Slashdot Mirror
Can The Mayhem AI Automate Bug-Patching? (technologyreview.com)
"Now when a machine is compromised it takes days or weeks for someone to notice and then days or weeks -- or never -- until a patch is put out," says Carnegie Mellon professor David Brumley. "Imagine a world where the first time a hacker exploits a vulnerability he can only exploit one machine and then it's patched." An anonymous reader quotes MIT Technology Review:
Last summer the Pentagon staged a contest in Las Vegas in which high-powered computers spent 12 hours trying to hack one another in pursuit of a $2 million purse. Now Mayhem, the software that won, is beginning to put its hacking skills to work in the real world... Teams entered software that had to patch and protect a collection of server software, while also identifying and exploiting vulnerabilities in the programs under the stewardship of its competitors... ForAllSecure, cofounded by Carnegie Mellon professor David Brumley and two of his PhD students, has started adapting Mayhem to be able to automatically find and patch flaws in certain kinds of commercial software, including that of Internet devices such as routers.
Tests are underway with undisclosed partners, including an Internet device manufacturer, to see if Mayhem can help companies identify and fix vulnerabilities in their products more quickly and comprehensively. The focus is on addressing the challenge of companies needing to devote considerable resources to supporting years of past products with security updates... Last year, Brumley published results from feeding almost 2,000 router firmware images through some of the techniques that powered Mayhem. Over 40%, representing 89 different products, had at least one vulnerability. The software found 14 previously undiscovered vulnerabilities affecting 69 different software builds. ForAllSecure is also working with the Department of Defense on ideas for how to put Mayhem to real world use finding and fixing vulnerabilities.
Tests are underway with undisclosed partners, including an Internet device manufacturer, to see if Mayhem can help companies identify and fix vulnerabilities in their products more quickly and comprehensively. The focus is on addressing the challenge of companies needing to devote considerable resources to supporting years of past products with security updates... Last year, Brumley published results from feeding almost 2,000 router firmware images through some of the techniques that powered Mayhem. Over 40%, representing 89 different products, had at least one vulnerability. The software found 14 previously undiscovered vulnerabilities affecting 69 different software builds. ForAllSecure is also working with the Department of Defense on ideas for how to put Mayhem to real world use finding and fixing vulnerabilities.
Source: Betteridge
No robots ain't patching my servers, not nohow, no siree!
Sent from my ASR33 using ASCII
Lol @ calling this, or anything, "AI"
Y2K in interpreted scripts.
Otherwise, no.
1. Mayhem should be open-source.
2. Keep the FBI and the NSA's sticky little fingers out of the code.
So, we've decided to manually build the Borg, is that it? What about when the software decides that being able to be shut down is a bug, and auto patches that, then decides we're bugs too...
Are we creating Skynet, or the Borg, or some evil lovechild of the pair of them?
Because they make the kinds of mistakes I can also fix without any creative thinking
What an opportunity for a DOS attack. Just penetrate the system and launch a patch that bricks some high percentage of the Net.
"real world use finding and exploiting vulnerabilities"
It's called an Intrusion Prevention System (or intrusion detection system) (IPS, IDS). Basically once the behavior or signature of an attack is known the IPS will block it. Any at least partially functioning IT department deploys an IPS to help protect the company. The drawback is it needs to scan all data traveling through the network. There are subscriptions lists for new attacks just like ad-blockers have subscription lists.
As for as automatic patching, forget it. Software is no where near advanced enough to handle that yet. You need provable software for this and provable software is insanely expensive and time consuming to build. No company is going to provide support for their software when some other software starts changing its binaries (and with security whitelists the software will be blocked from running as the security software will think it was modified by a virus). It would only take one mistake for the automatic patcher to completely destroy all your data. Oh, that looks like a bug in the data saving routine, fixed it! And bam, you can no longer load any of the backups you're saving and no one will notice until the site goes down and you need those backups. Then try to find the source of the corruption.
It may create a new life form. And possibily human extinction as a minor side effect!
"...2,000 router firmware images..."
"over 40%, representing 89 different products, had at least one vulnerability."
"The software found 14 previously undiscovered vulnerabilities affecting 69 different software builds."
Ok... So they fed a bunch of firmware in, some of the images being old with known vulnerabilities. That is how they get 40% of 2000 makes 89 products. Doing the math, it means they have 222-223 actual products. They found new 14 vulnerabilities across 69 builds. We will assume that these are vulnerabilities to current firmware that may impact older versions of firmware, also. All 14 may be in one product, or they could be distributed. This means defect rates by product in the range of 0.45% and 6.29%. It is not clear how many false positives this found. In my experience this software often has a massive number of potential issues to dissect, of which only a few are significant.