AI Bugs May Spark More Internet Outages, Experts Caution
Advances in artificial intelligence have revealed a series of new software vulnerabilities that are likely to lead to further disruptions similar to the outages that affected government websites worldwide this week, as indicated by seven cybersecurity professionals. AI contributed to a year-on-year doubling of the number of digital flaws identified, as indicated by forthcoming research. Matthew Prince informed that he was cognisant of “a bunch of additional severe vulnerabilities that are present in other pieces of critical software” and anticipated busy months ahead as AI revealed long-hidden weaknesses in the fabric of the internet. And “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” Prince said in an interview on Thursday. The outages that affected government sites in Europe and beyond starting on Wednesday were triggered by the identification of vulnerabilities in PHP, a well-established programming language that underpins a significant portion of the internet. Operators have been hastily addressing their software vulnerabilities in anticipation of widespread exploitation. Due to concerns that they could not implement necessary patches before hackers could take advantage, some opted to take their sites offline until they could ensure their safety.
Researcher Patrick Garrity noted that the urgent efforts to address vulnerabilities in PHP coincided with an already hectic week in the cybersecurity landscape. The week also brought disclosures of vulnerabilities in PHP alternative Node.js and streaming program Plex, breaches tied to AI gateway LiteLLM and development platform Railroad, and the revelation that Indian certificate authority eMudhra had employed an extraordinarily weak cryptographic key, potentially jeopardising users across the internet. “If we just saw four or five things like this, this week, I would expect we’re going to see a lot more,” Garrity said. “I think there’s going to be a lot more fire drills for anything that’s internet exposed.” The codebases that underpin contemporary software are extensive, and errors, or “bugs,” that create potential opportunities for exploitation frequently emerge in unforeseen locations. Historically, identifying bugs necessitated a fundamental level of expertise, and leveraging those bugs to create digital lockpicks – referred to as “exploits” – was typically anticipated to demand weeks or months of effort from a seasoned professional.
Historically, this would have afforded defenders some leeway to address bugs and implement software updates incrementally. AI has effectively discarded those assumptions. Models can identify one flaw after another by continuously analysing codebases and can generate exploits within hours. Shane Fry stated that the demonstrated performance of AI models in recent months has effectively dispelled any lingering doubts regarding their potential to transform the industry. “What’s fundamentally, and unquestionably, changing is the timescale for not only finding vulnerabilities, but how quickly adversaries can weaponize them,” Fry said. While all the experts concurred that the timelines for defenders were diminishing, there was a division in opinion regarding whether AI would result in a free-for-all for hackers. Daniel Stenberg contended that the vulnerabilities identified by AI models were often exotic bugs that posed challenges for malicious actors to exploit. Ramy Rahman, a senior principal solutions engineer at cybersecurity company ArmorCode, stated, “more disclosed vulnerabilities do not automatically mean more successful attacks.”
There was preliminary evidence of that surrounding the PHP vulnerability that garnered global attention this week. Threat intelligence firm Hunt.io reported that it had observed aggressive attempts to exploit the bug, similar to those seen with Amazon and Cloudflare. However, the firm’s head of research, Esteban Borges, stated that, as of 2 p.m. Eastern Time on Thursday, the cybercriminals he monitored seemed to have been unable to assemble an effective tool to exploit the situation. Prince, of Cloudflare, informed that he had observed anecdotal evidence of compromises associated with the PHP vulnerability. The influx of AI-driven discoveries may unsettle the industry; however, it is likely to yield a net positive outcome in the long run, he remarked, likening it to vanquishing the monsters within a haunted house. The confrontation may evoke fear, he stated, yet allowing the monsters to remain hidden behind closed doors is decidedly more detrimental. “The reality is, we’re going to get a lot of this stuff cleaned up,” he said.
