WEBVTT - PHP2Shell Won't Be the Last Big AI Cybersecurity Risk 0:00:02.730 --> 0:00:05.590 Bloomberg Audio Studios. Podcasts. 0:00:05.910 --> 0:00:06.430 Radio. 0:00:06.850 --> 0:00:07.270 News. 0:00:18.570 --> 0:00:21.439 Hello and welcome to another episode of the Oddbots Podcast. 0:00:21.500 --> 0:00:22.320 I'm Tracey Alloway. 0:00:22.380 --> 0:00:23.560 And I'm Joe Weisenthal. 0:00:23.880 --> 0:00:27.060 Joe, it's October. We're recording this on October 29th. 0:00:27.610 --> 0:00:27.870 Yeah. 0:00:27.970 --> 0:00:30.450 It is also Black October. Have you heard this term? 0:00:30.590 --> 0:00:30.990 Yeah. 0:00:31.250 --> 0:00:33.170 What does that mean? Have stocks gone down? 0:00:33.450 --> 0:00:34.090 No. 0:00:34.350 --> 0:00:36.910 Your mind immediately goes to markets. There are other worlds 0:00:36.990 --> 0:00:38.599 out there. We're going to be talking about the world 0:00:38.620 --> 0:00:41.460 of cybersecurity today because one of the reasons people are 0:00:41.500 --> 0:00:44.960 talking about Black October is we've had a number of 0:00:45.060 --> 0:00:48.960 recent security issues, the most prominent of which has been 0:00:49.370 --> 0:00:53.089 a bunch of vulnerabilities discovered in PHP, which is a 0:00:53.130 --> 0:00:57.110 coding language that apparently is used by 70% of websites 0:00:57.190 --> 0:01:00.410 in existence. We can get into that stat later. But 0:01:00.450 --> 0:01:04.030 the really interesting thing about this vulnerability being uncovered is 0:01:05.030 --> 0:01:08.530 AI was used to uncover it. And so the big 0:01:08.610 --> 0:01:11.660 question coming back to AI, there's a concern now that 0:01:12.250 --> 0:01:14.880 you have good actors who are maybe using AI to 0:01:14.940 --> 0:01:19.230 discover old vulnerabilities and trying to fix them. But you 0:01:19.250 --> 0:01:21.990 could also have bad actors who are using AI to 0:01:22.050 --> 0:01:25.030 exploit those same vulnerabilities. So we're back to the question 0:01:25.060 --> 0:01:28.820 of whether AI makes the internet safer or more dangerous. 0:01:29.140 --> 0:01:30.980 It makes it more dangerous. No, I have no idea. 0:01:31.360 --> 0:01:35.060 Ever since essentially Anthropic announced that they had this model 0:01:35.080 --> 0:01:38.720 called Mythos and now it's Project Glasswing, which was rolled 0:01:38.760 --> 0:01:41.640 out to companies to use for defensive purposes before it 0:01:41.680 --> 0:01:44.410 was available to the general public, there has been much 0:01:44.569 --> 0:01:49.300 more awareness of cybersecurity issues as it relates to AI. 0:01:49.380 --> 0:01:52.360 And there are many things that people debate about AI 0:01:52.440 --> 0:01:55.740 and some of these bigger existential questions. Pretty much everyone 0:01:55.820 --> 0:01:59.950 agrees cybersecurity good, more cybersecurity good. I will say I 0:01:59.950 --> 0:02:02.850 know very little about the world of cybersecurity. I don't 0:02:02.910 --> 0:02:07.170 know what, for example, a cybersecurity company actually sells. I 0:02:07.190 --> 0:02:10.389 don't know how if I were buying cybersecurity, I would 0:02:10.430 --> 0:02:12.750 know whether it's working or whether no one had tried 0:02:12.770 --> 0:02:15.190 to hack me or not or something like that. I 0:02:15.250 --> 0:02:17.710 need to learn a lot more, but it's absolutely true 0:02:17.730 --> 0:02:19.549 about the uptick in the volume of hacks. 0:02:19.630 --> 0:02:22.030 There are hackers out there right now taking notes going, 0:02:22.090 --> 0:02:25.620 Joe doesn't know anything about cybersecurity, probably doesn't have a VPN. 0:02:25.840 --> 0:02:26.139 I don't. 0:02:26.180 --> 0:02:28.620 That's why my vibe coding projects, I don't want to ever, 0:02:28.760 --> 0:02:31.220 I have yet to build anything with an account because 0:02:31.280 --> 0:02:33.120 I don't want to like have to think about that. 0:02:33.180 --> 0:02:35.560 So it's just like, I don't want to count information 0:02:35.620 --> 0:02:39.420 with anyone. But I have as a user of technical products, 0:02:40.240 --> 0:02:43.100 over the last several weeks, you get more emails saying like, 0:02:43.510 --> 0:02:46.510 Our thing was compromised. You're probably fine, but maybe you 0:02:46.530 --> 0:02:49.880 should refresh some keys or whatever. This is happening. This 0:02:49.960 --> 0:02:52.880 is real. And everyone really needs to learn more. And 0:02:52.900 --> 0:02:56.930 if you think about like black swans and Wall Street 0:02:56.970 --> 0:02:59.550 and all that stuff, you know, there's been for years 0:02:59.590 --> 0:03:02.470 a lot of talk about cyber as a major risk 0:03:02.530 --> 0:03:02.809 out there. 0:03:02.910 --> 0:03:03.010 Yeah. 0:03:03.350 --> 0:03:05.610 All right, well, we do, in fact, have the perfect guest. 0:03:05.770 --> 0:03:08.489 We're going to be speaking to two people from the 0:03:08.530 --> 0:03:12.059 company Calif, one of the companies that actually uncovered this 0:03:12.120 --> 0:03:16.200 PHP vulnerability. The other one was a company called Wiz. 0:03:16.300 --> 0:03:19.660 We have Tai Yun. He is the CEO over at Calif, 0:03:19.840 --> 0:03:22.430 which is a hacking firm, and we can get into 0:03:22.630 --> 0:03:25.230 exactly what that means, as well as Bruce Dang. He 0:03:25.350 --> 0:03:28.110 is an engineer at Calif as well. So, Tai and Bruce, 0:03:28.130 --> 0:03:29.630 thank you so much for coming on All Thoughts. 0:03:30.150 --> 0:03:31.829 We're glad to be here. So. 0:03:32.530 --> 0:03:35.910 Just to begin with, because hackers kind of, they always 0:03:35.940 --> 0:03:38.460 have cool achievements that they like to talk about. Why 0:03:38.480 --> 0:03:40.240 don't we just go ahead and start with who you 0:03:40.520 --> 0:03:43.480 are and what are the coolest things you've done in 0:03:43.520 --> 0:03:44.540 your hacking career? 0:03:45.900 --> 0:03:49.820 Yeah. So I started my career at Microsoft almost 20 0:03:49.820 --> 0:03:53.590 years ago in the Microsoft Security Response Center. These are 0:03:53.610 --> 0:03:56.870 the people that do patch Tuesdays. On the second Tuesday 0:03:56.950 --> 0:03:59.230 of every month, Microsoft releases an update. So I worked 0:03:59.290 --> 0:04:02.690 in that team a long time ago. Probably the biggest 0:04:02.710 --> 0:04:04.390 thing I did there and that I could talk about 0:04:04.470 --> 0:04:09.250 is I helped reverse engineer the Stuxnet virus, which is 0:04:09.330 --> 0:04:12.750 one of the one that was related to the supposedly 0:04:12.790 --> 0:04:17.489 the Iranian nuclear program was used to sabotage the Iranian 0:04:17.510 --> 0:04:18.230 nuclear program. 0:04:18.430 --> 0:04:20.710 This is the thing that people describe it as the 0:04:20.750 --> 0:04:24.660 world's first like known digital cyber weapon, right? 0:04:24.960 --> 0:04:26.580 Yeah, yeah, yeah, yeah. 0:04:26.940 --> 0:04:29.960 I'm sure there were many others before, but yeah, that's 0:04:29.980 --> 0:04:33.710 the first public one, yeah. I worked there for almost 0:04:33.730 --> 0:04:37.010 a decade. And then I left to do a startup 0:04:37.089 --> 0:04:40.990 with my friends. And then I joined Apple. I worked 0:04:41.089 --> 0:04:46.110 on iOS security. And then Ty managed to convince me 0:04:46.230 --> 0:04:48.690 to follow the Church of AI. 0:04:49.390 --> 0:04:50.550 And so here I am. 0:04:50.810 --> 0:04:54.020 Yeah, it took me four years to convince Bruce. So, 0:04:54.060 --> 0:04:57.260 you know, when you go to a website or you 0:04:57.300 --> 0:05:03.080 go to Amazon, even Facebook, Instagram, your computer will share 0:05:03.110 --> 0:05:06.650 information with the server, right? Yeah. And that would be, 0:05:07.910 --> 0:05:13.050 the information would travel through many, many other servers, like 0:05:13.270 --> 0:05:17.570 your ISP, your Wi-Fi routers. So you want to encrypt 0:05:17.690 --> 0:05:20.310 that information to make sure that only the server can 0:05:20.370 --> 0:05:24.440 see your data, nobody else. And there's a mechanism for that. 0:05:24.510 --> 0:05:28.400 It's called the SSL protocol, or the later version is 0:05:28.440 --> 0:05:34.150 called like TOS, like transport layer protocol. security protocol. So, um, 0:05:34.370 --> 0:05:37.789 I love those protocols and, um, back in the day, 0:05:37.890 --> 0:05:41.989 together with, uh, friends, we found a bunch of ways 0:05:42.070 --> 0:05:46.680 to break the protocols, you know, to decrypt the data. And, um, 0:05:47.200 --> 0:05:49.960 it's pretty cool. It's actually changed the internet, how the 0:05:49.980 --> 0:05:55.140 internet works, because we basically, um, showed that in the 0:05:55.180 --> 0:05:59.990 past that like two protocols, like SSL Versus 3.0, that 0:06:00.029 --> 0:06:04.740 was invented by Netscape. You remember Netscape? Yeah, yeah. 30 0:06:04.740 --> 0:06:08.460 years ago. And then people still use it because it's 0:06:08.580 --> 0:06:12.160 still working somewhat. But we show that, oh, it's not 0:06:12.200 --> 0:06:16.700 working very correctly. If you use SSL 3.0, then people 0:06:16.740 --> 0:06:20.560 can decrypt your data. So we hope the internet really, 0:06:20.650 --> 0:06:26.230 really removes SSL 3.0. And that's one thing. The other 0:06:26.270 --> 0:06:29.810 thing that I really enjoy doing was, you know, people 0:06:29.850 --> 0:06:33.210 think that in the past you have compression, you have 0:06:33.230 --> 0:06:35.609 some data and you want to compress the data and 0:06:35.630 --> 0:06:38.910 you have encryption. And both of them actually randomize your 0:06:38.930 --> 0:06:41.270 data in some way, right? If you look at a 0:06:41.550 --> 0:06:44.979 zip file, you open a zip file, look at the 0:06:45.040 --> 0:06:49.160 raw binaries, buy data in the zip file, look random 0:06:49.180 --> 0:06:54.289 to you. Because... all the redundant information has been removed 0:06:54.310 --> 0:06:56.990 and encoded in a way to reduce the size of 0:06:57.070 --> 0:07:00.770 the file. And so one of the basic question in 0:07:01.890 --> 0:07:06.370 computer security was, would you compress data and then you 0:07:06.410 --> 0:07:11.880 encrypt or you encrypt then compress? And I took some 0:07:12.000 --> 0:07:16.840 crypto class at Stanford University and I remember my professor, 0:07:17.620 --> 0:07:20.340 he asked this question in one of the homework assignments. 0:07:21.340 --> 0:07:25.520 And the obvious answer back then was you don't want 0:07:25.580 --> 0:07:28.800 to compress and then you don't want to encrypt and 0:07:28.820 --> 0:07:33.000 compress because encryption randomize your data. It means that compression 0:07:33.020 --> 0:07:36.070 would be less effective. So the right answer is you 0:07:36.110 --> 0:07:40.090 compress and then you encrypt. And that was the correct 0:07:40.170 --> 0:07:43.270 answer on my homework assignment. I think I took that 0:07:43.350 --> 0:07:48.420 class in 2011. And then three years later, we found 0:07:48.450 --> 0:07:52.210 that it's wrong. If you do that, then people can 0:07:52.270 --> 0:07:55.210 actually decrypt your data. And the way it works is 0:07:55.250 --> 0:07:59.510 pretty cool. I can explain to you. So compression actually reveals, 0:08:00.250 --> 0:08:02.570 if you look at a compressed file, you know how 0:08:02.690 --> 0:08:06.680 well it is compressed, right? Because it's softer. If it's smaller, 0:08:06.960 --> 0:08:09.980 the compression is very good because there's a lot of 0:08:10.000 --> 0:08:14.060 redundant information. That's why compression works well. It means that 0:08:14.200 --> 0:08:16.610 if you look at a compression alone, the size of 0:08:16.650 --> 0:08:21.010 the compression, a compressed file, you can tell whether the 0:08:21.050 --> 0:08:26.710 file has a lot of redundant information. And encryption hides 0:08:26.950 --> 0:08:29.990 the length. So it doesn't hide the size of the 0:08:30.310 --> 0:08:33.480 encrypted data. When you encrypt a message, you can still 0:08:33.580 --> 0:08:36.480 see that this message is maybe this long or this 0:08:36.520 --> 0:08:40.580 message may be this long, right? Because encryption doesn't try 0:08:40.620 --> 0:08:43.280 to hide that. There's some people try to do that. 0:08:44.080 --> 0:08:46.900 So it means that if you compress and then you encrypt, 0:08:47.320 --> 0:08:50.670 it means that I can see where your message has 0:08:50.710 --> 0:08:54.700 some redundant information, has a lot of redundant information. And 0:08:54.720 --> 0:08:57.580 that alone is a leakage already, right? That you don't 0:08:57.600 --> 0:09:00.600 want to review. And I gave you an example. Let's 0:09:00.620 --> 0:09:03.160 say that you take a message, like a random message 0:09:03.179 --> 0:09:06.280 that I gave you, and then you put your password 0:09:06.340 --> 0:09:09.750 together with that message. Let's just say that there's a 0:09:09.790 --> 0:09:11.910 reason for you to do that. You put your password 0:09:11.950 --> 0:09:14.370 together with the message I gave you and you compress together. 0:09:15.130 --> 0:09:18.900 And then you encrypt it. with a key that I 0:09:18.940 --> 0:09:23.700 don't know. And you reveal the ciphertext, the result encrypted 0:09:23.860 --> 0:09:26.620 message to me. So supposedly I don't have the key. 0:09:26.730 --> 0:09:29.650 I shouldn't be able to read the message, right? But 0:09:29.730 --> 0:09:33.470 because I give you a message and you get my 0:09:33.510 --> 0:09:38.250 message put together with your password, you compress together. If 0:09:38.330 --> 0:09:43.130 the compression works very well, then I know whether my 0:09:43.170 --> 0:09:45.850 message has some redundancy with your password. 0:09:46.580 --> 0:09:49.600 You can reverse engineer between the two relationships. 0:09:49.679 --> 0:09:54.040 Yeah, exactly. And you do that repeatedly. Eventually, we can 0:09:54.090 --> 0:09:59.730 recover your password. And that's exactly what we found on 0:09:59.890 --> 0:10:04.820 the web encryption protocols. In the past, that's exactly what 0:10:04.840 --> 0:10:09.180 they did. They take my data, they concatenate your password, 0:10:09.720 --> 0:10:13.340 they compress together, and then they send over the wire. 0:10:14.080 --> 0:10:17.700 And then as an attacker, I can see the length 0:10:18.330 --> 0:10:22.120 And that's enough for me to decrypt. And the solution 0:10:22.200 --> 0:10:26.579 was really interesting, because they decided to turn off compression. 0:10:27.340 --> 0:10:30.699 There's no solution. And then eventually, I was at Google 0:10:30.740 --> 0:10:35.170 back then. I was born in Saigon, Vietnam. I grew 0:10:35.250 --> 0:10:38.590 up there. Then I got a job in Mountain View 0:10:39.070 --> 0:10:43.530 for a consultancy, like what we do. So I moved 0:10:43.550 --> 0:10:46.700 to Mountain View in 2011. And then I joined Google. 0:10:47.550 --> 0:10:53.630 later that year. And I did cryptography at Google, basically 0:10:53.710 --> 0:10:58.410 help people do cryptography correctly, like try to avoid the 0:10:58.450 --> 0:11:02.880 mistakes that we found. I was there for 12 years. 0:11:03.780 --> 0:11:07.700 I work on like very last number of products. Google 0:11:07.760 --> 0:11:11.320 has a lot of products, right? Gmail, Chrome browser that 0:11:11.340 --> 0:11:13.569 we are using right now. And there's a lot of 0:11:13.610 --> 0:11:17.010 people out there that want to hack Google and our products. 0:11:17.030 --> 0:11:17.209 Yeah. 0:11:17.690 --> 0:11:21.490 So my job was to hack these products before we 0:11:21.530 --> 0:11:24.979 released them to the public. And I was there for 0:11:24.980 --> 0:11:30.280 12 years and then I left to create Calif. And yeah. 0:11:30.440 --> 0:11:34.440 That's fantastic. I'm already fascinated by this conversation. I want 0:11:34.480 --> 0:11:37.230 to get into obviously what Calif does specifically. I want 0:11:37.250 --> 0:11:40.090 to get into some of the latest vulnerabilities. But before 0:11:40.170 --> 0:11:42.110 we do that, you know, both of you have had 0:11:42.830 --> 0:11:47.130 long careers that by and large predate what we now 0:11:47.270 --> 0:11:53.050 call AI. Are the risks associated with AI a sort 0:11:53.100 --> 0:11:58.280 of continuation on some path that cybersecurity have well understood, 0:11:59.020 --> 0:12:01.760 or are we in a truly novel area for how 0:12:01.820 --> 0:12:06.540 we should we be thinking about cybersecurity risk? 0:12:07.200 --> 0:12:10.500 I think it's a combination of the two. We've always 0:12:10.580 --> 0:12:15.069 known that there are security vulnerabilities in systems. And so 0:12:15.110 --> 0:12:18.030 we have security engineers who are hackers. 0:12:17.650 --> 0:12:20.350 Who try to find and exploit these vulnerabilities. 0:12:20.970 --> 0:12:24.109 So the system has always been vulnerable to some degree, 0:12:24.130 --> 0:12:27.550 to a varying degree. What AI has done is it's 0:12:27.610 --> 0:12:30.470 kind of accelerated the speed in which you identify and 0:12:30.510 --> 0:12:34.380 exploit these vulnerabilities to a level where it's almost like superhuman. 0:12:34.660 --> 0:12:37.740 You know, like 20 years ago, Microsoft would release, let's say, 0:12:37.800 --> 0:12:41.960 maybe 20 updates every month. Now you're looking at like, 0:12:42.059 --> 0:12:46.990 you know, 1,400 updates per month. And that number is 0:12:47.010 --> 0:12:49.569 going to continue to grow. Just to give you an 0:12:49.650 --> 0:12:55.329 idea of the scale of things. And now, for example, 0:12:55.570 --> 0:12:59.040 to have certain systems, it may take you, let's say, 0:12:59.140 --> 0:13:02.780 three months with lots of people. Now, that may take 0:13:02.820 --> 0:13:06.160 you a few days with just one person and a 0:13:06.210 --> 0:13:07.670 very capable AI model. 0:13:08.170 --> 0:13:09.530 That's the reality that we're in today. 0:13:09.550 --> 0:13:14.989 It even changed the way how Attackers have certain types 0:13:15.030 --> 0:13:19.270 of systems, like in the banking sector, that our customers 0:13:19.309 --> 0:13:22.010 are in. You can tell some stories about that time. 0:13:22.210 --> 0:13:23.809 But that's kind of what I think. I think it's 0:13:23.830 --> 0:13:26.290 the systems have always been vulnerable to some degree. 0:13:26.510 --> 0:13:31.079 And now it's the AI just... accelerates that and makes 0:13:31.120 --> 0:13:31.960 it much more visible. 0:13:32.480 --> 0:13:35.579 And it's also made it easier for people to identify 0:13:35.620 --> 0:13:37.300 these vulnerabilities as well. 0:13:37.400 --> 0:13:40.390 And so, and then, you know, obviously there are pros 0:13:40.429 --> 0:13:42.510 and cons to that. But yeah, you can go into 0:13:42.530 --> 0:13:42.830 that later. 0:13:58.940 --> 0:14:02.520 Why don't we talk about discovering the PHP vulnerability then? 0:14:02.540 --> 0:14:06.949 Because I think this was a joint project between Calif, Wiz, 0:14:07.230 --> 0:14:10.910 and I think it was OpenAI. How did you find this? 0:14:10.990 --> 0:14:13.090 What was the process? And then what was the decision? 0:14:13.110 --> 0:14:14.689 I know you guys have gotten a little bit of 0:14:14.730 --> 0:14:20.130 pushback about publicizing it before it was fixed. So what 0:14:20.150 --> 0:14:23.630 was the process of actually putting out the statement saying 0:14:23.670 --> 0:14:24.410 we found this thing? 0:14:24.830 --> 0:14:30.080 We're really interested in finding vulnerabilities that have wide impact. 0:14:30.780 --> 0:14:36.210 And we want to understand these vulnerabilities to help inform decisions, 0:14:36.690 --> 0:14:40.710 defense decisions, how to fix and how to mitigate them 0:14:40.750 --> 0:14:45.370 for once and forever. On that background, we joined the 0:14:45.690 --> 0:14:51.760 OpenAI's Pass the Planet program. This is where OpenAI funds 0:14:51.780 --> 0:14:56.640 companies like Calif to go out and help open source 0:14:56.680 --> 0:15:02.820 maintainers to identify and fix, mitigate vulnerabilities in their software. 0:15:03.980 --> 0:15:08.600 And we have this engineer, like Ryan Osteen, who is, 0:15:09.280 --> 0:15:13.080 he's like a PHP historian. Yesterday, we went to a 0:15:13.120 --> 0:15:18.470 conference in San Francisco. We basically presented like, you know, 0:15:18.570 --> 0:15:23.750 PHP 2 shell, and Ryan walked everybody over like the 0:15:23.750 --> 0:15:28.780 25 years of history of PHP vulnerabilities. So we have 0:15:28.800 --> 0:15:32.810 this engineer, Ryan, and this is how we work, basically. 0:15:34.010 --> 0:15:37.310 Our engineer, they're interested in certain things, and then they 0:15:37.350 --> 0:15:40.130 just go and hack those things. And, you know, as 0:15:40.190 --> 0:15:42.810 business people, we try to see, okay, how can we 0:15:43.270 --> 0:15:46.080 convince some other people to pay us for this work? 0:15:46.680 --> 0:15:50.960 And that's exactly what we did with OpenAI. We convinced OpenAI, okay, 0:15:50.980 --> 0:15:54.980 we're going to hack PHP. Can you fund our work? 0:15:55.590 --> 0:15:58.430 And they said, yes, they gave us tokens and money. 0:15:58.990 --> 0:16:01.990 And then we go and convince like PHP Foundation, which 0:16:02.050 --> 0:16:05.990 is the organization behind PHP, that let's work together, you know, 0:16:06.030 --> 0:16:09.310 we can help you. And it's actually pretty interesting because 0:16:09.330 --> 0:16:12.710 I mentioned like they're like a history of 25 years 0:16:12.870 --> 0:16:17.990 of like PHP vulnerabilities. And the person that is behind 0:16:18.310 --> 0:16:22.110 all of these hacks is like Stephen Escher. He's also 0:16:22.170 --> 0:16:24.880 at Calif. He joined us, I think, six months ago. 0:16:25.600 --> 0:16:28.420 Back in the day, he's the PHP security guy. Basically, 0:16:28.450 --> 0:16:33.390 he hacked and helped, like, harden PHP. So we didn't 0:16:33.430 --> 0:16:37.030 know anybody at the PHP Foundation. So we asked Stefan 0:16:37.130 --> 0:16:40.790 to introduce us. And because, you know, even though Stefan 0:16:41.430 --> 0:16:45.050 stopped working on PHP security for a while now, his 0:16:45.130 --> 0:16:50.090 name still rings, you know, very... loudly in this circle 0:16:50.110 --> 0:16:50.710 of the world. 0:16:50.890 --> 0:16:54.370 I saw the comic that you guys put up about this. 0:16:54.390 --> 0:16:55.730 It was kind of funny. 0:16:55.950 --> 0:16:56.270 Yes. 0:16:56.510 --> 0:16:59.210 He's like Indiana Jones type character. 0:16:59.290 --> 0:17:03.500 Yeah. So he connected us and then we met with 0:17:03.720 --> 0:17:07.939 Volker Dusch at the PHP Foundation. And yeah, that's how 0:17:08.000 --> 0:17:13.320 we got started. I think we started in July 30. 0:17:13.320 --> 0:17:16.380 And then immediately after one or two days, you know, 0:17:16.420 --> 0:17:22.350 Ryan found the first vulnerability, and he was interested in 0:17:22.810 --> 0:17:29.859 finding a vulnerability similar to one vulnerability that Stefan disclosed 0:17:29.859 --> 0:17:35.619 22 years ago. And to his surprise, there's still a 0:17:35.660 --> 0:17:39.780 bunch of them like that in the PHP software right now. 0:17:41.040 --> 0:17:44.489 And so that's how we found it. And then we 0:17:44.530 --> 0:17:48.200 reported it to the PHP Foundation. because we know immediately 0:17:48.260 --> 0:17:52.450 that is a critical vulnerability that could affect a large 0:17:52.490 --> 0:17:56.210 part of the internet. Then the Peace Preach Foundation actually 0:17:56.290 --> 0:18:00.070 shared with us that they actually found this vulnerability, the 0:18:00.109 --> 0:18:04.179 same vulnerability, two years ago. But they didn't fix it. 0:18:04.960 --> 0:18:09.379 Because when they found it, they discovered that the fix 0:18:09.740 --> 0:18:14.360 is very expensive. And there's just maybe a few options 0:18:14.859 --> 0:18:18.670 to fix it. and none of them were actually perfect 0:18:19.330 --> 0:18:25.870 because they need to change a lot of functionalities within PHP. 0:18:26.790 --> 0:18:32.689 And those changes may introduce new bugs, new vulnerabilities, or 0:18:32.750 --> 0:18:36.570 new reliability issue. And people would be very upset if 0:18:36.650 --> 0:18:42.409 they upgrade PHP and their website stop working. So in 0:18:42.430 --> 0:18:47.780 the end, back in like 2024, The PHP Foundation decided 0:18:47.920 --> 0:18:52.380 not to fix it because there was no exploit. No 0:18:52.520 --> 0:18:55.200 one could manage to show that this is actually a 0:18:55.240 --> 0:18:59.380 real issue. And that's exactly what they asked us. They 0:18:59.420 --> 0:19:01.860 come back, they ask like, do you have an exploit? 0:19:02.880 --> 0:19:05.419 Then the next day we share with them the first 0:19:05.560 --> 0:19:11.000 exploit that showed them that, yeah, someone doesn't need to 0:19:11.060 --> 0:19:13.530 know anything. can hack your website remotely. 0:19:13.730 --> 0:19:16.830 So just to be clear, the use of AI in 0:19:16.930 --> 0:19:20.680 all of this, it wasn't necessarily that important in finding 0:19:20.720 --> 0:19:24.959 the vulnerability. It was more important in developing an actual 0:19:25.080 --> 0:19:27.119 exploit for a known issue. 0:19:27.460 --> 0:19:29.790 We think like that's probably the right way to think 0:19:29.850 --> 0:19:33.149 about it. But I think even for finding the vulnerability 0:19:33.230 --> 0:19:35.730 without AI, it would take a lot more time, right? 0:19:36.550 --> 0:19:41.860 So you can imagine like PHP was created like maybe 0:19:41.859 --> 0:19:45.270 30 years ago. So it's a huge code base with 0:19:45.330 --> 0:19:49.920 a lot of features. And as a human engineer, you 0:19:49.960 --> 0:19:53.840 have to dig into this code base and it will 0:19:53.859 --> 0:19:56.520 take like months, right? And along the way, people may 0:19:56.560 --> 0:20:00.209 give up. But the fact that PHP Foundation filed the 0:20:00.230 --> 0:20:06.090 bug in 2024 proved that humans can actually file the bugs, right? 0:20:07.070 --> 0:20:11.650 And the problem was the exploitation, like you said. And 0:20:11.830 --> 0:20:15.899 for exploitation, like AI plays a major role in it. 0:20:16.600 --> 0:20:20.180 It's like becomes an engineering problem where our engineers would 0:20:20.220 --> 0:20:22.280 tell AI, you know, this is how I want to 0:20:22.300 --> 0:20:26.880 design our exploit and you go and do it. And then, 0:20:27.060 --> 0:20:30.600 you know, prove to us that it works correctly. Yeah. 0:20:31.000 --> 0:20:35.030 Let me ask a philosophical question. Is there a reason 0:20:35.090 --> 0:20:40.950 to believe that defensive cybersecurity can stay ahead of offensive cybersecurity, 0:20:41.010 --> 0:20:43.170 just generally, and then we can get into some details. 0:20:43.550 --> 0:20:48.530 But philosophically, is that something that we can reasonably hope for? 0:20:49.150 --> 0:20:50.030 I think so, yes. 0:20:50.310 --> 0:20:50.670 How come? 0:20:51.170 --> 0:20:55.670 Because you can use the AI to build certain types 0:20:55.859 --> 0:21:00.810 of systems in ways that may be very challenging. for 0:21:00.930 --> 0:21:06.290 attackers to exploit. Today, you can use AI to build 0:21:06.590 --> 0:21:11.730 whatever systems you want very quickly. You can experiment, get 0:21:11.770 --> 0:21:16.640 feedback very quickly. It can also process data very, very 0:21:16.680 --> 0:21:18.980 quickly and reason about that data. 0:21:19.660 --> 0:21:22.120 And so I think it is possible. 0:21:22.240 --> 0:21:26.400 I think it may not be immediate, but over time, 0:21:26.460 --> 0:21:31.220 we're going to perhaps use AI to help us write 0:21:31.260 --> 0:21:35.680 more secure software or build more secure systems. And eventually, 0:21:35.700 --> 0:21:41.080 I think that should counterbalance the advantages. 0:21:40.680 --> 0:21:45.810 That the attackers have. Perhaps I'm being optimistic, but I 0:21:45.850 --> 0:21:47.369 do foresee this happening. 0:21:47.910 --> 0:21:50.770 I can add something there. So if you look at 0:21:50.790 --> 0:21:54.580 the history of humanity, our history is the history of 0:21:54.650 --> 0:21:59.480 like weaponize our tools, right? If you find a powerful tool, 0:21:59.600 --> 0:22:02.120 then someone would find a way to use that tool 0:22:03.000 --> 0:22:03.520 as a weapon. 0:22:03.820 --> 0:22:04.060 Yeah. 0:22:04.300 --> 0:22:10.040 So, and attackers always are early adopters of tools, right? 0:22:10.540 --> 0:22:16.040 New technology. Defenders move like at much slower pace than attackers. 0:22:16.810 --> 0:22:20.350 But fundamentally, we believe there are more good guys than 0:22:20.410 --> 0:22:25.310 bad guys out there. And eventually, the good guys would 0:22:25.350 --> 0:22:30.990 catch up and build things that help everybody defend off 0:22:31.190 --> 0:22:38.520 the bad guys. And I don't think in general, cybersecurity, 0:22:38.740 --> 0:22:40.460 if you see the news all the time, you see 0:22:40.700 --> 0:22:44.920 we got data breach every day almost, even before AI. 0:22:45.510 --> 0:22:48.190 So you may feel like it's not working at all. 0:22:48.930 --> 0:22:51.450 But if you're in the field, you can see the progress, right? 0:22:51.550 --> 0:22:55.370 In the past, like, 25 years, there's a tremendous progress 0:22:55.430 --> 0:22:58.730 in cybersecurity. Of course, people still got hacked because this 0:22:58.830 --> 0:23:04.150 is difficult. Imagine you have a very complex system. Like, 0:23:04.210 --> 0:23:07.260 imagine you have a house with lots of doors and 0:23:07.280 --> 0:23:11.000 lots of ways to get in. And cybersecurity must, like, 0:23:11.040 --> 0:23:13.160 make sure that everything is safe. At the same time, 0:23:13.220 --> 0:23:16.770 your house or your Office must remain open for business. 0:23:17.609 --> 0:23:20.660 So it's actually a pretty difficult problem. At the same time, 0:23:20.680 --> 0:23:25.060 without the progress that the industry made in the past 0:23:25.060 --> 0:23:29.860 25 years, things could be much worse. And I think 0:23:29.900 --> 0:23:32.820 the same thing would be happening here. It's going to 0:23:32.859 --> 0:23:37.010 take a while for defenders to catch up. Right now, 0:23:37.510 --> 0:23:40.770 AI helps attackers more than defenders. 0:23:41.540 --> 0:23:44.140 Is the general idea that we're just in this sort 0:23:44.160 --> 0:23:48.730 of awkward phase where a lot of people in cybersecurity 0:23:48.770 --> 0:23:51.850 always refer to technical debt, right? This idea that you 0:23:51.890 --> 0:23:56.170 haven't upgraded a system for ages, like the PHP vulnerability 0:23:56.230 --> 0:23:57.950 we were just discussing, and so now you have to 0:23:57.990 --> 0:24:01.560 pay back that technical debt. The idea that we're just 0:24:01.600 --> 0:24:03.879 in an awkward moment where AI is going to be 0:24:03.960 --> 0:24:08.170 able to exploit existing flaws in the system is But 0:24:08.300 --> 0:24:11.600 maybe we eventually move to a place where we upgrade 0:24:11.660 --> 0:24:12.879 the entire system. 0:24:13.100 --> 0:24:14.820 We reduce our outstanding technical debt. 0:24:14.840 --> 0:24:16.980 We reduce the outstanding technical debt. Exactly. 0:24:17.320 --> 0:24:19.030 That's an optimistic way to look at it. 0:24:19.280 --> 0:24:19.780 Okay. 0:24:20.540 --> 0:24:23.020 You know, we found that there are systems that we 0:24:23.359 --> 0:24:27.370 thought that, okay, that don't have a lot of technical debt. 0:24:27.869 --> 0:24:31.910 That turned out that they just like dumpster fire like 0:24:32.150 --> 0:24:37.260 everybody else. That was a very big surprise to me personally. 0:24:37.800 --> 0:24:41.540 We know there are places, there are bad problems, and 0:24:41.820 --> 0:24:44.619 we know that if we just point AI at that thing, 0:24:44.640 --> 0:24:47.219 there will be a lot of bugs coming out. But 0:24:47.240 --> 0:24:50.520