00:16:59 · Thai Duong
[00:16:59] S4: Yeah. So he connected us and then we met with Volker Dusch at the PHP Foundation. And yeah, that's how we got started. I think we started in July 30. And then immediately after one or two days, you know, Ryan found the first vulnerability, and he was interested in finding a vulnerability similar to one vulnerability that Stefan disclosed 22 years ago. And to his surprise, there's still a bunch of them like that in the PHP software right now. And so that's how we found it. And then we reported it to the PHP Foundation. because we know immediately that is a critical vulnerability that could affect a large part of the internet. Then the PHP Foundation actually shared with us that they actually found this vulnerability, the same vulnerability, two years ago. But they didn't fix it. Because when they found it, they discovered that the fix is very expensive. And there's just maybe a few options to fix it. and none of them were actually perfect because they need to change a lot of functionalities within PHP. And those changes may introduce new bugs, new vulnerabilities, or new reliability issue. And people would be very upset if they upgrade PHP and their website stop working. So in the end, back in like 2024, The PHP Foundation decided not to fix it because there was no exploit. No one could manage to show that this is actually a real issue. And that's exactly what they asked us. They come back, they ask like, do you have an exploit? Then the next day we share with them the first exploit that showed them that, yeah, someone doesn't need to know anything. can hack your website remotely.
00:19:13 · Tracy Alloway, Thai Duong, Joe Weisenthal, S1
[00:19:13] S3: So just to be clear, the use of AI in all of this, it wasn't necessarily that important in finding the vulnerability. It was more important in developing an actual exploit for a known issue. [00:19:27] S4: We think like that's probably the right way to think about it. But I think even for finding the vulnerability without AI, it would take a lot more time, right? So you can imagine like PHP was created like maybe 30 years ago. So it's a huge code base with a lot of features. And as a human engineer, you have to dig into this code base and it will take like months, right? And along the way, people may give up. But the fact that PHP Foundation filed the bug in 2024 proved that humans can actually file the bugs, right? And the problem was the exploitation, like you said. And for exploitation, like AI plays a major role in it. It's like becomes an engineering problem where our engineers would tell AI, you know, this is how I want to design our exploit and you go and do it. And then, you know, prove to us that it works correctly. Yeah. [00:20:31] S0: Let me ask a philosophical question. Is there a reason to believe that defensive cybersecurity can stay ahead of offensive cybersecurity, just generally, and then we can get into some details. But philosophically, is that something that we can reasonably hope for? [00:20:49] S1: I think so, yes. [00:20:50] S0: How come?
00:20:50 · Joe Weisenthal, Bruce Dang, S1, Thai Duong, Tracy Alloway
[00:20:50] S0: How come? [00:20:51] S2: Because you can use the AI to build certain types of systems in ways that may be very challenging. for attackers to exploit. Today, you can use AI to build whatever systems you want very quickly. You can experiment, get feedback very quickly. It can also process data very, very quickly and reason about that data. [00:21:19] S1: And so I think it is possible. [00:21:22] S2: I think it may not be immediate, but over time, we're going to perhaps use AI to help us write more secure software or build more secure systems. And eventually, I think that should counterbalance the advantages. [00:21:40] S1: That the attackers have. Perhaps I'm being optimistic, but I do foresee this happening. [00:21:47] S4: I can add something there. So if you look at the history of humanity, our history is the history of like weaponize our tools, right? If you find a powerful tool, then someone would find a way to use that tool as a weapon. [00:22:03] S3: Yeah.
00:22:03 · Tracy Alloway, Thai Duong
[00:22:03] S3: Yeah. [00:22:04] S4: So, and attackers always are early adopters of tools, right? New technology. Defenders move like at much slower pace than attackers. But fundamentally, we believe there are more good guys than bad guys out there. And eventually, the good guys would catch up and build things that help everybody defend off the bad guys. And I don't think in general, cybersecurity, if you see the news all the time, you see we got data breach every day almost, even before AI. So you may feel like it's not working at all. But if you're in the field, you can see the progress, right? In the past, like, 25 years, there's a tremendous progress in cybersecurity. Of course, people still got hacked because this is difficult. Imagine you have a very complex system. Like, imagine you have a house with lots of doors and lots of ways to get in. And cybersecurity must, like, make sure that everything is safe. At the same time, your house or your Office must remain open for business. So it's actually a pretty difficult problem. At the same time, without the progress that the industry made in the past 25 years, things could be much worse. And I think the same thing would be happening here. It's going to take a while for defenders to catch up. Right now, AI helps attackers more than defenders.
00:23:41 · Tracy Alloway, Joe Weisenthal, Thai Duong, S1
[00:23:41] S3: Is the general idea that we're just in this sort of awkward phase where a lot of people in cybersecurity always refer to technical debt, right? This idea that you haven't upgraded a system for ages, like the PHP vulnerability we were just discussing, and so now you have to pay back that technical debt. The idea that we're just in an awkward moment where AI is going to be able to exploit existing flaws in the system is But maybe we eventually move to a place where we upgrade the entire system. [00:24:13] S0: We reduce our outstanding technical debt. [00:24:14] S3: We reduce the outstanding technical debt. Exactly. [00:24:17] S4: That's an optimistic way to look at it. [00:24:19] S1: Okay.
00:24:20 · Thai Duong
[00:24:20] S4: You know, we found that there are systems that we thought that, okay, that don't have a lot of technical debt. That turned out that they just like dumpster fire like everybody else. That was a very big surprise to me personally. We know there are places, there are bad problems, and we know that if we just point AI at that thing, there will be a lot of bugs coming out. But there are also places we thought that could be okay because they received a lot of attention over the years already. But it turns out that there's still a lot of bugs there as well. And a lot means a lot more, like 10x more than we expected. And of course there are still like a few small places where there was fewer bugs back then before AI. Now there's still fewer bugs still now, but they're like very small, like very like lit, like they are the exception, not the norms. So that's actually a big surprise because I don't think anybody was surprised to find a critical vulnerability in PHP. because PHP wasn't known for like race security. So of course at the PHP 2.0 scale, then that's a different matter. But if you find another vulnerability in PHP today, then that's not a surprise. But if you go and, you know, find a vulnerability or maybe a hundred vulnerabilities, a thousand vulnerabilities in the Chrome browser for example, that's a surprise. And that's exactly what happened. Like people found like a thousand vulnerabilities in Chrome and you know, I was at Google and I knew, and then the entire industry like assumed that and knew that, wow, there was a lot of investment in Chrome security. And not just like, you know, remove, like eliminate vulnerabilities, but making sure that even if you have vulnerabilities, it's difficult to exploit these vulnerabilities. This is what we call mitigations. You accept that you have vulnerabilities, but then you make sure that like attackers couldn't use these vulnerabilities to control your computer or your browser. We thought that, you know, the defense layers were pretty good and the rate of vulnerabilities were low. But then after AI, we just discovered that either like we, as security engineers, suck at our job. We couldn't find these things. Or they're just like too much code that we didn't have enough time to look into.