00:14:24 · Thai Duong
[00:14:24] S4: We're really interested in finding vulnerabilities that have wide impact. And we want to understand these vulnerabilities to help inform decisions, defense decisions, how to fix and how to mitigate them for once and forever. On that background, we joined the OpenAI's Pass the Planet program. This is where OpenAI funds companies like Calif to go out and help open source maintainers to identify and fix, mitigate vulnerabilities in their software. And we have this engineer, like Ryan Osteen, who is, he's like a PHP historian. Yesterday, we went to a conference in San Francisco. We basically presented like, you know, PHP 2 shell, and Ryan walked everybody over like the 25 years of history of PHP vulnerabilities. So we have this engineer, Ryan, and this is how we work, basically. Our engineer, they're interested in certain things, and then they just go and hack those things. And, you know, as business people, we try to see, okay, how can we convince some other people to pay us for this work? And that's exactly what we did with OpenAI. We convinced OpenAI, okay, we're going to hack PHP. Can you fund our work? And they said, yes, they gave us tokens and money. And then we go and convince like PHP Foundation, which is the organization behind PHP, that let's work together, you know, we can help you. And it's actually pretty interesting because I mentioned like they're like a history of 25 years of like PHP vulnerabilities. And the person that is behind all of these hacks is like Stefan Esser. He's also at Calif. He joined us, I think, six months ago. Back in the day, he's the PHP security guy. Basically, he hacked and helped, like, harden PHP. So we didn't know anybody at the PHP Foundation. So we asked Stefan to introduce us. And because, you know, even though Stefan stopped working on PHP security for a while now, his name still rings, you know, very... loudly in this circle of the world.
00:16:50 · Tracy Alloway, Bruce Dang
[00:16:50] S3: I saw the comic that you guys put up about this. It was kind of funny. [00:16:55] S2: Yes. [00:16:56] S3: He's like Indiana Jones type character.
00:16:59 · Thai Duong
[00:16:59] S4: Yeah. So he connected us and then we met with Volker Dusch at the PHP Foundation. And yeah, that's how we got started. I think we started in July 30. And then immediately after one or two days, you know, Ryan found the first vulnerability, and he was interested in finding a vulnerability similar to one vulnerability that Stefan disclosed 22 years ago. And to his surprise, there's still a bunch of them like that in the PHP software right now. And so that's how we found it. And then we reported it to the PHP Foundation. because we know immediately that is a critical vulnerability that could affect a large part of the internet. Then the PHP Foundation actually shared with us that they actually found this vulnerability, the same vulnerability, two years ago. But they didn't fix it. Because when they found it, they discovered that the fix is very expensive. And there's just maybe a few options to fix it. and none of them were actually perfect because they need to change a lot of functionalities within PHP. And those changes may introduce new bugs, new vulnerabilities, or new reliability issue. And people would be very upset if they upgrade PHP and their website stop working. So in the end, back in like 2024, The PHP Foundation decided not to fix it because there was no exploit. No one could manage to show that this is actually a real issue. And that's exactly what they asked us. They come back, they ask like, do you have an exploit? Then the next day we share with them the first exploit that showed them that, yeah, someone doesn't need to know anything. can hack your website remotely.
00:19:13 · Tracy Alloway, Thai Duong, Joe Weisenthal, S1
[00:19:13] S3: So just to be clear, the use of AI in all of this, it wasn't necessarily that important in finding the vulnerability. It was more important in developing an actual exploit for a known issue. [00:19:27] S4: We think like that's probably the right way to think about it. But I think even for finding the vulnerability without AI, it would take a lot more time, right? So you can imagine like PHP was created like maybe 30 years ago. So it's a huge code base with a lot of features. And as a human engineer, you have to dig into this code base and it will take like months, right? And along the way, people may give up. But the fact that PHP Foundation filed the bug in 2024 proved that humans can actually file the bugs, right? And the problem was the exploitation, like you said. And for exploitation, like AI plays a major role in it. It's like becomes an engineering problem where our engineers would tell AI, you know, this is how I want to design our exploit and you go and do it. And then, you know, prove to us that it works correctly. Yeah. [00:20:31] S0: Let me ask a philosophical question. Is there a reason to believe that defensive cybersecurity can stay ahead of offensive cybersecurity, just generally, and then we can get into some details. But philosophically, is that something that we can reasonably hope for? [00:20:49] S1: I think so, yes. [00:20:50] S0: How come?
00:20:50 · Joe Weisenthal, Bruce Dang, S1, Thai Duong, Tracy Alloway
[00:20:50] S0: How come? [00:20:51] S2: Because you can use the AI to build certain types of systems in ways that may be very challenging. for attackers to exploit. Today, you can use AI to build whatever systems you want very quickly. You can experiment, get feedback very quickly. It can also process data very, very quickly and reason about that data. [00:21:19] S1: And so I think it is possible. [00:21:22] S2: I think it may not be immediate, but over time, we're going to perhaps use AI to help us write more secure software or build more secure systems. And eventually, I think that should counterbalance the advantages. [00:21:40] S1: That the attackers have. Perhaps I'm being optimistic, but I do foresee this happening. [00:21:47] S4: I can add something there. So if you look at the history of humanity, our history is the history of like weaponize our tools, right? If you find a powerful tool, then someone would find a way to use that tool as a weapon. [00:22:03] S3: Yeah.
00:22:03 · Tracy Alloway, Thai Duong
[00:22:03] S3: Yeah. [00:22:04] S4: So, and attackers always are early adopters of tools, right? New technology. Defenders move like at much slower pace than attackers. But fundamentally, we believe there are more good guys than bad guys out there. And eventually, the good guys would catch up and build things that help everybody defend off the bad guys. And I don't think in general, cybersecurity, if you see the news all the time, you see we got data breach every day almost, even before AI. So you may feel like it's not working at all. But if you're in the field, you can see the progress, right? In the past, like, 25 years, there's a tremendous progress in cybersecurity. Of course, people still got hacked because this is difficult. Imagine you have a very complex system. Like, imagine you have a house with lots of doors and lots of ways to get in. And cybersecurity must, like, make sure that everything is safe. At the same time, your house or your Office must remain open for business. So it's actually a pretty difficult problem. At the same time, without the progress that the industry made in the past 25 years, things could be much worse. And I think the same thing would be happening here. It's going to take a while for defenders to catch up. Right now, AI helps attackers more than defenders.