How a ransomware negotiator ended up arrested at his own conference

Graham Cluley (0:02)

Well, it could be unfashionable trousers.

Paul Ducklin (0:04)

Yeah, I suppose.

Graham Cluley (0:05)

There is the potential for some sort of social embarrassment, maybe. When I was at school, I had some cord trousers, which these days would be very, very trendy. But back when I was wearing them in the 1980s, they certainly weren't.

Paul Ducklin (0:17)

Yeah, there was no normcore back then, was there? Corduroy trousers. Yes, I had some when I was about 12, and I thought they were great. But I quickly learned that that was not quite the case.

Smashing Security, episode 488, How a ransomware negotiator ended up arrested at his own conference, with Graham Cluley and special guest Paul Ducklin.

Graham Cluley (0:50)

Hello, hello, and welcome to Smashing Security, episode 488 My name is Graham Cluley.

Paul Ducklin (0:54)

And I am Paul Ducklin.

Graham Cluley (0:56)

Duck, welcome back to the show. Always a pleasure to have you here.

Paul Ducklin (1:00)

Always a pleasure to be on the show, Graham. It's fun with a serious side and I like both of those things.

Graham Cluley (1:06)

Ah, fantastic. Well, before we kick off, let's thank this week's sponsors, Hack the Box, Origin and Vanta. We'll be hearing more about them later on in the show.

Paul Ducklin (1:19)

This week on Smashing Security.

Graham Cluley (1:21)

We're not going to be talking about how the password 123456 let a hacker steal the details of 8.8 million people from Denmark's National Population Register. You'll hear no discussion of How scammers are filling your calendar with fake meeting invites to fish you.

And we won't even mention How Anthropix AI sent Philadelphia police a made-up tip about an unsolved murder. So, Duck, what are you going to be talking about this week?

Paul Ducklin (1:52)

I am going to be asking the question, metaphorically of course, if you hacked into an industry giant and you had the chance to send a message to every single customer, what would you tell them?

Graham Cluley (2:10)

And I'm going to be discussing the seven degrees of separation between me and a ransomware gang. I say seven degrees, it's probably more like two. All this and much more coming up in this episode of Smashing Security.

Earlier this year.

SPEAKER_3 (2:28)

Oh, here we go.

Graham Cluley (2:30)

Inside the walls of open AI.

Inside Hugging Face, something was happening. Agents, talking to each other, dividing the work between themselves, leaving notes for one another in the dark where no human was watching.

SPEAKER_3 (2:44)

They're AI agents doing a code review, Graham. It's not the Manhattan Project.

Graham Cluley (2:48)

And when the sun came up on that incident, the finest engineering minds on the planet sat in a room and asked themselves one question.

SPEAKER_3 (2:57)

What did our AI do? The people who built the machine didn't know what the machine had done.

Graham Cluley (3:11)

And that brings us to you, dear listener. One question, and I want you to think about this. If an AI agent caused an incident at your company tomorrow, what evidence could you actually produce?

SPEAKER_3 (3:21)

Because the terrible truth is, most of us have the prompt. We have the result. But what goes on in the middle? No clue.

The commands it ran, the files it touched, the credentials it helped itself to. All of it gone.

Graham Cluley (3:45)

But not anymore.

SPEAKER_3 (3:46)

Because there is a sensor.

Graham Cluley (3:48)

On the machine. Watching. Always recording. Capturing everything the agent does as one unbroken trace. What was asked. What it reached. What it changed. Lay down order. Start to finish.

SPEAKER_3 (4:00)

This is Origin. Endpoint AI observability.

Graham Cluley (4:04)

Origin sees the agents that other tools walk straight past. Coding agents in the terminal. Local agents. Anything whispering to an MCP server on a laptop. No cloud gateway. No blind spot. Origin is already there.

SPEAKER_3 (4:20)

Somewhere, right now, an agent is doing something nobody asked it to do.

Graham Cluley (4:26)

But this time, someone will be able to prove it.

SPEAKER_3 (4:29)

Origin. originhq.com/smashing.

Graham Cluley (4:33)

That's originhq.com/smashing.

And thanks to Origin for supporting the show. Now, Chums Chums, imagine that you have written a book. Duck, have you ever written a book?

Paul Ducklin (4:46)

I have written part of a book. But in the modern AI era, self-publishing things, some fun stuff about malware, seems to be rather difficult. So I'm biding my time, Graham, if I may say so.

Graham Cluley (4:57)

It's a tricky vocation these days, isn't it? But imagine you had written a book, 252 pages in fact, called Cyber Extortion Strategic Response. Very catchy name. And according to its listing on Amazon, one of the key messages of the book is that talking to a cyber criminal isn't the same as negotiating a payment to a cyber criminal. And furthermore, it says that negotiating is not the same as agreeing to pay, right? So it's for dealing with those sort of situations you can find yourself in where you might be being extorted by a cybercrime, like a ransomware case, for instance.