LLMs – PwnDefend

Machine Speed

I have been both watching/listening and in meetings where I have heard some ‘interesting’ statements about ‘machine speed’ hacking by with unlimited capacity and unlimited speed….

You can, if you know me, imagine my expression on my face, however I figured let’s not settle for ‘Trust me bro it doesn’t work like that’, let’s do some SCIENCE!

(I know everyone loves scientists these days after they pluck numbers out of their ass and say things like: there is a 10-70% chance AI will destroy humanity in the next 5 years’ (and have zero evidence for the math let alone evidence for the risk model other than ‘trust me, I’m super smart’).

I’m not that smart so I do actual testing of theories, and then I share things, I know, I’d make a terrible ‘scientist’. It’s hot in the lab today so this will be a quite a brief view but should contain the key details.

Getting less wrong about computing

The last two weeks online have been like a flood, I’m not even sure what words to use to describe them accurately, but I’ll give this a go:

Disinformation
Misinformation
Hype

I have been shocked really at what has occurred, in front of me:

Mass hysteria
Media hosting people constantly who are making unprovable claims with seemingly no real challenge

It’s been frankly exhausting to watch, let alone being involved in a range of discussions online:

I’ve seen people actually say things like: we have created a new lifeform, AI is alive etc. (paraphrasing)
I’ve had people tell me that these computing systems are not computers (WTF)
I’ve seen journalists essentially platform and parroting people with what appears to be significant loss of grasp of science and reality.

So I’ve been quite active online (whilst trying to field off questions from friends, family and colleagues about: is AI going to kill us? (good god how much time has been wasted!) but also I’ve been trying to give people a view of reality TODAY! So that’s partly what this blog is about!

Leadership

Vulnerabilities found with AI, oh my!

Ok, so the world is currently obsessed with AI (at least the digital world…) and with the latest Apple update releases we can see that LLMs have been used to help people find bugs! This is great news, finding bugs is better than not finding them!

The funny thing however is the obsession with CVE counts…. this is, honestly not a very useful metric to a defending org.. and I’ll try and explain why!

If it’s so powerful, it’s a shame you didn’t…

Imagine building what you describe as the most powerful AI enabled cyber tool…. and then showing the world that you put it in a lab where a single box compromise led to it having unrestricted and unmonitored internet access… that would be awkward would it not? Here’s an LLMs take on this…

Threat Intel

Bleeding Out

When you compromise a firewall you have lots of options in terms of next steps, from using the VPN, changing configurations, creating backdoors or perhaps using the firewall to PCAP. In this post I’m going to explore the ‘Fortibleed’ campaign. I have to note, we can see in honeypot logs this TA did not seem to limit themselves to Fortinet exploitation, however the area of analysis has a heavy Fortinet element. You will see they deployed a capture and analysis platform. Treat everything with a pinch of salt because I’m using a mad probability based machine (LLM) to support me for this!

Threat Intel

Fortibleed

In the ‘world of Mythos’ and other such overhyped AI buzz words…. the fundamentals of digital security still apply. Don’t get me wrong, I think LLMs are great, as a digital defender, I’ve been using LLMs relatively for a long time now (from offence to defence to general CTI/Research) so I’m not a hater, they are like an Iron Man suit! But we still need our Tony Stark and Pepper Potts!

It’s very easy in a world full of complexity to oversimplify, it’s very easy to focus on one class of threat and ignore another. Zero days sound cool, when mass exploration occurs, it’s a real problem, but for the day to day in an org, authentication attacks (identity plane) are the number one thing you will likely be seeing (if you look at our logs… you have logs right???)

one step closer to Skynet?

Yesterday I ran a pentest against an RDP server, the process was ok but not amazing, I had to provide more help than I would have liked, resource consumption and the idea it should keep going…. wasn’t great. The process and output wasn’t terrible at all but it didn’t blow me away.

So today I wanted to see if Claude could take on as simple active directory lab! Now let’s be clear, there were I think one or two updates to the Claude client in that time! The Claude UI even changed look and feel! So I span up an AD lab I had made a while ago and got to work!