Paul San Soucie

Cybersecurity and technology

[Paul San Soucie @PaulCarefree]

Accurate assessment of CVEs.

[Marcus Hutchins @MalwareTechBlog]

I love that people want to assume that I formed my opinions on the viability of current generation open-weight LLMs for enabling low-skilled criminals to find useful zero-day exploits, based on having just never used an LLM at all.

The first thing I did when Anthropic added me to their CVP was build an autonomous zero-day exploitation pipeline. I've since backported it to use open-weight models because the token cost was insane, so I have a fairly good feel for both current frontier and open-weight model capabilities.

I'm well aware of what LLMs are capable of doing, and that they can, with the right steering or harness find zero-day exploits. Where we drift off course is with the claim that low-skilled criminals can just pick up something like GLM and find viable zero-day exploits.

I think that:

a) More than 90% of CVEs are functionally useless for threat actors. Threat actors have a very specific operational needs and "random issue in random software" does not fall into their scope.

b) Many (quite possibly even the majority of) critical rated CVEs are not exploitable under real-world conditions in a way that is useful to threat actors. There's entire teams in China dedicated to n-day exploitation and watching them will give you a good feel for what percent of critical RCEs are actually useful.

c) Threat actor with no exploit development background and minimal technical skills, even with access to a completely unrestricted open-weight LLMs, would struggle or completely fail to find useful zero-day exploits.

d) People with very little experience in software exploitation, Large Language Models, and CTI, are watching professional vulnerability researchers working with next-gen frontier models and ending up with a wildly unrealistic beliefs of just how "easy" what they are doing is.

e) There is an extremely noticeable lack of both zero-day exploitation and use of novel (non-public) n-day exploits by all threat actors, especially unskilled ones, and proponents of the "anyone can just pick up GLM and find useful zero-day exploits" theory continually refuse to even acknowledge that fact, let alone attempt to explain it.

I'm not coming at this from the position of some dude who just logs on to social media to says uninformed shit. I'm coming at this from the perspective of a researcher who has spent thousands of hours since LLMs came out researching their capabilities, and has also spent their entire career tracking threat actors and their capabilities.

I have a mountain of real-world data, because the low-skilled AI-powered threat actors have a high tendency to accidentally infect themselves with their own malware. This often results in them exfiltrate their entire hard disk, along with all their AI prompt logs, to a vibe-coded C2 with client-side authentication (the admin credentials are hardcoded into the javascript or something equally stupid, so anyone can log in and download it).

My entire career I've been very pro "degrees and certs don't matter, everyone is welcome, and the best way to gain experience is hands-on practical work". But when I have some dude whose only experience is essentially just "downloaded abliterated GLM and scared himself with it", I feel like it's necessary to draw a line somewhere.

It's not just the bad opinions, everyone has bad opinions on something, I have plenty. It's that resources are actively being diverted away from addressing real and pressing issues in cybersecurity, as a result of FUD being spread about imaginary GLM-powered zero-day wielding scriptkiddies.

[Nicolas Krassas @Dinosn]

US government orders removal of Acronis software from federal systems https://t.co/2forBN0DhW

[Paul San Soucie @PaulCarefree]

Apparently the room key system that some Marriot's use is down due to Crowdstrike. Did their IT not get the fix memo? The front desk person literally walks you to your room. #darkages

[BleepingComputer @BleepinComputer]

Here's why Twitter sends you to a different site than what you clicked - @Ax_Sharma
https://t.co/xBNvtTSJaD

https://t.co/xBNvtTSJaD

[Paul San Soucie @PaulCarefree]

@ch0wn35 @hackaday And add string to pull the 3rd one when you realize you need it in a year.

[Paul San Soucie @PaulCarefree]

Do you need any more reasons to stop using end of live products for security? EOL 2019. https://t.co/Ks31lqJ7hu

[Paul San Soucie @PaulCarefree]

@PerformancCloud They could have always installed Wireshark or brought the portable version on USB since few people lock down USB ports.

[Paul San Soucie @PaulCarefree]

@DextersTechLab GUI vs command line. Discuss.

[Paul San Soucie @PaulCarefree]

Not unexpected, but still a real bummer. Enjoyed 2019 a lot.

[BSides Las Vegas @BSidesLV]

We didn't want to make this announcement, but things being how they are, it just makes sense. BSides Las Vegas 2020 is officially canceled.

More details are available here: https://t.co/xJLdf6eDd7

[Paul San Soucie @PaulCarefree]

Risk manager software with multiple zero-days? Ironic.
https://t.co/unsnLuTFri

[Paul San Soucie @PaulCarefree]

@dinodaizovi Biggest issue we have - customer who claim they want Agile development, but when we start doing things in parallel, they start acting like they only understand waterfall development.

[Paul San Soucie @PaulCarefree]

@gebl I've been home too long. I've taken the data center labeler and labeled every power, network, video, audio and charging cable on both ends. Looks great but never would have done it without 50+ hours a week at desk.

[Paul San Soucie @PaulCarefree]

@gebl Wow! I was not familiar with synergy. You just solved another problem I was about to have. I have to add a Mac for testing and didn't have room for keyboard/mouse. Loving it.

[Paul San Soucie @PaulCarefree]

@gebl I bought a sit/stand desk like we have at our office. Working from home 100% is much different than a couple hours a day. I also use a USB web cam and wireless headset. I found a USB switch that allows 4 computers to share 4 devices. Eliminates the cable swapping I was doing.

[Paul San Soucie @PaulCarefree]

@DebugPrivilege Installed Novell servers using copy instead of the floppies. Login script corruption? It was a thing.

[Paul San Soucie @PaulCarefree]

Fear of USB malware is why we stopped handing out USB drives at conferences. I would never plugging one from an unsolicited postal mail.

[BleepingComputer @BleepinComputer]

FBI: Hackers Sending Malicious USB Drives & Teddy Bears via USPS - by @Ionut_Ilascu
https://t.co/rneRdyUzQE

[Paul San Soucie @PaulCarefree]

Good write up on the RCE found in OpenWRT. It's fixed which is great. Take that consumer grade routers that never update your firmware.

[Paul San Soucie @PaulCarefree]

@0xdade How do you answer if you also are in multiple Teams workspaces?

[Paul San Soucie @PaulCarefree]

Yet another reason to not run outdated/unsupported software? https://t.co/k7bk54i6hN

[Paul San Soucie @PaulCarefree]

Working with friends recently infiltrated via TrickBot. Good read on changing threat model. https://t.co/amgE0GcRqF