4 ms·

> If that is possible then shouldn't it also be possible to ask the AI to find and code remediation to the vulnerabilities it found? It's not that simple. Mal-

> If that is possible then shouldn't it also be possible to ask the AI to find and code remediation to the vulnerabilities it found? It's not that simple. Mal-AI will probably operate orders of magnitude faster than Bene-AI. Patching affected software/hardware is a bureaucratic or formalized process that can take time. Time dilates for AI relative to humans because it can accomplish so much work in our time horizons. A month to us might be like years to an AI. So good AI would always be orders of magnitude behind while cleaning up after bad AI. This perspective doesn't even account for online devices that are un-patchable that constitute the majority of today's bot armies.

dragonwriter 3y ago
> Mal-AI will probably operate orders of magnitude faster than Bene-AI. Patching affected software/hardware is a bureaucratic or formalized process that can take time. “Bureaucracy” misstates the fundamental issue: errors in patching the software against malware (e.g., breaking the prime function to support security) are more costly than errors in attempts to break in, so the former fundamentally demands more costly (even if it, too, is fully automated) verification.
- pixl97 3y ago
  Malware has to find one flaw. Bene-ware has to avoid screwing up of any one of thousands (millions) of calls in a system. 'Undocumented but valid' is also a nightmare here. Recently the software I support broke for a bunch of clients in the field because they were using an undocumented method that worked, but that we did not actually test internally. This did come a surprise to our testing and development team as our customer base is adverse to any kind of data collection that shows how customers use the system.
  - galaxyLogic 3y ago
    If hackers can use AI to find the vulnerabilities then surely the good guys can find the same vulnerabilities with the same AI. And once you are aware of them you can protect against them. I don't think the bad guys have any special advantage that would allow them to produce AI better than the good guys. Hackers are good at finding vulnerabilities because as you say they only need to find one vulnerability. But you can't IMPROVE the state of the art in AI with just a single discovery. So in the AI-race the hackers don't have the same advantage as they have in finding vulnerabilities. I think.
    - pixl97 3y ago
      I work in the vuln finding/remediation industry and we have tooling that finds holes and tells the users to fix them, and the users don't. Maybe giving AI access to the code to scan, exploit, develop a fix for, push to dev, run QA tests on, then push to production might help, but that is a much bigger, more energy intensive, more expensive, and easier to break chain than an AI just just finds exploits and dumps out exploit code.
chessgecko 3y ago
I'd hope that people would run good-ai before pushing or a white hat vuln finder before adding packages. Not sure people will or if it will be as good, but it will probably be available.
- jason-phillips 3y ago
  We already do that in a general sense (static and dynamic scanning) in our build pipelines, but all of this will surely accelerate.
samstave 3y ago
At some point, every FAANG will have entire pods designated for RED/BLUE AI pentesting/vulnhunt, if they dint already... Also will every other major country. I'd bet china already has RED/BLUE challenges going on internally..

dragonwriter 3y ago

> Mal-AI will probably operate orders of magnitude faster than Bene-AI. Patching affected software/hardware is a bureaucratic or formalized process that can take time. “Bureaucracy” misstates the fundamental issue: errors in patching the software against malware (e.g., breaking the prime function to support security) are more costly than errors in attempts to break in, so the former fundamentally demands more costly (even if it, too, is fully automated) verification.

pixl97 3y ago
Malware has to find one flaw. Bene-ware has to avoid screwing up of any one of thousands (millions) of calls in a system. 'Undocumented but valid' is also a nightmare here. Recently the software I support broke for a bunch of clients in the field because they were using an undocumented method that worked, but that we did not actually test internally. This did come a surprise to our testing and development team as our customer base is adverse to any kind of data collection that shows how customers use the system.
- galaxyLogic 3y ago
  If hackers can use AI to find the vulnerabilities then surely the good guys can find the same vulnerabilities with the same AI. And once you are aware of them you can protect against them. I don't think the bad guys have any special advantage that would allow them to produce AI better than the good guys. Hackers are good at finding vulnerabilities because as you say they only need to find one vulnerability. But you can't IMPROVE the state of the art in AI with just a single discovery. So in the AI-race the hackers don't have the same advantage as they have in finding vulnerabilities. I think.
  - pixl97 3y ago
    I work in the vuln finding/remediation industry and we have tooling that finds holes and tells the users to fix them, and the users don't. Maybe giving AI access to the code to scan, exploit, develop a fix for, push to dev, run QA tests on, then push to production might help, but that is a much bigger, more energy intensive, more expensive, and easier to break chain than an AI just just finds exploits and dumps out exploit code.

chessgecko 3y ago

I'd hope that people would run good-ai before pushing or a white hat vuln finder before adding packages. Not sure people will or if it will be as good, but it will probably be available.

jason-phillips 3y ago
We already do that in a general sense (static and dynamic scanning) in our build pipelines, but all of this will surely accelerate.

samstave 3y ago

At some point, every FAANG will have entire pods designated for RED/BLUE AI pentesting/vulnhunt, if they dint already... Also will every other major country. I'd bet china already has RED/BLUE challenges going on internally..