Did the Knicks’ phishing test go too far? Plus, hackers pose as IT in Teams Transcript, AI Summary & Key Points

00:00 Panelists, today we're talking about fishy emails and fancy rings, but what I want to know is what talent or expertise would earn you a championship ring. >> Maybe I read a lot of books. I guess that's maybe I'd win a ring for that. >> Almost all of my days now are explaining hacking to people who aren't hackers. I'd say use code builder to take a very complex research paper that Patrick provides and make it simple for everybody to read.

00:26 >> I give you a rig for that for sure. Hello and welcome to Security Intelligence, IBM's weekly cyber security podcast, where our expert panelists turn the biggest industry news stories into practical takeaways that you can use. I'm your host, Patrick Lucas Austin. Our guests on today's show are Patrick Facell, X Force Red Adversary Services Lead, Nikki Robinson, STSM for AI and Development, and Serinas Tumal Penta, distinguished engineer, master inventor, and CTO cyber security.

01:01 Thanks for joining me, guys. [music] Our [snorts] first story is one that should be a celebratory one for many New Yorkers and Knicks fans, but unfortunately some MSG staffers uh were left uh to take an extra cyber security training class uh after responding to an MSG sent fishing email um that has left people questioning how effective fishing tests are uh in the first place.

01:30 Um, a few weeks before the Knicks ceremony, the Knicks ring ceremony in September, um, MSG staffers got an email asking them to select which type of ring they would like to receive. Um, it is customary in a lot of, uh, sporting sporting leagues for staffers to get rings, championship rings along with the players of a team. Um, unfortunately, this email was not in fact legit and led to a uh, mandatory cyber security training class.

01:59 I'm just going to uh start with you Sernivas. I feel like this might be this is either the worst way to do a fishing test or the best way to do a fishing test. As a practitioner, right, awareness is very important. Okay. And what MS has done is probably is helping in two ways. on obviously raising awareness and education for MSG employees itself and just by virtue of publishing this story and getting more people curious about this and reading about this and we talking about this is actually helping more than MSG here.

02:33 So actually thank you to the MSG team for for know sharing this story and people will be extra cautious on on this like not getting lured into no they're in this euphoria right they want they know everything is good now I want a piece of action I want a piece of know momentum of those things no people will be that no that's what the bad actors are looking for like take those emotions and then see how to exploit during those emotional times right this is the positive emotion and a lot of people will will come in and to

03:03 be part of that action. So I think one definitely help the U corporation itself plus they're doing a public service as well helping others. So thank you MSG >> Patrick. I'm going to go to you. Um I'm I'm assuming you may have a similar uh opinion but maybe you can maybe you can give me some hope here. We do fishing as part of our engagements very frequently and we always tell our clients, is there anything that an actual threat actor wouldn't be willing to send in their emails to get you to click on it?

03:37 And obviously the answer is no because there's no harm to them. But we also recognize that there's challenges that that they have to deal with, which is at some point they do need these users to click on emails when they send them. So, one thing that we like to do is send an email that maybe capitalizes on something that's very timely like this. For instance, right now in the United States, lots of people are doing open enrollment for health insurance.

04:00 Well, what a great opportunity for a hacker to send an email that looks like open enrollment. The problem is if we send that email as somebody who's trying to test and teach now, when the actual open enrollment happens, they the the users might say, "Well, I don't know if I can click on that." So, they get quite nervous. And so, it's all about writing that line.

04:18 And you know these days instead of teaching people to just think about oh look for things like poor spelling in email really sort of pushing them to think of all email as an untrusted thing and starting from there. And so there definitely is a good and a bad here. >> You know it's interesting you mentioned you mentioned you know the signs of a sort of fishing scam being things like poor spelling.

04:38 Um, I was going through IBM's cost of a data breach report um that noted that fishing was the top attack vector um and costs on average about five over $5 million a year. Cost businesses over $5 million a year. Um Nikki, I'm wondering if the signs of the traditional fishing scam are maybe a little outdated now. We've got AI that can replicate, you know, my my mom's voice and fool me into wiring some money.

05:10 We've got um you know, device code fishing, trying to get the uh codes off of my phone. Is email fishing the sort of baseline fishing scam that we should be prepared to handle and what what comes after that? >> What we used to see in fishing was just sort of hit everybody, as many people as you can, and just sort of hope that somebody clicks on it. We're seeing a lot more sophistication behind the emails.

05:34 Part of that is because they have AI to help, right, with imagery, uh, crafting really, you know, real looking emails. Uh, but we're also seeing things like, so business email compromise used to be a very targeted, you know, type of attack, spear fishing at executives or someone very specific. And what they would do is they would spend three months, six months, nine months getting to know the individual, how they craft emails, how they respond to things, when do they craft things.

06:06 That's all that social engineering aspect that we're seeing they're able to use in a a much broader fishing type of fashion. So, what I would say is when we're educating our users, giving them real scenarios is super important. You know, we talk about uh what does it look like if they're trying to get you to click on your bank. uh you get an email from your bank, you know, a lot of those things are the same types of things.

06:26 I loved uh Patrick's example of open enrollment. So, giving them examp real real world examples of what they might see, I think is super helpful. But I'll also bring in the technical control aspect. I think it's a really good time to evaluate technical controls for email security. Um making sure that there's an external flag on anything that's coming from external, making sure that um domain checking is in place.

06:49 Uh, I think I could go on about demark, DKIM, and SPF for uh, years. I won't. Uh, but all of those settings when it comes to email security are super important. And, um, so I recommend all of our our technical friends uh, to look at defense in depth when it comes to email security because one tool really doesn't cut it anymore. You really need a a layered approach to email security.

07:12 >> Patrick, there's one more um, pointer to this, right? Obviously, the story starts with MSG. It's a corporate environment. Okay. And then we're doing those things. Now this corporate people are also personal email users and that's a that's a entry point as well for bad actors. Right? So we have all these corporate controls and governance and layers and exercises that we could do on the corporate side but on the defenses are not so strong on the personal side right and there is different know obviously family members

07:46 different levels of users in the family members and everything know from kids to uh elderly people etc right and there is a different way of exploiting uh things those things so I mean taking this opportunity for using this as a discussion topic for general awareness whether it's corporate or personal use and you talked about deep fake also right deep fake is being used on elderly right a lot of these scams are happening on elderly people right so in broader things you know this particular conversation hopefully this

08:15 will help just not for corporate users only but also everybody know who's using ITM email systems before we move on to our next story for everyone watching and listening uh please remember to like and leave a comment and don't forget to subscribe on YouTube or wherever you get your podcasts. [music] Our second story um delves deeper into the whole uh email fishing epidemic that we're seeing.

08:43 Um, we're talking about uh mailbombing and Microsoft Teams, an Arctic Wolf uh blog post detailed an social engineering campaign with over 400 incidents in the wild using Microsoft Teams external chat creation tool. Um, Nikki, this sort of touches on what you said when it comes to that sort of technical access and and management. The attack starts with a with a mailbomb um which leaves your inbox full of hundreds of very interestingly written emails followed by more emails by your uh supposed IT department um asking you

09:21 for remote access so they can take care of your email uh issues. Um Arctic Wolf says there are detection indicators that IT teams can use to avoid this this incident from from happening to them. Um, but I do want to just talk more about the social engineering element of the scams we're seeing this year. Um, Nikki, again, I want to go to you. This is a social engineering scam through and through, powered by AI, emails using emojis and, you know, nice dialogue that can be sent at scale.

09:54 What does this say about the future of of of my inbox? >> I'll start with um, you know, this is a a tale as old as time. uh pretending to be an IT employee trying to fish credentials. This is something this technique has been going on for years and years and years. They just leverage different technical mechanisms to you know to be able to gain those credentials, gain access, elevate privileges uh and then try to persist or maintain a foothold in that environment.

10:26 Um the the most important thing is the the technique is changing. you know, they have access to more tools, more sophistication. The the challenge really becomes what looks suspicious in my inbox. 500 emails coming in looks pretty suspicious. If you're getting uh an email from your IT staff that says, "Oh my gosh, did you just get 500 emails? That's crazy."

10:49 Uh that's also suspicious to me. Um because my IT staff shouldn't be emailing me something like that, right? They may call me. uh they might go on to whatever your communication channel is and say, "Hey, we see something suspicious." But it uh in general will never ever ask for credentials and they shouldn't ever try to set up a remote session to gain access to your computer.

11:11 They should already have access to your computer if they're if they are the IT staff. So, some of this I think is general awareness for technical procedures for how your IT staff would be reaching out to you. I think the other aspect is having a level of and I can say this because I'm in cyber security but a level of skepticism about when you see an email start with skepticism and then validate check a couple of things especially if you're not sure if if it feels like it's not right give it a couple extra minutes or

11:40 even call your IT staff and say hey I got a weird email can you guys take a look um that's that's probably the best way to handle it but um yeah they it spam spam bombing and pretending to be IT staff is uh something I think we'll continue to almost makes you wonder if um Serbas, do we need a a cyber security sort of fishing poster in the break room next to the OSHA poster sort of telling people what to watch out for in terms of in terms of scams?

12:09 Um how do we how do we make it clear when it is on the line and when it's not somebody pretending to be it? I think the general awareness that happens in the corporate naturally through through it means and everything I think that's that's good that's adequate right and we we don't need good right if you have more visible way of uh raising awareness and reminding everybody on a daily basis know regular basis that's good that that that's right but there are also other techniques that we could we could use now I use a

12:43 technique I have a filter rule on my email okay and anything that is not follows that particular rule like you know known IBM members like absolutely uh my partners or or the clients that I'm working with there's a particular format there's a format for know people who are trying to spam as well so if when you apply those filter rules and filter out that that emails that's not supposed to be coming to you yeah it piles up in a lot fair you don't want to look at it or look at it browse through it and see if you're not

13:15 missing anything but don't try to access any of those things or all of those things, right? Just see if there's something that you feel it's important. Okay, just check it, right? And say, okay, do you want to uh accept it or not? So, techniques like that will help. Okay. Now, just because you said team, I just want to bring in one more um uh issue as well.

13:37 Email absolutely we're talking on email, but this teams thing that that we talk on or not just teams, you know, it could be anything. this this thing pops up and say hey I'm your note taker or we are setting up in slacks and say when you want to talk to the partners and things like that we have to think about awareness people should be aware of those entry points as well right where bad actors could come in and spammers could come in scam artists which could come in through those channels as well so just raising the

14:05 awareness more in terms of the entire collaboration suite is also important >> Patrick I want to talk about the access issues here and sort of the the problem that comes that stems from the from this setup. Um is this a situation where everybody gets the you know least amount of access until until otherwise noted sort of you know you're you're kept in here until until you have proven that you need to make an external team's call um or things like that.

14:40 Um, you know, how how locked down does the system have to be to prevent something like this from happening? >> Well, the real answer to that is there's no such thing, right? Um, you know, if we were going to be like really pedantic, like you could go to maximum security on everything and at some point it's just a matter of how much time is willing willing to try to gain access.

15:01 So, um, I think you know Nikki and Sereni did a really good job of talking a little bit about thinking about the problem as as a user. Um and so just to kind of switch that around a little bit when we you know even thinking about Patrick you mentioned sort of this principle of lease privilege like how is the hacker thinking about this there and why is this such a great approach like like Nikki mentioned this is something that's been around for a long time is hackers love to use something that looks legitimate that

15:30 actually uses a legitimate you know functionality you s was talking about all the different channels you might use as a you know I'm a corporate user I sit down on my laptop and I've got Slack or Teams and email, these are things that that the organization has provided to me and the hacker sees exactly those same things. And if they know, hey, this is what they use.

15:49 Uh maybe I'll send them an invite to my Slack channel. Now I establish a rapport with them and I look like I'm a customer of theirs or something along along those lines. That's why Teams is such a great um way to to begin some communication like this because sure, it does kind of look legitimate. It's coming from Microsoft. it's an actual Microsoft, you know, hosted system and it's sending me a request, like why wouldn't I accept that?

16:11 And, you know, lots of users may not understand sort of the intricacies of trust relationships between these sorts of systems. And so, um, it's it's a really, you know, I think it's such a difficult question to apply a lease privilege to because it really comes down to, well, what does your user need to be able to do to do their job and how do we put the right technical controls around them to protect them and make them aware of what they should and shouldn't be doing?

16:36 That's why cyber security is such a tough, you know, problem to to to understand. One more thing that I wanted to add on uh tag on to what Patrick was saying which is the technical controls are super important but the the social engineering the psychological understanding motivation of what these people are after they're after credentials they're after information they want to gain access to systems.

16:57 So, so having sort of that mindset like Patrick said, understanding what the attackers are after can really help you understand how you want to protect your systems or things that you should be looking for uh you know to be skeptical of or to keep an eye out for. So, I always encourage uh when we're thinking about cyber security practices to help people understand uh behavioral analysis, motivation theory, there there's a bunch of of really important psychological aspects to how and why someone would want to attack a

17:28 communication channel. So, >> Nikki, is is there any, you know, not to not to put you on the spot, but is there any sort of way that we can maybe positively reinforce more sort of vigilant cyber security hygiene? Yes, I would say um we we talk about u I'll pick vulnerability management as an example. We were talking about this a little bit where you know the the the idea was okay well you have to patch everything you have to get everything done you have to do everything that sort of comes across as a an impossible task

18:01 that's a a mountain that most people can't climb and so I think when we talk about cyber security hygiene or best practices we have to sort of change the story around what we are asking people to do we're not we're not asking you to to fix everything all at once we are asking you to be mindful to be considerate and to take a little bit of extra time.

18:20 You know, you you can take that extra time, especially if an email is saying, "Hey, you got to click on this now. Don't do that." Uh so, I I think it's about us helping people understand versus sort of pushing it at them. You know, I think we we need to be seen as allies and um and that we're really trying to help. So, I I think if we can change the narrative that that'll help users, too.

18:40 >> Yeah. And I'll add to last thing that Nikki mentioned, right? Email comes in. If you don't think that it meant for you, doesn't feel the delete button is there. Use the delete button more. Right? So simple hygiene practice, right? Just don't open it. Delete button. Another hygiene practice. Yep. Laptops or any of the systems, keep it current, patch it, right?

19:04 You probably have your your corporate systems automated like know sending out automated patches. look for those notification and ensure uh that's being uh current based on your know corporate notification. So things things like that I think we can move on to our last story one that I suppose many have been expecting for a few weeks. Um, according to CISA, they have reported a successful exploitation of the recent PHP vulnerabilities that were um that were uh released or revealed last week.

19:46 Um, CISA has added both flaws to its to its vulnerability list. Um, which it usually adds to when there is evidence of of a successful um exploit. Um the the exploit was discovered by researchers at Perplexity um who said that the threat actor achieved remote code execution. Um, a troubling stat I I saw was one from the Shadow Server Foundation, which found 263,000 instances of of endof life version PHP, which essentially means that these versions will not be patched or get updated and that the users must upgrade to a

20:26 newer version of of PHP. Um, Patrick, is this a hacker's um, you know, dream come true? all these all these unpatched PHP instances and all these vulnerabilities just waiting for me to go to town. >> I'd love to say yes. Uh but we've looked at this in practice and obviously when you know uh my team and I we see something like this, the first thing we ask is uh well can we can we use this?

20:52 Is this something that we can go use in our engagements right now? And how hard is it? Uh unfortunately yeah for us in this case or maybe fortunately depending on how you want to think about it um the answer is most of the time this is actually very difficult to exploit in the wild. It's there a set of really complex conditions that have to be true um in terms of memory manipulation that are typically you know um not easy to reproduce in the real world.

21:16 And um not that it makes it impossible to exploit, but what that does is if you're a a smart defender and you know what you're looking for, it gives you a lot of opportunity to see someone's trying to exploit this in the wild and understand that you have a lot of chance to see it and stop it before it goes anywhere, if it was even possible to trigger in the first place.

21:35 So, um while it's super interesting and I'm not saying that you shouldn't take it very very seriously, you absolutely should. I think that it's not uh it's not at the same level as some other similar vulnerabilities we've seen in the past like you know something like log forj in terms of it's much harder to actually use as a as a bad guy particularly if you have um a defender who knows what they're looking for.

21:57 >> You know in reading about this and reading researchers discussing this um there was some discussion about the quality of proof of concepts that were circulated to the cyber security community. I see you nodding your head very knowingly. Um, can you maybe illuminate that a little bit? >> I'll just say, you know, uh, this is always a really tricky thing, right?

22:18 If I'm I'm a researcher and I've become aware of this vulnerability, particularly one that could have a lot of impact, what should I do in terms of what I release? Should I release code that it shows maybe it's possible but doesn't get it all the way there? And particularly in the age of AI, the ability to take a partial vulnerability and turn it into a full exploit is is much shorter than it was, you know, 2 years ago or 5 years ago.

22:39 Um, so, you know, it's not clear uh what the source of that, you know, why did we release um details that were perhaps not all the way there or maybe they they realized that that this vulnerability is much more difficult to trigger than originally, you know, uh, indicated. So I think you know I don't want to suppose what what the the reasoning behind that was but I will say um what's very clear to us is that if you wanted to go and produce this for yourself it would take quite a bit of of work uh a bit of manual and

23:14 maybe some serious investment in tokens to go um actually make the code that would that would go and exploit this in the wild. Nikki, uh, I'm wondering whether or not the whether or not PHP in general could use a an AI assisted security boost considering the news coming from the foundation itself that these vulnerabilities were discovered based on a a security audit, you know, a long overdue security audit.

23:43 Um, so I'm I'm wondering how we can prevent something like this from happening. Um, is there an AI agent that can maybe you run through my code and be like, you should probably take a look at this. It's that time of year. It's it's time for your it's time for your dentist appointment and your and your third party audit. >> Yeah, there there there are there's a lot of tools, techniques, things that we can use to evaluate our code, evaluate our our uh software, the tools that we're using, the libraries that we're using.

24:09 there are a number of scanners if you're using a CI/CD pipeline if you're um you know and I think I think we as developers should be very cognizant of what we're using um I think just in general what we've seen from open source right we we do have to be careful what we're using um and be aware uh who's patching it uh who runs it who's making sure that it's secure um but but I would also say I think we uh as a developer I would say it's it's super important for us to try to get away from the old way that we used to code

24:48 where uh you know and I can say this cuz back when in my IT days you know it was like well that old version of Java I don't want to update cuz that's going to be a lot of work. Um we have so many tools available to us now to help us with coding to help us figure out upgrade paths. um claude claude code there's I mean there's a million perplexity there there's a million uh options out there so my recommendation is to leverage whatever is available to you in in a corporate setting or in your personal setting that you can

25:19 use take a look now uh because I want to take the conversation sort of away from PHP um this this happens a lot this this this does happen so uh if you can evaluate your your whole tool tool stack all your libraries figure out what you're using um that can be really helpful just from an assessment perspective to to sort of lower the the the risk landscape in general.

25:41 Um so I hope people take this as a uh maybe I should check things out, maybe I should look because in you know things will continue to happen. So maybe take a a broader look. >> It's interesting you you talk about all all the new tools that can that can help people you know move faster. um the executive director of the PHP Foundation um you know was was quoted as as saying you know the there are twice as many proposed changes but the number of contributors has not followed um and and Cernas I can maybe direct this

26:14 question to you the PHP Foundation itself has only one full-time employee being the executive director with the rest being you know part-time employees and contractors and volunteers Um, I'm wondering if there is a maybe a risk in leaving such an essential part of our infrastructure, you know, in the in the hands of of, you know, incredibly capable people who are simply a little underfunded.

26:43 >> Absolutely. Before getting to that point, I'll just take the uh take one step back and explain a couple things. >> In an enterprise, people are getting lot of these advisories thrown at them. Okay? they're not able to parse out and say okay what is it meaningful for me and what is it not meaningful for me right so that's the first step so so Nikki is mentioning about like how do I identify those things so the first step in an enterprise is they have to have an understanding of their asset intelligence right their

27:10 entire estate their business context their application context now I have this infrastructure this cloud this hybrid environment what is the asset inventory that I have what are the software inventory I have what is the application inventory that is sitting on top of it is what is in a runtime environment, what is in a code environment. That is very very very important these days, right?

27:31 A PHP situation happen. We can pull this and check how many clients, how many people are able to say, "Yeah, I exactly know what PHP environment I have, what PHP versions I have and I can go proactively and and know take actions on that." Very few companies in the world. Okay. So that level of preparation is important not just for this but into the future as well as a cyber security professional like you are seeing all these things.

27:59 It's a very exciting moment. What has been a backdoor or or a not so priority activity which was a hygiene management now has becoming to the primary step right now. Hey everybody's thinking about I need to go do this autonomous remediation. Many people ask us about hey do you have an way to automate my patches? Can you automatically autonomously patch my things?

28:19 Can you identify where my systems are and help us with those things? There are a lot of inquiries coming at us that right. So the conversation is shifting the focus is shifting. We should take advantage of this particular situation to get the hygiene right. Right. That's very very important. When you have your hygiene right there are fewer things to to manage.

28:39 If your hygiene is wrong, there are more and more holes that the bad actors could come in and that that's so that's that's one thing right now to come to your point about open-source communities in general. So the answer part of that for in terms of this yes it is now restricted constraint but Red Hat lightfield opened a door in that part right so anything in terms of opensource in general if there is a vulnerability available or a bug or something that that a corporate or an open source community would engage Red Hat

29:12 and then take it to Red Hat. Red Hatad would provide a fix and they would provide it to the corporations and they would want to give it back to the communities as well. So where there wherever there are communities with this kind of a deficient set of like know less support or mostly know part-timers giving in those things there are other channels being opened up with Red Hat like consortiums and then there are other consortions forming as well.

29:36 So engaging those communities will help and we are this is not just about individuals right this is about us as a community how do we protect how do we be that defenders as a community uh against either vulnerabilities coming at us or even you know countering the bad actors >> I think that was very beautifully said thank you that does it for this episode thank you to our panelists Nikki Serivvas and Patrick thank you to our producers and thank you for watching and listening subscribe to security intelligence wherever

30:07 wherever you get your podcasts so you never miss an episode. [music] Stay safe out there.