D-Squared
D-Squared
  • 120
  • 116 293
Auto patching vulnerabilities with generative AI
A future where software heals itself isn’t too far off. We’re taking baby steps today with products that are auto-patching vulnerabilities.
We’ll explore this today. I will explain how engineers and researchers use LLMs to auto-patch vulnerabilities.
Check out the blog below for all the resources.
www.dylandavis.net/2024/11/self-healing-code/
00:00 - Intro
00:42 - 6 sources of inspiration
2:50 - Common process for auto patching
6:50 - High-level LLMPatch process
10:11 - LLMPatch graphs
12:35 - LLM finding root cause
13:15 - Comparing root causes
14:42 - Patch Creation
16:04 - Patch validation
16:51 - Main takeaways
18:48 - Outro
Music by www.bensound.com
License code: UCHO4QVCXL54CQVX
Переглядів: 175

Відео

Lessons from a year of building with LLMs
Переглядів 1,6 тис.3 місяці тому
I read 42 pages of content, so you don’t have to. :) Six practitioners who have been working with LLMs for a year published a three-part blog series covering the tactical, operational, and strategic lessons they’ve learned. It's one of the most practical blogs I’ve seen for those looking to work seriously with LLMs. I’ve created a visual TLDR for this series, highlighting the most interesting i...
AI will drive future operating systems
Переглядів 1 тис.11 місяців тому
In today's video, we delve into three key topics from a blog about AI-driven operating systems: switching to voice and gesture controls, the role of generative AI in redefining device operations, and the crucial aspect of security in this advanced tech landscape. Subscribe to newsletter - embeds.beehiiv.com/025f95aa-709c-46bc-88f7-1550d56f0714 Listen to blog posts on... Spotify - open.spotify.c...
Why Banning ChatGPT is Ridiculous
Переглядів 2,2 тис.11 місяців тому
I’m back! 😀 Today I wanted to highlight a perspective that seems to be overlooked when debating the risk associated with employees possibly leaking data to an LLM such as ChatGPT, Bard, etc. Subscribe to the newsletter for more frequent updates - dylandavis.us13.list-manage.com/track/click?u=bd71cd49b30f5c2da7de758fa&id=1eea621aa7&e=f635f6ec5f Checkout the blog here - www.dylandavis.net/2023/11...
How to Never Run Out of Business Ideas Again!
Переглядів 480Рік тому
Struggling to brainstorm business ideas? Join me as we tackle this common problem with a secret weapon - Sahil Lavingia's idea generation framework! 🚀 In this video, I’ll guide you from community-focused ideation to rapid execution. Plus, I’ll share tips on riding trends, choosing between ideas, and a handy idea checklist. Remember, the only bad idea is not watching this video! 😉🎥 Here’s the bl...
Boosting Cloud Native Security With eBPF
Переглядів 350Рік тому
As more organizations transition toward cloud-native infrastructure, it's important they adopt cloud-native tooling and practices. Today grokking a new technology called “eBPF”, which had rapid adoption in the previous 3 years thanks to the Linux kernel community and big tech companies jumping on board early. If you’re interested in crypto or cloud-native security you should subscribe to my wee...
Common Zero-Knowledge Proof Vulnerabilities
Переглядів 1,8 тис.Рік тому
Today on our zero-knowledge-proof learning journey we’re focusing on common vulnerabilities found in ZK programs. Big shout out to Kyle and Gubsheep for pulling this resource together. If you’re interested in crypto security you should subscribe to my weekly newsletter here - eepurl.com/gLhH9r If you’re interested in more content, check out my UA-cam channel or website below. Website - dylandav...
ZK Vulnerability - Zcash Hash Collision
Переглядів 735Рік тому
Today on our zero-knowledge-proof learning journey we’re focusing on a ZK hash collision that led to a double-spending vulnerability impacting Zcash (2016) If you’re interested in crypto security you should subscribe to my weekly newsletter here - eepurl.com/gLhH9r If you’re interested in more content, check out my UA-cam channel or website below. Website - dylandavis.net Resources linked withi...
ZK Vulnerability - Frozen Heart
Переглядів 1,3 тис.Рік тому
Today on our zero-knowledge-proof learning journey we’re focusing on a ZK vulnerability called “Frozen Heart”, which was discovered by Trail of Bits. If you’re interested in crypto security you should subscribe to my weekly newsletter here - eepurl.com/gLhH9r If you’re interested in more content, check out my UA-cam channel or website below. Website - dylandavis.net Resources linked within shar...
Introduction to Zero-Knowledge Proofs
Переглядів 3,3 тис.Рік тому
This is my zero-knowledge proof learning journey from n00b to slightly above average. :) In this series, we’re going to take baby steps toward tackling a series of security and non-security-related concepts within the realm of zero-knowledge proofs. If you’re interested in crypto security you should subscribe to my weekly newsletter here - Here’s the associated blog post for this video - www.dy...
The ideal smart contract audit report
Переглядів 1,9 тис.2 роки тому
The line between good and great smart contract auditing firms is clear. A good auditing firm can find issues, a great auditing firm can communicate those issues in a simple way. Over the last two-weeks I decided to read 11 audit reports from 4 prominent smart contract auditing firms to uncover common security flaws and the logic auditors use to reach their conclusions. Here’s a blog about my id...
Ethernaut CTF - DoubleEntryPoint (Level 26)
Переглядів 1,6 тис.2 роки тому
Next up! Level 26 - DoubleEntryPoint In this CTF series, we’re going to learn more about the practical side of smart contract auditing and security. If you’re interested in more/similar content, checkout my channel or website below. My digital dumping ground - dylandavis.net Additional Resources Ethernaut CTF - ethernaut.openzeppelin.com/ Dalton Sweeney - daltyboy11.github.io/every-ethernaut-ch...
Ethernaut CTF - Motorbike (Level 25)
Переглядів 1 тис.2 роки тому
Next up! Level 25 - Motorbike In this CTF series, we’re going to learn more about the practical side of smart contract auditing and security. If you’re interested in more/similar content, checkout my channel or website below. My digital dumping ground - dylandavis.net Additional Resources Ethernaut CTF - ethernaut.openzeppelin.com/ Digibard - ua-cam.com/video/WdiCzB3zjy0/v-deo.html Naveen Sahu ...
Ethernaut CTF - Puzzle Wallet (Level 24)
Переглядів 1,5 тис.2 роки тому
Ethernaut CTF - Puzzle Wallet (Level 24)
Ethernaut CTF - Dex Two (Level 23)
Переглядів 9312 роки тому
Ethernaut CTF - Dex Two (Level 23)
Ethernaut CTF - Dex (Level 22)
Переглядів 1,4 тис.2 роки тому
Ethernaut CTF - Dex (Level 22)
Ethernaut CTF - Shop (Level 21)
Переглядів 8792 роки тому
Ethernaut CTF - Shop (Level 21)
Ethernaut CTF - Denial (Level 20)
Переглядів 8272 роки тому
Ethernaut CTF - Denial (Level 20)
Ethernaut CTF - Alien Codex (Level 19)
Переглядів 1,6 тис.2 роки тому
Ethernaut CTF - Alien Codex (Level 19)
Ethernaut CTF - Magic Number (Level 18)
Переглядів 1,7 тис.2 роки тому
Ethernaut CTF - Magic Number (Level 18)
Ethernaut CTF - Recovery (Level 17)
Переглядів 8022 роки тому
Ethernaut CTF - Recovery (Level 17)
Ethernaut CTF - Preservation (Level 16)
Переглядів 9082 роки тому
Ethernaut CTF - Preservation (Level 16)
Ethernaut CTF - Naught Coin (Level 15)
Переглядів 8512 роки тому
Ethernaut CTF - Naught Coin (Level 15)
Ethernaut CTF - Gatekeeper 2 (Level 14)
Переглядів 7042 роки тому
Ethernaut CTF - Gatekeeper 2 (Level 14)
Ethernaut CTF - Gatekeeper 1 (Level 13)
Переглядів 2,7 тис.2 роки тому
Ethernaut CTF - Gatekeeper 1 (Level 13)
Ethernaut CTF - Privacy (Level 12)
Переглядів 9632 роки тому
Ethernaut CTF - Privacy (Level 12)
Ethernaut CTF - Elevator (Level 11)
Переглядів 1,2 тис.2 роки тому
Ethernaut CTF - Elevator (Level 11)
Ethernaut CTF - Re-entrancy (Level 10)
Переглядів 1,8 тис.2 роки тому
Ethernaut CTF - Re-entrancy (Level 10)
Ethernaut CTF - King (Level 9)
Переглядів 1,4 тис.2 роки тому
Ethernaut CTF - King (Level 9)
Ethernaut CTF - Vault (Level 8)
Переглядів 1 тис.2 роки тому
Ethernaut CTF - Vault (Level 8)

КОМЕНТАРІ

  • @dhaneshpk5637
    @dhaneshpk5637 4 дні тому

    very nice Explanation

  • @hexxt_
    @hexxt_ 14 днів тому

    my ass

  • @fursan7525
    @fursan7525 15 днів тому

    Welcome back! We've missed you and your super content. It’s not about the quantity but the quality, and you always deliver TOP info. Weiter so ;-)

    • @d-squared70
      @d-squared70 14 днів тому

      Appreciate the kind words! 🤗

  • @FathimaMifrah-b9v
    @FathimaMifrah-b9v 19 днів тому

    thanks for the effort you put into this..

  • @phoenixsp7
    @phoenixsp7 26 днів тому

    one of the best and most explained tutorials! Youre the best! I understood everything clearly

  • @nobody-u-know
    @nobody-u-know 29 днів тому

    What are the implications for hardware? Put into a personal computer context, it seems we will be using local hardware, but mostly cloud compute. Because an orchestrator llm could break up any task into steps, or threads, they could easily use different hardware. Creating a PC with 12 low end cpus and shared Ram could work very well. The os AI would manage the threads. Different specialist ais could run different cpus.

    • @d-squared70
      @d-squared70 17 днів тому

      This is a really interesting train of thought. I could see a world where local compute is less of a concern, especially with Apple investing so much into more efficient models and beefier phones

  • @yazashimi3962
    @yazashimi3962 2 місяці тому

    why is the bash in leviathan 3 automatically in the hammoud solution?

  • @corytreverson9860
    @corytreverson9860 2 місяці тому

    I really like the way you explain every detail, maybe I am not that moron afterall, i managed to get to natas6 with you and it was fun 😎 Thanx

  • @bryanbischof4351
    @bryanbischof4351 2 місяці тому

    This is cool; nice job. Btw for shadowing it doesn’t need to be on test. You can run both on prod and just log the shadow

    • @d-squared70
      @d-squared70 2 місяці тому

      @@bryanbischof4351 thank you for the additional insight

  • @security_threat
    @security_threat 2 місяці тому

    Really helpful!

  • @jxnlco
    @jxnlco 2 місяці тому

    Thanks for making this!

  • @hamelhusain7140
    @hamelhusain7140 2 місяці тому

    Wow! Thanks for making this

    • @d-squared70
      @d-squared70 2 місяці тому

      The thanks goes to you and the others who built this content. :)

  • @charles_irl
    @charles_irl 2 місяці тому

    Thanks for making this video!

    • @d-squared70
      @d-squared70 2 місяці тому

      And thank you for creating such kick-ass content for the community

  • @jpatt0n
    @jpatt0n 3 місяці тому

    Finally got around to watching! This was super helpful and I appreciate you taking the time to break down these topics. I took notes and sent them to my work slack.

    • @d-squared70
      @d-squared70 3 місяці тому

      Appreciate the feedback, amigo! And I miss you! 🤣

    • @jpatt0n
      @jpatt0n 3 місяці тому

      @@d-squared70 miss you and the whole nomad community too. I’m in a techno wasteland right now

  • @itwing9312
    @itwing9312 3 місяці тому

    Impressive article and presentation thanks for sharing such a valuable knowledge

    • @d-squared70
      @d-squared70 3 місяці тому

      Appreciate the kind words

  • @evmlionel
    @evmlionel 3 місяці тому

    Hey, welcome back! Love you content!

  • @c123ian
    @c123ian 3 місяці тому

    Really useful video thanks for the summary, I've also given your video some explicit feedback 👍

  • @0xSmarter
    @0xSmarter 3 місяці тому

    Good video . More video on this topic

  • @patrickchan2503
    @patrickchan2503 4 місяці тому

    Curious to know what your background, if you are happy to share? As you are not a web developer but you have knowledge of Burpsuite and software, I take it. My background is software and I know some web stuff...

  • @patrickchan2503
    @patrickchan2503 4 місяці тому

    the fact that you are learning and succeeding and all this is recorded in this video is inspiration to all of us. Thanks.

  • @patrickchan2503
    @patrickchan2503 4 місяці тому

    thanks! congrats, subscribed + liked!

  • @hantony5361
    @hantony5361 4 місяці тому

    Very much appreciate your sharing. I found this share when questioning how to read audit reports, especially many audit reports. It gave me a huge guide.

  • @jeremiahabiola994
    @jeremiahabiola994 4 місяці тому

    Is there a way we can get your notes

  • @jeremiahabiola994
    @jeremiahabiola994 5 місяців тому

    Nice man. Im currently watching your videos on the ethernaut challenges.

  • @atikuuthman742
    @atikuuthman742 5 місяців тому

    Please are your notes public?

  • @PhantomHorrors
    @PhantomHorrors 5 місяців тому

    I love this series. Thank you for letting us learn from your experience and research. One thing I wanted to add for others. On level 9, instead of using ";cat ../../../etc/natas_webpass/natas10" you can instead just "cat" out the contents of the password file by using: ";cat /etc/natas_webpass/natas10" "/etc/natas_webpass/natas"X"" is the file location for all of the passwords for Natas. But understanding the concept he used in this video is certainly useful for scenarios where the file you are looking for isn't a given.

  • @jackgikandi5875
    @jackgikandi5875 7 місяців тому

    Awesome methodology and thought process into this..

  • @Ldotzkid
    @Ldotzkid 7 місяців тому

    Thank you for the video.

  • @eskapel8803
    @eskapel8803 7 місяців тому

    Thanks for the detailed explanation. The rest of Leviathans were a breeze (partly because I learned a lot from this one)

  • @jackgikandi5875
    @jackgikandi5875 7 місяців тому

    Apparently you still needed to import the Force.sol contract file and still create an instance of the Force contract at the same time, otherwise remix would have thrown a compiler error, atleast thats what it did when I tried to avoid them... All in all, appreciate it for the awesome content. You make it so seamless solving these challenges...

  • @Sn00piZz
    @Sn00piZz 8 місяців тому

    as all the serie, this video is a 10 ! thanks for your work and all the questions you're answering in 25 minutes. If i may, at the very end, you say that you become the owner of the contract "Delegate", are you sure about this ? You used the function pwn() in the context of Delegation, so you should become the owner of Delegation, not Delegate right ?

    • @jackgikandi5875
      @jackgikandi5875 7 місяців тому

      Remember, the Delegation contract delegates all incoming function calls to the Delegate contract using delegatecall, effectively allowing the Delegate contract's functionality to be executed within the context of the Delegation contract. The function pwn() is within the context of the Delegate contract, right? And this function allows anyone to change the owner of the same Delegate contract to the caller of the function as described in the line ( owner = msg.sender). Therefore, by sending the txn using the function signature (pwned_attck) feed to the msg.data data field within the delegatecall, we transfer ownership of the Delegate contract to ourselves, not the Delegation contract. Thats why. Hope that helps...

  • @Sn00piZz
    @Sn00piZz 8 місяців тому

    love when you say "that was probably not the greatest explanation", bro that was I-M-M-A-C-U-L-A-T-E

  • @jackgikandi5875
    @jackgikandi5875 8 місяців тому

    Its also good to mention that the latest solidity pragma versions 0.8.0 and greater now have an in- built underflow/ overflow checker that mitigates this types of vulnerabilities. So basically once it comes across an underflow or overflow vulnerability, it fails to execute the txn, unless you decide to disable the checker by using the 'unchecked' keyword, but why would you disable it right...

  • @Web3cryptohack
    @Web3cryptohack 10 місяців тому

    Hi, how are you doing in the audit? Have you completely disappeared?

  • @PRABHAVTOMAR-b9s
    @PRABHAVTOMAR-b9s 10 місяців тому

    Amazing content broo || Love from India

  • @internetceo
    @internetceo 11 місяців тому

    Thanks for your sum up (:

  • @SCHaworth
    @SCHaworth 11 місяців тому

    I think if we start designing OS's for AI, then it could complicate training data. I think if we design programs for humans, and then give AI the ability to use that, then it will be more stable. Ive been working on a cross system AI assistant out of GPT-4 for a few months now. Ive got it to where its an effective universal voice assistant of sorts. ive even added GPT vision, however It cant locate points, so clicking aint an issue.

  • @henrytirla
    @henrytirla 11 місяців тому

    I solved it without remix watching your previous video it was dead obvious what the solution should be

  • @sweetjimmy
    @sweetjimmy 11 місяців тому

    sounds too good to be true

  • @Boo-wd1ov
    @Boo-wd1ov 11 місяців тому

  • @d-squared70
    @d-squared70 11 місяців тому

    Recent developements from Deepmind in relation to LLMs memorizaing and regurgitating training data - not-just-memorization.github.io/extracting-training-data-from-chatgpt.html The risk still seems overblown, especially if coroporates are preventing their employees from using this tools. 🤔

  • @Flat0Line1
    @Flat0Line1 11 місяців тому

    But risk of leakage not in LLM itself, but in service - which saving your queries, responses, metadata of dialogues etc. You can provide some nda-info, which will be stored - that you can see it in chat with bot, and that's just simple db which stores your queries and responses. And it can be a risk with inside job in company which provide you these services

  • @cmfjr0
    @cmfjr0 11 місяців тому

    thank you for taking the time to put this together. it's clear that the productivity gains from using LLMs can be significant, but doesn't that value hinge on the dataset it references? i think organizations make LLMs most valuable by putting their data into the database it defers to. do you agree? this unfortunately increases the likelihood of the real risk you highlight.

    • @d-squared70
      @d-squared70 11 місяців тому

      Indeed it does increase the risk, but there are tactics one can take to reduce that risk. Maybe a future video on RAG defenses. 😄

  • @danielmarco7863
    @danielmarco7863 11 місяців тому

    The loom filler word filter is so distracting

  • @MichaelHoughton_
    @MichaelHoughton_ 11 місяців тому

    This is a very good video. Thanks 🙏🏻

  • @kitersrefuge7353
    @kitersrefuge7353 11 місяців тому

    Very good. I learned about the existence of Vector Db's. w.r.t security, there should be a chatGPT paid option where a client certificate is required for the interaction to be further secured. I would have thought that any FinTech would have already thought about this, in order to leverage the productivity but to ensure next level security.

  • @Michael-pw6qk
    @Michael-pw6qk 11 місяців тому

    Tell that to the various Board of Directors. They're the technophobes not the rank and file programmers.

  • @samuelmcmurray3502
    @samuelmcmurray3502 11 місяців тому

    cache... they have your conversations bro

  • @ichseseien5194
    @ichseseien5194 11 місяців тому

    Why would it be ok to give openai my secrets in the first place?

    • @d-squared70
      @d-squared70 11 місяців тому

      It wouldn't, but accidents happen. Especially, when you're securing large corporations with lots of employees. 😉

  • @almightyzentaco
    @almightyzentaco 11 місяців тому

    I don't believe any chat data is used to train the model. There should be zero connection to the next model of GPT and the data inputs from any chats. The real danger is someone intercepting packets between the opening server and your enterprise servers if you are sharing sensitive information.

    • @d-squared70
      @d-squared70 11 місяців тому

      This interesting prespective. You seem pretty confident here. Can you share some supporting details as to why there's no connection between user input and training data for future models?

    • @samgoodwin89
      @samgoodwin89 11 місяців тому

      ⁠@@d-squared70that’s a nice way of saying this person is totally wrong. lol which they are. They do train on chat data and have admitted it. They don’t train on the api calls or ChatGPT enterprise, but they do use ordinary logs to distill gpt4 turbo from gpt4. Companies that are worried should buy GPT enterprise. Simple. Worrying about packets being intercepted is ridiculous. That’s true of any network request. HTTPS solves this.