00:00:00 · Thai Duong, Ruby Justice Thelot
[00:00:00] S0: Right now, in the next six months to a year, we can have a lots of attacks. You know? AI is gonna help, like, offense more... Way more than defense because, okay, you can detect them, but does it help you if you detect them and you find that there's, like, a a 100 of dumps inside your network? Maybe a thousand of agents hacking you right now inside your network. I haven't seen anybody come up with a, you know, a good idea here, right, that could help people defend against a thousand attackers inside your network at the same time, concurrently concurrently attacking you. [00:00:43] S1: And we are back. We are live with Thai Duong, who is Chief Executive Officer and Founder of Calif, which is a California security firm that does offensive research and security engineering. Very cool, very topical. Thai, welcome to MTS.: [00:00:59] S0: Thank you for having me.: [00:01:00] S1: Absolutely. So my first question is, what are your current vibes on cyber risk? Do you think that we are under imminent threat of massive cyber catastrophe like we've never seen before? Because markets don't really seem to be pricing this in.:
00:01:00 · Ruby Justice Thelot, Thai Duong
[00:01:00] S1: Absolutely. So my first question is, what are your current vibes on cyber risk? Do you think that we are under imminent threat of massive cyber catastrophe like we've never seen before? Because markets don't really seem to be pricing this in.: [00:01:20] S0: I don't think it's going to be massive, but I think there's lots of attacks but smaller attacks. Banks are gonna get popped like more data breaches, more ransomware. But it's not like people are gonna attack like the power read or the water UD network because I think the pharma activities are like basically caused by criminals. They later are more like nation state activities. And I think for nation state, the current environment is very good for them, to come in and compromise computers and networks and to steal information for intelligence purposes. So they don't really want to show their capabilities until they actually need it. But for criminals, this is the best time to hack and steal money. So [00:02:29] S1: that, yeah, there's the intelligence use cases, and then there's the risk of potentially somebody hacks critical infrastructure. How likely do you think that is?:
00:02:29 · Ruby Justice Thelot, Thai Duong
[00:02:29] S1: that, yeah, there's the intelligence use cases, and then there's the risk of potentially somebody hacks critical infrastructure. How likely do you think that is?: [00:02:40] S0: I think the risk is increasing, right, because things that are difficult before now become much easier. And then more people get access to these applications now because now you can just bomb and if you have enough tokens, you can basically have infinite number of hackers hacking things for you. And that's really crazy. And this is the world we're entering basically. So if somebody out there really, really wanted to hack critical infrastructure for whatever reason, if they couldn't do it before, now the chances that they can actually do it are higher, right? Because like it boils down to if they have tokens or not, and they can steal the tokens even if they don't have the money. [00:03:37] S1: Right. So tell us more about what Calif does specifically within cyber.
00:03:44 · Thai Duong
[00:03:44] S0: We do hacking basically, and what people can send, right? We don't hack people without their consent. And we published a lots of offensive security research. Recently, you can probably see the PHP2 shell exploit, vulnerability exploits. And one of our engineers discovered that. So we love to find vulnerabilities that impact a large part of the internet. And we also... Well, actually our main research program focus on the iPhone because if you do like vulnerability research, you would know like in software security, the iPhone is like the holy grail of like vulnerability exploitation. And it's not like nobody has hacked the iPhone before. But since Apple introduced MIE, which is a hardware mitigation mechanism, since last year nobody actually has published any public iPhone exploit. So we really, really wanted to hack the iPhone for that reason because it's very difficult. And recently, yeah, we managed to do that. We published some of our work in Paris. We went to a conference there. We managed to get root access to the iPhone and even persistent access. In the past, people said that if you... One of the one of the best practices for iPhone security is to reboot your phone after a while because all the malware out there, they would go away after you reboot your iPhone. But we show that it's actually... There's ways to to stay... To persist our attacks even if you reboot or you upgrade your iPhone. This is pretty cool. And I believe nobody has done that, like, publicly in the past ten years. So yeah, that's what we do. And on the other hand, we do only things because we want to understand two things like to understand vulnerabilities and also want to understand the limitation, the frontier of like AI assisted vulnerability research. And this knowledge is actually pretty useful in helping our clients defend themselves. For example, like when we work on the iPhone, we understand in order to like what AI can do, what it cannot do right now. And that actually help us design mechanisms that help us defend our clients' network better.
00:06:30 · Ruby Justice Thelot, S2
[00:06:30] S1: Right. Ad[00:06:31] S2: I wanna shout out our sponsor, Lovable. You know the app you've been meaning to build? The internal tool, side project, or product you'd otherwise lose a weekend to? With Lovable, you get software you can ship today. That includes an editable code base you can inspect and change plus two way GitHub sync. Lovable also handles the backend and infrastructure including managed Postgres, auth, storage, hosting, payments, and more so you don't have to wire it all up yourself. And through Lovable's MCP server, you can create and deploy your project directly from the agents you already use. Turn ideas into software people love with Lovable, lovable. Dev. Now onto the episode. [00:07:10] S1: So if there are outstanding exploits that people can use to hack an iPhone, why doesn't everyone get hacked all the time?
00:07:18 · Thai Duong
[00:07:18] S0: Oh, that's a good question because I think in the past, just the recent past, like such an exploit was very difficult to develop. You need the vulnerabilities. You may need like multiple vulnerabilities, not just a single one. You need a way to get into the phone and then you need to get to root, like it... Like, basically to compromise the entire phone. And usually, it start with, like, you know, you visit a website or you receive a message on, you know, WhatsApp, on Signal, or on iMessage. And then the message or the website would exploit vulnerability in these apps. And then it would try to go from that vulnerability to the kernel of the phone, and that's how it gonna be able to control the entire phone. And you can see that's very difficult to do. Right? It it requires multiple vulnerabilities. It usually require a very well funded team of like several people to work very hard for a few months to be able to come up with such a vulnerability and exploit. So it's very expensive. And only a few groups of people all over the world can actually do it. And that's why this category, somebody have it, they don't want just to use it randomly because it's so expensive to develop. So AI changed that equation a little bit. Because now with AI, things become easier. Of course, you still need the human experts. You still need people who understand the iPhone architecture and everything. And then with the right AI model, frontier models, they would be able to speed up the vulnerability discovery and exploitation. In our team, for example, it took us like two or three weeks to develop these chains, and we have multiple chains. And so we believe moving forward, there will be more people having this capability. And it raised a lot of question about the privacy and everything for everybody, right? Because imagine if your neighbor can just hack you by sending you a message, what does it mean for your privacy? And I think hopefully, because we find these bugs and exploits to fix them. And we are working with, like, the vendors, in this in this case, Apple, to get them fixed. So hopefully, like, a lot of these bugs would be killed before these capabilities get into the hands of, like, everyday... Everyone. So, yeah, that's basically the situation that we are in right now.