Cybersecurity's Past, Present, and AI-Driven Future

0:00It's time to hand over cyber security to computers. Entropy is increasing. They have more apps, more entitlements, and more actors. Every single year, it's exponential growth in the number of public breaches. The size of the breaches, the damage in the breaches, vendors still exploding. How can they watch out for a bank run that's orchestrated by a deep -fake campaign? If this is indeed a state -back, this is probably not the only thing they did in that two -year period. In 2022, $8 .8 billion was lost by consumers alone in the US. How can we build compound businesses from day one? How can you actually build a platform from day one even though you start up?

0:40Who does security? Nobody does security. The cost to launch a disinformation campaign that's AI generated is quickly approaching zero. Now that the cybersecurity industry commands a market of hundreds of billions of dollars, It's easy to forget how this industry once ceased to exist. And in its few decades of rapid growth, things have changed a whole lot. So in today's episode, we'll take you on a tour through the history of security, which can't be disentangled from the history of the internet and culture. This episode was actually recorded at the 16Z's Campfire Sessions event this April, where our infrastructure team brought in some of the top security minds in the industry.

1:20And just like any good campfire session, today you'll hear four people talk candidly about what's really keeping the overnight. From what really happened with the X and UTILs attack to new AI threat factors that are already impacting companies, to empowering overworked developers, and a lot more. For those both inside and outside the security community, I hope this episode is a helpful reminder of just how much has changed throughout the years, for both offenders and defenders of trustworthy computing. So with that, we'll start with Travis McPique, GoFounder and CEO of Resources. We'll walk us through how we really got here.

1:57Let's kick things off in 1995.

2:03As a reminder, the content here is for informational purposes only. Should not be taken as legal, business, tax, or investment advice, or be used to evaluate any investment or security, and is not directed at any investors or potential investors in any A16C fund. Please note that A16Z and its affiliates may also maintain investments in the company's discussed in this podcast. For more details including a link to our investments, please see A16Z .com slash Disclosures.

2:33Okay, phase zero, the Dark Ages. The year is 1995. Build more number one song, Gengsters Paradise. The box office number one was Batman Forever, nostalgia for the old people here. Who does security? Nobody does security. It was a totally different world. You have to realize that we didn't have much internet connectivity. Patching wasn't really much of a thing. Vendors was basically like an aviress in the start of firewalls. Milestones of this dark ages time, we had the first DEF CON. We had the first CISO, Stephen Katz at CityCorp. So that year, they actually had a breach where somebody stole money.

3:09And they said, this can never happen again without us having someone to go chop their head off when it happened. So this is the first CISO. We had the first word macrovirus. The first bug bounty came from Netscape. As we'll get to you, Netscape did a lot of cool things that moved forward security. And of course, the hackers movie. It was Web 1 .0. It wasn't an app that you went and dealt with. It was a site that you came to. So this is Apple's site from 97. Hackers are like these dingy people. It's not like an actual job. One of the things that really moved from this to the next phase was web browsers went from like that Apple thing that I just showed you to a place that you go do business.

3:45Netscape made a lot of those things possible. So they brought forward SSL. They had the first bug bounty. They were putting forward a standard of how we're gonna build out apps on the internet. And that standard was JavaScript. At the same time, we had Java, which was one of the first ways of building apps on the internet from an old company called Sun, today known as Facebook. Checkpoint was founded in 1993 from somebody that came directly out of IDF and used all of the stuff that they learned to productize the web application firewall. Okay, phase two. Security is an actual thing, but it's a function of IT.

4:20So the year's 2001, billboard number one is hanging on by a moment, box office number one is Harry Potter and the Sorcerer is Stone. Who does security? IT is security. So context here, this is the start of when we get like big hacking. So it's not just like a thing that happens once in a while. Businesses have all either moved online or rapidly moving online. vendors now is Anivirus Firewall's systems management. Milestones here, Microsoft engineers coined the term SQL injection in 98. The first big internet worm that made it like bad for business was code red. The first patch Tuesday was in 2003.

4:56And I don't know if for anybody that's old like me, we have this Y2K thing, which was actually like complete nothing burger. But what was interesting about it is we cared enough about computers and what they do that we thought it might be a thing. So one of the changes here was bug track and full disclosure. So back in the day, we had mailing list bug track. People would send security vulnerability reports and vendors would basically do nothing with it. They'd just sit on it forever. And so there was this big moment at the time, full disclosure where it's like, okay, well, we're just going to put like the full gory details of this thing and force action from vendors.

5:28And then that led to regular patching cycles. So Microsoft quickly copied that. We also had the first web application security tools. So this is NICDO, an old one from 2001. It was kind of open source. But this is the beginning of these tools being broadly available. And then this is the beginning of what I call the tail wagging the dog when it comes to vendors and security. So from some of the folks I talked to, we basically have these new attack paths and the buyers, in this case IT, were very uneducated about how this works. So it's like, you need to have your web port open. It needs to be legit open.

6:01And I can get in and compromise you through that. IT didn't understand it very well. So vendors had to do their part to come and educate the IT buyers that this was possible. What this looked like was basically, I just completely compromised all your systems. And they said, how did you do that? And then you explain why this web application security is an actual thing and why they need vendor solution for it. All right. Phase two is the risk sign -off function. So the year is 2004, billboard number one is, yeah, by usher, a little John. Box office is trekked to you. This is what phones look like.

6:31By the way, these phones will last longer than you will. These things were basically indestructible. Who does security? Now we have a security team that doesn't. So this isn't just a thing that IT does with some of their time. So this is when we start to get the beginning of traditional security activities. We have Microsoft basically get popped in the mouth and they need to do some stuff differently. Tech companies start hiring people that are actually called security. Vendors now is exploding. So we have Anabirus firewall still, email security, web application firewall, DAST, and SAST. Milestones here, we have the first use of the term cross site scripting.

7:03again by Microsoft engineers, OOS was founded in 2001. The first use of the term shift left, I actually thought it was much more recent, but this is a very old term. And then SOX regulation was, I think, the first compliance standard that actually mandated some security activities. There was a growing community of folks that were really interested in web security and all of what's possible here. And Mark Kurfy started this group called OOSP to basically make this knowledge more socialized so that people knew about it. One of the first projects in OOSP was the OOS top 10. And that immediately became like, how can I get my vendor shit to be one of the top 10 things that people are buying?

7:37So this is, you know, yet more tail wagging the dog. It's like, oh, my thing should be, you know, in the top five for sure, because it's gonna help us sell a lot more of it. Now, we have the beginning of the big internet worms. So at the time, Windows basically didn't come with any firewall. You started up, it would get immediately compromised by stuff. The worms here were costing a lot of money. So we had like attacks like a mafia boys, is DeDOS in 2000. It took down more than 1 million of the 5 million IAS servers and cost an estimated $2 .6 billion in damages. And so for part of this, basically Microsoft had these big customers that were saying, hey, we're just getting killed because we're using Windows.

8:13And then this led to, in part to, trust worthy computing. Basically, we need to see the light. We can't just keep doing business as is. Bill Gates saw a very early version of a book that Microsoft folks were writing on these security practices. and basically that led him to say, like we need to completely change what we're doing. We're losing trust with customers, and then that was the beginning of what we consider traditional security activities today. We have threat modeling, stride, all of these things are being birthed around this time. We also get more compliance. So PCI DSS version one was written in 2004.

8:47This mandated security activities. Again, vendors are trying to get themselves into the standards so that they can sell more product, right? It's like, okay, well, if you're going to deal with payment card data, then you need to do web scanning, for example. Proofpoint was an example of one of the companies here that was founded in 2002. Still around today, very successful by email security, right? So as soon as you have email being used as widely as it is today, and we also have email viruses, it's okay, we're going to need something to filter out spam and viruses. So proofpoint started that and then also in Perva, a big web application firewall that it's also still around today.

9:21Okay. Phase three is DevSecOps. So the year's 2013, Billboard number one is thrift shop. Box office number one is Iron Man. Who does security? It's everybody's job. We've collectively decided that basically security doesn't scale. Like we've been this sign off function that you have to do with security before you ship your product for the year. And now we're moving to cloud, and we're doing continuous deployment. And security's like, I don't know when I do these assessments anymore. So what we do is we basically take every single developer and tell them, guess what? Good news, you're a security person now.

9:51So we're also getting more and more mega breaches. If you look at the numbers from this time, every single year it's exponential growth in the number of public breaches, the size of the breaches, the damage in the breaches, vendors still exploding. So EDR, next -gen firewall detection, all the posture management's dev training bug bounty. Milestones, the first use of the term DevSecOps was actually in 2013, and we had the first CSPM, which gave birth to you as massive posture management industry that we have today. We start to see no before, right? It's like we're going to train developers continuously.

10:23Developers are going to learn about all of the types of cross -site scripting and SQL injection with one day, like once per year of training where they learn it, and then they immediately forget it the next day. We also have big bug bounties, so crowd sourcing more and more vulnerabilities in the hopes that the attackers aren't going to use these things to cause massive breaches for us, so much posture management. The first was Cloud Security Poster Management. Evident was the first company here at Netflix. They also created SecurityMonkey, which is basically open source posture management. Since then, it's just like posture management, just exploding all over the place.

10:55We have app -sec posture management, data security posture management, identity posture management, SSPM, whatever that bottom posture management is, just so much posture management everywhere. What these things are really good at doing is going and finding problems after they're already deployed. Then you have to go do something about it, because just knowing about risk, you can't just tell your boss, okay, well, here's all the risk that we have, they're going to want you to reduce it somehow. And so what we moved to since this is now developers owning security is we rip a bunch of geartickets for them and we call it a day.

11:24So we also are getting at this time job shortage. The first time the job shortage news articles was in 2015 or early 2016. We're short of million jobs already in 2016. This is just piling up more and more. We don't have enough security people to actually do the work that we need them to do. So where does this leave us? I think that we're entering a new phase phase four of security. where basically telling developers, it's your job, you fix security all the time. Didn't particularly scale well, I think that that's becoming very evident today. So years 2020, blinding lights is number one, box office is bad boys for life.

11:57Who does security? I think systems do security. What we're doing doesn't scale. We have developer fatigue. I hear people tell me all the time, like, oh, we take the posture management and then we just filter out everything that's not higher critical. And then we ship those jurisdictions to developers. Training relentlessly, obviously, It doesn't matter how many times we've trained developers on all the SQL injection types, they still don't remember it, and really they shouldn't have to. So milestones. One of the projects they really informed how I see this is Lima, the Netflix released in 2015.

12:26Google launched their Identity Aware Proxy in 2017. Chrome added a password manager by default back in 2018. And Clint Gibbler, one of my friends, and somebody that has done a lot of work in the space, did his talk in 2021 called How to Arradiate Vulnerability Classes. So Lima. When I got to Netflix, it was in 2017, and I remember just being blown away at how easy it was for our developers to just get things like certificates without having to Select a cypress suite and pick crypto parameters and rotate it and store your private key securely It was just made it like dead symbol and the benefit of this is that developers never have to learn about crypto anything They just get it for free Google has done just probably more work than anybody here So we're going to upscale people to HTTPS automatically, Chrome updates itself, which became standard for many other pieces of software.

13:14We have these basically like impossible to mess up GoLang libraries to handle a lot of security things. And actually my mom sent me this article recently, mom's so funny. She knows that I work in security and sends me like everything that has security in it out of Wall Street Journal. And usually it's like something that either happened three months ago or it's got nothing to do with me. But this one was written by Larry Ellison, and it's not very old. At his point is it's time to hand over cyber security to computers. Basically, just relentlessly hounding the users and trying to get the users to be smarter, like it doesn't work anymore.

13:45What we want to get is developers back to just writing app code, like working on the business, not having to be like security people all the time. So today, if you think about it, Devs have to burn down this never -ending pilot, Jira tickets. This causes annoyance with the security team. If you had a friend that only showed up when they wanted you to do something, you're probably going to start avoiding that friend and we're getting a ton of that. What if instead, if they just use systems, they made good security choices on their behalf and forget about all of this training relentlessly all the time.

14:13So conclusions, I was part of this move from like waterfall to continuous and then saw this, we just heap stuff onto our developer's plate and then saw developers learn to resent and avoid security more and more. I think what we should do instead is help them out. Like they're very, very busy people. We should build a system that makes it fast and easy for them to go do something they want to do, and then has security victims as side effects. So it's like when you want your dog to take vitamins, you don't just put vitamins in your hand and offer them to the dog. You put the vitamins in the peanut butter, and the dog wants the peanut butter, and the dog gets the vitamins too.

14:45I think this is what we should be doing for our developer users. Speaking of meetings, make things easier for our developers. Let's get a sense of what these hacks can really look like in 2024. Now, usually in this talk, I like to talk about solar winds, but we actually have a better example that was gifted to us. The XCU Tills attack. So everybody here has heard about this by now, but this was some group likely, I think, backed by a state that infiltrated an open source data compression project called XCU Tills. That was for us a book DJ, Founder and CEO of Socket. So XCU Tills has taken the security industry by storm, since it introduced the back door via OpenSSH, which is a critical piece of infrastructure used by millions of servers around the world.

15:29Let's hear from Faras regarding what really happened there. To get a sense of the kind of security offenders we're now dealing with in 2024. That can involve multiple years, multiple contributors, social engineering, the potential for state actors, and more. The way that they did this was just so interesting and it's something that I mean, look, I'm sad that it happened, but I'm also like, I've been telling you guys about this for so long, because sort of like kind of satisfied in a way that finally there's an example that's really caught the imaginations of folks. So what happened here was we had a group, like I said, probably state backed, winning over the contributor of the project over several years of work.

16:07So that's like a scale of time invested in this that we haven't seen in other attempts like this. And then they introduced a sophisticated though not flawless backdoor that was aimed at compromising SH servers. So it's a pretty multi -layered vulnerability. There were multiple personas involved for identities that hadn't been seen anywhere on the internet before, so that kind of is another indication that probably this was someone relatively sophisticated. This wasn't just someone doing it for the lulls, and so probably suggesting kind of state -backed actors here. And then just the way the timeline and the kind of some of the stuff that they did also seem to indicate that it might be like the same people behind SolarWinds.

16:44Probably, but again, this is all just kind of speculation. I want to kind of go into a little bit of, so you can kind of see just the character of what this attack kind of looks like. So this is kind of individual who ends it up committing and releasing the malicious code. And this is his first email patch to the mailing list where they do the development for this project XCUTILs. And it's interesting, this is just kind of a totally pointless patch, right? This is like the kind of thing that is a maintainer you get all the time. Someone just drive by dropping in an editor config file, which is basically does nothing, right?

17:15it's a no -op in terms of the functionality of the project. And oftentimes you'll see these from people who just want to get to be able to say that they're a contributor to a project. It doesn't require any understanding of the project. So there's just noise, but you can see their first attempt to get involved in the project. Then they sent another patch a month later, fixing some build problem. And they also sent a couple more patches after this one, all totally ignored by the maintainer, who at this point has been maintaining this project for about 15, maybe 20 years. This is a long time project and the guy running it is just, at this point, it's in maintenance mode.

17:49It's basically, he's sort of burned out, he's sort of kind of half maintaining it, checking the mailing list once in a while, but really not actively working on this anymore. So it's something that a lot of maintainers go through. And so then finally, this is like, I think, three more months after the last email, we see that the maintainer just randomly comes by and merges a couple of line change to the that is the first code from this G10 individual that's actually included in the project. And what I think is interesting about this is all of his other patches were ignored. The patch that was merged is this like trivial two line patch that you can just look at and kind of as an overloaded maintainer, you can look at this and sort of figure out what it's doing.

18:27And oh, it fixes a bug cool. Let me just merge it and move on. The bigger multi hundred line patches were ignored, right? Typical also typical behavior for an overloaded maintainer, right? Okay, then a couple of months go by And now we see a new character enter the picture. This guy, G -Gar Kumar, sends kind of a few emails complaining that some of G -A -TAN's patches weren't landing. This is often used to pressure maintainers to include code in projects. Patches spend years on this mailing list. There's no reason to think anything is coming soon. So aggressive, right? At this point, remember, he's already landed a few of the patches, but the pressure is building here.

19:03And then this is insert project name still maintained. That is the bane of a maintainer's existence. It's the meanest kind of issue you can open up on a project. In my opinion, this has happened to me many times. I had a couple screenshots here. Is this still being developed? And like on a perfectly active project, because their PR wasn't looked at for a little while, right? Here's another one on one of my projects. Is this project dead? It's not nice. Don't do this, people. And I think one of the interesting things about this whole situation is that this is another one of the things I've seen change in the way that open source has done is traditionally, you would think of a project like Linux or WordPress sort of these big foundation -backed projects, they have the structure up here at the top, where you have one project, one entity, with many, many maintainers that are participating in the project.

19:44A lot of times they're paid by their employer to even work on the project into submit patches as part of their day job, right? But what we see a lot more of, as we've shifted into this world of many, many, many dependencies, a lot of tiny dependencies, is more of a structure like this, where you have an individual with hundreds, potentially, hundreds of projects that they take care of. And that was the case here with Lassie Collins. and he had multiple projects that he was managing as an individual maintainer. Okay, so let's continue on. So this is three months has gone by. He replies, he apologizes for the slowness and he also adds in a bit about how Geotan has helped him off list with XCU Tills.

20:19So probably they have some kind of chat conversation going off list now and they're collaborating more closely, building up the trust. And he says he might have a bigger role in the future, at least with XCU Tills. It's clear that my resources are too limited and something has to change in the long term. So the kind of idea has now been planted in his mind that he probably should give access to somebody else to help maintain the project. And again, this all sounds nefarious because I'm doing it in a talk and I have slides up here, but this is also open source working correctly. This is thinking about, oh, hey, maybe I'm not the best maintainer.

20:47Maybe I should hand this off to somebody. That's pretty normal as well. At this point, nothing actually nefarious has happened. By the way, there's no bad code that's been included. This is just laying the foundation. He's a couple weeks go by. So now we have this character G -Gar Kumar who enters and And this person is much more aggressive and really starts to apply more pressure. So they go over one month and no closer to being merged, not a surprise. So like dropping into threads to just sort of neg the maintainer and kind of make him, I feel like he's not doing a good job. Progress will not happen until there is a new maintainer.

21:16And then the maintainer finally replies and pushes back and says, hey, I haven't completely lost my interest here, but I've been having some mental health issues and I have a lot of things going on in my life. But again, maybe Geotan will have a bigger role in the project. And so a few months after that, last seat, Colin merges the first commit with Geotan as the author you can see here, and they actually are listed as an author. This is a pretty innocuous change. Then again, the pressure continues from G -GAR and Dennis, who's this other persona that are both there, really just support the idea that G -S should be made a maintainer.

21:44You can see here, you ignore the patches that are rotting away on this mailing list, right now you choke your repo. Why wait until 5 .4 points are to change maintainer? Why delay what your repo needs? Applying the pressure. Then again, the last one here is great. Like, why can't you commit this yourself, Gia? I see you have recent commits. So just kind of pushing more and more. And then finally, Lassi says, again, Gia Tann has been really helpful off list. He's practically a co -maintainer already. And then finally, this is the first email about two years after the very first interaction with the mailing list, where Gia Tann is actually now doing their release notes for the project.