Hello, you're listening to the show where we bring you the latest in cybersecurity news, research, and leaders. My name is Mackenzie Jackson and this is The Secure Disclosure. We're starting off the show in a segment with Jacques Louw, the chief product officer and co-founder of Push Security. We're going to discuss their latest white paper research project about the evolution of phishing attacks. We're going to talk about what on earth is trending in the world of phishing and why this is still such a problem for us in 2025. Next, we're going to go into a news deep dive. We're going to look at the WhatsApp iOS zero-click vulnerability which allowed spyware and malware to be installed on users' mobile devices without them ever having to click or do anything. And finally, we're going to head down to the Cyber Sake Bar with the world's number one competitive hacker, Philippe Dourassov. We're going to discuss what it's like to compete on the world stage in competitions like World Skills and Defcon. And we're going to talk about why this led him to develop his own startup. It's a fascinating segment, so you're going to want to stick around to the end. Before we get into our first segment, please do me a quick favor. Please like this video or podcast and subscribe to the channel. Every subscriber makes an adversary cry. That is a fact. So, make sure you go ahead and do that. All right, enough about that. Let's move on to the first segment.
Mackenzie Jackson: Phishing attacks still seem to be one of the biggest chinks in the cybersecurity armor. We don't seem to be getting on top of this, even though it's been around since the start of cyber attacks. This is partly because it relies on the weakest link of cybersecurity: humans. But it's also partly because attackers continuously update their methods. Phishing is becoming more and more sophisticated along with everything else. Push Security brought out a research white paper called "The Evolution of Phishing Attacks." It looks at where we are right now in phishing and why it is still such a big problem along with the biggest technical trends that we're seeing out there in the wild. To discuss this white paper, we're bringing on to the show Jacques Louw, who's one of the co-founders and chief product officer at Push Security to discuss the latest trends. It's an awesome segment and I really enjoyed the conversation. Jacques, welcome to the show. It's amazing to have you here and I really appreciate you taking the time out to join me.
Jacques Louw: Yeah, great getting a chance to chat about this, obviously a topic I care about a lot. So, yeah, love talking about it.
Mackenzie Jackson: Yeah. Well, you've got a bit of media coverage recently because of a white paper that you published out there. I read it. It's kind of a great snapshot of where we've come from and where we're going when it comes to phishing campaigns, which is still just such a predominant threat. I guess phishing still remains one of the biggest attack paths that we face even now so many years on.
Jacques Louw: Yeah. No, it's actually really surprising. I mean, we started doing this, I don't know, 15 years ago as junior pen testers and we thought, oh, great, phishing is going to be this short-term thing. It's a technique we use now, but surely we're going to get across this and it's going to be something that goes away like all other attacks. Yet, weirdly, here we are in 2025 and it is, it is yeah, it's a richer scene of attacks as any other. So, yeah. No, it's surprising.
Mackenzie Jackson: It is very much surprising because it still seems to be how most adversaries are kind of getting in. I want to start off then and kind of dig into some of the information that you have in this report. From your perspective and from the research you did in this, what's the kind of biggest misconception that people are facing around phishing campaigns now in 2025?
Jacques Louw: Yeah, I think there's a couple there. I think the first one maybe is just when I speak to my ex-colleagues, incident responders know this already, but the guys on the red team side are often thinking about this very much still in the same kind of, you know, you spin up a website, it's a static HTML site that asks you for a username and password, and that's kind of the game. But it's moved on so much beyond that. Predominantly the tools we're seeing now are all sort of like they much closer resemble a reverse proxy than an actual static website. You know, they're all attacker-in-the-middle tools. So, they're basically just man-in-the-middle you between you and the actual thing they're trying to steal credits from. So, that's been a big change. I think the second thing that's changed wildly is the amount of, yeah, maybe not the amount, the massively small amount of time that the really good phishing pages are staying up. So, it used to be the kind of thing that you could think about like classifying a domain and getting any value from that. But now, I mean, the attacks we're seeing, we're detecting them and within, if we're, sometimes we're hitting these things like 15 minutes later and they've already gone down. So these attacks are coming up, getting used, and as soon as someone uses them, they get pulled down. And the way they're doing this is by actually they're not buying domains anymore. It's quite expensive to spend even, you know, like $15 a domain or whatever, and they're just buying subdomains of really common domains. So like we're seeing something like sa.com, it.com, es.com. So there's a lot of these domains that are getting used incredibly frequently and it's because you can buy and use them once for very, very cheaply. They're using wildcard subdomains for on the certificate. So it's very easy to keep flexing this infrastructure very, very quickly, like just 10 minutes at a time. You know, they're making links that are targeted at one specific user. So every person in the campaign gets their own URL. You know that's not something we've seen before. And I think maybe the third misconception is that it's only coming through email. I think that's kind of where our brains were at. But that certainly isn't the case these days anymore.
Mackenzie Jackson: Yeah, I'm glad you mentioned that because that was something in the report that I wanted to touch on is that when I think about phishing, when people talk to me about phishing, my brain just goes to email immediately. But as the report mentioned, that's not necessarily the only go-to. What other formats other than email are being used in phishing campaigns today?
Jacques Louw: Yeah, it's very interesting because I think we were kind of expecting that all the phishing we were detecting came through email as well and a while back we launched a feature where we were actually properly tracing through the origin and what is the original tab where the user started clicking to open sub-tabs, etc., and eventually get to the phishing page, and we realized like actually it's probably closer to half when you're looking at the browser, we're looking at the attacks that make it into the browser. So typically we're looking at the more sophisticated attacks that make it through your email security and all the rest of the things. So that number is skewed. But having said that, you know, we're seeing stuff coming from the popular messaging apps, Slack, Teams, WhatsApp, Web, LinkedIn Messenger, all these kinds of things. That's kind of expected and maybe like a narrow evolution on just sending emails is just, you know, sending emails to whatever the new email thing is. But the more interesting thing actually for us has been looking at the attacks that are happening through malvertising. So people are buying up Google ads and then just presenting the Google ad for the thing they're trying to fish. This is, it's doubly interesting because what we've realized is like why does this work? And it turns out a lot of people actually don't remember the URL or don't bookmark the app. They just Google the app name and then click the first link and then hope to get to the login page through that. So, yeah, that behavior is obviously driving a lot of this attacker ability and it's interesting to see the kinds of things they're targeting. So you think about like malvertising is traditionally impossible to target this thing, but then you look at like how geographically distinct these attacks are happening and, oh, but yes, of course, like Google advertising does actually allow you to do pretty micro-targeting. So, I don't know, if you wanted to target Boeing, you could probably target, I don't know, Arlington, wherever their headquarters are. You could probably target the aerospace industry. You could probably target a system administrator. You couldn't target the exact employees of that one company you're targeting, but you could probably get pretty, pretty damn close. And you're not coming out of marketing budget. This is attacker budget. So, I'll just bid more than anyone else for this ad. I don't care as an attacker. So yeah, I'm sure that's what's driving some of this as well.
Mackenzie Jackson: Should these advertisers be doing more? Are they doing something? Is it just economies of scale? What's, why is this happening on the advertising phishing side?
Jacques Louw: I guess probably for the same reason that just generally detecting these things automatically is incredibly difficult. I mean, there's no real way for, I mean, these things are like these ad exchanges where people are bidding to place ads at micro-second scales, how are you going to vet the links that go into these ads at that scale? It's basically an impossible task for them and then on the flip side, even if you were going to do that, okay, you can host legitimate things on microsoft.com. So looking for the fact that I am marketing something or advertising something that has a microsoft.com legit link like even that is going to be impossible. So, yeah, I'd love them to do more. I'd love for advertising to go away completely, but, yeah, in the modern world there isn't really something practical there. I mean, I just can't even imagine how you would go about it.
Mackenzie Jackson: Moving on to another scary factor for me is one of the things that I really thought would change the game was multi-factor authentication and when that became really normalized. Just to give you an example of something that's happened recently, there's a package manager called npm for JavaScript. npm enforces you to have multi-factor authentication if you're a popular maintainer. Yet all these popular maintainers were getting fished and their accounts accessed even though they had multi-factor authentication. How is this possible that people are bypassing MFA via these kind of phishing campaigns?
Jacques Louw: Here is the, here's the fundamental takeaway from this thing is like the, the, the weird insight here is that modern identity technology is additive. We keep adding new things and better things, but all the old things still stay. So that means like over time, it's not like we're moving towards a more secure infrastructure. We're just adding a more complex infrastructure. So it used to be username and password and then we were like, okay, cool. We want to do some single sign-on. Let's add SAML. Okay, we want to do OIDC as well. Let's add that. Okay, we want MFA. Do we want push MFA, token MFA, SMS MFA, email MFA, whatever that thing is, let's add it. Biometrics, let's go. Passkeys, let's go. Everything just adds on top of each other and eventually what you end up with is just this incredibly complicated stack that doesn't work like the simple network diagram picture you're expecting. You have these things that are integrating not one with the other, but they're using weird third party to like, yeah. So the ultimate cause of this, I think really is just the massive complexity for making all these things interact. The specific things are, you know, like the consequence of this is that you see attacks like MFA downgrade. You created this account 10 years ago, five years ago, back then you were like first on the bus. I'm going to do MFA. Which MFA methods do you have? SMS. Great. I'll do that. Was it perfect? No. Was it better than nothing? Absolutely. Today, same account. We now support passkeys. Fantastic. I'm going to add a passkey. Both those or MFA methods still exist in that account. When you get fished for this thing, the attacker is in the middle of that conversation and the app says provide your passkey. The man in the middle here, the attacker in the middle, says, "Actually, I don't want to use my passkey. Show me what alternative MFA methods I have." The provider sends that response and that's the response that gets shown to the user. So, the user doesn't even select the passkey or the SMS MFA, they just get automatically passed through to the SMS MFA and go, ah, why is this thing, yeah, that's weird. I thought I had a passkey, but cool, here's the SMS code. And so like, you know, for push authenticators for whatever it is like very, very few MFA methods, it's really only WebAuthn that is properly like domain-bound fishing resistant and, you know, the amount of accounts that we see in our product that are like there is MFA on this account and there's only one MFA method and that MFA method is strong, yeah, it's not a huge, it's not a huge. But I think even if you get through the, even if there is good MFA, you're seeing guys like Scattered Spider and these kinds of groups targeting people and say like, "Okay, cool. I got the username and password. How do I just get the MFA reset?" And like to get a help center to reset your MFA, much easier than having to say like reset my password and the MFA and everything all in one go. So like, yeah, it's complicated.
Mackenzie Jackson: One thing that you mentioned earlier on that I kind of want to double tap on is you're talking about, you know, using the Microsoft domain there for the phishing, you're hosting pages inside that. How much of an impact does this play in phishing attacks? We see it, our audience will probably be very familiar with this happening on GitHub where you can host a page on GitHub with the GitHub URL that could be potentially a man-in-the-middle account. You see it with Google drives in places. I've even seen Google calendar phishing link areas like that. What, what does this play, this ability to create pages and trusted sites? How does that play into modern phishing campaigns?
Jacques Louw: I think maybe it's good to separate these into two things. So, one of these techniques might be called something like domain camouflage. So I think when you're going to be delivering these links through a vector like email, especially where you're expecting something to, you know, inspect all these links, you want to use like a legitimate service to basically do, you know, process that link for you. So even if you're hosting that domain or the phishing page on a malicious website, it couldn't look any worse. But you can still bounce through something that is very legitimate looking. And so like the typical things we see there are, DocuSign, JotForm, Figma, SharePoint, like anything that will host something that looks like a PDF for you. So you click a legitimate DocuSign email. It takes you to the real DocuSign website. It opens up a form and it says that the document you're supposed to sign contains only one thing and it's a link that says, "Click here to open this, to unlock this document or preview this document or whatever." So they're abusing the flows within those apps or, yeah, there's a thousand of these examples and they're all customized for which app you use to actually deliver that link for you. Now from an email perspective, what are you supposed to classify DocuSign as a malicious website or something suspicious? Of course not. So once you're in that DocuSign website, you click another link and that secondary link is basically camouflaging the first link that's delivered through email. And then you have the second part is where do you go after that? Where is this, where's this phishing page actually hosted? And I think what we're seeing is that the majority of these things are hosted on domains that are very quick and easy to rotate. So there's actually not that much hosting of the final phishing page or the, yeah, phishing app on something like GitHub or Google. You know, like of course there, you know, you can host whatever arbitrary webpage you like on like scripts.google.com, google.com, but I don't think a lot of people go through the effort of doing that because they want that domain rotation and that path rotation to happen really, really quickly and for this to be like take down resistance, etc., etc. So, yeah, I think that's maybe why we're not seeing it so much. And I think at the point where you're past that like traditional detection point, you're outside email. Well, then all bets are on. There's basically no detection. So then at that point, like why not host it wherever is easiest?
Mackenzie Jackson: That makes total sense. So, we've just mentioned a whole bunch of scary things. I'm kind of freaked out. What about defense? Okay, what is modern phishing defense look like if it's not blocking DocuSign? Clearly we're not making so much progress on this broadly. How can companies that want to do more than just the standard, what can they do?
Jacques Louw: If you're relying on detection in the kind of legacy way of just saying like whatever comes through email, be sure that that's not going to be enough anymore. I would say like looking at things that happen on the network is useful but it has limited use because there's a lot of code obfuscation and dynamic content generation and things that are happening basically to evade those network detections. I mean, that's why we think basically that the way to resolve this is to do the detection at the same place that your user actually gets attacked in the browser. But having said that, I mean, of course I know not everyone is going to be able to acquire new technology or, you know, chase something like this immediately. And I think if, you know, if you're maybe a smaller company and you have an ability to lock down your environment and you can deal with things like, you know, enforcing a much more hardened identity policy, like and you don't maybe have so many apps that are outside your core SSO and you're like, you know, a smallish company you could deal with that, then I think making sure that you have just like very good identity hygiene. So making sure that you have passkeys everywhere that's possible. Making sure you have as much behind SSO as possible generally. I mean, it is a very tough problem to approach without having like visibility at the same level where the user getting attacked has visibility.
Mackenzie Jackson: We can't have a podcast today without talking about AI. I'm sorry, but we have to, we have to bring it up or no one will subscribe. So, how, how is kind of AI affecting Gen 3 phishing and in the future? And what is it kind of bringing us to the next evolution? And if not, or if so, like what is that next evolution of phishing?
Jacques Louw: It's very hard to say what's going to happen, but I can tell you like the initial signs that we're seeing of AI use already and it's not in the place that we thought. It's like, it's in a very weird place. But okay, so like take as an example that attack I was telling you about which the attackers were using malvertising and so they're pushing like a Microsoft domain which redirects you to some custom domain. So in the blog post you'll see I think that attack went to something like bluegraintours.com, just like a really random domain and it doesn't look immediately like phishing. And so when you see this in a log or when you see this in like domain categorization, when you click on the link from the malvertising, you know, from the Google results, all the way through, there's a paste hosted on that domain which is just straight Microsoft phishing, like no questions, this is just 365 phishing. But when you visit that domain like just clean without any path, you know, you just visit the base domain, the homepage on that domain, what you get is like a seemingly pretty realistic travel website. It looks like a tour operator in Canada and it's got all the human faces there. All the contact details are there. So initially we're like, ah, this must be like some kind of WordPress site that got compromised or something and they've uploaded this thing. But what actually happens is we're like after looking at the code and just looking at like none of the links go anywhere. None of those humans exist. The addresses don't exist. The whole, the whole website, the whole front of that thing appears to have been vibe coded start to finish. We're actually starting to see this domain more and more. So like almost every detection domain we see is like now backed by a legitimate looking webpage. Our best guess for why this is happening is that there is something out there doing domain crawling and domain inspection and categorization. So, you know, you see something suspicious happening. Some kind of crawler visits that site and says like, okay, cool. No, this is a travel website. This is a tour operator website or, you know, this is a manufacturing website or this is a, you know, whatever the case is, a real estate development website, like almost every category. So it seems like someone has a, you know, someone is building an AI that just says like, "Write me a, create me a company website for XYZ" and it's just dynamically doing that almost every time you access a domain. So every time a domain gets spun up, something legitimate looking gets spun up, but none of this has anything to do with the attack. Like the attack works. Nothing is stopping those attacks. Like in broad strokes, most of the legacy stuff isn't touching the actual core attack code. So no need to use AI there yet, I guess.
Mackenzie Jackson: You just kind of made me terrified of something dynamically creating sites and we're kind of there now. I'm just trying to think about like, you know, it takes like two minutes to spin up a complete site with a lovely, or something like that, then yeah, I can totally see how this is all just this, the speed of this, even the creation of the site is so rapid. Well, there's going to be a link down in the description wherever you're listening to this of the white paper that we've kind of been talking about today. It's called "The Evolution of Phishing Attacks" by Push Security. And Jacques is in fact the author, one of the authors of that. So if you're interested to learn more, there will be a link for that wherever you're watching or listening to this. Jacques, it's been a really fascinating conversation. I'm slightly terrified, but I do have hope now that you've described. But I do want to thank you for spending the time with us and going through this. So we really appreciate it.
Jacques Louw: Great chatting. Thanks for having me.
Mackenzie Jackson: And now for our deep dive into our new segment of the week. Imagine if your phone could be completely compromised just from you receiving a message. You didn't click anything. You didn't do anything. You just got a message. Well, this is the exact scenario that has been observed in the wild. It pairs together two vulnerabilities: one from WhatsApp and the other from Apple iOS. Together, attackers were able to completely take over some victim's phone and install spyware onto them. This all originates with a vulnerability from WhatsApp, which was patched in August 2025. The vulnerability CVE-2025-5177 was noted as incomplete authorization of a linked device synchronization message. Now, I know that's a bit of a mouthful right there, but essentially what this meant is that attackers were able to use this to arbitrarily execute URLs that they send to a user without any interaction from the user themselves. That in itself was bad enough, but this was then paired with a vulnerability from Apple. To make matters worse, it all starts with the WhatsApp vulnerability. And what does it actually mean when we say incomplete authorization of a linked device synchronization message? Well, with WhatsApp, you have a primary device, in this case nearly always your mobile phone, and then you have secondary devices. Maybe that's WhatsApp on the web or a desktop application. It allows you to sync the two together. And to create a seamless experience, it does this through synchronization messages where it sends over all of the messages plus the metadata and images and downloads and things like that between the devices. What the attackers figured out is that WhatsApp didn't actually check the origin source of the synchronization message. This meant that if an attacker was able to craft a synchronization message that was in fact correct according to WhatsApp, then WhatsApp wouldn't check where it came from and instead would just execute it, syncing together all of the users' datas from their primary device to their secondary devices, but malicious content had been slipped in there as well. Because this was coming from what WhatsApp thought was a trusted source, it then fetched all of that content and processed it, even though inside that was malicious instructions from the attacker. So a legitimate synchronization message may look like this where you have some media and then a URL containing that media there. WhatsApp will then process that, fetch that image, and display it on the linked device. But what if we replaced that media with something evil? In this case we have the same type of content, in this case media content, but we're going to evil.com. It's going to fetch that, process that image, and run it. That's how we're able to get WhatsApp to execute malicious commands without the user actually doing anything because it's all part of a synchronization process. Now, this is of course bad, but it actually gets a whole lot worse because they chained this together with a very complicated vulnerability from Apple. The vulnerability, noted as CVE-2025-43300, is what they call an out-of-bounds wire memory vulnerability. This vulnerability occurred when the Image I/O framework, which is part of Apple's iOS operating system, received a malicious image or payload which would cause memory corruption. This memory corruption allowed the attacker to write outside of the allocated memory slots, which a very, very sophisticated attacker could then turn into arbitrary remote code execution. So when we combine this together, the synchronization message which contains a malicious payload that actually has a malicious image inside of it, which is then run by the framework I/O, which causes memory corruption and allows the attacker to do remote code execution on the phone with zero clicks whatsoever. I can barely follow along with this myself. This is clearly the sign of a very sophisticated attack group. In my opinion, which I don't know for sure, I would say that this is the work of a state-sponsored APT. It has all the hallmarks of that kind of sophistication. Moreover than that, only 200 people were affected, or at least WhatsApp sent messages to 200 people to let them know that they had been potentially affected. I don't know, but I would assume that these 200 people aren't 200 random people. Not with this level of sophistication. Now, I would never encourage anyone to do anything malicious or illegal, but gosh darn it, you have to admit that was pretty impressive.
Mackenzie Jackson: And now it's time to quickly mention the sponsor of this show, Aikido Security. Aikido Security is your complete code-to-cloud security solution. Aikido secures everything from the first lines of code that you write all the way to your cloud environments. Aikido's superpower is noise reduction. Getting rid of those pesky false positives. I would love to tell you about all of its amazing features like its reachability analysis on dependencies, breaking changes, AI autofixes for your code, containers and cloud and even AI powered human written code quality checks, but I just don't have time and I want to get back to the show. But thank you Aikido for sponsoring this podcast and make sure you check them out at aikido.dev and sign up for free and check it out today. All right, let's move on to our last segment. We're going to head down to the Cyber Sake Bar with a key leader in security to discuss some trends. We have a great guest today. We call this segment Unfiltered Sake.
Mackenzie Jackson: I'm thrilled to be here with Philippe Dourassov. How are you going, Philippe?
Philippe Dourassov: Doing great, thanks.
Mackenzie Jackson: Today we're going to be kind of diving into a world that I don't know a whole lot about, which is competitive hacking, which is a thing. And you are currently ranked number one in the world. So, it's pretty impressive. But before we get into that, we're going to try some sake today. So, we have two sakes to try and we're going to mix it up a little bit. The first one here, we have a traditional Japanese sake. This one is from Okayama in Japan. And then we have a Californian sake. So, we're going to, we're going to, we're going to see which one is your favorite. I'm not going to tell you which is which. We're just going to get into it now. Cheers.
Philippe Dourassov: Cheers.
Mackenzie Jackson: You don't need to shot this. Some guests do find that confusing. So, all right. What do you think?
Philippe Dourassov: Pretty nice. I like, it's a nutty one. Okay.
Mackenzie Jackson: We'll do at the end. We'll do the reveal of which one you liked best and which one was the Japanese and which one was California? Sounds good. I want to start at the beginning though. So, obviously you're a very established pen tester, hacker, ethical hacker at the moment. Where did this all start? Where did the curiosity for this get started with you?
Philippe Dourassov: Yeah. So I, I think I, I wanted to become a hacker for a while and at some point I saw that there was this, oh yeah, 10 hours full guides how to become a hacker on YouTube and me being like 15 years old and impressionable, I saw, I thought, okay, this is perfect, this is what I need. And after 20, 30 minutes, I just couldn't anymore. It was, it was too boring, right? It's, it's actually then there that I realized that theory is absolutely not working for me and I need to have hands-on stuff to appreciate something and have fun there. And then I discovered John Hammond which made a video on TryHackMe, which and then I tried the platform from there. I saw that web exploitation was pretty fun, like all of these websites are actually hackable, right? Played around a bit. I started doing competitive competitions as well. So like CTF, Capture The Flags, and did a bit of bug bounty as well and I saw that, hey, actually what you learn there, it's actually quite realistic. People don't know how to create secure websites and even in like 2020 when I started, it was already terrible, like it's impressive how many of those issues you think that are really unrealistic and obvious to fix and turns out people don't know or don't care, right? So like I just, I was thought like, okay, wow. This is insane. This is crazy. And from there, I, I started doing these competitions, right? So just getting better and better. I think the fact that you can see yourself progress every time you do a new competition every weekend, you see yourself becoming better and better, solving more and more challenges, scoring higher in the scoreboard, right? And even when you're not able to solve a challenge, when you have this, this very hard problem that you don't know how to tackle, well, you always get a learning out of it because at the end of the competition, people share about their solution. There's a lot of community around the CTF that is very beginner friendly and really helpful when you want to get started and discover stuff, right?
Mackenzie Jackson: I find that kind of in general with security. It's a very daunting thing to start with these, but I do find it, it's like a very welcoming, welcoming place. What is kind of like a good starting point for people then? If you were you going back, because I think one of the things that's daunting about starting this process is that there's thousands of different vulnerabilities. You could become an expert in any of them. And I think that that's how a lot of people get some of these more advanced bugs because they become true experts in cross-site scripting, SQL injection, those things. Where do you start? What's a good vulnerability to kind of start with?
Philippe Dourassov: I would say that most importantly, even before going into like specifics. One thing that is important is figuring out what's the best way of learning for you, what works best for you. For me, it was just practical. I was breaking stuff until I'm and failing until I do it again and fail enough time that it works, right? For others, it might be theory. There's plenty of books that could work for others. There's plenty of YouTube videos as well, guides of awesome YouTubers that share their knowledge with people, right? I do think that it's hard to directly go into practice, have a website, and okay, now I'm going to hack it and you don't know where to start, right? So maybe I would say that starting with either beginner CTFs that learn you the basics about web exploitation, for example, or maybe videos that explain the different concepts of web hacking. Right? I think those are good resources to get started. If you want theory, you have plenty of interesting YouTube videos. If you want practice, you have plenty of people that created labs, created challenges to practice those exploit techniques. So there's, there's things like TryHackMe, which are great because they create kind of purposely vulnerable applications. But what, like, what was the moment that you had where you found something like in the wild and you were like, oh my god, this isn't just like a game anymore. This is real life.
Philippe Dourassov: Maybe there was this one time where I kind of accidentally hacked Discord.
Mackenzie Jackson: That could be a, that could be a cool story. Okay.
Philippe Dourassov: I was using Discord a lot before to communicate with other people through either, well, for either these competitions I was doing or just playing with my friends, right? And I started looking at how Discord works which is perfect because Discord also has a bug bounty program. So I am actually allowed to do active hacking there, right? And try to exploit it. And very quickly I realized that it's not as safe as I thought. Like even the big popular applications there have many issues and I can't go into the details of what happens there but I did find a super interesting issue that could have allowed me to get any files that were uploaded on Discord, right? Which is quite crazy and I was only a beginner at that point, right? This was crazy, this was insane. And from there, I, I realized that, okay, now the more I get better, the more crazy stuff I'm able to do it. It actually worked, right? I got better and better and now I'm able to find vulnerabilities in huge applications and get the job out of it and do bug bounty and start startups as well, right? And create automations for, well, security, right?
Mackenzie Jackson: Yeah, that's really cool. And as a bit of a spoiler, we are, you, you have gone into startup world. We'll talk about that, we'll talk about that at the end, kind of what you're working on there, which is really cool. I want to kind of dive into competitive hacking because this is going to be something that most people aren't really familiar with at all because, you know, especially if you're not familiar with like the white hat hacking kind of area. So, you have these Capture the Flags event, but there's, there's one in particular, World Skills, which is kind of like the Olympics for a lot of things in technology, I guess you could say. What, what's the process like of entering these large international competitions? How do you get selected to do that? Can anyone just appear? And kind of what's the process like at, at such a kind of global level?
Philippe Dourassov: The first step here is that you have to be selected by your own country. In this competition, every country was able to send two people at this competition, right? For Switzerland, which is the country where I'm from, the process was that you had to compete into Swiss Skills first and get good results there. So the first step is to get two gold medals because it's every two years the World Skills and Swiss Skills is every year. So you had to get good results. Maybe not gold medal, but I did second place then first place. That was enough. And then you get selected by your country to get to the World Skills. And from there you have to try hard. You have to intensively train a lot. You have to basically sacrifice eight months of your life of just getting better and better to be able to have a chance at it, right? And that's what we did. It was not easy. Honestly, I mean, at that point, I was studying at the university. At the same time, EPFL, I had to manage the 40 hours of studying plus the 30 hours weekly of training for the competition for multiple months. Good thing I had my teammate with me to kind of support each other in the mall. He was also able to do the tasks that I didn't like and he did like which was perfect because we're quite complimentary there. And after this training, you get invited, well, you go to the competition itself, right? 2024 was in France, I think next year is going to be in Shanghai. But yeah, France was, it was pretty convenient. Switzerland super close to France. There's no jet lag or whatever. Quite happy about it, not going to lie. And yeah, you get there, you have four days of competitions.
Mackenzie Jackson: And once you're in the competition, what did you have to do? What did you have to hack? What do they, what do they give in front of you to, to actually kind of test everyone?
Philippe Dourassov: So it wasn't only offensive actually, it was quite large. So there was some defensive part where you had to do forensics. For example, you had this malware, you had to decompile and understand how it works, right? You have this log traffic where you have to analyze where is the data exfiltrated, how are they doing this, what encryption are they using, right? And each day you have a different team basically, right? The first day was, I think, for six, you had to do this analysis. It was eight hours, I think. And then the second day was more offensive. So this is closer to what you would have during penetration testing. You have applications, you need to be, you have to get in there and have a root shell, right? And this goes through classic web exploitation techniques, privilege escalation techniques as well. Goes to pivoting into the internal network, finding the other hidden websites and go further and further into the network and super interesting stuff, but extremely complex because we only had eight hours and this was like one, two weeks long kind of assessments if it was a normal situation, right? And every team is doing their best as well, like there was huge, there were huge countries there with much more budget and people in there as well, right? I mean, Switzerland is what, 8 million, 9 million people living there. China is like more than a billion, maybe two billion, I don't know. And we had to compete against the two best hackers from the two billion people there, right? It was so intimidating. It was really hard to see them go up the scoreboard, then we go back up, then like it was just super close all the time, right? And then at the second day, we finished it and then my teammates who worked with me started to feel sick. He actually, he actually had a fever at this point and it was the worst time because we're doing some, well, and like he gets a fever, like just loses all of his energy, but we cannot stop there, right? Like we're, we're like, we can do it. We, we're pretty close to just win this whole competition that we trained for eight months, right? Somehow he manages to like still carry on the load and go, go all the way there. It was impressive. And then the third day was quite easier, which it was very fortunate because at this point we were exhausted and yeah, the third day, I think it was just the classic SOC stuff. You had to look at traffic, find the malwares and cities and yeah, I think most teams got all of the points there. So we are quite relieved to not have to go another day of just, I think we would have died if we had to go the same intensity as the other days. So then like after these four days, we get this like one few days of suspense where we don't know what score we had and the ceremony is going to announce whether we had the medal or not. And then we go to the ceremony and then we see that hey, Switzerland, Iran and Taiwan is in the top three, but we don't know who is where yet. And then there's like this anticipation where they announce the country third place, I think it was yeah, third place was Taiwan and then second place it was either Iran and us and then we hear Iran. And that means we had the first place, right? And that is why we're so happy. And yeah, this is basically the story of how my teammate and I got the first place worldwide and got the cybersecurity world champion title.
Mackenzie Jackson: That's, it's a pretty awesome, awesome story, not straightforward a huge amount. How does something like that compare to, because there's, there's other competitions other than this. There's also big competitions like Defcon, which you've competed in, lots of other things. How does something like, let's say, Defcon, which is probably the one of the most well-known Capture The Flag competitions, how does that compare to something like, World Skills?
Philippe Dourassov: So, Defcon is indeed pretty popular. I think when people think about CTF, that's the name that most often comes. It's like at the biggest conference. It's been running for 30 years or something. And yeah, it has a lot of heritage. Let's say it was one of the first, one of the biggest competition and hackers of all around the world wanted to be part of it as like an accomplishment, right? And nowadays it's still running and there's eight teams each time going to the finals or 16 teams, well, 12 teams, oh, I, I lost count already. And there, there are all of these teams that are coming to the finals in Vegas every year and it is an intense experience. It's quite different because you're not two people, you're a 100 people team there, right? So your contribution is much harder to see. But at the same time, if you are with the right team, with the right people, the hardest problems with the best people around you, and just work together to solve the most interesting and complex problems you could see in competitions, right? I think it's, it's awesome to see that this tradition is only getting like better and better. It's not dying with time. It's just growing, right? And it's an awesome achievement if you're able to go there.
Mackenzie Jackson: Well, I want to switch up gears a little bit and change the subject. But first, we're going to refresh our sake. We're going to try a different sake now. Cheers. This one is, this one is quite different. I think it's more acid.
Philippe Dourassov: Yeah, it's definitely the other one's definitely smoother.
Mackenzie Jackson: So, I've been learning a little bit about sake and the smoothness and nuttiness of it comes from two things. The brewing technique, but also the water. So, Japan has like all these natural springs within it. So, you can start to, I can't really, but some people can taste the region of it based on that. So, I think this, this one probably has a more, kind, probably water with kind of more dissolved solids in it, more minerals in a sec. Okay. So, you've been in the world of competitive hacking. You've achieved the highest kind of moments of this world, being in Defcon, winning the, the, the World Skills championship. You're now gone into another very competitive, very crazy world of startups. What made you want to do that?
Philippe Dourassov: All of these competitions I was doing, I realized that the logical next step is just to solve security or at least try to solve security. All of those competitions, all of these learning resources originally they come from the fact that we've been trying to make unhackable possible, right? Being able to find all of the security issues in the code before hackers, attackers are able to find them. Being able to just put all of the mitigations and protections to make sure that we're not getting hacked. Yet, we are still all vulnerable and unable to find a concrete definitive solution to it. Right? And I wanted to give, to give a shot at it. Right? There was all of these advancements with AI that were absolutely huge and I was at a point where I wanted to try it out just tinkering around it and I quickly saw the potential which was huge. AI was able to find security issues the same way I was doing it but at a much larger scale and at a much higher speed and all that was lacking wasn't the pure raw intelligence. It was already here. It was just like the infrastructure, the architecture around it, something that would orchestrate this intelligence and put it against real problems, real life problems, right? I started building an application that's able to automatically analyze codes, find security issues, and give developers remediations, ways for them to just fix them. But very quickly, I realized that, and now I'm coming back to breaking is easier than building. I'm not a builder. I don't know how to create stuff. I only know how to break stuff. I know how to break stuff well at that point, right? But I'm, I'm still unable to build something properly. And fortunately for me, one of the big advantage of competitive hacking is that you meet a lot of people. And through the Swiss national hacking team, I met Manaf, which later became the co-founder of Hacker, the startup we're building. And he was able to really help me on all of the building sides, being able to build whole interface between the developer and these AI stuff that's finding issues, right? He was able to build whole benchmarks to only make the AI better and improving it at what he's doing. Thanks to his help and the help of other people around us, we were really able to get something great and working well. It was able to even start getting good results at these same hacking competitions. In fact, I think it was able to solve a challenge that only five teams out of 500 were able to solve it. Well, it was able to hack it, right?
Mackenzie Jackson: Your, your AI system was able to hack it. Wow.
Philippe Dourassov: It was absolutely impressive. When I saw this, I, I thought that's okay, we need to make something out of it. We need to give it to the people, to the developers.
Mackenzie Jackson: This kind of leads me to some more questions. Hearing what you said, your startup, Hacker, you're creating AI automated pen. You're basically creating AI versions of you trying to create these, these models that can then hack things. It's interesting. You're talking about, you know, you're building something that can break something, which is kind of interesting. I quite like that you then believe that with the help of AI we can solve security. Is that what I'm hearing?
Philippe Dourassov: I don't know if we're able to solve it but we're able to do a very big step forward to having unhackable applications, that is for sure. Because now if you look at the current standard, which is to, well, call pen testers whenever you need, either for certification, either you need to do twice a year. So every six months as you call them. I mean, I won't say it's bad like it is good that you do this, right? But the issue is that what happens when you are pushing codes the day after the pen test? Well, it's not getting reviewed for another five months, three weeks and six days. What happens if I don't know, you, you, you want to have a pen test for a feature you review, you just published now. You want to have a pen test directly right now but you have to actually wait two weeks for them to start and then another two weeks for them to well do the pen test and create a report. It's not, not everyone are have these passions and this just becomes frustrating because security is becoming an obstacle instead of something that empowers you to really, well, push your code to production and have the best application for a good user, right? And having this obstacle, this frustration is really not what we should aim for. Security should really be something that developers are able to have in their application by default without going through like painful processes and being able to automate it with AI. Well, people don't need to book a pen test having two weeks and having discussions and meetings. They can just put their link, maybe their codebase if they want, and then they get a whole report with all of the issues and maybe we can even integrate a way for them to automatically fix those, right? We can propose batches and then it just becomes a matter of minutes and in a few minutes they're able to protect all of the users they have on their application without having to, well, spend three weeks just having to go all of the traditional process, right?
Mackenzie Jackson: We're, we're kind of, we need to start wrapping up soon, but I do want to ask you something, but kind of before we, we get into the last segment is, do you, we've talked about a lot about defense, right? These, these, these AI models that can hack for the purpose of pen testing. What about on the other side? Let's say that you're not such a nice guy. Let's say that you're working for an APT group or something and you're also developing the, the exact same thing. What's the risk that this technology is developed by malicious actors instead of like defensive actors?
Philippe Dourassov: Oh, this is going to happen. It's not if it's going to happen, it's when it's going to happen. And I think the answer is it's already there. It's just that we're at the stage where even the defensive people that have the support of VCs and millions to spend into research, even for them it's, it's, it's still a research for them. They still have to create this technology, right? And we're getting there. We are able to, as I said, get better than most of the competitive hackers on web exploitation itself. But it's not a solved problem yet, right? And I think that it's still very new technology. I think it started becoming realistic only a year ago. So we are only at the beginning here. But I do think that as we are getting closer to a product that's actually usable in production and we're getting there already. Nowadays they just use open source models and no one can stop them. Not even OpenAI or Anthropic. I mean if an open source model can be used by them they will be using it for automating hacking, right? And now the issue is that instead of targeting just a few websites, they can target whole countries and be able to attack all of the websites of a country to, well, attack the economy directly. Right. This is very scary stuff.
Mackenzie Jackson: Yeah. Okay. Thanks for that cheerful note. All right. So, we're going to move into our last segment now, but we need to refill the sake. This one here. Cheers. Okay, we have a game now. The game is called "Would You Rather?" I'm going to give you two options. You have to pick one.
Mackenzie Jackson: Would you rather reuse the same password for everything or hardcode all of your API keys and secrets inside your Git repository?
Philippe Dourassov: The Git, like inside your source code. It's not publicly exposed. Your Git repository is private. I would probably go with the, the hard-coded API keys and, and, and stuff in the codebase. It's, it's absolutely terrible to have this, but it still requires an entry point to be able to access that, right? And it is a very thin line of defense, but it is one. If there's no TFA and the password is like public and it will become public very quickly. Well, there's nothing I can do, right?
Mackenzie Jackson: Yeah, yeah. Good. Good. Cool. I think I agree with that one. Usually I tend to disagree, but that's mostly because I'm an idiot, but I agree with this one. So, I don't know what that says about you. Okay. Another, another question here. Would you rather deploy every single Friday at 5:00 p.m. and you can only deploy once a week? None of this continuous deployment nonsense that's happening with DevOps, or your application cannot have any firewall behind it. It's completely all ports are public. If you have an issue and everything is on fire like at 6:00 p.m., then you have to wait another week to push this. This is, this is just like, I can't, like, this, this will just like end businesses if this would happen, right? Like firewall can still do mitigations and have like strong rotating passwords for all of your services like production at 5:00 p.m. Friday only. It's just going to break it.
Philippe Dourassov: Okay. Yeah. Very good. Very good. I think I, I think I agree with that one, too.
Mackenzie Jackson: Well, Philippe, thanks so much for joining us. It's been awesome to have you and I hope to have you back sometime.
Philippe Dourassov: Yes, we'd love to.
Mackenzie Jackson: Well, that's all we had for you this week. We're coming at you with another episode next Thursday. It's going to be a great show. I'm very excited. We have some very special guests lined up. So, make sure you subscribe to the channel. Give us a five-star rating if you're listening to this on a podcasting platform. And until next week, stay
