Comment Curl ism’t myths “target" (Score 1) 54
As I understand it Mythos’ “big leap” is not in finding specific flaws it is in chaining them together into a “bigger” flaw. So finding a minor issue in curl that lets you put a file where you shouldn’t, plus a flaw in something that assumes some file location is “safe” and it doesn’t have to parse things with an advassery in mind, plus a flaw in something that relies on that thing, and so on.
When doing that kind of security work you don’t need to find a bunch of significant flaws in each tool, just a minor flaw in places that turn out to be useful when combined with say up to 9 other minor flaws. So from the viewpoint of cUrl which doesn’t rely on a lot of other tools to provide its services nothing has changed. The pain is experienced on a wider scale like over a whole OS where there are a lot of tools any of which might contribute a minor flaw so Mythos can find way to gain “the prize” (maybe remote execution, or a privilege escalation, or both).
Maybe a better way to think about Mythos is it doesn’t have to hyper focus on one tool like “can I break into the system using cUrl?” (and is not actually any better at that question then prior AI), but it does a far far better job at answering the question “can I break into the system using up to a dozen or so flaws together out of this pool of 1000+ tools?”. I assume it may be a bit better at finding flaws in single tool if the flaws require putting more bugs together or more steps to reach the state where an existing flaw shows up, but again that isn’t the big deal. The big deal is at a system level it puts multiple sub-critical flaws together to combine into a critical flaw. (queue transformers joke here)