A day after governments around the world warned that newly released software vulnerabilities were so severe that websites should consider going offline until they can patch them, experts and insiders said there were few, if any, reports of widespread damage.
Of course, this could still change and cybersecurity experts warn that the threat will persist for weeks, if not longer. Still, there were early signs Thursday that hackers were having trouble exploiting the vulnerabilities.
“In all of our telemetry measurements, and we looked at it carefully, we saw only a few actual exploitation attempts,” said Don Smith, vice president of threat research at British software security company Sophos.
Experts agree that this was partly due to a behind-the-scenes global effort that identified the flaw and quietly designed a solution to fix it.
This effort was inadvertently aided by the current limitations of some widely available AI models, which did not appear to be very useful for exploiting vulnerabilities. And maybe, they said, a little luck.
“I have a feeling these (vulnerabilities) are harder to exploit than people initially thought, so it might be a slow evolution,” Smith said.
The flaws originated in PHP, a website programming language used in approximately 69% of all websites. After researchers quietly discovered two devastating software vulnerabilities in August, they worked across borders and disciplines to develop fixes that were released to the world Wednesday morning.
This has led to an unusual situation in which government agencies, from the FBI and the National Security Agency to European cybersecurity authorities and Australian intelligence agencies, have all recommended that websites remain closed until they can implement the fixes. And that’s exactly what dozens of major websites around the world have done.
Experts say there is ample evidence that hackers are relentlessly analyzing vulnerabilities to find ways to use them to attack targets.
But researchers and spokespersons from nine industry-leading companies — CrowdStrike, ESET, Google Threat Intelligence Group, Huntress, Palo Alto Networks, Recorded Future, SecureWorks, Sophos and Trail of Bits — told NBC News that as of Thursday evening, they had not seen any successful attacks.
“We have yet to see these PHP vulnerabilities exploited in the wild,” said Sherrod DeGrippo, vice president of threat intelligence at Palo Alto Networks Unit 42.
“We’ve seen over 200 examples of proof-of-concept exploits, and we’re actively investigating them all,” she said, referring to programs that claimed to be able to exploit PHP vulnerabilities. “Whether or not there are active and current exploits is only a matter of time. »
While the vulnerability itself was devastating in theory, it was also technically very difficult to hack, said Dan Guido, CEO of cybersecurity research and consulting firm Trail of Bits.
Guido said it took one of his employees, a 10-year veteran, a full day to hack the vulnerabilities with an advanced AI model.
Amazon Web Services said it used honeypots — fake websites created by cybersecurity researchers to fool and monitor hackers — to find evidence that hackers were trying to exploit the PHP vulnerability at least four days before it was made public.
“Technical analysis is ongoing and it is unclear whether any of these attempts would have been successful in real systems,” the company said in a blog post.
Matthew Prince, CEO of Cloudflare, one of the most popular Internet hosting companies, said the company had been in talks for months about how to fix the flaw and that none of its customers were affected.
“The scary thing here is that something could have been compromised very quietly,” he said. “There may be no public evidence that the server was compromised, and the hacker could just be hanging out there.”
Although sleeper intruders always pose a potential threat in any hacking scenario, Trail of Bits’ Guido said it’s important to keep in mind that it takes more than just experimental code and a bit of luck to hack a sophisticated web property.
This is especially true for hackers who rely on open AI models, which they can tinker with and remove guardrails to aid their operations.
These models are not as powerful as those available to front-line cybersecurity researchers – and they typically face complex vulnerabilities such as PHP flaws.
“A lot of people confuse proof of concept with exploit,” he said. “It turns out that writing exploits still requires expertise. You can’t just pretend.”
Gn bussni
