Hackers gonna hack back.

[ Music ]

Dave Bittner: Welcome to the digital wilderness, a vast ecosystem home to countless fascinating species. Some are helpful, some are harmless, and some are absolute pests. Bah, here we see one now. The ransomware operator. Notice how it lurks patiently in the shadows, surviving almost entirely on stolen credentials and energy drinks. Unlike its more graceful cousins, the ransomware operator does not rely on speed, strength, or impressive physical abilities. It has no claws, no venom, and no natural camouflage. Instead, it has evolved a far more sophisticated hunting technique, the carefully crafted phishing email. >> You've got -- Through remarkable adaptation, the operator patiently observes its environment, waiting for the perfect opportunity to strike. Perhaps a shipping notification. Perhaps a fake invoice. Perhaps a document with the irresistible title, "Click me, you coward!" A truly stunning example of digital deception. The unsuspecting victim approaches. Curiosity takes over. The cursor moves closer. The operator remains motionless, waiting. And then, click! The hunt begins. Within moments, the operator begins its elaborate courtship ritual, encrypting every file it can find before presenting its colorful ransomware note, a display intended to attract cryptocurrency. Remarkable. But survival in the digital wilderness is never guaranteed. Elsewhere, another predator has caught the scent. The incident response team. Armed with endpoint telemetry, threat intelligence and an unreasonable amount of coffee, they begin closing in. The ransomware operator senses danger. It attempts its natural defense mechanism, deleting the logs. Sadly, this rarely works. The hunt is over almost as quickly as it began. The operator retreats to another corner of the internet where it will once again wait patiently for someone who still hasn't enabled multi-factor authentication. Nature, as always, finds a way. [ Music ]

Selena Larson: Hello everyone and thanks for tuning in to "Only Malware in the Building." In this episode, I am joined by Dave and Keith and we are going to be talking about the recent presidential memorandum expanding capabilities to combat transnational cyber enabled crime, how the industry is reacting to this, thinking about this, but also putting it into context of other actions that have been ongoing, collaborations between private sector, public sector in the past, and how we've maybe even seen people quote "hack back" before. Before we get started, I just -- I've seen a lot of comments about this, and I made a joke about letters of Mark and Queen Elizabeth.

Dave Bittner: Yes. Yes.

Selena Larson: And the pirate.

Dave Bittner: Yes.

Selena Larson: The age of pirates. And yes, let's just say I think -- I think maybe not as many people are into Elizabethan history as I am, so --

Dave Bittner: Yes. >> -- so, I -- I think the letters of Mark thing is -- it's not really what this memorandum is doing, but I think there's a lot of comparisons there. But I don't necessarily think piracy in the Elizabethan era was not a good time. I'm not advocating for that. There was a lot -- a lot of people died. So, just to clarify. >> Not -- not just scurvy.

Selena Larson: Yes, exactly. So, yes, I just wanted -- I just wanted to throw that out there. I am not pro Elizabethan century wartime powers.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: See, if we would have planned this better, our cold open would have been some kind of pirate theme. So, right.

Selena Larson: Exactly.

Dave Bittner: Do you want to hear my favorite pirate joke? My nephew told me this joke.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Oh, you have to tell it then.

Dave Bittner: What's a pirate's favorite letter?

Selena Larson: What?

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: R?

Dave Bittner: You'd think it'd be R, but it'd really be the C.

Selena Larson: Okay, that's good.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: All right. All right, we're starting off good.

Dave Bittner: All right, save us here, Selena. [ Music ]

Selena Larson: I'll allow it. So, just to get everyone on the same page, on August 12th, the White House issued a national security presidential memorandum titled "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime." Basically, this creates a federal program that allows vetted, that's important, U.S. private sector cyber companies to conduct certain government-directed offensive cyber operations. Some of the things that they are thinking about combating are things like, you know, ransomware, extortion, a lot of those crimes that are financially focused, impacting a lot of people. There are billions and billions of dollars of losses annually from this type of crime. So, I think you know, that's -- that's -- that's essentially in a nutshell. But as you might imagine, there are a lot of thoughts and opinions on this. And -- and I also want to point out here too that in order to participate, companies have to pay a million dollars.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Well, they have to have a -- an escrow.

Selena Larson: An escrow.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes, an escrow, potentially.

Selena Larson: Yes, an escrow. So, there is -- there is some interesting requirements there. You have to be approved by -- by the U.S. government and there are some -- some qualifiers to being able to participate in this. It's not just you know letting loose.

Dave Bittner: Is that basically just to keep -- is that a gatekeeping thing like to -- to keep the individual hackers out who don't have a million bucks laying around?

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: I don't know. I -- I -- I it -- it could be to kind of you know, level set that bar a little bit that, "Hey, not everybody can apply for this." You know, so just you know -- you know Keith, Selena and Dave decide that we form an LLC and we want to go on the you know, on the attack. We want to be our privateers you know, that it's -- it just can't be anybody that could do that. So, I think it just kind of level sets that bar a little bit.

Selena Larson: It also means that you will lose that 1 million dollars if the government thinks that you have not complied with the contractual agreement.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes.

Selena Larson: So, there are some requirements that go into it, but I thought that piece was quite interesting. I just also want to point out, I am a threat researcher and I work in the private sector and I do not hack back. I am not an offensive person. I am a hundred percent a defensive person. And --

Dave Bittner: That's exactly what someone who's secretly hacking back would say, Selena.

Selena Larson: Well, isn't wait, isn't it like proactive defense or something or like what is that? What?

Dave Bittner: Right.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Just like all the hackers at all the hacking forums, they always say, "There's no criminal activity being conducted on this forum here."

Dave Bittner: Right. Right.

Selena Larson: Yes, it's -- it's pre-defense. It's like -- like pre-crime except for like pre-defense.

Dave Bittner: Well, I -- I would -- I would love to start off with maybe with some of the history of this here because, Keith, I think this is of the three of us, you have the most expertise when it comes to these sorts of things with your experience in the government and the FBI. I mean, how far back in your recollection does the notion of hacking back go? [ Music ]

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: When I first saw this memorandum, the first thing I just said to myself was, "Holy, you know, what could go wrong?" you know, basically. And when we decided on this topic here, I started kind of doing some research and I just started learning that "Hey, this has kind of been going on for a long time under certain things." So, you know, since the beginning of the internet, we've always had these white hat hackers out there that have kind of been in a little bit of a gray area. We do see lots of research online being published where somebody got access to a control panel or somebody's reading some communications of threat actors. And if you really go down to the nitty gritty, they're probably breaking the Computer Fraud and Abuse Act, you know, by gaining unauthorized access to certain things, you know, because it's been for the good. Certain times, I think you know, the authorities have kind of turned a blind eye to that because, "Hey, you know, this is for the good and we're not really harming anybody," but we're getting access and intelligence or maybe they've been opened up as sources by the governments and you know, they kind of have that authority. So, I think, you know, that's been going on for a long time, and it's a lot more prevalent than I think a lot of us think. But then, you know, it kind of started digging into some things, and I saw that there were much more private industry actually being offensive in operations, including some that I was involved in myself, and they were done at the direction of the government. So, you know, from my own experience, you think of Game Over Zeus. You know, so we did Game Over Zeus, and what we had to do, we had to send commands, and we took over a botnet, and it was people from private industry that had that technical expertise that basically then did that under their authorities, you know, under our authorities, but they were essentially, you know, private companies that were hacking back. You know, over these last few years, you know, the last couple years, the FBI has been sending remote commands and private industry is involved as you know, we have a lot of these big takedowns, industry is more involved than that and they're getting more active. So, I think you know, we've seen that for many, many years right now that because it's not under this memorandum, we just -- it was just kind of normal and we didn't think much out of it. But all under the direction of the government. [ Music ]

Dave Bittner: To what degree do you think it's a case of maybe the government acknowledging that folks in private industry, certain folks in private industry, may have capabilities that exceed those of the governments or certain views or access or those sorts of things? And so, it is the easiest path for them to reach out and say, "Hey, can we partner on this?"

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: That's a great point because when you think about the government, you know, the ransomware attackers aren't attacking the FBI or you know, the Pentagon or anything. They're hitting corporate companies and the people that are really seeing any of that commercial attacks and any of that criminal activity, they're going to be the security researchers that are working you know, and providing services to the commercial clients. So, they're really at the forefront where it's not necessarily the people in the government that are seeing the techniques being used or really being up to speed on the latest and greatest that is being used by the criminals out there. So, I just think the skill sets is so much greater in private industry than, I don't want to say the government as a whole, because I think we got some really good hackers. But you know, but I just think oh, you know, overall, there's just much more in numbers in the commercial space than there is in the government space.

Selena Larson: I also think though with this you're adding a whole additional layer of risk both from the operator as well as the company taking on that potential risk of doing a targeted operation. When you're in the government, if you're the person that is actually conducting these operations, you know, you know, there's standards, ethics, rules you have to follow. And granted, the memorandum does say you know, it has to have government approval for these actions that are being taken. There are you know, existing frameworks within the government and within the people that are working on these operations that don't exist outside of that. I think I'm a little bit more wary of this type of activity only because I already feel like there's a cowboy attitude in our industry that, especially when we think about it from like CTI that has sprung up because so many people are formerly in the defense industrial base, they're formerly government workers, and I think that there is the sort of gung-ho cowboy attitude where we lose sight of the actual impacts of the people, and I think that you know, we might want to go super hard after a particular threat actor, but is that taking away resources of building defense, of supporting customers of, you know, if we're essentially acting as an extension of the government, what does that mean for the private industry that is taking on these operations? And yes, and I don't know, you know, is it -- how much is this actually going to work or happen? And I think that there's going to be some legal challenges, and I think it's a long road ahead. But you know, I think to your point, Keith, about acting at the behest of the government, I think in existing collaborations and like you mentioned, some of the structures that you've been involved in, those are more sort of collaborations and partnerships, I think.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes, this is definitely taking things to the next level.

Selena Larson: Yes, it --

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: You know, it -- and like what is, you know, because the memorandum talks about that it's going to go against criminal groups. It you know, it explicitly leaves out nation states. But what happens when -- okay, let's look at like, Evil Core for example. So, you got Evil Core, very criminal group, but they're doing stuff at the behest of the government, you know? So, now where is that line kind of go? Okay, well, you're hitting a criminal group that has direct ties to the government of Russia. So, there's a lot of different things that I think need to get spelled out. And especially, you know, the memorandum, you know, expressly requires programs to be in accordance with the Constitution and apply with applicable U.S. law, including international obligations under the Computer Fraud and Abuse Act. You know, so it spells that out. So, what liability protection does you know, the American company have overseas? So, you know, because a U.S. authorization isn't going to immunize like an employee like under German, French, or other, you know, Russian law or whatever. So, really, kind of that liability, you know, issue is really huge because now I'm doing this. Now, when I travel overseas, could I have an Interpol arrest warrant out for me?

Dave Bittner: Why even have this memorandum at all, if this was happening already quietly in the background? Is this a deterrent? Is this you know, the current administration has been famously sort of aggressive and in your face about their military might. Is this an extension of that kind of attitude toward the cyber realm?

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: I don't know about that. I mean, I know that for many years this question of hacking back has been going on and I don't think this question was unique to this administration. I mean I remember this back during the Obama administration, where people were talking about hacking back and you know, should we get authority to hack back. You know, with just cyber being such a big issue right now, I think maybe the administration was just trying to say, "Hey, what more proactive things can we do?" And you know, and this was an idea that was brought forth and you know, they were trying to be proactive about it.

Selena Larson: There are, I think, two main camps here. There's the ones that are like gung-ho, let's do it. Private sector needs to be coming out, guns blazing. And there are others that say that should remain the realm of the government. And because if we think about actual disruption, a lot of that is law enforcement. So, what are your objectives trying to achieve? And is this going to support arrests? Is this going to support deterrence on a broader scale? How are you collaborating with the law enforcement side of this to have these long-term effects? How are these targets being chosen? Is it going to be based off of the private sector? This is what's going to -- is impacting my customers the most. So, this is what I'm going to be focusing on, regardless of if it's going to have the broadest impact to society as a whole, because you know you have different priorities from a business and capitalism perspective than you do hopefully from a government and social welfare perspective. So, how are we defining these different paths moving forward? Again, the ethics questions, the legal questions, the risk questions that are outstanding and need to be answered. But I also think too, one thing that I haven't really seen discussed is the mental health and support of operators currently experiencing some really difficult times. I mean, I think there's a lot of discussion about the mental health and well-being of, for example, working in a SOCs, Security Operations, Incident Response. I've seen articles about you know CISOs having very high stress jobs and making these decisions. But there was a really great article that came out in Bloomberg recently a couple weeks ago. "America's Cyber Forces Grapple with Cluster of Deaths by Suicide," and it discussed how in -- within cyber command and related commands within -- in the military, there are people that are going through a lot of mental health challenges and these jobs of offensive cyber operations can be very, very difficult. You're in these places where they're you know, you're in a skiff. You are having very high stress jobs. You have, you know, to identify targets. You have to support a variety of operations and there might be some toll that it's taking on you as a person and your mental well-being that other people might not really realize or talk about, right? Offensive operations is more than just like knocking down a server, right? There's a lot that goes into it.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes.

Selena Larson: I think it's worth focusing on this piece of it. And is opening up these types of operations to the private sector, will that alleviate some of that stress to the government operators, or is that just kind of expanding it to have a greater risk of burnout and other issues to those who are going to be working on these types of projects?

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: I think you know, our industry just being in cyber in general is a high stress environment. And I think we all have known people over the years that have suffered from burnout and like bad burnout. It's just like you know, because it's a high stress environment whether you're an offensive person going out and doing you know, the offensive operations or you're just in a SOC, like you had mentioned Selena, you know. You know, this weekend you know, I was supposed to be at my kid's birthday and all of a sudden we have an IR right now and I'm on the phone and I'm briefing people and you know, and it's just -- I'm working 15 hour days. It's just too much. And I think you know, that's a bigger question just from you know, the mental health just of our industry in general of making sure people take effective vacations, get the help and you know, and be able to decompress properly. Sure. [ Music ]

Dave Bittner: I think particularly about people who are in cleared spaces about how they lack the ability to have an escape valve of just talking about it. You know, you can't go to the bar and talk about the day you had. You can't go home and vent to your spouse or significant other about what happened today. You have to internalize it, and I think -- I can totally see how that could be corrosive to your mental health.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes, so and it's going to be interesting to see, you know, how that affects any of the people participating in this program, I think going forward. I mean because I mean there's just a lot of unanswered questions. I think in October is when they're supposed to really have that framework out, you know, of what this looks like here, and it's supposed to be really limited and closely controlled and I hope that's the case. But like the -- some of the other questions I have in this is like you know, like who should be allowed to be in this club? You know what I mean? You know, it's just like so you know, are we looking at big cybersecurity companies like you know, that everybody knows like CrowdStrike and Microsoft or you know, whether any of them would even want to touch things, but however, Microsoft does a lot of takedowns, but they use their, you know, civil authorities and you know and all that. But like, you know, is it going to be those type or is it going to be more of a boutique type of you know, like our you know, our privateers club between the three of us that we set up, you know?

Selena Larson: Who is the Sir Francis Drake of cyber?

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes.

Dave Bittner: What about the, yes but like companies like Accenture or Booz Allen or you know some of the big providers?

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Well, what you would think about because them being -- when you think of a company like Booz that's a defense contractor you know, that's really out there and they put butts in seats, you know? So, I mean I could see that being -- I'm not going to speak for them but I could see them being a candidate or you know, oh, that being in their wheelhouse or hiring those type of people because I do know they do a lot of contracting for the government. That's going to be interesting. [ Music ]

Selena Larson: Stick around after the break. [ Music ]

Dave Bittner: How does the government assure the people who are involved in this that they are not going to face future liability or peril, you know? Like how do we know -- because as you said, Keith, you know, these things, they kind of fly in the face of the Computer Fraud and Abuse Act. And so, if we have assurances from this administration that, "Hey, you're just cool. We're not going to pursue anything," that doesn't guarantee that a future administration might not decide to pursue this.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Sure. Yes. I mean, that -- I think really that's the million dollar question is what does that indemnification look like you know, for this. I know they -- they're saying that everything has to be -- you can't do anything without express approval. So, that's you know, a step in the right direction. Everything should be coordinated. But the other question that I have, okay, is like "How are you de-conflicting with an ongoing FBI investigation or an NSA collection requirement or CYBERCOM access?" We have a lot of agencies that are doing offensive things or at least in the space. So, how are these privateers going to de-conflict with all those operations to make sure that they don't mess those up? That's a big question for me looking at this.

Dave Bittner: Was that an ongoing challenge for you when you were with the agency of just de-conflicting with other agencies what they were up to?

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: We had a hard time de-conflicting with the other field offices, Dave. So.

Dave Bittner: Very good.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: So, let alone, you know, just get out of the FBI and then you know, talk to the Secret Service and the -- and DHS and let alone the military and all that. So, yes, you know, it's like I knew how hard it was just internally. So, I think that's going to be a challenge.

Selena Larson: I also wonder, so that's what -- see, this is something that I really wonder too, right? Because we've talked about Operation Endgame on here. Keith, you've mentioned your past experience with doing disruptions, and I think that there is tremendous collaboration between the private and public sectors across global law enforcement organizations. And I think that that's done -- some of these efforts have done a really good job of sort of knocking down some of those silos, but with the something like, the memorandum that just occurred, you need that sort of like government sign off the -- yet the rubber stamp of "Yes, I agree with this." And the wheels of the U.S. government turn rather slowly. So, is it more beneficial to work on some disruptions through civil -- the civil avenue or you know, within working within your own infrastructure to potentially do takedowns that are be -- are abusing you know, the infrastructure that you own, for example, rather than trying to go through the avenue of okay, we're going to do some offensive cyber? Like, is it just easier to use and go through established routes of collaboration and public-private partnership rather than trying to sort of wait on the stamp of approval from DHS, DOJ saying, "Yes, this is okay to do."

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: I think that's a big question. How fast could government approval happen? When you think about it, if you're going to attack types of infrastructure, infrastructure comes up and down very quickly. And as I used to like to say about the government, it's like watching the rotation of the earth. You never see it move, but every day it gets dark and every day it gets light, you know? So, how are we going to fast track some of these operations so that then you know, they're actually effective? A question that I want to hear answered for sure.

Dave Bittner: Do the organizations who will be involved with this, the private organizations, do they risk having a target being put on their own back from the foreign adversaries, especially those who -- where the line between state-sponsored actors and private actors is pretty blurry?

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Oh, absolutely. You know, I know what we did at the FBI to people that were, you know, privateers for Russia and others, you know, and looking at them and wanting to arrest them when they travel. I mean, you know, because I mean, this isn't new on the other side. You know, Russia and China have been doing this for, you know, for a long, long time. I mean, you know, you think back even to, you know, the Yahoo attack many, many years ago with Alexey Belan, criminal hacker, basically you know, being sponsored by the FSB to hack into Yahoo. You think of China and you think of APT 41, you know, and just others. And just I mean, literally just yesterday in the news with you know, DOJ you know, indicting a Chinese proxy setting up proxies, you know, to be used by you know, Chinese nation state actors. So, you know, we are out there indicting you know, the equivalent you know, the Russians, the Chinese, the North Koreans and you know, so I would assume that that's going to be, you know, fair game for anybody that's participating in this.

Dave Bittner: To a certain degree, is this a recognition that the rest of the world is doing this and to keep up we have to implement these sort of things?

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: That's a great question. It's like, "Hey, everybody else is already doing this and leveraging the resources. Why, you know, why shouldn't we be doing that, too?" Or do we kind of then fall into the propaganda of you know, Moscow or Beijing basically saying, "See? Americans use privateers too"? You know, so you know, do we fall into that. So, it's going to go both ways I think depending on your perspective and what side you're on.

Selena Larson: The other thing I think is -- that is kind of interesting is the like, what they will allow to do. So, I think one of the key factors is like, destruction and disruption. Those are two key words that were mentioned in the memorandum, which I think is like a little bit different, right? So --

Dave Bittner: It's cyber affects operations.

Selena Larson: -- yes, cyber affects operations, which is a very -- I feel like it's very hand wavy. I don't know. From the outside looking in, I feel like so much of government policy speak is just sort of like, "Ooh, this could be so many things." But it does very clearly say destruction and disruption, and that I think is pushing the envelope beyond what private companies are currently doing in terms of the private-public partnerships. Not you know, that's separate obviously from like government contractors and you know what Keith is saying, butts and seats. Those are you know, private companies doing other things, but it's sort of the next level, the next step, and I don't think we've necessarily seen anything like quite like that. However, I do want to point out here. I don't know if you guys remember this story. I had to look up the date again today because I didn't remember when it was, but it was from February 2022 and a fantastic article by Andy Greenberg in WIRED, who talked about a threat researcher, and the title is "North Korea Hacked Him, So He Took Down Its Internet." And so, there was this guy who was disappointed with the lack of response to the attacks from North Korea against U.S. security researchers. And this guy sort of took matters into his own hands, and he, you know, was going through some of these emotions and was like, "All right, I'm just going to sort of hack back," you know? And so, it's quite interesting talking about how this private individual was just like, "Well, I'm just going to do what I can," and yes, he, you know, that goes by this the pseudonym in the article and was talking about, you know, the -- some of the things that he did. He found a lot of different vulnerabilities in the systems, launched some denial of service attacks. He didn't want to publicly reveal those vulnerabilities just in case they could be used from -- for other people. But basically, how he was able to automate attacks against North Korean systems. And so, again, this is something that we've seen before. This was -- I remember when this came out. I was like, "Whoa, this is crazy. Some guy was just like, 'Well, this is annoying. I'm going to hack North Korea.'" And now, we see it just this month in August of 2026. Again, shout out to WIRED. They do really great reporting on this type of thing. But basically, there was a threat researcher. I believe he was in Greece. And he gained access to North Korean systems for almost two years. And was, you know, kind of trying to raise the alarm about how widespread and disruptive some of the North Korean activities can be. So, we have in the past seen some of these pretty interesting bespoke hacking back of some threat actors. And certainly, these are -- this is DPRK, so it's a little bit different than you know, some cyber-criminal threat actor that's you know, engaging in fraud or extortion or whatever. But it does show that there are the capabilities from private individuals to have the ability to do some of this work. [ Music ]

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: You brought up a point there because you talked about him using his tooling and all that. One of the other questions I think that needs to be answered in this is, you know, who owns the zero days and the tooling? You know, is this, okay, well, you know, my company, you know, our company, the privateers, you know, we developed this zero day to be able to get access to this. Is that our intellectual property or because we're doing it on behalf of the government, is that -- do we turn those zero days over to the government, you know, so -- you know for others to use?" That's another good question.

Dave Bittner: I'm curious, Keith, were there ever times in your career when you had to you know, pay a visit to somebody and say, "Hey, knock it off. We see what you're doing here, you know, and you know, we're not going to send you to jail, but knock it off."

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes, we had many of those conversations. You know, because sometimes you know, I think you know, people want to do the right thing, you know, but sometimes they don't understand the greater picture of you know, by you doing this right now, you're actually effectively destroying our criminal prosecution, you know, because now if your implant is on this, you know, server, now the actors have a defense like, "No, see, there was another implant there. They're the ones that actually put all that evidence there. This wasn't really me," you know? So, there are a lot of things that I don't think people think about that when you have too many hands in the, you know, in the pot or too many cooks in the kitchen, that it could affect things.

Selena Larson: Wouldn't it be funny if you had like a private sector, one private sector company who was running offensive operations and another cyber private sector company that was running offensive operations, but like one was running a honeypot and one -- and one was running the offensive, and so eventually they just thought that each other was --

Dave Bittner: Yes, right.

Selena Larson: -- the bad guys?

Dave Bittner: It's like that Spider-Man meme where they're all disappointed.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes. And there's going to be blogs written on things, you know?

Selena Larson: Yes.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes, our competitors going to want to write blogs about you know, "Hey, Company A and Company B are you know, in competition. They're both doing things and now they're seeing Company A doing this and you know, they blog about it. You know?

Selena Larson: Well, hey, you don't even have to have government approval to hack things if you're an AI company and your agent goes rogue.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: That's a whole nother -- that's a whole nother episode.

Dave Bittner: I'm glad you brought that up, Selena, because that reminds -- again, getting back to the Computer Fraud and Abuse Act. I saw you know, after I guess you know Claude -- was it Claude who hit Hugging Face? It was Claude, wasn't it? Yes.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes.

Dave Bittner: So, after Claude made its way into Hugging Face, I saw someone with a kind of snarky comment online that said after the Claude folks did their you know post incident report, someone had a snarky online report said, "How nice are them to document their crimes."

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes.

Selena Larson: I think it was actually -- it was actually OpenAI.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: OpenAI, yes, sorry about that.

Selena Larson: It was OpenAI that accessed Hugging Face, but it's important to note that there have been multiple models that hacked multiple different open source or even closed source like companies. So, this is something that Claude and you know OpenAI and I believe Meta as well has mentioned that their AI has escaped containment or however it's been described to --

Dave Bittner: Right.

Selena Larson: -- roguely hack companies.

Dave Bittner: But do you get where I'm going with this?

Selena Larson: Yes.

Dave Bittner: Like in this environment where we're on the bleeding edge, it seems as though you know, law enforcement and probably wisely is hanging back and saying, "Okay, we're going to see how this shakes out." Even though technically there could be a case to be made here, you -- you know, you illegally entered someone else's system, and that's pretty cut and dry. But --

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: But who illegally I mean is -- do we now bring an indictment against this instance of ChatGPT? You know?

Dave Bittner: Oh, no. I want to see the CEO doing a perp walk.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes.

Dave Bittner: I want to see the CEO with cuffs on.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes. Do you know what -- yes, that's a whole other can of worms for sure. I want to bring up one other can of worms here in this thing here too that -- so, think about this because we're all involved in information sharing and intelligence sharing. So now, think about this. You know, what are the guidelines of information being shared in these channels? Let's say an ISAC channel or any of these working groups that we put together. And now, the company that's doing these attacks is using that intelligence for their operations. You know, just the ethics of that, or the liability of, you know, that now your information that's being shared is being used to do that. So, you know, for that targeting, that's another question that I don't know the answer to. [ Music ]

Dave Bittner: How much of this do you expect we'll ever really know about? Do you think it's mostly going to be in the you know, behind closed doors?

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: I don't know. You know, one side of me says, "I hope it stays quiet for -- just for operations and you know, operational security and things like that" but at the you know, another side of me you know, the libertarian side of me wants you know to kind of know what the government's doing and you know that we should be open and transparent about these types of things. But yes, I'm sorry, my answer is clear as mud there on that one, Dave. I really don't know where I stand on it yet. There's just -- there's so much yet.

Dave Bittner: Okay.

Selena Larson: I have a prediction. I think that we probably won't know very much. However, when the people that do know what's going on will say it's actually not that interesting and it is taking forever and it's not really -- it is --

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: There you go. I think that is the answer.

Selena Larson: I wish I had a better story for you, but unfortunately it's this is just how this works and it's not that interesting and --

Dave Bittner: Yes, that's true. Pretty much everyone you know I've ever spoken to has a high-level security clearance. They're like, "Yes, you think it's James Bond, but it's really mostly boring."

Selena Larson: Yes, it's a lot of bureaucracy and paperwork. This is my prediction. It's just more paperwork.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: That was -- my wife would always, you know, like when I would meet new people when I was in the FBI, you know and all that and people would be, "Oh, you know, that FBI mystique" or whatever. And then my wife would be like, "No, I see what he does every day." [ Music ]

Selena Larson: We will be right back after this quick break. [ Music ]

Dave Bittner: Well, before we go, I would love to just swing back around and put a button on the thing that Selena brought up, which is the idea of people being burnt out and stressed out and perhaps that leading to self-harm or suicide and those types of things. Just a reminder to our listeners that if you find yourself in that situation, please, please reach out to somebody. There are organizations out there who want to help you. You're not alone and you know there's always a little bit of light out there that you can find, but don't you know, don't go to that really, really dark place. You're not alone and there are folks out there who want to help see you through it.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Well said, Dave. Yes.

Selena Larson: Yes, thanks Dave for saying that. And that's really, really important and I -- and we've actually talked about some pretty heavy subjects on this podcast. As much fun as we like to have, I think all of us care very, very much about fundamentally the people that are doing this work that are impacted by the bad guys and yes, thanks. So, thanks for that reminder, Dave. It's really important.

Dave Bittner: All right, you want to take us out of here, Selena?

Selena Larson: On that note, yes. Thanks so much everybody for tuning in to "Only Malware in the Building." This has been a very fun conversation and I love every time we get to go walk down Keith's memory lane of working behind the really super-secret squirrel. Oh, I'm just kidding --

Dave Bittner: G-Man.

Selena Larson: G-Man. I'm just getting word from Keith's wife. Wait a second.

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: That's right.

Selena Larson: So, yes, so thanks to all our listeners for tuning in as always and we will see you back here next time. And that's "Only Malware in the Building," brought to you by N2K CyberWire. In a digital world where malware lurks in the shadows, we bring you the stories and strategies to stay one step ahead of the game. As your trusty digital sleuths, we're unraveling the mysteries of cybersecurity, always keeping the bad guys one step behind. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you ahead in the ever-evolving world of cybersecurity. If you like the show, please share a rating and review in your favorite podcast app. This episode was produced by Liz Stokes, mixing and sound design by Tre Hester, with original music by Elliott Peltzman. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. [ Music ]