greg

CEO of Secfault Security, looks like a cliché hacker according to @halvarflake

@[email protected]

[Secfault Security GmbH @secfaultsec]

The other day, our colleague Oliver decided to play around with Syzkaller to fuzz the FreeBSD Kernel. He added some support for the Bluetooth stack and indeed found an OOB read. If you're interested, check our blog post here: https://t.co/spfvizWozJ

[greg @teh_gerg]

@ju916 @41414141 @halvarflake But I now see what you mean. You want to be able to study the emergent properties of LLMs (or similar systems). I initially assumed you were interested in lower-level aspects of such systems.

[greg @teh_gerg]

@ju916 @41414141 @halvarflake It can be used to describe some aspects of emergent phenomena - and I suspect there's similar approaches for understanding LLMs. Which also show some emergent phenomena, that we'd like to get better handle on.

[greg @teh_gerg]

@ju916 @41414141 @halvarflake I do like your QM vs. weather example btw. I could now say that while QM will not help you as much here, studying the Navier-Stokes equation _will_ (I believe; not an expert on weather either). I'd argue in the same direction when it comes to machine learning.

[greg @teh_gerg]

@ju916 @41414141 @halvarflake That could be true, but I'm not in the position to argue from a neuroscience perspective; my view is heavily influenced by maths etc., so it might be natural for me to argue from that angle.

[greg @teh_gerg]

@ju916 @41414141 @halvarflake I don't know any neuroscience, so that's not something I can comment on. I guess it depends on your perspective: I see LLMs as an implementation relying on maths and ML theory. Might be that I'm just lacking the neuroscience perspective.

[greg @teh_gerg]

@ju916 @41414141 @halvarflake I know what you mean, but my point of view here is a bit different. Our current lack of debugging/inspection capabilities does not mean that we don't understand the magic on a low level. I'd say that when it comes to debugging/inspection, we're currently facing scale issues.

[greg @teh_gerg]

@ju916 @41414141 @halvarflake If you look at an LLM, then I'd say low-level is rather something like the maths behind it (some linear algebra for instance, and the whole theory behind ML). If you look at a compiler, some automata theory will also help.

[greg @teh_gerg]

@ju916 @41414141 @halvarflake Knowing details about low-level things is imho always helpful. However, the definition of "low-level" depends on the tech you're looking at. If you look at an OS then I'd say low-level points towards stuff like assembly.

[Secfault Security GmbH @secfaultsec]

We recently did some internal research and took a look at the JavaScript runtime Deno. We found a couple of interesting bypasses for their permission system. If you'd like to learn more, please feel free to check out our blogpost at https://t.co/worNH0qJ4G.

[Secfault Security GmbH @secfaultsec]

We've taken (another) look at the OpenOlat learning management solution and found an XXE issue, which can be turned into an arbitrary file read and an SSRF problem. In case you're interested, make sure to read our blog post at https://t.co/iJmS8VPtR3!

[BSides Cape Town @BSidesCapeTown]

Forging Chains: The Java Blacksmith by Fabian Yamaguchi & David Baker Effendi https://t.co/SslEOXuAIy

[WHIRLYLABS @whirlylabs]

We presented the first iteration of our work on mining Java deserialization gadgets at BSides Cape Town. This includes exploit chains against ZK framework and Groovy. Slides are available at https://t.co/oByzSODkWn - recording will follow.

[Fabian Yamaguchi @fabsx00]

Here are the slides of this morning's talk "Everything is (still) broken - looking back at 20 years of hacking." https://t.co/srsUCHcb44 - don't take it too serious, I know I don't.

[greg @teh_gerg]

@G33KatWork

[Secfault Security GmbH @secfaultsec]

We recently decided to take a look at LibreOffice, and found an (almost) arbitrary file write issue, which is now public (CVE-2023-1183). If you're interested, check out https://t.co/aRQta0XrHM for details :)

[Secfault Security GmbH @secfaultsec]

Last year we did a number of projects for AgileBits, focusing on the 1Password ecosystem. The reports have now been made public, so in case you're interested to get an impression feel free to check https://t.co/rbWpdIWUuX.

[Jenny @OldM4nHunting]

Checkout my write-up (with @secfaultsec) on an object deserialization flaw in the Visual Studio App Center SDK for iOS and macOS. I hope you enjoy joining me on this journey.

https://t.co/Fcq6FFr0jY

[Secfault Security GmbH @secfaultsec]

Recently, @OldM4nHunting took a look at the Visual Studio App Center SDK for iOS and macOS and found an insecure object deserialization issue. Here's a write-up on her journey of identifying and exploiting the issue: https://t.co/EE6kReELPP.