00:01:29 · Joe Weisenthal, Tracy Alloway, Thai Duong
[00:01:29] S0: It makes it more dangerous. No, I have no idea. Ever since essentially Anthropic announced that they had this model called Mythos and now it's Project Glasswing, which was rolled out to companies to use for defensive purposes before it was available to the general public, there has been much more awareness of cybersecurity issues as it relates to AI. And there are many things that people debate about AI and some of these bigger existential questions. Pretty much everyone agrees cybersecurity good, more cybersecurity good. I will say I know very little about the world of cybersecurity. I don't know what, for example, a cybersecurity company actually sells. I don't know how if I were buying cybersecurity, I would know whether it's working or whether no one had tried to hack me or not or something like that. I need to learn a lot more, but it's absolutely true about the uptick in the volume of hacks. [00:02:19] S3: There are hackers out there right now taking notes going, Joe doesn't know anything about cybersecurity, probably doesn't have a VPN. [00:02:25] S4: I don't.
00:02:25 · Thai Duong, Joe Weisenthal, S1, Tracy Alloway
[00:02:25] S4: I don't. [00:02:26] S0: That's why my vibe coding projects, I don't want to ever, I have yet to build anything with an account because I don't want to like have to think about that. So it's just like, I don't want to count information with anyone. But I have as a user of technical products, over the last several weeks, you get more emails saying like, Our thing was compromised. You're probably fine, but maybe you should refresh some keys or whatever. This is happening. This is real. And everyone really needs to learn more. And if you think about like black swans and Wall Street and all that stuff, you know, there's been for years a lot of talk about cyber as a major risk out there. [00:03:02] S1: Yeah. [00:03:03] S3: All right, well, we do, in fact, have the perfect guest. We're going to be speaking to two people from the company Calif, one of the companies that actually uncovered this PHP vulnerability. The other one was a company called Wiz. We have Thai Duong. He is the CEO over at Calif, which is a hacking firm, and we can get into exactly what that means, as well as Bruce Dang. He is an engineer at Calif as well. So, Thai and Bruce, thank you so much for coming on Odd Lots. [00:03:30] S1: We're glad to be here. So. [00:03:32] S3: Just to begin with, because hackers kind of, they always have cool achievements that they like to talk about. Why don't we just go ahead and start with who you are and what are the coolest things you've done in your hacking career?
00:03:32 · Tracy Alloway, Bruce Dang, S1
[00:03:32] S3: Just to begin with, because hackers kind of, they always have cool achievements that they like to talk about. Why don't we just go ahead and start with who you are and what are the coolest things you've done in your hacking career? [00:03:45] S2: Yeah. So I started my career at Microsoft almost 20 years ago in the Microsoft Security Response Center. These are the people that do patch Tuesdays. On the second Tuesday of every month, Microsoft releases an update. So I worked in that team a long time ago. Probably the biggest thing I did there and that I could talk about is I helped reverse engineer the Stuxnet virus, which is one of the one that was related to the supposedly the Iranian nuclear program was used to sabotage the Iranian nuclear program. [00:04:18] S3: This is the thing that people describe it as the world's first like known digital cyber weapon, right? [00:04:24] S1: Yeah, yeah, yeah, yeah. [00:04:26] S2: I'm sure there were many others before, but yeah, that's the first public one, yeah. I worked there for almost a decade. And then I left to do a startup with my friends. And then I joined Apple. I worked on iOS security. And then Ty managed to convince me to follow the Church of AI. [00:04:49] S1: And so here I am.
00:04:50 · Thai Duong
[00:04:50] S4: Yeah, it took me four years to convince Bruce. So, you know, when you go to a website or you go to Amazon, even Facebook, Instagram, your computer will share information with the server, right? Yeah. And that would be, the information would travel through many, many other servers, like your ISP, your Wi-Fi routers. So you want to encrypt that information to make sure that only the server can see your data, nobody else. And there's a mechanism for that. It's called the SSL protocol, or the later version is called like TLS, like transport layer protocol. security protocol. So, um, I love those protocols and, um, back in the day, together with, uh, friends, we found a bunch of ways to break the protocols, you know, to decrypt the data. And, um, it's pretty cool. It's actually changed the internet, how the internet works, because we basically, um, showed that in the past that like two protocols, like SSL Versus 3.0, that was invented by Netscape. You remember Netscape? Yeah, yeah. 30 years ago. And then people still use it because it's still working somewhat. But we show that, oh, it's not working very correctly. If you use SSL 3.0, then people can decrypt your data. So we hope the internet really, really removes SSL 3.0. And that's one thing. The other thing that I really enjoy doing was, you know, people think that in the past you have compression, you have some data and you want to compress the data and you have encryption. And both of them actually randomize your data in some way, right? If you look at a zip file, you open a zip file, look at the raw binaries, buy data in the zip file, look random to you. Because... all the redundant information has been removed and encoded in a way to reduce the size of the file. And so one of the basic question in computer security was, would you compress data and then you encrypt or you encrypt then compress? And I took some crypto class at Stanford University and I remember my professor, he asked this question in one of the homework assignments. And the obvious answer back then was you don't want to compress and then you don't want to encrypt and compress because encryption randomize your data. It means that compression would be less effective. So the right answer is you compress and then you encrypt. And that was the correct answer on my homework assignment. I think I took that class in 2011.
00:07:36 · Thai Duong
And then three years later, we found that it's wrong. If you do that, then people can actually decrypt your data. And the way it works is pretty cool. I can explain to you. So compression actually reveals, if you look at a compressed file, you know how well it is compressed, right? Because it's softer. If it's smaller, the compression is very good because there's a lot of redundant information. That's why compression works well. It means that if you look at a compression alone, the size of the compression, a compressed file, you can tell whether the file has a lot of redundant information. And encryption hides the length. So it doesn't hide the size of the encrypted data. When you encrypt a message, you can still see that this message is maybe this long or this message may be this long, right? Because encryption doesn't try to hide that. There's some people try to do that. So it means that if you compress and then you encrypt, it means that I can see where your message has some redundant information, has a lot of redundant information. And that alone is a leakage already, right? That you don't want to review. And I gave you an example. Let's say that you take a message, like a random message that I gave you, and then you put your password together with that message. Let's just say that there's a reason for you to do that. You put your password together with the message I gave you and you compress together. And then you encrypt it. with a key that I don't know. And you reveal the ciphertext, the result encrypted message to me. So supposedly I don't have the key. I shouldn't be able to read the message, right? But because I give you a message and you get my message put together with your password, you compress together. If the compression works very well, then I know whether my message has some redundancy with your password.
00:09:46 · Tracy Alloway, Thai Duong, S1
[00:09:46] S3: You can reverse engineer between the two relationships. [00:09:49] S4: Yeah, exactly. And you do that repeatedly. Eventually, we can recover your password. And that's exactly what we found on the web encryption protocols. In the past, that's exactly what they did. They take my data, they concatenate your password, they compress together, and then they send over the wire. And then as an attacker, I can see the length And that's enough for me to decrypt. And the solution was really interesting, because they decided to turn off compression. There's no solution. And then eventually, I was at Google back then. I was born in Saigon, Vietnam. I grew up there. Then I got a job in Mountain View for a consultancy, like what we do. So I moved to Mountain View in 2011. And then I joined Google. later that year. And I did cryptography at Google, basically help people do cryptography correctly, like try to avoid the mistakes that we found. I was there for 12 years. I work on like very last number of products. Google has a lot of products, right? Gmail, Chrome browser that we are using right now. And there's a lot of people out there that want to hack Google and our products. [00:11:17] S1: Yeah. [00:11:17] S4: So my job was to hack these products before we released them to the public. And I was there for 12 years and then I left to create Calif. And yeah.