When a major computer security vulnerability is discovered, there is understandably a rush to patch the affected systems. The perennial problem is that most computer users don't proactively update their operating systems or applications, because of a mixture of ignorance, misunderstanding and sloth. This is why companies like Microsoft push Windows Updates so hard, and incidentally why smartphone operating systems have been designed from the off to force updates. But even when a vulnerability has been widely publicised and every measure taken to encourage updating, not all systems will be patched. For example, the EternalBlue SMB protocol vulnerability was widely publicised in 2017, not least because it turned out to have been first identified a number of years earlier by the US NSA, who had kept quiet about it and developed an exploit for their own use in offensive cyber-warfare. The exploit was finally leaked to hacker groups (I wonder how that happened) and then used for ransomware attacks, notably via the WannaCry and NotPetya worms.
The scale of the damage those worms caused was amplified by Microsoft initially not releasing patches for older, unsupported versions of Windows, which affected organisations that had failed to keep pace either due to negligence or a lack of funding, the latter including much of the NHS (Microsoft relented after a month). Today, it is estimated that around 15% of Windows devices running the SMB protocol are still vulnerable. What this highlights is that vulnerabilities are actually commonplace and are rarely fully eliminated. Sometimes this is because the systems are of little intrinsic value, such as a hobbyist's public-facing sandbox, so being compromised may not matter. In other cases it's because they are part of a complex legacy system whose inner workings may be a "black box" that you tamper with at your peril (the Jenga Tower problem). Incidentally, "inscrutability" in computing long predates LLMs and their mysterious ways. Much of the banking industry depends on 50 year-old COBOL systems that only one well-remunerated contractor on the Isle of Wight understands.
Despite the widespread media hyperbole and the precautionary shutdown (aka arse-covering) of many government systems following the announcement of two major vulnerabilities in PHP, the vast majority of servers running that program have not yet been patched and it's likely that lots of them will remain unpatched for the foreseeable future. And yet the sky has not fallen in. There are a number of reasons for this. First, there is an entire industry and media ecosystem committed to the idea that everyone is under imminent threat, whether from criminals, Islamists, antisocial incels or Vladimir Putin. The result is an exaggeration of the possible impact, hence the emphasis on the risk to sensitive private data, such as passwords and credit card details, despite the plentiful evidence that cyber-criminals go after large organisations with enough money to pay a ransom, not small fry (that remains the speciality of phone scammers and email phishers who rely on social engineering - i.e. gullibility).
Secondly there is an exaggeration of the significance of the technology itself. Contrary to the claims, the Internet does not run on PHP. The Internet runs on the Internet Protocol (IP). Even if we accept such language as a crude synonym for "used by lots of websites", this obscures that sites are served by stacks that include operating systems, web servers and databases. The most widespread is LAMP, which stands for Linux (the OS), Apache (the web server), MySQL (the database), and PHP. The last of these is a scripting language that sits between the web server and the client (your computer or smartphone). A scripting language is not a programming language but an application (PHP is written in C, an actual programming language). Its purpose is to generate on-the-fly web pages, in other words the HTML and CSS etc that your web browser renders. The reason why LAMP is so widespread is that the software is free to use. This obviously carries some risks, as the people who maintain the systems are themselves hobbyists rather than paid professionals (though most will have high-expertise day jobs in IT), and who knows, some of those may in turn be earning a little on the side by being helpful to state actors like the NSA.
Some embarrassing attempts to educate the public have noted that PHP is a recursive acronym, standing for PHP Hypertext Preprocessor (the visual analogy used in that BBC article imagines that burgers are served by waiters). This is a techie joke. PHP originally stood for Personal Home Page. It was written as a common gateway interface (the other CGI), which simply means an extension to the web server that dynamically generated the HTML output when a page was requested. The dynamic content may have been as simple as printing today's date at the top of the page, or it might take form input and run a query against a database, returning the results as a formatted table (think of a basic search function). PHP has obviously become more sophisticated over time, but it remains at heart a fairly simple technology. The reason it is so popular, beyond being free, is because it is ideal for many modern web applications, from commercial sites that require frequently changing content and interactivity (e.g. search lists and shopping carts) to blogs that require low maintenance (WordPress is built using PHP: an abstraction layer upon an abstraction layer upon a programming language).
The type of exploit the two PHP vulnerabilities could give rise to is more likely to be a remote command execution (RCE) than the extraction of passwords and credit cards from compromised memory. What that means is forcing an error that allows a subsequent command to be run against a database using privileged security credentials (like having a skeleton key). However, it should be noted that this type of vulnerability is already common. The most famous example of this is the class of exploits known as SQL injection. For websites that don't utilise a database, an RCE is unlikely to be able to do much damage beyond simple vandalism - e.g. executing system configuration commands that render it temporarily unusable (a reboot will fix that). Even where a database is used, the attacker may encounter the other perennial problem of modern, Internet-based computing, namely that the data is trash. The reality of cyber-crime is that criminals spend a lot more time identifying a target in terms of potential value, technical competence and public embarrassment (i.e. casing the joint) than they do in writing malware.
As of now, there have been many reports of exploit attempts issued by security firms (who have an obvious interest in bigging-up the danger), but no reports of successful exploits (this doesn't mean they won't happen, but that the danger has been exaggerated). This is likely to be because most of those attempts will have been by relatively unskilled hackers running bots that scan public websites (which they do constantly). An important aspect of this is the number who will be relying on AI-generated code (and you can safely assume that AI companies will have choked that by ensuring the code doesn't work). In fact, the most interesting aspect of this whole affair hasn't been PHP (thank you for bearing with me up to this point), but the role that AI has played. According to press reports and industry boosters, the obscure vulnerabilities were discovered by AI. In fact, while AI may have played a role in nominating them as candidates and testing them, the source of the identification can be traced to humans actively looking for vulnerabilities. After all, AI doesn't take the initiative.
The other AI dimension is the belief that tools like as ChatGPT and Claude can be leveraged to not only discover but exploit system vulnerabilities (the claim that only "frontier AI", i.e. versions not yet publicly released, can so this is just marketing). This is akin to the idea that AI can be used to create powerful bio-weapons, the key difference being that while the latter require access to specific and often hard-to-find ingredients and processing capabilities, which proved beyond the powers of Saddam Hussein, the former just requires access to a computer. Behind this overt fear that the lesser people of the earth (fanatical Muslims, woke teenagers and the suicidally empathetic) might get their hands on weapons of mass destruction is the covert fear that AI itself might decide to do us harm by trashing our WordPress blogs. Indeed, it is hard to avoid the conclusion that the PHP vulnerabilities are simply the latest opportunistic episode in a long campaign to convince us that we must go all in on AI lest AI goes in hard on us.
No comments:
Post a Comment