Tenable report shows how generative AI is changing security research 

Right this moment, vulnerability administration supplier Tenable printed a brand new report demonstrating how its analysis staff is experimenting with giant language fashions (LLMs) and generative AI to boost safety analysis. 

The analysis focuses on 4 new instruments designed to assist human researchers streamline reverse engineering, vulnerability evaluation, code debugging and internet software safety, and establish cloud-based misconfigurations.

These instruments, now accessible on GitHub, exhibit that generative AI instruments like ChatGPT have a worthwhile function to play in defensive use instances, notably with regards to analyzing code and translating it into human-readable explanations in order that defenders can higher perceive how the code works and its potential vulnerabilities.

“Tenable has already used LLMs to construct new instruments which can be dashing out processes and serving to us establish vulnerabilities quicker and extra effectively,” the report stated. “Whereas these instruments are removed from changing safety engineers, they will act as a power multiplier and scale back some labor-intensive and sophisticated work when utilized by skilled researchers.”

Automating reverse engineering with G-3PO 

One of many key instruments outlined within the analysis is G-3PO, a translation script for the reverse engineering framework Ghidra. Developed by the NSA, G-3PO is a device that disassembles code and decompiles it into “one thing resembling supply code” within the C programming language. 

Historically, a human analyst would want to investigate this in opposition to the unique meeting itemizing to determine how a bit of code capabilities. G-3PO automates the method by sending Ghidra’s decompiled C code to an LLM (supporting fashions from OpenAI and Anthropic) and requests a proof for what the operate does. Because of this the researcher can perceive the code’s operate with out having to investigate it manually.

Whereas this may save time, in a YouTube video explaining how G-3PO works, Olivia Fraser, Tenable’s zero-day researcher, warns that researchers ought to at all times double-check the output for accuracy. 

“It goes with out saying after all that the output of G-3PO, similar to any automated device, ought to be taken with a grain of salt and within the case of this device, in all probability with a number of tablespoons of salt,” Fraser stated. “Its output ought to after all at all times be checked in opposition to the decompiled code and in opposition to the disassembly, however that is par for the course for the reverse engineer.” 

BurpGPT: The net app safety AI assistant 

One other promising answer is BurpGPT, an extension for software testing software program Burp Suite that permits customers to make use of GPT to investigate HTTP requests and responses. 

BurpGPT intercepts HTTP site visitors and forwards it to the OpenAI API, at which level the site visitors is analyzed to establish dangers and potential fixes. Within the report, Tenable famous that BurpGPT has proved profitable at figuring out cross website scripting (XSS) vulnerabilities and misconfigured HTTP headers. 

This device subsequently demonstrates how LLMs can play a job in decreasing handbook testing for internet software builders, and can be utilized to partially automate the vulnerability discovery course of. 

“EscalateGPT seems to be a really promising device. IAM insurance policies typically symbolize a tangled complicated internet of privilege assignments. Oversights throughout coverage creation and upkeep typically creep in, creating unintentional vulnerabilities that criminals exploit to their benefit. Previous breaches in opposition to cloud-based information and purposes proves this level time and again,” stated Avivah Litan, VP analyst at Gartner in an e mail to VentureBeat.

EscalateGPT: Establish IAM coverage points with AI 

In an try to establish IAM coverage misconfigurations, Tenable’s analysis staff developed EscalateGPT, a Python device designed to establish privilege-escalation alternatives in Amazon Internet Companies IAM. 

Primarily, EscalateGPT collects the IAM insurance policies related to particular person customers or teams and submits them to the OpenAI API to be processed, asking the LLM to establish potential privilege escalation alternatives and mitigations. 

As soon as that is achieved, EscalateGPT shares an output detailing the trail of privilege escalation and the Amazon Useful resource Title (ARN) of the coverage that might be exploited, and recommends mitigation methods to repair the vulnerabilities. 

Extra broadly, this use case illustrates how LLMs like GPT-4 can be utilized to establish misconfigurations in cloud-based environments. As an illustration, the report notes GPT-4 efficiently recognized complicated eventualities of privilege escalation based mostly on non-trivial insurance policies by means of multi-IAM accounts. 

When taken collectively, these use instances spotlight that LLMs and generative AI can act as a power multiplier for safety groups to establish vulnerabilities and course of code, however that their output nonetheless must be checked manually to make sure reliability.