Hacking All The Devices, with AI? - Rob Allen - PSW #941
Summary
This episode features an interview with Rob Allen from ThreatLocker discussing the security risks of AI agents, emphasizing the need for strict allow-listing, ring-fencing, and zero-trust controls to prevent rogue behavior. The show also covers a study on exploiting Visa contactless payment systems to bypass expiration checks, alongside a roundup of news including a 16-year-old Linux LPE, a Denver International Airport breach, and the rise of AI-powered PLC attacks.
Topics discussed
Intro: AI agents, 16-year-old Linux, and zombie credit cards
Welcome Rob Allen from ThreatLocker
AI use cases and the benefits vs. risks debate
The danger of AI agents with unrestricted local access
Bolt-on security and the need for agent controls
Implementing least privilege and zero trust for AI
The difficulty of auditing AI-generated scripts
Blocking MCP servers and limiting credential access
Granular permissions and living off the land attacks
Blocking legitimate remote access tools as defense
Zero Trust Cloud Access and IP restrictions
Phishing attacks targeting AI chat histories
User education vs. technical enforcement controls
Zero trust hierarchy: User, Agent, and Children
Treating AI agents as standard users
Host introductions and InfoSec World promotion
Zombie credit cards: Exploiting magnetic stripe flaws
NFC contactless payment vulnerabilities and skimming
Personal anecdotes on card fraud and reissuance
AI-assisted exploitation of exposed Siemens PLCs
OT security, Purdue model, and internet exposure
The gap between cyber and OT security knowledge
Physical security breaches at Denver Airport
Historical security failures: Railways and phone systems
Nuclear reactor at University of Rhode Island
Antiquities: Punch cards and Plymouth Rock
PCI compliance and the convenience vs. security tradeoff
QR code stickers on gas pumps and soft targets
Protocol flaws: IPMI and unfixable architecture issues
Password management: Books, managers, and passkeys
Ad-clicking malware on Android TV and IoT devices
The rise of Linux and domestic OS strategies
BadUSB devices and persistent hardware threats
Frustrations with AI writing styles and guardrails
Closing remarks and next week preview
Listen ad-free on Castria