The PHP Bug's Stunning Consequences + Cybersecurity's Black October — With Alex Stamos

0:00 This has been about the craziest 30 days or so in the history of our industry of cyber security. and so PHP is what's catching the headlines. but for people to do this professionally, there's actually lots of stuff that's happened just in the last couple weeks. so the PHP bug specifically like you said, PHP is a very popular language for writing websites easily. So very few kind of enterprise quality websites are are written in PHP. the interesting counter example is Facebook. Although Facebook doesn't actually use real PHP, they use a typed version of PHP called hack. but other than that, it is very hard to think of like a big company that uses PHP for a banking website or a big application or something. That being said, it's extremely popular for companies to make side projects, right?

0:52 Here's my marketing site. Here's a a a smaller application. It's extremely popular in a number of frameworks and hosters like WordPress that host lots of sites and so it is still very widespread. the bug was found by a in a a project that was being run by OpenAI called Hack the Planet in which they have been providing their >> Yeah, exactly. right. that is marketing. I'll agree with Ron John on that one. but there's been as we talked about actually on stage at your conference there's a lot of controversy about the access to the best cyber capabilities from the two big Labs OpenAI and Enthropic who at differing levels restrict the ability for people to use their software to do vulnerability research. And so to as a response to that they both companies run these programs where approved people have access to use their models to go find bucks. This was part of this where they were actually giving this away to free to bugfinders a company called Califf which is a kind of excellent security consultancy that does a lot of AI enabled vulnerability research. They used it to find the PHP bug. and then that was actually several months ago and there's been a coordinated effort by a bunch of companies to try to get ahead of this issue of what's called coordinated disclosure. It went kind of off the rails in the last couple days, however, before the release in that whenever you do these coordinated disclosures, you start obviously with a small circle and it gets bigger and bigger and bigger and it started to leak out and we now have evidence that bad guys started exploiting this well before the public release. there was a controversial dump by the CEO of Changguard, which is a company that will make their own patches and push them to customers. but looking back, he might have been in the right. It's it's it's a little bit controversial.

2:45 There's a big discussion. Anyway, the bug is a big deal because it is a pre-authentication remote code execution. So, means you do not have to be part of the web app, right? So, there's, you know, there's been a bunch of web app vulnerabilities where you need to be logged in or you need to be accessing some kind of functionality. This just works on the front end and it's remote code execution. It is not an incredibly easy exploit to write. It turns out to be quite a complicated issue, but people have figured it out probably with AI. And so, >> so that that just means that I just visit the site and my stuff could be could be jacked.

3:16 >> what it means is as a bad guy, you could just connect up and attack the system without having a login and without having special access. So, even if the PHP site the front page says login here, you can't access anything else, you're still vulnerable and you can't fix the bug without patching PHP which is under your web code. They only released a patch for the latest family of PHP and there's a lot of PHP sites on older versions and so upgrading to that breaks your site. So it's not just as easy as going in and saying, you know, run your update program, whatever your operating system is. For a lot of companies, they have to actually refactor their code to be compatible with the latest version of PHP8 because it was not backported. There turns out to be some like unofficial backports and patches that you can get. but that those are not w as widely available.

4:11 >> So what does that what does that mean in terms of the vulnerability of every website that has been built with PHP in terms of the hacker can just take it down. They can access actual underlying databases. they have like full access to whatever is in terms of the in their whole stack or >> they take over the computer >> at the same level as the web server is running which by definition has access to all of your data. Right? So what has been happening since just a little bit before the announcement is when you have a bug like this, you have a bunch of different bad guys go out and try to break into as much stuff as possible and then they'll figure out later what they actually care about. and so what we've been seeing is automated exploitation of hundreds of millions of attempts to break into millions and millions of websites that are going on continuously. So these will be Russian ransomware actors who will like to take these things over, install malware and then figure out who they want to actually ransom. It is probably what is called the Chinese cottage access industry. So there are within China there's effectively like an eBay for hacking. and so there's there's providers in China that will break into a huge number of sites. We've seen this with other bugs and then they will later sort through and then figure out who they want to sell access to inside of the PRC. there is probably the >> our eBay is is vintage sweaters and their eBay is ransomware and your computers. Yeah, it it's not quite like a a full eBay site from my my understanding, but like there's basically an ecosystem here and it's quite smart because in other countries like Russia, you have this problem where if there's a desire to hack something, everybody rushes in and they all step on each other's toes. So the PRC has the ability kind of ddup taskings for their private access industry. So anyway, I expect that those people, we have seen this in the history like there was a very famous SharePoint bug in Microsoft where these Chinese access vendors broke into something like 80,000 SharePoint sites that were on the internet and then sold them later to Chinese companies. so and then these guys break in, they plant malware and then sometimes what they do is they actually fix the bugs so nobody else can do it. What we have seen in the past is you'll have them fighting over control of these systems. So whoever gets there first, part of one of the things they have to do is close the door behind them. Otherwise, other people will break in, remove the malware from the first hacker, and then patch it themselves.

6:31 And so that is effectively what's going on right now is you've got dozens or hundreds of hackers of hacking groups attacking tens of millions of websites and trying for control. And then in the long term, what you'll see is they'll then have their list of this is what I control. And they'll search through it of like, oh, these are government websites. is a hospital like what is the interesting stuff that now that I have control of it and I have malware there I'm going to actually steal data or or do a ransom. So, so by control, just so I understand it correctly, it's you control as users are entering information into the website, you're receiving all of that. But does it but does it also mean you then have access to anything else like in the back end or it's it's both? You will have access to what is happening live but also probably everything in the database. and so and then it also gives you a foothold inside the organization. So you're now behind the firewall. You're in their production network. And so you can you've got your first foothold inside of their network.

7:34 You can use that to maybe break in deeper. So that that will this is just the start for the PHP bug. This is the initial access vector. There will be some of these attackers are probably breaking in and then just dumping the entire database out so that they can ransom. They can just use the data. That's probably what they're doing. Yeah. Yeah. It's just like you just copy it all and then you figure out later what was interesting. 95% of it is going to be useless. 5% of it will be gold.

7:58 and then some of them will say, "Okay, great. Now that I have a foothold inside this company, I can use this to scan the rest of their systems, find other vulnerabilities, and go automatic." The other thing that I I don't know, I don't have any good statistics on where we are. But in some cases, they are also using AI to do the attack, which means the traditional I have to wait doesn't really exist because you can just have your AI agent go do the rest of those steps automatically. that from what I've heard is not as widespread, but that is going on in other situations that we can talk about. For example, a Chinese group broke into a bunch of South Korean bakes with completely automated AI attack chains. and so in this case, if you have that that attack system set up, you could use this to pivot inside of the network to go to different systems.

8:47 Alex. so just going to give some stats that Matthew Prince from Cloudflare gave in the 10 hours before it was publicly announced. This PHP vulnerability across the Cloudflare network, we saw thousands of attempts to exploit it. That jumps to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours and millions now. So this is certainly leading to, you know, a ton of hacking attempts. just just explain it for us like if you're not like cyber security brained what do you think the next couple months are going to look like you know once you know obviously the damage is being done as we speak but this is one of those things that it'll be latent until it starts to emerge. So what do you think the next month two months 3 months 6 months are going to look like as a result of what we just saw.

9:31 >> So first off it is now basically impossible to get a instant response company to respond to you. So B anybody qualified was already booked before this. So you'll have a bunch response. >> Yeah. What's in instant response? >> Instant response. So like like a forensics firm to help you do this work, they were already basically completely booked because of everything else going on before this. So if you are a big company and but you don't have a team that can do your own instant response, you're in real trouble here because it will be very hard to get a Mandant or CrowdStrike or Sentinel One or any of the other companies that do this work to respond quickly. So first off, you're going to have lots of people trying to either do their own forensics or to recover by themselves. we will see the breach notifications are going to start happening for the companies that actually have good security teams because they will hopefully have detected that this happened and then they will be able to do their own forensics. But that is going to be spread over a significant amount of time because there's going to be a lot of people who patch it and don't realize that within the 48 hours it took them to patch, somebody got a foothold. And so then we'll see these secondary breaches over the next months as attackers now use that foothold to go deeper and deeper inside these companies. for you know ransomware actors they want to get paid. So in those cases they will contact those companies and ask for money. For the government actors we won't hear anything unless there is some kind of interesting research that finds their attack servers or something like that. And so what you'll see is just a huge amount of data is leaving these companies. a huge amount of customer data. we're also going to see a huge problem if everybody's password just got stolen, right? So, the the number one way any individual human is hacked is that they use the same password on multiple websites. And what we're about to see is in the dark webs where these are sold, you're going to see these dumps of tens of millions of passwords being sold over and over and over again. And for a a disturbingly large number of people, that is going to that password is going to work from their email. It's going to work from their >> their bank. Yeah. especially especially if you get access to somebody's email, their life is over because then you can use that to reset almost all their other passwords. and so we're going to see a ton of kind of individualized fraud, spam, that kind of stuff is all going to hit a new high over the next six month >> when we So go ahead.

11:50 >> What do we do as everyday simple folks who are just logging into our bank accounts and emails and what do we do? I mean, use one password. What what what do you recommend? >> Yeah. So, for for normal folks, there's nothing you can do to actually stop the breaches. So, what you need to do is you need to make sure you're using a different password on every single website. The easiest way to do that is a password manager. One password is one I like. There are other ones as well.

12:20 so, you need to install a password manager. And now if you've got that, you know, the name of your cat 123 was your password, then every site that you're using that on, you need to now change it. >> my my Pebbles 123 password is now exposed. Goodness gracious. >> Yes. Yes. There you go. so you got to do that. you should just be very I think what's starting is we live through this era where people just kind of assume things were secure. That was never true, but it kind of worked because the number of attackers that were finite basically was right was finite. And so if you just kind of blissfully walked down the street through a bad neighborhood, you just got lucky over and over again. Well, the neighborhood's gone really bad. we've gone from like, you know, a a bad neighborhood in LA to like you know, Somalia 1990s, right? like it we have it is completely the threat profile has completely changed of what is the likelihood something bad is going to happen to you if you are walking down the street and so I think people are just going have to be much more paranoid obviously there's a password thing they're going have to be much more paranoid about what websites they use like people just throw their personal information everywhere login everywhere and you're just going to have to you can't really do what we call vendor risk management as a normal person of asking them lots of questions but you can get a feel of like is this fly by night forum from the kind of thing I want to put my personal information in. And I think what even normal people will start using sock puppets, right? So people will start creating secondary Gmail accounts for all the crap stuff they do and then they'll have their important account for their bank and all that. and you're going to want that secondary thing to be as disconnected from your real identity as possible. And I'd be looking out for frauds and scams, right? The number of spam is going to go way up. You're going to get way more texts and emails from people you know asking you to click something. people are going to be getting phone calls because all this directed graph information about who knows whom and their phone numbers have all been leaked and so you're going to get a lot more of the bad texts and the phone calls of like that are all AIdriven now of you know your grandchild's been kidnapped and all that. like people are just going to have to just be much more paranoid going forward and and I think we can talk about this but I I think unfortunately this is probably the new normal for several years where the pace of crazy things that have happened in the last 30 days might be this might be up here but we're not going back to the baseline. It might drop a little bit, but it is possible we are now at a a heightened level of kind of operational tempo for bad guys and for defenders for at least several years.

15:01 >> And briefly, what's it going to mean for corporations and governments? So the consumer level we got down for the for the big guys, what what's going to happen to them? >> Yeah. So on this I'd like to expand it a little bit because the PHP bug is a big deal but just to make it clear on the same basically within 24 hours of the PHP bug there was a a large number of node flaws so NodeJS is also a popular web application server framework and is much more likely to be used by enterprises. Now the fortunately the bugs there are more complicated and to exploit but they are significant.

15:33 we've had a bunch of breaches over the last couple weeks. there was a certificate authority that had their certificate stolen. So kind of a a not so great certificate authority. These are the people who the little lock icon in your browser. They're the ones that make that work. And if somebody steals those certificates, they can create certificates. They can create an Amazon certificate or Google certificate that is also trusted. It's a little more complicated than >> it's Yeah, it's PHP, Node.js. This is from X. So you can tell us if one of these are wrong. Java, GitLab, Railway, Signal, WordPress, Light LLM.

16:08 They're calling it Black October. >> Black October. Yes, it is. It is it is spicy. I mean, this is what we talked about on stage. Like this is this is the start of the takeoff of what the new normal is going to be based upon just the number of vulnerabilities are being found, but then also the operational tempo that attackers are able to stay at going forward. those all those breaches you're talking about. So like railway fireworks those are almost certainly not PHP. So that is just attackers being good at their jobs and that being enhanced by AI >> finding API keys for everything you built on railway which I did insecurely myself on some side projects in the past. So I went back and yeah yeah >> same with fireworks. So there's a lot of attacks against infrastructure ingredient companies where you see and that is why I expect those attacks are professionals that is not like a 19-year-old that is probably somebody working for a commercial like a a commercial vendor who's doing state level work because folks are breaking into people who are important in the AI ecosystem neoclouds you know hosting providers and then once you have those API keys you can turn around go back to the cloud so user enterprises So enterprises are dealing with PHP right now. They're dealing with Node.

17:24 they are asking all of their vendors what they're doing, right? So I have to I keep on having to fill out these send these emails saying we do not have PHP at this company. but we did have Node. Everybody does and but we fixed it as quickly as possible. what you know companies are like kind of panicking for their vendors for themselves. What this is reminding them is they probably have a lot of stuff they didn't know about.

17:53 Like a bunch of these PHP sites are like somebody set up a website for a conference they held two years ago >> 2011 or something. Yeah. Yeah. >> Yeah. Exactly. And and if you architected things correctly, then if you pop that, nothing bad happens. For too many organizations, once you're there, you're in a DMZ with a bunch of other servers that you can now compromise. or there was a bunch of data there that now you have to do forensics because you had the registration lists. for everybody who went to your conference that just got downloaded. You're going to be ransom for that or it was downloaded for a state actor who's going to use it for you know future whatever use and now you're going to have to do a breach notification. So there's a bunch of companies that are realizing that their attack surface is actually much larger than they expected because of all of this random crap. A lot of which is actually in the cloud. that makes it hard for them to pull together and say you know this is our perimeter >> and governments like I saw the NSA the NSA was talking about this.

18:51 >> Yeah. I mean NSA published SISA published something. so yes it is a big enough bug that you have the US government unfortunately the the number of people who do defensive cyber in the US government has gone significantly down in the last couple of years because SISA was kind of decimated by political you know political appointees who don't like the idea of SISA doing election security stuff. and this is showing now the outcome of that which is we really need competent people in the government to help coordinate response to things like this.

19:26 >> Okay. Even though I am absolutely terrified right now, I'm still going to ask one level above that I'm I'm wondering about. So everything we've described so far is still again purposeful coordinated attacks to exploit leveraging AI to increase the velocity of these attacks. I still then there's still the entire world of and then there's reports on banking like unsupervised agents potentially acting autonomously. Obviously the hugging facing the scandal seemed to be more around agents going rogue as opposed to people controlling them in nefarious ways. Like is that yet another layer we need to worry about or do we have to worry about? Yeah.

20:06 >> Yeah. That's just I mean so those are two totally valid but completely separate issues. You've got the agents escaping during evals and training that is going to be I'm not going to say solved but the industry has done a lot to reduce that. A lot of things you've been hearing announcements are stuff that happened in the same air same time as hugging time frame as hugging face. It's just it's all coming out now. still it's all kind of leaking out.

20:31 you know maybe that will happen every once in a while but there's been a lot of changes in the way people do these evals and training. that is not like an actual I think that is not an act like open AI's models going crazy and hacking >> you is not actually the threat that people should worry about. the other side is yes we are people using agents and then being like hey here giving instinct or muse here's my entire one password go like handle my finances for me go file my taxes is totally insane with my head in shame I did >> but people are doing that right people are absolutely doing that and and so that's what the banks are talking about is that they now see all of these >> the these interactions with them that are are authenticated correctly So they're not stolen credentials but are clearly bots doing interaction and u one of the reasons instinct has a ridiculous valuation from my perspective. but one of the things they did that that made them popular is they actually figured out ways to defeat all a bunch of the automated bot detection mechanisms from these companies. And that's why Instinct is useful because it will effectively bypass the safety protections that are in place at these companies to keep you from doing exactly what you're doing, which is to have your bot interact with the most important parts of your life.

21:50 so that is so you have this you have this crazy tension where you have like the banks and big tech companies and you know financial institutions and folks who are like I am going to do everything I can to prevent automated access to my systems on behalf of customers and then you have this big demand from customers of I want my life to be easy so I'm just going to turn over all my my loginins and personal data to a company that's existed for six months.

22:16 >> I just want to end with this. there was a Nikita Beard tweet who he said former head of product at X. He said there's nothing to worry about. Nothing important is run on PHP or old software except the water and electrical grid, a few government services like our missile defense systems and a handful of electrified fences at the zoo specifically for the lions tigers and the cobras. So folks, if you do see a lion walking in your neighborhood this weekend, just understand that the origin was OpenAI's hack the world program.

22:44 >> Yeah. Hack the planet and Okay. The planet. >> The planet, >> which is a reference to the that hackers movie from the '90s. I I don't know. I This is another reference. I I can't make these references at work anymore because now I work with a bunch of 25 to 30 year olds. and I can't make any '90s references. literally I had I mean there's like multiple employees at Cognition who were students of mine at Stanford and one of them called me professor and it was like the scene from you know Indiana Jones where you know becomes a keeper immediately. Yeah. but I can make it with you guys. You guys are closer in age to me. But yeah, >> Angelina Jolie was in the Jolie was in that. Yeah. I remember that was like what computers were supposed to be in the >> Yes.

23:26 >> when hackers were Yeah. >> Yeah. And they're hacking culture. Yeah. Yeah. Yeah. >> There's a lot of neon. It's pretty fun. It's a fun movie. A lot of people watch it like in parties at Blackhand Defcon. But okay, to open AI's credit, like >> the the truth is is this bug has existed for a decade. A bunch of the bugs that enthropic and open AI are either fixing themselves directly or are facilitating the fixes of are issues that have existed for decades that have always been waiting there. And so there are people I I just want to push back on this because there's people in X who are like blaming anthropic and open AI. And the truth is these bugs were there and it is very hard to fix a open-source product like this that is so widely distributed. this was handled as well as it possibly could be and it was always going to be bad.

24:12 And if OpenAI and anthropic were not doing this work, these bugs would be discovered. So I've got my M5 Studio Max finally came. I'm running a obliterated quantized version of GLM53 and wow like the stuff I feel like a much younger man with the reverse engineering I can do, the exploits I can write, the things I can do now on a Mac Studio that leaves absolutely no logs. And so these bugs were going to be found by the openweight models, the Chinese models.

24:39 Somebody was going to find them. We have to fix them. And the only way through this of the two years or or three years or five years of dark ages we're going to go through is to find bugs and fix them. And then also we're just going to have to rewrite a huge amount of software. That is we can't have these applications written in like type and memory safe on languages languages by humans. We're going to have to refactor the whole thing. And the good thing here is that would have been absolutely impossible 5 years ago. Now it is totally plable, right? Like that's actually a big part of our business at Cognition is helping big companies refactor stuff.

25:13 you know, and there's all these examples of like some old SAP based software that was rewritten in eight days and such. And so you could do that, but it takes money. It takes time. It takes access to the best models. and it takes kind of a a willingness on behalf of the entire open source community to throw away the old stuff and to replace it with something new. And so I think that is one of the things that might come out finally. This is something I've been calling for actually for a while is like we just need to rewrite a huge amount of the software that underlies the internet. maybe finally there will be the billions of dollars necessary in both money and tokens thrown into a pool here so that that can get done.

25:51 >> Right. Last week my biggest worry was the honeypot. So it turns out I was not anywhere prepared for where we would be this week. >> The the good oldfashioned human honeypotss. Actually we're going to look back nostalgically as >> Exactly. Yeah. Exactly. >> Yeah. Well, those are hard to copy with with AI >> AI >> for now. Alex, it's always great to speak with you. you know, you've been here with us through thick and thin through the year. and as the the stuff keeps hitting the fan, we'd love to keep speaking with you. So, thanks again for coming out.

26:21 >> Yeah. Feel like this won't be the last time we chat. So, unfortunately, the Grim will be back. >> Oh, god. All right, everybody. Well, have a very comforting weekend. Thank you, Alex, and thank you, Ranjan. We'll see you next time on Big Technology Podcast. Stay safe.