Exploits Now Beat Patches: Open Source Security in the AI Era - Patrick Smyth, Chainguard

AI Engineer · 21 min · 290 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

00:01[music]
00:12So, this is how Frontier AI changed risk tolerance for open source.
00:17Kind of wanted to subtitle it, you know, how I learned to love the atomic bomb or whatever, but uh decided not to go for that.
00:23So, I'm Patrick Smith.
00:25Um I work for Chainguard.
00:26Um when I'm not thinking about the software supply chain or messing around with um you know, Frontier AI.
00:33Uh I am hanging out in Queens.
00:35[snorts]
00:35I'm one of these annoying people who like saunas all the time.
00:39Uh if you're out of town, we have some great ones in the city.
00:41There's 10th Street.
00:41That's one since around since the 19th century, and they have great food.
00:45And then there's one at FiDi, too.
00:47So, um you know, and then I know there's a lot of finance folks interested in this, so uh that's the one.
00:5488 Fulton.
00:54That's the one if you're if you're down there.
00:56[laughter]
00:58Um okay.
01:00So, uh this is going to be the scaring you part of the the talk, basically, but um but this year, so here's some just some fun headlines.
01:08Um, so, uh, 17-year-old, uh, Osakan uh, teenager, he's still in high school, uh used ChatGPT, wrote some scripts, um, uh, exfiltrated, um, something like 4.4 and a quarter million records from the biggest,
01:25um, internet cafe in Japan, and, uh, then used one of the cards to to buy some Pokémon cards.
01:32Used one of the credit cards to buy Pokémon cards or whatever.
01:35Um so, you know, people can be very smart and very dumb at that age.
01:38Um FunkSec, um somebody hits uh thought to be an Algerian semi-technical person, hit 85 um targets over the course of the last uh few months.
01:50Um one individual who has not been identified um used Cloud Code to attack um 17 organizations from ranging from healthcare to government to you know major corporations.
02:05Use cloud for everything from writing the ransom letters, picking the next target, organizing his files, um and of course doing the attacks.
02:14Um kind of a takeaway here is that the way I've been thinking about it is everyone kind of goes a level up in terms of threat.
02:21So, if you were an actual engineer before, now you're like a uh team.
02:26If you were actually, you know, a a team before, now you're like advanced persistent threat level.
02:31Um So, here's a little another little tidbit for you.
02:37This is a This is basically whether the patch comes before the exploitation.
02:44So, the exploit, you know, obviously is the attack.
02:47The patch is remediation of the vulnerability.
02:50Back in ancient history in 2018 and 2019, it was 63 days.
02:55This is an average, so it's pretty noisy, but it tells you something.
02:59It's kind of There was this like secular trend that was going on for a long time that I guess is continuing though it's kind of been drowned out of like
03:07you could kind of think of it as, you know, digital application or something like that.
03:11But basically like every you know hospitals were using Python code all of a sudden and stuff like that.
03:15So, that secular trend sort of was responsible for this tightening over the course of, you know, '21, '22, kind of probably '23.
03:23But then you see in '23 and '24 and last year it just kind of left, right?
03:29I wonder what could have been causing all of that.
03:32We'll talk about it.
03:33I think you already know.
03:35But now it's negative 70 days.
03:37So, actually the exploit the on average hits before the patch.
03:43This is from Mandiant.
03:45So, they have their M-Trends report.
03:48This is kind of what it used to look like if you were to add an organization, who uh you know, you would have say uh you you have X amount of software in your stack,
03:58you run scanners against it, um such a you know, scanners like Grype, Trivy, etc. Trivy also had a bad year.
04:05Um you uh scan against it, you get your X number of CVEs, known vulnerabilities that are rated, you know, from critical, high, medium, low.
04:13Um that goes to a team.
04:15They get some amount of things to remediate.
04:17All very sensible, all very good.
04:20Um the only problem is 30 days may as well be a million years in terms of some of these attacks that have been happening.
04:25[snorts]
04:26So this timeline basically you can't you know, I mean obviously you have to have some kind of timeline just because you're remediating on some cadence, but it basically doesn't work that well anymore.
04:36Um between uh attackers jumping on known vulnerabilities almost immediately, exploiting finding vulnerabilities out out of ban, um and now these new sources of zero days, cough cough, we all sort of know what that is.
04:50Um you know, MythOS, new frontier models, um that this timeline is basically completely out the window.
04:58Um this is a whole other area of uh of fun and enjoyment that we had this this last year.
05:04So this is um just these I don't know what you'd call it, but like these are I kind of you could think of it as the four horsemen here.
05:10They're the met waves and waves of malware.
05:13Um every month, uh you know, I used to do a meme calendar for um supply chain attacks in old presentations where I'd have like one one big one every month, and then I used to be like
05:25a big attack every month, guys.
05:27It's it's really bad out there.
05:28And now it's like it would be crazy.
05:30I could do a meme calendar of every day, pretty much.
05:33And but the you know, this is basically just I put um four up here, but three from one month, um and then Shai Hulud, which of course is just a perennial source of fun.
05:43But basically what is Shai Hulud?
05:44It's a a worm originated in JavaScript ecosystem.
05:48kind of showed everyone that you could do a huge worm and do really well.
05:51So, now there's huge numbers of copycats, Shy Haluds, there's sandworm mode, all this kind of stuff.
05:56Shy Halud is a worm from Dune.
05:58Um so, you know, it's a worm, worms are very clever.
06:01And then uh some of the code of these things, if you look at it, is actually pretty I mean, you you know, shouldn't be too entertained by attackers like comments in their code or whatever, but it they they they name things in amusing ways.
06:10Um Trivy got attacked, that's a scanner.
06:13Um this is all The other three were all March this year.
06:16Um Trivy uh a uh kind of router for for agents.
06:23And um you know, Axios was only a supply chain attack, it was only live for 2 hours, 600,000 um downloads, okay?
06:31And a lot of these supply chain attacks So, this is malware we're talking about in in specific.
06:36A lot of these attacks are chaining one from the other because everyone has everyone else's dependencies, you attack compromise one person, now you're compromising other people.
06:44So, something's wrong in the state of Denmark.
06:46Um this is from Hamlet 2000.
06:50It's a weird movie.
06:50You can go back and watch Hamlet 2000.
06:53Um and uh yeah, it's agents, right?
06:56It's frontier agents.
06:57And I think everyone in the room kind of knew that.
06:59Um that they have been accelerating everything, but but you you put that salt and pepper on everything, you know, you're accelerating how you make code, you're accelerating everything.
07:08Um but but it also
07:09[snorts]
07:09attackers are making heavy use of these.
07:12Um and the environments have changed a lot.
07:15Um I don't know if folks have heard, you know, maybe I'm old or whatever, or I like I kind of I'm enthusiastic of early computing and stuff.
07:21There's this a concept called the eternal September.
07:24Basically, it was back in the day, there would be these uh university networks, people were very like, you know, people probably wearing their bow ties or whatever.
07:31People were were very um polite, they had their like no community norms.
07:36Um everything would be stable.
07:38And then what would happen?
07:39September would roll around, students would join those accursed uh things that are always clogging up the university.
07:45Students would arrive and start messing up all the the networks and everything like that.
07:50They wouldn't know any of the norms.
07:51They'd be talking in capital letters.
07:52They wouldn't know any of the good emoticons or whatever.
07:55Um so, another way of thinking about it is the eternal September has kind of gone on forever.
07:59And this is how this happens all the time.
08:01Culture It's a cultural thing, but it's also like naturally you have an environment or community that is like high trust and moves to a uh sort of more adverse low-trust situation, okay?
08:13Um another way of thinking about this is This And this is just the basic problem of software supply chain security, okay?
08:20And it's very simple, but when you think this way, I think it kind of clarifies a lot is that you have users.
08:27They're relying on your infrastructure, on your software um to do the things that they do with with your with your your stack, with your business.
08:36Um you have a responsibility to them.
08:38Then, you turn around and you're actually pulling from upstream.
08:42You were pulling from uh places that are, you know, you're trying to vet, you're trying to keep up with it, but it's difficult.
08:48It's a And any of those things that you pull in could potentially compromise you and your users, okay?
08:53So, it's kind of But, we're all in this position, right?
08:56We're all between in this very specific rock and hard place.
08:59And this is the base This is the fundamental problem of software supply chain security.
09:03Um so, again, we're going to move from just random gloo doom and gloom to actually what you have to and should do this year.
09:12But, I'm just going to throw out a few things.
09:14But, this is to make a larger point, okay?
09:16You have to do um if you're thinking about uh packages, you have to do cool down periods.
09:21If you are um you have If you're thinking about see uh CVEs, you have to remediate them faster than ever.
09:29Um you have to sign, right?
09:31Um I'll talk about it later, but salsa and sigstore, you know, sign your your uh your artifacts.
09:38Um you have to worry about operational security on developer laptops, um including physical keys.
09:44Um there's a lot you have to worry about.
09:47Uh the point here isn't so much I think I'll dial in on a whole bunch of these as we go on, but the point here is actually like it's time to get serious.
09:55Like it's actually time to to take this seriously because right now it's not 2024, it's not 2023.
10:02It's a actually significantly a much more adverse environment out there than it was just a few years ago, okay?
10:08Um there's a and there's a lot to do and it costs and uh it's painful, but um some some of these you should do first and also I would say
10:16if you're still, you know, moving to containerize, if you're still moving to do CI/CD, um great time to finish those projects, right?
10:25Um because or I would say you you almost kind of need to because if you don't have some of those um basic fundamental uh pieces in place, it can become very hard to do these other modernization
10:36efforts that have become more important over the last couple years.
10:39Now luckily now you have AI to do some leapfrogging there, so I wouldn't be, you know, so down, but time to get that skunk works going, time to get those projects going, time to complete
10:47um your golden images program, etc., etc., okay?
10:50Centralize your containers.
10:52[snorts]
10:52Um who are we?
10:54We're Chainguard.
10:55Um we've been thinking about this since 2021.
10:58Um we have uh four founders.
10:59They've created uh projects you have might have heard of them, Kubernetes, uh Sigstore, Salsa, um uh Google Distroless, and we, you know, this is basically we're basically here to just just think about the software supply chain security problem and try to like nuke it from orbit basically.
11:17Um you know, we're I'll get into some of the specifics that we do um in a second, but here's some just a few surfaces that I kind of want to dial into,
11:28okay?
11:29So, first First all, you've got um and these all interact in different ways, but you can think of them somewhat separately and sometimes it's helpful to think of them separately.
11:38Okay?
11:39On the one hand, you've got um malware, okay?
11:42So, that was like your trivia, your axioses, everything like that.
11:45That's one vector, okay?
11:47That's the kind of thing a cool down period is going to help you with.
11:49Um then, you've got known vulnerabilities, okay?
11:52So, this is kind of like legacy security.
11:54Um people are often like, "Oh, see you know, it's CVE is kind of the unit of this, right?"
11:59Common vulnerability and exposure.
12:01People are like, "CVEs are are CVEs are Yeah, a lot of CVEs are basically noise, but X percentage are actually important, you know?
12:10They actually need to remediate.
12:12The rest make The rest noise makes it harder to deal with the ones you actually need to deal with.
12:17And because they're known vulnerabilities, you have to fix them because they're in a database, right?
12:22Like someone could just be like go find Here, look at your software, look at the database, and combine those two things together, right?
12:28So, it's actually very important to remediate known vulnerabilities.
12:31We now, even more importantly, have this realm of unknown vulnerabilities or like uh zero days, okay?
12:37So, this is becoming more important with the rise of frontier models that have {quote} the juice, like Mythos, um ChatGPT now has Daybreak, um but Astra also very capable in this in this way.
12:50Um basically, frontier models are very good at chaining together lots of smaller vulnerabilities to make exploits, okay?
12:56And and so, that realm of zero days is very important.
12:59Um then, we have these emerging layers or you could also think about them as like side targets, soft targets, side doors that attackers are entering in through, okay?
13:08Used to be they'd come to the front door and be like, "No admittance.
13:11Our production code is very secure."
13:13Now, attackers kind of know, "Hey, actually let's hit your CI/CD cuz that's No one's really
13:18[snorts]
13:18looking at it that much.
13:19It's misconfigured.
13:20It's running a lot of dependencies and stuff in there.
13:22Uh let's hit the developer workstation cuz the developer is pulling things to prepare."
13:26You have a cool down period, but does your developer workstation's laptop have a cool down period?
13:29No. So, let's attack the developer laptop.
13:32Let's attack the new agentic layer.
13:33It's emerging.
13:34It's changing a lot.
13:35People don't even know what's going on, and you can poison the models.
13:39So, the the that's these new uh side doors that attackers are very conscious are the soft targets.
13:44And And the last year has shown that.
13:47Mac OS stealers, all this kind of stuff.
13:48So, this is kind of how Chainguard's thinking about it.
13:50And then we'll dial in on I'll try to also combine with more general ways that these things can be addressed, okay?
13:57For zero days, we have um we've I'll actually get to it at the end of last.
14:01Um so, our classic um uh our classic sort of thing that we've been providing for a long time is um containers that have no known vulnerabilities.
14:09So, if you migrate onto them, they basically don't have any vulnerabilities at all.
14:13I'll talk more about that in a second.
14:14Um for malware, we have our Chainguard libraries.
14:17We build from source.
14:19Um you pull from us instead of from PyPI, NPM, Maven Central, and makes a lot of attacks structurally impossible.
14:26Um so, basically replacement repositories.
14:29Um for zero days, we've been working with um major banks um and other uh tech companies.
14:36And uh we have a large consortium going to Athena's consortial solution.
14:41So, basically we we do have a clearinghouse where we um take uh uh known zero days, and then we provide them back to people within the consortium.
14:50Um and then we also have our new uh Chainguard actions and Chainguard skill uh Chainguard agent skills that are hardened uh versions of CICD actions or agent skills um that you can kind of drop in.
15:05Um in terms of the the sort of that area that I was talking about, that CVEs area, that sort of like legacy area that you still can't ignore, uh the big problem is this like iceberg problem, right?
15:15Is that you have to run on some infra, but that infra is um Um, most of it is beyond your control.
15:22Um, so that basically means that like say 2% of the code that you run is your application code.
15:27That's made up number, but I would say it's actually not a bad made up number.
15:30It's actually probably pretty close.
15:32Could be 1%.
15:33Um, is actually your code that your engineers wrote and they can introduce problems in that.
15:38That's not We do software supply chain security.
15:40Everything else is kind of more our area.
15:42So, if you can don't control the OS, um, the application layer, the language runtime, that those are the layers that most of the vulnerabilities are on, okay?
15:52And I call this the uh, my boss told me to fix a bunch of problem.
15:56Um, and it basically is like well, okay, now we somehow have to fix all these things in systems that we don't control.
16:02The way that Tenkar thinks about this is that we actually started over with a new distribution of Linux that is called Wolfie and it's basically just completely, um, you know, from the built from the ground up to be to solve this problem.
16:14And we may mostly do that by having it be a rolling distro.
16:17So, there's kind of like not much of an upstream beyond You're basically running on upstream maintainers, um, code, okay?
16:24And we pull in very quickly.
16:25Things get pulled in.
16:26Images get rebuilt, uh, one to four times a day.
16:30Um, so it's a very different way of approach.
16:31We don't sit on stable versions, okay?
16:33It's a very different approach.
16:34We also try to be minimal and do some other things.
16:36Minimal also helps with zero days.
16:38[snorts]
16:39This is our SLA.
16:40So, no 30 60 90.
16:42It's uh, 1 7 14.
16:44One day for unknown exploited vulnerability, 7 days for criticals, and then 14 days for everything else.
16:50So, the 14 for a lot of that 14, that's stuff that no team would ever fix, right?
16:56Like a lot of a lot of teams, mediums and lows would never be triaged in under any circumstances.
17:01So, um, what else do do we think is really important?
17:04This is not a product.
17:05This is uh, something we care about.
17:07Um, Salsa and Sigstore, um, basically we think you should sign everything.
17:13Whenever an artifact is created, sign it.
17:16And then pass it off, then check that signature on the other end, okay?
17:18That's And what you can use for this for this stack is Sigstore is very useful for this, okay?
17:23Um and then Salsa is basically like attach provenance of the artifact, cryptographically sign it, and then check it on any other internal pipeline that you have, okay?
17:35So, it's a way of doing like a zero-trust pipelines that's very effective.
17:39It's very good in this current environment.
17:40A lot of these attacks are basically pipe different kinds of pipeline attacks, messing with your uh um your your tags, your download pages, um your depths, uh anything earlier between source and where your users got stuff.
17:54Um libraries is basically uh we take And this is a new mechanism, so it's a little hard to it's a little hard sometimes to for people to be like, "Wait, what what's the point of this?"
18:03Basically, we take clean clean source.
18:06Most attacks are after source and then between the source and the distribution of the artifact.
18:12So, we take the source, we airlift it out of the maintainers' kind of like, you know, situation with their distribution page and their CI/CD and everything.
18:20We airlift it out, little helicopter.
18:21We put it into our system.
18:23We build it all, and then we pass it on to you, okay?
18:26So, it's built from source.
18:27We also do scanning, another kinds of remediation triage, you know, uh to, you know, beyond that, but you know, the built from source is a kind of unique mechanism that we do.
18:38And then I guess Ubuntu's not updating.
18:40[laughter]
18:42Maybe I should be running on Wolfi.
18:43And um and then see our ChainGuard Actions, and we're thinking about more in this space now, but basically trying to remediate this this problem of CI/CD is being this this one of the main soft targets in the modern
18:58um environment, okay?
18:59So, ChainGuard You can pull You can try it out.
19:01It's it's free to try it out.
19:02ChainGuard Actions um you can drop them in for GitHub Actions.
19:06Um we'll also be thinking about other ways where, you know, I think I don't know what I exactly what I'm allowed to say.
19:12We have Assemble London going on, so you can tune into that this week, okay?
19:16Um this is something I've been working a lot on myself, too, is the Chingerd Agent Skills.
19:20So, Chingerd Agent Skills is basically we take upstream third-party skills, um we harden them in our pipeline, and then we pass them on to you.
19:30Uh so, it goes through a whole bunch of deterministic and non- and in-agentic steps.
19:35I actually just released a weird little video with like, you know, like machine um uh kind of Minecraft-esque that will kind of explain how the pipeline works.
19:42If you want to check that out on the R YouTube channel.
19:45But, um but yeah, so, you know, and a lot of agent skills like my own in um recent uh analysis is something like 5% of agent skills on upstream repositories are actively malicious.
19:57Um earlier in the year, I think it was like something like 20%, though I think this changed a little bit.
20:01And then another like 30 to 40% have serious security issues or implications um that make them insecure even though they're not intended to be malicious.
20:10Um we also can in your own organization, you can upload um uh skills to be hardened and then discovered by folks within your own organization.
20:18Um so, it's basically a quick and dirty, you know, 20 minutes kind of the new lightning talk, right?
20:24And I'm trying to cover a lot of ground.
20:26Um hopefully we can maybe answer a question or two.
20:28Um but we have the open source finance forum forum coming up.
20:32It's funny when I just just now was looking at the slide and it said open source fiance forum.
20:36So, that sounded kind of fun, actually.
20:39We should have the open source fiance forum.
20:41But, um but it's the open source finance forum on November 5th.
20:45Um that's with Dan Lawrence, our CEO, and uh leaders who are leaders from the Athena consortium.
20:51Uh check that out.
20:52That's the QR code there.
20:54And then hope hopefully it works.
20:55And then um this is our fi If you're I know there's a lot of finance folks in the room, this is QR code is to our like start here if you're in finance page.
21:03Um come do check out our our in um in it's booth 23.
21:09We're behind a big column so we're really hard to see.
21:11So just look behind all the columns in the big expo room and you should be able to find us.
21:15And then my name is Patrick Smith.
21:18Uh this is my LinkedIn and this is Wolfie.
21:21Wolfie is the smallest octopus in the world.
21:23He's really tiny.
21:23He's minimal.
21:24Being minimal helps with zero days.
21:26Uh it's he's the size of a of a fingernail.
21:29There's not that many videos of him.
21:30This is one of the few that are online but he you know I'll leave him up for a second and then hopefully we have time for just a couple questions but thank you.
21:40[applause]