00:06:21 · Matthew Prince, John Coogan, Jordi Hays
[00:06:21] S2: Yeah. I think... I mean, I I think that in this particular case, you know, the PHP vulnerability Yeah. Really applies to businesses and people running running web servers. So there's not as much for the consumer. But but, you know, it would... As as if TSTO and the Chainsmokers and Common and a... And one of the worst vulnerabilities the web has ever seen wasn't enough for one week. We also had other vulnerabilities that were disclosed this week. There was a Node. Js vulnerability that was also something that probably consumers have to care about. The one that consumers should care about more is that there was a... It was discovered that one of the key root servers that powers the encryption behind the Internet, they're supposed to be secured with these very long complicated passphrases. They're supposed to be three twenty eight bits at a minimum. Instead, an an Indian company that was running some of these these root root server... Root key servers [00:07:16] S0: Yeah. [00:07:16] S2: They... Instead of using 328 bits, they used literally the number four. [00:07:21] S0: Yeah. [00:07:21] S2: So their password was less secure than your ATM PIN. Yeah. And the problem with that is that because... Can we give them [00:07:28] S1: the the benefit of some four d chess? Because... [00:07:31] S0: Who would think to guess that? [00:07:32] S1: No one... No one's thinking if you were gonna try to brute force it, you would pick a number at least in the four digits Yeah. And then go from there.
00:07:32 · Jordi Hays, Matthew Prince, John Coogan
[00:07:32] S1: No one... No one's thinking if you were gonna try to brute force it, you would pick a number at least in the four digits Yeah. And then go from there. [00:07:41] S2: They had they had, I I think... I I can't remember if six or eight of their... These these key... These root these key root server certificates. The the most secure password they used was was the number 136. So they did... You know, they they they they... Again, almost to your ATM PIN [00:08:00] S0: Yeah. [00:08:00] S2: At that point. [00:08:01] S0: They call it security through obscurity. No one would... [00:08:04] S1: And they just rage they just rage quit the product category. Did I see that? I think they [00:08:09] S2: just... Yeah. They did. [00:08:10] S1: So... Which I mean... You can't fire us. You can't fire us. We quit. How [00:08:15] S2: you can ever be trusted is is is tough. But this is actually one where consumers do have something because [00:08:21] S0: Sure.
00:08:21 · John Coogan, Matthew Prince
[00:08:21] S0: Sure. [00:08:21] S2: These certificates, if somebody could get in the traffic flow, they could pretend to be Google, they could pretend to be your bank, they could trick you into doing a bunch of things. And so what the industry has done is as soon as this happened, your browser, your operating system distrusted these particular certificates. Sure. But until you upgrade your browser, until you upgrade your operating system, then you might still be trusting these certificates and your and your browser could be spoofed. So I think that that right now is a great time when your when your phone says, hey, do you want me to upgrade overnight? The answer is yes. Yeah. When your browser is harassing you to, like, you know, upgrade, like, just do it. Takes a few seconds. You're gonna be much more secure. And I wish I could say that like this was an unusual week and we're not we're never going see another week like it. I think we're going see a lot more weeks like this. I think the next two years are going to be incredibly, incredibly, incredibly fraught with what again are these new tools that we have that have infinite patience to go look for vulnerabilities, finding real problems across the internet. And it's going to feel scary. It's going to feel like the sky is falling. It's going to feel like there's nothing we can do. And and I think there are gonna be stories that characterize AI as the bad guy. [00:09:34] S0: Yeah.
00:09:34 · John Coogan, Matthew Prince, Jordi Hays
[00:09:34] S0: Yeah. [00:09:35] S2: AI is not the bad guy here. AI is the good guy. The AI didn't create these vulnerabilities. AI found them. And I think the question is, like, if you're living in a house that's got deadly monsters living in every closet, but you don't know they're there, are you are you in a in a better place or a worse place than if you start like going through the closets and finding the monsters and killing them? Yeah. Like, it's gonna be a lot more frightening to go through and kill the monsters, but you're probably gonna get a [00:10:01] S1: lot safer. And so I think we're gonna see some very scary stories. But there you go. Scary monster music. [00:10:08] S2: We're gonna see some very scary stories. But the good news is that, you know, you're... OpenAI, Anthropic, the Frontier Labs, and then in partnership with companies like Cloudflare are actually killing the monsters off. And I think the Internet is gonna get more secure. [00:10:24] S1: How are how are attacks evolving? Like, are are you seeing, like, swarms in in a way... In in, like, in a way that's, like... Swarm is obviously, like, this sort of, like, it's a it's a a real thing, but it's also kind of an idea. It sounds like something [00:10:41] S2: out of The Matrix. [00:10:42] S1: Yeah, like something... Is it that different than historical efforts when there's this kind of vulnerability? Because I imagine you can just get effectively a directory of every possible website that might have this vulnerability and then run a program.
00:10:42 · Jordi Hays, John Coogan, Matthew Prince
[00:10:42] S1: Yeah, like something... Is it that different than historical efforts when there's this kind of vulnerability? Because I imagine you can just get effectively a directory of every possible website that might have this vulnerability and then run a program. [00:10:59] S0: Yeah. There's something called a rainbow table. It's basically like every possible password. [00:11:02] S2: And every possible password. [00:11:04] S0: Yeah. But that was easily mitigated. But, yeah, a for loop with every possible... [00:11:07] S1: Are seeing like rogue swarms of of... Like powered by open weight models that are that are driving a lot of this? Or is it just, hey, there there's vulnerability that impacts 70% of the Internet? Mhmm.
00:11:21 · Matthew Prince
[00:11:21] S2: Yeah. I mean... So so first of all, you don't need AI to take advantage of the vulnerability in this case once it's been discovered. So the the people who are trying to exploit this now, they're not using models to exploit it. They're just running they're running, you know, fairly simple scripts that are just, you know, trying to check every single server, every single IP address online Yep. To see if it's vulnerable to take it over. Mhmm. What what I think has changed is the rate at which attackers can figure out what they do when they find themselves in an environment. So about a year ago, there was a very, very, very popular plug in that plugged into Salesforce that got compromised by a Russian hacker. And it was it was so broadly deployed that it effectively gave the Russian hacker access to a huge portion of Salesforce's infrastructure and Salesforce's customers. But what was interesting was when you actually studied what the attacker did, they clearly... Like, they they weren't in enterprise sales. So they didn't really know how Salesforce worked. Sure. And so they kind of bumbled around like not quite knowing what to do or the fact that they'd stumbled on what was an incredible treasure mine. And as a result, what could have been just a disaster of a hack wasn't nearly as bad. What we're seeing now is if that same hack happened today, the attackers are using AI to say, okay, I found myself in Salesforce. What what stuff should I go, you know, looking for or stealing or trying to do? So the ability to very quickly, you know, figure out I'm here. What what what can I take advantage of, You know, is gotten there? What we're not seeing yet are, you know, I think that the example out of OpenAI with the hugging face compromise, I mean, that again makes, I mean, it's almost out of science fiction, some of the things that are happening there. But I think the good news is that the cost of running that type of Intact, an agent swarm like that is still extremely expensive. Hundreds of thousands, if not millions of dollars for that. And so an organization like, you know, OpenAI that's got those resources, the good guys have more resources than the bad guys. Yep. And so for now, I think you're you're actually seeing kind of a very naive use of AI by by at least the sort of typical cyber criminal.