๐๐ฆ๐ฎ๐ฆ๐ฎ๐ฃ๐ฆ๐ณ, ๐ฐ๐ถ๐ณ ๐ข๐ฎ๐ฃ๐ช๐ต๐ช๐ฐ๐ฏ ๐ช๐ด ๐ต๐ฐ ๐ถ๐ฏ๐ฅ๐ฆ๐ณ๐ด๐ต๐ข๐ฏ๐ฅ ๐ต๐ฉ๐ฆ ๐ท๐ถ๐ญ๐ฏ๐ฆ๐ณ๐ข๐ฃ๐ช๐ญ๐ช๐ต๐บ ๐ธ๐ช๐ต๐ฉ ๐ฐ๐ถ๐ณ ๐ฃ๐ณ๐ข๐ช๐ฏ, ๐ฏ๐ฐ๐ต ๐ฅ๐ช๐ด๐ค๐ฐ๐ท๐ฆ๐ณ ๐ฌ๐ฏ๐ฐ๐ธ๐ฏ ๐ง๐ญ๐ข๐ธ๐ด ๐ฐ๐ณ ๐ด๐ฆ๐ณ๐ท๐ฆ ๐ข๐ด ๐ข ๐ณ๐ฆ๐ค๐ฐ๐ณ๐ฅ ๐ฐ๐ง ๐ฉ๐ฐ๐ธ ๐ฐ๐ถ๐ณ ๐ด๐ค๐ณ๐ช๐ฑ๐ต๐ข ๐ข๐ณ๐ฆ ๐ฐ๐ถ๐ต ๐ฐ๐ง ๐ค๐ฐ๐ฏ๐ต๐ณ๐ฐ๐ญ. ๐๐ฆ ๐ข๐ณ๐ฆ ๐ฏ๐ฐ๐ต ๐ช๐ฏ ๐ข๐ฃ๐ญ๐ฆ ๐ฐ๐ง ๐ค๐ณ๐ฆ๐ข๐ต๐ช๐ฏ๐จ ๐ฆ๐ฏ๐ฆ๐ณ๐จ๐บ ๐ฐ๐ณ ๐ฎ๐ข๐ต๐ต๐ฆ๐ณ, ๐ฅ๐ฆ๐ข๐ญ๐ช๐ฏ๐จ ๐ธ๐ช๐ต๐ฉ ๐๐ข๐ค๐ฉ๐ช๐ฏ๐ฆ ๐๐ฆ๐ข๐ณ๐ฏ๐ช๐ฏ๐จ ๐ฐ๐ณ ๐ด๐ค๐ช๐ฆ๐ฏ๐ต๐ช๐ง๐ช๐ค ๐ณ๐ฆ๐ด๐ฆ๐ข๐ณ๐ค๐ฉ, ๐ข๐ฏ๐ฅ ๐ฏ๐ฆ๐ช๐ต๐ฉ๐ฆ๐ณ ๐ค๐ณ๐ฆ๐ข๐ต๐ช๐ฏ๐จ ๐ฏ๐ฆ๐ธ ๐ค๐ฐ๐ฅ๐ฆ ๐ฃ๐ค๐ง ๐๐ญ๐ฅ๐ก๐ค๐๐ฉ๐จ, ๐ฃ๐ค๐ง ๐๐๐ซ๐๐๐๐๐๐๐ ๐๐ง๐๐ ๐ข๐๐ฃ๐๐ ๐๐๐ข๐๐จ. ๐๐ฉ๐ฆ ๐ด๐ฆ๐ค๐ถ๐ณ๐ช๐ต๐บ ๐ฃ๐ถ๐จ ๐ข๐ฏ๐ข๐ญ๐บ๐ด๐ช๐ด ๐ข๐ฅ๐ท๐ช๐ด๐ฐ๐ณ ๐ต๐ฉ๐ข๐ต ๐๐ฆ๐ณ๐ฌ ๐ช๐ด ๐ฅ๐ณ๐ฆ๐ข๐ฎ๐ช๐ฏ๐จ ๐ฐ๐ง ๐ช๐ด ๐ฑ๐ถ๐ณ๐ฆ ๐ฏ๐ถ๐ฎ๐ฃ๐ฆ๐ณ, ๐ถ๐ฏ๐ณ๐ฆ๐ข๐ญ, ๐ข๐ฏ๐ฅ ๐ฆ๐ฎ๐ฆ๐ณ๐จ๐ฆ๐ด ๐ข๐ด ๐ข ๐ต๐ฆ๐ฏ๐ต๐ข๐ต๐ช๐ท๐ฆ ๐ฑ๐ช๐ค๐ต๐ถ๐ณ๐ฆ ๐ฐ๐ง ๐ฉ๐ถ๐ฎ๐ข๐ฏ ๐ค๐ฐ๐ฏ๐ค๐ฆ๐ฑ๐ต๐ด ๐ฐ๐ง ๐ฏ๐ถ๐ฎ๐ฃ๐ฆ๐ณ.
Cybergaucho
@xy
- 467 Followers
- 217 Following
- 123 Posts
Software Developer - Security researcher - Cybergaucho - Parody account - @ortegaalfredo on twitter.
Kierkethumbs up convincingly
Here's the most basic model (performance depends on the model) casually finding CVE-2020-6523, an exploitable Chromium integer overflow:
The AUTOK automatic bug hunter is now available as a VSCode extension:
Compatible with most C-like languages (JavaScript, C/C++, even Solidity). Functions offline as well.
Download from: https://github.com/ortegaalfredo/autok-extension
Consider enabling it on that junior developer's computer:
So while it has found several bugs, I think the autopatcher is more interesting. Here we have the OpenBSD 7.5 kernel, booting with over 10,000 additional AI-generated patches and input checks within the IPv6 and IPv4 stacks. The cost to implement these improvements was ~ $6 USD.
I also make the the observation that itโs often easier to fix a vulnerability than to create an exploit for it, so this asymmetry between defense and attack will cause offensive AI-generated exploits to almost never succeed, because less complex defensive AI will discover and patch them first.
Article pdf here:
I'm happy to share my article 'AI-Powered Bug Hunting - Evolution and benchmarking' where I released several open-source tools, including a simple benchmark, a bug auto-finder (AutoKaker) and auto-patcher (1/3)
