Risky Business #730 -- Apple, Facebook go all in on e2ee
Dec 12, 2023
auto_awesome
Haroon Meer from Thinkst Canary discusses APT groups shifting to 'living off the land' techniques. Topics include Russian cyber attack on Ukrainian telco, Apple and Facebook's e2ee push, sketchy 702 reauthorization, USG push notifications request, and 2024 predictions.
Detection of post-compromise activities becomes challenging with the rise of living off the land techniques.
Defenders must shift towards detection engineering to identify subtle malicious activities.
Deception technologies like hardware honeypots offer enduring detection capabilities to combat evolving threats.
Deep dives
Implications of New Trends in Cyberattacks
As cyber attackers increasingly pivot towards living off the land techniques, detection becomes harder due to the subtle nature of post-compromise activities. Traditional solutions focused on detecting initial events are inadequate for identifying non-malware based threats. Solutions like hardware honeypots and deceptive technologies offer enduring detection capabilities, simplifying detection efforts amid evolving attack methods.
Challenges in Detecting Modern Cyber Threats
The rise of living off the land techniques necessitates detecting malware-less post-compromise activities, posing a challenge to traditional file-based security solutions. Defenders must adapt to detect subtle malicious activities in their environments, requiring a shift towards detection engineering and enduring detection controls.
Role of Deception Technologies in Detection
Deception technologies, such as hardware honeypots and Canary tokens, offer effective detection by focusing on attackers' actions and objectives, irrespective of the entry point. These solutions provide enduring detection capabilities, minimizing the need for frequent feeding and watering, and leveraging existing detector constraints to enhance detection efficiency.
Evolving Security Needs in Response to New Attack Methods
As cyber attackers adopt more sophisticated methods like living off the land, security organizations, including defense contractors and government entities, are recognizing the need to enhance their detection mechanisms. By incorporating innovative detection technologies and embracing enduring detection strategies, organizations can effectively combat modern cyber threats.
Anticipated Development in Cybersecurity Solutions
The cybersecurity landscape is evolving, with a shift towards sustainable, enduring detection mechanisms that adapt to emerging threats, such as living off the land techniques. Solutions like canaries and token-based detection tools provide reliable and efficient means of detecting post-compromise activities, aligning with the evolving cybersecurity needs of organizations facing sophisticated cyber threats.
In this week’s edition of the show Patrick Gray and guest co-host Dmitri Alperovitch discuss:
Major telco in Ukraine taken down by Russia
Apple and Facebook go all in on e2ee
Why 702 reauthorisation is looking a bit sketchy
The USG wants your push notifications
The year in review, plus some predictions for 2024
This week’s show is brought to you by Thinkst Canary. Haroon Meer, Thinkst’s founder, is this week’s sponsor guest. He joins us to talk about APT groups pivoting to living-off-the-land techniques.
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode