Cybersecurity professional with an interest/background in networking. Beginning to delve into binary exploitation and reverse engineering.

  • 0 Posts
  • 20 Comments
Joined 2 years ago
cake
Cake day: March 27th, 2024

help-circle

  • If you’re submitting a vulnerability to a public repo, that’s also your job. These slop reports that are wasting maintainers time should never have been reported. The person tasking the LLM is out of their depth and can’t be the human in the loop that verifies the vulnerability report before submitting because they don’t have the required knowledge to do that. It’s a shame, because if people who had the requisite knowledge were the ones submitting, the ratio of valid reports to noise would be way higher than 5% and open source maintainers wouldn’t be feeling burned the fuck out.


  • I’ve been fucking around with using Claude to solve CTF challenges. I’m using a harness built out of a custom agent I wrote that progressively loads specific a specific skill for the challenge category, cryptography, binary exploitation, reverse engineering, forensics, etc.

    It’s solving the simple shit in <1m using sonnet. It’s solved some shit that I couldn’t figure out at all during the CTF in the time limit we had in ~20 minutes. There’s been 2 challenges that after about 25 minutes I’ll kill the agent working on it, change to opus, then opus solved them in about 20m. One crypto challenge was so math heavy i never would have figured it out. One bin exp challenge didn’t provide a local binary, everything was remote. There was a catch that I never would have solved bc it was remote only and I couldn’t locally debug it.

    It’s fucking scary good at solving these things. I just prompt with “use <agent> to solve ./category/challenge/“ and it fully just does everything. It’s definitely akin a fuzzer that can be used for way more than just finding crashes and memory leaks. It takes some work and understanding to make it context/token efficient I think, but it lowers the bar so tremendously that I definitely see why there’s concern here. And again it’s solving most of these things with sonnet, not even opus and definitely not fable.

    All told, this feels like the same panic that happened when metasploit first got released/demo’d at defcon back in the day.







  • WhatsApp’s code is not public. The app generates the private keys. The app has to have access to the private keys to decrypt your messages. Because the code is not public, no one has any idea if meta has ad hoc on demand access to the private key, or if they upload the private key to their servers.

    If WhatsApp was open-source like signal, we wouldn’t be having this conversation. Until then, and based on metas know business practices, it’s safe to assume they have access to WhatsApp private keys.











  • You’re misunderstanding what end-to-end encryption is. If they have a copy of your private key, it’s still end to end encrypted. The alternative would be akin to a TLS termination proxy, where your device would encrypt a message using Facebooks public key, they decrypt message, store it, and then Facebook uses your chat partners public key to encrypt and send to them. You cannot send an encrypted message straight through to your chat partner.

    What I’m insinuating is that there’s no way to know if Facebook has a copy of your private key. The message is still end-to-end encrypted, it is encrypted by you using your chat partners public key, and passes through all of Facebooks infrastructure encrypted, until your chat partner receives and decrypts it. If Facebook stores the message, it’s stored encrypted. They can just decrypt it when subpoenaed or whenever they want bc they have the required private key.