Social media and "cybersecurity experts" had a big role in this. Stuff like "EU SAYS THIS IS A URGENT VULNERABILITY" and even the Prime Minister of Japan doing a nighttime PSA. They cite "the experts" posts on social media about the initial advisory, while the very same so-called experts share google search AI output mitigation strategies. None of these organizations or bodies had any details other than what was on the advisories and social media. (e.g "CVSS 10, that's bad!!")
To me, it seems more more akin to broadpwn, technically severe, wide scope (millions of iphones), yet will never be a one-size-fits-all-PWN-button.
Even in the age of AI, I don't think this is going to be weaponized down the line like how Eternalblue was... but I'm not the social media cybersec guy with 15000 followers, so don't take my words at face value ;)
I feel like half of working in the cybersecurity industry is just cultivating your social media persona. It's bizarre. I left a viral up-and-coming startup over it. It was mixing into everyone's personas at work in weird and uncomfortable ways, as someone who doesn't use traditional social media.
It’s unfortunate but you’re correct.
There are a few “social media famous” cybersecurity folks really worth their salt who didn’t immediately dumpster their morals and skills at the first sign of an ego boost.
People like Krebs, Allison Nixon, Joanna Rutkowska.
Most of them though are just addicted to likes as it’s become a core part of their self worth.
Most cybersecurity is performative, like war, cybersecurity is mostly boring and if you are doing your job, zero drama. If you want to stand out you need piercings and hot takes.
The pop culture makes you think cybersecurity is wearing black clothes, having wild tatoos and jacking-in the matrix with a dripped up thinkpad while at the back of a nightclub. Turns out, its wearing suit, and showing slide to corporate begging them to have a review process for their firewall and a decommission plan for their 20 years old services made in java 6 and never updated.
True, but I am talking about the whole vibe of security as an industry and how the corporatization of defcon shapes it. The primary issue with security, it is difficult to show efficacy. It is akin to proving a negative. If you are doing your job, no one notices until they have laid you off. You need to be loud, flashy, dangerous, brash to stick around. So now the ecosystem breeds for a signal isn't related to how qualified one was at security.
I would argue that Krebs is exactly the type of guy who will do anything for a good story, whatever it costs. I saw him lying more than once and this eroded my trust completely.
I think you’re talking about Brian Krebs while the person you’re replying to is talking about Chris Krebs.
Both of them are well known in cybersecurity but are very different people with very different reputations.
Whoops, you are right. Sorry!
Would you have examples to share? I'm genuinely curious.
Marketing, for a while, has been about the personalities of the people involved - socMed just amplifies that
Not everything needs to be abbreviated
I actually rather like 'SOCMED', given that social networks these days can be weaponized in various ways, so it deserves a name akin to 'OPSEC' and other military-like terms
Whilst I would love credit for coining the term - it's been around for a minute
https://www.collinsdictionary.com/submission/11194/SocMed
you'll find egomaniacs in any industry. From experience the people who actually speak regularly at cybersecurity conferences do tend to have a "cult of personality" aura about them. Part of it is industry incentives too. If you have a bunch of stuff on Github / technical blog posts / social media presence it helps a lot finding a job. So I wouldn't necessarily entirely blame them for cultivating a social media persona.
In fairness sometimes its thrust upon some by followers themselves, just depends how they handle this _fame_.
It’s not. Social media personas is most of what gets seen, hence your understandable conclusion. What most don’t see are those who do not give a damn about that and just do the work.
And get pennies for the work while social media personas rake in millions.
So I have been failing to do half of my career this whole time?
The people you hear from are famous personalities... That's the nature of being a famous personality. There are plenty of us who are just normal people with opinions of our own and no desire to cultivate a public name or face for ourselves...
Unfortunately part of some cyber sec jobs is literally doing sales. I remeber in the begging of my career I was offered cyber sec job and the guy hiring me said you will be doing sales and will be reaching out to people on top of your job. I just declined.
Yes, the cybersecurity industry definitely oversells itself on every (social media) channel it can find. But to be fair, it kind of has to. Many people and companies are notoriously lazy about secutity and patching until something goes wrong. So you have to cause a stir, oversell the risk, and create a sense of urgency, to get them to act.
Obviously, there are also some people in cybersecurity who oversell not for the greater good, but only to further their careers... and even those who are honest and would prefer not to self-promote like that, are sort of forced to, because visibility can matter as much (if not more than) expertise when trying to find a job in cybersecurity, as you'll look like an underachiever if you don't oversell yourself like everybody else.
Yep. First few years is just getting a read on who is accurate, who is precise, and who is both. Lots of alarms going off all the time in this industry.
The problem is, by and large, that AI has drastically reduced time to exploitation of vulnerabilities that modern CVEs are often under-representing their severity. If you've worked in security this year, it's been a march of vulnerability after vulnerability and everyone is waiting for the next big one that exposes your systems.
The fact that this particular CVE doesn't have an easily exploitable path has meant very little, historically, in the modern threat landscape. AI has proven it's able to pull off chaining multiple exploits that are very difficult or hard to pull off, but a machine does not care for "ease" or "difficulty".
All that is to say, the security community is currently a little gun-shy, but with good reason.
>"cybersecurity experts" had a big role in this
Nobody listens to experts. Maybe you mean cybersecurity influencers? Actual experts, like in most industries, are not the most visible.
You are basically correct in your estimate of the severity. Exploitation, at least now, requires knowing exact PHP config and a lot of tweaking.
There was a complete panic on the internet and in all HN threads, with people claiming insane things like "this is already exploited everywhere in the wild" (it was not), "it took me 10 minutes to replicate this vulnerability from a public information" (yeah, sure) or "there is a public blog post with a writeup" (it was hallucinated AI slop). Voices of people who knew more, while present, were drowned in fake news. It didn't help, that in the first threads people who knew more (and were serious about coordinated disclosure) couldn't say much, so people sharing the most, knew the least.
I wish I could help, but honestly there were so many people parroting incorrect information that it's impossible. Signed, someone who got information about this vulnerability before it was publicly known, and worked to remediate it.
Just reading all of these made me question if it actually was this secure. It seemed very much like a moral panic. Sure I patched as soon as it came out, but taking websites offline seemed a bit much.
To be fair, the warning to either take down websites or patch immediately on release came from the people who've been working on this for months (or those with advance notices like CERTs), not out of nowhere. People just took it down pre-emptively since exploit attempts (whether working or not) popped up in logs way before the patch was released, but it also took forever until the fix actually landed downstream after the advisories were released.
> Social media and "cybersecurity experts" had a big role in this.
I think the problem that "coordinated disclosure" has too many people and companies with conflicts of interest.
For example, this PHP "coordinated disclosure", you have:
Then governments probably have various "pro alerts" subscriptions so they get all in a panic because the company sending out the alerts starts ringing the alarm bells.
Meanwhile the rest of the world with good-old LAMP (Linux Apache Mysql PHP) installations ? Meh ... a mere afterthought to the money-making opportunities. Some posts on HN suggest there was a 2 month delay between discovery and "coordinated disclosure" ?
Historically you might have written this off as an un-necessarily cynical view. But sadly I think it is a valid reflection of the world we live in today.
People seem to not understand that cybercriminals are lazy, as well. They're not gonna sink a lot of effort into doing something technically impressive when there are way easier ways to generate a decent ROI. Why would they mess around with remote heap grooming when there are plenty of nday rce in widely-deployed enterprise slop just laying around, makes no sense.
This was big news because it was the news that a sector was looking for - that is, “AI Discovers a Cataclysmic and Widespread Vulnerability” - and confirmation bias does the rest.
It took me five minutes to realise that this was something of an nothingburger. As the author states, you basically have to have PHP running as root, and allow an attacker to upload and then execute malicious code on your server already - and if you’re there already the house is already on fire.