Allegiant’s Dan Creed on Navigating the Risks of Deepfakes in Corporate Security

This is a growing attack surface. It's only going to get worse. And it spurred on these conversations with the board that like, we need to start to put just to protect ourselves from this. If it's not face to face a financial transaction to put safe words or safe codes into transaction limits to prevent this kind of stuff.

Welcome to the Ahead of the Breach podcast where we are dedicated to empowering security experts and practitioners with the knowledge, insights and actionable strategies to lead the future of cybersecurity. Here's your host, Casey Camilleri, CEO and founder of Sprocket Security. Now let's dive into today's episode.

Welcome to the Head of the Breach podcast. I'm Casey Camilleri. We talk everything offensive security with industry experts and leaders in the cybersecurity realm. I'm here with Dan Creed. Dan Creed has 25 years of experience. He's currently a CISO of Allegiant Travel, formally held positions as head of infrastructure security at Facebook and Meta, and has plenty of expertise all throughout his years of everything cybersecurity, operational risk management, and it goes on and on. I probably didn't even do that justice, but thanks for being here, Dan.

Yeah, my pleasure, Kasey. Yeah, we've had a good friendship over the years and had the opportunity to work together a few times.

Yeah, it's been great. So how many years have you been coming to Black Hat and DEFCON?

I've been coming since DEFCON 3, so, I mean, before Black Hat, because DEFCON spawned black ad, so.

Yeah. And do you have any good stories from back then?

Oh, I mean, there's so many fond memories back in the day. I can remember being at Alexis park and getting tips, you know, that there was going to be an FBI in the spot, the Fed game and tossing cell phones out a window to avoid FBI raids. So many memories and fun stories and shenanigans. ATMs taken over. Like walking into a casino and seeing that that is not the normal screen dis by an atm.

Like, oh, I remember in the days, like you just walk through and you see all those ATMs just like either blue screen or at a command prompt, right?

Oh, yeah.

Good times.

And recently we had that with crowdstrike too.

Yeah, right.

Oops.

Now, you were telling me a little bit about deep fake work that you've been doing. And you told me a pretty cool story before we started recording here about how you use deep fakes in the boardroom. Tell me a little bit more about that.

Yeah, so at our last board presentation last month, I Did a demonstration on defects because a couple months ago there was a financial institution in Hong Kong that they did a deep fake of the cfo. So it started with a traditional business email compromise attack. They were skeptical. Guys like, well, jump on a zoom call with me. And so sets up the zoom call with the employee. And sure enough, it looks like the cfo, you know, can see people walking around in the background. It looks like their offices and stuff. And socially engineered $25 million out of the company. And so it's a growing attack surface. Like you can do this with off the shelf hardware these days. And I wanted to show our board how we're thinking about future Attack Surface. And this is a big up and coming risk. So I did a deep fake for the board presentation where I literally did three different levels of deepfake. The first one being where you take their actual image, sync your lip and facial movements to it and move around. Being the first level, you know, that stuff's fairly easy to spot because background doesn't match and there are tells on that. And then the second level to that is I generated a deep fake image based off of a single image downloaded of them off the Internet and overlaid their face on my face and showed them a level two example. And then there's a level three I literally took from our chairman of the board. I think it was like 90 minutes of video from him from all different angles. Dissected it image by image and fed that into an X8, an XEG LLM to do a fully rendered 3D model based on AI deepfake of him mimicking overlaying his entire head on my head.

That's crazy. You did this all just average laptop, average, compute nothing.

Average is relative. But yeah, a computer, you could go in and buy it, you know, Micro Center Best buy today. I mean, RTX 4090 in it, 64 gigs of RAM and 24 cores.

Okay.

It's a beefy laptop. I'm looking at like $5,000 worth of hardware. And I mean, the time that I put into doing it and just using Deep Face Lab, I could teach a teenager how to do that in a couple of hours.

Nice. You should teach me how to do.

And like I said, this is a growing attack surface. It's only going to get worse. And it spurred on these conversations with the board that like, we need to start to put just to protect ourselves from this. If it's not face to face a financial transaction to put safe words or safe codes into transaction limits to prevent this kind of Stuff I was going.

To ask you, how do you think we should combat that? Because I feel like nowadays we're going to have, you know, it's kind of like a PGP signature. Right. An email. Like we're going to need that for like every source interaction that we have with someone. Right. To know that you're talking to someone in who you're actually really speaking with. Right. Is the person like how do you think we're going to tackle that moving forward?

I mean it's tough because there's multiple attack scenarios to it. Now I'm like, that was part of my message walking away from the boards meeting is I attended the first half of it in teams meeting and Microsoft, Zoom, Citrix, it doesn't matter. Like I can do it in any of them and they don't detect it at all. They don't detect anything's a mess. So like the big companies haven't solved for this problem yet. So like I said right now, old school implement some kind of passphrase or something to signify that only they would know that it's them.

Yeah.

You know, that would have to be socially engineered out of them. Outside of that, I think it's evolving space and I'm kind of waiting to see what the industry comes up with to solve for that. But like then you look at use cases like honestly I'm surprised that the government, they probably are especially being in an election year, super fearful of this stuff. But like it start to do this to generals and high ranking officials and you know, we're already seeing more and more deepfake actions going on. Like I said, it's an attack surface. It's just going to continue to grow.

How did the board respond to that?

Actually I think they kind of walked away from it going, thank God he's on our side.

There you go.

I mean I think it was really eye opening to them in seeing how easily one could do this. Like I said, I could teach a teenager how to do it in a couple of hours with off the shelf hardware. You know, and I also made that statement in the board meeting. Now imagine a threat actor who's going to invest, I invest a $5,000 laptop in this. Now imagine somebody who's going to invest $20,000 and three months of time into this what they can do. Because it's a good example, like you know any sci fi fans who watch the Mandalorian when Luke Skywalker, they did the deep fake of young Luke Skywalker in the last episode of the first season of that the open source community. Somebody else actually did a better deepfake of that than ILM did. That ILM then went back and actually hired him.

I did not know that story. That's pretty crazy. Now, you spent a lot of time in boardrooms being a CISO and advising. Do you have any recommendations, any tips for how to conduct yourself in the boardroom, how to present and showcase risk, and how to interact with leadership?

One is be humble about it. Like, your job is not to be the no person. Your job isn't even to accept the risk. It's a business. It's the board's business and leadership's business to determine what their appetite for risk is. You know, always keep in perspective that your job is to identify the risk, to help quantify what that risk is, and then to help weigh in so that they can make an intelligent decision on if the risk is acceptable or not. And be willing to say, like, I don't think this is a good idea. I'm not willing to accept the risk. But if the business wants to accept that risk and feels it's within the appetite of risk of the business, the business is free to sign off on that risk and don't take it personal like, it's business. You have to make money. And if you get bit by that risk, you did your due diligence, you know, you communicated and quantified what the risk was and the business decided to accept it. It's just part of business. You can't do business without risk. If you have a customer, there's a risk. If you have an employee, there's a risk.

When you slide them that paper to say, sign off on this risk, they think twice and ask for another meeting just to make sure they know what they're signing off on.

When they accept risk, I mean, sometimes they ask for another meeting and like, that's, you know, if you look at breaches in the last year, like the largest breaches, mgm, you know, if you look at the stuff that's gone on with Snowflake that led to, in theory, Ticketmaster and stuff, Solar Winds itself was a weak password from an intern. People and relationships are important and, you know, make sure that you have that relationship, that they do think twice and they have enough respect for you and enough trust in your expertise to at least give them pause on, he thinks that this isn't an acceptable risk. Maybe we shouldn't do. But like I said, sometimes they override you and it is an acceptable risk, but you also have to be reasonable about it. I can Think of an incident recently where we needed to put some prod data temporarily in a staged environment to do some testing just during migration. And, you know, the cost of the business of not doing that from the disruption that it would have cost, would have cost the airline because they would have had to take an outage of multiple days that, you know, would have cost the business multiple millions of dollars. Where the risk profile based on the dwell time of, okay, that data is going to exist in there for 24 hours of, you know, okay, that's an acceptable risk. It's normally against policy. Like, if you wanted to do this in the long term, I'd be like, no, like that's not an acceptable risk. Weighing the operational impact of the business versus the short duration and came up with an agreement on what's an acceptable risk profile and went to the board with that where, you know, again, they're confident now, where we've identified the risk, we quantified it and we had the conversation of what's an acceptable amount of time and risk for the business that everybody agreed and signed off on. That's the other big thing with dealing with boards and CISOs is an evolving space. I got asked this question recently by an aspiring younger person who wants to become a ciso, who their current CISO was pushing them in the debate of should I get my MBA or should I get my Ms. Of, you know, oh, you should get your Ms. And like, my stance on that is the exact opposite. Get your mba. Like, if you want to be in the C suite and you don't understand the rest of the business's language, like, you're not going to succeed, you know, I'm as comfortable talking to our CFO about things that impact our capital and operational budget, you know, and how it's going to impact our EBITDA as I am talking with our technical teams about battling botnets or doing code reviews.

So true. I'm glad you mentioned that because I feel like that is something that CISOs tend to forget. Younger CISOs. Right. Is that it is about business, about moving forward in business. And if you can't speak business, you are going to have a little bit harder time in the role.

Well, we had, like, you know, I'll give you a good example. You can translate it to things that make sense to the business. If you understand it then too, we were having a problem with a lot of scraping going on on our website, the automated botnets and stuff that we started to really hammer in because, oh.

Yeah, that was me scraping for you Know, the cheapest price. Right.

You know, my predecessor had thought that this was normal traffic, and it turned out it was. Over 60% of calls for flight searches was fraudulent bot scraping. So as we started to smack them down and get into this pitched battle of, you know, we adjust, they adjust, we adjust until we made it so expensive that they went on to an easier target because they realized they're, hey, they're here to stay now, like, they're going to keep smacking us around. We're just going to go to somebody easier because it's not worth our time anymore. We made it expensive for them. Then after that, I had to sit down and talk to our chief marketing officer about look like our unique number of visitors are, you know, in the airline industry, it's called look to book ratio, which is basically how many people look at flights versus convert to a booking. So it's your customer conversion rate. Like our metrics for that are going to drastically change.

Yeah.

Because we fed all this bogus amount of searches off of our site and like, it impacts us financially as well. And I had to talk to the CFO about that as well because it's going to change our look to book ratios and we have contracts that are based on the number of look to books that we have and reset their expectations. And like even a year later, it still freaks them out a little bit. And I've had to come back a little bit of talks of, hey, our unique number of visitors is down year over year by 20%. Okay. You know, Chief Marketing Officer Scott of like, you know, does that correlate to a 20% drop in bookings? No. Well, bookings are up. Okay, well, we talked about this. That 20% drop in unique visitors is because it was all botnets that weeded off and battled out of the site.

I think a lot of people in just any business can take that away. And marketing in general, like all the bots, all the scrapers, AI now scraping sites, you know, and I just read a story where open source, I think it was, read the docs, for example, just got hit with like a $5,000 a month bill or something ridiculous. Because AI was just scraping the site. So it's kind of like a vanity metric. Right. With marketing, it's like you have all these people coming and hitting, but what's the quality of that? Is that a real person or is it a bot? And I imagine you guys have that problem tenfold compared to everyone else because everyone's trying to scrape for ticket prices and all that. Try to get ahead of the actual pricing. I know.

Sometimes we even have it with our own partners. We're like kayak, like we have an API dedicated for them and they'll hit the API and then they'll hit our public site as well to validate. Oh really? Actually getting the same price that the public. We had to have a conversation with them about that. And like what are acceptable rate limits for this?

Yeah, right.

Like we're not going to allow that on a one to one basis again. We have contracts that are impacted by our look to bookeration.

Yeah. So level of trust now when I actually go to it and I look at the ticket price of my flight and then I come back five days later. Are you guys recording that and changing the ticket price based on how interested I am on returning visits and things like that?

No, we're not basing it on user metrics so much. But there is definitely pricing components that go into that and like it's going to enhance that even further. I mean you're starting to see fast food restaurants do you know, demand based pricing. Yes. It's one of the use cases that's being pitched by every vendor in that space for business intelligent pricing.

Yeah. So I imagine security companies might have demand based pricing too in the future. Right? That'd be crazy.

I mean you already know this too. Being in the offensive space that they operate these as business like still amazes me like how many executives you get in that like have no idea of like you know, threat actors have help desks they're starting to hire. Especially like the ransomware companies. They're starting to hire negotiators, customer service.

Representatives for your ransomware and DDoS operators.

They have layoffs if you're not making your profit margin. They need like it's a legit business. It is. And it's still amazing me how many executives you tell that to.

They're like really probably ran better than some, some legit businesses. You know, they make money. They make a lot of money. Right. And so it's business is business crazy.

It is indeed.

Now what do you guys do for offensive security? Kind of in a proactive approach? Is there anything that you have your teams do?

Yeah. So we've started to implement where we do monthly exercises of actually simulating a threat actor inside of our environment and we'll do stuff like say reactivate a retirees account, give them some elevated access and start them performing and doing actual lateral movement things without any giving any knowledge to the rest of the security team to then actually monitor how long it takes us to detect it and how we respond. And then do kind of like a purple team engagement after that where we follow up of, okay, let's sit down after that, do a debrief and an after action report and figure out if we didn't detect it, why not? If we did, how quickly did we detect it? Can we improve upon that? If we didn't, how can we write something better to detect it? And, you know, coming up with new ideas every month where we're simulating different methodologies and using actual ttps that somebody already inside the network would do.

Yeah. Do you take any real world events to help drive that or.

We do. You know, depending on what the threat actors are commonly using and stuff. A good example is MGM last year and Caesars. And you know, the social engineering uptick that you've seen in general in mfa.

Yeah.

Is resetting somebody's MFA account and reusing that and seeing how long it would take, like following the knock through of detecting and intentionally resetting somebody's mfa.

Yeah. You know, I look at change health, for example. Right. You know, it's like you can have a system out there that's missing that mfa. And us as attackers, we're really great at finding the one thing that's missing something and taking advantage of it. And I feel like an organization, you have so many things going on, it's kind of hard to get that coverage and identify that. Are you guys in your offensive approaches to doing those exercises? Are you looking at things at scale in the perimeter, on the internal? Where are you guys kind of focusing your efforts?

I mean, we're focusing our efforts primarily internally. I mean, externally we do a fairly decent job of having a really tight perimeter. But like any company, I mean, if you look at the internal versus the external scans for what's an acceptable vulnerability and time to patch and stuff like external, you have to be hard internal, there's more forgiveness and forgiving ground. But, like, the reality is, is the more dwell time or time on target that you have, the more damage that you do. You know, you hear about somebody exfiltrated, you know, a million records, or look at Ticketmaster, 500 million customer records, like they didn't do that in 30 seconds. Like they had time on target. You know, you look at how pervasive MGM was taken over last year. I mean, they were in there pervasively for an extended period of time. And the soft, chewy middle scares me more than the external. And like, that's why the focus of these exercises too is really on meantime to detect and remediate. Because any dedicated hacker, like if they really want it and they're going to find a way in, it's the key is really how quickly you can detect that and respond to that and how you respond. I mean, we got hit by Move it last year and I mean, you know, there's always an element of luck too. But I mean, we detected it and you know, through user behavior analytics and had it blocked and shut off that we only lost a really small amount of files and we actually had it blocked before there was even any public knowledge and anybody knew that there was a zero day vulnerability in Move It. That's an ideal state. Like I said, there's always an element of luck. So, right, knock on wood, do we keep that streak of luck going? But that's, you know, I said we focus big time on how quickly can we detect and respond.

Do you feel like that is the primary thing that you've gotten the most value from is running those exercises to kind of say as a leader, like, where do I invest more in and are you correlating it against some sort of framework like Mitre ATT and CK or something to kind of help you decide and leverage?

Mitre ATT and CK is doing that. But like I said, then we get a lot of different threat intelligence feeds because we're critical infrastructure. We get a lot of early advance notice about what, you know, a lot of attack surface is seeing. And like, that's one of the neat things about the aviation industry in general. Despite, you know, that we're all competitors on the cybersecurity front, we all coordinate and cooperate really, really well. In fact, there's a tabletop exercise coming up where we're coordinating with the FAA and TSA and CISA and the airlines together to be like, what would be our unified response to some attacks. And you know, even when you think about it like we're competitors, but like if our pilots need to get somewhere, they can just hop on any other airline's flight and they'll fly them to where they need to get to their plane. Like, you don't see that cooperation between competitors and a lot of industries, and that extends to cybersecurity. I'm on regular calls with pretty much all of the aviation industry CISOs and we intelligence share and cooperate on a regular basis.

Anything else that aviation travel, logistics, like being a ciso, that's been unique that you've learned.

I mean, there's things that people don't think about from an Aviation perspective, like during times of war and stuff. Like if you look especially like, you know, in Iraq and Afghanistan, that there's a lot of leverage, especially like in the initial days of troop movements because there's the civilian air reserve fleet and like we're targeted by state sponsored actors too. Want to get in and sit low and slow and say China invades Taiwan of now they have the ability in some ways to disrupt a piece of troop movements. And like people don't think about that. And so like it surprises people like when they find out that like wait, you're in the airline and you have a top secret clearance. It's like, yeah, we're part of critical infrastructure. And you know, sometimes people forget why and how important aviation is to moving, you know, not just us around for our holidays, but as well as troop movements and material and product and how the impact and days that it takes to reset when the system gets out of whack too. I mean Southwest during the holidays two years ago and the weather, like sometimes it takes days to reset the whole system. And Delta's meltdown with Crowdstrike.

Yeah, I was going to say Southwest, they were good though on CrowdStrike because they use Windows 3.1.

That's the river. They're not that bad. Like they've improved a lot, but their tech is different.

I read that article and I had a good chuckle because you know, oh, we all are like, we all have legacies.

Easy target right now too. Oh, who doesn't have legacy? Like now have you seen a new startup or do you have legacy tech?

Yeah, in the airline industry probably has a fair amount of legacy, right?

I mean they do, but I mean there are newer airlines too. And I mean we're relatively new and when you compare us to some of the big airlines and you know, you have new startups like Avelo and Breeze and so a lot of it depends on the age and size of the airline. But like there are two big players like in the reservation system game of like Sabre's the biggest, which came out of American Airlines but in some ways was government mandated. And like that stuff is still. There's a lot of green screen based stuff there. So yeah, there's a lot of tech debt. Yeah. And I mean airlines in general because they're so capex heavy and stuff like margins for airlines are extremely low, relatively speaking. And it's the tight market.

Yeah. And you're mentioning, I think that some of them don't even have CISOs because of that reason.

That's true. Some of them don't mean some of them don't take security as seriously as others and. But everybody's got a discount, different risk profile and true. I'm not going to throw stones because.

Right.

Everybody approaches it differently. I think that Allegiant takes a very balanced approach and that's good. But I think that they definitely, you know, our board is very security conscientious and aware and we invest a significant amount in security and that's part of the reason I stay at Allegiant.

Nice. And you've had a lot of great past experience too. Where you came from was meta, formerly.

Facebook, 8 million plus servers.

Yeah. So what challenges you had there as head of infrastructure security. Right.

Yeah. I mean it's a very different environment and like at the end of the day it's an advertising business. So a lot of people like attacking, trying to get free advertising. There's that avenue. But then there's also because you have 3 billion users in such a global footprint, like thinking from an attacker's perspective of how am I going to influence an election. Yeah. Or public opinion on stuff like that was a big learning curve for me of like, because it's just a very different attack surface.

Yeah. Your adversary is very different. Right?

It is. You know, in that case they're not financially motivated. So like the state level and as well as psychologically of like any of the large tech companies, Google, Amazon, like you have to assume that there are state sponsored actors working there and have wormed their way in and like.

Well I've been reading the news and I think every week I just learned of someone new, hired some adversary like and made it all the way into the company, went through all the HR reviews, you know, went through the interviews and then they somehow discovered it. Seems like that's happening every week.

Yeah, yeah, I mean that's definitely happens. I mean I'm sure we do it too.

Yeah.

You know.

Right. Last question I have for you Dan is you know, what makes building a strong cybersecurity team? You've worked with a lot of different teams and is there anything that you look for specifically you're hiring for your team?

I mean I think the biggest thing is the eagerness and the ability to learn quickly because you know, that's the biggest thing with cybersecurity is you have to be able to absorb knowledge and learn quickly. Because not only is technology changing, but you know, your Windows guys have to know Windows, your Linux guys have to know Linux, your network guys have to know network, your security guys have to know everything. Yeah. And like sometimes I get a little bit of a flack about that. Cause there's the big debate on like, how do we solve the security talent gap shortage and stuff. And there's a lot of, well, why can't I get an entry level job in security? Why is it so hard? Security isn't really an entry level job. People need to realize that. And like I said, I get heat because some people don't disagree with, some people disagree with that. But I don't like, you know, starting to help desk start networking, get some foundation of how technology operates and work your way into security.

But like, yeah, because if you don't have that, you're going to have significant gaps. As a cybersecurity professional, if you don't know how something works underneath the hood, you got to understand it and have that foundation before you can build on the cybersecurity. Learn how it breaks, learn how to improve it, learn how to identify if it's misconfigured and whatnot.

You can all like in, you know. And I have a unique experience from the perspective of I actually was self taught and I didn't go back until I went back in 2018 and got my degree because I wanted to get my mba and I'm like, oh crap, I got to get my bachelor's first. So I got my bachelor's in cybersecurity and information assurance in 2018.

And that's like after how many years you've been working.

Yeah, there's the thing with school. I got through it really, really quick because like I could have taught all my classes but you know, so I've been through the education system fast enough that like you can only learn so much in school. And like being in the security space, they teach you the fundamentals of security, but that doesn't teach you the fundamentals of I'm as comfortable getting on a Windows box and working in AD as I am in Linux or Kerberos. You know, for authentication, you know, I can get on a network switch in Cisco and function as a network admin. I can get on storage gear, I can do SQL, I can do HTML, I can do all sorts of stuff that like, you just can only learn so much of that in school. And school is focused on more of the fundamentals of security. And that's why I said like, you know, to really be good in security, you need to learn to at least have a mid level of competency on all the different technologies because then you understand as well how lateral movement works and they move from one piece to another piece. And I mean, you're the same way. You know, it's not just one area of focus, you know, because resources are thin to begin with and budgets are thin that like no company out there hires. You know, this is my Linux security team. This is my Windows security team. This is my network. It doesn't scale that well that the expectation is my security people know the security components of all these things.

Absolutely. Well, Dan, thanks for being on. It's a great conversation. If someone wants to follow you and your work and what you're doing, how can they find you?

Man, they can find me on LinkedIn or they can always just hit me up at, you know, or my email dan.creed@thecreeds.net Nice.

Thanks, Dan.

Appreciate you, man.

Thank you for listening to another episode of the Ahead of the Breach podcast. If you enjoyed today's episode, please leave us a review on Apple Podcasts or Spotify. If you're interested in exploring how Sprocket is shaping the future of offensive security, be sure to check out our website@sprocketsecurity.com thank you again for joining us. See you on the next episode.