BTS #40 - Backdoors in Backdoors - Matt Johansen

In this episode, Paul Asadoorian and Matt Johansen discuss the recent targeted attacks by Chinese threat actors, particularly focusing on the Volt Typhoon group. They explore the implications of back doors in cybersecurity, the role of ISPs, and the ongoing tension between privacy and security. The conversation delves into historical contexts, the evolution of threat actor tactics, and the shared responsibility model in cybersecurity. They also highlight the challenges of supply chain security and the visibility issues that make network devices vulnerable to attacks. In this conversation, Paul and Matt discuss the evolution of software security, focusing on the shift from traditional vulnerabilities to emerging threats in network devices. They emphasize the importance of observability and aligning incentives for better security practices. The discussion also highlights the need for innovation in infrastructure security, including the use of modern web frameworks and memory-safe languages to enhance security measures.

Chinese threat actors are increasingly targeting ISPs.
Back doors in cybersecurity create significant vulnerabilities.
Privacy and security often conflict in the digital landscape.
ISPs must be proactive in addressing cybersecurity threats.
Historical attacks on ISPs provide context for current threats.
Threat actors are evolving their tactics to exploit weaknesses.
The shared responsibility model is crucial for cybersecurity.
Supply chain security is a major concern for ISPs.
Visibility into network devices is critically low.
Nation-level attacks are becoming more common and sophisticated. We’re getting better at shipping more secure software.
Attackers are now targeting edge devices due to vulnerabilities.
Better visibility into devices is crucial for security.
Incentives for security need to be aligned with risks.
Observability is key to improving threat detection.
Guard rails can help prevent misconfigurations in security.
Security practices are often behind technological advancements.
Modern web frameworks enhance security by design.
Using memory-safe languages can reduce vulnerabilities.
Long undetected hacks highlight the need for better security measures.