Listen Notes: the best podcast search engine
Special | A Patch It Properly Week

Full Transcript for Special | A Patch It Properly Week

TRANSCRIPT 🔗

WEBVTT 00:00:00.719 --> 00:00:02.959 Hello everyone, welcome to Cyber Leaders. 00:00:03.040 --> 00:00:04.240 I'm James Lyne. 00:00:04.480 --> 00:00:07.839 And I'm Kieran Martin, and it's another special episode, James. 00:00:07.919 --> 00:00:14.000 This one, it's in commemoration of we've suddenly noticed it's Cybersecurity Awareness Month. 00:00:14.080 --> 00:00:15.919 How's that going for you this year, James? 00:00:16.320 --> 00:00:21.679 I am feeling much more aware of Cyber than I think I ever have felt, Kieran, actually. 00:00:22.079 --> 00:00:26.000 I mean, it's been a roaring success, Cybersecurity Awareness Month this year, certainly for me. 00:00:26.079 --> 00:00:28.640 It's been much better than Sober October, that's for sure. 00:00:29.120 --> 00:00:37.039 Now look, um uh joking aside, or joking paused, more accurately, um, there's quite a lot going on. 00:00:37.679 --> 00:00:41.039 And uh cybersecurity is leading the global news. 00:00:41.200 --> 00:00:46.000 There's this PHP vulnerability, but there's lots of other things too. 00:00:46.159 --> 00:00:50.399 Why don't you set out for us just the full panopoly of what's going on? 00:00:50.560 --> 00:00:59.600 And then we'll look at PHP and maybe one other aspect of what's going on and try and give real, usable lessons for the cyber leadership community. 00:00:59.759 --> 00:01:00.320 So over to you. 00:01:00.399 --> 00:01:01.439 What's going on, James? 00:01:01.840 --> 00:01:03.119 What's the saying, Kieran? 00:01:03.280 --> 00:01:08.719 Um, nothing then uh nothing then all at once does seem to somewhat uh apply to this week. 00:01:08.959 --> 00:01:20.400 Yeah, look, I mean, the headlines are on fire in particular with these PHP flaws, two two very nasty remote code execution bugs that I know we'll dive into more. 00:01:20.560 --> 00:01:29.680 Yeah but what I think is particularly interesting as you've noticed, there's also flaws in bind that you know runs the infrastructure more broadly, DNS. 00:01:29.760 --> 00:01:40.799 There's flaws in Python, in Node.js, um, some fascinating issues going on in the global kind of certification and crypto infrastructure, particularly in India. 00:01:41.040 --> 00:01:49.280 So it it just it just seems like simultaneously, all at once, everywhere across the globe decided to have some form of serious flaw. 00:01:49.599 --> 00:01:57.200 So let me push you on this in terms of its consequences and also what it means strategically, because you know, like a lot of people, I'm waking up. 00:01:57.280 --> 00:01:59.519 I'm probably doing that stupid thing when you first wake up. 00:01:59.599 --> 00:02:00.799 I'm looking at social media. 00:02:01.040 --> 00:02:01.680 Very dangerous. 00:02:01.920 --> 00:02:03.599 Some people are sane, but I'm not. 00:02:03.840 --> 00:02:09.280 So we we look at social media and we look at the cyber subsection of social media. 00:02:09.360 --> 00:02:15.520 And right now, there's a lot of people, particularly in the United States, but not confined to the US, who are saying, this is it. 00:02:15.759 --> 00:02:24.080 So insert the prefix, whether it's breach, vuln, cyber, whatever, but then use the suffix is pocalypse and it's beginning. 00:02:24.159 --> 00:02:24.800 This is the moment. 00:02:24.879 --> 00:02:26.319 We've been warning about it for ages. 00:02:26.400 --> 00:02:28.080 But look, and they and they do your list. 00:02:28.159 --> 00:02:34.479 They do PHP, they do the India crypto thing that will come through, they do all sorts of other things, buying that you mentioned, and they say right. 00:02:34.639 --> 00:02:42.000 And some of them, and I've seen at least two viral essays on on this, are literally saying it's time to switch everything off and head for the hills. 00:02:42.159 --> 00:02:45.599 It's time to stockpile cash, it's time to stockpile water. 00:02:45.680 --> 00:02:52.319 Even our own government here in the UK, although it's not specifically about cyber, it's a sort of unhappy coincidence that they're talking about wider things. 00:02:52.479 --> 00:02:59.199 But there people are getting serious advice that the digital age is now fraught with immediate life-threatening peril. 00:02:59.439 --> 00:03:04.240 Um, you have a long perspective and a deep technical understanding of this. 00:03:04.560 --> 00:03:09.599 Is it just a set of unhappy coincidences in the same week? 00:03:09.919 --> 00:03:18.080 Is it a huge structural shift for the worst that's going to speed up and we're going to have every week like this in 2027? 00:03:18.159 --> 00:03:19.199 Or is it somewhere in between? 00:03:19.280 --> 00:03:21.360 What's going on strategically, James? 00:03:21.759 --> 00:03:22.719 Yeah, good question. 00:03:23.199 --> 00:03:33.280 Look, I I um I do not love this fear-mongering that one must accumulate cans of spam in response to the impending Volume apocalypse. 00:03:33.599 --> 00:03:36.479 It's spam, but not as we know it in cybersecurity. 00:03:36.719 --> 00:03:39.520 It's an unfortunate food choice on my part there. 00:03:40.000 --> 00:03:46.960 Yeah, look, I I do think that um, you know, it is wrong to sit at either extreme on this. 00:03:47.039 --> 00:03:56.400 To say that the likes of AI is having no impact on the work in cybersecurity, the opportunity for attackers, the pace, I think is wrong. 00:03:56.560 --> 00:04:06.800 To flip to this other extreme that every week will now be like this and that technology can no longer be trusted, I think is entirely disproportionate. 00:04:06.960 --> 00:04:23.120 Um, and perhaps, Kieran, in support of that, before we get into these kind of AI-assisted flaws that have been found in PHP, let's actually pick another example that's really serious, precisely because it has basically nothing to do with AI and these claims. 00:04:23.439 --> 00:04:23.600 Okay. 00:04:23.680 --> 00:04:25.839 I think you're going to India, aren't you, James? 00:04:26.079 --> 00:04:26.800 I am. 00:04:26.959 --> 00:04:34.879 Yeah, look, amid all
Load full transcript
this sophistication comes a reminder that sometimes the problems are rather simpler. 00:04:35.519 --> 00:04:43.759 So for those of you that you know haven't read up on this one for all the other great distractions this week, e-Mudra, they're an Indian certificate authority. 00:04:43.920 --> 00:04:48.959 Um, and in fact, the only Indian route certificate authority trusted globally. 00:04:49.600 --> 00:05:00.079 And these guys issued it kind of eight intermediate certificates whose private keys were so small you could guess them. 00:05:00.560 --> 00:05:05.199 And you might be thinking, oh, okay, you could guess them with you know mass computational power. 00:05:05.279 --> 00:05:09.120 And uh no, one of the numbers was four. 00:05:10.079 --> 00:05:13.839 Not four bits, mind you, actually four. 00:05:14.560 --> 00:05:20.160 Um I think you refer to EMUDR as India's formerly only trusted certificate authority. 00:05:20.319 --> 00:05:30.000 And what I do love about this is we're long used to, particularly in this part of the world, to Douglas Adams telling us that you know the key to the secrets of Earth and the secrets of human life is 42. 00:05:30.240 --> 00:05:33.279 Turns out the key to the secrets of India, the most populous country in the world. 00:05:33.439 --> 00:05:34.879 The key to the secrets is four. 00:05:35.120 --> 00:05:36.240 It's even easier. 00:05:36.480 --> 00:05:36.800 Okay. 00:05:37.199 --> 00:05:41.040 Along along with 66, 155, and 237. 00:05:41.360 --> 00:05:42.879 Well, that's a bit more complicated, James. 00:05:42.959 --> 00:05:44.959 I mean, you you might need an LLM for that. 00:05:45.040 --> 00:05:45.360 Or perhaps. 00:05:45.759 --> 00:05:48.720 Oh, maybe, Karen. 00:05:48.879 --> 00:05:52.879 We'll come to that because it's amazing. 00:05:53.360 --> 00:05:54.480 Oh, it's it's stunning, right? 00:05:54.560 --> 00:06:07.839 So, I mean, uh for for those who are less au fay with you know the the kind of technical specifics of how this ought to work, a proper key of this sort should be a random number that is hundreds of digits long. 00:06:08.079 --> 00:06:08.560 Right. 00:06:08.800 --> 00:06:17.120 Um, you know, and these examples we're talking about for 42, you know, they offer a few hundred possibilities at most. 00:06:17.519 --> 00:06:28.160 Um, the infamous Scott Helm, fantastic security researcher, um, he recovered all eight from these uh public certificates in under a second. 00:06:28.720 --> 00:06:36.160 Um I dare say that you know, a toddler with a calculator was probably in with a sporting chance on this one. 00:06:36.480 --> 00:06:36.879 Excellent. 00:06:38.000 --> 00:06:41.680 Now, why this matters a little bit, and then let's come back to that AI point. 00:06:41.759 --> 00:06:53.279 Um, look, we we have a technical set of listers here, so I won't overdo this, but certificate authorities are how your browser knows that your bank's website's really your bank. 00:06:53.360 --> 00:06:53.680 Yeah. 00:06:53.839 --> 00:07:00.800 Um, and of course, you know, if you've got one of these keys, you can mint a certificate for any site that you wanted. 00:07:00.959 --> 00:07:01.279 Yeah. 00:07:01.519 --> 00:07:07.839 Um, so you could pretend to be a bank, you could launch all kinds of nasty phishing campaigns, you know, you name it. 00:07:08.079 --> 00:07:12.720 What bothers me here, Kieran, I think is pertinent to our discussion, is the visibility. 00:07:13.040 --> 00:07:13.360 Yeah, yeah. 00:07:14.160 --> 00:07:20.959 These keys sat in public certificates for over a year, there for anyone who wanted to look. 00:07:21.120 --> 00:07:35.120 I mean, there was even a warning in May 2025 when the revocation lists failed their signature checks, which is you know, about as clear a red flashing light as you can get from this type of infrastructure. 00:07:35.360 --> 00:07:39.040 But it was patched over and filed as a process error. 00:07:39.279 --> 00:07:39.680 Wow. 00:07:39.839 --> 00:07:47.439 Um, you know, and and therefore, because of that, you know, independent auditors now are none the wiser on how much of this has happened. 00:07:47.519 --> 00:07:50.879 We don't know how much it's been abused. 00:07:51.120 --> 00:07:51.519 Right. 00:07:52.000 --> 00:07:55.279 Um so you know, when someone says, you know, was anyone attacked? 00:07:55.519 --> 00:07:55.839 We don't know. 00:07:56.079 --> 00:08:00.319 It's kind of a don't know, don't think so, can't prove it. 00:08:00.639 --> 00:08:13.360 But just because we'll need to get on to PHP, just to try to summarize this, we don't know what harm there's been, but clearly most of us haven't observed any that would affect us, say, outside India. 00:08:13.439 --> 00:08:19.439 So there is probably a difference in risk, isn't there, between what the risk is within India and what the risk is out with it. 00:08:19.680 --> 00:08:21.360 So that's the first question I'd like you to deal with. 00:08:21.439 --> 00:08:25.120 And then, of course, the second one is this is on a big list of the AI apocalypse. 00:08:25.199 --> 00:08:27.920 Could you describe the AI dimension to this operation? 00:08:28.160 --> 00:08:30.000 Hint, it won't take very long. 00:08:30.800 --> 00:08:32.000 Yes, yes. 00:08:32.159 --> 00:08:38.720 Uh look, I I think if you're looking at this flaw, um, the lesson stands that the mathematics are sound, right? 00:08:38.799 --> 00:08:43.679 This isn't some hyper impressive technical flaw in the crypto. 00:08:44.159 --> 00:08:46.639 It's what is so often the case in cybersecurity. 00:08:46.799 --> 00:08:48.639 The process around it failed. 00:08:48.879 --> 00:09:05.360 And as you've highlighted, Kieran, for those fretting that every great flaw now henceforth will be some AI-wrought super exploit, this one was very serious, very dumb, and entirely human. 00:09:05.919 --> 00:09:11.759 I mean, e-mudge's statement did suggest the keys could have been cracked with an AI-assisted technique. 00:09:12.799 --> 00:09:23.600 I would
gently observe that the technique in question was counting to 237, and that I might be able to accomplish that without supercharged AI LLM models. 00:09:24.000 --> 00:09:24.240 Yeah. 00:09:24.320 --> 00:09:30.399 So the lesson being that you're supposed to have 237 digits in the key. 00:09:30.559 --> 00:09:32.320 It shouldn't be 237. 00:09:32.480 --> 00:09:33.600 That's the key mistake. 00:09:33.759 --> 00:09:35.840 Uh that's the critical uh mistake. 00:09:36.080 --> 00:09:44.960 And again, just for reassurance, there's clearly lots of mitigations and management to be done within the Indian, particularly the e-government system, for reasons that we won't go into. 00:09:45.519 --> 00:09:50.559 But for the rest of us, this is not something that we have to go and fix and so forth. 00:09:50.639 --> 00:09:57.200 It's just an alarming reminder of some of the critical um weaknesses in human practice. 00:09:57.679 --> 00:10:12.320 And Kieran, if I if I may, a reminder for all of us, amidst all these headlines um where there's a predisposition to look for the sophisticated and sexy with AI, sometimes it's just process screw-ups and nastiness and cruft. 00:10:12.399 --> 00:10:22.399 And a lot of the attacks around the world still come down to those hygiene configuration and process issues, even on the scale of global trust infrastructure. 00:10:22.799 --> 00:10:23.200 Absolutely. 00:10:23.279 --> 00:10:26.960 And onto hygiene, but onto something that people do have to fix or at least should fix. 00:10:27.039 --> 00:10:29.600 Let's talk a little bit about PHCP now. 00:10:29.759 --> 00:10:32.639 We don't want to go in because of to all of the details. 00:10:32.720 --> 00:10:38.799 As you say, it's a largely technical audience and Cybersecurity Awareness Month joking aside. 00:10:38.879 --> 00:10:40.159 Everyone will be aware of this. 00:10:40.320 --> 00:10:41.360 Uh it is Walton. 00:10:41.679 --> 00:10:45.919 And it's a great webcast if you want the technical details from Moses, Frost, and Rich Green. 00:10:46.399 --> 00:10:47.919 Where they go through the demo and explain it. 00:10:48.000 --> 00:10:49.840 So we won't do that today, as you say, Kieran. 00:10:50.000 --> 00:10:55.759 And again, there's an AI, um, there is an AI dimension to this, and we can come in, we can come onto that in a little bit. 00:10:55.840 --> 00:10:59.120 But also there are words around being used like unprecedented. 00:10:59.200 --> 00:11:01.759 And whilst there aren't many precedents for this, there are some. 00:11:01.919 --> 00:11:14.000 Uh for those who've been around for a while, we've talked about log4j, log4 shell, and you know, for some of us this feels like log4j, but the media are reporting it, or you know, it's log4j again with wall-to-wall media coverage. 00:11:14.159 --> 00:11:18.080 How does it look to you two, three days on, depending on when you start this? 00:11:18.159 --> 00:11:21.919 Because of course it was the leak of the pre-agreed vulnerability process rather
disgracefully. 00:11:22.159 --> 00:11:22.879 Where are we now? 00:11:23.360 --> 00:11:23.759 Painful. 00:11:24.000 --> 00:11:24.159 Yeah. 00:11:24.320 --> 00:11:25.360 Where are we now? 00:11:26.159 --> 00:11:29.039 Yeah, look, I mean, there's no doubt it's serious, Kira. 00:11:29.120 --> 00:11:35.519 And I don't think you and I would want to walk out of this podcast with folks rolling their eyes and saying, I'm not going to bother patching. 00:11:35.679 --> 00:11:36.000 Absolutely. 00:11:36.639 --> 00:11:42.000 Is unauthenticated remote code execution in software that's running in some bank of the web. 00:11:42.559 --> 00:11:43.039 It's bad. 00:11:43.440 --> 00:11:44.639 People should be alarmed. 00:11:44.799 --> 00:11:46.159 There's something alarmed about it. 00:11:46.399 --> 00:11:46.639 That's right. 00:11:46.720 --> 00:11:47.519 You you must take action. 00:11:47.600 --> 00:11:53.360 And in the end, Kieran, we must press ourselves to give folks two or three things they they really need to pay attention to. 00:11:53.919 --> 00:12:01.360 But um, but it is a little bit more nuanced than the headlines and kind of black October and the end of the internet. 00:12:01.600 --> 00:12:06.480 I mean, for one, Kieran, there's this line of millions of attacks. 00:12:07.519 --> 00:12:08.799 Lovely figure. 00:12:09.120 --> 00:12:16.960 But, you know, a honeypot getting hammered or attackers attempting isn't the same as winning. 00:12:17.200 --> 00:12:22.320 And it turns out that the public exploits of this are fussy, right? 00:12:22.399 --> 00:12:26.559 There's a lot of works on my machine versus someone else's. 00:12:26.639 --> 00:12:35.840 And I I loved your comparison to log for shell because that was one line of text in a username field that kicked the door open reliably. 00:12:36.480 --> 00:12:43.679 This, at least yet, you know, is a serious flaw, but it's not kicking doors down the same way. 00:12:44.240 --> 00:12:46.559 The burglars are finding a lot of stiff handles. 00:12:46.720 --> 00:12:48.080 Oh, that was a good analogy. 00:12:48.159 --> 00:12:49.279 I'm going to keep that one for the future. 00:12:49.600 --> 00:12:50.080 That is excellent. 00:12:50.159 --> 00:12:51.200 But let's dig into this a little bit. 00:12:51.279 --> 00:12:55.120 Because let's face it, James, you know, you are, at least for the most part, you're a goody, right? 00:12:55.200 --> 00:12:57.759 You try and do good, you try and build communities and so forth. 00:12:58.000 --> 00:13:09.519 But let's say, for example, I was able to harness the evil spirit of Claude that we've all been reading about, and I would be able to cast a spell on you and turn you and turn you bad, because you're a very, very capable hacker. 00:13:09.679 --> 00:13:18.159 Um, and but also, I mean, you're running a huge global cybersecurity training company, but you know, in your spare time, uh, you still have time to keep yourself technically relevant. 00:13:18.480 --> 00:13:19.360 One has fun. 00:13:19.759 --> 00:13:34.399 I know you spent quite a lot of the last couple of days, ethically, of course, because we haven't cast the evil Claude spell on you, ethically trying to see if badness worked on this, because if you went to the dark side, you could cause an awful lot of trouble. 00:13:34.639 --> 00:13:44.320 So I think it would be really interesting for our technical leadership, just to give us a sense, not so much of the details, but of your experience as a proper hacker, somebody who knows what to do with this stuff. 00:13:44.559 --> 00:13:48.799 How did you find trying to exploit safely and ethically? 00:13:49.039 --> 00:13:50.159 PHP to Shell. 00:13:50.399 --> 00:14:08.320 Yeah, it it was a really interesting experience, Kieran, because I expected with the, you know, the published details, the availability of AI, and a lot of the noise around that one might feed it into AI and ask for a nice exploit, and the work would be done. 00:14:08.399 --> 00:14:17.919 And it would lead to this kind of bloodbath scenario that you know you you might read about in the news where you get, you know, pop pop and shell on PHP. 00:14:18.000 --> 00:14:20.480 You just you press a button and it and it works. 00:14:20.799 --> 00:14:22.559 Um not so. 00:14:22.799 --> 00:14:30.480 And and interestingly, you of course, there are folks who are much more talented exploit developers again than me in the community I've been talking to, also. 00:14:30.879 --> 00:14:41.279 Um, our experience is you still need a lot of expertise in combination with AI and knowledge of the details to produce something useful. 00:14:41.360 --> 00:14:41.519 Yeah. 00:14:41.679 --> 00:14:46.399 Like there wasn't this just kind of AI automated generated hack that came out of it. 00:14:46.639 --> 00:14:58.559 It took me a few hours to get to something useful on my machine, but that doesn't immediately mean that I can go and trounce around the internet and hit other people's systems. 00:14:58.879 --> 00:15:01.840 Um, so it is it's fussy and fiddly. 00:15:02.159 --> 00:15:07.519 And I suspect in time, you know, more universal exploit versions will appear. 00:15:08.000 --> 00:15:16.960 But in this interim period, it is giving us some time to patch and it doesn't have the reliability of some of those prior exploits. 00:15:17.200 --> 00:15:18.480 This was fiddly, Kieran. 00:15:18.639 --> 00:15:30.720 So let's try and bring this together for cyberleaders, because that's a really important and for now reassuring point, but I say for now, because we do do detail, we do do nuance, we do do subtlety on this podcast. 00:15:30.799 --> 00:15:34.639 That's the whole point of the damn thing, uh, rather than just, you know, hysterics. 00:15:34.879 --> 00:15:41.600 So as I read it from the much less technical background, so somebody like you, you know, super technical, very, very expert. 00:15:41.679 --> 00:15:46.080 There are others that we've we've talked to and you've talked to, and they're all
trying to see if this works. 00:15:46.240 --> 00:15:47.440 And that's the good side of things. 00:15:47.600 --> 00:15:55.679 On the bad side of things, we know, I mean, there is, and this is where AI comes in, there is an unprecedented volume of attack, of attempted attacks. 00:15:55.919 --> 00:16:06.639 And they will range from people, as one of my friends joked to me, people typing into an LLM, you know, hack PHP, make no mistakes, and seeing how they get on, which isn't gonna work. 00:16:06.799 --> 00:16:08.480 I think you've established that beyond any doubt. 00:16:08.639 --> 00:16:08.879 Yep. 00:16:08.960 --> 00:16:09.120 No, no, no. 00:16:09.279 --> 00:16:17.519 But all the way, all the way through, and I'm serious about this, all the way through to teams of evil people, like evil versions of you, um, who are really, really good at this. 00:16:17.600 --> 00:16:22.879 And they're gonna spend all weekend trying to engineer this, trying to make it work, and they might succeed. 00:16:23.120 --> 00:16:25.679 So again, this isn't just just being reassuring. 00:16:25.759 --> 00:16:26.720 There's a big risk out there. 00:16:26.799 --> 00:16:27.679 We've had a break. 00:16:27.840 --> 00:16:32.639 We've had a lucky break in that it's not log for it's not as easily exploitable as log4 shell. 00:16:32.799 --> 00:16:38.799 So if it takes them all weekend, well, then more and more people should patch between now and the other side of the weekend, et cetera, et cetera. 00:16:38.879 --> 00:16:41.120 Is that a fair sort of summary of where we are? 00:16:41.440 --> 00:16:43.360 Yeah, I I I love that, Kieran. 00:16:43.440 --> 00:16:48.080 And I and I and I think this you you kind of you highlighted our position of nuance, right? 00:16:48.159 --> 00:16:51.039 If anyone walks out of this going, oh, okay, not that bad. 00:16:51.120 --> 00:16:52.639 Never mind, I'm not gonna do anything. 00:16:52.799 --> 00:16:53.440 We failed. 00:16:53.600 --> 00:16:54.240 Yeah, absolutely. 00:16:54.480 --> 00:17:01.440 We also don't want folks running around with their hair on fire saying AI is successfully going to break every piece of software. 00:17:01.600 --> 00:17:03.840 Oh my god, it's breaking the thing that powers the whole internet. 00:17:04.079 --> 00:17:06.559 That's gonna happen next week and the week after. 00:17:06.880 --> 00:17:19.039 This is still the domain of skilled security researchers in combination with AI being augmented, not this kind of one-button exploit. 00:17:19.279 --> 00:17:25.680 But but Kira, should should we, I guess we should try and pick three or four things um for security leaders to do right away. 00:17:26.000 --> 00:17:27.839 I've got a couple in mind, unless you want to go first. 00:17:28.079 --> 00:17:29.599 No, I mean, just a reflection more. 00:17:29.680 --> 00:17:34.880 I think, you know, AI, let's set aside the apocalypse and pea doom argument and all that nonsense. 00:17:35.039 --> 00:17:36.240 I mean, it's a tool. 00:17:36.480 --> 00:17:39.680 And uh it's it's been a complicated tool for both good and bad. 00:17:39.759 --> 00:17:41.440 It's been both hero and villain of this piece. 00:17:41.519 --> 00:17:48.400 You know, AI has part funded and assisted the research that got us to identify this 14-year-old vulnerability that was going to be found at some point. 00:17:48.559 --> 00:17:54.240 And so I think it shows us that the way AI impacts on cyber is going to be complicated. 00:17:54.319 --> 00:17:56.160 It's gonna be a mixture of good and bad. 00:17:56.319 --> 00:18:07.359 And actually, you know, to try to introduce to try to um hand over on a point of I think reasoned but cautious optimism, if we do the right thing, AI will be a net benefit in this particular case. 00:18:07.519 --> 00:18:12.960 There'll be other cases where it's a net problem, but and we're gonna be here for ages. 00:18:13.119 --> 00:18:15.839 So I just wanted to make that observation in terms of the CAM. 00:18:16.240 --> 00:18:21.920 And then I think definitely, you know, I'll just do the I'll just do the clever analytical observation. 00:18:22.000 --> 00:18:24.559 Can you do the actually useful practical advice, please? 00:18:24.880 --> 00:18:25.359 You got it. 00:18:25.440 --> 00:18:25.839 You got it. 00:18:25.920 --> 00:18:27.359 We're a wonderful team, Kieran. 00:18:27.440 --> 00:18:30.400 Um, like uh like an evil Claude, might one might say. 00:18:30.559 --> 00:18:41.119 Um yeah, look, for for the for security leaders out there, I'm sure that you and your teams are already on to, you know, the harsh realities versus the headlines, but let's just make it clear. 00:18:41.519 --> 00:18:44.640 Patch the engine, not the paintwork, right? 00:18:44.720 --> 00:18:47.039 It's not about updating WordPress. 00:18:47.200 --> 00:18:50.400 You've got to get the PHP runtime upgraded. 00:18:50.640 --> 00:18:55.519 Um, number two, you're probably getting more risk from the stuff no one owns. 00:18:55.759 --> 00:18:58.079 You probably are thinking about your website. 00:18:58.240 --> 00:19:00.160 What about all the other services? 00:19:00.319 --> 00:19:04.480 The partner portal off to a side, the thing running under someone's desk. 00:19:04.720 --> 00:19:09.920 Remember that these patches don't go all the way back through the entire history of PHP. 00:19:10.000 --> 00:19:20.160 So a PHP 7 server under someone's desk or a vendor appliance that hasn't been updated, those are the things to isolate and chase down. 00:19:20.480 --> 00:19:29.839 Um and you know, lastly, if I may, count patched hosts, not blocked attacks. 00:19:30.079 --> 00:19:30.319 Right? 00:19:30.400 --> 00:19:35.599 There's this narrative forming around a million blocked requests, look at what our WAF is doing. 00:19:36.240 --> 00:19:46.400 When you really come down to it, this is a project of hygiene where you're attempting to deploy good coverage to reduce the possibility of this exploit in the future. 00:19:46.799 --> 00:19:51.839 Don't get too
hung up on the controls in front of it or the volume story. 00:19:52.079 --> 00:20:00.799 Um, so Kieran, I mean, if you'll allow me a a little a little technical reflection like yours, but for me, this is a patch it properly week. 00:20:00.960 --> 00:20:01.119 Yeah. 00:20:01.279 --> 00:20:13.279 It it might seem like a fire alarm week, but use this window while the exploits are clunky, because they often don't stay that way, um, and get the patching done. 00:20:13.599 --> 00:20:29.200 And for the cybersecurity community, remember if we cry log for shell every time, if we do this week after week, and because it's sexy and it's got AI assistance in it, no one's gonna listen when the real ones turn up. 00:20:29.519 --> 00:20:33.359 You know, these flaws have been sat in PHP for years. 00:20:33.680 --> 00:20:36.480 AI helped find them, helped build exploits. 00:20:37.200 --> 00:20:40.640 I think, Kieran, as you said, a lot more of that is going to happen. 00:20:40.880 --> 00:20:47.119 But for us as security leaders, I've said it before and I'm gonna say it again clearly here AI is gonna change the game. 00:20:47.279 --> 00:20:49.440 It's gonna change some of the players, some of the rules. 00:20:49.599 --> 00:20:52.720 It doesn't change what winning looks like. 00:20:52.960 --> 00:20:56.480 Attackers still want your data, your money, your access. 00:20:56.799 --> 00:21:06.319 So know what matters in your organization, know what someone's gonna come for, and make sure the controls and the people guarding it are up to the job. 00:21:06.640 --> 00:21:12.640 You do that, and the next round of worst bug ever is a busy week rather than a bad one. 00:21:12.880 --> 00:21:14.160 And that's where we want to get to. 00:21:14.240 --> 00:21:29.359 So thank you for that brilliant mix of specific technical advice all the way through into how to handle the people that you need support from in your organization to go and fix this, how to pitch it properly, because this isn't the last time we're going to be here, but we can't be here every day. 00:21:29.440 --> 00:21:31.759 And we're not going to be here every day. 00:21:31.839 --> 00:21:34.079 So it's important to help work out what matters. 00:21:34.160 --> 00:21:40.079 So that brings us to the end of this special episode of the Sans Cyber Leaders podcast. 00:21:40.160 --> 00:21:43.359 We'll have a regular season back pretty shortly. 00:21:43.519 --> 00:21:46.240 We may have another special episode or two. 00:21:46.400 --> 00:21:46.880 Who knows? 00:21:46.960 --> 00:21:48.240 It kind of depends what happens. 00:21:48.400 --> 00:21:51.279 Hopefully, we're not back next week with another week like this. 00:21:51.599 --> 00:21:55.119 Probably when someone picks a private key of 42 after you suggested it, Kieran. 00:21:55.359 --> 00:21:56.400 Well, exactly. 00:21:56.640 --> 00:22:01.359 But I will make no predictions other than, as they've long said in this country, we'll meet again. 00:22:01.519 --> 00:22:06.000 Don't know where, don't know when, but I know we'll meet again some cyber day. 00:22:06.160 --> 00:22:10.640 You can leave us feedback at Sans Cyberleaders the website. 00:22:10.799 --> 00:22:14.400 You can email us at cyberleaderspodcast at sans.org. 00:22:14.480 --> 00:22:18.000 There are multiple ways, but please do give us ratings and so forth. 00:22:18.079 --> 00:22:19.039 It really helps. 00:22:19.200 --> 00:22:21.839 But for now, from me, Kieran Martin. 00:22:22.079 --> 00:22:26.720 And for me, James Lyme, it's keep cybering and goodbye. 00:22:27.359 --> 00:22:29.839 And good luck patching all the things.
Edit transcript