00:11:17 · Thai Duong, Joe Weisenthal, Bruce Dang, S1
[00:11:17] S4: So my job was to hack these products before we released them to the public. And I was there for 12 years and then I left to create Calif. And yeah. [00:11:30] S0: That's fantastic. I'm already fascinated by this conversation. I want to get into obviously what Calif does specifically. I want to get into some of the latest vulnerabilities. But before we do that, you know, both of you have had long careers that by and large predate what we now call AI. Are the risks associated with AI a sort of continuation on some path that cybersecurity have well understood, or are we in a truly novel area for how we should we be thinking about cybersecurity risk? [00:12:07] S2: I think it's a combination of the two. We've always known that there are security vulnerabilities in systems. And so we have security engineers who are hackers. [00:12:17] S1: Who try to find and exploit these vulnerabilities.
00:12:17 · S1, Bruce Dang
[00:12:17] S1: Who try to find and exploit these vulnerabilities. [00:12:20] S2: So the system has always been vulnerable to some degree, to a varying degree. What AI has done is it's kind of accelerated the speed in which you identify and exploit these vulnerabilities to a level where it's almost like superhuman. You know, like 20 years ago, Microsoft would release, let's say, maybe 20 updates every month. Now you're looking at like, you know, 1,400 updates per month. And that number is going to continue to grow. Just to give you an idea of the scale of things. And now, for example, to have certain systems, it may take you, let's say, three months with lots of people. Now, that may take you a few days with just one person and a very capable AI model. [00:13:08] S1: That's the reality that we're in today. [00:13:09] S2: It even changed the way how Attackers have certain types of systems, like in the banking sector, that our customers are in. You can tell some stories about that time. But that's kind of what I think. I think it's the systems have always been vulnerable to some degree. [00:13:26] S1: And now it's the AI just... accelerates that and makes it much more visible. [00:13:32] S2: And it's also made it easier for people to identify these vulnerabilities as well. [00:13:37] S1: And so, and then, you know, obviously there are pros and cons to that. But yeah, you can go into that later.
00:13:37 · S1, Tracy Alloway
[00:13:37] S1: And so, and then, you know, obviously there are pros and cons to that. But yeah, you can go into that later. [00:13:58] S3: Why don't we talk about discovering the PHP vulnerability then? Because I think this was a joint project between Calif, Wiz, and I think it was OpenAI. How did you find this? What was the process? And then what was the decision? I know you guys have gotten a little bit of pushback about publicizing it before it was fixed. So what was the process of actually putting out the statement saying we found this thing?
00:14:24 · Thai Duong
[00:14:24] S4: We're really interested in finding vulnerabilities that have wide impact. And we want to understand these vulnerabilities to help inform decisions, defense decisions, how to fix and how to mitigate them for once and forever. On that background, we joined the OpenAI's Pass the Planet program. This is where OpenAI funds companies like Calif to go out and help open source maintainers to identify and fix, mitigate vulnerabilities in their software. And we have this engineer, like Ryan Osteen, who is, he's like a PHP historian. Yesterday, we went to a conference in San Francisco. We basically presented like, you know, PHP 2 shell, and Ryan walked everybody over like the 25 years of history of PHP vulnerabilities. So we have this engineer, Ryan, and this is how we work, basically. Our engineer, they're interested in certain things, and then they just go and hack those things. And, you know, as business people, we try to see, okay, how can we convince some other people to pay us for this work? And that's exactly what we did with OpenAI. We convinced OpenAI, okay, we're going to hack PHP. Can you fund our work? And they said, yes, they gave us tokens and money. And then we go and convince like PHP Foundation, which is the organization behind PHP, that let's work together, you know, we can help you. And it's actually pretty interesting because I mentioned like they're like a history of 25 years of like PHP vulnerabilities. And the person that is behind all of these hacks is like Stefan Esser. He's also at Calif. He joined us, I think, six months ago. Back in the day, he's the PHP security guy. Basically, he hacked and helped, like, harden PHP. So we didn't know anybody at the PHP Foundation. So we asked Stefan to introduce us. And because, you know, even though Stefan stopped working on PHP security for a while now, his name still rings, you know, very... loudly in this circle of the world.
00:16:50 · Tracy Alloway, Bruce Dang
[00:16:50] S3: I saw the comic that you guys put up about this. It was kind of funny. [00:16:55] S2: Yes. [00:16:56] S3: He's like Indiana Jones type character.
00:16:59 · Thai Duong
[00:16:59] S4: Yeah. So he connected us and then we met with Volker Dusch at the PHP Foundation. And yeah, that's how we got started. I think we started in July 30. And then immediately after one or two days, you know, Ryan found the first vulnerability, and he was interested in finding a vulnerability similar to one vulnerability that Stefan disclosed 22 years ago. And to his surprise, there's still a bunch of them like that in the PHP software right now. And so that's how we found it. And then we reported it to the PHP Foundation. because we know immediately that is a critical vulnerability that could affect a large part of the internet. Then the PHP Foundation actually shared with us that they actually found this vulnerability, the same vulnerability, two years ago. But they didn't fix it. Because when they found it, they discovered that the fix is very expensive. And there's just maybe a few options to fix it. and none of them were actually perfect because they need to change a lot of functionalities within PHP. And those changes may introduce new bugs, new vulnerabilities, or new reliability issue. And people would be very upset if they upgrade PHP and their website stop working. So in the end, back in like 2024, The PHP Foundation decided not to fix it because there was no exploit. No one could manage to show that this is actually a real issue. And that's exactly what they asked us. They come back, they ask like, do you have an exploit? Then the next day we share with them the first exploit that showed them that, yeah, someone doesn't need to know anything. can hack your website remotely.