00:37:00 · S1, Thai Duong, Tracy Alloway, Bruce Dang
[00:37:00] S1: Yeah, of course. [00:37:01] S4: And the AI companies, they're making money by selling tokens. And most of the tokens are used for coding today, like programming, building things, right? And if you build, if you want to be really good at coding, you need an agent on AI that understands code understand technical problems, can debug things, can control computers. But that's basically the definition of a hacker. So you cannot really escape this. You cannot have a cake and eat it too, right? You need to be good at coding. Then you have an AI that is good at hacking. So unless you don't want spend more tokens, or you don't want to get into the coding business anymore, you focus on scientific discovery, physical AI, whatever, then maybe you can train a model that is not good at hacking anymore. But as long as you want to automate knowledge work, then eventually your AI must be able to use computers and control computers to understand technical problems. And that's the reason of someone like Bruce. So it's unavoidable. [00:38:17] S3: So actually, on this note, I'm curious, can you just talk about what it's like being a hacker in the age of AI versus, say, even three or four years ago, right? Like, it's crazy how quickly stuff has shifted. But how has your day to day changed? [00:38:34] S2: Yeah, I'll just use some background. So I wrote a textbook with some friends on reverse engineering. It used to be like, you know, like you try to like reversing is the practice of understanding software without any source code or hardware systems.
00:38:34 · Bruce Dang, S1, Tracy Alloway, Joe Weisenthal, Thai Duong
[00:38:34] S2: Yeah, I'll just use some background. So I wrote a textbook with some friends on reverse engineering. It used to be like, you know, like you try to like reversing is the practice of understanding software without any source code or hardware systems. [00:38:50] S1: That used to be like, I wrote this textbook. And then I think with the. [00:38:55] S2: Advent of AI, I think what, like, you know, whatever, nine months ago, as of nine months ago, like that entire book is deprecating. It takes like, you know, two prompts or one prompt and then bam, it will generate the textbook for you. And it's even better, you know, and it took us, you know, a long time to write. Just that gives you an idea. And then I talk to friends who've been doing this for decades, right? [00:39:16] S1: They're like specialists in this area, right? [00:39:18] S2: And they tell me that, oh yeah, man, like I spend, you know, whatever, $ 5 on some open source model and it reverse engineered the firmware on, you know, some Canon or like you know, HP printer and it hacks it, Bruce. You know, and whereas before it would take me, you know, like months to figure some stuff out. [00:39:35] S1: You know, that's just to give. [00:39:37] S2: You like a glimpse into what's happening, like how quickly things change. [00:39:44] S1: Well, a friend, you know, like this guy, Matt Suiche, he's, you know, and he's this dude. [00:39:50] S3: He's a friend of the show. [00:39:52] S0: A longtime friend of the show, multi-time guest. [00:39:55] S4: Yeah, keep going.
00:39:55 · Thai Duong, Tracy Alloway, S1, Bruce Dang
[00:39:55] S4: Yeah, keep going. [00:39:55] S3: We used to hang out in Abu Dhabi a lot. [00:39:58] S1: Oh, okay, yeah. Like, I'm no Matt Fawkes. [00:40:01] S2: I mean, like, now he's like, he gave a talk with our team the other day, and he showed his rack, you know, in his apartment, and he's sitting there, you know, like, hacking stuff, like, while he's sitting there talking. It's just insane. We have people that, let's say, for example, we've been hacking the iPhone. To build a full chain on the iPhone, it's not an easy task. Sometimes it takes several people to do this. And our team was able to do this within. [00:40:35] S1: A few days. [00:40:36] S2: Wow. [00:40:37] S1: You know, as a one person. And we have multiple of these chains. [00:40:40] S2: It really compresses the time, like the exploitation, the time to build exploits. [00:40:49] S1: We see customers getting hacked. [00:40:52] S2: By AI, you know, in the financials, in the banks, basically. You know, defenders cannot, you know, actually, Ty, why don't you tell these stories? [00:41:01] S1: And, you know, just a little bit, this has happened in the last few weeks, you know. Yeah. how things changed.
00:41:01 · S1, Thai Duong, Bruce Dang
[00:41:01] S1: And, you know, just a little bit, this has happened in the last few weeks, you know. Yeah. how things changed. [00:41:07] S4: Yeah, basically we saw like, you know, in the OpenAI and Hugging Face incident, there's one detail that is very interesting. I'm not sure if people noticed, but OpenAI noticed that like the people who handled incidents on the OpenAI side, they said that they have handled a lot of incidents, but this is the first time they saw that, you know, an incident where you have like a hundred people points within your networks that were compromised at the same time. Like there were a hundred like hackers within your system. Normally you have maybe one or two, right? Now you have a hundred. And I saw that I was like, wow, that was pretty interesting, but maybe because OpenAI have lots of tokens, so their agents can just go, you know, hack everything. And then just two weeks ago, we have like two clients in the banking industry. And they got hacked and they called us to help them with like the incident response. We came in because we do hacking as well. We know like usually it took us like maybe a month or something. Once we come in a network and then took a month for us to spread out. For the AI, it took like, they came in, they brought inside the network on Monday. By Tuesday, they're everywhere. [00:42:23] S2: Everywhere.
00:42:23 · Bruce Dang, Thai Duong, Tracy Alloway
[00:42:23] S2: Everywhere. [00:42:24] S4: And like, it's like cancer is spread like at a machine speed. And it was like mind blowing, right? Because how could you defend against that? Like in the past, we were telling our clients, you know, you have to invest in detection. Well, how can you help yourself? If you see it, you can detect it, but there's a hundred of them. [00:42:45] S2: Noted. [00:42:45] S3: We have a hundred hackers in our system right now. It's not really helpful. [00:42:49] S2: Exactly.
00:42:50 · Thai Duong
[00:42:50] S4: How could you do it, right? And then you have to shut down everything. But shut down is not an option because you are a bank. So that's actually true. requires us to sit down and think about how to redesign the defense system. What we have right now is not working very well. But to come back to your question, as a hacker, how does it feel? I love history. So I always come back to history to see, did it happen before? It actually did happen with chess, for example. You remember in 1997, You know, IBM Deep Blue defeated Garry Kasparov. That was a big moment, right? And then 20 years later, AlphaGo defeated like Lee Sedol in the game of Go. But those two moments are actually quite different. Like the first moment, the Deep Blue moment, after Deep Blue, the best chess player wasn't a computer because Deep Blue was a mainframe, right? Not something that you can run on your computer. And it took 10 years for someone to go from Deep Blue to develop a computer software that you can run on your computer that defeated everybody. But the 10 years, it took 10 years. During that 10 years, the best chess player was a centaur player. This is a term coined by Garry Kasparov. It's a combination of computer and human. It took 10 years. For AlphaGo, it took like three years. Like after AlphaGo, Then 2019, somebody come up with a computer software that defeated anybody without any human input at all. At Calif, we think like, you know, we are enter the era of the central hackers. Basically, the best hacker right now is a combination of AI and humans. And, you know, our work and our friends' work as well show that AI is powerful. It can hack anything. but it still requires a human expert to arrive at it. And we don't know how long this is going to last, maybe three months. Maybe we come back here and by the end of the year, we tell you we retire now. There's nothing else for us to do. Maybe it lasts like three years. And this is actually pretty exciting to find out. That's exactly what we want to do. And we think like, That's like a pessimistic view, right? AI is going to do everything. Let's just retire and hate AI. Or you can see AI as a tool. It's like humanity just discovered fire. And without fire, we wouldn't be here today. So, of course, we have to think about how to control fire.