TuxCare Warns AI Will Weaponize Vulnerability Chains

Hey guys. Thanks for the throw. We're here with Igor Zeletsky, who's the CEO of TuxCare, and we're having a little chat about, well, this AI vulnerability apocalypse that's about to descend on us and what it means.

Igor, welcome to the show. Thank you. I think one of the issues that we're starting to see is that people are on maybe too far of an extreme on both sides of this thing.

On the one hand, I got a bunch of folks who are saying that we're going to have this massive amount of new vulnerabilities that are just going to be too much for us to deal with. " I can't help but wonder if maybe the truth lies in between those two extremes somewhere, because it seems like even if the vulnerabilities are low level, they'll get strung together in ways that we don't think about just yet. Or what's your impression of what's going to happen here?

Yeah, I think you're exactly right. So first of all, I think both of those set of people are right. There is going to be too many vulnerabilities.

They will be low level vulnerabilities based on our way to classify vulnerabilities today. But it wouldn't matter from the perspective of attacks, because attacks will come from chaining large numbers of those vulnerabilities together to get to the meaty part of the organizations, to penetrate deep into layers and layers of protected stuff, and extract the information that can be sold, get people into the situations where they have to pay ransom or simply steal money. To tell you honestly, I told all my friends and relatives, expect that your computers will be hacked, that your bank will be hacked.

Make sure you have two-factor authentication so that your money don't get stolen, or if they're stolen, it's not your responsibility and bank has to reimburse you. I'm on the camp of we will have very difficult year and a half. And difficulty also stems from the fact that while everybody seems to be obsessed with Anthropic and Mythos, but there's a lot of models out there, and some of them are already pretty adept at finding vulnerabilities, and they don't have to be the super secret Mythos ones to accomplish this goal.

And it also seems like the bad guys can now reverse engineer a vulnerability in a matter of hours, right? Yeah, I think that's where most people miss what Mythos is about and why a lot of security experts are scared what it will deliver. So, if you look at ecosystem, we knew about huge number of vulnerabilities, like there was thousands and thousands of vulnerabilities reported every year, but most of them were never weaponized.

So the difference between Mythos level systems, and I know OpenAI has a similar one today, they just restrict access to it the same way as Mythos is restricted. But the power of Mythos is not in discovering vulnerabilities. It is in weaponizing the vulnerabilities.

So majority of models today, they're fairly weak at weaponizing vulnerabilities. They might be able to do 5% of the vulnerabilities to be weaponized, while Anthropic and Mythos claims number closer to 60. So imagine you need to string 10 vulnerabilities together.

If you can weaponize only five of them, you are not going to move that far. If you are weaponizing 60%, you can actually progress and get to the core of attacking the companies. So I still think that hackers will get hands on it because I believe in 6 months to 12 months, this will be something that open source or Chinese models will be able to do.

They will just catch up. But the real issue is not ability to find vulnerabilities, it's ability to write code to actually exploit them. What should enterprise IT organizations be looking at here?

I get that this is happening, and it's out of their control, but are there things that you think that they should be putting in place today that maybe mitigate some of this later? Sooner? Yeah, definitely.

First of all, not everything is lost. It's not like, oh, it's disaster, et cetera. So the rules of multilayer defense and depths security is still going to protect us, and solve a lot of those problems, slow down the attacks.

So this is one of the things that has been done by organization for at least a decade now. That will continue to work. I think the idea of prioritizing vulnerabilities based on scoring, et cetera, is kind of out of the window.

We need to fix all of them, and that's what we're doing inside our company, and I recommend to other people. " I think it's no longer the right approach. I think we have to address absolutely everything, because If you have 20 vulnerabilities, low vulnerabilities in your software, you should be prepared that hackers will be able to abuse them to get to a critical level chain that allows to penetrate as deep as it gets.

So is the emphasis going to shift to what we call resiliency and the ability to contain the breach and the assumption that these things are going to happen, and we need to be smarter about how we architect our systems so that when there is a breach, there isn't this kind of wholesale access to everything? Well, that's what I'm saying. We're doing it already as this is something that most IT organizations are doing.

There is going to be more of that, but no, I don't believe this is going to save us. Because typically would just save us because it takes too long to exploit and IT organizations had time to react to it. Right now or in a year, once it will be accessible to all the hackers, the attacks will be much faster.

And I don't believe that AI systems will be able to react to it as well. So we can say, well, what if we put AI instead of humans to monitor the signals and react? And yes, it will help.

I think it's not enough. I think we are actually going to see significantly safer, from the security standpoint, environments in the next three years when we will fix all the vulnerabilities in our software. So today we cannot do it or two years ago we could not do it because we didn't have enough expertise among developers to fix all those vulnerabilities.

And right now, because AI is pretty good and getting only better, we will fix all of them. We will not have hundreds and hundreds of low-level vulnerabilities or undiscovered vulnerabilities in the systems. We will discover them, we will fix them, and then we will do it again and again as the models become smarter and will find new vulnerabilities in the same code.

So I think what will start happening is that software will be fundamentally much more secure by itself, and that will save us. It's just going to take us time. It seems like historically we only spent, I don't know, couple hours a month on fixing software.

I've seen recently maybe some organizations have at least temporarily stopped building new features and new capabilities just to focus on fixing vulnerabilities for a little while in the hopes that they can get ahead of this in some fashion. Is that going to be more common or is that the exception to the rule? I'm in that camp.

I really hope it will become more common. I'm monitoring what's happening with open source systems, and I know that maintainers are overwhelmed with the number of reports, and they're not fixing all of it. I hope they will start fixing all of it.

I understand it's not as simple. I hope AI will help as it progresses, but I think there is no choice. I think a lot of organizations have also historically been reluctant to patch, and part of the issue is you didn't know what the quality of the patch was and you're waiting to see somebody else work with it and see what their experience was because you were afraid it might take your application offline.

Have we reached a point maybe now where the risk of the security breach is higher than the downtime, so maybe we need to automate a deployment of the patches and we can always fix them later if there's an issue? So we're not at that point yet. At least to me, it's clear because you don't see these widespread waves where every day there are 10, 20, 30, 50 organizations that has been hacked, in a small region, in a small segment of the industry.

I think we will get there. I think once the meters level models will become available, we will see this huge wave of attacks, huge waves of companies being penetrated, and then that's when everyone will wake up and says, "Oh, we just have to patch you. " And I think the main problem with patching is not that...

It's the fact that we need to test and know that we haven't broken everything, anything. It's not that we need to make sure that the patch does fix what it needs to fix. We need to make sure that it doesn't break the functionality.

That's why most people are afraid to patch. I think we do have good tools for patching. We don't have good tools for verifying that the systems are up and running after that.

And I do believe there is going to be big investment across companies to make their CI/CD pipelines, to make whatever is possible so that they know that when they release new version, when they roll out a patch, things didn't break. There's a lot of panic and hysteria, and that's to be expected, but what's your best advice to people who are actually responsible for all this about what they should be doing and how should they be approaching all this stuff? So first of all, I do believe there is two categories of people who are responsible today.

One is security departments. They need to make sure that they do have layers, that they do have defense in depths, that they do isolated environments and all that stuff. Something that they have been doing for ages.

They just need to do it better, more of it, and using latest tools. I think that developers were Always more reluctant of spending time and focus on security. And I think it's something that will bite them in the next six, 12 months again, and they need to really get ahead of the wave.

So I'm in the camp of yes, start fixing all the vulnerabilities. Start detecting vulnerabilities and start fixing them as soon as possible, because it will take time and once this wave starts, it will be scarier. It will be especially scary with open source software, because hackers can just run the model against it and find all the different vulnerabilities and then start creating exploits for them.

But I think it is the same thing with proprietary software because we know how to disassemble stuff, we know how to reverse engineer it, and the models are as good, well maybe they're not as good, but they're getting close to be as good with exploiting such proprietary software where code is not available as they are with open source. Is this a battle that's going to be fought at machine speed? And I'm asking the question because it seems to me that the bad guys will have AI agents that are building exploits as quickly as possible, and the good guys hopefully will have AI agents that will sense those attacks and create a patch and test it and deploy it and hopefully, the amount of time where there's damage being inflicted will be kept to a minimum or is that too hopeful?

I think it's not practical. I don't think that's how it will work. So here's what's happening.

The way attackers attack is that there is a vulnerability that they discover. Now they are not reading NIST reports, database, et cetera. They are trying to discover new vulnerabilities.

Now they got superpower to discover new ones. Then they create the exploit, and then they run the exploit. So the defenders know about someone running the exploit maybe two, three weeks later after the exploits are actually created.

So hackers had all the time, defenders don't have any time to react. So that model doesn't work, and that's why I'm saying it's all on the developers, or a lot of it onto the developers, because they should be doing what hackers are doing. They should be spending a lot of time discovering vulnerabilities and fixing them.

They should be running the same models that hackers will do to discover vulnerabilities, but instead of creating exploits, they should be closing them down. To your point about that, we've been talking about shifting more responsibility for application security left for a long time now. And to be honest, I don't feel like we've had a whole lot of success doing that, and part of the issue is the developers claim they don't have the time or the cognitive load is too high.

So how do we shift more responsibility left? So, time is obviously always going to be a problem. Cognitive load, I don't buy it.

I think it's mostly about expertise. Developers just don't know how to hack. They never had to learn how to hack.

Plus, that's not what developer wants to do. Developers actually very good in implementing in the code how things should work. Hackers actually have to get this assumption and find where the model of how it should work breaks in the code.

So completely two different skills, and we always lack that skill of hacking in the development teams. Like there was never enough hackers. And that changed with models.

Like with Anthropic models, with OpenAI models, now we have this expertise. So today, developers no longer have to look for the vulnerabilities. They don't have to acquire the skill set to do it.

They can just run models and detect this huge number of vulnerabilities that hides in plain sight in the code simply because no one with the right knowledge had it. And of course, my phone is ringing. Yeah, go ahead.

Sorry. So ultimately to your point, are we about to see a regular series of cascading catastrophic events, or is this going to feel more like a death by a thousand cuts before everybody kind of wakes up and figures out what's going on here? I'm afraid to make any prediction like that.

So my expectation is that everything will be fine. Everything will be fine because we will see more and more attacks. Industry will wake up.

We have people today who are fixing all the bugs, fixing all the security issues, focusing only on security and not doing anything else. We will see as the number of attacks increases, we will see more and more companies doing exactly that. Stopping what they're doing, fixing all the bugs, fixing all the security issues, and then continuing to move forward already with all the processes, not to introduce new ones again.

All the processes that there is a new smarter model, we rescan all the code and fix all the bugs. So I expect us gradually get to the point where we are significantly more secure than we are today and where ransomware attacks that are happening today are not a thing. It's going to get worse than today, but I do believe the industry's smart enough to know when to make this transition and do the right thing.

All right, folks. Well, you heard it here. I think there's a German philosopher who said something to the effect of that which doesn't kill us makes us stronger.

Seems that's going to be the case here. Igor, thanks for being on the show. Thank you, Mike.

Thanks a lot. All right, and back to you guys in the studio.