Schneier on Security

Clive Robinson • July 28, 2025 10:09 AM

@ Bruce,

With regards,

“It’s an absolute mess”

You don’t make it clear if you mean this particular Microsoft Product, or Microsoft’s software production in general…

Recent attacks have happened on a severity of 9 or greater due to a myriad of failures in the way Microsoft design, prototype, produce, and support software.

In one case Microsoft trying to fix one fault, showed crackers –we presume from reverse engineering the Microsoft issued patch– how to find and exploit similar flaws in around a day…

The fact these attacks are being found, exploits created and put into action in such a short period of time seriously suggests that Microsoft and similar need to review the way they go about things.

Further, even though Current AI LLM and ML systems are fairly bad with software, they are compared to humans incredibly fast.

It is the nature of attack progress and software development that the direction is forward. Thus we can only expect Current AI performance with analysing and developing software to “improve”.

Thus it may not be long before “patch to fielded attack” is measured in minutes not hours.

Clive Robinson • July 28, 2025 3:21 PM

@ Stephen, ALL,

With regards,

“If the time it takes to reverse-engineer an exploit from the patched binaries beats the time to test and deploy the patch into production, you’re screwed to the severity of the patched vulnerabilities.”

It’s actually “worse than that”.

When an exploit is discovered, it is always,

“An instance in a class of attacks”

This is due to the notion of “code reuse” in it’s various forms and especially in common functions like “serialisation”.

That is the class of attackable vulnerabilities is almost always bigger than just a single instance, and the number of instances will almost certainly grow with time and ongoing development.

Thus if it’s the first instance discovered in a new class there are almost certainly a significant number of instances of other attackable vulnerabilities in the class not just,

1, in the current code,
2, but in future code to come.

But also classes tend not to exist in isolation they tend to be grouped with related classes. Thus are in effect sub classes of a larger more general class.

So finding just one “new instance” means you have to fix not just,

1, that vulnerability,
2, but others in it’s class,
3, and related classes.

Which is apparently not what Microsoft did in rushing a patch out of the door they only fixed “the vulnerability”.

The allegadly Chinese attackers then reverse engineered the patch and found other vulnerabilities in the class or a closely related class.

My point about Current AI LLM and ML systems is that whilst they may not be of much use for many things, they are very good “adaptive filters” thus finding related instances and related classes of attack is something they are almost ideally suited for.

Whilst US AI firms are “going big” with “general models” that are “jack of all trades masters of none” the Chinese are going as far as we can see for smaller more specific models that are in effect “advanced tailored / expert systems” that are “masters of the trade / knowledge domain”.

Such systems are good not just at reverse engineering by pattern matching, but finding relating patterns of various relatedness.

As you note,

“If the time it takes to reverse-engineer an exploit from the patched binaries beats the time to test and deploy the patch into production, you’re screwed”

For all the instances in the class of vulnerability and all related classes.

But… Not just in that one application, in all the related applications where,

1, The code is reused (class)
2, The development methodology is the same (related classes).

Hence my question to our host @Bruce of,

“You don’t make it clear if you mean this particular Microsoft Product, or Microsoft’s software production in general…”

That is if he ment just the application or all of Microsoft’s applications.

Microsoft’s past history suggests it’s likely to be the latter.

And if it is the Chinese and they start using AI to reverse engineer patches etc then the customers of Microsoft but large software houses in general are without doubt are,

“Going to live in interesting times.”

Clive Robinson • July 31, 2025 6:37 AM

Part 2,

of “Microsoft Foundation Class”(MFC) for Windows were well aware of this issue and the various reasons Microsoft were doing it. However one was said to be to force external app developers down a “slow path” so Microsoft internally developed Apps used a different “short path” so always looked faster in comparison. Which spawned a number of projects to find the hidden API’s (and yes some were found).

Any way using DLLs is always a compromise and almost always has three issues,

1, Kitchen sink mentality
2, Jack of all trades issues
3, Overly complex interface

Throwing every thing in “including the kitchen sink” is never a good idea as you end up with a very high “junk to use” ratio.

Making it a “one ring” for a myriad of different users using different programming languages and methodologies to be a “jack of all trades”… Makes the DLL not just “not a master of none” but have a massive degree of needless complexity that never gets properly tested.

In that needless complexity hides many vulnerabilities. Worse because the DLL is “universal” all applications have the same vulnerable code “reusable”.

Clive Robinson • July 31, 2025 6:41 AM

Part 4,

It’s well known in the Industry that “Indian coders cost 10% of US coders” and there are many agencies making a very great deal on exploiting this.

Whilst the US DoD “want security” Congress “will not pay for it”.

History shows this over and over.

So it’s all very well for Pete Hegseth to spout that,

“his agency would look into Microsoft’s use of foreign-based engineers to help maintain the highly sensitive cloud systems”

As his “deflection”…

But history shows as soon as the blame is passed it will be back to normal pork/grease/lobbying that makes the critters on the hill fat.

As you know the “Deflection Game” is a variation on the “hot potato game” so Microsoft are in turn “deflecting” and so on untill somebody far down the line well away from the real crooks gets burned unless they drop it.

And as we all know very soon the eyes of the MSM and Trade Press will turn else where and the “gravey train” will pick up speed again.

Clive Robinson • July 31, 2025 6:44 AM

Part 6,

Are the Silicon Valley Mega Corps going to stop doing things “on the cheap”? Of course not, not as long as the “American Dream” is taught to toddlers.

Bug bounties and Hackathons are here to stay because they save the Mega Corps millions if not billions in costs they should otherwise have to pay…

[1] There was a joke doing the rounds about the F35 and it’s significant problems. China had a “look alike” that was actually flying and landing. The joke was that the US DoD should have outsourced the F35 to China to save time and costs… Looks like the joke had real teeth…

Clive Robinson • August 1, 2025 6:26 AM

@ ResearcherZero, ALL,

With regards,

“I’d give a capable team a day to produce a working concept.”

The key word there is “capable”, and like “common sense” it is a rare commodity thus very limited resource.

Which means that even a Level III (State / major Corp) entity will be constrained by the resource limitation.

Now we know that due to the nature of “code reuse” in various forms, vulnerabilities will have numerous instances in the class, and most likely several associated classes.

The thing about Current AI LLM and ML systems is that they do semi-stochastic pattern matching. That is they will see the vulnerability shape even if fine detail varies.

Thus how fast would an appropriately trained LLM network to find the many variants from the single instance?

And how long after that to cobble together PoC code for all of them?

Because that is the direction I see things going in in the next few years.

Oh and because the ML input will be specific rather than general, the size of LLM network does not have to be large.

I suspect it a useful version will fit on a laptop or small cluster.

As we’ve seen the Chinese are already significantly researching and are it appears well ahead on the design and implementation of these smaller LLMs.

How long do you reckon it will take a year maybe two?