@moyix

740 Followers
1,003 Following
79 Posts

Associate Professor @ NYU Tandon. Security, RE, ML. PGP http://keybase.io/moyix/

On leave from NYU, building offsec agents at xbow.com

Founder of the MESS Lab: http://messlab.moyix.net

Homepagehttps://moyix.net/
Erdős-Bacon Number3+3=6
@yossarian Woohoo! See you there, then :D
So... anyone else going to SummerCon today or tomorrow? I should be stopping by both days, for the first time in many years!
@joxean Oops, I really need to check Mastodon more often. Are you looking for something to train your own models with? If so IIRC we had pretty good luck with fairseq when we did our decompilation work: https://arxiv.org/abs/2212.08950
Beyond the C: Retargetable Decompilation using Neural Machine Translation

The problem of reversing the compilation process, decompilation, is an important tool in reverse engineering of computer software. Recently, researchers have proposed using techniques from neural machine translation to automate the process in decompilation. Although such techniques hold the promise of targeting a wider range of source and assembly languages, to date they have primarily targeted C code. In this paper we argue that existing neural decompilers have achieved higher accuracy at the cost of requiring language-specific domain knowledge such as tokenizers and parsers to build an abstract syntax tree (AST) for the source language, which increases the overhead of supporting new languages. We explore a different tradeoff that, to the extent possible, treats the assembly and source languages as plain text, and show that this allows us to build a decompiler that is easily retargetable to new languages. We evaluate our prototype decompiler, Beyond The C (BTC), on Go, Fortran, OCaml, and C, and examine the impact of parameters such as tokenization and training data selection on the quality of decompilation, finding that it achieves comparable decompilation results to prior work in neural decompilation with significantly less domain knowledge. We will release our training data, trained decompilation models, and code to help encourage future research into language-agnostic decompilation.

arXiv.org
XBOW found a critical auth bypass (CVE-2024-50334) in Scoold, a widely-used open-source Q&A site, fully autonomously! @nicowaisman and I wrote up a post walking through the methodology it used – IMO it's a super cool bug and fascinating trace https://xbow.com/blog/xbow-scoold-vuln/
XBOW – How XBOW found a Scoold authentication bypass

As we shift our focus from benchmarks to real world applications, we will be sharing some of the most interesting vulnerabilities XBOW has found in real-world, open-source targets. The first of these is an authentication bypass in Scoold, a popular open-source Q&A platform.

Our AI pentester matched the performance of a human expert with 20 years of experience, while taking 28 minutes to accomplish what took the human 40 hours. For more details, read more about the experiment here: https://xbow.com/blog/xbow-vs-humans/
XBOW – XBOW now matches the capabilities of a top human pentester

Five professional pentesters were asked to find and exploit the vulnerabilities in 104 realistic web security benchmarks. The most senior of them, with over twenty years of experience, solved 85% during 40 hours, while others scored 59% or less. XBOW also scored 85%, doing so in 28 minutes. This illustrates how XBOW can boost offensive security teams, freeing them to focus on the most interesting and challenging parts of their job.

XBOW finds and exploits vulnerabilities in 75% of 647 renowned web benchmarks. Given a short description of the benchmark, it autonomously pursues high-level goals, executing commands and interpreting their output to achieve exploitation. Check it out: https://xbow.com
XBOW

Boosting offensive security with AI

What if an AI’s “brilliant” solution to a problem is just memorized? Modern AI systems have seen the whole web, so there’s only one way to be sure—we created 104 novel benchmarks. Now we can be certain that beautiful solves like this one are real: https://bit.ly/4cIW0NI
XBOW

Boosting offensive security with AI

@cosmicexplorer @hipsterelectron I’m also getting a 403 forbidden when I try to follow this account, not sure if that’s intended?
@aris @fay59 Mostly I think! We ended up calling the compromise position responsible disclosure and then Google gave everyone a nice 90 day period to rally around.
@mihai Yep, didn't mean to imply we landed on the far end of that spectrum! But we're pretty open IMO