The Internet Is BREAKING… And It's Only Getting Worse? — Transcript

Full transcript

1. 0:00Hello world. I'm an unemployed ex big
2. 0:02tech software engineer with 25 years of
3. 0:04experience in tech. So over the last
4. 0:07couple of days there has been a literal
5. 0:09tidal wave of security vulnerabilities,
6. 0:12hacks, breaches, and other incidents.
7. 0:14It's gotten to a point where I feel like
8. 0:16the entire internet is under attack and
9. 0:18is in the process of being taken down.
10. 0:20Now let's start with the biggest
11. 0:22vulnerability, right? And that is the
12. 0:24set of PHP to shell issues. So
13. 0:27apparently a couple of security firms
14. 0:30with the help of AI, they found three
15. 0:33critical vulnerabilities within the PHP
16. 0:36runtime. Now PHP is a really old
17. 0:40language. It's more than 30 years old.
18. 0:43It came out right around the time when
19. 0:45the internet was booming. And because of
20. 0:47this, PHP was used to build much of the
21. 0:51modern internet. Everything from
22. 0:52nonprofit organizations like Wikipedia
23. 0:56to enterprise content management systems
24. 0:58like Drupal to e-commerce platforms like
25. 1:01Magenta and even blogging platforms like
26. 1:04WordPress. PHP is used across the entire
27. 1:07internet. Something like 70 to 80% of
28. 1:10all websites across the web, they use
29. 1:13PHP. So these three critical
30. 1:16vulnerabilities,
31. 1:18they're all remote code execution or rce
32. 1:22vulnerabilities. Basically, attackers
33. 1:24can send HTTP requests to a website
34. 1:28that's running on PHP and under specific
35. 1:31situations, they can gain direct access
36. 1:34to the underlying server that's hosting
37. 1:37this website. access as in the ability
38. 1:39to read files on that server's file
39. 1:42system, the ability to read databases,
40. 1:44the ability to execute code on that
41. 1:47server, the ability to access the
42. 1:49internal networks that that server is
43. 1:52part of, and so on. Apparently, these
44. 1:54vulnerabilities have been hiding within
45. 1:57the PHP runtime for like the last 20
46. 1:59years. It took powerful frontier AI
47. 2:02models like chatgpt 5.6 6 and Gemini
48. 2:06Argon to uncover these vulnerabilities.
49. 2:09This then triggered a Mad Max style
50. 2:11race. Hackers rushing to exploit these
51. 2:14vulnerabilities while exhausted IT teams
52. 2:17scrambled to patch their systems before
53. 2:20they get compromised. This whole
54. 2:22dumpster fire situation, it reminds me
55. 2:25of a similar incident that happened
56. 2:27about 5 years ago, right before
57. 2:29Thanksgiving. So 5 years ago this
58. 2:32critical zeroday vulnerability called
59. 2:34the log forshell vulnerability it put a
60. 2:38huge number of Java applications under
61. 2:40the risk of being hacked and taken over.
62. 2:43Now due to various reasons I was the
63. 2:46only available chief architect within
64. 2:48the business unit of my old big tech job
65. 2:51at the time. As such dealing with this
66. 2:53disaster it fell on me. So I called an
67. 2:56emergency office hours, an office hours
68. 2:59meeting with the architects and tech
69. 3:01leads of like a hundred application
70. 3:03squads. It was a ridiculously stressful
71. 3:06meeting. Our brand new CTO of the
72. 3:09business unit, he was there. He had
73. 3:11inherited this log for shell issue as
74. 3:13his very first crisis. So this guy was
75. 3:16almost like breathing down my neck the
76. 3:18entire time. Now my job was to get all
77. 3:21100 teams to patch their systems. Sounds
78. 3:24easy, right? Except a bunch of these
79. 3:27applications, they were ancient. Their
80. 3:29original developers were long gone and
81. 3:32the current teams barely knew how to
82. 3:34maintain those applications. Sometimes
83. 3:37applying the patch would break the
84. 3:39entire application. Other times, teams
85. 3:42had to modify application logic like the
86. 3:44source code just to be able to accept
87. 3:47the patched library. It was a total
88. 3:49nightmare. And you know what? This
89. 3:52current PHP vulnerability, it is orders
90. 3:55of magnitudes worse than what I dealt
91. 3:58with. And this is just the beginning.
92. 4:00Over the past week, we have seen a title
93. 4:03wave of major cyber attacks across the
94. 4:05world. The Japanese Nikkay was hacked
95. 4:08resulting the loss of millions of
96. 4:10personal records. There was the Safe Pay
97. 4:13ransomware attack across the United
98. 4:15States. The FBI said that these attacks
99. 4:17hit more than 600 critical
100. 4:20infrastructure organizations. Things
101. 4:22like health care facilities, government
102. 4:24services, energy utilities, and so on.
103. 4:28Hackers reportedly attacked a bunch of
104. 4:30refrigeration systems at major French
105. 4:32supermarkets. The hack raised
106. 4:35temperatures in these freezers to like
107. 4:37over a hundred degrees and spoiled tens
108. 4:40of millions of dollars worth of food.
109. 4:42And then there's the click fix exploit
110. 4:45which impacts Seaman's industrial
111. 4:47control software. This exploit is now
112. 4:50actively being used to take over
113. 4:52industrial control computers. Computers
114. 4:55that support critical infrastructure,
115. 4:58infrastructure like advanced
116. 5:00manufacturing plants, logistics and
117. 5:02fulfillment hubs, and of course the
118. 5:04power grid. It's now gotten so bad that
119. 5:07some government agencies and businesses,
120. 5:10they're taking their websites offline to
121. 5:13prevent them from being hacked. It's
122. 5:15starting to feel like the entire
123. 5:16internet itself is shutting down. And
124. 5:19guys, this entire phenomenon is quite
125. 5:22predictable. The human created internet,
126. 5:25it's always been riddled by bugs and
127. 5:28vulnerabilities like a giant block of
128. 5:31Swiss cheese. Modern internet
129. 5:33applications, they're massive. Sometimes
130. 5:36a single app could have millions of
131. 5:38lines of code. Companies are rushing to
132. 5:41release new features, right? So often
133. 5:43times things like testing and security
134. 5:46reviews, they're sacrificed for the sake
135. 5:49of speed. And software developers,
136. 5:52they're constantly being pushed to
137. 5:53deliver, right? So they also make
138. 5:56mistakes due to fatigue, inexperience,
139. 5:59and just unclear requirements. Sometimes
140. 6:02because of all of these things, it's
141. 6:04nearly impossible to anticipate and deal
142. 6:07with all the bugs that are out there.
143. 6:09But with AI, using just existing cyber
144. 6:13security knowledge and exponential
145. 6:16amounts of computational power, it can
146. 6:19scan those massive code bases in hours.
147. 6:22And through pure algorithmic brute
148. 6:25force, AI agents can uncover hidden
149. 6:28vulnerabilities that would take humans
150. 6:31years to find, if they ever find them.
151. 6:33So, by now you're probably asking, Asian
152. 6:36dad energy. Who's behind all of this?
153. 6:39Well, here's my take on the main
154. 6:42culprits. This could be a false flag
155. 6:44event, like a fake crisis. a fake crisis
156. 6:48that's drummed up by one or more major
157. 6:51American AI companies. I have spoken at
158. 6:54length about this on another vlog that I
159. 6:56made a while back. But the idea here is
160. 6:59to spook the general public enough so
161. 7:01that the government steps in. And the
162. 7:04government in the name of public safety,
163. 7:07they essentially ban open-source
164. 7:10openweight AI models. This then allows
165. 7:12the existing big AI companies to take
166. 7:16over the entire American market and
167. 7:18perhaps even the markets of the
168. 7:20collective west through regulatory
169. 7:23capture. Now, this could also be a case
170. 7:26of AI agents being misaligned. A large
171. 7:30language model, it has no inherent sense
172. 7:33of morality. It relies on safety guard
173. 7:36rails that could be bypassed or removed.
174. 7:39This is especially dangerous during
175. 7:41cyber security testing where AI models
176. 7:44simulate hacking. So if sandbox
177. 7:47environments are not properly secured,
178. 7:50these models could escape and attack
179. 7:52real world targets. And let's not forget
180. 7:55the human factor here. The world's full
181. 7:57of scammers, criminals, terrorists, and
182. 8:00other malicious actors. People who would
183. 8:03love to steal money and take down
184. 8:05critical infrastructure. But up until
185. 8:07very recently, most of them they lack
186. 8:11the technical capability to do so. But
187. 8:13now there are freely available advanced
188. 8:17near frontier open weight models. Right?
189. 8:20Models that according to most measures
190. 8:22are just a few months behind the most
191. 8:25advanced closed source American models.
192. 8:28So now these people, they got the
193. 8:30capabilities that they were missing. So,
194. 8:32in the face of this massive cyber
195. 8:35security dumpster fire, what do we do
196. 8:38exactly? Well, I got a couple of coping
197. 8:40strategies that could help. The first
198. 8:42thing is to secure your own personal
199. 8:45digital accounts. I'm talking about
200. 8:47turning on at least two factor
201. 8:50authentication and if at all possible,
202. 8:53multiffactor authentication. So with
203. 8:55two-factor authentication, when you log
204. 8:58into a website, it would combine your
205. 9:01password with a code that you get from
206. 9:03an SMS text message. Stronger
207. 9:06multiffactor authentication. It includes
208. 9:08things like using an authenticator app
209. 9:11where you get this temporary login code
210. 9:14every time you log into a website. It
211. 9:16could be a software-based cryptographic
212. 9:18key or even better a hardwarebased
213. 9:22cryptographic pass key that you keep
214. 9:24with you. You should also consider
215. 9:26reducing the total number of accounts
216. 9:29and passwords that you have with you.
217. 9:31The lower the total number of
218. 9:33credentials that you're managing, the
219. 9:35less likely that one of them would get
220. 9:37compromised. And please store your
221. 9:40credentials in a secured password vault,
222. 9:43something like one password or bid
223. 9:45warden. And by the way, I got all of
224. 9:48these security safeguards in place right
225. 9:50now. Now, if you got any computing
226. 9:52resources, things like home servers,
227. 9:56home labs, cloud hosted servers, and so
228. 9:58on, make sure they're properly secured.
229. 10:01Keep your servers patched. Make sure
230. 10:03that data is properly encrypted in
231. 10:06transit and at rest. If your servers are
232. 10:08calling external APIs, minimize the
233. 10:12number of those APIs as much as possible
234. 10:14and rotate those API keys. Finally, you
235. 10:18got to enforce strict firewall rules to
236. 10:21protect network access to your machines.
237. 10:23Finally, there's the physical safety of
238. 10:26you and your family. Unfortunately,
239. 10:28critical infrastructure, it's not
240. 10:30airgapped from the internet, at least
241. 10:33not for the United States. Modern power
242. 10:35grids, water facilities, and logistics
243. 10:39networks, they increasingly rely on
244. 10:42internet connected digital services.
245. 10:44Think cloud services, remote management
246. 10:47tools, and so on. That means cyber
247. 10:50attacks, they could disrupt essential
248. 10:53services like electricity, water, and
249. 10:56food distribution. And guess what? Every
250. 10:59society is just three missed meals away
251. 11:02from chaos. As such, I would highly
252. 11:05recommend keeping at least one week
253. 11:07worth of food and water at hand. We're
254. 11:10talking about things like rice, beans,
255. 11:12water, and maybe a small camp stove.
256. 11:15It's relatively cheap and easy to
257. 11:17prepare for, and it could get your
258. 11:19family through a major disruption.
259. 11:21Hopefully, as AI powered attackers and
260. 11:24defenders evolve, we'll eventually reach
261. 11:27some sort of a new equilibrium and
262. 11:29society can regain some measure of
263. 11:31stability. But guys, I'm not saying this
264. 11:34casually. I don't make these kind of
265. 11:36warnings for fun. Consider this as a
266. 11:39public service announcement. So do take
267. 11:42this seriously. Prepare now and keep
268. 11:44your family safe. And that's all I got
269. 11:47to say about that. Hope it helps.
270. 11:49Anyways, if you have a morbid curiosity
271. 11:51to join me in this life journey, please
272. 11:54subscribe to my channel and subscribe to
273. 11:56my Substack newsletter. If you want to
274. 11:58support me in making vlogs, please
275. 12:00become a paid member to the channel and
276. 12:02a paid member to my Substack or just buy
277. 12:04me a coffee. If you want a one-on-one
278. 12:07coaching session with me, just schedule
279. 12:09it. Anyways, thanks for watching. Talk
280. 12:11soon. Bye.