AI is exposing old software debt faster than teams can patch it

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

1. 16:29

   Well, Jason, I think 10 days is too long. I think these things are going to happen much faster than every 10 days. I think part of the challenge we're seeing is we've been talking about technology debt that we've all have to go pay sooner than later. And what's happened is people have not paid attention to the idea that they have to go fix their stuff. I met a customer once they were, but I talked to the CIO this morning.

2. 16:52

   They had a PHP problem. They have a bunch of websites. Some are running the most advanced piece of software so they can put the patch. Some are running older versions, which they can't patch. They've got to bring them down and go build them up. But you know what? They never did anything about the fact they were running older versions because it wasn't important. So now they have to go take those websites down.

3. 17:10

   They're going to go upgrade them, put the patch in, bring them back up. We found out about this a few days ago. We scanned everything in our infrastructure to make sure that there were no issues. We made sure that our products had patches available for our customers who deploy them. So there's two ways to solve this problem, right? One, you can go in and patch the vulnerability. You can go in, find the code, patch what has been given to you by PHP, and make it work.

4. 17:35

   The other is, you can actually put it in a perimeter defense product like ours, or Cloudflare has one, or other firewalls have one. You put the patch there, it's a virtual patch, so any attacker trying to access that vulnerability can stop the perimeter because we know what they're looking for. They're coming to a CDN, the content delivery network, first, and that acts as a first-line event because they're not getting to the actual servers.

5. 17:55

   But if they do get to the actual servers, my understanding is they can run code on these servers and there were some security certificates that were incredibly brittle and easy to hack the closed models have basically said hey these things are cyber risks and so we need to be very thoughtful i know anthropic did that with mythos where they brought you in and a bunch of other people and like 50 companies in and said okay They can now go harden your systems.

6. 18:24

   Were the closed models helpful here? Were they the ones that helped you find these CBEs? Bring us behind the curtain. The closed models can be helpful because both OpenAI and Enthropic and most likely Google as well have very powerful models now, which can go, if you give them enough compute, enough persistence, they're going to go find vulnerabilities. They're going to even chain vulnerabilities to find an attack path, right?

7. 18:45

   If they can solve neighbor's dokes, they can change for vulnerabilities. And if you give them enough immense compute, they will try every way possible to be able to agree with it. Actually, the PHP problem was solved by persistent compute. This problem was identified a few years ago, but nobody thought it could be solved because it required too much of coordination. So what happened was, if you throw a computer at the problem, it persisted and it found a way to crack that.

8. 19:09

   Once they found the way to crack that and they published it, or it got reverse engineered, every hacker knows now how to go after it. Because the challenge you have with patches is, hackers are smart. They look at a patch, they see what the patch is trying to do, the reverse engineer from there and say okay if i follow the reverse engineer path if somebody's not patched i can break in it seems like a bunch of the hullabaloo today that's being drummed up and this seems like it's going to change every day is all about these bank accounts getting