Machine Learning-Powered CDR – Daniella Pontes & Anna Belak, Sysdig

This is texturing TV. Hi everyone. Welcome to techstroke TV.

We've got another great segment lined up for you. I have some friends from sistig who are joining us. We have annabellik who's been on the show before and a welcome.

It's good to see you again. To be here and actually I'm gonna ask you to do more fully introduce yourself Anna. But before we do I want to know so introduce the audience to Daniela Ponce and I think Danielle, this is your first time on text on TV, isn't it?

It is and today I'm very glad to hear be here. Thanks and thanks for being here happy to have you here. So Danielle, since you are a first time or I'm gonna ask you to go first and just kind of introduce yourself to our audience.

Okay, so Daniela points and I'm part of this is the cue product marketing team. Excellent, and thank you. And Anna if you don't mind just a quick introduction to our audience.

Mr. Ellen, we're happy to be back here. My name is Anna.

I am the director of thought leadership artistic in a former Governor analyst. Actually and then looks being that you are not the rookie here. I'm gonna test you if it's okay with maybe look a lot of our audiences very familiar with this thing, but maybe some who aren't or not.

Sure. Why don't you give them a little background about cystic? And I think my shortest version is that cystic is a cloud and container security company specifically we help you secure your Cloud native applications from source to run.

So that means we help you make sure that you don't ship things that are flawed and we also help you make sure that the beautiful things that you ship continue to do. Well once they're running and if something weird happens we let you know as soon as possible. Absolutely.

Very cool. All right. So we want to talk some cryptojacking today, huh?

And before we get into. What system is doing about it? I feel like we need to Define.

Crypto jacking right we look you know, it's funny. I had some team members in this week a little younger than me. They're all younger than me, but I had something and I happen to walk in the office and they're all in there with their crypto things, you know looking at their crypto whatever it is one looks at when you have crypto.

I I'm not a crypto person but who wants to Define kind of crypto jacking for purposes of our discussion today? And so I can do that cryptocurrency for this one not familiar. You could read entire lectures on it.

But basically it's an alternate form of currency. The probably most well known ones are a Bitcoin and ethereum and the idea is that you mind this currency by running processes on machine can be either CPU or GPU. And crypto jacking is when you run that process on someone else's machine that you are not authorized to use.

Thereby using their compute resources electricity. And what have you to generate money for yourself. Let me if you don't mind and I'm just going to expand a little bit on it.

Look. a Bitcoin a single Bitcoin or a single ethereum coin, you know, they're exchanges that set the value of these things but some of the whole underlying system if you will they're validity of the system is based on the the the blockchain that underlies the currency or the coin or whatever you want to call it. And the people who started or the person depending who you believe that started Bitcoin.

You know had this ingenious idea that the the coins could be validated through what we call mining of which means intense computing power to try to you know, get the not break the blockchain but, you know figure out those numbers and it to juice and one can actually mine coins this way right one can actually gather coins and big coin look at its height. What was it 50 60,000 and maybe it's down to 20. I don't remember now, but think about that.

So in addition to just having dollars or rubles or whatever to buy Bitcoin, you could mind getting enough computing power to mine these coins. If you if you figured it out now getting enough computing power far exceeds what we can do baby, you know on my laptop here usually and so Like what we used for seti for those who are in age and remember search for extra terrestrial intelligence. We kind of crowdsourced and use CPUs across many different people looking for patterns in signals from space or a more Sinister a zombie machines that we were using for DDOS attacks, right?

We would take over the bad guys would take over these bad machines and use their CPUs and machines to launch an attack. Very similar kind of thing with with Bitcoin mining right crypto mining. We don't have to call it Bitcoin rights crypto mining, right if we take over these machines and use their CPUs to give us the horsepower.

We need to mine. We can really get coins so we can yeah. try to get coins and Of course, not everybody wants to give you their machine to you.

So this whole crypto jacking industry has popped up. When we take over machines to use them as an effect to mine for these coins. I'm holding myself out to be an expert.

That was a very Layman's description. But I hope it did the trick here for people. I've been here you're in the right department for sure.

I'll add a couple things one. Is that while Bitcoin in ethereum are the most prevalent and probably most Credible I'll say coins the ones that are often mined by cryptojackers are actually the ones that are more privacy focused. So one of the key elements of the blockchain is that your transactions are private and they're all traceable.

So nobody knows who exactly owns things but everyone know, but it's possible to find out exactly what happened. So to your point about trying to steal compute power and to your point about giving it a voluntarily I think holding at home is another example where you could like run something on your Playstation to help the protein folding scientists figure yourself out. This is much different.

But now we also have access to this infinite pool of compute power in the public Cloud, right? So if you are wanting to do this non maliciously like you just wanted to buy some coins you could theoretically go into Google or a AWS and spun up instances and do that. It turns out to not be worth it because the cost of the compute power is much greater than the money you are likely to generate but if you're stealing someone else's Google Cloud instances, then it's To you and it costs them money, but you get coins.

So if the coins end up with something this is very lucrative for the attacker and because of the Privacy features of the blockchain and because it's pretty easy to find open compute instances. It's actually a very low risk proposition for the attacker as well which results in cryptojacking being at the moment the most prevalent type of cloud attack that is out there because it's just a great Roi for the malicious actors. So is it that easy to Jack?

Are there so many now it's fairly easy. So you can go on so specific has A3 research team which spends all a lot of time looking into this stuff and they actually will set up instances for people to hijack to see how they do it. But you can also go out and you can read about it and there are lots of kits available that you can just download that literally will like step-by-step walk you through how to do this.

So almost anybody with a computer can't try it's harder to make a lot of money because it gets into more complex attack patterns. Like you may need to steal credentials to actually be able to create new instances rather than for example, stealing from existing ones, but in general almost any, you know, like teenager with a computer can try this the actors that collect the most money tend to be a little more sophisticated but none of them are like incredibly Advanced folks as far as we can tell. So do you look I'm in security a long time.

So do you think we're still at the kitty script or stage on this or do you think there's more organized in a fair areas actors that play here? It's hard to tell exactly but I would if I had to guess I would say that it's more script kitties than you know, advanced persistent threats Advanced persistence threats tend to go toward higher value targets. Like they're not just scraping coins.

They're interested and stealing data or maybe extortion or something like that. So my suspicion is the vast majority of cryptographers are actually just opportunistic kinds of attackers. So I thought I had read somewhere that there was one nation state.

Maybe it was North Korea. That was if you want to call them a script Kitty. I I'm not gonna argue with you but now right but anyway, so let's talk about how big a problem is this Danielle you have any insight into you know, how how prevalent how big I don't know how you would even measure it by dollars.

Jacked by people. I don't know so it is it is becoming a real threat in terms of the prevalence. Yeah.

So Google released the report saying that among, you know, the attacks that they have seen in compromised machines 86% is crypto jacket and there is a tendency to actually shift to crypto jacking exactly because it's easy and immediate kind of monetization. You don't need to chase for ransom or be chased by, you know law enforcement now as well, they are not traceable. So there is good incentives for crypto jacking and also as Anna said you don't need much, you know, they are offered as a service as well so you can start really easy.

Yeah, low barrier of Entry as we say, you know, the business World exactly. And once you were there, you start mining you become part of a pool. Yeah.

So whatever you do as a contribution to the final mining when they get the commission you get a part of it. So you don't have to go chasing the money the money comes to you. crazy Huh who would have thought of me think that if you had like tell your grandma or Grandpa?

Or someone from a hundred years ago that you know, this is gonna be a problem. How would you even explain this? Right?

I mean it would be so wow. But anyway, that's the world we live in so what can we do what how consistent help us? So there are many ways that you can detect crypto miners.

Yeah, you can detect to detect from things that we have been observing in the market some kind of indicators of compromise. But you can also try use machine learning in a very focused way because machine learning is very good for things that you want to make sure that you capture when it happened happens in its variation as well. So crypto miners they have been used based on kids out there and the variations that are coming to Market they are you know vast, you know, so machine learning that understands the anatomy of a crypto minor is is a good way to detect their presence and the sooner you detect their presence.

The easier you are. Oh, I would say that the less impact you have both financially and also in terms of reputation because they can run up your bill, you know, after hundreds of thousands in one month. They use stealthy kind of tactics to stay under detected.

Or non-detected until you start noticing, you know degradation in your application or your bills, you know becoming completely out of control and also you if you detect them early you avoid what is called multistage attacks or attacks with multiple types of downloads. Once they are in your environment. Why not?

You know, put other things yeah, why not move laterally why not, you know launch a runs on attack as well. So I mean this feeds into the whole ecosystem of the bad guys, like, you know, I call it evil ink the whole ecosystem of evil ink today right where you know, the cryptojackers don't exist in a vacuum. They added to your point.

They may be relatively innocuous low level kind of bad guys in in the hierarchy, but nevertheless there's a whole echo system. of the of these bad folks of evil ink right and and once they have it in Look, they're looking to make money. They can't make enough money crypto mining or jacking or whatever.

They know enough to pass along that access to the next level of evil ink. who we're gonna come in and maybe you know find another way to make money off of your assets and information and then maybe it's the ransomware people and maybe it's depending Who You Are you know, it's it can get all the way up to nation states and what have you so you know it even the smallest relatively innocent and I don't want to Here's a mistake. I think we make though.

Let's not call crypto jacking innocent. It's wrong. It's illegal.

It's theft right they may not be, you know, stealing your nuclear codes or waging thermonuclear war or whatever, but they're nevertheless thieves and bad. And and they're part of this bigger. Ecosystem of that and you don't see your point.

Like if somebody becomes a target of crypto jacking it's sort of a signal to how easy it is to compromise your system. Right? So even though I may have just discovered that I can run this minor on your machine for five minutes.

That means you're not protecting yourself very well so I could sell that information to somebody who may be more vicious and wants to do something more serious, especially if I know something about you like, oh, you're a financial institution like that's delicious. So there's a whole array of potential consequences just because you're exposing yourself as a not a very secure organization. Exactly.

So what about today? So cystic what can we how how's this take helping me? So we are coming to Market with this machine based approach to detect crypto tractor and it is a focus kind of solution because machine learning as he came to Market, you know, usually it's to detect anomalies but anomalies leaves a very large margin for false positive.

You still have that job to analyze what that anomaly is about and time is of a sense here. We want to be very targeted in terms of we detect crypto miners in their as soon as possible and we give you high Precision about yeah. This is a crypto minor.

Please do what you need to do to stop it because from that point on it's gonna be Hefty bills and also more exposure to to threats. So we come to market with the various effective way to put a layer of defense against cryptographers in their Vari. Because it's hard to track them as a as a single or a small set or a set of indicators.

You really need to understand their behavior. Yeah. I mean, I I, you know recognizing the pattern pattern recognizing that the problem there.

Now once once this thing alerts you to this what what do we do next Anna? So you have the option as with any sis dig rule or method you have the option to use it in a blocking fashion or in a learning session. So you can if you see a minor always block it or you can send an alert to the dashboard and then your team can deal with it as need be there's another actually I think pretty interesting element here that's sort of unique to I'm also as you might know machine learning is a probabilistic type of approach.

So what actually happens is the model will say with very high Precision that like, oh we are a needle 99% sure. This is a minor right or we're 95% sure this is a minor and we set some threshold where we say like, okay. Well, it's more the next person then we're gonna block it or then we're gonna give you the option to block it, but in our case was different is the user has control over the model threshold.

So if you want to say that you want to block only things over 99% and alert. Things over 90% you theoretically could do that which is quite unusual normally machine learning models can't be tuned very well. They're just going to set for you.

Absolutely guys, I got to wrap we're running at it. We this was a long 15 minute interview, but we got a lot to cover Daniela for people who want to get more cystic info on on stopping crypto. Jacking where could they go?

Um, they go to our website. We have plenty of resources about you know, what how we do it and and what we can offer to our customers in terms of use cases. com and that's why yes the IG and ladies.

Thank you so much for joining us on Tech strong. Hey, stop crypto jacking in its tracks. It's not joke.

It's it's crime and and don't be a victim. We're gonna take a break here on Tech strong. We'll be right back.