00:08:21 · John Coogan, Matthew Prince
[00:08:21] S0: Sure. [00:08:21] S2: These certificates, if somebody could get in the traffic flow, they could pretend to be Google, they could pretend to be your bank, they could trick you into doing a bunch of things. And so what the industry has done is as soon as this happened, your browser, your operating system distrusted these particular certificates. Sure. But until you upgrade your browser, until you upgrade your operating system, then you might still be trusting these certificates and your and your browser could be spoofed. So I think that that right now is a great time when your when your phone says, hey, do you want me to upgrade overnight? The answer is yes. Yeah. When your browser is harassing you to, like, you know, upgrade, like, just do it. Takes a few seconds. You're gonna be much more secure. And I wish I could say that like this was an unusual week and we're not we're never going see another week like it. I think we're going see a lot more weeks like this. I think the next two years are going to be incredibly, incredibly, incredibly fraught with what again are these new tools that we have that have infinite patience to go look for vulnerabilities, finding real problems across the internet. And it's going to feel scary. It's going to feel like the sky is falling. It's going to feel like there's nothing we can do. And and I think there are gonna be stories that characterize AI as the bad guy. [00:09:34] S0: Yeah.
00:09:34 · John Coogan, Matthew Prince, Jordi Hays
[00:09:34] S0: Yeah. [00:09:35] S2: AI is not the bad guy here. AI is the good guy. The AI didn't create these vulnerabilities. AI found them. And I think the question is, like, if you're living in a house that's got deadly monsters living in every closet, but you don't know they're there, are you are you in a in a better place or a worse place than if you start like going through the closets and finding the monsters and killing them? Yeah. Like, it's gonna be a lot more frightening to go through and kill the monsters, but you're probably gonna get a [00:10:01] S1: lot safer. And so I think we're gonna see some very scary stories. But there you go. Scary monster music. [00:10:08] S2: We're gonna see some very scary stories. But the good news is that, you know, you're... OpenAI, Anthropic, the Frontier Labs, and then in partnership with companies like Cloudflare are actually killing the monsters off. And I think the Internet is gonna get more secure. [00:10:24] S1: How are how are attacks evolving? Like, are are you seeing, like, swarms in in a way... In in, like, in a way that's, like... Swarm is obviously, like, this sort of, like, it's a it's a a real thing, but it's also kind of an idea. It sounds like something [00:10:41] S2: out of The Matrix. [00:10:42] S1: Yeah, like something... Is it that different than historical efforts when there's this kind of vulnerability? Because I imagine you can just get effectively a directory of every possible website that might have this vulnerability and then run a program.
00:10:42 · Jordi Hays, John Coogan, Matthew Prince
[00:10:42] S1: Yeah, like something... Is it that different than historical efforts when there's this kind of vulnerability? Because I imagine you can just get effectively a directory of every possible website that might have this vulnerability and then run a program. [00:10:59] S0: Yeah. There's something called a rainbow table. It's basically like every possible password. [00:11:02] S2: And every possible password. [00:11:04] S0: Yeah. But that was easily mitigated. But, yeah, a for loop with every possible... [00:11:07] S1: Are seeing like rogue swarms of of... Like powered by open weight models that are that are driving a lot of this? Or is it just, hey, there there's vulnerability that impacts 70% of the Internet? Mhmm.
00:11:21 · Matthew Prince
[00:11:21] S2: Yeah. I mean... So so first of all, you don't need AI to take advantage of the vulnerability in this case once it's been discovered. So the the people who are trying to exploit this now, they're not using models to exploit it. They're just running they're running, you know, fairly simple scripts that are just, you know, trying to check every single server, every single IP address online Yep. To see if it's vulnerable to take it over. Mhmm. What what I think has changed is the rate at which attackers can figure out what they do when they find themselves in an environment. So about a year ago, there was a very, very, very popular plug in that plugged into Salesforce that got compromised by a Russian hacker. And it was it was so broadly deployed that it effectively gave the Russian hacker access to a huge portion of Salesforce's infrastructure and Salesforce's customers. But what was interesting was when you actually studied what the attacker did, they clearly... Like, they they weren't in enterprise sales. So they didn't really know how Salesforce worked. Sure. And so they kind of bumbled around like not quite knowing what to do or the fact that they'd stumbled on what was an incredible treasure mine. And as a result, what could have been just a disaster of a hack wasn't nearly as bad. What we're seeing now is if that same hack happened today, the attackers are using AI to say, okay, I found myself in Salesforce. What what stuff should I go, you know, looking for or stealing or trying to do? So the ability to very quickly, you know, figure out I'm here. What what what can I take advantage of, You know, is gotten there? What we're not seeing yet are, you know, I think that the example out of OpenAI with the hugging face compromise, I mean, that again makes, I mean, it's almost out of science fiction, some of the things that are happening there. But I think the good news is that the cost of running that type of Intact, an agent swarm like that is still extremely expensive. Hundreds of thousands, if not millions of dollars for that. And so an organization like, you know, OpenAI that's got those resources, the good guys have more resources than the bad guys. Yep. And so for now, I think you're you're actually seeing kind of a very naive use of AI by by at least the sort of typical cyber criminal.
00:13:40 · Matthew Prince, Jordi Hays, John Coogan
He's probably different when you're looking at nation state actors. I think that if you if you look at China or Iran, the NSA in in The United States, like, that... That's a different case. But but right now, I think that AI is actually helping the good guys more than it's helping the bad guys. Yeah. We're finding the monsters that are hiding in the closets and... [00:14:01] S1: What advice would you... So over the last week, we had open... Like, a open code ran into issues and reported being, like, attacked for basically days on end. Obviously, the attackers were going after the... [00:14:16] S0: It was token theft. [00:14:17] S1: Yeah. Effectively token theft. [00:14:19] S0: It's the modern version of... [00:14:20] S1: Railway. Railways had had massive issues over the last twenty four hours. I know of another big inference provider that has been, like, under attack and, like, viscerally feeling that for the last three, four days. Wow. And that that that people... That everyone And would [00:14:39] S2: this is... And what this is probably... What a lot of these are symptoms of are the attackers are like, wow. We could do a lot more if we had more compute, if we had more AI models. And so stealing tokens [00:14:50] S1: Yeah.
00:14:51 · Matthew Prince
[00:14:51] S2: You know, hacking inference providers, That... That's that's giving them access to tools. We... You know, you'd see this before. Like, it's... For a long time, Cloudflare was an Okta customer, and Okta kept getting hacked over and over again. And the reason why... And Okta was an identity provider. I mean, the the reason why was they were going after us and they were going after Coinbase, which is another another one of their one of their customers. And again, I think you... The attackers are trying to find their way to whatever is valuable that they can that they can get to online. And and I think right now, the ability to have more inference, more tokens is something that attackers are very much longing for. And so they're going to go after a bunch of those providers. And then to your question of what to do, like you got to just stay up on all of the security patches that are out there. You know, my... I I don't know the the the details of, like, the railway attack, but my hunch is it's probably based on one of these, you know, latest vulnerabilities that was out there. And so it's just, you you know, they... You talk about like an ODA loop, which is like how quickly you can adapt versus your attacker. And so at Cleflo, we're just sort of saying how can we make that ODA loop faster and faster and faster and faster so that we can adjust incredibly quickly. And part of that is using AI tools and using things that can actually proactively you know, have a swarm of defenders that are looking out for the swarm of attackers. And and that's that's exactly what we're doing at at Cloudflare and what we're doing for all of our customers.