Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- I'm positively surprised that their tool is not yet another LLM wrapper.
The quality of research (and by extent HN submissions) has really plummeted since LLMs have become marginally useful
by burgerone - This showed me that taint analysis is kind of slept on. Maybe we should invest in better tooling that allows us to reverse engineer with taint analysis easier. Do we think it is a UI problem? Of course over tainting is a thing, but maybe we can make it work with better UI.by joa-
- > The attack effectively modifies only the arguments of the execve syscall
I feel this checklist of shell-tools [0] is relevant, although the focus is more on how setuid is dangerous because you might not know the fancier arguments someone could supply.
> GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.
by Terr_ - > Data-only attacks ... have long been considered too sophisticated and niche to pose a practical threat.
I thought the whole point of fuzzing was an example of finding data-only attacks.
by gumby - I'm missing a critical part of the explanation.
If "the server has a memory safety bug that allows a malicious client to overflow some buffer and overwrite, for instance, the contents of the cgi_bin_path variable", then why is this a data-only attack? Instill need to overflow a buffer the "traditional" way.
- Data-only attacks are somewhat low-hanging fruit. Classical static analysis could already find them before AI got this strong, and LLMs make identification even easier. But the real threat is risk buried in business logic, especially abuse of normal business logic. Take e-commerce refund abuse. Bug hunters would not even call it a risk, yet fraud rings have arbitraged millions off this kind of logic. And because the logic is legitimate business logic, it is very hard to detect.by mgaldys4