Boffins Build Automated Android Bug Hunting System 15
Researchers from Nanjing University and the University of Sydney developed an AI-powered bug-hunting agent that mimics human vulnerability discovery, validating flaws with proof-of-concept exploits. The Register reports: Ziyue Wang (Nanjing) and Liyi Zhou (Sydney) have expanded upon prior work dubbed A1, an AI agent that can develop exploits for cryptocurrency smart contracts, with A2, an AI agent capable of vulnerability discovery and validation in Android apps. They describe A2 in a preprint paper titled "Agentic Discovery and Validation of Android App Vulnerabilities."
The authors claim that the A2 system achieves 78.3 percent coverage on the Ghera benchmark, surpassing static analyzers like APKHunt (30.0 percent). And they say that, when they used A2 on 169 production APKs, they found "104 true-positive zero-day vulnerabilities," 57 of which were self-validated via automatically generated proof-of-concept (PoC) exploits. One of these included a medium-severity flaw in an Android app with over 10 million installs.
The authors claim that the A2 system achieves 78.3 percent coverage on the Ghera benchmark, surpassing static analyzers like APKHunt (30.0 percent). And they say that, when they used A2 on 169 production APKs, they found "104 true-positive zero-day vulnerabilities," 57 of which were self-validated via automatically generated proof-of-concept (PoC) exploits. One of these included a medium-severity flaw in an Android app with over 10 million installs.
Re: (Score:2)
Re: (Score:3)
It's what people in England call a scientist.
Only those of us who are over 80 and a few others who write for newspapers.
Re: (Score:2)
wtf is a boffin?
It's a small baked bun, typically dusted with sugar or similar, that you have with a cup of tea. In the US it'd probably be called a muffin even though it isn't really.
You're welcome.
just one? (Score:1)
>>One of these included a medium-severity flaw in an Android app with over 10 million installs.
You are kidding me. Just one?
Re:What makes them Boffins? (Score:4, Informative)
Re: (Score:3)
Hmmm, here in Australia 'boffin' is more or less a term of endearment.
A bunch of clever folks doing intellectual things, for which journalists with no technical background assume is magic.
Even in an ironic sense here "Researchers found 100 vulnerabilities in common Android apps. Those Boffins, how dare they? They could be doing something useful with their time like building AI-powered nukular rockets for Dr Evil."
Re: (Score:2)
Re: (Score:3)
Re: (Score:3)
LOL definitely had this reaction. Saw boffins in title thought "ah probably a Register article" (not that they're the only ones to use it, but if it's an IT related article... then it's a good bet)
Used for Curl (Score:4, Interesting)
25 bug reports submitted. https://gist.github.com/bagder... [github.com]
These include gems like:
* Vulnerability code changes are disclosed on the Internet
* Buffer overflow in Strcpy (which didn't get reproduced)
* Vulnerabilities that exist, but the code identified as the cause didn't appear in the codebase
* Local file accessed using file://
* And the latest: Cookies leaking from 127.0.0.1 to 127.000.000.001 [hackerone.com]
Re: (Score:2)