Patch IPv6 Flaw Now; Microsoft's Endpoint Security Ecosystem Summit will Not be Open to the Press; Companies are Opting Out of Letting Apple Scrape Data for AI Training

Luckily, the released code will only cause a system to crash, and triggering even the DoS condition is not fully reliable. Finding paths to code execution will be tricky. Let's hope exploit developers are not going to surprise us with a solution anytime soon.

This one is still fragile as an exploit, but it works. However, the exploit is complicated and, over time, maybe weaponized. I'm not a fan of disabling IPv6Ó at the network adapter layer, as I've been through this movie before. We had the same conversations in the Novell IPX/SPX and IPv4 days. Once you get to 'enabling IPv6, you may find it's not as easy as disabling it. I prefer to patch the systems and properly route IPv6; if you cannot, disable IPv6. Do not leave IPv6 untouched; that is also a vector for adversary in-the-middle attacks.

You're thinking, 'Switch to IPv6 they said; it'll be secure they said.' They weren't wrong - implementation details are where things can go south. At the time the patch was released on August 13, there weren't any known POCs or exploits. If you've already rolled out the update, you're good. If you're still doing analysis, time to step it up. Then go back and make sure you're following the current best practices for a secure IPv6 rollout.

Way back in 2003, Microsoft acquired GeCAD, a Romanian antivirus software company and I wrote a Gartner research note urging Microsoft change the game by making Windows and Office apps more secure and not just join in on endpoint security revenue (projected to be over $5B in the US in 2024) - revenue which largely exists because of Microsoft vulnerable code and Microsoft's refusal to force Windows users away from reusable passwords. This area is kind of like the profit attractiveness of drugs to alleviate symptoms vs. development of cure for causes of disease.

It's common for Microsoft to ask vendors to come in and discuss their products. I suspect this may be the first time all the vendors are at the same conference on the same topic.

A not unexpected follow-on event after the CrowdStrike incident. Cyber Resiliency is critical and making sure our endpoints are as robust as possible, to include detection and prevention of attacks, is a key component here. Part of the discussion will be the efficacy of removing kernel access, something Apple has been working on for the last few years; it's not simple and has nominal return. Even so, cyber improvements are likely to come in small increments.

Unlike traditional search engine web crawlers, AI bots will obscure the original source of any information they acquire to train their models. Even if asked for a reference, AI bots in the past have often made up fictitious references. Copyright holders are rightfully concerned about the use of their work by AI bots without being provided any credit or compensation.

On the Red Team my first thought is, what happens when I switch my user agents around and become one of these bots? It's always interesting.

Applebot respects directives in your robots.txt file, for user-agent Applebot or Googlebot. The directive blocks the data on your site from being used to train their LLM. Google's AI-specific bot, Google-Extended, is blocked by about 43% of websites while OpenAI is blocked by about 53%. Apple competitors like OpenAI and Perplexity are negotiating partnerships with news outlets, social platforms and other sites to allow processing their content. Speculation is businesses want to withhold data until a partnership (typically paid) is established. If you have copyrighted content, you likely don't want the LLM's trained on it, update your robots.txt. With the plethora of new AI bots, consider wildcards to avoid perpetual updates.

Not a lot of specifics are being shared. The Dutch Ministry of Defense is categorizing this as login problems with some service impacts due to phones being offline. The outage is impacting flights to Eindhoven airport which serves as a military base; Schiphol, the country's largest airport, remains unaffected. Given the impact on civilian travelers, it's reasonable to expect better communications on the outage, impacts and related activities.

I suspect they will revisit connectivity to other networks as part of the After Action Report (AAR) and look to segment those networks.

The phrase "if this goes sideways, delete my browser history" comes to mind. While a privileged insider is tricky to prevent, particularly one with global admin, enforced MFA and monitoring can raise the bar.

The court documents call into question the skillset of Mr. Rhyne as an infrastructure engineer. At a minimum, he didn't seem to have familiarity with the 'command line' interface. Oh well, score one for the good guys although it doesn't seem that they had to work that hard to find and charge the culprit.