FFMPEG takes a Big Sleep

Microsoft is a corporation that turns CEO claims 30% of new code is A.I. into So many It's crazy. Hello chat. How are we doing? Good afternoon. Hi. That's a great intro Ed. I I really appreciated that intro Anyway, sorry. All right. Are you guys ready? Yeah You can't laugh about it. I'm just asking if you guys are ready. Okay. Welcome to the stand-up today We are talking about FFM peg and security. We brought on with us the resident security expert and team who Casey low-level learning That's crazy. Oh I set the stage. It's okay. I'm not insulted. It's true. I am It's a compliment, bro. To be able to say category Dude, I'm Casey for the low-low price of 499 made out of plastic manufacture of Beijing. That's pretty good, dude

That's good. I don't even get that Okay, like I got none of it or we always have with us teach we always have with us trash everybody say hi All right, so Casey you got Casey. Sorry wrong Wrong person. Hey, this is going well We're crushing it, bro. Oh, man Please Just Just walk this dog to the park. Tell us how what's going on? I Don't know. Let's do it. So yeah, hey My name is team who Casey also known as low-level. Um, so yeah, I'm a security guy, right?

And you've probably seen maybe a few of my videos about the world of like AI CB in a little bit because you're pixelated and it's like impossible to read that tweet. Oh, I trust me I'll get there. I'll get there. Oh, okay. He's streamed before, bro I know how to computer technically Anyways, ffmpag is this piece of software. You're probably all very familiar with it has kind of two components It has the ffmpag software stack open source volunteer project It also has the ffmpag Twitter, which is kind of Parts of the project in and of itself, right? Um, and so fmpag's twitter has got a little bit of heat recently and they've kind of stirred the pot For Google so so Google has a couple of projects to find vulnerabilities in software

One of them is oss fuzz basically they fuzz or inject bad data into open source projects wait for bugs to fall out and report them And their new push is to do lm-based security, right? So they use a giant lm to read software and then use the reading of the software to maybe finally use after frees kind of more complex bugs that fuzzing has a harder time finding Um, and so google did report a vulnerability it found a vulnerability ffmpag and it was submitted um via their AI system And uh, this kind of pissed off the ffmpag twitter guy again I don't know if this guy's actually a maintainer or feel like runs just a twitter or if he's a bot I have no idea um, but basically his argument is that google submitted a vulnerability

But they submitted it with a 90-day disclosure period basically says hey this bug is private We're not gonna tell anybody until 90 days have a left after 90 days if there is no there is no um patch We will make it public Go and do with that what you will and this kind of start a conversation with ffmpag fmpag is saying hey if google has the compute to find vulnerabilities They should also be patching the vulnerabilities right it should not be on a volunteer organization To be at the whim of this company that has all this compute and kind of be held at gunpoint by google right And so it kind of started the whole conversation on twitter About not only the security disclosure timeline But also like is it right that multi-billion dollar corporations use ffmpag netflix looking at you prime

You know probably a prime candidate So I'm kind of curious what you guys think about the situation right? Is it wrong that google submitted a bug report to an open source project using large amounts of compute? Is it google's responsibility to find the vulnerability and fix it? What do you guys think and I think we may have lost prime but we'll keep going here I want to hear trash is take yeah, well here my take do you want to hear what you've got to say trash?

I personally think it's fair Especially something else popular as ffmpag Right and feeling once consuming it I don't the 90 day things kind of interesting because like they call as a volunteer thing like they shouldn't really be subjected to some timeline But I guess there is some responsibility for having a project as popular as ffmpag right So like I see it from that angle, but you know like How are how do they hold them accountable to that like I mean sure they go public with the bug but Does that that's about it? It's not really like a pay us by 90 days We're gonna kill your family. No, it's literally just like 90 days. We'll go by and then we will publish the bug Brut down What happened? I don't know did you push on a Friday?

Never we're gonna figure this out. How are we gonna figure this out? That is your problem. Do you guys need the wheel? Oh You know, if I'm gonna get big that means I'm gonna put a couple hours re-dactory off the plugins Don't guess where your issues are you can see exactly where they are happening with century Get all the context you need to debug any problem because code breaks so fix it faster with century So this kind of started the conversation on twitter about like why we even have these disclosure timelines and the rationale behind that is This is a bug in software whether or not we we discovered the bug the bug exists, right?

So that means that right now in reality like someone is vulnerable to the vulnerability this exposes So we have an option here. We can disclose it publicly Now and let attackers and defenders know about it or we wait try to mitigate it and then give a disclosure After it's been mitigated but the problem is if you release it before the mitigation You don't have a patch and now everyone knows a bug exists, right? So you kind of heightened the Likelihood that it gets attacked right right? I don't get the threat of like making it public Because it just does more harm than anything like why don't they just help fix it?

All right, well, sure and that that's kind of the question is like why like this bug is not not that it's simple But it's not that complicated. It's a use after free right which basically means pointer gets freed Still has a pointer variable in it But you can use that pointer somewhere else a simple like pointer equals null after the free would literally fix this So the question kind of becomes why did Google not fix this?

You know why did Google who has resources to find the bug not just fix a bug at the same time My thought here is that just like literally They found it in an automated fashion and to submitted the ticket and like no one Was like the process of finding the bug did not also include mitigation because I don't think they have this scale of people to do that I'm not sure big sleep Can find and mitigate bugs if that makes sense, but what are your thoughts teach?

Yeah, I mean It's that there's definitely like a given take here of It's nice to get Bug reports that are reproducible and can tell you exactly what happens and how to do this and what the path is To fix that's like that is a valuable thing that Google's providing so that's nice But it does feel like really crummy to be on the receiving end of them where it's like One is not super obvious. I don't know in this particular case, but at least generally like Is this really even exploitable is this really like a thing that actually could happen in practice is this like You know to someone have to do something insane like oh this only happens when someone tries to cut out minute You know seven in a 49 hour video or something like that right like

um And so especially I can understand the difficulty of being on the maintainer side and you're getting effectively like in automated LLM bug report from Google and Google is just like well you guys should just fix this bro like bro just fix it Just deal with it registered just deal with it and we're gonna you don't have billions of dollars of recruiting spend like we do Whoa, what do you mean? That's not possible and so that part and the especially like From the maintainer side they probably see this like Upward slope of how many times that are gonna get Issues and Disclosures like this where they're like how could we possibly Keep up with potentially the volume of how many things Google could be like sending or submitting to us

All the time and then it's like that's just Google what if like Amazon wants to do the same thing and that looks wants to do the same thing And and now you're like I have like 25 of the you know fortune 500 sending me bug reports every day of things that we need to fix and then know Like follow-up situation or like no Maintenance fee or nothing. It's kind of just like just fix it um, I mean the software is like I mean, I don't know what ffmpegs licenses But I'm assuming it's provided without warranty So it's like it's in the license. Yeah, right. That's a good question That's a good point you've brought up and that's actually with ffmpegs highlights I think in this so to kind of bring up trash this point and your point about like how exploitable is this how

Much does this matter right? Yeah, so the vulnerability is actually in a codec written by a hobbyist from 1995 or not not not that the code is from 1995, but it supports a codec that has only been used in 1995 It is a proprietary LucasArts codec used in a video game Rebel assault to for the first 20 to 10 frames 10 20 frames And this is basically the only use of this codec that we're aware of And Google submitted an AI report to it, right?

So it's kind of a two it's kind of a two sided sword. It's like okay They're spending all of this compute spend and basically bombarding open source with these issues Come up, but also no one is vulnerable to this vulnerability So like why are we talking about it so much? Why is it gotten so much attention? And I think it highlights to what you're talking about the The increasing slope of CVEs. I think AI while it's not good right now at bug hunting It's going to get better. It's only going to keep getting better And so for an organization like ffmpegs if they get a thousand bug reports from Google's big sleep What are they supposed to do? You know like it's a good thing naturally that they found the vulnerabilities

But now what you know, I mean what are they supposed to do with that? Yeah, the thing too is like and I get it, you know the The public like at some point they want to make it public They want to be able to say we found these things They feel like they need to do some disclosure of it etc to let people know who are or potentially could be affected by it But it's also kind of like sending it public makes it so that Attackers now target this thing who don't have access to a trillion dollars of GPUs and all of the latest things to find the bug So like maybe attackers would literally never find this bug except the now Google's like hey, here's a bunch of unfixed Security issues and ffmpegs like in case anyone was wondering we've got a full platter

To try and exploit them if you like yeah, and so that that's the whole argument about disclosure right? It's like you are disclosing enough bug exists that defenders can do the defender thing But also you are now removing the act of vulnerability research and just giving Pots to attackers, right? So yeah, not sure there actually is an answer to this question I just think it it spawned a very Useful conversation on Twitter, then I would like you know people I think it's I'm also curious to hear people that are not in like security spaces say because obviously I have a very Biased you know potentially myopic lens of how I look at this But you know people actually maintain software as their day job is probably very different

So prime what do you think about this man? So here's my big problem with the whole situation and really responsible to close the disclosure overall uh is that none of this Takes into account who or what they're disclosing upon which I think is the I don't know if you guys talked about it But I think that that's just like a huge it's just a huge problem right because if you have say a product that everybody uses And it's a paid for service in which company has actual engineers and it's their jobs to maintain Then yeah, I feel like you are more allowed to be like hey you need to fix this bug and we are disclosing this But what does like Google gain about disclosing?

I always figure disclosing is a mechanism in which you try to pressure someone to either a make a fix or b You want to get the street cred for being able to find this really and you you know unique novel security things So it helps your resume. This is just Google's big AI right they don't they don't they can just be a chart We found 47 critical bugs and 14 different you know OSS projects boom like that. They only need high level stuff So I don't understand even Google's like pressuring to begin with the thing that they're pressuring against isn't created by people being paid or full-time Employee so it's like all of it just seems Just wrong in itself because there's no individual person that's actually getting

Um, like some sort of street credits not like Bob from you know the security department found this really cool 1995 codec issue Uh, he was playing some star wars realized something and hacked his main brain like it's just like not happening and so that's I guess that's where my confusion at is why is Google doing this To these people to begin with Yeah, so I mean it's a good question. Um, I don't think that the disclosure process is a Process meant to give people credit. I think that is a side effect of disclosure Right, I think when a researcher discloses it is supposed to be that they are disclosing to tell the vendor And to tell the public hey your stuff is vulnerable comma also look at me

I found this book right if you're doing disclosure for cloud that's a separate conversation now to your point This is not done by a researcher. This is done by an AI right so you could argue that like Google is getting clout But really very human of it This like give me the credit, bro. It's the most human thing of Google is I want it right now Yeah, I want it. Maybe if they said chaos orbs around the line You know, they're like I don't know And it's like I got to put this on Twitter right now. I got to talk about it Of no, I mean so that's a thing disclosure is about telling to I don't know if you miss this prime because you may have been out with the internet issues But disclosure is about telling defenders right disclosure is about like hey whether or not we report on this publicly

The bug exists right and we know about it secretly attackers may know about it secretly right so we have to inform people That this bug exists because you may be at risk of its exploitation Now the one that's the kind of the problem with this this codec is that like literally nobody has this codec enabled Like this does not compile by default into ffmpeg you have to explicitly enable it And the only place it's known to be used in a game from 1995 So it's like I to me it feels like Google's AI is set up to fuzz opens or software This is what OSS fuzz does and I'm sure that's exactly how big sleep operates And so the AI probably triages all the codecs that exist And it found a bug in a codec and it gave it the default the default disclosure timeline

And I think it's the combination of like all of those factors like the automation behind it The lack of customization to the actual attack surface that piss people off It's like you spent a billion dollars or whatever on this niche codec found a bug and now now it's my problem You know what I mean But it does highlight a larger issue that you highlighted like how how does ffmpeg deal with this at scale that that I don't know So two things one there's this whole AI finding bug thing I you know, I know you're saying AI is really great at finding bugs They have been pretty good at finding bugs, you know If especially if you give them stack traces and you give some sort of hinting to them But generally all the security reports I've seen where things are just like go find a security bug

Have all come up as you know predominantly noise. I know Daniel Gosh, I can't let I can't seem to remember his last name From curl is just like you don't submit AI generated reports You're not allowed to do this at all and he gets just constantly bogged down a bunch of people are getting bogged down So I don't know how convenient these things are comparatively to something some coding guy suggesting which is covarity Uh, what's your experience with covarity at finding say use after free bugs comparatively or static analysis tools in general compared to these AI things Yeah, so a static analysis tool will always be concretely Better right like it will always like if if covarity says there's use after free

There is use after free. There is no question. Yeah, the problem is that is basically a A one for one scalar against human talent right like you need the engineer equipped Then knows how to use covarity that knows the code base to use covarity into triage if these after free is actually there Right, which it likely is The attempt with LLM is to take Security talent which does not scale well again software engineering talent and scale it right Uh, but the problem that we run into is kind of what I think whoever said that in chat is talking about Is of the problem that Sean healing talked about in his article where he basically found a zero-day with LLM's But the problem is that the let me see if I can find the verb to cheer um the signal to noise ratio

Which is basically how many are real versus how many are fake of LLM generated bug reports is one to 50 So you may ask an LLM for find me a use after free vulnerability in the SMB server for for linux and it will give you 50 reports all of which detail this huge stack and like this is the bug right here Only one of them are real if that you know Um, so that's that's what I say like LLMs are getting there. They're not good yet like an LLM can find a bug in software Right the problem is just like how do you deal with the scale of that because now I have to triage 50 potentially fake vulnerabilities, you know um So yeah, and so and like Google and some of these other places they don't have any like

Contractual things with FFM peg or anything that's what seems crazy to me like I feel like What wouldn't you if you're using it like an insane amount for that core of it like I get it that like okay Maybe you know like left pad 37 you can't figure out that it's an important like dependency for your company And so you don't it seems like they don't have people funding like FFM peg time or something like I literally have no idea I couldn't fit I couldn't find or see anything there where they had like maybe some SLA or whatever with them Yeah, I am not aware of the contractual or like legal nature of this arrangement But Google does spend a lot of resources on fuzzing open source software This is a project Google

OSS buzzer literally the Google team spends Google compute in Google Cloud Platform to constantly be Pulling setting up harnesses for and fuzzing a variety of open source software Which is like for example FFM peg is literally a target Inside of OSS buzz if you go to project here you'll see they have all these fuzzers and harnesses set up for all the software one of them being FFM peg And so they they have been spending a lot of money on finding vulnerabilities right which is a good thing naturally But like where does that trade-off happen right like when do you when do you now also help mitigate the vulnerabilities?

Because if you're acknowledging that like you are a big company You are doing this altruistic thing to help make the world a safer place Hey, but you also acknowledge you have more money than every volunteer organization like how do you go about You know rectifying that and the answer in my opinion is like spend some money on mitigations as well That I don't think that's been done so far and that's I that's the whole argument that FFM Peg is making is like hey Just give us some you know a patch file or something So can I ask a quick question? Yeah, uh, what do you think the chances are that trash is looking at Pokemon or paying attention right now?

Okay, I'm gonna I was looking at the read me for OSS buzzer And I was trying to understand how do they how does a project qualify to be fuzzed by this? That I don't know that say Daughters see what they start fuzz in my my code base and they start sending me stuff. I'm like whoa buddy I don't I don't maintain this code Do do projects opt in to be a part of this Google sleuth?

Or whatever they call it Google that's actually a great question. I do not know. I do not know the the process there Because I don't like that because it feels like FFM Peg should be able to say hey, we don't want these reports like you shouldn't file CVEs against us Well, I mean, so I think the argument there is like why would you opt out?

Yeah, I think they want them. It's just there's there's probably Single the noise for them. They wanted them to fix it They didn't even want like they're like oh, well just set us a patch. They don't want the report. They want the result Well, sure I think in this particular kid I'm not sure if the complaint was generally speaking that they want like Google engineers just sending a bunch of fixes for everything But like in this particular case it felt like okay, the fix is relatively simple You know, add you gave an example of how one way that you could fix it like quite easily Like don't send us a report just send us like a fix for this. Yeah, and then like Because that makes sense, but there's gonna be use after freeze or other like actual

You know slightly more complicated vulnerabilities that they could find that like you would still like I think to get those pretty so like for neovim I know We've had I'm pretty sure covarity scanning for a long time and like used that um and effort large open source projects and pretty sure it's free as well Like I'm pretty sure it was free for neovim And so they're like and we've fixed Real things with that and also send like upstream patches to to them and like Overall, that's like helpful, right? But I in general, I don't think covarity I don't I don't think neovim gets a deadline for when this is to fix and uh like Disclosure timeline of when it's gonna get published, right? It's like it's a private

You log into this and view a dashboard Yeah, right and then also there's like some severity levels and some other stuff like that Where you could at least try and decide if it's even worth fixing or it's like okay Sure this happens when xyz thing happens whatever. It's not actually like a big deal um So you know, so it's like it is valuable It's very valuable to get it helps you fix things and like keep the project in a in a better state and less you know Big hacks, but Yeah, it does feel I can see how like with this timeline pressure applied to it and like there's no Like cool. You're donating this thing to us to give it to us and stuff and that's nice and everything But it it also does apply real pressure on maintainers and like projects

And if they don't close I thought I was reading from them like if they don't close enough of these They get like dinged and like other like ratings of stuff of like how secure their project is or something of just like Hey, if you have a bunch of cv ease reported and you don't fix them even if They're like you know not important you get like Thing it's somewhere in some universe of like secure software that can run places and people are happy to use I don't know exactly. That's I don't have any secure software. So um like trash, you know nothing written and rust baby So someone in chat linked how you get accepted into this project and I'm about to submit all of DAX's projects And so he could start so he could so he could start tweeting. Hey, man. I just got a little bug report. This is insane

Code is going in there He's left and right Beautiful fresh That's amazing So I mean that's pretty much it's less of a answer less of a wow crazy bug It's more just like a higher level discussion about like you know It is a good thing that people are finding bugs and software that is a naturally good thing But like then what right like what are you supposed to do if you're a team of 10 people against the gig?

A corporation X right and you know, I don't know the answer to that. Yeah, I mean, it's already like that at work If someone reports a bug on my software internally, I'm like oh I don't want fix that right now You know what I mean You know what I'm saying like I mean it depends on the severity like in this case It was like like you say it was such a niche bug. So if someone reports that I'm like, you know Make a geratick and then maybe I'll open gerat next year, you know Josh you said you admitted last week you've never opened gerat in your lifetime I said maybe if I open up gerat next year. Oh, okay. All right Yeah, I mean that that is one one like human factor that I think a lot of people tend to forget like maybe the ffmp

I got I don't know where he's worked or whatever But like even where I work like large company right if we on my team submit a bug to the engineers Like they have to re-allocate resources to fix that bug and like some bugs be submitted They're like hey, that's gonna take an entire quarter to deal with like we don't have the people right now It's a minimum at Microsoft What's that At any big company, right?

Yeah, no matter where I was on anybody on a person. Yeah, I was speaking on Microsoft on a minute I had a meme. Give me a second. Yeah. Yeah, it's just like no matter where yeah, there you go That's the one I was looking at dude. It's so good. I love this and what's funny is that like it wasn't it wasn't this big It started as a single article and as more people kept us appending to the meme. Oh, it's so good Oh, that's funny So I mean that at these big corporations. I know at Netflix. We'd have it depends on who submits it to and so I think this one thing That's really important here is that Some or at least I think something that can happen is if Google does submit these things and put a lot of pressure on people

Also the value of the project does go down Because now when I hear someone making this kind of submission I'm like, oh, this isn't that important because one time I got a a bug from Reed Hastings himself saying hey There needs to be a vignette on this thing and so it's just like you know how fast that got fixed It got fixed way way faster when your VP's telling you what did the big man set up stand yet Are you saying I got to fix that yesterday But you know like but if a company keeps on submitting things and they kind of tarnished their name People may not take the things they say as seriously and so there is kind of like a there's a whole problem there Yeah, the other thing that which I think is a completely reasonable

Uh Like complaint from F of MPEG team and more broadly in like open source generally is just like it also takes I'm not only to do the fix but to do the triage Right and if like is oftentimes lost like getting a bug report is not free um, so there is something I don't know how to wait that right like I would still probably on average I guess prefer to know what vulnerabilities exist in the software I'm maintaining versus not but also like There's just only so many hours in the day bro There's just like it's only so many hours and if I'm going to spend all of it on triaging big co Uh threat vector level low sent to me like I'm going to be sad, you know, I'm just going to not want to work anymore or do anything and like that yeah

Yeah, I don't know Yes tough man Interesting Interesting, interesting, you know, this kind of flows nicely into uh something we can talk about here for a moment here What a transition they I'm gonna doubt the transition and we've got transition which is a great transition episode. I'm done You

FFMPEG takes a Big Sleep

Kapitelklicken springt direkt hin

Shownotes

Transkriptvom Podcast bereitgestellt · Zeitmarken springen hin