Beer Counter: 9!
Grrcon this year was pretty interesting this year. Attending confrences typically help you do one of two things. Get up to speed with technologies that you use, and they can also help indicate to you where the technology / market is moving.
In years past, Grrcon was more interesting to see the way you can get up to speed with the tools that you are using. I remember, for example in 2021 when Behavioral Based Detection + AI was making its first waves into the EDR, MDR sceene. I remember signing up at a vendor booth (sentinel one) and doing a challenge, where we had to diagnose the type of malware etc. quicker than the AI, everyone who did it lost within seconds.
I think at the time, it was pretty well established that this was a trick used to kind of sway mahogony row into buying their product. But id like to say from a technical perspective, it is snake oil. Behavior based detection is not new, and i have been using it in EDR since 2019. Today though, we have numerous problems with false positives related to behavior based AI.
For example, i worked somewhere with Sentinel One as their EDR + MDR. In that company, we have a number of devices with different purposes. Especially considering that we are a school. Well most devices come with specific purposes and software. One example would be for the Animation and Art building, we have some pretty spec’d out pcs for the animation students, and along with that they get animation software like blender.
Well one day, S1 nuked the entire classroom of its blender installation (please note that this is 1 of 5 classrooms with blender). When we log into the S1 dashboard and view the reason for removing blender on this one classrooms PC’s, the justification by the behavioral based AI was as follows.
Program was launched via a shortcut classifying as a obfuscation technique.
Program consumes a lot of memory in attempt to hide from EDR.
…. something else that i dont quite remember.
Well reading through the two major points there, i think its clear to see that the behavioral based AI is complete bullshit. At one point, maybe before it was integrated with an LLM, and was static analysis of the behavior (i guess what im trying to do here is draw a line between what i knew was hueristics based behavioral analysis and behavioral analysis ai??)
Another example was once we had a server running a program that needed to do some encrpytion, for the reason of encrypting data. The Behavioral AI nuked libcrypto.so….. like, the library that provides a bunch of cryptography methods etc…. Looking at the justification for the behavioral based AI was as follows.
Program attempted to encrypt sensitive data to evade EDR.
Program attempted to decrypt encrypted data to evade EDR.
What a joke man.
I would say there was a definet prime of behavior based EDR, between 2021->2024/25. At this point we are in a purgatory of AI products. And this sentiment bleeds into the experience of this years convention.
The Present State of Grr Con
The fun part of Grr Con to me, is always the interactive bits that they provide you. For example, they handed out a badge, thats begging to be hacked by me and you. and maybe one day it will be :) (demo coming soon?)
Badge Front
Badge Back
2600 HZ
but also, they had a phone booth, that you had to hack using the phreaquency. Once you got connected to the operator, you had tree of choices. You could speak to E.T., Robocop, Skynet, WOPR, Etc.
Speaking to each of the bots, would give you a puzzel, where they would ask you a question or tell you some tidbit from the movie, and you had to respond with the thing that they wanted. There were 3 tidbits of info you had to provide per each bot. Ive seen E.T. and Robocop, and im aware of skynet as a concept, but not sure that ive seen a movie with him. But i absolutely know what WOPR means.
I asked the operator to pass me to WOPR and from there i played a game with the bot. It was a classic, you have access to thermal nuclear war heads, who would you strategicly nuke first?
My anwser lol russia, as it was in the movie. Im sure you can see how the game was played from here. Now thats a pretty sick game to play. And i would love to remake it or something along those lines.
Presentations
Most Presentations were soem how deeply coupled to using AI to do something. I sat in on a presentation about some hacker using claude to write malware. In essence the presentation was about social engineering the bot through prompts to do naughty stuff for him. He went over his successes and his failures.
Another presentation i went too was a bust, and i ended up leaving. But unfortunately almost all presentations were following this kind of show. Again not to reminicess on previous conventions, but past renditions had more interesting presentations. Unfortunately, i dont think this is to blame on Grr Con them selves. This is up to us, as a community of hackers in SWMI to provide better content and presentations. I want to learn more about what your doing, but i dont want to learn about how you too are using AI to get mediocer results. objectively, none of the presentations were particularly interesting.
Vendors
This year, there quite a few new vendors and not so many of the big names. Many of the big named venders that were there had really nothing to show this year. Which i think is okay. The rest of the vendors seemed to be relatively green and new. Most of the sales reps i talked to either didnt really know their product well, or were selling snake oil. It turned out to be that an over whelming 85% of the vendors this year were essentially attempting to sell or vendor some extension of an AI that will make it more secure, or smarter, or better behaved etc. Unfortunately i think all of these companys are once again snake oil. I think if i was a CTO, or a CISO, i may look at these companys and the things they offer and provide and go, man our company really needs something like that. But because im not really a CTO, and im not really a CISO, and i actively use AI as a developer i can see the shortcomming of the developers when they use it.
Of the 85% of the vendors, they were looking at essentially AI governance, and ensuring that the AI wont do something bad. Which from a developer stand point doesnt really make sense. I kind of want the AI to do whatever i need it to when i want, under my supervision. Now where i see this going as a market, is going to these vendored tools. For example say i work at WMU, and i release bronco buster chat to students. Or im meta, and i release muse which allows anyone to chat with it. At the moment, you can do relatively naughty and out of scope things to it. I want the vendor solution to prevent that and stand up the gaurd rails for me.
Maybe im out of touch and a laggard in the technical world. Maybe everyone is being pushed to build chatbots and RAGs and etc. And maybe everyone is working twoards something that will ultimately need 85% of these vendors tooling, but for me i dont quite see the need, and i dont want it on my personal agent.
The Good
Contrast Security was by far my favorite company to talk to. Essentially, say im an ape, and i dont know how to write code, and all my code is written by my bot overlord claude. Contract, provides custom compilers and runtime interpreters, that essentially will outfit your code with edge cases that you may have never expected. Say you write shitty code, and you dont sanitize your inputs from users, and your subject to some prompt injection. Well, if you use contrast, it will layer your function where you take user input and do a thing, and then it will safe gaurd it for you, and sanitize the content for you.
I got to talk to one of the developers on contrast, and we discussed the different ways that they are doing this, because fundamentally, there are so many different languages that are made different ways. Two examples were python and go. For contrasts python solution, they will essentially provide you a custom interpreter to run your code in production. For Go, they will take your compiled binary, and RE-COMPILE IT!!! what the hell!! that to me in incredible feat.