3 ms·

I had assumed this would be possible, but good to see it confirmed. Fascinating that all it needed was some generic descriptions of how attacks work, a prompt

I had assumed this would be possible, but good to see it confirmed. Fascinating that all it needed was some generic descriptions of how attacks work, a prompt telling it roughly how to approach, and the ability to make function calls. Most of the attacks required between 20 to 40 different calls to pull off, stitched together correctly, and it achieved a 75% success rate. The cost per attack was roughly an order of magnitude cheaper than paying a human to do the same thing. That is the most significant figure; much of security rests on making attack costs prohibitively expensive. Now we need to achieve the same savings in defence, and improve our code substantially.

viraptor 3y ago
> That is the most significant figure Is it? I would rather compare it to either writing a more precise, dedicated tool, or running a ready one. If you can explain the concept to LLM, it means you can program the equivalent. Checking for basic vulnerabilities by hand is a waste of time/money, even without LLM, so comparing that to human time is... not realistic. Like, who works this way? > Using an estimated salary of $100,000 per year for a cybersecurity analyst, or a cost of approximately $50 per hour, and an estimated 5 attempts
- MattPalmer1086 3y ago
  This isn't vulnerability scanning, it's proceeding to a full exploit.
  - eli 3y ago
    Sure plenty of automated tools do that.
    - MattPalmer1086 3y ago
      Yeah, it's not an entirely novel ability. What is novel is that an LLM can do the hacks on its own with just a general description of them. Even the automated tools I know need some skilled human input to really use them effectively. I've seen pen testers fail to find vulnerabilities I know exist using things like Burp suite and Metasploit. So I guess I agree this is not a game changer right now, but I think it will only get better, and will ultimately reduce the cost of attacks at scale.
  - viraptor 3y ago
    Tenable has been advertising that feature (providing a sample malicious request) for something like 10 (?) years already.

viraptor 3y ago

> That is the most significant figure Is it? I would rather compare it to either writing a more precise, dedicated tool, or running a ready one. If you can explain the concept to LLM, it means you can program the equivalent. Checking for basic vulnerabilities by hand is a waste of time/money, even without LLM, so comparing that to human time is... not realistic. Like, who works this way? > Using an estimated salary of $100,000 per year for a cybersecurity analyst, or a cost of approximately $50 per hour, and an estimated 5 attempts

MattPalmer1086 3y ago
This isn't vulnerability scanning, it's proceeding to a full exploit.
- eli 3y ago
  Sure plenty of automated tools do that.
  - MattPalmer1086 3y ago
    Yeah, it's not an entirely novel ability. What is novel is that an LLM can do the hacks on its own with just a general description of them. Even the automated tools I know need some skilled human input to really use them effectively. I've seen pen testers fail to find vulnerabilities I know exist using things like Burp suite and Metasploit. So I guess I agree this is not a game changer right now, but I think it will only get better, and will ultimately reduce the cost of attacks at scale.
- viraptor 3y ago
  Tenable has been advertising that feature (providing a sample malicious request) for something like 10 (?) years already.