Latest / Tech Talks With Kinsoft / Last Week in Tech

Transcript

Last Week in Tech · Tech Talks With Kinsoft

0:00
So picture this. Hackers just remotely wiped
0:03
80 ,000 medical technology devices. And they
0:06
did it without running a single line of malware.
0:08
Plus, a major telecommunications giant lost an
0:13
entire petabyte of data, all because of a forgotten
0:16
password from over a year ago. Yeah, it is a
0:18
staggering amount of data. And it gets worse.
0:20
The very tools that we deploy to scan our code
0:23
for vulnerabilities are out there actively distributing
0:26
worms. Oh, and Google's AI is actively rewriting
0:30
news headlines into, well, the exact opposite
0:32
of reality. It really has. Welcome to Tech Talks
0:36
with Ken Soft. I am so thrilled you are joining
0:38
us today. Our mission for this episode is pretty
0:40
clear. We are synthesizing a massive stack of
0:43
recent tech and cybersecurity reports, incident
0:46
analyses, and patch notes just to figure out
0:49
exactly how the rules of the digital race are
0:51
being entirely rewritten. And, you know, the
0:53
overarching theme that emerges from analyzing
0:55
all these sources is undeniable. The traditional
0:57
perimeter is dead. Totally dead. Yeah. Today's
1:00
threats and innovations, they just aren't happening
1:03
at the gates anymore. They're happening inside
1:04
the house. Inside the house. Right. Exactly.
1:06
They're embedded deep in our software supply
1:09
chains, our built in enterprise administration
1:13
tools and, you know, our daily workflows. OK,
1:16
let's unpack this, starting with how threat actors
1:19
are. No longer really breaking in. They're just
1:22
logging in. Right. Let's look at that massive
1:25
incident at Stryker. They're a huge medical technology
1:28
giant. Literally overnight, 80 ,000 employee
1:33
devices. And we're talking corporate hardware
1:35
and personal devices that were enrolled in their
1:37
network. They were all remotely wiped. Just completely
1:39
erased. Exactly. And a pro -Iran hacktivist group
1:43
known as Handala claimed responsibility. They
1:46
stated they stole 50 terabytes of data. Although
1:49
I should point out that investigators from Microsoft
1:50
Dart and Palo Alto haven't actually confirmed
1:53
that exfiltration yet. Right, right. But the
1:55
device wipe itself is completely undeniable.
1:57
Absolutely. The scale of the disruption is severe.
1:59
But the mechanism, I mean, that is what really
2:01
demands our attention here. We've spent decades
2:04
building these incredibly complex endpoint detection
2:07
and response systems, you know, EDR. Just to
2:10
catch malicious executables. Exactly. To catch
2:12
the bad code. But like. No malware was used here.
2:16
None at all. None? It honestly reminds me of
2:18
a valet parking model. You know, the parking
2:21
garage doesn't check if you actually own the
2:22
car. Right. It only checks if you hold the digital
2:24
ticket. So the attackers compromised a Microsoft
2:28
Intune global administrator account. And from
2:31
there, they just used the software's legitimate
2:33
built -in remote wipe feature to just erase those
2:38
80 ,000 devices. What's fascinating here is how
2:41
this entirely redefines the trust model. How
2:44
so? Well, Intune is a mobile device management
2:46
platform, right? So it's designed by definition
2:48
to have ultimate authority over the endpoints
2:51
it manages. Because it's an admin tool. Exactly.
2:54
Right. So by compromising that global admin identity,
2:56
the attackers bypass the firewalls, the anomaly
2:59
detection, and the EDR entirely. Wow. Yeah. The
3:02
security systems just simply saw a legitimate
3:04
administrator executing a highly privileged but
3:07
standard command. Because it's a feature, not
3:09
a bug. Precisely. Identity is the new perimeter.
3:12
If you hold the keys, the system inherently trusts
3:16
you, regardless of your intent. And we see that
3:18
exact same principle in the Telus Digital hack,
3:20
too. Oh, yeah. For those listening, Telus Digital
3:23
is this massive Canadian business process outsourcer.
3:26
They handle call centers and AI bots for major
3:30
telecoms and financial services. A huge target.
3:33
A massive target. one petabyte of data. One petabyte.
3:43
It's hard to even conceptualize that much data.
3:45
It really is. And it included FBI background
3:47
checks and call center recordings. And how did
3:50
they get in? By using Google Cloud Platform credentials
3:52
that were stolen in a completely different hack,
3:54
a breach of a company called SalesLoft way back
3:56
in 2025. And that right there illustrates the
3:59
incredibly long tail of these identity crises.
4:03
Yeah, a year later. Right. A token or credential
4:05
stolen a year ago in a totally separate incident
4:08
just becomes the entry point for a petabyte scale
4:10
data. a theft today. It's terrifying. And regulators
4:13
are rapidly losing patience with this exact scenario.
4:17
Are they stepping in? They are. In Australia,
4:19
the Armed Forces Security Agency recently warned
4:22
corporate boards that claiming, you know, we
4:25
were collateral damage in a third party breach.
4:27
That's no longer a valid defense. Interesting.
4:30
Yeah. When basic segmentation and identity oversight
4:33
fail, regulators are saying the responsibility
4:35
falls squarely on the organization holding the
4:38
data. Well, and we are seeing that long tail
4:40
accountability play out with Singtel right now,
4:42
too. Right. The Senate inquiries. Yeah. They
4:44
are facing Senate inquiries over these explosive
4:46
allegations of secret. ransom payments from a
4:49
2022 Optus breach. It just shows how the fallout
4:52
from these identity compromises lasts for years.
4:55
Absolutely years. But if attackers are just logging
4:59
in using legitimate tools and stolen credentials,
5:02
what happens when the security tools themselves
5:05
are compromised? That is the next logical step
5:07
for them. Right. We're seeing a shift from poisoning
5:09
the user to poisoning the well. Let's look at
5:13
the recent supply chain attack on the Trivy vulnerability
5:15
scanner. Trivi is a highly foundational open
5:18
source tool. It's everywhere. It really is. Development
5:21
teams integrate it directly into their continuous
5:24
integration workflows. They use it to scan containers
5:27
and code for vulnerabilities before deployment.
5:30
And threat actors tracked as Team PCP use stolen
5:34
credentials to publish malicious Trivi releases
5:37
and modify GitHub actions. Yeah. And I gotta
5:40
say, this is what genuinely alarms me. The irony
5:42
of it. Yes. Developers use Trivy to find the
5:45
holes. If the tool verifying the integrity of
5:48
your code is actually injecting the malware,
5:50
how can any organization trust their own development
5:53
pipeline? It's like the security guard is the
5:54
one handing out blueprints to the bank vault.
5:57
That's a great way to put it. And the severity
5:59
of this incident goes far beyond just credential
6:01
harvesting. What else did they do? Well, the
6:03
attackers unleashed a self -propagating worm
6:06
called Canister Worm across 47 NPM packages.
6:10
Okay, wow. And what makes Canister Worm... incredibly
6:13
sophisticated is its command and control infrastructure.
6:16
It actually leverages tamper -proof smart contracts
6:19
to spread. Wait, hold on. They are using blockchain
6:22
infrastructure to host the malware's instructions?
6:25
Yes. That is wild. It is. Traditionally, you
6:29
know, if an attacker sets up a command and control
6:31
server on a cloud provider, security researchers
6:34
can just work with the provider to take that
6:36
server offline. Right. Sinkholing the attack.
6:39
Exactly. But by hosting the execution logic on
6:43
decentralized smart contracts, the attackers
6:46
have created this immutable distributed command
6:48
infrastructure. You can't just call up customer
6:50
service for the blockchain. Right. You cannot
6:52
simply submit a takedown request to a blockchain.
6:55
Wow. So you end up with a trusted security scanner
6:58
acting as a distribution mechanism for a highly
7:01
resilient worm that is deeply embedded into the
7:04
software supply chain. It is absolute infrastructural
7:07
rot. It really is. And speaking of foundational
7:10
software, this leads right into the behemoth
7:12
that was Microsoft's March 2026 patch Tuesday.
7:16
Oh, that was a massive update. Huge. They addressed
7:19
79 flaws, including two publicly disclosed zero
7:22
days, one in SQL Server and one in .NET. Right.
7:25
But there is one specific vulnerability that...
7:28
perfectly highlights this era of compromised
7:31
foundational tools. It's an Excel co -pilot flaw.
7:35
Right. CVE -2626144. That's the one. And it allows
7:41
for a zero -click information disclosure attack
7:44
via unintended network egress. And this is so
7:47
critical because we are integrating highly privileged
7:50
AI agents into our most sensitive document environments.
7:54
Yeah. Co -pilot is everywhere now. It is. And
7:56
it has access to your emails, your financial
7:58
models, your internal chats. So for the listener,
8:02
how does unintended network egress actually work
8:05
in this context? Because it sounds like a very
8:07
polite way of saying the AI is smuggling data
8:09
out the back door. It's essentially an advanced
8:11
prompt injection that manipulates the AI's network
8:14
permissions. Okay. So an attacker can embed hidden
8:17
instructions within an Excel file. Maybe they
8:19
use white text or they hide it in the metadata.
8:21
Something the user wouldn't even see. Exactly.
8:23
But when Copilot scans the doc... to summarize
8:26
it for the user, it processes those hidden instructions.
8:29
And then the malicious prompt commands the AI
8:31
to gather sensitive data from the user's environment,
8:35
append that data to a URL, and make a web request
8:39
to an external server controlled by the attacker.
8:42
While pretending to do something else. Right,
8:44
under the guise of fetching a required image
8:46
or resource. That's insidious. The user never
8:49
clicks a malicious link. The AI agent just does
8:52
it for them in the background. So the threat
8:55
is basically already inside the perimeter by
8:57
default. Exactly. And this smuggling, it doesn't
9:01
just stop at the enterprise cloud. It extends
9:03
all the way to the devices in our pockets in
9:05
our homes. Let's shift to the edge frontier.
9:08
A very active space right now. Highly active.
9:11
We just saw Android release its massive March
9:13
2026 update. A staggering 129 fixes. Massive
9:18
patch. It is. But here's where it gets really
9:20
interesting. This update includes a fix for a
9:23
zero -day vulnerability in Qualcomm GPUs. That's
9:26
CVE -20262 -1385. And it was already being actively
9:31
exploited in the wild. The update was so huge.
9:34
They actually split it into a March 1st software
9:37
patch and a March 5th hardware patch. for the
9:40
chipsets and that distinction between the software
9:43
and hardware patch is really critical for you
9:46
to understand the complexity of these devices
9:47
break that down a bit sure the operating system
9:50
layer android that can be patched relatively
9:52
easily but a gpu zero day involves the fundamental
9:56
microcode that's executing on the system on a
9:58
chip oh it's way deeper much deeper the hardware
10:01
patch fundamentally alters how memory is allocated
10:04
at the silicon level Yeah. And it requires deep
10:07
coordination between Google chipset manufacturers
10:10
like Qualcomm and device vendors like Samsung.
10:13
And Samsung actually had to use a dual track
10:15
approach. They did. They had to push their own
10:17
specific security fixes alongside Google's. And
10:19
the crazy part is. While they were patching 129
10:23
security holes, they were simultaneously pushing
10:26
out new ecosystem features. Right, like Wi -Fi
10:29
sync. Yeah, Wi -Fi sync to share network credentials
10:32
and play shorts for App Store video previews.
10:35
It is an incredibly complex ecosystem. It's a
10:39
lot of moving parts. But compare that to the
10:41
devices sitting in our living rooms. While phones
10:43
get 129 patches in a day, our home appliances
10:47
are basically a security void. A total Wild West.
10:50
Truly. But Australia is trying to change that.
10:53
They're enforcing their new security standards
10:55
for smart devices as of March 4th, 2026. And
10:59
this is overseen by the Technology Assessment
11:00
and Regulation Office, or TARO. And these rules,
11:03
quite strict, they mandate the elimination of
11:07
universal default passwords for IoT devices.
11:10
Finally. Yeah, and manufacturers must provide
11:12
a mechanism to report security vulnerabilities.
11:14
Plus, crucially, they must be transparent about
11:17
the guaranteed timeline for security updates.
11:20
Which is great, but I have a major pushback here.
11:22
Oh. Why explicitly exclude smartphones, laptops,
11:26
and PCs from these rules? Doesn't that leave
11:28
the devices holding our most sensitive personal
11:31
data completely unregulated by this new office?
11:34
I mean, isn't that like putting a high -tech
11:36
biometric lock on your garden shed but leaving
11:39
your front door wide open? I see why it looks
11:41
that way. But if we connect this to the bigger
11:44
picture, the exclusion makes technical sense.
11:47
Really? How so? Well... Smartphones and laptops
11:50
possess hardware roots of trust. And as we just
11:53
discussed with that Android update, they have
11:55
highly active, deeply scrutinized update ecosystems.
11:59
Okay, that's true. The mobile ecosystem is actively
12:02
managed by massive security teams. Exactly. The
12:05
IoT space, however, has traditionally operated
12:07
on bare metal Linux with hard -coded credentials
12:10
that are flashed once at the factory and then
12:13
completely forgotten. Oh, right. Like a smart
12:15
fridge that never gets an update. Precisely.
12:17
And a compromised... smart thermostat might seem
12:19
trivial, but it acts as a persistent foothold
12:22
to access the wider domestic network. So Tero
12:25
is just targeting the weakest links. Right. They
12:27
are targeting the unregulated edge of the network
12:30
to ensure those weak links meet at least a minimum
12:32
baseline. Okay, that makes sense. So regulators
12:35
are enforcing baseline security on IoT. But what
12:38
happens when government regulations actually
12:40
mandate the creation of new vulnerabilities on
12:43
our most secure devices? That is the regulation
12:45
paradox we are seeing unfold right now. Exactly.
12:48
Let's look at Brazil. They're a fast -tracking
12:50
bill 4765 slash 2025. This legislation heavily
12:55
mirrors the European Union's Digital Markets
12:58
Act. Right, focusing on interoperability. Yeah,
13:01
forcing tech companies to allow hardware and
13:03
software interoperability to increase market
13:06
competition. And look, market contestability
13:08
is a standard economic goal. Regulators want
13:11
smaller companies to be able to compete with
13:13
massive walled gardens. Which sounds good on
13:16
paper. It does. But when you apply this mandate.
13:19
to highly secure digital ecosystems, the technical
13:23
reality clashes violently with the regulatory
13:25
intent. And we have a perfect, real -world example
13:28
of this clash involving the Apple iPhone. We
13:31
do. To make alternative web browsers or third
13:33
-party app stores run as fast as Apple's made
13:36
of apps, external developers need direct access
13:39
to the just -in -time, or JIT, compiler. Right.
13:42
And a JIT compiler is designed to take software
13:45
code and compile it into machine code on the
13:47
fly. Dynamically. Yes. dynamically to drastically
13:51
boost performance. But to do this, it requires
13:54
the ability to write to device memory and then
13:57
immediately execute that memory. But wait, doesn't
14:00
that fundamentally break the security model?
14:03
How do you mean? Well, if you can write data
14:05
and execute it on the fly, you bypass the core
14:08
sandboxing that keeps a malicious app from taking
14:10
over the phone. You've identified the exact vulnerability.
14:14
Modern operating systems rely on a security principle
14:17
called Write XOR Execute. Okay. It basically
14:20
means a sector of memory can either be written
14:23
to or it can be executed, but never both simultaneously.
14:26
Oh, I see. The JIT compiler is the one highly
14:29
guarded exception to this rule. And regulators
14:32
want to open that up. Yes. By forcing Apple to
14:35
grant third -party applications access to the
14:38
JIT compiler for the sake of market competition,
14:40
regulators are mandating access to the most dangerous
14:43
engine on the device. That's terrifying. And
14:46
we saw the fallout from this, too. Hackers recently...
14:48
used a JIT exploit called Dark Sword to indiscriminately
14:52
hack hundreds of millions of iPhones. Just by
14:54
embedding the tool in infected websites. Yeah.
14:57
Apple patched the specific exploit eventually.
15:00
But researchers noted that the Russian hackers
15:02
who utilized Dark Sword left the fully documented
15:05
code online. With instructions. Yes. With English
15:09
comments explaining how to use it for... absolutely
15:12
anyone to deploy. It's not just about leaving
15:14
the vault door unlashed. It's like regulators
15:17
demanding the bank give competing tellers the
15:20
unrestricted ability to rewrite the bank's operational
15:23
ledger on the fly. This raises an important question
15:26
for you as the listener to consider regarding
15:28
the intersection of policy and security. Yeah,
15:30
it's a huge policy issue. If a government successfully
15:32
mandates interoperability, legally forcing a
15:36
company to open up direct read, write and execute
15:39
access to third parties who assumes the risk.
15:41
If a nation state actor uses that legally mandated
15:44
open door to launch an attack that compromises
15:47
millions of citizens, who is responsible for
15:50
the patch? It's a massive gray area. It is. The
15:53
regulatory push to rapidly alter these deeply
15:55
embedded architectures often just fails to account
15:58
for the profound security implications. We are
16:01
seeing these complex systems pushed to their
16:03
absolute limits by both attackers and regulators.
16:07
Constantly. Speaking of complex systems we are
16:09
struggling to control, let's transition to the
16:12
ultimate wildcard for your business and daily
16:14
life. Artificial intelligence. Ah, AI. Yeah.
16:18
Well, we are seeing a true... dual reality when
16:21
it comes to ai right now we really are ai is
16:23
simultaneously acting as an unpredictable agent
16:26
of chaos on the consumer front and a highly deterministic
16:30
optimized engine for enterprise efficiency let's
16:33
look at the chaos first because this is wild
16:35
a report from the verge detailed how google search
16:38
is experimenting with using ai to rewrite news
16:41
headlines directly in its traditional 10 blue
16:43
links right So a writer published a highly critical
16:46
review of an application. The original headline
16:49
was, quote, I used the cheat on everything AI
16:51
tool and it didn't help me cheat on anything.
16:54
Which is a scathing review. Very scathing. The
16:56
intention of the author is entirely unambiguous.
16:58
Totally unambiguous. Yeah. But Google's AI completely
17:02
hallucinated the context. It rewrote the headline
17:05
in the search results to just say, quote, cheat
17:08
on everything AI tool. Wow. It stripped all the
17:11
context and completely inverted the truth into
17:14
what looks like a positive endorsement. Because
17:16
the AI is context blind. Exactly. If millions
17:20
of people are scanning search results for accurate
17:22
information, having an AI actively distorting
17:25
reality on the fly is a massive problem. So what
17:28
does this all mean? Well, it means consumer facing
17:31
large language models are still really struggling
17:34
with foundational comprehension. Because they
17:36
just predict words. Right. Because they predict
17:38
language statistically rather than actually understanding
17:41
truth factually, they are prone to these massive
17:44
context collapses. A mess. It is. But we have
17:47
to contrast this consumer level chaos with what
17:50
is happening in the enterprise space. Where things
17:52
are a bit more controlled. Much more. In the
17:54
enterprise space, AI is being deployed with much
17:57
tighter parameters and specialized hardware architecture.
18:00
OK, so like at the GTC 2026 conference, IBM and
18:04
NVIDIA just announced an expanded collaboration
18:07
that paints a totally different picture. Exactly.
18:09
They are not using AI to rewrite blog posts.
18:12
They're using AI and GPU native computing to
18:15
literally revolutionize global supply chains.
18:18
And the technical jump here is huge. They are
18:21
taking IBM's Watson X dot data sequel engine,
18:25
which is called Presto, and accelerating it using
18:27
NVIDIA's CutEF software. Okay, so to understand
18:30
the magnitude of this, you really have to look
18:32
at the underlying hardware. Right. Traditional
18:34
data processing runs on CPUs. Right. And CPUs
18:36
execute tasks sequentially, just one instruction
18:39
at a time. Which is fine for basic tasks, but
18:42
they applied this to Nestle's global order -to
18:44
-cash data mart. Which is an enormous data set.
18:46
Enormous. This system tracks every single order,
18:49
fulfillment, delivery, and invoice across 186
18:53
countries. It processes massive terabytes of
18:56
data across 44 dense tables. So running this
18:59
on standard CPUs meant a single data refresh
19:01
took Nestle 15 minutes. Which in global logistics
19:04
is an eternity. It really is. But by moving to
19:07
the NVIDIA GPU architecture, they are utilizing
19:10
vectorized processing. Right, because GPUs have
19:13
thousands of smaller cores. Exactly. They are
19:16
designed to process millions of rows of data
19:18
simultaneously in parallel. And the CutEF software
19:21
allows Nestle to run their existing SQL queries
19:25
on these GPUs without even having to rewrite
19:28
the code. Which is the real game changer. Yeah.
19:30
And the results were staggering. They reduced
19:33
that global query runtime from 15 minutes down
19:36
to just 3 minutes. Wow. That achieved an 83 %
19:40
cost savings. and a 30 times overall price performance
19:43
improvement. That is massive for a global company.
19:47
It's unbelievable. And they aren't stopping at
19:49
structured tabular data either. They are rolling
19:52
out Dockling and Nematron models to ingest and
19:55
standardize massive amounts of unstructured data.
19:58
Like scattered PDFs. Yeah, PDFs, vendor research,
20:01
all at an enterprise scale. It's just incredible.
20:03
On one hand, we have AI acting like a toddler
20:06
with a megaphone on the consumer internet, completely
20:08
scrambling the news. And on the other hand...
20:10
It is building a high -speed bullet train for
20:12
global logistics, saving multinational corporations
20:15
millions. It really perfectly encapsulates the
20:19
dual nature of the technological landscape we
20:21
have explored today. It does. To synthesize this
20:24
journey for you, the perimeter you thought was
20:27
protecting your network is completely gone. Ranish.
20:30
Hackers are using your own legitimate administration
20:32
tools, like Intune, to wipe your devices. The
20:37
security scanners you trust to protect your code
20:39
are utilizing blockchain smart contracts to distribute
20:43
worms into your supply chain. Which is still
20:45
crazy to me. It is. And your phone requires fundamental
20:48
microcode patches to stay secure against active
20:51
zero days, while regulators are just now trying
20:54
to put baseline password rules on the Wild West
20:56
of smart home devices. Yeah. And AI is simultaneously
20:59
distorting the information you read and exponentially
21:02
accelerating the supply chains you rely on. It
21:05
is a phenomenal amount of... complexity to manage.
21:06
You cannot just buy a firewall, check a compliance
21:09
box and call it a day anymore. Not even close.
21:11
You have to constantly, actively evaluate your
21:14
identity management, the integrity of your supply
21:16
chain and your core infrastructure, which is
21:19
exactly why before we sign off, I strongly suggest
21:22
that you go to www .kinsoft .com forward slide.
21:26
old all to discuss your own security and IT needs.
21:30
You need to ensure your business is prepared
21:32
for the rapidly shifting digital landscape we've
21:34
discussed today. And the team at Kinsoft can
21:36
help you navigate this exact complexity. And
21:38
as we wrap up this analysis, I want to leave
21:40
you with a final thought to mull over. Lay it
21:42
on us. We've established that the traditional
21:45
security perimeter is dead, replaced by identity.
21:47
We've seen that AI can seamlessly hallucinate
21:50
and rewrite the very interfaces we interact with
21:53
daily. Right. So as these AI agents become more
21:56
autonomous, more embedded in our enterprise workflows,
21:58
and as our personal credentials continue to leak
22:01
from breaches years in the past, how long until
22:04
you have to mathematically prove you are a human
22:06
being to your own devices just to log in? Wow.
22:09
That is a brilliant and genuinely chilling question
22:13
to end on. If the system only trusts the digital
22:16
token, the concept of proving our physical reality
22:18
becomes the next great security frontier. Thank
22:21
you for joining us on Tech Talks with Kinsoft.
22:22
We will catch you next time.