00:05:46 · John Coogan, Jordi Hays, Matthew Prince
[00:05:46] S0: What about in the in the consumer realm? Are there... I've I've been sort of... You know, I've I've run into other people who have been like, oh, I've heard about this. Do I need to update my iPhone or update my Chrome tabs? Like, is there anything that that that breaks out into the consumer world, or is all of this just for, webmasters, people who are actually serving, web services, running servers, or does anything bleed over into consumer just yet? [00:06:14] S1: People are saying cycle your your Social Security number. [00:06:18] S0: Oh, yeah. Rotate your Social Security number. I saw that. [00:06:21] S2: Yeah. I think... I mean, I I think that in this particular case, you know, the PHP vulnerability Yeah. Really applies to businesses and people running running web servers. So there's not as much for the consumer. But but, you know, it would... As as if TSTO and the Chainsmokers and Common and a... And one of the worst vulnerabilities the web has ever seen wasn't enough for one week. We also had other vulnerabilities that were disclosed this week. There was a Node. Js vulnerability that was also something that probably consumers have to care about. The one that consumers should care about more is that there was a... It was discovered that one of the key root servers that powers the encryption behind the Internet, they're supposed to be secured with these very long complicated passphrases. They're supposed to be three twenty eight bits at a minimum. Instead, an an Indian company that was running some of these these root root server... Root key servers
00:06:21 · Matthew Prince, John Coogan, Jordi Hays
[00:06:21] S2: Yeah. I think... I mean, I I think that in this particular case, you know, the PHP vulnerability Yeah. Really applies to businesses and people running running web servers. So there's not as much for the consumer. But but, you know, it would... As as if TSTO and the Chainsmokers and Common and a... And one of the worst vulnerabilities the web has ever seen wasn't enough for one week. We also had other vulnerabilities that were disclosed this week. There was a Node. Js vulnerability that was also something that probably consumers have to care about. The one that consumers should care about more is that there was a... It was discovered that one of the key root servers that powers the encryption behind the Internet, they're supposed to be secured with these very long complicated passphrases. They're supposed to be three twenty eight bits at a minimum. Instead, an an Indian company that was running some of these these root root server... Root key servers [00:07:16] S0: Yeah. [00:07:16] S2: They... Instead of using 328 bits, they used literally the number four. [00:07:21] S0: Yeah. [00:07:21] S2: So their password was less secure than your ATM PIN. Yeah. And the problem with that is that because... Can we give them [00:07:28] S1: the the benefit of some four d chess? Because... [00:07:31] S0: Who would think to guess that? [00:07:32] S1: No one... No one's thinking if you were gonna try to brute force it, you would pick a number at least in the four digits Yeah. And then go from there.
00:07:32 · Jordi Hays, Matthew Prince, John Coogan
[00:07:32] S1: No one... No one's thinking if you were gonna try to brute force it, you would pick a number at least in the four digits Yeah. And then go from there. [00:07:41] S2: They had they had, I I think... I I can't remember if six or eight of their... These these key... These root these key root server certificates. The the most secure password they used was was the number 136. So they did... You know, they they they they... Again, almost to your ATM PIN [00:08:00] S0: Yeah. [00:08:00] S2: At that point. [00:08:01] S0: They call it security through obscurity. No one would... [00:08:04] S1: And they just rage they just rage quit the product category. Did I see that? I think they [00:08:09] S2: just... Yeah. They did. [00:08:10] S1: So... Which I mean... You can't fire us. You can't fire us. We quit. How [00:08:15] S2: you can ever be trusted is is is tough. But this is actually one where consumers do have something because [00:08:21] S0: Sure.
00:08:21 · John Coogan, Matthew Prince
[00:08:21] S0: Sure. [00:08:21] S2: These certificates, if somebody could get in the traffic flow, they could pretend to be Google, they could pretend to be your bank, they could trick you into doing a bunch of things. And so what the industry has done is as soon as this happened, your browser, your operating system distrusted these particular certificates. Sure. But until you upgrade your browser, until you upgrade your operating system, then you might still be trusting these certificates and your and your browser could be spoofed. So I think that that right now is a great time when your when your phone says, hey, do you want me to upgrade overnight? The answer is yes. Yeah. When your browser is harassing you to, like, you know, upgrade, like, just do it. Takes a few seconds. You're gonna be much more secure. And I wish I could say that like this was an unusual week and we're not we're never going see another week like it. I think we're going see a lot more weeks like this. I think the next two years are going to be incredibly, incredibly, incredibly fraught with what again are these new tools that we have that have infinite patience to go look for vulnerabilities, finding real problems across the internet. And it's going to feel scary. It's going to feel like the sky is falling. It's going to feel like there's nothing we can do. And and I think there are gonna be stories that characterize AI as the bad guy. [00:09:34] S0: Yeah.
00:09:34 · John Coogan, Matthew Prince, Jordi Hays
[00:09:34] S0: Yeah. [00:09:35] S2: AI is not the bad guy here. AI is the good guy. The AI didn't create these vulnerabilities. AI found them. And I think the question is, like, if you're living in a house that's got deadly monsters living in every closet, but you don't know they're there, are you are you in a in a better place or a worse place than if you start like going through the closets and finding the monsters and killing them? Yeah. Like, it's gonna be a lot more frightening to go through and kill the monsters, but you're probably gonna get a [00:10:01] S1: lot safer. And so I think we're gonna see some very scary stories. But there you go. Scary monster music. [00:10:08] S2: We're gonna see some very scary stories. But the good news is that, you know, you're... OpenAI, Anthropic, the Frontier Labs, and then in partnership with companies like Cloudflare are actually killing the monsters off. And I think the Internet is gonna get more secure. [00:10:24] S1: How are how are attacks evolving? Like, are are you seeing, like, swarms in in a way... In in, like, in a way that's, like... Swarm is obviously, like, this sort of, like, it's a it's a a real thing, but it's also kind of an idea. It sounds like something [00:10:41] S2: out of The Matrix. [00:10:42] S1: Yeah, like something... Is it that different than historical efforts when there's this kind of vulnerability? Because I imagine you can just get effectively a directory of every possible website that might have this vulnerability and then run a program.
00:10:42 · Jordi Hays, John Coogan, Matthew Prince
[00:10:42] S1: Yeah, like something... Is it that different than historical efforts when there's this kind of vulnerability? Because I imagine you can just get effectively a directory of every possible website that might have this vulnerability and then run a program. [00:10:59] S0: Yeah. There's something called a rainbow table. It's basically like every possible password. [00:11:02] S2: And every possible password. [00:11:04] S0: Yeah. But that was easily mitigated. But, yeah, a for loop with every possible... [00:11:07] S1: Are seeing like rogue swarms of of... Like powered by open weight models that are that are driving a lot of this? Or is it just, hey, there there's vulnerability that impacts 70% of the Internet? Mhmm.