is the VULNPOCALYPSE Coming for the Internet?

How’s that for a made up word? It wasn’t me. Blame Tech Crunch.

Here is the BLUF version. Lots of old code and old bugs. Source code for millions of applications like PHP and Linux is available for free and anonymous download from various GIT repos. Lots of obsolete, no longer maintained, but still used, versions of popular software and AI that you can run on a computer that costs maybe two grand. If it has to crank for a week using a free, Chinese, open weight AI model, who cares. All that costs is a couple of bucks of electricity. From the defender’s standpoint, keeping up with thousands of bugs a month using old, creaky, system maintenance processes is a nightmare. And, you probably don’t want your local electric provider to send you a message saying that we are going to turn off your lights tomorrow for a couple of days (or weeks) so that we can patch tens of thousands of devices.

Other than that Mrs. Lincoln, how was the play?

PHP is the most recent example, but there are many more including Linux and more discovered every day. Microsoft patched almost 2,000 bugs last month. Oracle, 1,500 bugs. Google now patches Chrome every two weeks.

The hackers are using AI to design attacks once the patches are released and before they are deployed. Sometimes that takes as little as a few hours. Other times a few days. Both of these are faster than most corporate patch cycles.

Patching by hand, which is what most small companies, startups and small critical infrastructure do will not withstand the onslaught.

Some of these bugs that AI is finding are decades old. Even open-source software like PHP and Linux. So much for open-source is better blah, blah, blah.

IF, and that is the operative word, companies take this warning to heart and implement a few critical (but possibly painful) defenses like network segmentation and alerting using AI, you MAY be able to avoid the worst of it.

As part of your annual vendor risk assessments you are asking your vendors if they are testing their code bases using AI. You don’t need to ask the big companies – Oracle, Microsoft, Google, etc. All you have to do is look at their bug counts in their patch releases compared to last year to see that they are doing that.

Also, even though FINDING bugs using AI may be easy, patching them may not be. For example, if a vendor finds a bug and the fix breaks a known common use case for the software, do you fix it and tell your customers to just deal with it? What if the customer is worth a LOT of money to you? What if there is no fix other than a major rewrite?

Also remember that finding a bug is only part of the problem. Hackers have to figure out how to exploit it. That could be easy. Or impossible.

Then you have the supply chain. Right now we are dealing with a bug in the reference code for a popular UEFI (PC BIOS) code out there. They fixed the example, but now motherboard makers have to figure out how to integrate the patches and figure out if they are going to patch a motherboard they stopped selling and supporting last year, but which there could be thousands to millions of them out there. Once they do that they push the fix to the system makers who then need to test them and only then, make it available to customers, who have to figure out how to deploy them.

Remember this doesn’t only impact servers and workstations. Consider network devices like network storage (NAS/SAN), routers, firewalls, cameras and billions of other devices.

End of life devices, ones that vendors are not going to patch at all, will be vulnerable until they are crushed under the back tires of your car. Are you going to replace all of that?

And don’t forget my favorite – critical infrastructure – power, water, gas, etc. A lot of the hardware they use could be 20, 30 or more years old. The companies that made them may not even be in business now. Replacing that, we have seen, may require a massive project and millions to hundreds of millions of dollars, depending on the size of the infrastructure. Likely, due to cost, people resources and down time, many of these will never be fixed. They will hope (not a great strategy) that the hackers hack someone else. We have already seen that often doesn’t work.

If this scares you, feel free to contact us. We don’t have a silver bullet but we can help you work through a strategy and even help you implement it.

Credit: Tech Crunch

by