Is this the new cyber normal?

roenxi

> Is this the new cyber normal? No. We're in a "brief" [0] transition period where a scaleable superhuman developer enters the scene and discovers a whole heap of bugs. Once the majority of code is written by similar systems then the tide of critical bugs being found will slow down. The article does sorta say this but lets not bury the lede to deeply. It isn't realistic to expect new security vulnerabilities to be found at this rate, we're clearing out years of backlog and the maintainers haven't had time to deploy AI to do the software right the first time. Once the situation stabilises I'd personally expect very few public vulnerabilities because the expertise in how to assess code security is moving from a handful of experts to everyone. > The NHS approach: close source everything. Yeah good luck. I've seen how these systems work at decompiling and I expect they're probably going to be really good at fuzzing too. [0] Could take a while.

thomascgalvin

Everything I've read indicates that yes, this is the new normal. When Mythos was first announced, pretty much every security expert I talk to freaked directly out. A significant portion of my job now revolves around mitigating the impact of AI-generated exploits. The rate at which we're churning out AI-generated code is going to make this worse, too, because AI-generated code is kind of notoriously terrible at security.

dotdi

> already being exploited in the wild [0] The article cites this commercial blog patting themselves on the back how they detect the exploit, yet after reading it I don't see any actual exploiting? Is scanning/probing the same as active exploitation all of a sudden? [0]: https://ellio.tech/en/blog/php2shell-what-we-observed-and-wh...

TutleCpt

These are all human-generated software bugs. At some point when AI writes all code, the bugs should all but disappear. Almost.

u8

This is the new playing field, but this game can't last forever. Most software is not churning through a software factory of endless patches and releases. Most software, once mature, is mostly done. I see a world in which we all get some generous Dependabot 2.0 on large forges because leaving so much software insecure otherwise is untenable, but once the software is not iterating a billion times a week, you're not introducing new classes of bugs just sitting there. You can have a frontier security model pentesting your program every night while you sleep and you can wake up knowing that whatever happens, you did the best you could.

efilife

By generating the entire website in AI, yes, you are contributing to the new normal

leftouterjoins

It’s mostly hype. Days in now and nobody can exploit the PHP vuln. Yawn.

sigmar

I'm not in a position to know. But Jason Clinton seemed to approximate "18 months" as an upper bound for the crisis period: >as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.) https://x.com/JasonDClinton/status/2113325263157395456

helterskelter2

I can't help but wonder if we're going to see the OS and browser maintainers begin streamlining code and reducing complexity. Software these days almost seems like a fractal of insecurity, the only way to make the problem more tractable is to reduce attack surface.

dreamcompiler

LLMs seem to be very good at detecting vulnerabilities caused by using C and other forms of human stupidity. So yes.

yomismoaqui

Am I the only one that hates seeing "cyber" when refering to cybersecurity? The same with "crypto" to refer to cryptocoins instead of cryptography.

aeon_ai

> At the time of writing (23rd Oct), eMudhra has announced that it will be retiring from the certificate authority space. In unrelated news, a farmer has announced that he has shut his stable door, following reports of an escaped horse. Ah, wit is alive and strong!

mattbrewsbytes

People running old versions and not applying patches rigorously is also normal. Its been normal for decades, nobody likes doing maintenance so it gets forgotten or ignored.

swiftcoder

> Who knew a regex engine was such a security issue Anyone who has ever implemented a regex engine, I would imagine. Regex has always been a security nightmare, especially due to persistent attempts to use regexes to validate untrusted input

DrBazza

For now yes. When LLMs can iterate and test at speeds humans cannot, it is going to continue to find holes. An interesting side effect will be whether we accelerate moving towards memory safe languages (and development of more of those languages) in more sectors than just 'low-level'. Not forgetting that this is only one mitigation of cyber-attacks and exploits and potentially removes a whole category of attacks developed by analyzing *source code*

bcvvvy

Not for me. I’m taking my shit offline. Out of harms way.

csande17

Is this the new normal, or just, uh, normal? Big embarrassing network-exploitable bugs in major open-source projects happen sometimes, and network-scanning attack botnets have been around forever. Small shady CAs mess things up sometimes. People upload malware to PyPI and NPM all the time, and "move fast and break things" software-deployment startups get breached all the time, to the point where it doesn't even really feel like news to me when those things happen again. It's unfortunate that a few of those events all happened at around the same time. But, like, even if that's not a coincidence and these events are actually happening more frequently, you should have been preparing for them anyway!

jmyeet

I'm a bit of an AI doomer but I'm going to disagree. I don't think this is the new mormal but there is going to be a dark transitional period. What we're seeing is a bit of a "gold rush" where LLm advancements are coming thick and fast and they're being pointed out code bases that simply haven't had the level of scrutiny where relatively easy bugs to find have managed to survive. That's temporary. Here are my predictions: 1. Correctness and, in particular, memory safety is going to become increasingly important. I was bullish on Rust before this AI hype wave. LLMs finding and exploiting bugs has reinforced just important it is that Rust prevents as certain class of bugs that are the most prone to rmote exploitation ie certain memory safety issues. I've long said that modern CPU architectures, out-of-order execution, hyperthreading (does that still exist? or did Intel fully kill it?), different CPU cores and compiler optimizations that it is essentially impossible for a human to write correct multithreaded code, particularly in userspace with "leaf node" code. LLMs just make that more apparent; and 2. Mature code bases for core functionality are going to become increasingly important because they've been "proven" in the wild (as much as you can prove a negative). My sincerest hope, which is probably more wishful thinking than anything else, is that LLMs will be another nail in the coffin for C++, which is simply too complex and dragged down with legacy features and backwards compatibility to be salvageable.

DCKing

It really depends on your gut feeling about how deep the rabbit holes in terms of number of game changer vulnerabilities. How many RCEs are in PHP of this kind? Many people would've said zero before. After the fixes, it may be zero again. It could be thousands, it could be eighty-six, it could be four, it could be zero. But even if you don't think it's zero again, most people will find themselves that there's probably not many left. Extend this to other world ecosystem - how many high impact devastating security bugs are there? Dozens, hundreds, thousands, millions? At least when it comes to open source security, there has to be some low upper bound given how countable the number of projects there are where impact could be high and most have taken some care for their quality (despite obvious hardships). And while closed source software is harder to reason about (also on the ecosystem level), if there's a low upper bound for open source software surely the bound for closed source software can't be many orders of magnitude higher. We now have new tools that allows us to discover these. Both the discovery as well as changes in the development process most are taken should bring these numbers closer to zero again. The main question is - are we working through a small backlog of issues, or a very deep one with no practical end? I'm still inclined to believe it's a manageable backlog, but I'm an optimist and everybody's intuitions differ on this.

adverbly

I can tell you, if it is, I'm going to be radically changing the software architectures and patterns that I am recommending to people. Data privacy and security must not be sacrificed. A shift is needed towards simplification and minimization of attack surfaces. I've entirely removed several dependencies which provide some pretty nice features, but unfortunately make things almost unmaintainable. I want to go much further though to simplify architectures themselves even if it makes far worse ux.