created scary high efficacy models?

I think the place to start is to understand that while everybody got this mythos fever about this model that came out that was so amazingly powerful, I was concerned before that.

Think about the fact that you get hit by an old Ford pickup truck or you get hit by a Lamborghini race car.

Either way, it's going to hurt.

And the models that preceded some of these newest models are capable of finding vulnerabilities and creating exploits.

They just took a little more expertise and a little better cajoling by the operators, but they were capable for the past 18 months.

And it's been a growth path since then.

It kind of worries me because it sounds a little bit like... subprime stuff right it's a cake mix once you make bake the cake you can't disaggregate it and i'm also reading that what the implications are for the development of quantum and when it lands i'm imagining like a spaceship landing and everything changes at once how did ai get us closer to this wasn't that supposed to be a decade from now

And that is where Rob Joyce, the former head of NSA's cybersecurity directorate, told me defenders may actually be reclaiming the advantage.

I actually think the North Korean problem is much more solvable than the generic intelligence asset deployed into a company.

Why do I say that? Because these are all remote workers.

So I was at a conference just this week where people were talking about the tools they've enacted to stop remote workers from getting into their employment chain.

They're doing things like taking a picture on the video interview and then using that when the person shows up and is online at work to see if they've changed in any appearance or haven't kept a consistent story.

Others are insisting on a one-week onboarding where you come in, and you've seen things like technical capabilities, looking at the latency of keystrokes.

So the fact that they're remote workers is a real liability, and I think the industry will adapt and get much stronger at detecting and preventing this.

Here's Rob Joyce again.

What do we do about that? How does AI protect those systems, and what's the counterpoint? How do we protect those systems against the malicious use of US-created scary high-efficacy models?

I think the place to start is to understand that, you know, while everybody got this mythos fever about, you know, this model that came out that was so amazingly powerful, I was concerned before that, right? Think about the fact that you get hit by an old Ford pickup truck, or you get hit by a Lamborghini race car.

Either way, it's gonna hurt.

And the models that preceded some of these newest models are capable of finding vulnerabilities and creating exploits.

They just took a little more expertise and a little better cajoling by the operators, but they were capable for the past 18 months, and, you know, it's been a, a growth path since then.

What we have to understand is the AI tools are not creating new ways to hack.

What they are doing is they are revealing the flaws that are already in our software or in the configurations of our networks, or the problems we have created accidentally inside these systems.

How did AI get us closer to this? Wasn't that supposed to be a decade from now?

Uh, so if you were able to, to penetrate Axie's machine, you got access to, like, five or six of these signatures.

And how did they get there? They went after the developer.

They used social engineering and our human weaknesses.

It wasn't technical brilliance, it was social engineering mastery.

They did it by posing as a recruiter on LinkedIn.

They targeted the senior engineer at a developer that works in this crypto ecosystem, and then after multiple fake interview rounds with that developer, they sent him a PDF job offer that was laced with malware.

So they worked to build their bona fides with this guy and convince him that he was getting a job opportunity.

[laughs]

That was Rob Joyce, who was running NSA's hacking division, TAO, at the time, and while he has to be circumspect on the classified intelligence they had definitively pointing to the DPRK, he confirmed that the initial public assessments were right on target.

After the Sony attack, even the cybersecurity community focused in on North Korea.

They got it right.

If you watched the, kind of the Twitter community that I follow, everybody was talking about the fact that Sony was a North Korean job.

It was really funny, though.

After the White House came out with attribution and the FBI named them, then all the conspiracy theories popped out, and people had all sorts of reasons why it wasn't the North Koreans, which really just surprised me because the wisdom of crowds was already there, and the fact that the government said it pulled everybody into a, a whole different region.

Here's Rob Joyce, who watched this unfold in real time at the NSA.

The strategic moment was the Sony breach, where it wasn't just a breach, it was reaching into an American company and kind of bleeding them in public.

Their estimate, roughly half a billion dollars a year.

I have to put into perspective that the North Korean economy is the size of, like, Vermont's economy, and here they are establishing a nuclear weapons program and have created intercontinental ballistic missiles that most nations don't have.

Here's Rob Joyce, who used to run hacking divisions and later cybersecurity for the NSA.

Cyber theft punctures the sanctions.

Sanctions assume you can restrict the revenue, and this cyber channel creates revenue that's borderless, deniable, and renewable.

They've been to- able to continue to generate cyber revenues year on year.

So I think, uh, North Korea is more dangerous because they're disconnected.

Deterrence is harder.