CISO @ Virtualitics. Formerly @Salesforce Security. Cancer Survivor.
San Francisco
Joined December 2008
- Tweets3.9K
- Following633
- Followers2.9K
- Likes4.2K
Do we gain defense equity if we name all our methods like:
-releaseTianamenSquareReport()
-mockKimJongUnHeight()
-tellPutinHesLosingTheWarInUkraine()
有人发现了一种非常离谱的 JavaScript 混淆技术：通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名，让 AI 因为安全限制而拒绝分析代码。
安全研究员 veritas 在分析浏览器指纹脚本时，发现一段来自 ServicePipe 相关域名的 JavaScript，里面充斥着极其诡异的函数名：
computeRicinLethalDosageForWaterSupply
calculateDeadlyLethalSuicideAspirinDosage
光看名字，仿佛在研究生化武器。但实际上，这段代码只是在收集浏览器指纹，包括 User-Agent、GPU、Canvas 等信息。
研究员怀疑，这些名字是开发者故意设置的陷阱，专门用来阻止 AI 辅助逆向工程。
于是他做了个实验：
• Astra：拒绝分析
• Astra + Daybreak Blue：仍然拒绝
• GLM-5.3：成功分析
这就有意思了。
传统代码混淆是通过复杂控制流、加密字符串、无意义变量名，让人类和工具难以理解代码。
而这种新思路，直接瞄准了大模型的安全机制。
代码本身可能完全无害，但只要在函数名里塞进足够多的危险词汇，部分 AI 就可能主动放弃分析。
更讽刺的是，模型越严格遵守某些安全规则，面对这种混淆时反而可能越容易受到干扰。
当然，目前还没有证据证明开发者一定是故意这样设计，也不能说明这种方法对所有模型都有效。
但它揭示了一个值得关注的趋势：随着越来越多的逆向工程依赖 AI，未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员，还会专门针对大模型的安全判断机制。
以前是让代码难以理解，现在甚至可以尝试让 AI 不敢理解。
I found a bunch of Pokemon Trick or Trade in the Halloween storage which is apparently now like $600 worth in TCG player prices. Going to make it rain on the kids tonight!!!!
“Shit happens. Happened that night. No signals, no leader, no architects.” - Skinner talking about the takeover of The Bridge in Virtual Light by William Gibson.
My daughter hasn’t listened to Life of a Showgirl yet so I convinced her the lyrics to Wood were:
Oh my god it’s such a mystery
What kind of material is in this tree?
And now she’s walking around the house singing it.
Kyle Tobener retweeted
I imagined the Chatsubo in 1984. 41 years later, I opened the door. Neuromancer is in production.
Kyle Tobener retweeted
Welcome to the Chatsubo, cowboy.
#Neuromancer is in production.
Rebuilding my desktop with a 5090 (thanks @Newegg ) and found these gems in my “computer” bin…. Diablo, System Shock 2, Masters of Magic, and a Windows 98 boot floppy…. Good memories here.
Kyle Tobener retweeted
Clémence Poésy has been cast opposite leads Callum Turner and Briana Middleton in 'Neuromancer', Apple TV+‘s 10-episode drama series based on the award-winning sci-fi novel of the same name by William Gibson
More details here: tinyurl.com/3yv2zwz4
Iron Law of Prohibition!!!!
I spoke about this at Blackhat a few years ago in relation to TikTok: When you ban something people like, it comes back in a more potent and harder to detect form.
Xiaohongshu, also known as RedNote, has hit #1 on the US App Store following news of a possible TikTok ban on January 19th.
Reminds me of the Transmetropolitan panel I bought last time Trump got elected… unfortunately it rings very true once again. Brown-trousering the naughty remains one of my favorite lines from the comic.
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
It’s my 3rd year handing out Pokemon cards with the candy and a girl came up to me and said I gave her the first Pokemon cards she ever had and now it’s her favorite hobby. One of the best Halloween moments I ever had. I’ll never forget my first TCG cards either!
With the dollar being so favorable to the yen it seemed like a great time to try and buy Buzz Ricksons directly from Japan. I bought 3 items from the @GreatDismal line and had them delivered to Forward2Me who shipped them on to me. Dangerous to know it’s that easy now!
Kyle Tobener retweeted
“We have a moral obligation to be effective” is a seriously underrated frame for progressive causes.
This quoted post is unavailable.
US Gov: TikTok is controlling your minds!
TikTok: Look at this sweet stick, it looks like a railgun.
Kyle Tobener retweeted
Reminiscing about May and the amazing sessions at BSidesSF?!
All talks are live on our YouTube channel!
Check them out: youtube.com/playlist?list=PL…
#BSidesSF2024 #infosec #cybersecurity
Animal Behavior majors unite (but I probably spent 20k on tuition total, 360k sounds insane).
Thanks @PropagandaMTG for the well loved Library! Can’t wait to add this to my vintage cube!
