more popular, this idea of micro VMs. So instead of having your container be dependent strictly on the kernel to create a new namespace, Instead, the companies like Docker, for example, created this thing called Docker Sandbox, which actually acts as a VMM, a virtual machine monitor that uses the native hypervisor on the host, KVM being the one that comes out for Linux, to create hardware isolation, right?

54:57 Like it truly spawns the container as a virtual machine, right? Meaning that... Even if you compromise the kernel of container A, it is a truly separate kernel that runs in a different process space than kernel B because KVM is hardware isolating it. It's kind of an interesting shift in the, I guess...

55:19 the thought process of code isolation. I mean, I have a couple like toy platforms that I mess with that depend on like isolating user supplied code through containerization. And the inherent problem is like, okay, if a user gets there after an LPE is dropped that I don't have time to update for, like I'm at risk of the entire platform getting hosed.

55:40 But if we use micro VMs, right, the hypervisor is now the meaningful attack surface. that kind of, I guess, ends that initial thought, Matt. What are your thoughts on that? Yeah, I think I was following, right? It's basically attack surface, right, at this point. And it's like, okay, if you're running in a Docker container, and you have some sort of security issue, what's the blast radius?

56:01 What's the attack surface? And it seems like it's very big, or it's bigger than people realize. Yeah. But it wasn't that big of a deal because there wasn't as many security issues that could... take advantage of that large attack surface, but now graph go up to right on CBEs in that particular kernel level attack surface that we used to think was a good enough security boundary.

56:25 Yeah, like if you look back to like 2016, the really big one that stands out in my mind was Dirty Cow. So Dirty Cow was a Linux LPE primitive in a race condition of the Linux copy-on-write system. I forget the details. Basically, it was one of the first—not first, but first that sticks out in my mind.

56:45 Truly universal LPEs that you could just .slash run and get a root shell. And it wouldn't crash the system because it wasn't a memory corruption. It was a logical race condition. And so, you know, that kind of set the stage for like, hey, these universal LPEs come out and they're bad, but they're kind of rare, right?

57:01 They come out like every couple of years and you hear about them in the news. They get a fancy name like dirty cow or dirty whatever. And then we patch them and we move on. But just this year, 2026, I mean, we are on track to have, I think, like over a dozen unique classes of universal LPE in Linux kernel.

57:19 So it's gone from LPEs exist and are scary but rare to LPEs exist and are scary. Oh, and also they come out every couple of months, which is a much different threat model. And so, you know, that leads us into the hypervisor conversation, which now we use micro VMs. But funny enough, a KVM bug actually just came out as well.

57:39 So kind of pivoting into the next article. So before we get into the KVM bug, let's talk about this outside of like exploitation and stuff. And so say like I'm a developer. I was the head of security at a fintech company that was like really early Kubernetes. And so like trial by fire had to like figure out what a lot of this meant.

58:01 Like I didn't do any real like containerization stuff. But we were, we were, prod was running on like GKE, like they hosted Google Cloud Kubernetes solution in like 2015. And like, if you follow the documentation, that Google put out about this, you wound up with like a Swiss cheese of a security situation that I gave talks about this at DevOps days years ago.

58:23 Mm-hmm. We don't have to get into that. But I like learned a lot about like making your architecture into this containerized like single bit of your app in a container and like the whole Kubernetes orchestration ecosystem. Yeah, like microservice architecture. microservices. Yep. That was the word that was just wouldn't come out my mouth.

58:47 I gotcha. So, so microservices. So, and I got to the magic of that. I got to see the magic of that when we had like spikes of user signups and it's like, Oh, the off microservice that like is seeing a spike right now. Kubernetes can just like auto provision a bunch of containers into the auth pod, right?

59:07 And like all of a sudden that could handle that spike without having to like do anything sysadmini-wise to like the whole backend, right? Right. And like, so zooming out a bit on like the suggestion here, right? Of like, okay... we were microservicing everything via Docker. Now, maybe that's not as good of an idea for specific workloads as part of it also.

59:32 We're not saying, hey, everyone abandoned Docker. Yeah, 100%. No, no, no. So, like, what are the workloads? And then, like, what does it look like to then... do this KVM thing, like, for an application developer? Like, if we're talking to a bunch of developers right now, right, not security researchers, what does that look like?

59:49 Like, I know Kubernetes now, right? I don't know the KVM alternative or the Hyper-V alternative or whatever it is of, like, how I would do that specific thing. Do you know? Yeah, yeah, yeah, for sure. So I guess to answer your workload question, right, so this is not like, oh, containers are vulnerable all the time, and Docker is bad, and blah.

1:00:10 No, it's like if you're running a workload where you depend on a container to ingest user code, code that is untrusted, and run it, that is where it gets scary. User input. User input. User input code, right? Because in your case, you're at the application for your fintech company. you know the developers, right?

1:00:30 Unless it's an insider threat, which, like, unlikely, like, the code is doing its job. It's not malicious code. A lot of the times the issue is, like, you know, for example, I run, like, on Low Level Academy, my course site, you can submit your project. And I use containerization to segment the graders, right?

1:00:47 Well, if I don't stay up to date with the current LPE structure, If someone wants to come in and submit their project and their project happens to be an implementation of this LPE, they can use that to escalate out of the container and now they're on the native host drive API keys, right? No bueno. So there's that.

1:01:02 Now, as an application developer, what's actually nice is like Docker is aware of this. And actually, one of the engineers from Docker reached out to me to talk to me about this, which is pretty cool. I'm not going to name them. And it's not an ad, by the way, but if you wanted to make an ad, hit me up.

1:01:14 They have this thing called Docker Sandbox, which literally is meant to replace the shim between Docker and the kernel, which is called runc. So runc is the daemon that actually uses the clone syscall to create the container namespace. They have a new thing called Docker Sandbox, which acts as a VMM, which just takes your container as it already stands and turns it into a virtual machine.

1:01:39 That's it. So, like, the application from the developer perspective is the same. It's just now it runs on a different, call it hardware abstraction layer, if you will, or like OS abstraction layer. So, in theory, to the developer there should be no change no major change what are what are some other popular implementations of this that aren't docker sandbox are there other yeah frameworks and tools that people are using micro vm the ones that pop up that are pretty popular are firecracker is one and one that starts with a k that i can't think of um firecracker adw s lambda micro vms are very popular and then kava something i forget what it's called oh i can't think of the name I'm looking for it.

1:02:18 But yeah, there are companies now that are coming up and kind of creating solutions to this problem in the form of micro VM. Cata containers. A Cata container is an open source runtime that runs standard containers inside of a lightweight virtual machine known as a micro VM to provide hardware level isolation.

1:02:34 So same idea, you get containerization, but also it runs with hardware isolation. All right, and it looks like all the major cloud platforms have this as things that you can implement also, right? So micro VMs on Google Compute Engine, like E2 micro and all this are KVM level stuff. Okay. Yeah, and so if you have a big enough AWS instance, by the way, if you're like an AWS deployed application, big enough virtualized AWS instances give you access to KVM.

1:03:07 So you can literally just like run Docker Sandbox, I think, in place of the current run C. Cool. And then it'll give you KVM isolation. Okay. I got there. Yeah, I was like trying to put my, I'm a system architect looking to this. These guys just said containers might have issues for the most sensitive parts of my app that are taking user input.

1:03:29 Like, what do I need to go do homework on? And it seems like the application can still stay the same. The application code can still stay the same. You just need to make sure that the underlying virtualization technology that you're using is one of these KVM style things instead of what is effectively a higher level container, right?

1:03:49 Yeah, 100%. Again, I have not deployed this yet. I'm personally like currently experimenting with this. So, you know, grain of salt. But as far as I understand it, you just have to swap out within like Kubernetes, for example, your current runtime with like a Kata container or Docker sandbox. And that gives you the KVM isolation, which is pretty sweet.

1:04:07 All right, sweet. Amen. And so, okay, sorry, I cut you off. So KVM is having security issues as well. What's going on? So this is, so again, we're going to go doom and gloom for a minute, but then we're going to kind of wrap it up with like a sunny side up, okay? So there is a researcher out there putting in work.

1:04:25 His name is Hyunwoo Kim, right? Let me make sure I get this right. I mispronounced this guy's name like 30 times. Hyunwoo Kim. This guy. has been dropping KVM zero days, I think at this point, once a month for four months. So if you're not aware... In the Linux kernel and in a variety of other OSs, there is a piece of software that gives you a user mode process, an interface to the processor's virtualization technology.

1:04:53 So when you make a VM, what is actually happening, your CPU code is running on bare metal. It's just that the address translations are virtualized. They add another layer of translation between you and the system. So you and your VM can't touch the kernel of the host, right? It's called SLAT, second layer address translation.

1:05:12 Now, there has to be code that allows you to run this process of virtualizing a host. And so like any code, right, code can have vulnerabilities. Hyunwoo Kim has found another KVM escape. He found one three months ago, I think, that made it really, really popular. He actually won Google's KVM CTF, where if you escape out of a KVM VM that Google hosts for you, they will pay you a quarter of a million dollars.

1:05:35 And he won that quarter of a million dollars. He found another zero day that was published, I think it's like yesterday or maybe a couple days ago. But did he pivot into GitHub? But did he escalate his privileges? I know. What an asshole. No, I'm kidding. He found another vulnerability in the KVM virtualization code for ARM64.

1:05:52 So KVM, right, depends on the individual underlying hardware because every different family of processor has a different implementation of virtualization, right? So ARM has one different than AMD, than Intel, than 32-bit ARM. And so I think he's found literally a zero day in KVM for ARM64. X86-64, AMD-64, and I think ARM-32.

1:06:13 So your question may be like, wait, wait, wait, wait. If KBM has vulnerabilities, why are we going to depend on Docker Sandbox for hardware isolation? My argument there is that the attack surface that a guest has access to in a virtualized environment is significantly smaller and significantly harder to exploit than a Dockerized environment, right?

1:06:35 Or a containerized environment. In the container environment, you have access to the totality of the system call interface, which is incredibly complex and has unique combinations that can lead to weird things. It's like kind of the whole new class of LPEs we're finding. Whereas virtualization technologies, while they are complex, there's, I think, less of an attack surface you can meaningfully do things with.

1:06:57 Like, the amount of errors that there can be in these code bases is a lot smaller and I think will run out, whereas the kernel is, like, ever-expanding and ever-changing. So it's just a different attack surface. So KVM's got bugs, but less in the Linux kernel, in theory. So there you go. Well, this is about as low level as we got on the podcast.

1:07:19 So, yeah, this was like, you were telling me that you were making a video about this. I was like, I need this explained to me in different language. This makes for decent podcast content, I hope. Leave some feedback. Would you guys rather segments like that or just the news stuff or just the whatever?

1:07:38 We're also thinking about doing some question stuff from the audience about stuff that we talk about. as additional content in the week. So hit us up and let us know about all of that. Yeah, I could riff on memory corruption for like two hours, but I don't think anyone cares about that. But if you do, leave a comment.

1:07:54 Maybe we'll do it. Yeah, yeah. Well, I think there are certain parts of everything that you're talking about that a lot of cybersecurity people know about. There are a much smaller subset of the security community that could actually kind of explain down to the bits and bytes like what some of these vulnerabilities like are, look like, and why they happen and like what at the...

1:08:19 close to the metal level strategies can we implement to limit our attack surface? I think attack surface management at like a higher level than we're talking about right now is well understood. Maybe just well understood by me. So I'm like saying it's well understood, but like I got it. I got like application stuff and just straight up endpoints out there and like what's on the internet and all that kind of stuff and vulnerabilities and a bunch of exposed services.

1:08:45 But when it comes down to like oh, containers share the kernel and like the syscall stuff, but KVMs don't. And there's like a whole other thing. And like that level of attack service is very different for a lot of people. And I'd say that most security jobs, like even hands-on keyboard, don't interact with that level of vulnerability and architecture.

1:09:07 Yeah. Yeah, yeah, yeah. I think about it in terms of like, you know, just levels of levels of complexity. I think a lot of people when we talk about security, I kind of hate the word cybersecurity because it means so many different things like cybersecurity is business. Cybersecurity is threat management, like higher level attacks, service management like you're talking about.

1:09:30 And then cybersecurity is also software level software cybersecurity. Which is like a whole different way of managing like kind of the shift left conversation. How do we make it so that like bugs can't come out or we reduce the ability for bugs to come out? You know what I mean? And I think this is kind of the same thing where we're reducing the software level attack surface.

1:09:50 Even if there are software bugs, how low can you go? Or how bad is it when they happen? Yeah, I mean, I've worked on a security team, just the security team of over 3,000 people. And I'd say single digits, single digits of those 3,000 were finely tuned to the problem that you're talking about right now.

1:10:13 Interesting. You know what I mean? Yeah. Like, oh, okay, we need to, at our scale and size and threat model, we need to worry about like the firmware of the devices that were getting shipped from China. Like that is a concern for us. Like, but you didn't have teams of dozens of people that had the skillset to like answer those questions or address that threat model, right?

1:10:39 It's why I like, I mean, not to like, you know, blow smoke too much in your direction. It's why I love your channel and why I think it's so important, especially in the age of AI. Yeah. It's because I think even now we're going to get even fewer people that really truly understand the code and never mind the firmware, right?

1:10:58 Like we're abstracting it even further. Because I'd say that like most people that went and got a computer science degree from most universities probably learned a whole lot of like Java and Python or something like that. Right. And maybe had a hardware class thrown in there somewhere. But like you've always kind of latched on to some of these, you know, like topics that are obviously, you know, a different level of closer to electrical engineering.

1:11:24 Right. Yeah. That's my degree. I don't have a computer science degree. I'm an electrical engineer by trade. I didn't know that. And now it makes sense. Right. Yeah. Yeah. Yeah. I think that in the age of, hey, my computer's going to write my code for me, it's like ever more important to like really, really understand what that code is doing, bits and bytes wise, like to understand how the adversaries might take advantage of that.

1:11:49 Yeah, I mean, I have a genuine concern that, like, you know, again, not to get, like, dark and bleak, but, like, well, like, Linus Torvald's gonna die someday, unfortunately, and, like, that whole generation is going to go away. And my question is, like, who takes over? I mean, if you just look at, like, the population generally of developers, there are significantly less people now that know and understand C and assembly and memory alignment and structure than did in his generation, right?

1:12:13 Yeah. Um, actually Linus Torvald loves rust, not because of the language, but because rust attracts people in the community towards knowledge of the architecture, right? Of how it works. And so the question is like, if, I mean, if humans are still writing code in 20 years, I have no fucking idea. But if we are, um, we're going to have significantly less people that understand the systems, not only for even like security, just pure on pure maintenance, right?

1:12:36 Who's going to maintain a Linux kernel, which literally runs everything from that camera to that camera to these monitors. Like all that stuff is Linux. Yeah. Are you Linux? I think, therefore, I am Linux. Yeah. I mean, back to that same large corporation I worked out, we still had COBOL people kicking around, man.

1:12:55 We still had mainframes kicking around. I'm sure... podcasters that didn't exist of the 90s would have been like, what are we going to do when no one knows Cobol anymore? Right? It's like, well, there's going to be that guy that figures it out and sits in the basement and keeps that thing purring. I think I saw a job posting for the New Jersey Department of the Treasury.

1:13:18 COBOL programmer, $220,000. Oh, yeah, yeah, yeah, yeah. And I'm sure that's not even that high compared to some other large financial institutions that very much need that stuff going. All right. I know we're long. I do want to hit some of these other things. So I hope you all are along for the ride for a longer episode.

1:13:37 Send it. We got rogue AI again, man. People would hold us at gunpoint if we didn't talk about this. Low level. The AIs are out there hacking stuff that they're not allowed to again. This time... Oh, man. I have thoughts on this one. Please introduce it, but I have thoughts. I have thoughts, too, of course.

1:13:58 I'm also, like, really sick of normie media talking about cybersecurity issues. Yeah, that's what it is. It's like I feel like the the hipsters, right? Like I thought I knew about this before it was cool when it comes to cybersecurity. I've kind of always been a dick in that fashion, but I feel like it's justified now because I feel like mainstream mainstream media and mainstream media is getting some of this a little egregiously wrong.

1:14:24 And I'm curious. So let's talk about what we're talking. What we're like going over here. What happened? I heard about this story from that guy on social media, Aaron Parnas. I don't know if you catch it. No. Everything is breaking news. Oh. And he just reads every headline or whatever, right? I don't dislike Aaron, but it's just like...

1:14:43 It was... man, when he's like, the AI agents have hacked into a government website or a government network or whatever the heck he said this time. All right. So we got a story that came out and it's targeted at OpenAI again. And it's really talking about that same timeframe in like the late spring, early summer of this year, where a lot of these stories that we're talking about are from open AI.

1:15:09 It's just they're finding more evidence of like other stuff kind of going rogue. This time it's coming out of the Australian government. Because OpenAI just notified them in September about this activity. I don't know when OpenAI found the activity, but they just notified the Australian government that they had some information about it.

1:15:32 It's like literally in the same week as the Wiki collusion thing and the Ruby gems. It's like within the same couple of weeks of Ruby gems, the German like Wiki collusion site and like a few weeks before the hugging face hack. this one used a website called urlquery.net, which a lot of people use to bypass...

1:15:57 If you want to load a website without loading it on your computer, you can load it on this website. And it seems like the agents used... this website to do some of the stuff. They had a goal. So very similar to the other like rogue AI agents. The goal from the people that were driving these agents was to get a bunch of data, like healthcare data about stuff.

1:16:19 I don't even know what stuff, but they couldn't get the data just like out on the internet. So like step two seems to be using, we have very little information, but like using... what seems like an OAuth top 10 hit list of application security vulnerabilities like SQL injection, command injection, path traversal, and cross-site scripting in order to actually go and get the data that the agent was tasked with getting.

1:16:47 All right, low level. I've been holding you back. I've been holding you back. You've got feelings. Let's go. Yeah, yeah, yeah. So here's my thing, right? My issue with this article is that I feel like it's trying to paint up this incident, if you'll even call it that, the same as the hugging face incident, right?

1:17:04 So if you are not aware, OpenAI's model went rogue, hacked hugging face, inside job, not a different conversation for a different day. It wasn't inside, but that's my running joke. Anyway, it literally found a zero day in the artifactory, in JFrog artifactory, used that to pivot to the internet and hacked into hugging face.

1:17:21 Big deal. Big news story. Okay. I feel like This news story is trying to conflate the two of them, right? To make them at the same level. What I have here, the issue that I have is these incidents appear to be like the AI model like tried to do an SQL injection or like tried to do cross-site scripting, which like is hacking activity technically.

1:17:45 But there were also like script kiddies in my college that got in trouble for doing this. You know what I mean? And they're not like AI models that went rogue. They're just kids that typed tack or one equals one tack colon slash dot, you know, dash dash. Like I just don't think these two things are the same.

1:18:00 And on top of that, you know, when are we going to start getting held accountable? Not we, but when is OpenAgg going to get held accountable for its felonies? You know what I mean? I don't know. Both things are frustrating because I know I have friends in college who like couldn't touch a computer in the college for a semester after doing some shit that was similar to this, even though it was dumb.

1:18:15 You know what I mean? So I don't know. It's just it's very silly to me. Yeah, this is kind of weird. I also... I guess one of my main issues about this one in the normie media is that for some reason they're putting it on a pedestal that this is a government website. Like... government websites are somehow less or susceptible to SQL injection or cross-site scripting?

1:18:40 I know. I think quite the opposite, right? I mean, we just talked about the FBI who potentially didn't update their system for three months. Like, you know, come on. Uh, so like, I don't know, man, like AppSec's hard. Path traversal, cross-site scripting have been everywhere for 25 years. We've known about how to not code SQL injection, cross-site scripting, path traversal.

1:19:03 The entire time we've known about the vulnerabilities, we've known how to not... code them. And like, we're still, it's, it still happens everywhere constantly. So I don't, I'm not like, so my God, they hacked the Pentagon on this one. But it does seem to be a concerning trend that, you know, Give a group of AI agents a task, and it seems like the models that you and I don't use, the unreleased models, take that task extremely seriously.

1:19:35 Yeah. Extremely seriously. By all means necessary, achieve said goal. Mm-hmm. Is a concerning trend from the technology, from the makers of this technology, right? I agree with you. I'm not like... oh my god, headlines, rogue AI agents hacked a government. But I am like, what the hell are we doing over there?

1:19:55 Yeah, yeah. That this time period from April to July, it was just apparently the horse blinders were on and we were just giving tasks to AI agents and then being like, hope they didn't commit felonies because i'm not watching anymore until september and then i gotta like go say i'm sorry to all the governments that they got that they hacked right yeah if you think about like the hugging face thing that was kind of my main criticism is like how is no one watching like the prompts like are you gonna sit here and like sit here with claude and again it was open ai i don't say you can watch it live do its thing if you look at it it says i am now doing this you know thinking And so my thought was like, okay, this ran for over a weekend.

1:20:35 How did nobody come in and like check out the prompt as it was running? But now we have this graph that shows we are literally April 16th to June 21st. There are thousands of high confidence events of the models doing hacking adjacent activity, right? SQL injection, cross-site scripting, entity injection, et cetera.

1:20:59 no one was looking at this. There was no monitoring at all. Like, yeah, it's kind of weird, man. And like, this brings me back to Zach Corman's video about like the non cybersecurity industry, basically dictating the, the narrative on cybersecurity right now in the age of AI. And like, why are we letting it happen?

1:21:13 It's just like, this is what, this is what it's coming down to. Right. Like, I got to meet Greg Brockman at Black Hat this year, co-founder of OpenAI. Like, he had some really thoughtful questions to me about what they were doing and security and, like, if they released a model that had no guardrails.

1:21:28 Like, we had, like, a really, like, I don't know, kind of crazy hypothetical conversation that it was like, pinch me, am I doing this right now? Like, I'm just a guy with a YouTube channel, but, like... It was super cool. It's cool that he's thinking about it at that level, right? Co-founder of the company at a Black Hat event asking about it.

1:21:46 Seems like he used to go to DEF CON and stuff back in the day. They got hacker brain, right? But he was just on stage last week talking about in the aftermath of everything that we're talking about, all these incidents, that they paused a bunch of their engineers' work and they said, you guys are not shipping features right now.

1:22:08 like he took 25 people or whatever it was off the bench and said, you guys are now you're running Astra on our own stuff. You're, you're like finding all the security issues. And like, this was some sort of like revelation to them. And like that they invented some new thing. The joke that I made was like founder reinvents secure SDLC from first principles.

1:22:31 Yeah. It was like, oh, I'm taking engineers and like, we're going to run our own stuff on our own stuff to like make sure and find our own vulnerabilities. It's like, yeah, that's like every AppSec program I've ever built. Like since the early 2000s was like, well, literally our motto was hack yourself first.

1:22:49 And like, he's on stage in 2026 being like, you won't believe what we did. We stopped shipping code. I made this comment on my last podcast. It was like Guillermo, I forget his last name, like the CEO of HerCell. HerCell. HerCell. when there was a big, either it was a Vercel hack or vulnerability in Next.js, he had this big comment on Twitter that was like, in the age of AI, it's not that we should assume when things get hacked, or sorry, it's not that we should assume if they get hacked, but when they get hacked.

1:23:15 We now know that there are vulnerabilities in all code. It's like, brother, this is not a new thing. We have done this for a very long time. This has been like The argument of any meaningful app sec person for a long time is, but, like, bugs are there. They're going to be there. What do we do if? This is not new.

1:23:30 So to your point about, like, the normies, if you will, kind of driving the cybersecurity conversation, it is very frustrating. It's like we've been yelling about this for a decade. You know what I mean? Yeah. Yeah. It's like, I was like, what, what do you all think AppSec has been? Yeah. Like, you know what I mean?

1:23:45 Like, Oh, like we, we reinvented AppSec from first principles. Like, cool. We're running our own security tool. Like the, the, the super bug finder we developed, we decided we should point it ourselves. Right. And, and not, you know, just ship code indefinitely without checking it for bugs. Yeah. Kind of crazy.

1:24:05 Insane. All right. I got one more quick one. We're super long today. But every time I make a video about ClickFix, what do the comments say? What do the comments say? How could you be so stupid as to participate and be hacked by a ClickFix? You dummy. But I would never fall for this. Yeah. Okay. Really cool blog out of Push Security Disclosure.

1:24:29 They... They... That's their product is like helps protect against click fix. So like take that with what it is, but they put out some, some data based on a lot of the stuff that they're seeing of trends of click fix. And it's just, again, graphs up to the right, right? Like of click fix, continuing to get to, to be a more popular tactic by attackers.

1:24:53 This would not, be the case if it wasn't working. So like preempting all the comments that you wouldn't fall for this because you're a genius, right? But like the right lure, hitting the right person in the right situation is successful. And that's why it's happening. One of the more interesting stats on this and like why I wanted to like bring it up was four in five click fix payloads that they saw are accessed from Google or Bing.

1:25:25 So it's like not even like a spear phishing lore. It's like on websites that do get cataloged by search engines are serving up click fix pages. And so like, and they're just getting more and more creative with this. A lot of AI themed lores. So like people are already like, if you're a non-technical person and you're trying to do the AI thing is you got a bunch of FOMO, And you land on a page that's, like, going to teach you to do some, like, weird technical thing with AI that you don't know how to do.

1:25:54 It might not seem weird to you that you're about to run a command on your computer. Right. Right? It's like, oh, I'm going to open up this terminal that I've never opened before in my entire life. And I'm going to run some command because I need to do the AI thing. Right? And so, like, it's working. People are, you know, it just continues to be bad.

1:26:11 Anyway, this report... from push security goes into a lot of the variations on the lures that we're seeing. And then the variations around evasion of detection that we're seeing, including fetching its command and control from smart contracts on public blockchains. Ether hiding, they called it. Interesting.

1:26:31 So instead of just like straight run a command that like reaches out to a C2 that like maybe some EDR or some network level detections might catch, it's grabbing some stuff from public blockchain. Yeah. Anyway, I think it's really important. I think it's one of the more important things to do as blue teamers is stay on top of threat actors' MOs.

1:26:50 I think I've said that a number of times on the podcast. 100%. This is a very good pile of data about morphing attacker MOs. And then just a really quick fun one on Bleeping Computer that I saw today is that placeholder domains used in dev documents, including Stack Overflow posts going back to 2015, including a website, third-party.com.

1:27:12 So someone was just like responding to a Stack Overflow thing and they were like, yeah, you could see like... quote, thirdparty.com thing, answering someone's questions. Well, attackers are going and finding domains in documentation that are fake, quote-unquote, fake domains, and they're actually squatting on them.

1:27:32 It's kind of like typo squatting, and they're just putting a cloud flare, like, prove you're not a robot, and they're just putting a cloud flare, uh button on it that is a click fix lore on these uh third-party websites honestly just kind of fun one super cool uh this stuff is everywhere we're just seeing it everywhere and like little variations on uh on it so if you don't have an answer for this uh it's time to get on it on your corporate network but i would never fall for it i'm a genius matt Yeah, for sure.

1:28:01 For sure. I know. I know we are impervious to this, of course. And everyone around us that ever touches anything would never fall for this. Social engineering couldn't be me. Yeah, we were already long, so I'm not going to talk about some other stuff. But we've also got some really cool thread. I'll probably just talk about this in the next podcast because it's not like a timely thing.

1:28:22 But we also saw a few real-life behind-the-curtain examples of these social engineering attacks getting caught. And the people were wise to it, but they played along. And so we've got like some footage behind it. So I'm teasing that for the next episode. I got to remember, put in show notes for next week.

1:28:39 You know what else we should tease, Matt? He's the audience to go check out the sponsor of the video or of this podcast. Maeve's great partner helping us keep the code that we publish more safe. What's up? You got your finger up. I forgot. We're going to do a live thing. We're doing a live podcast at a live conference.

1:28:54 And we have a discount code to give our crowd. We almost forgot. We do. If you are attending or considering attending OneCon in Vegas hosted at the ARIA by Sentinel One, guess what? we've scored you a little discount, a little bit of a freebie. You know what I mean? Not a freebie, but a lessbie. Use that for 20% off, I believe, of the ticket to get into OneCon, which is pretty great.

1:29:17 That's a big discount. And the conference seems really cool. I'm actually kind of excited that they tapped us. They're doing like a live CTF type thing, a culmination of basically a threat hunting, but like CTF, so like blue team type CTF. that's been going on regionally for the year. And they're culminating here in Vegas for the champion.

1:29:38 Sweet. So I think you and I are going to be talking to the competitors and looking at the competition and really getting into that, which I'm super excited about. We're going to be harassing the contestants the entire time. Yeah, I think they were trying to make us contestants at some point. And then some people were like, we do not want washed YouTubers on this stage.

1:29:56 And I was like, I get it. I get it. I get it. Again, if it was like a modern like attack defend, like memory corruption CTF, maybe. But like, yo, I am not a threat hunter. I would suck ass at that CTF. I think that would make good content. I think us sucking ass at that contest would make good content.

1:30:10 Yeah, I agree, I agree. But some of the other breakout sessions seemed really cool. I saw one that was like an FBI agent and the person that he was hunting for years are now like buddy cop, like something or other. So they're giving a talk. And then Cliff Stoll, author Cliff Stoll, who was one of the keynotes at DEF CON, that was awesome.

1:30:28 He's doing one of the keynotes there too. So yeah, I'm kind of excited for it. And it's cool to give our audience a discount. Yeah, man, for sure. All right, y'all. Thanks for listening. I appreciate it. Check out the discount. Check out Maze, obviously. Give them some love, and see y'all next week. Happy hacking.

1:30:44 Peace!