Security

Ok fine, where can I get me one of these “security harnesses” you speak of?

Ok, so in a recent post I summarized some reading I had recently done about security harnesses. When I say “security harness” think “thingie which orchestrates many many LLM sessions to turn tokens and environmental stability into zero day vulnerabilities and dopamine”. That is, as Claude Code is to code generation, a security harness is to vulnerability hunting.

The next obvious step is to try one of these things and see if it does what it says it does on the tin. That is, do I get the dopamines? The problem of course is finding one.

A harness is the orchestration layer around an LLM. It controls the inputs, tools, prompts, models, state, validation gates and outputs for each stage of work. — ZephrSec

(more…)

Continue ReadingOk fine, where can I get me one of these “security harnesses” you speak of?

What is a LLM “security harness” and why do people keep talking to me about them?

Increasingly I am being told to “use a security harness” when analyzing code for potential vulnerabilities, but what is a “harness” and how does it differ from just running Claude Code and asking it nicely to find me some sweet vulns?

This post is literally my notes on reading up on this topic via a series of Cloudflare blog posts. That is, this post is a summary and does not intend to provide anything you cannot find anywhere else (with a lot more words used).

(more…)

Continue ReadingWhat is a LLM “security harness” and why do people keep talking to me about them?

I think I just experienced my first hallucinated security vulnerability

Yesterday my time I experienced what I think was my first LLM hallucinating a responsible security disclosure. Honestly it was no curl situation, but I think it was still interesting. The bug is on launchpad.net if you're interested in taking a look. I think in total I spent a couple of hours on the whole thing, with the hardest bit being trying to understand what the author was claiming. Fundamentally they had conflated being able to change the state of memory and other hardware inside their virtual machine with changing the state of those things for the hypervisor. They did not seem to understand that the video memory of the guest was not the video memory of the host for example. That said, I tried to be nice and I hope my replies were perhaps a little useful to them.

Continue ReadingI think I just experienced my first hallucinated security vulnerability

Do you want the apocalypse, because this is how you get it

  • Post author:
  • Post category:Security

So I read this paper over the weekend. Naively, its a resonably interesting piece of research around using a generative AI to use descriptions of CVEs from their responsible disclosures to exploit unpatched systems autonomously. Now read that sentence again -- these people prompted Chat GPT4 with CVES which didn't have fixes yet, and had it hacking unpatched systems with an 85% success rate. We're doomed.

Continue ReadingDo you want the apocalypse, because this is how you get it

The BeyondCorp papers

Google’s BeyondCorp effort would probably be what we would now call Zero Trust, although I am surprised by how little name recognition BeyondCorp has when I talk to security people about Zero Trust. Perhaps there are subtle differences between the two, but if there are they aren’t obvious to me. I find myself reading the relevant Usenix papers for BeyondCorp, so I figure I’ll post a summary of what I got from each paper here.

The earliest of these papers are quite old now (2014), especially for something the rest of the industry is only starting to talk a lot about at the moment. I wonder if there is a viable business model in watching what papers megacorps like Google publish, and the implementing them as commercialized products before the rest of the market catches on?

Either way, here’s a summary of the various papers from the perspective of an interested bystander…

(more…)

Continue ReadingThe BeyondCorp papers

Cisco CyberOps Associate: Official Cert Guide

I don't think I've really reviewed a technical book here before, but I read the thing so I guess I should. This book is the certification guide for a "Cisco CyberOps Associate" certification, which is what they now call the CCNA Security qualification. Its a relatively junior certification, qualifying you to be a level one operator in a Security Operations Centre (SOC). I read this book because I took a Cisco NetAcad course for the associated certification in the second half of 2022 (although it has continued to be a thing I plug away at in 2023). That was mainly motivated by a desire to more about a field that is clearly important, but hasn't been core to my personal career. This book is reasonably well written and readable -- I'd read a chapter in the evening after work and its wasn't a huge chore to churn though. I certainly learned things along the way, even if the certification seems to suffer from a desire to have everyone rote learn a lot of acronyms, which seems like a common ailment in the industry (AWS Certified Cloud Practitioner, I'm looking at you). My main critism is of the qualification itself, which…

Continue ReadingCisco CyberOps Associate: Official Cert Guide

Learning from the mistakes that even big projects make

The following is a blog post version of a talk presented at pyconau 2018. Slides for the presentation can be found here (as Microsoft powerpoint, or as PDF), and a video of the talk (thanks NextDayVideo!) is below:

 

OpenStack is an orchestration system for setting up virtual machines and associated other virtual resources such as networks and storage on clusters of computers. At a high level, OpenStack is just configuring existing facilities of the host operating system — there isn’t really a lot of difference between OpenStack and a room full of system admins frantically resolving tickets requesting virtual machines be setup. The only real difference is scale and predictability.

To do its job, OpenStack needs to be able to manipulate parts of the operating system which are normally reserved for administrative users. This talk is the story of how OpenStack has done that thing over time, what we learnt along the way, and what I’d do differently if I had my time again. Lots of systems need to do these things, so even if you never use OpenStack hopefully there are things to be learnt here.

(more…)

Continue ReadingLearning from the mistakes that even big projects make

End of content

No more pages to load