Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The coming industrialisation of exploit generation with LLMs

sean.heelan.io

Post reply on HN
Print view View original

171–174 of 174 posts

Re: The coming industrialisation of exploit generation with LLMs

#171

Post by larodi »

KellyCriterion wrote: post #126
larodi wrote: post #124

two points - 1) it becomes increasingly more dangerous to dl stuff from the internet and just run it, even its opensource, given normally people don't read all of it. for weird repos I'd recomment to do automated analysis with opus 4.5 or the gpt 5.2 indeed. 2) if we assume adversaries are using LLMs to churn exploits 24/7, which we should absolutely do, perhaps the time where we turn the internet off whenever is not…

...well, just dont download random stuff from the internet and run it on your important machines then? :-)) You are right: 30 years ago, it was safe to go to vendor XY page and download his latest version and it was more or less waterproof. Today with all these mirror sites, very often better SEO ranking than the original, its quite dangerous: In my former bank we had a colleague who installed a browser add-in that h…

well, how about all those Show HN repos? just don't download them or what?

Re: The coming industrialisation of exploit generation with LLMs

#172

Post by staticassertion »

ahartmetz wrote: post #167
staticassertion wrote: post #154

Earlier quoted context omitted.

Most mitigations just flat out do not attempt to help against "arbitrary read/write". The LLM didn't just find "a vuln" and then work through the mitigations, it found the most powerful possible vulnerability. Lots of vulnerabilites get stopped dead by these mitigations. You almost always need multiple vulnerabilities tied together, which relies on a level of vulnerability density that's tractable. This is not just b…

Maybe I've been fooled by survivorship bias? You don't read much about the the vulnerabilities that ultimately weren't exploitable. Reports about the ones that are exploitable usually read to me like after finding an entry, the attacker reaches into the well-stocked toolbox of post-entry techniques (return-oriented programming, nop slides, return to libc...) to do the rest of the work.

Most people don't publish dead ends. Here's one that my company published: https://web.archive.org/web/20221001182026/http://graplsecur...

Re: The coming industrialisation of exploit generation with LLMs

#173

Post by rightbyte »

intended wrote: post #118
rightbyte wrote: post #108

Earlier quoted context omitted.

My strategy is to not use "the entire world's infrastructure" which makes it redundant. If enough people cancel their leftpad-as-a-Service subscription the server can be unplugged. (Yes I am somewhat hyperbolic and yes I see use for internet connected servers and clients. I argue against the SaaS driven centralization.)

I mean, yeah you can have the joy of being right from the heights of the hill you are standing upon. But It seems like you grasp the heart of problem being discussed. How do we deal with the floods threatening those living in the valleys and slopes?

I send them my thoughts and prayers. Like, what can I do other than just try to educate them on the matter?

Re: The coming industrialisation of exploit generation with LLMs

#174

Post by LeakedCanary »

jdefr89 wrote: post #138

Vulnerability Researcher/Reverse Eng here... Aspects about it generating an API for read/write primitives are simply it regurgitating tons of APIs that exist already. Its still cool, but its not like it invented the primitives or any novel technique. Also, this toy JS is similar to binaries you'd find in a CTF. Of course it will be able to solve majority of those. I am curious though.. Latest OpenAI models don't seem…

I had similar questions when reading the original article. I’m also interested in how the agent is constructed. From my experience, it can be very difficult to implement exploits without access to debugging tools, so I’m curious whether pwndbg or similar tools are included in the agent’s toolset and, if so, how they are integrated. Existing open-source GDB MCPs don’t work very well unless further optimized, at least the last time I checked.
Post reply on HN