?PHP Problem? - Computerphile Transcript, AI Summary & Key Points

00:00 Oh, it's been a busy week. >> Um, it's like everything. You wait for a PHP vulnerability to come along and two arrive at once. And that's not the only ones that are happening last week. It's been a a bit of a a storm in the cyber security world. Um, quite a few vulnerabilities over the last week have come out. Um, and I thought in this video we'd have a look at the two PHP vulnerabilities.

00:21 Um, probably because they made the most um, press. I never thought I'd live to see the day when the BBC's rolling news live story would be live patching of computers across the world. Obviously, there wasn't a cat stuck up a tree last Wednesday. Uh was it Thursday? I lose track of the date. Um but yeah, so things have been rather busy. So I thought we'd have a look at what those PHP vulnerabilities were, how they sort of work in general.

00:46 We'll run one of them to see that actually yes, it is a real vulnerability and then we'll have a little chat about the aftermath of what's come over there. PHP is probably a good place to start. Um, it stands for something like hypertext processor. I can't remember the exact details. I have a book here that I bought I think back in 1999. It's a second edition and it has a whole chapter on PHP.

01:11 So, it's been around for donkeys years. I think it's been around for about 30 years. >> Assistant hypertext uh process. >> Um, something like that. It doesn't actually say in this. It just calls it PHP. So, we'll just assume that it's called PHP. So, PHP, what is it? Well, when you create websites, generally we will write them in HTML and that's great.

01:29 If the website is static, we could put some JavaScript in there which will run on the client. What PHP enables us to do is to develop websites which build themselves programmatically on the server. So what you can do in PHP is you can put commands into it and you use a syntax which is basically angle bracket or a less than sign question mark and then you put the commands that you want to do and then I think if I remember correct it's been a long time since I programmed PHP.

01:55 You put a question mark and a close angle bracket or greater than sign there. You put that into your code and when it runs through the server the server will process it, run the code in there and you can do cool things like you can put four loops in there. You can wrap blocks of HTML inside the for loop and repeat it many times which is great if you want to say populate a table with data from a database.

02:18 >> So when you say dynamically so that's and programmatically that's so rather than typing in all the data into the web page it can go and find that data. >> Exactly. Say you wanted to create a video sharing site like this one. Um you might have a list of videos in your database and you want to show the user the ones they've already watched on their history.

02:35 You'd go to the database in your PHP script. You would select all the data. You would then populate the HTML that you wanted as a program repeating the same block popping in details say with the thumbnail with the name of the video and so on to see how many computer file videos they watched in the last day. So that's what we mean by programmatically.

02:54 We're creating it based on some sort of data. >> Now PHP has been phenomenally successful. Um loads and loads of websites use it. you have almost certainly visited today a website that uses PHP somewhere in the back end. So it is everywhere and there are lots of different um versions of it. Uh, and what happened last week, um, last Wednesday I think it was, there were two PHP vulnerabilities that were announced, or let's put it another way, they were meant to be announced orderly.

03:25 Um, but chaos ensued. Um, someone accidentally released details of them onto Hacker News. Um, he'd been told about them, wasn't told they're embargoed, so he just posted about them so people were aware of them. someone else accidentally released a video of an exploit for one of them, which meant that the whole thing had to be brought forward because these vulnerabilities enabled you to run code on the server as the website.

03:50 So you could be sitting, as we'll see in a bit, you could be sitting at your laptop, connect technically to a website and run your code on there. And this is a bad thing as a website administrator. This is something you don't want to happen. So what were those two vulnerabilities? Well, I think it's easy. We won't go into the details, but I think it's easy to sort of see how they work in in sort of the general terms.

04:15 The way PHP works is that you have a series of worker threads that you create that process the request. So, when you go to a website, you send a HTTP request to it, that gets passed to one of the worker threads for PHP, which will then process it based on the program that you've created in your PHP file. So we got this worker thread and I'm going to represent this by a box.

04:42 And for one of the vulnerabilities, there is various state in here. We've got things like error state. Uh we've got things like objects that are in use. We've got stuff like extension that we've got in there. And that's global. It exists for the whole worker thread. And what happens is when a request comes in, the request is temporary. It happens. So I'm going to represent that with a postnet.

05:04 So that request comes in to the worker thread and it comes in and various bits of these are set to point to stuff in the request that we've got. And what normally happens is the request is met, the details are created, the page is created, these are then removed and so on and the request disappears. But you can get a state when what actually happens is there's an actual thing in the system where if some sort of error occurs or something happens this can get destroyed the request can get turned down but these links into

05:40 it still remain. So what happens is uh and this is how you can get the remote code execution. If you construct another request or several requests in fact to it, what happens is the next request comes in u and under certain circumstances these things still point into that. They pointing to the old one, but the old one's gone and we've got a new one here.

06:02 And if you can construct your initial request and then this second request and possibly a third and fourth in a just the right way, then you can get code to run on the server that actually you've created rather than what the person who wrote the website. And then you can do all sorts of nasty and malicious things to that website. You could extract data from it.

06:24 You could use it to attack something else. So it's it's a big vulnerability and I'll run a demo of it in a minute and it'll happen. So that's one of the exploits. The other one um is it's similar. Basically, there is a thing in C called a long jump which is used um particularly for things like error handling and particularly that's what it's used for in PHP if you get an out of memory error.

06:45 Um so you can do a similar thing. You can you cause this sort of error. It causes a long jump to happen and it then happens to jump to the wrong place. the state isn't quite reset properly and if you craft things in exactly the right way, you can get your code to run on the server. So, these are really bad vulnerabilities um that mean that I could be sitting at my computer and run code on let's say um Wikipedia's web page uh and so on because Wikipedia is written in PHP as is everything that uses WordPress and a

07:20 bazillion other websites that you could name. So this was a really big problem and to make it worse it had existed for about 14 odd years of PHP releases. So it's not just in the latest and greatest. You had websites running PHP 5 that suffered from this right up to PHP 8.5 or 8 point yeah 8.5 um that you had running this. So it was a huge problem and they all needed to be patched because you could run stuff on there.

07:45 Um let's have a look at that working. Um, I've got the laptop open and I found I did not write this exploit. Um, I haven't had time unfortunately to dive into the source code and actually try and write this myself. I've got one I think it was released by a Chinese group of people called 9BIE. Um, and there was a translation which I found into English which is very helpful.

08:06 So what I've got on screen now I've got two windows open to a machine downstairs which I use for doing sort of malware analysis and so on. So on the first window on left, what I'm going to do is I'm going to run a PHP web server and it's going to serve one very, very simple web page. So I'm just going to run that. And so that's going to run. There's nothing special about that.

08:24 It's just a standard thing. And if I make a curl request to it from the same machine, I'm only running this on the local machine. I don't want to expose this to the whole internet. Then all it does is it returns. Okay. >> So curl is that thing where >> curl is a command line tool for fetching things from a URL, connect to URL or something like that.

08:42 It will stand for I don't know what it actually stands for but that will be >> something URL >> something URL probably C URL it's a really great tool so we can connect to it we can get something back all it does is print okay that's all it's set up to do what I'm going to do now is run the exploit which is written in Python and it will use the various vulnerabilities that were announced last week to run arbitrary code on there's a folder on this computer which is currently empty called out and it will write into that

09:11 folder a text file called P1 which will contain the ID of the user it's running it. So if I type that now, you'll see that I'm running as the user Steve. What will happen then when I run this exploit is it will make various requests as we talked about to the server um and cause it to get into a state where it runs arbitrary code and it's going to run basically the command ID which will tell us who the user is except it will get the user of the web server.

09:37 So it'll be www data which is a standard username you use for web servers. So let's give that a whirl. I'm connecting to the server. I've run it on port 1810 because that's what the example I got was set up to do. So if we run that and we'll see it'll start to make the request to make this work. It's actually doing some interesting things first and we'll talk about that in a minute.

09:58 So there we are. It's run and right at the end it's printed out the data that we've got and if we have a look at that folder now out we'll see it's created that file and in there we can see whoops cat outp1 we can see that it's got the details of the web server these exploits are real they do work they do enable you to run arbitrary code on another server they're not a sort of scam or anything this is a real exploit this needs to be patched having said that now however It is actually quite difficult to exploit these

10:34 vulnerabilities. Uh and actually the PHP team did discover at least one of these back in 2024 and they had discussions about well should we patch this? This is dangerous. But at the time they couldn't work out exactly how you would uh exploit it and they couldn't also work out a way to fix it in a way that didn't cause other problems. So they sort of left it.

10:54 They probably think that may have been a mistake at this point, but hindsight is always 2020. Um, let's not lay into them because of that. I mean, they're an open source team. They're probably not that many developers doing this in their spare time. It's amazing what they can produce. We should look at that as much as we look at the stuff that they can't.

11:14 However, they probably did make the wrong choice here, particularly because over the last few years, the number of stochastic parrots that are being used to test these things has gone up. and what happened over the summer. >> So by stochastic parrots, you're talking about large language models, right? >> A static par I mean a large language model. Certain people have sort of argued about whether it should be artificial or super.

11:34 Um from my point of view, that was never the part of the name that was in out. It's the intelligence bits I have doubts over when it comes to large language models. Um I'm showing my biases there. So one of the AI companies that are around have been throwing money, throwing tokens at trying to find vulnerabilities. If the PHP team in 2024 were discussing this, that's probably in a public forum which will have been ingested into the large language model at some point.

11:59 So, >> so it might have actually found that. >> Yeah, I mean, we we don't know. They may well have found it independently, the vulnerabilities as well. We don't know. Although I suspect the the large language models have seen the messages and the data from PHP, so we can't rule out that they were using that. We'd have to inspect and see what's happening.

12:15 But anyway, we've got now the vulnerability. We've certainly got the second vulnerability. Um I think the PHP team only found one of them. So definitely that one was found. And more importantly, they managed to produce working exploits uh and then completely bungled the release of this. We don't know why that happened. I I mean certainly the guy who posted it on Hacker News said that he didn't know there was any embargo and just thought he was passing on useful information.

12:38 So we shouldn't harang him. People who managed to misrelease a YouTube video. Well, as Sean will know, um, if you've ever used the YouTube interface, it's probably quite easy to not click private at the right time or set the date wrong and get it to come out. >> I mean, that, yeah, that's definitely a possibility, but um, one thing I would say is that, um, we should probably just talk about that embargo idea.

13:00 So, so is this is the idea of people know about it, but you don't want it going super public. >> So, I think, so, yeah, I mean, the thing is, as we've seen with this, you can basically get access to another server. Um, so if you've got this, you don't want to announce details of the vulnerability, particularly in a situation where anyone with a stocastic parrot can probably spend enough tokens and generate their own exploit um before you've got the patch.

13:28 So what you will generally do in these things is responsible disclosure. You will tell the people who are developing the software, we found this vulnerability. They will verify it. Um, they will come up with a patch. they will probably then talk to downstream people so the the Linux distributions and so on to say well hang on this patch is going to come out um we need to get all our ducks in a row so that when the vulnerability is announced it's announced with this vulnerability has happened you need to apply this

13:56 patch >> ASAP fix is available >> rather than hey all your websites are vulnerable and we're not going to release the patch for a while which may or may not h have happened with certain other companies earlier in the year but I won't go into that uh for fear of legal repercussions. This came out in a bit of a a mess on Wednesday. Um well, Tuesday night, I think it broke.

14:20 Wednesday, they released the patches. Thursday, everyone was updating their machines. Um and yeah, it became big news. You had the NCSC in the UK and the equivalent elsewhere in the world sort of telling people, you must patch. If you don't patch, take your website offline until you have patched it. um which I don't think I've ever seen that sort of level of um data there.

14:39 These are bugs. You should patch them. There's no doubt about that. Um what I find odd is we haven't seen the sort of level of scripty sort of attacks on websites. I mean it I found this relatively straightforwardly on line um to exploit it. it wouldn't be hard for someone to have fun with this um or be malicious with this as you'd want to. Um we don't seem to have seen that.

15:11 Now that could be because we managed to get the message ac but people managed to get the message across uh and everything was patched before anyone had a chance. But actually I think part of the problem is is that this isn't an easy exploit to use. One of the things that happened when we ran this is it said at the beginning pinning 150 workers because to exploit this you need to make sure that you're always talking to the same worker thread that PHP uses.

15:34 The way PHP works is you're getting requests all the time. You're not just getting one request you handle then you hand the other the next. You would have lots of them coming at a time from different servers sorry from different clients from different people on the internet. So you have lots of these worker threads each of which have their own global state each of which have their own requests going to them and as you send a request in it gets rooted to one of them and so to actually exploit this you need to make sure

15:59 that your request goes or all your requests go to the same one to cause it to happen and so what we had to do what this exploit had to do was make sure that all the other ones were tied up doing something else. So the default is that you have 150 of them in PHP. It tied up 149 of them doing something useless so that it could hammer the one that was remaining with its request to generate the exploit.

16:22 Not only that, but you need to know sort of which version of PHP it's running, what the operating system is, probably even what C compiler it might be running may have been compiled in and so on to try and get this. You need to know a lot of information about the setup to actually make it work. So I suspect actually exploiting it in the wild is probably not as easy is to exploit it on a Docker container running on the same machine.

16:46 Um all it would require would be someone else to make a request to that one remaining server before yours and it would have destroyed the state and your attack wouldn't happen. Um so yeah I suspect it's very important that we patched it. Was there some hysteria over it? Possibly. Was that stage managed to bump up IPO prices? Possibly. Fortunately, I don't I only don't manage any websites, so I didn't have to deal with it.

17:13 But um poor old Michael, who manages the ones in the university, um certainly had a rough uh Wednesday, and I think our cyber security person, Mark, definitely had a a rough few days last week. So, um but then it's probably a good idea that those PHP machines were patched. I don't think this is the case. Uh but part of my brain goes like this. If I was a a malicious actor, um, if I was a malicious actor and I wanted to make sure there was code running on lots and lots of websites, if I could get that code into PHP and

17:45 then arrange something like this where everyone is rapidly patching everything in one go, it wouldn't be a good way to do it. Uh, I don't think that's what's happened, but it makes you think. And so, actually, has anyone seen Mike Pound recently? Is he sort of sitting on the Spanish island sunning himself as he sort of exploited the whole world? Mike.

18:06 Mike. >> Hey there everyone. Our channel sponsor Jane Street is challenging you to design your very own chip. Your opensource protocol emulator will be able to talk to other hardware and be reprogrammable after it's manufactured. But here's the best bit. As a prize, Jane Street are going to choose their favorite designs and actually manufacture them on a dev board in cold hard silicon.

18:35 I guess the silicon will get warm, won't it, when it's Anyway, all the details can be found on this blog post. I'll link to it below. All the stuff you need to get started is here. All the information, all the bits and pieces. Jane Street's encouraging innovation, creativity, and feel free to use AI along the way. That's all part of it. This is suitable for people of all experience levels, including first timers.

18:54 You can do it on your own or you might want to do it as part of a team. Submissions are due on January 18, 2027. So depending on when you're watching this video, well, it might be too late, but hopefully you're watching this video in time. Don't just sit there. The links are down below.