AI That’s Too Dangerous For You? What we learned from S.A.T.A.N Transcript, AI Summary & Key Points

00:00 AI is now able to find thousands of zero-day vulnerabilities. Those are bugs that can be exploited by attackers because there's no patch available yet. You're completely exposed times a thousand, maybe more. One of these recently discovered zero days was in an operating system known for its security capabilities. Shockingly, it had eluded human detection for, get this, 27 years, 27.

00:28 We're all doomed. We should just unplug and live out our remaining days off the grid until our AI overlords enslave us, right? Well, hold the phone. It might not be as bad as all that. I actually predicted something like this would happen in a previous video on cybersecurity trends. No, not the AI apocalypse part, but the fact that AI would be used to find previously unknown bugs and even build exploits to take advantage of them.

00:55 Not only was this foreseeable, but it was really just continuing a trend. That began at least 30 years prior. It was inevitable. So there should be no surprises here. Let's take a look at what all this means. What are the issues? What can we do about them? And is there any hope for humanity? Spoiler alert, the answer to that last one is yes. Because if we do this right, this could actually turn out to be a good thing for us all.

01:20 Let's begin with a history lesson from a guy, old enough to have lived it, but not quite old enough yet to have forgotten all about it. So we'll start the lesson with S.A.T.A.N. No, not that guy. What I mean here is the system administrator tool for analyzing networks, this S.A.T.A.N. When it burst onto the scene 30 years ago, it created a huge controversy.

01:44 It was hotly debated among security circles. S.A.T.A.N. was software that was developed by a couple of guys named Dan Farmer and Vytsa Venema. The latter was a former IBMer, by the way. It was one of the first automated vulnerability assessment tools. So it would go out and scan your network and tell you which ones of your systems were strong and which ones had weaknesses.

02:05 The idea being that a system administrator could use this to find out where they were weak and they could shore up their defenses before the bad guys had a chance to. But this also meant in the hands of an attacker, it could be used to figure out how to actually break in. So like most technologies, it was dual use. It means it could be used for good or it could used for bad.

02:28 And that's why it was controversial. And the fact that it was named, well, S.AT.A.N., that certainly fueled the flames. So note to future self, don't name a tool intended for good after the Prince of Darkness unless you want a PR nightmare, which is what that one did. So many were arguing that S.A.T.A.N. was too dangerous for release publicly because it made things too easy for the bad guys.

02:51 It lowered the skill level, it lowered the amount of time, and it lowered cost of attacks for them. So that was good news for the bad guys and bad news for good guys. But the problem with that argument is that it overlooks the fact that good guys could use this tool as well. In fact, they could use it to find where they were weak before the bad guy did, and then they could harden their systems.

03:14 In other words, it was a race. And whoever used S.A.T.A.N. the best, well, that was gonna be the winner. We look back on all this now and it seems like a complete non-issue. Everyone has vulnerability scanners now. One of the really popular ones is one that's called Nessus, but there are many more. And in fact we've had an entire industry pop up around these vulnerability scanners.

03:37 Would we call them S.A.T.A.N's spawn maybe? Indirectly or directly, this is a common class of tool in use by defenders today. And what was once a huge controversy that died down. So long ago that most of you probably never even knew about it. Okay, so much for the history lesson, old man, but what has that got to do with AI now? Well, I'm glad you asked.

04:01 Recently, we've seen AI vendors announcing new models that are capable of identifying and then exploiting zero-day vulnerabilities in every major operating system and every major web browser. That's a big deal. And the vulnerabilities they find are often subtle or even difficult to detect. As I mentioned earlier, one example of this was a bug that was found in an open source operating system called OpenBSD.

04:28 And this bug had been around for 27 years as I made that point before. So that's an open-source, meaning the whole world had an opportunity to look at this. This bug was hiding in plain sight for nearly three decades, and none of you found it. But a brand new AI model comes along. And finds it in almost no time. So is that a good thing or is that bad thing?

04:54 Well, here we go with the S.A.T.A.N. 2.0, same debate, different tool, same set of issues. Well, so it's always dangerous when a new zero day is found because we haven't had time to yet adapt our defenses, which is why we call it a zero day. But it's a good things now that we know about it so that we can work on the fix. The worst case is if only a few people know and the rest are in the dark.

05:18 Then those people can exploit with impunity and the others will just be victims. So let's consider a timeline so that you understand what I'm referring to here. If we think about risk and as it increases over time, so I'm gonna map risk here along the y-axis and then we'll look at time as it goes out this way. So first imagine that a bug is introduced.

05:43 So this is when there's a mistake in the program, the vulnerability is introduced, Now we're gonna see what the risk does. Initially, there's virtually no risk with that. Then the next thing that happens is the bug is discovered. Now, what does that do to risk? Risk is gonna go one of two directions, but both of them are up. It's just a matter of how much up.

06:06 If only a few people know about it, then the risk is through the roof. If someone who is a good actor knows about it and then notifies the vendor of what they need to do to fix this. Well, then the risk is lower because only a few people know it at that point. But what happens next? Well, eventually, the bug gets publicized. And once that happens, then...

06:31 The risk is up here regardless of who notified about it. Because now the whole world knows about this risk and notice there's nothing they can do about it, they just know about it. The next thing then is that a patch is made available. The vendor hopefully comes out with something, we can put that on and then eventually a patch is applied. Once the patch is applied, then this risk goes right back down.

07:00 So if you look at this model, the timeline, basically where the danger zone is, right here between discovery and application. That's when you have to be worried. That's where if only a few people know about it, they can take advantage. If everyone knows about it we can build the defenses. But ultimately you've got to apply the patches or put in whatever the countermeasures are to make sure that this thing is gonna be safe.

07:26 So all of this raises questions about how this type of capability should be used and shared. That's what many asked about S.A.T.A.N. when it first came out, but now everybody has vulnerability scanners and no one seriously debates whether they're a good thing or a bad thing. They're just an essential part of the cybersecurity toolkit. The same is true of these new AI vulnerability scanners.

07:47 It all really comes down to who is using it and what are they doing with it? So for instance, if a good guy is using it to find vulnerabilities in their system and fix them, that's a good thing. But if it's a bad guy using it to find vulnerabilities and exploit them, well then it's bad thing. So besides, at this point, this technology is already out there.

08:10 There's no unringing this bell. In fact, we've already seen multiple AI vendors innovating and iterating in this space. Also we've seen where source code for AI systems has been leaked. So there's no reason to think that AI models won't also leak as well. And when it does, attackers will make versions without the guardrails, just as they've already done in the past with a thing called WormGPT.

08:34 Yeah, that's a real thing. It will happily write malware and other exploits for you if you ask it to, but please don't. Okay, so what should we do about all of this? Well, one thing for sure is that AI is not gonna get dumber. This trend will continue. And you will not be able to contain it. So let's embrace it and figure out how we can leverage it.

08:57 So that way it's to our advantage. First of all, we might start with this notion of responsible disclosure. This is something that's been around for a long time. And the idea behind it is that if I find a bug in a particular product, then I notify the vendor and therefore I do disclosure to them. And I give them let's say 30 days, maybe 60 days, maybe 90 days, I can choose whatever that interval is.

09:25 And then that way the vendor has this much time, this much of a head start, where they can develop a patch, put the patch out, and then everyone is safe. As opposed to if I just take this vulnerability and tell the whole world, then everyone's vulnerable until the patch is available. So this is a way of notifying the vendor and trying to give them a headstart on the problem.

09:48 Without exposing everyone. But it also, because it has a timeframe built into it, puts pressure on the vendor to in fact fix the problem. Because if they don't do it after this amount of time, then I'm gonna go public with it. And that puts the pressure and that does good for all of us. So this model of responsible disclosure has served us really well for the last 30 years.

10:10 So why wouldn't we do the same kind of thing when it comes to these AI vulnerability models? Another idea to consider, is integrating this kind of next level testing into the standard DevOps process. You're familiar with this term, development and operations. Well, let's add a component here and make security right in the middle of all that and turn it into DevSecOps.

10:33 So in other words, no code goes out without first being run through the AI wringer. That way the good guys get a chance to plug the holes before the bad guys get chance to exploit them. The idea that AI can find vulnerabilities at a rate that is orders of magnitude greater than what we've seen before, sounds really scary at first. Or maybe that's just because we learned from history that we don't learn from history.

10:57 As you can see, we've already had a big debate 30 years ago about S.A.T.A.N. No, that one, which was initially judged by many to be too dangerous for public consumption. We don't think that anymore about that tool. Seems the same thing. Will happen with these AI vulnerability models as well. The only difference is that the velocity and volume is going to increase.

11:20 But what else is new? We've seen this kind of thing before. This has always been the trend with information technology and we've always risen to the occasion. Helping balance all of this is the fact that we have better tools for defense than we used to. The good guys have AI too and we need to make sure we're using it better than the bad guys are. Mozilla announced that Firefox 150 include fixes for, you ready for this, 271 vulnerabilities that were identified by their use of one of these AI models.

11:52 So that's 271 bugs that won't get exploited in your environment as a result of the good guys leveraging this technology. It's a race to see who will use the AI models best. Will it be the bad guys? Finding holes and exploiting them or the good guys finding holes and plugging them. It's AI versus AI. If you're a glass half full kind of person then you're going to love what Mozilla concluded.

12:17 They said this the defects are finite and we're entering a world where we can find them all. So does that mean the end of zero days? Well I'm not sure I'm ready to go quite that far, but if we do this right what first look like a super scary tool could usher in a new wave of tools that make us safer as they get in the hands of more people. That's what S.A.T.A.N. taught us 30 years ago and now we just have to make sure we don't forget that lesson.