4 ms·
So how do you detect these attacks?
by Yoric 1y ago
So how do you detect these attacks?
- veber-alex 1y agoAI based code review with escalation to a human
- Yoric 1y agoI'm curious :) Does the AI detect the obfuscation?
- justusthane 1y agoProbably. It’s trivial to plug some obfuscated code into an LLM and ask it what it does.
- spartanatreyu 1y agoYeah, but just imagine how many false positives and false negatives there would be...
- 33a 1y agoIt's actually pretty easy to detect that something is obfuscated, but it's harder to prove that the obfuscated code is actually harmful. This is why we still have a team of humans review flagged packages before we try to get them taken down, otherwise you would end up with way too many false positives.
- Yoric 1y agoYeah, what I meant is that obfuscation is a strong sign that something needs to be flagged for review. Sadly, there's only a thin line between obfuscation and minification, so I was wondering how many false positives you get. Thanks for the links in your other comment, I'll take a look!
- nurettin 1y agoI think that would be static analysis. After processing the source code normally (looking for net & sys calls), you decode base64, concatenate all strings and process again (until decode makes no change)
- 33a 1y agoWe use a mix of static analysis and AI. Flagged packages are escalated to a human review team. If we catch a malicious package, we notify our users, block installation and report them to the upstream package registries. Suspected malicious packages that have not yet been reviewed by a human are blocked for our users, but we don't try to get them removed until after they have been triaged by a human. In this incident, we detected the packages quickly, reported them, and they were taken down shortly after. Given how high profile the attack was we also published an analysis soon after, as did others in the ecosystem. We try to be transparent with how Socket work. We've published the details of our systems in several papers, and I've also given a few talks on how our malware scanner works at various conferences: * https://arxiv.org/html/2403.12196v2 https://arxiv.org/html/2403.12196v2 * https://www.youtube.com/watch?v=cxJPiMwoIyY https://www.youtube.com/watch?v=cxJPiMwoIyY
- ATechGuy 1y agoYou rely on LLMs riddled with hallucinations for malware detection?
- jmb99 1y agoI'm not exactly pro-AI, but even I can see that their system clearly works well in this case. If you tune the model to favour false positives, with a human review step (that's quick), I can image your response time being cut from days to hours (and your customers getting their updates that much faster).
- ATechGuy 1y agoYou are assuming that they build their own models.
- Mawr 1y ago"LLM bad" Very insightful.
- Culonavirus 1y agoHe literally said "Flagged packages are escalated to a human review team." in the second sentence. Wtf is the problem here?