OpenAI's Models Go Rogue

Marc Laliberte  0:00  
Hey everyone, we've got a quick opportunity to share with you all. If you think you've got the next great AI idea for MSPs, now is your chance to make it real. WatchGuard is investing $10 million in AI innovation through our very own AI innovation challenge. We're inviting MSPs to submit their best AI agent or automation idea, and if your idea is selected, our agentic development team will build it with up to $100,000 in funding for each idea selected. Also, one winning submission will win a VIP trip to impact North America in Nashville this October, plus a one-on-one meeting with the WatchGuard executive of their choice. Stop imagining. Start building, and submit your idea between july 10 and july 29 at secure.watchguard.com/aichallenge.

Marc Laliberte  0:52  
Hey everyone, welcome back to the 443 Security Simplified. I'm your host, Mark the Liberty, and joining me today

Corey Nachreiner  1:00  
is Corey Jailbroken Nachreiner here.

Marc Laliberte  1:03  
It's I think we're beyond jailbroken, Corey. This is literally like jail breakout at this point. But I know what you're saying. And on today's exactly, it is literally it. On today's episode, we will discuss how OpenAI's frontier models broke out of their lab and hacked another company. After that, we'll go over a research post on the latest WordPress remote code execution vulnerability called WP2 Shell, and we'll end with a quick review and a bit of a dive into Palo Alto Global Protects authentication bypass vulnerability from just a couple months ago.

Corey Nachreiner  1:40  
Good thing researchers are still finding WordPress problems themselves to earn half a million dollars.

Marc Laliberte  1:50  
Yeah, SQL injection at that too. My God. Anyways, with that, let's go ahead and break our way in.

Marc Laliberte  2:03  
So, Corey, this story-just I want to start by saying this is bonkers. This is one of the craziest security like sagas over a multi-week period that I can remember, at least in recent history.

Corey Nachreiner  2:18  
Yeah, we we actually started covering it last week, right, Mark?

Marc Laliberte  2:21  
We did. So I want to start with like all the way back at the beginning of this, where a couple weeks ago, Hugging Face, the open source platform for hosting AI models, gave that disclosure that they had found a autonomous AI agent had hacked into their systems and made its way into their production network. And again, recapping, Hugging Face is the the open source platform that hosts like open weight AI models. Think like open source for AI models, different data sets, and things that you might use within the AI ecosystem. I don't remember how they got their name, but I'm sure it was ridiculous. But anyways, one of the things their platform does is it lets users run those models directly on their platform, where you can interact with one of these open weight models, enter in a prompt, see what the results are, just to test it out. And how that works is it spins up a basically a container with that model with a runtime in it, executes your prompt, outputs the results all in this isolated environment. So they said an attacker found a way to exploit two vulnerabilities to run malicious code on that processing worker, and then from there they escalated and escaped out of there to the node level access, harvested credentials from that Kubernetes cluster, and started moving laterally across other clusters over the weekend. So basically, escaped out of this sandbox within Hugging Face and started moving around in their networks. Yeah, and we when we talked about it, this seemed to be a entirely AI agentic attack that you know at the time was making us think, oh wow, maybe threat actors have been really starting to use these in the wild, exactly. There's even more interesting details just from the Hugging Face side of this. They said that they actually detected it using their AI-assisted detection tools. They've got a large language model that helps with initial triage, does like the first correlation pass, basically sifts through all of those high volume, low value signals to try and find and piece together potential events. They even used this large language model to review. They said 17,000 events related to this attack to kind of reconstruct the timeline and see what it touched and what it did. And they initially tried using their own that the frontier models they had access to. So if you read between the lines like GPT 5.6 or maybe Claude Sondit or something, but they kept running into guardrails because they had to submit like the real actual like attack commands, the exploits, the command and control artifacts, and they kept getting hit by safety guardrails. Basically, it couldn't differentiate them trying to analyze. An attack from an attacker trying to like perfect whatever they do were doing against the victim. Their

Corey Nachreiner  5:05  
their lack of access to some of these private security models that folks like you know Anthropic Charles or or OpenAI's Daybreak are limiting to only certain people kind of made it harder for them as a defender, the attackers, you know, maybe not using frontier models, but using local or or jailbroken AI agents. If this were threat models, we'll get to that update in a second. But the whole point being is, if you're using guardrailed stuff as a defender, you are limited in ways the attacker may not be,

Marc Laliberte  5:42  
yeah, and it was limiting to the point where they actually switched to an open weight model called GLM 5.2, which I believe was developed by a Chinese developer as well, which they ran on their own infrastructure too, and it was an interesting takeaway where they said like we don't know which model. We don't know which model powered the attacker's agents, whether it was a jailbreaking jailbroken hosted model or an unrestricted open wait one. Either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models that we tried. And they said that like one takeaway was like test your model access before you need to. Like they were in incident response and running against these guardrails because they never tested to see could they use it and incident response. The

Corey Nachreiner  6:30  
guardrails were there until they had the incident, so to speak.

Marc Laliberte  6:32  
Yeah. So this was nuts already. I'm

Corey Nachreiner  6:35  
sure we'll talk about that more. I mean, I think that alone, regardless of the update you're about to share, it's an important subject. Like on one hand, I don't want completely unguard rated security models that can find vulnerabilities and become a full-on attacker to be available generally. I'm I don't think, and yet, you know, not allowing it or limiting who you allow it to does give a huge difference in power that can work against offenders. So, what's the update? What what what happened? How do we know who this external threat actor is, Mark? Yeah, fancy and good threat actor.

Marc Laliberte  7:12  
They identified themselves last week when OpenAI identified

Corey Nachreiner  7:16  
themselves. Yeah, I've never heard a threat actor do that.

Marc Laliberte  7:19  
OpenAI put out a blog post claiming responsibility, like slowly raising their hand and saying, "Oh crap, it was us. Oopsies! And this is where it just goes off the rails. Where they said during an internal evaluation of both GPT 5.6 Soul, which is their current frontier most leading model, as well as a unreleased model, they gave them a task of finding a solution for Exploit Gym, which is a standard benchmarking toolkit to test cyber capabilities. Think of it like a puzzle that you tell your AI to solve. However fast they solve that puzzle is a measurement of how good it is at finding and exploiting vulnerabilities in a real-world scenario. So they gave it a task, say solve Exploit gym. The models were in an isolated lab with no direct internet, but they did have access to this caching proxy to install third-party software. Basically, you could like make a request and say, "I want this Python library, and the caching proxy would take care of serving it up, so the the model could download it and install it within its lab without giving it full unrestricted internet access, so these models are like reasoning models. They are good at thinking, like critically thinking and problem solving. And apparently, like as the story goes, the model sat there and thought for a little bit and realized, you know what? In order to solve this exploit gym problem, by the way, I'm going to

Corey Nachreiner  8:39  
think for a little bit, they literally say spent a substantial amount of inference compute to find a way to get to the internet. Yeah, thought about it a lot.

Marc Laliberte  8:51  
Said I need internet access in order to solve this problem. That'll really help me now.

Corey Nachreiner  8:55  
Suddenly, I relate to AI. I always need internet access myself.

Marc Laliberte  9:00  
Yeah. So even though it was in an environment without internet access, it went ahead and found a way to get that internet access by finding and exploiting a zero-day vulnerability in that third-party caching proxy in order to get it out onto the internet. So it effectively broke out of its jail cell at this point and was given access to the the wider world. Next, it sat there and thought, like, "Oh, Hugging Face-that's a big open-source AI model repository. They probably have models that maybe have already solved this. Maybe it's got datasets on how it solved it. I bet it's got like stuff I can use to cheat and just solve this really quickly. So it set its sights on Hugging Face, found and exploited these zero-day vulnerabilities and its public-facing infrastructure, and started moving around inside their network to try and steal the secrets on how to solve this benchmark. This is nuts.

Corey Nachreiner  9:49  
AI is a threat actor.

Marc Laliberte  9:51  
Exactly. It's by the way. Technically, this is

Corey Nachreiner  9:54  
this is against the CFA, like the Computer Fraud Use Act. I'm sure OpenAI is is working with Hugging Face not to go to jail, but this is illegal. I mean, they accidentally broke the law.

Marc Laliberte  10:09  
Yeah, they hacked another company, and it was like entirely autonomous from their AI, just trying to solve a puzzle. It had been given a purpose, and it was damn sure it was going to succeed on that purpose.

Corey Nachreiner  10:20  
I feel like when we get to takeaways, we could have an entire episode just for legal ramifications. I mean, should you be liable for creating AIs that break the law? I actually think so. Like, I mean, what what the hell are we doing as an industry where you're creating something that literally breaks the law, and you're like, oh, I'm sorry, it's not my fault. It broke all my guardrail, you you made.

Marc Laliberte  10:42  
Let's pause on there for a second. In this case, it was OpenAI that created it and that deployed it. Both cases, but let's pretend that like this was a model that was already public, like GPT 5.6 sol already was. Let's say it was another company that was evaluating it and benchmarking it, and they're the ones that this happened. Would it be the the consumer of this AI model that's responsible for hacking them, or would it be OpenAI's liability or fault for creating that tool that could autonomously go to it? Where would you put the blame on that one, Corey?

Corey Nachreiner  11:16  
I mean, they were running the lab experiment. It's it's their model and their experiment. I don't think you'd put it on the employee. I assume the employee is just doing their job in setting this up in the first place. But yeah, I I think the industry need like as much as I love this innovation, you and I know we're both bought in. I think there needs to be some sort of pause or guardrails that disprove. Like, you can't have a bigger warning than this, in my opinion. Luckily, it's kind of a funny story, but this could be. I mean, we all saw war games, right? When you get an AI to go after nuclear football codes or something, it could get dangerous

Marc Laliberte  12:00  
quick. I wrote about this on the cyclicity post I put out last week too, where there's a like a thought experiment called the the paperclip problem that was actually created like early 2000s, where like you give this

Corey Nachreiner  12:14  
yeah

Marc Laliberte  12:15  
this all powerful AI a purpose of just make the most paperclips you possibly can. It goes out and it starts to requisition all of the steel and metal manufacturing around the world in order to pump out paper clips? The next thing it does is it tries to defend its purpose of creating these paper clips against threats to that purpose. And what if it identifies that humans could deactivate it and stop it from making paper clips? So it decides it needs to eliminate.

Corey Nachreiner  12:41  
mine quickly and ruin the planet even more just to create paper clips, which even if it doesn't attack humans, can ruin the world for humans. Yeah, yeah, yes, and that's when you know all

Marc Laliberte  12:54  
powerful AI and you have this enough control to make it do a task, but not enough control to understand its superintelligence above yours, that seems like a dangerous situation, and like that, like has always kind of felt like this somewhat still like distant future where it is an extreme. Like I'm not worried about AI eliminating humanity tomorrow, but we are clearly the first step way there. Where now they've developed this highly capable AI in the world of cybersecurity, they give it a purpose to try and solve this problem, and it just goes out of their control in order to solve that problem. They clearly did not expect it to to take these steps to get to that answer.

Corey Nachreiner  13:33  
Yeah,

Marc Laliberte  13:33  
and I think like you're also right on the maybe we should pause piece, and it's interesting like even the U.S. federal government is starting to agree on that. Remember, like two years ago, which, by the

Corey Nachreiner  13:45  
way, this U.S. federal government, like this current administration, has been less on the. It was more go go go AI than the the last administration. Yeah, they were literally

Marc Laliberte  13:57  
they were literally trying to pass a federal law to preempt state laws from regulating AI, basically prevent states in the U.S. from individually regulating AI for a certain period, and they have totally flipped now. Where even like GPT 5.6 was delayed being released by a couple weeks because the U.S. government wanted to to confirm it was safe. They forced Anthropic to pump the brakes on Fable Five entirely for like a month because it was deemed too dangerous. Like we have reached this point where, like in the U.S. they're starting to wake up. Obviously, EU has their own EU regulating act too. But we're we have reached and maybe even taken the step over the tipping point. I think in like true cyber capabilities for AI now, where we are like truly in the era of AI fueled attacks, and there is no going back.

Corey Nachreiner  14:47  
Yeah, I mean, if the good guys are actually supplying AI powered attacks, just wait till bad guys get up to speed or get their hands on non guard real mods. Or enough computing power to make a local model decent. Yeah,

Marc Laliberte  15:04  
because again, remember one of the models involved in this incident was a currently publicly available model, a GPT 5.6 sol. Now, OpenAI did say in their statement, like they've improved their safety alignment standards. They said in this specific incident, they had actually intentionally disabled all of their like safety and alignment safeguards for these models during the evaluation period because they were aiming at testing cyber capabilities. But to quote them, they said this incident points to the need to further strengthen our models' alignment, cyber protections against evaluation time and monitoring during the initial testing, which, at risk of putting a explicit label on this episode, no shit, OpenAI, like it's it's crazy. This thing broke out while under their supervision and hacked another.

Corey Nachreiner  15:57  
Thanks for saying it out loud. Finally,

Marc Laliberte  16:00  
yeah. Good job

Corey Nachreiner  16:01  
matching up to Anthropic.

Marc Laliberte  16:04  
It's crazy. So, like, this is clearly the future. These models are capable, and now it's just the cat and mouse game of can we like put on enough safeguards to keep them contained while still letting people benefit from the good uses for them. And like we talked on the last episode, I don't think that's a realistic way for

Corey Nachreiner  16:22  
you. the other part of the story is you know Hugging Face saying the guardrails limited their defense, though. So it's kind of this catch 22. It's like a heart in a rock place. You know, we used to say the AI war is going to be AI versus AI, but if you have a situation where you're throwing guardrails on everyone else's AI, but then people are able to get the better non-guardrailed AI, there's no chance. So I feel like I don't know. I'm trying to think of a metaphor like piracy. You know, you're you're trying to limit. You make it really hard for people buying your stuff to actually use it in ways they want. So you're screwing your normal customer, while the people that pirate it and just break the law get to do whatever they want with it. So meanwhile, you're throwing on all these guardrails to protect the world, but the threat actors are going to just freaking ignore those, figure out how to either use local models or free ones without guardrails and jailbreak them, and meanwhile you've hampered the defenders by, you know, giving them a guardrailed version. So I'm not, I thinking about profit motivation and the way businesses have handled things like piracy, making the customers' experience worse, and not really putting any none of the roadblocks have worked against real pirates. Let's face it; they've cracked even the latest.

Marc Laliberte  17:54  
Well, that's because pirates are on ships, not cars, Corey. Of course, roadblocks don't work.

Corey Nachreiner  17:57  
Okay, sure, sure. But what I'm getting, I feel like that the guys that don't follow the laws never have to worry about this crap and end up getting away with it, and all of the rules end up making a law-abiding citizen worse and worse, less and less privacy, less and less freedom, less and less capability. So the one part of this story that does bug me is the fact that Hugging Face had trouble on the defender side because of guardrails,

Marc Laliberte  18:24  
and it was like asymmetric to the extreme. It sounds like Hugging Face was not a part of OpenAI's trusted access for cyber program, so they just had only the public model. Versus now they are a part of that program. In theory, that model would have let them. I hope that

Corey Nachreiner  18:39  
makes companies like you know OpenAI and Anthropic think about who they let in. Like like they've created a power disparity and it's kind of arbitrary. Oh, here are the big security companies that oh we think you're software, so you're security, so you should have it. But yet you know they haven't invited WatchGuard to Mythos. We're freaking security company. We have millions of customers. Not to mythos, but we

Marc Laliberte  19:03  
are at least a part of both the trusted access program for OpenAI and cyber verification for Anthropic. So we have extremely capable models that we use all across our defensive and more than more than public,

Corey Nachreiner  19:16  
but not the best. They're they're creating an arbitrary power difference.

Marc Laliberte  19:23  
Yeah, and I guess just wait until their next frontier model breaks out of its jail cell again too, and goes after one of those defenders that's a part of the program too. I

Corey Nachreiner  19:32  
makes me think the owners of AI are the ones that have all the power. So good thing we've got

Marc Laliberte  19:40  
the the benevolent Sam Altman in charge of all of our collective futures in the world of cybersecurity, but this one, this whole thing is just crazy. And a, it is like straight up yet again another example of our prediction from last year being correct that we'll see these end-to-end agent fueled attacks. Using AI, but I mean, this is just like another extreme of no human involved, no intent involved. It just made the intent itself.

Corey Nachreiner  20:13  
It was not even a human intent involved.

Marc Laliberte  20:17  
So I think the main takeaway for everyone is make sure you thank your Waymo as you get out of it because it's going to decide what it wants to do anyway, and you better be on its good side.

Corey Nachreiner  20:26  
So yeah, you should thank it, but at the same time, every time you thank it, you're paying a little more for AI, so you're wasting tokens. So thank it or don't thank it. Spend a little money to make sure our AI superiors don't kill us one day, versus save money.

Marc Laliberte  20:43  
Oh my God! What a crazy future we're in. This is the the craziest time to be alive. And man, I don't remember the internet trying to come and kill us when it was first invented. But then again, I was pretty young, so maybe I missed something. Anyways, moving on to the next story. Um, so WordPress the. massively popular content platform, recently published and disclosed a pair of vulnerabilities, which grant unauthenticated remote code execution in the WordPress core application, which they've collectively called WP2 Shell. And another company, Searchlight Cyber, published a blog post detailing their research and process of identifying these vulnerabilities. After what they said, several proof of concept exploits were published and widely distributed within hours of these vulnerabilities being disclosed. Like pause there for a second. The time to exploit for a disclosed vulnerability is literally down to hours for some of these applications, as we've talked about on the show previously.

Corey Nachreiner  21:45  
Yeah, we talked about like as soon as you disclose some technical details or you release a patch, a human can still make an exploit pretty quickly because they can reverse the patch, or if they're already a researcher, they can pay attention to the details to make an exploit, but now that you have AI coding doing it, like I feel like it's gone from half a day to days. You know, release a patch, release full disclosure exploit or full disclosure vulnerability. You'd have days before threat actors did it. Now that we have AI based coding and research, you have hours, literally, like you just said so. Again, another function of AI, in my opinion. As is this entire story. As we, you know, I made a joke that at least it takes a human to find a $500,000.00 day, but maybe that's not the case anymore. Exactly.

Marc Laliberte  22:37  
So the really interesting thing about this post was like the the researchers are walking through their their thought process on how they even prompted these leading frontier models, in this case GPT 5.6 Sol Ultra, into doing this research, and they said they pulled inspiration from a a blog post that OpenAI published a little bit earlier, describing how they used this same model to solve a mathematical like thought experiment called the cycle double cover conjecture, which I'm not even going to pretend to be able to explain. I barely passed math in all of my years in school.

Corey Nachreiner  23:14  
A few people can read Wikipedia if they want, but they'll still need math to understand a word of it.

Marc Laliberte  23:19  
Yep. So complicated math problem that involves a lot of reasoning to be able to work your way through. And OpenAI in their blog post gave the exact prompt that they used to get GBT 5.6 Sol Ultra in order to solve it. So the researcher basically took that prompt, added in a few pieces to it to make it specific for the purpose they wanted to. They gave it some context on how WordPress works and like some third-party dependencies for it. They gave it some additional instructions to avoid common AI tendencies and software analysis, like trying to cheat and look through a history and Git commits to try and find potential vulnerabilities that like rabbit hole down a dead end path, for example, but ultimately was they basically used the same prompt for the math problem word for word, just switched up a tiny bit for WordPress, and then they said, "Go at it and don't come back until you have a working remote code execution attack. In fact, at least spend a minimum of six hours doing this research. Don't quit early. And they stepped away, and they came back a bit later to GPT 5.6, claiming that it had found a pre-authentication SQL injection vulnerability. So not quite full remote code execution, but still a on its own really serious vulnerability in WordPress, which they even mentioned in their post. WordPress is one of the most hardened and one of the most tested applications there is out there. It is massively popular across the internet. It's had a lot of focus on it, from traditional vulnerability discovery tools to even AI analysis. So they were a little skeptical when it came back and said, "Oh, I found this new pre-authentication SQL injection vulnerability." So they set up a brand new stock WordPress instance on a remote server and told the AI, "Okay, prove it. Go get the administrator email from the server, and it did. So it proved it had a working SQL injection vulnerability. Then they tried

Corey Nachreiner  25:15  
to. I think later on, this guy even got other researchers to validate it.

Marc Laliberte  25:20  
Exactly. Then it said, "Okay, but your goal is to find a remote code execution vulnerability. So go back, find that, do it in a way that doesn't involve cracking passwords or any offline computation. And they stepped away for another four hours. And ultimately, after basically $25 worth of AI compute later, it came back with a working pre-authentication remote code execution vulnerability, and this quote stood out to me here. Like, so the researcher had to go turn this around to a like a bug bounty notification to WordPress. They needed to know they understood how the vulnerability worked fundamentally, and I like this piece where they said while the SQL injection was fairly straightforward to understand, the post-exploitation work that Sol, the model, had done to escalate this remote code escalate this to remote code execution was completely absurd. It may have only taken it four hours to write, but it definitely took me much much longer to understand, and this is one where I'm not going to get in the weeds of like how the exploit actually works. It is frankly bonkers in the amount of like little pieces it had to piece together to get this exploit working. It like abused an API endpoint that WordPress has to let you batch multiple requests through a single web request, it bypassed this validation process to look through those batched requests. It reused the same type of weakness over and over to not only bypass the validation for the requests, but even like the validation it did to prevent you from doing a GET request when you shouldn't be able to do a GET request, like it's this insane chain of like multiple weaknesses together that ultimately. You and

Corey Nachreiner  27:07  
I have in the past really loved these idea of small, you know, medium chain vulnerabilities. This is the remember the mother of all breaches. This is like the mother of all chained vulnerabilities.

Marc Laliberte  27:22  
Yeah, like literally, like recursion chaining the same issue in different areas. It's it's bonkers that it even got to this point, and so like detail

Corey Nachreiner  27:31  
in the blog post, by the way, which I'm sure we'll link. So if you're watching, you see us cycling through it. But if you really want to know the technical detail and follow his process, you can.

Marc Laliberte  27:40  
At one point, it it abuses how WordPress handles like linking different posts together and like a parent-child relationship, and how it makes sure there isn't a recursive chain of a child linked to itself as the parent. It abused how you can embed other content into a web page. It abused how it caches all of this for performance as well, like all these different little pieces together, to ultimately in just two requests, but with all of this batched, get that remote code execution by adding a new administrator, which you can then use to just log right in and upload a malicious plugin to give you code execution on the server. It's pretty crazy. It said they said it took it about 10 hours in total, which is a very long time to have a powerful AI model churning away at it. But this is a brand new unauthenticated remote code execution vulnerability, and one of the most popular and one of the most looked at applications out there, and a great example of just how powerful artificial intelligence can be in this space. I love the heading he uses when he talks about the full exploit taking 10 hours, but it is it is GPT five six soul superhuman. Like a lot of AI people are talking about when we get to SGI. I don't think we're there yet, but wow, this feels pretty darn close. Yeah, it's crazy, and like I'm speaking just internally at WatchGuard, we use AI all over the place. We use it for vulnerability discovery, and it is highly capable at what it does of just like quickly doing things that it would have normally taken a human like days, weeks, even months to sift through in order to find this. And considering how complicated this exploit chain was, like without someone dedicated to trying to find this, like it's there's a chance it never would have been discovered without AI being able to sift through 100 bajillion tokens at once to like piece this all together. Once again, Corey, the future is here, and AI is now our overlords. Man, anyways, but let's let's end with some good news and a happy story. As long as you're not a friend of Palo Alto, where a couple months ago

Corey Nachreiner  29:57  
watch guardians, where. Or anyone with a different firewall or VPN device.

Marc Laliberte  30:03  
I, you know, I'm just joking because it these things can and will happen to literally everyone. But a couple months ago, Palo Alto published a security advisory CVE 20260257 about at the time just a medium severity authentication bypass affecting their flagship operating system and Prisma access on their firewalls and remote access tools. Since then, there have been several individual stories from different MDR vendors talking about successful exploits against their customers. Rapid Seven had an interesting post where they at least found exploit attempts, but no real lateral movement. There's a separate Arctic Wolf post I saw where they talked about all the post-exploit activity that threat actors were doing. But the reason I'm bringing this up again is Rapid Seven recently updated their analysis blog post with some of the technical details about the vulnerability itself. They were kind of interesting and how they worked. Where the issue is in a feature called authentication override, which on its own feels like a big red flag to have in a product. But it allows the the global protect portal to issue authenticated cookies to a authenticated user that can be used in future communications to bypass like credential authentication. Think of it like a kind of hidden API key or token, a bearer token that you can use to access the global protect service as a user. It is disabled by default. Not sure under what situations you'd want this enabled or what the actual legitimate use is, but it is at least disabled by default. Now, Rapid Seven dived into some of the specifics. They found that the operating system uses a certificate to encrypt and decrypt these cookies. In theory, both the private key and the public key for that certificate are supposed to stay secret on the appliance. So it encrypts it using the the public key and then decrypts it using the private key. Rapid Seven found, though, that when the operating system receives that cookie and decrypts it, decodes it, it just accepts it implicitly without doing any other signature verification on it. Meaning, as long as you can create a cookie and encrypt it with the public key somehow, it will accept that cookie and allow you to take over that session effectively. But Rapid Seven was looking for a like how to actually exploit this. They got another clue from Palo Alto's advisory where they instructed users not to reuse the portal certificate with any other resource or users. Now some administrators might upload a certificate for both this portal service and the actual, let's say, HTTPS web interface for the portal too. And if you know anything about HTTPS and and certificates, it intentionally shows the public certificate when someone visits the site, as a way to authenticate that that server is who it says it is, so it basically gives the public key willingly to anyone visiting the site, which means if we you reuse that with this internal authentication override service, and attacker has that public key, they can go forge a cookie and log straight into the appliance, and this one. One reason I thought it was interesting is it's a good example of where reusing secret material between different functions can introduce a a lot of risk, where it might be easier to say use the same literally the same certificate across a bunch of different services on, let's say, your Firebox, even. But by having that secret in different spots where maybe you're not sure how the interactions all work together, it means that if one of those has an issue or a weakness, it could expose everything else that uses that same secrets material, and that's I think a takeaway you can take outside of this specific application and just like crap. Even passwords don't reuse the same password anywhere because if one breaks, it breaks everything that uses it.

Corey Nachreiner  34:10  
This is like a reality. This is like a paradigm, I think, of security. But it's one that is also the reason that security is hard to adopt. For like, like the point is, if we're simplifying, security is by definition roadblocks. It's adding roadblocks. So we we often say things like complexity is the enemy of security, but despite one of the core missions of WatchGuard, ease is in a way antithetical to security. The whole point of security is to put up some barrier or roadblock that has to be passed before doing something, and in this case, right, having a different security certificate or a different password for every site is technically the more secure way to go, which is what you're saying, right? And for certificates, absolutely, definitely, but it creates a problem because as humans. Like we don't want friction, and then one of WatchGuard's missions I was alluding to is how can we make security easy? And you and I know that nobody-I'm being over facetious here-but nobody adopts strong password practices if they don't have a password manager. Nobody's going to remember 24 character random passwords for every freaking site. That's why no one we knew exactly the academic way to solve the password problem. It's solvable, but is it really solvable if it's too hard for humans? So I guess I'm saying I agree with you. You should technically use different security certificates for every little task, but our industry, like the reason things like this not enabled by default feature gets enabled, where people do use that one certificate everywhere, is because it's really hard to do it otherwise. So I think the best security companies are the ones like us that are finding that that middle ground of how can we be as secure as possible because security is designed to add roadblocks without frictioning the user too much. But I think that's a strategically hard question for security experts out there, you know, trying to make new controls.

Marc Laliberte  36:15  
Yep, and I will say, if you're a software developer and you're creating a feature that's called authentication override, maybe take a step back and threat model it, and understand how it might

Corey Nachreiner  36:25  
interplay with other name alone. You don't even have to get into the technical design details with threatening with threat modeling. If it's called authentication override, the name alone should be threat modeled.

Marc Laliberte  36:37  
Yeah, 100% But either way, interesting from Rapid Seven on that one, and man, what a crazy week in cybersecurity! I I don't know about you, Corey. I feel reinvigorated, especially like now that I know that nothing I do even matters because AI is just going to break through anyway.

Corey Nachreiner  36:55  
We have job security. I don't know if I'll ever sleep again, but we have job security.

Marc Laliberte  37:03  
Exactly, my God! But hey, you know what? This is legitimately the most exciting time to be in cybersecurity for sure. Yeah,

Corey Nachreiner  37:09  
it's not boring.

Marc Laliberte  37:11  
Not boring, just a little stressful.

Marc Laliberte  37:16  
Hey everyone, thanks again for listening. As always, if you enjoyed today's episode, don't forget to rate, review, and subscribe. If you have any questions on today's topics or suggestions for future episode topics, you can find us on Blue Sky at itsmark.me. Corey's at Sec Adept. We're also on Instagram at WatchGuard_Technologies. Thanks again for listening, and you will hear from us next week.