Security through obscurity is dead, and AI delivered the fatal blow

odyssey7

An interesting consequence is that cybersecurity researchers and hackers are now AI researchers. The prominent game right now is about the classes of attacks that AI can recognize both to exploit and to remedy. Implicitly, that creates a new highly valuable class of vulnerabilities: the ones that AI for whatever reason is unable to readily see. Understanding those two groups will be paramount and will lead to better AI.

qarl

Speaking of obscured code: I'm using AI to decompile old arcade games. I am finding the craziest anti-tampering stuff. Three different routines - each watches the code of the others - and if anything changes - tank the machine by jumping into graphics RAM. When I first started seeing this stuff I assumed my decompiler was broken. Nope. Just insane code.

pixel_popping

It's not "dead", what kind of crappy binary take is this. It absolutely still work to an extent where making an attacker lose time does slow down attacks, thus increasing security. You can absolutely make an agent lose its mind thus making it spend more tokens, to an extent where it might not be viable, but in all case, slowing down or making something more expensive is a direct way to increase security, so wasting either token or human time both is useful. SBO+Real security > Security.

tow21

Totally disagree tbh. Obscurity is about the only form of security worth the name these days. Don't run on open source software - doesn't matter how obscure it is, the LLMs will know about it. Don't run on software that other people use - if there is more than one copy of the software accessible, it'll be broken elsewhere and you'll be a victim of drive-by hacking. Do - run your own software, written by you, which nobody else uses, that is closed source and completely undocumented. Then you might have some chance of avoiding being hacked.