News for hackers. Stuff that matters.

A comment on Google assigns a CVE for libwebp and gives it a 10.0 score. Parent comment

Re:Google assigns a CVE for libwebp and gives it a 10.0 score by toomuchtodo on Tuesday September 26, 2023 @11:06AM (#37660473)
This is why I'm bullish on LLMs for application security vulnerability searches (like Shodan for code). It'll see what humans don't.
[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by theptip on Tuesday September 26, 2023 @11:24AM (#37660714)
Seems to help attackers just as much as defenders though, until you’ve found every single bug (which could be possible, but will likely be expensive.)
[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by malfist on Tuesday September 26, 2023 @11:19AM (#37660643)
Why would you expect that? LLMs are explicitly trained on what humans do. Humans miss security vulnerabilities all the time.
[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by toomuchtodo on Tuesday September 26, 2023 @11:24AM (#37660723)
Because the LLM based appsec products I've tested on a large code base have been very good at finding what devs and appsec code reviews didn't.
[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by reitzensteinm on Tuesday September 26, 2023 @11:37AM (#37660937)
Which ones, out of curiosity?
[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by dnedic on Tuesday September 26, 2023 @12:15PM (#37661518)
Humans can't be forced to evaluate every piece of code 100000 times in an hour. LLMs can.
[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by philipwhiuk on Tuesday September 26, 2023 @12:22PM (#37661632)
With infinite hardware, sure. LLMs are pretty expensive to run vs fuzzing.
[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by ZiiS on Tuesday September 26, 2023 @12:17PM (#37661558)
Humans find security vulnerabilities all the time too. The assumption is a lot of the misses are because highly trained security experts don't have time to carefully read and understand all code without fatigue.
[ Parent | on HN ]
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by xeckr on Tuesday September 26, 2023 @12:44PM (#37661981)
Because of generalization.
[ Parent | on HN ]