PHP flaw: How AI just hacked an unhackable part of the internet | About That — Transcript

Full transcript

1. 0:00Ah, PHP, where the P stands for PHP.
2. 0:04No, really. That's actually what the
3. 0:06first P stands for. But, never mind that
4. 0:08because more important than this stupid
5. 0:10factoid you will never now forget is
6. 0:12knowing that PHP is a critical piece of
7. 0:16what most of the internet is built on.
8. 0:18And that a critical flaw in PHP is now
9. 0:21public knowledge.
10. 0:22>> There's an urgent warning tonight for
11. 0:24organizations to install [music]
12. 0:25critical security updates to protect
13. 0:28websites around the world under threat.
14. 0:30>> This is all after a major security flaw
15. 0:32was found in a programming language that
16. 0:34runs much of the internet.
17. 0:36>> Now, I'll get into more technical detail
18. 0:37in a moment, but this newly discovered
19. 0:39bug in the internet found and powered by
20. 0:43AI is so serious that many of the
21. 0:46world's biggest companies just decided
22. 0:48going offline, unplugging from the web,
23. 0:51might just be the safest thing.
24. 0:52Cybersecurity companies have tracked
25. 0:54millions of hacking attempts now that
26. 0:56this exploit is in the wild. And what we
27. 0:58don't know right now is how much damage
28. 1:01was done when this exploit leaked but
29. 1:04before it could be fixed. In fact, there
30. 1:06are almost certainly parts of the
31. 1:07internet that still aren't fixed even as
32. 1:10you watch this video. So, it's open
33. 1:12season for hackers and a race for
34. 1:15defenders in what experts are calling
35. 1:17one of the most severe vulnerabilities
36. 1:19of its kind, quite possibly in all of
37. 1:23software history.
38. 1:29PHP is just a programming language and
39. 1:33organizations run it on their own web
40. 1:35servers to basically fetch information
41. 1:37when someone online asks for it. So, for
42. 1:40example, let's say you want to know
43. 1:42which is the correct orientation for a
44. 1:44toilet paper roll. Paper comes out over
45. 1:47or under. So, naturally, you go to
46. 1:49Wikipedia to look it up. You type in
47. 1:51toilet paper orientation and completely
48. 1:54as expected, you get a remarkably
49. 1:56detailed breakdown including a reference
50. 1:59to the original toilet paper holder
51. 2:00patent. PHP is how a server processes
52. 2:04your request, gets you what you need,
53. 2:06and then generates that webpage before
54. 2:09it reaches your browser. And just to
55. 2:10make my point clear here, PHP is part of
56. 2:14the foundational architecture of how
57. 2:17websites work at all. It's not just
58. 2:20software, it's also the very language
59. 2:23that such software understands. And it's
60. 2:26that elemental nature of PHP, how it's
61. 2:30embedded so deeply in so much, which
62. 2:32begins to explain why this flaw that
63. 2:34they found in PHP is estimated to affect
64. 2:3870% of the internet.
65. 2:40>> There are government websites, there are
66. 2:42websites that are used for shopping
67. 2:44enablement, WordPress uses it, [music]
68. 2:46Wikipedia uses it.
69. 2:47>> I struggle to think of another
70. 2:49technology today that's as widespread or
71. 2:51impactful and used across the planet in
72. 2:55our tech stack. We all think Mac,
73. 2:57Microsoft, Google, but PHP, it's the
74. 3:00giant sitting below everything.
75. 3:03>> It's not really an exaggeration to say
76. 3:05PHP is a backbone of the web, part of
77. 3:07this invisible infrastructure that makes
78. 3:10it all tick. So now let me show you
79. 3:12what's broken about it.
80. 3:15>> [music]
81. 3:19>> So the most urgent part of the story
82. 3:21starts with a cybersecurity company
83. 3:23called Wiz, owned by the same company
84. 3:25that owns Google. They used the
85. 3:27processing power of the most advanced
86. 3:30large-scale artificial intelligence
87. 3:32models and systems available to see if
88. 3:35PHP had a weak spot. What they found,
89. 3:39I'll admit, is very technical, and I can
90. 3:42give you one example just to show you
91. 3:44what I mean. This bit here about remote
92. 3:46process memory disclosure. So it's
93. 3:49talking about how PHP handles RFC 1867
94. 3:54multipart requests, which are a type of
95. 3:57file upload, before normal module
96. 4:01initialization has completed. So,
97. 4:04the server is managing the upload and
98. 4:07doing a few other related things at the
99. 4:08same time. Like a waiter taking orders
100. 4:12before the kitchen staff are all set up.
101. 4:14This is normal. And when this bug report
102. 4:16talks about publishing a session ID,
103. 4:19that's like the waiter writing your
104. 4:21order down on a ticket.
105. 4:23But, here's where it gets complicated,
106. 4:25where an out-of-memory error can abort
107. 4:28the request before cleanup completes.
108. 4:31PHP then destroys the request heap and
109. 4:35may leave the session ID pointing to the
110. 4:37freed allocation, and then we have this
111. 4:39bit about PHP trusts the stale pointer
112. 4:43and ultimately grants unauthenticated
113. 4:45disclosure about things outside the
114. 4:48attacker's request.
115. 4:50What the heck does that mean? Well, if
116. 4:52we return to our waiter analogy with
117. 4:54you, the customer, as the hacker, the
118. 4:57waiter's writing down your order, but as
119. 4:59the person trying to break the system,
120. 5:00you just don't stop, and you somehow
121. 5:04manage to bamboozle him enough with
122. 5:06enough weird stuff that he's got to put
123. 5:09everything down for a second, and he
124. 5:10tells you, "Okay, wait. Stop. Let's
125. 5:11start again. This is too much."
126. 5:13But, then, in the confusion, his orders
127. 5:16are getting mixed up. And as you place
128. 5:18your new order, he's trying to make sure
129. 5:20he gets it right, reading your new order
130. 5:22back to you, except mixed in there are
131. 5:25elements of your old order, and maybe
132. 5:27even the orders of other customers that
133. 5:30have nothing to do with you.
134. 5:32His tickets,
135. 5:34his very memory, is mixed up. That's the
136. 5:36sting of this bug. We demonstrated
137. 5:40unauthenticated disclosure of live
138. 5:43worker memory containing data from
139. 5:45outside the attacker's request.
140. 5:48And the way experts at Wiz put it, that
141. 5:50memory may contain passwords,
142. 5:53authentication tokens, API keys, and
143. 5:55certificates belonging to other requests
144. 5:57or the server itself.
145. 5:59>> So, imagine it's a a government website
146. 6:02or bank website, and so now you can
147. 6:04listen in and gather things like
148. 6:06passwords and and usernames or even
149. 6:10take control of accounts. So, it is a
150. 6:13whole bunch of headaches
151. 6:15all at once.
152. 6:16>> In the industry, we call it god-like
153. 6:18access, which is obviously the last
154. 6:20thing you would ever want if you're
155. 6:21running a government website or a
156. 6:22financial services or a healthcare
157. 6:24website or anything involving private
158. 6:26data that you don't want to get out or
159. 6:28systems that need to be available to
160. 6:30their communities 24/7/365.
161. 6:33>> And this is just one of several bugs.
162. 6:35There are others, but that all fall
163. 6:38under the same general weakness [music]
164. 6:40of how an attacker can overload parts of
165. 6:43PHP memory without needing [music] any
166. 6:46kind of credential at all. And then use
167. 6:48that confusion to give them access to
168. 6:50things that they shouldn't be seeing.
169. 6:51And on some levels, just to go back to
170. 6:53the waiter analogy, these loopholes can
171. 6:56even allow the attacker to throw away
172. 6:59other people's orders or worse, write
173. 7:02new ones for the waiter to fulfill.
174. 7:04>> Imagine being [music] able to go into a
175. 7:06website, going into a database, and
176. 7:08putting misinformation, changing [music]
177. 7:10information within a corporate corporate
178. 7:13environment. That could have equally
179. 7:15devastating results.
180. 7:16>> In the same way we have standardized
181. 7:19ways of measuring the magnitude of
182. 7:21earthquakes or the power of a hurricane,
183. 7:24we also have what's called the CVSS or
184. 7:28the common vulnerability scoring system,
185. 7:30which is basically a way of rating how
186. 7:33severe a software or system
187. 7:35vulnerability is. These PHP exploits
188. 7:38have a severity reaching 9.2 out of 10.
189. 7:42Some security firms even actually rate
190. 7:43them a perfect 10 out of 10, which means
191. 7:46a bad actor can crash the system or
192. 7:49hijack it, wipe data, change it, steal
193. 7:52[snorts] it. And exploiting this
194. 7:54vulnerability was only made possible
195. 7:57with Frontier AI, basically the most
196. 8:00powerful AI systems available today.
197. 8:02>> It was AI that allowed
198. 8:06analysis of the millions of lines of
199. 8:09code that make up PHP to find where that
200. 8:12weakness was. If we relied on humans to
201. 8:15do that kind of analysis, it would take
202. 8:17hundreds of years to get to that point.
203. 8:20>> Yeah, because the bug only works when
204. 8:22it's chained with multiple other bugs,
205. 8:25the outcomes of which can all vary
206. 8:27widely depending on which PHP version
207. 8:29you're running, how it's configured.
208. 8:32Exploiting the bug is like solving a
209. 8:35maze where every move you make changes
210. 8:38where one of the walls is. Solvable, but
211. 8:41maddening to do so. Just to prove that
212. 8:43point, the underlying vulnerabilities
213. 8:45being exploited here are so arcane and
214. 8:49complex, they've apparently been there
215. 8:52for decades, but nobody could figure out
216. 8:54how to actually use them until
217. 8:57AI.
218. 8:58And now,
219. 9:00there's just one more problem.
220. 9:06You know, there's a way of looking at
221. 9:08all of this as a good news [music]
222. 9:09story, right? After all, it was the good
223. 9:12guys, the defenders, who found the
224. 9:14exploit and are trying to patch it up.
225. 9:17It's just that they haven't quite
226. 9:18finished patching it up yet. They've
227. 9:21been working quietly for months, since
228. 9:24the summer, to create a fix that they
229. 9:25could then distribute in an orderly,
230. 9:28large-scale way. Then, the plan was to
231. 9:30tell the general public about it.
232. 9:32Except, it all leaked before they could.
233. 9:35>> So, one of the research firms that was
234. 9:37doing original work on this
235. 9:38vulnerability accidentally leaked a
236. 9:41video that they had done of them proving
237. 9:43the concept that this bug works. That
238. 9:45showed people that this vulnerability
239. 9:47can actually be used to get into
240. 9:48systems. It's not just that it's a
241. 9:50theoretical problem.
242. 9:51>> Multiple stories right now about who
243. 9:53leaked what. We're seeing others
244. 9:55accusing some vendors of jumping the
245. 9:57gun. Basically, the coordination fell
246. 10:00apart on this.
247. 10:01>> So, now you have a new way of
248. 10:03understanding what I showed you at the
249. 10:04very start. Why companies, even
250. 10:07governments, have panicked pulling down
251. 10:09their websites, which right now feel
252. 10:11more like sitting ducks. Why hackers,
253. 10:14even now with a patch available, are
254. 10:16still trolling the web looking for
255. 10:18targets that haven't yet gotten the
256. 10:19memo. And it's why these attempts to
257. 10:21break in were already happening even
258. 10:24before the wider public ever caught wind
259. 10:26of the story to begin with. So, it's a
260. 10:29real-time race. AI being used to
261. 10:32discover and close off these
262. 10:34vulnerabilities, while also being used
263. 10:36to hack the unhackable, to break into
264. 10:39systems that no human or even team of
265. 10:41humans could do before. What's unnerving
266. 10:44about the whole thing though is that
267. 10:46even the patch that closes this loophole
268. 10:49may not be enough. It's like when
269. 10:51squirrels chewed their way into my dad's
270. 10:53house years ago.
271. 10:54You can patch the hole, but you still
272. 10:56have squirrels.
273. 10:58It's impossible to know not just if
274. 11:00hackers are finding their way into
275. 11:02systems through this PHP exploit, but
276. 11:04even what are they doing once they're
277. 11:07inside? Is it a smash and grab that
278. 11:09we'll know about right away? Or are they
279. 11:12planting malicious code that works
280. 11:14patiently? Is it possible that they're
281. 11:18creating other weaknesses that we may
282. 11:20only learn about much later?
283. 11:25>> [music]