7 ms·

Using Large Language Models to Catch Vulnerabilities

175 points by sigmar 2y ago

guerrilla 2y ago
So the the eternal arm's race escalates.
sigmar 2y ago
TL;DR P0 collaborated with DeepMind to make "Big Sleep," which is an AI agent (using gemini 1.5 pro) that can look through commits, spot potential issues, and then run testcases to find bugs. The agent found one in SQLite that was recent enough that it hadn't made it into an official release yet. They then tried to see if it could have been found with AFL, the fuzzer didn't find the issue after 150 cpu-hours.
- nickpsecurity 2y ago
  Using a fuzzer was a terrible point of comparison. They’re the slowest, heaviest users of resources. They’d be better off comparing to static analyzers which find bugs fast. In this case, Infer might do since it’s designed to catch those errors. My concept was running a bunch of open-source, static analyzers with the LLM’s essentially blocking false positives. They can do it analytically or by generating the test cases to prove the bug. It might also be easier to fine-tune open models for this since the job is narrower.
cjbprime 2y ago
The work is impressive, but I wish Google wouldn't try so hard to claim to be the world first at everything. This claim feels extremely unprincipled: > We believe this is the first public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software. Earlier this year at the DARPA AIxCC event, Team Atlanta discovered a null-pointer dereference in SQLite, which inspired us to use it for our testing to see if we could find a more serious vulnerability. Every word in "public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software" applies to the Team Atlanta finding that they are citing too, and the Team Atlanta finding was against an actual release version of SQLite instead of a prerelease. If either team has provided the first example of this convoluted sentence, it is Team Atlanta, not Google. It is possible that they're arguing that the Team Atlanta finding wasn't "exploitable", but this is very debatable. We use CVSS to rate vulnerability impact, and CVSS defines Availability (crashing) as an equal member of the [Confidentiality, Integrity, Availability] triad. Being able to crash a system constitutes an exploitable vulnerability in that system. This is surely especially true for SQLite, which is one of the most mission-critical production software systems in the entire world. But if we're going to act like we're being very precise about what "exploitable" means, we should conclude that neither of these are exploitable vulnerabilities. To exploit them, you have to provide malicious SQL queries to SQLite. Who does that? Attackers don't provide SQL queries to SQLite systems -- the developers do. If an attacker could provide arbitrary SQL queries, they can probably already exploit that SQLite system, through something like an arbitrary file content write to an arbitrary local filename into RCE. I don't think either group found an exploitable vulnerability.
- jnwatson 2y ago
  "Attackers don't provide SQL queries to SQLite systems -- the developers do." Yet SQL injection is still a thing. Any vuln that can promote an SQL injection to an RCE is very bad.
  - moyix 2y ago
    Note that the vulnerable extension is only enabled in the sqlite shell: > However, the generate_series extension is only enabled by default in the shell binary and not the library itself, so the impact of the issue is limited. https://project-zero.issues.chromium.org/issues/372435124 https://project-zero.issues.chromium.org/issues/372435124
    - bawolff 2y ago
      Yeah, this seems pretty misleading by the blog post. Quite a big difference between finding a vuln in sqlite vs an sqlite extension.
  - cjbprime 2y ago
    (Are you sure that SQLite attempts to protect against RCE from an attacker who can run fully arbitrary queries? I would be surprised.)
    - StrauXX 2y ago
      I sure hope they do. Security doesn't end at the gates, so to speak. It starts there. We need layered security to create systems where not every hack has critical impact.
    - bawolff 2y ago
      Yes I'm not sure why you are surprised. I'm pretty sure almost all serious dbs attempt this (although some have a permission model to attempt it). In sqlite there is the load_extension() function but it is disabled by default. In some situations you can use attach to write a file with a name that is meaningful to something else on your system. Other than those two things (and assuming no weird extensions are loaded) i think it would be very big news if you found a way to execute code from an sqlite query.
simonw 2y ago
I think the key insight from this is: > We also feel that this variant-analysis task is a better fit for current LLMs than the more general open-ended vulnerability research problem. By providing a starting point – such as the details of a previously fixed vulnerability – we remove a lot of ambiguity from vulnerability research, and start from a concrete, well-founded theory: "This was a previous bug; there is probably another similar one somewhere". LLMs are great at pattern matching, so it turns out feeding in a pattern describing a prior vulnerability is a great way to identify potential new ones.
- ngneer 2y ago
  Thanks for highlighting a key aspect. It may be informative to see all the ways in which the LLM got it wrong along the way, before arriving at the cherrypicked example. For instance, was this the only pattern flagged as a potential bug in the process? That said, I am surprised at how far pattern matching can get you. Certain exploitation requires arithmetic. If LLMs struggle with simple arithmetic, then it is unclear why we would expect them to do well with these. In the GPZ example, it does not appear that the assistant can do the arithmetic or realize the negative offset and its implication. Rather, it looks like pattern matching that mimics static dataflow analysis in order to arrive at the assertion failure. "To cause the assertion failure, we need a constraint on a column with index greater than 3 or smaller than 1."
  - simonw 2y ago
    I would be shocked if this process didn't kick out hundreds of false positives. In this context I think that's fine - zero-day vulnerabilities are rare, so security researchers should expect to browse through all sorts of mis-leads on the way to finding one.
coding123 2y ago
Most code ought to be replaced with llm generated and then reviewed by a number of additional llms
- dboreham 2y ago
  Is that you Elon?
maxtoulouse31 2y ago
Shameless self-plug here, however two years ago I attempted a self study project following a similar intuition: https://maxdunhill.medium.com/how-effective-are-transformers-at-detecting-vulnerable-code-f23ed443c017 https://maxdunhill.medium.com/how-effective-are-transformers... And created a Hugging Face repo of known vulnerabilities if anyone else wants to work on a similar project (link in blog post). My project was a lay person’s not especially successful attempt to fine-tune a BERT-based classifier to detect vulnerable code. Having said this, a main takeaway echoes simonw’s comment: “LLMs are great at pattern matching, so it turns out feeding in a pattern describing a prior vulnerability is a great way to identify potential new ones.” Given majority of vulnerabilities stem from memory misallocation, it seems that an LLM would most consistently find misallocated memory. Useful, though not the most complex vulnerabilities to weaponise. It seems the next frontier would be for an LLM to not only identify previously unidentified vulnerabilities, but also describe how to successfully daisy chain them into an effective vulnerability exploitation. Said differently, giving an LLM a goal like jail breaking the iOS sandbox and seeing how it might approach solving the task.
jumploops 2y ago
We have a “poor man’s” version of this running as a GitHub Action on our PRs[0]. It basically just takes the diff from the PR and sends it to GPT-4o for analysis, returning a severity (low/medium/high) and a description. PRs are auto-blocked for high severity, but can be merged with medium or low. In practice it’s mostly right, but definitely errs on the side of medium too often (which is reasonable without the additional context of the rest of the codebase). With that said, it’s been pretty useful at uncovering simple mistakes before another dev has had a chance to review. [0] https://magicloops.dev/loop/3f3781f3-f987-4672-8500-bacbeefca6db/view https://magicloops.dev/loop/3f3781f3-f987-4672-8500-bacbeefc...
- ctxc 2y ago
  Looks cool!
princearthur 2y ago
I'm excited at the prospect of LLMs being deployed here. An attacker only needs to find one weak link in the chain. Eliminating weak links is hard, and might be NP-complete. However, throw resources at it and you might just make weak links much rarer. Throw a variety of heterogenous LLMs at it, and you might be looking at a large force multiplier.
ngneer 2y ago
Sounds like they had some fun, but what is missing from the analysis is the effort spent, or even a rough indication of said effort. The epilog lists about sixteen non-security contributors that were needed to achieve the feat, and probably many more security personnel were needed from GPZ. Yet the outcome is one bug that could have been found with manual code review or a custom fuzzer. I am not sold on the premise that LLMs can increase code security or lower costs. At the moment, LLMs are producing and introducing more insecure code than they are finding.
- jebarker 2y ago
  This seems both pessimistic and conflating two issues. It's entirely possible that generating code is a bad idea but LLMs can be effective at finding vulnerabilities in human written code. Also, this is an applied research project, you have start small to prove the idea and iron out the wrinkles then you can find efficiencies to scale up later.
  - ngneer 2y ago
    I agree it is a pessimistic view. I did not mean to make a disparaging comment, though. I agree that all research starts out small. And, naturally, for any influential idea, you can point back to when it was small. I did not intend to conflate separate issues. I agree assisted coding and assisted bug hunting can coexist. I was merely trying to weigh the net effect LLMs have on security.
j376c63h9vj 2y ago
[flagged]
westurner 2y ago
awesome-code-llm > Vulnerability Detection, Program Proof,: https://github.com/codefuse-ai/Awesome-Code-LLM#vulnerability-detection https://github.com/codefuse-ai/Awesome-Code-LLM#vulnerabilit...

175 points by sigmar 2y ago

So the the eternal arm's race escalates.

TL;DR P0 collaborated with DeepMind to make "Big Sleep," which is an AI agent (using gemini 1.5 pro) that can look through commits, spot potential issues, and then run testcases to find bugs. The agent found one in SQLite that was recent enough that it hadn't made it into an official release yet. They then tried to see if it could have been found with AFL, the fuzzer didn't find the issue after 150 cpu-hours.

nickpsecurity 2y ago
Using a fuzzer was a terrible point of comparison. They’re the slowest, heaviest users of resources. They’d be better off comparing to static analyzers which find bugs fast. In this case, Infer might do since it’s designed to catch those errors. My concept was running a bunch of open-source, static analyzers with the LLM’s essentially blocking false positives. They can do it analytically or by generating the test cases to prove the bug. It might also be easier to fine-tune open models for this since the job is narrower.

cjbprime 2y ago

The work is impressive, but I wish Google wouldn't try so hard to claim to be the world first at everything. This claim feels extremely unprincipled: > We believe this is the first public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software. Earlier this year at the DARPA AIxCC event, Team Atlanta discovered a null-pointer dereference in SQLite, which inspired us to use it for our testing to see if we could find a more serious vulnerability. Every word in "public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software" applies to the Team Atlanta finding that they are citing too, and the Team Atlanta finding was against an actual release version of SQLite instead of a prerelease. If either team has provided the first example of this convoluted sentence, it is Team Atlanta, not Google. It is possible that they're arguing that the Team Atlanta finding wasn't "exploitable", but this is very debatable. We use CVSS to rate vulnerability impact, and CVSS defines Availability (crashing) as an equal member of the [Confidentiality, Integrity, Availability] triad. Being able to crash a system constitutes an exploitable vulnerability in that system. This is surely especially true for SQLite, which is one of the most mission-critical production software systems in the entire world. But if we're going to act like we're being very precise about what "exploitable" means, we should conclude that neither of these are exploitable vulnerabilities. To exploit them, you have to provide malicious SQL queries to SQLite. Who does that? Attackers don't provide SQL queries to SQLite systems -- the developers do. If an attacker could provide arbitrary SQL queries, they can probably already exploit that SQLite system, through something like an arbitrary file content write to an arbitrary local filename into RCE. I don't think either group found an exploitable vulnerability.

jnwatson 2y ago
"Attackers don't provide SQL queries to SQLite systems -- the developers do." Yet SQL injection is still a thing. Any vuln that can promote an SQL injection to an RCE is very bad.
- moyix 2y ago
  Note that the vulnerable extension is only enabled in the sqlite shell: > However, the generate_series extension is only enabled by default in the shell binary and not the library itself, so the impact of the issue is limited. https://project-zero.issues.chromium.org/issues/372435124 https://project-zero.issues.chromium.org/issues/372435124
  - bawolff 2y ago
    Yeah, this seems pretty misleading by the blog post. Quite a big difference between finding a vuln in sqlite vs an sqlite extension.
- cjbprime 2y ago
  (Are you sure that SQLite attempts to protect against RCE from an attacker who can run fully arbitrary queries? I would be surprised.)
  - StrauXX 2y ago
    I sure hope they do. Security doesn't end at the gates, so to speak. It starts there. We need layered security to create systems where not every hack has critical impact.
  - bawolff 2y ago
    Yes I'm not sure why you are surprised. I'm pretty sure almost all serious dbs attempt this (although some have a permission model to attempt it). In sqlite there is the load_extension() function but it is disabled by default. In some situations you can use attach to write a file with a name that is meaningful to something else on your system. Other than those two things (and assuming no weird extensions are loaded) i think it would be very big news if you found a way to execute code from an sqlite query.

simonw 2y ago

I think the key insight from this is: > We also feel that this variant-analysis task is a better fit for current LLMs than the more general open-ended vulnerability research problem. By providing a starting point – such as the details of a previously fixed vulnerability – we remove a lot of ambiguity from vulnerability research, and start from a concrete, well-founded theory: "This was a previous bug; there is probably another similar one somewhere". LLMs are great at pattern matching, so it turns out feeding in a pattern describing a prior vulnerability is a great way to identify potential new ones.

ngneer 2y ago
Thanks for highlighting a key aspect. It may be informative to see all the ways in which the LLM got it wrong along the way, before arriving at the cherrypicked example. For instance, was this the only pattern flagged as a potential bug in the process? That said, I am surprised at how far pattern matching can get you. Certain exploitation requires arithmetic. If LLMs struggle with simple arithmetic, then it is unclear why we would expect them to do well with these. In the GPZ example, it does not appear that the assistant can do the arithmetic or realize the negative offset and its implication. Rather, it looks like pattern matching that mimics static dataflow analysis in order to arrive at the assertion failure. "To cause the assertion failure, we need a constraint on a column with index greater than 3 or smaller than 1."
- simonw 2y ago
  I would be shocked if this process didn't kick out hundreds of false positives. In this context I think that's fine - zero-day vulnerabilities are rare, so security researchers should expect to browse through all sorts of mis-leads on the way to finding one.

coding123 2y ago

Most code ought to be replaced with llm generated and then reviewed by a number of additional llms

dboreham 2y ago
Is that you Elon?

maxtoulouse31 2y ago

Shameless self-plug here, however two years ago I attempted a self study project following a similar intuition: https://maxdunhill.medium.com/how-effective-are-transformers-at-detecting-vulnerable-code-f23ed443c017 https://maxdunhill.medium.com/how-effective-are-transformers... And created a Hugging Face repo of known vulnerabilities if anyone else wants to work on a similar project (link in blog post). My project was a lay person’s not especially successful attempt to fine-tune a BERT-based classifier to detect vulnerable code. Having said this, a main takeaway echoes simonw’s comment: “LLMs are great at pattern matching, so it turns out feeding in a pattern describing a prior vulnerability is a great way to identify potential new ones.” Given majority of vulnerabilities stem from memory misallocation, it seems that an LLM would most consistently find misallocated memory. Useful, though not the most complex vulnerabilities to weaponise. It seems the next frontier would be for an LLM to not only identify previously unidentified vulnerabilities, but also describe how to successfully daisy chain them into an effective vulnerability exploitation. Said differently, giving an LLM a goal like jail breaking the iOS sandbox and seeing how it might approach solving the task.

jumploops 2y ago

We have a “poor man’s” version of this running as a GitHub Action on our PRs[0]. It basically just takes the diff from the PR and sends it to GPT-4o for analysis, returning a severity (low/medium/high) and a description. PRs are auto-blocked for high severity, but can be merged with medium or low. In practice it’s mostly right, but definitely errs on the side of medium too often (which is reasonable without the additional context of the rest of the codebase). With that said, it’s been pretty useful at uncovering simple mistakes before another dev has had a chance to review. [0] https://magicloops.dev/loop/3f3781f3-f987-4672-8500-bacbeefca6db/view https://magicloops.dev/loop/3f3781f3-f987-4672-8500-bacbeefc...

ctxc 2y ago
Looks cool!

princearthur 2y ago

I'm excited at the prospect of LLMs being deployed here. An attacker only needs to find one weak link in the chain. Eliminating weak links is hard, and might be NP-complete. However, throw resources at it and you might just make weak links much rarer. Throw a variety of heterogenous LLMs at it, and you might be looking at a large force multiplier.

ngneer 2y ago

Sounds like they had some fun, but what is missing from the analysis is the effort spent, or even a rough indication of said effort. The epilog lists about sixteen non-security contributors that were needed to achieve the feat, and probably many more security personnel were needed from GPZ. Yet the outcome is one bug that could have been found with manual code review or a custom fuzzer. I am not sold on the premise that LLMs can increase code security or lower costs. At the moment, LLMs are producing and introducing more insecure code than they are finding.

jebarker 2y ago
This seems both pessimistic and conflating two issues. It's entirely possible that generating code is a bad idea but LLMs can be effective at finding vulnerabilities in human written code. Also, this is an applied research project, you have start small to prove the idea and iron out the wrinkles then you can find efficiencies to scale up later.
- ngneer 2y ago
  I agree it is a pessimistic view. I did not mean to make a disparaging comment, though. I agree that all research starts out small. And, naturally, for any influential idea, you can point back to when it was small. I did not intend to conflate separate issues. I agree assisted coding and assisted bug hunting can coexist. I was merely trying to weigh the net effect LLMs have on security.

j376c63h9vj 2y ago

[flagged]

westurner 2y ago

awesome-code-llm > Vulnerability Detection, Program Proof,: https://github.com/codefuse-ai/Awesome-Code-LLM#vulnerability-detection https://github.com/codefuse-ai/Awesome-Code-LLM#vulnerabilit...