***Guest post by Ian McNee***

Most people will have heard the news recently that an IT security researcher using state of the art AI tools discovered two (now three) critical flaws in a software system which much of the internet relies upon: PHP – a computer scripting language that allows websites to deliver dynamic content to internet users (and if you’re not sure what that means, dynamic content is essentially anything beyond text data with images and links to other static text/image data, ie, nearly everything useful on the internet).

Now the original two vulnerabilities are the most serious flaws in a widely used system that have been discovered in number of years: a sophisticated attacker could theoretically compromise any system publicly accessible on the internet, take control of it and potentially access all of the data on that system. So yes, it’s a big deal and it rightly deserves widespread coverage in the mainstream media beyond the nerdy sites covering internet security and related topics that interest computer geeks.

BUT – and this is a very big BUT – have you heard in recent days about the compromise of internet certificates issued by an Indian Certificate Authority, eMudhra? I expect not, but this is the tip of a very large and very nasty internet security iceberg. Cloudflare (who have been commenting extensively and authoritatively in the media on the PHP flaws) put it thus: “an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic.”  They could, for example, create a website that a browser or app will see as authentic, and that looks like Gmail or your bank, as far as the user is concerned.

That in itself is bad enough but the situation is significantly worse than that because the essential vulnerability is not a flaw in software or the human systems that operate such software, rather it is a vulnerability by deliberate design that cannot be fixed by a software patch or other straightforward mitigation by either users or service providers.

The internet’s system of authenticity, the means by which any system on the internet can determine that another system on the internet that it is communicating with is actually who it says it is, works via a system of Certificate Authorities who issue cryptographically-signed certificates to websites that ‘prove’ they are who they say they are.

In the case of the weak certificates issued by eMudhra, the problem could be fairly quickly and easily isolated (at least for the vast majority of the internet who hadn’t bought certificates from eMudhra) but that is frequently not the case when Certificate Authorities are compromised – and it happens often enough to turn IT security people grey.

Back in 2011 a large software corporation called Comodo (you may have used their free firewall and other security products on your PC back in the day) had their Certificate Authority operation compromised by what was likely an amateur and amateurish hacker who created fake certificates for a number of services run by several internet mega-corporations. And in the following weeks Comodo were compromised several more times. But unlike eMudhra it was impossible to isolate Comodo as at the time 20-25% of the sites on the internet globally used certificates issued by Comodo. That meant that if, say, Mozilla had revoked the validity of Comodo certificates in its Firefox browser then up to a quarter of the internet would have instantly vanished for Firefox users. In other words Comodo were ‘too big to fail’ – where have we heard that before?

And it is in this way that internet security is no longer solely the domain of geeks but enters the world of political economy. There are far more resilient and trustworthy methods of guaranteeing authenticity on the internet (a very promising one was proposed in the video I’ve posted here) but: (i) they don’t make any money for a number of large monopolistic corporations that dominate the the certificate market; and (ii) they limit the powers of states (and the same corporations) to snoop on, or control parts of, the internet. It should be noted that the latter is not something that happens often at all, not least as it is almost impossible to conceal, and because it is a highly inflammatory act, likely to have significant political and/or diplomatic consequences. But state actors do not like to give up such powers, particularly in increasingly turbulent times such as we are now living through. I seriously recommend this talk by the cryptographer and software engineer Moxie Marlinspike (incidentally the creator of the secure messaging system Signal) at Black Hat USA in 2011:

For more concise, written version click here.

He explains the problem very well and proposes viable a solution. That someone with his weight in the cryptographic world clearly understood and articulated the problem alongside offering a solution a decade and half ago and yet essentially nothing has changed, speaks to the strength of the vested interests resisting change.

It is worth adding a note on the role of AI in all of this. A lot of commentary on PHP2Shell and other computer security issues, particularly in the mainstream media, mentions AI and the sky falling in. The essence of such claims is that AI will discover so many serious flaws in the online systems that we use to manage our daily lives that such systems will no longer be safe or reliable enough to use.

There is certainly an element of truth to this: for more than a year now security researchers and software developers have noted the significant increase in the number of bugs found, and therefore of the patches that must be created to fix them. This is a real problem: the resources to create and test software fixes is limited, even if that effort is itself assisted by AI. But this does not necessarily mean that we are in a fundamentally new and more dangerous situation. It has always been known that all software systems contain bugs some of which will make that system vulnerable to compromise.

And in this there is likely an upside to the AI demon. For many years there have been businesses that make their money by discovering flaws in important online systems and, rather than reporting those flaws responsibly, they sell the details to the highest bidder, often state security services who keep this information under wraps until an opportunity presents itself to weaponise such flaws against individuals, organisations or other states. With the advent of AI-assisted security research it is certain that at least a proportion of these previously secret flaws will be found and fixed. So the world has become more complicated to navigate but I doubt that we are facing the PHPocalypse or similar that some are predicting.