Comment by nonfamous
14 hours ago
From the Twitter advisory on the issue being referenced here [1]:
>>> To every other developer: we believe this is a sober reality of the new AI paradigm. AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry’s most seasoned experts. If your firmware is open-source or has ever been public, assume it's already being read by attackers and defenders alike.
Kinda turns the “many eyes” principle of OSS on its head, eh?
If your source is not open that's barely a speedbump, given a binary. At least that's my impression of the current state.
This flaw would probably be easier to find from the binary: the source itself was misleading, but if you analyized the binary you'd find that there was no access to the hwrng at all (assuming the dead code got eliminated by the compiler) or that the only function that accessed it was never called.
One lesson out of this is that now that AI has made a certain grade of review cheap is that it would be useful to perform security review both against the source code and against the resulting binary.
If the industry most seasoned experts are not using LLMs right now to front-run the discovery of vulnerabilities in the code they are responsible for, they are not experts, but clowns.
A lot of the vulnerabilities being discovered are low hanging fruit. An LLM could discover them, but so could a human.
Let me amend your statement:
If the industry most seasoned experts are not engaging in regular security reviews of their firmware, they are not experts, but clowns.
LLMs are useful for this but not absolutely necessary to address the core issue.