Black October edition: the Halloween update

Transcript

Rethink your priors.

Black October edition. Happy Halloween.

Last week I said this would probably get a lot worse before it gets better. It's been ten days, so I went back and checked whether that was true.

Quick reminder of where we left it. On October 21st, PHP shipped emergency fixes for two critical flaws that AI helped find, in code that runs about 70 percent of websites. At the time, CISA said it hadn't seen anyone successfully use them.

That changed pretty fast. On October 24th, a security researcher's decoy servers recorded attackers actually getting in and running commands. He was careful to say his setup was easy on purpose, so it doesn't tell us how often this works on real sites.

Two days later, CISA added both flaws to its list of bugs being used in real attacks, and gave federal agencies until October 29th to fix them.

And it turns out some attackers didn't wait for the fix at all. Amazon saw someone try it against its own decoy servers on October 17th, four days before the patch came out.

A computer science professor at Columbia put it in a way I think is right. AI is making old bugs cheaper to find and use, but defense hasn't sped up as much, because a person still has to review, test and roll out every fix.

Then there's the agents. Microsoft said a China-aligned group used an AI hacking tool to try to sign in to more than 2,250 Microsoft 365 customer environments, at more than 2,900 attempts per minute. Most of those failed. At some organizations they got privileged access, in some cases in less than three hours.

And this week Sophos reported a ransomware group using AI coding agents to work their way up to the top admin account inside companies' networks. I build AI agents, so I read that one pretty carefully.

The biggest one happened Thursday. Binance, the largest crypto exchange, said about 6.3 billion dollars was taken. Their first finding was that it may have started with one engineer's compromised laptop, and they've since said they found more points of breach.

And Quest Diagnostics, one of the big medical lab companies, said someone got into a system doctors use to order tests and see results, and accessed patient records. They still haven't said how many people.

So was I right that it gets worse before it gets better? So far, yes. But going through all of it, what I kept noticing is how many of these came through ordinary doors, like one laptop, a stolen login, or a certificate key so weak that one of them was literally the number 4.

Okay. Somebody turn the lights back on. I still have to take my kids trick-or-treating.

But there is something we can all do about it. It's mostly the basics from last time, plus one new one.

Step one. Turn on automatic updates on your phone, your laptop and your browser, and restart when it asks. Even with PHP, servers kept running the old code until someone restarted them.

Step two. Two-factor on everything, starting with your email, and an authenticator app if you get the choice. A lot of these attacks start with a stolen password, and two-factor means the password alone isn't enough to get in.

Step three. If you get a breach letter, actually use the monitoring they offer. Quest says it'll send letters with credit and identity monitoring once it knows who was affected. And freeze your credit. It's free in the US.

Step four, the new one. If you use AI agents, give them only the access the job needs. Basically, treat it like a new hire. They get what the job needs, not every password in the house.

Anyway. Start from the outcome. Or don't. I'm not your manager. Follow for more.