{"id":112715,"date":"2024-01-05T21:10:15","date_gmt":"2024-01-05T19:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/problemy-iz-za-podgotovlennyh-ai-instrumentami-otchyotov-ob-uyazvimostyah"},"modified":"2024-01-05T21:10:15","modified_gmt":"2024-01-05T19:10:15","slug":"problemy-iz-za-podgotovlennyh-ai-instrumentami-otchyotov-ob-uyazvimostyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/problemy-iz-za-podgotovlennyh-ai-instrumentami-otchyotov-ob-uyazvimostyah","title":{"rendered":"Problemas causados por relat\u00f3rios de vulnerabilidades gerados por ferramentas de IA","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Daniel Stenberg, autor da ferramenta para enviar e receber dados pela rede curl, criticou o uso de ferramentas de IA na cria\u00e7\u00e3o de relat\u00f3rios sobre vulnerabilidades. Esses relat\u00f3rios incluem detalhes escritos de forma clara e s\u00e3o visualmente atraentes, mas sem uma an\u00e1lise cuidadosa podem enganar, substituindo problemas reais por conte\u00fado com apar\u00eancia qualitativa que n\u00e3o oferece valor. <\/p>\n

O projeto Curl recompensa a identifica\u00e7\u00e3o de novas vulnerabilidades e j\u00e1 recebeu 415 relat\u00f3rios sobre problemas potenciais, dos quais apenas 64 foram confirmados como vulnerabilidades, e 77 como erros n\u00e3o relacionados \u00e0 seguran\u00e7a. Assim, 66% de todos os relat\u00f3rios n\u00e3o continham informa\u00e7\u00f5es \u00fateis e apenas desperdi\u00e7aram o tempo dos desenvolvedores, que poderia ser utilizado em algo mais produtivo. <\/p>\n

Os desenvolvedores s\u00e3o for\u00e7ados a gastar muito tempo analisando relat\u00f3rios in\u00fateis e revisando as informa\u00e7\u00f5es v\u00e1rias vezes, pois a qualidade externa da formata\u00e7\u00e3o confere uma confian\u00e7a adicional \u00e0 informa\u00e7\u00e3o, criando a impress\u00e3o de que o desenvolvedor n\u00e3o entendeu algo. Por outro lado, a elabora\u00e7\u00e3o desse tipo de relat\u00f3rio exige esfor\u00e7os m\u00ednimos do solicitante, que n\u00e3o se preocupa em verificar a exist\u00eancia de um problema real e simplesmente copia dados gerados por assistentes de IA, esperando ter sorte na busca por recompensas. <\/p>\n

S\u00e3o apresentados dois exemplos desses relat\u00f3rios in\u00fateis. Um dia antes do an\u00fancio planejado sobre uma vulnerabilidade cr\u00edtica de outubro (CVE-2023-38545), um relat\u00f3rio foi enviado pelo Hackerone afirmando que o patch de corre\u00e7\u00e3o havia sido tornado p\u00fablico. De fato, o relat\u00f3rio continha uma mistura, criada pelo assistente de IA Google Bard, de fatos sobre problemas semelhantes e trechos de detalhes sobre vulnerabilidades passadas. Como resultado, a informa\u00e7\u00e3o parecia nova e relevante, mas n\u00e3o tinha liga\u00e7\u00e3o com a realidade. <\/p>\n

O segundo exemplo aborda a mensagem recebida em 28 de dezembro sobre um estouro de buffer no manipulador WebSocket, enviada por um usu\u00e1rio que j\u00e1 havia informado v\u00e1rias vulnerabilidades a projetos diferentes atrav\u00e9s do Hackerone. Como m\u00e9todo de repeti\u00e7\u00e3o do problema, o relat\u00f3rio mencionou termos gerais sobre o envio de uma solicita\u00e7\u00e3o alterada com um tamanho de valor que excede o tamanho do buffer usado durante a c\u00f3pia com strcpy. O relat\u00f3rio tamb\u00e9m apresentou um exemplo de corre\u00e7\u00e3o (substitui\u00e7\u00e3o de strcpy por strncpy) e indicou a linha de c\u00f3digo \"strcpy(keyval, randstr)\", na qual, segundo o requerente, havia um erro. <\/p>\n

O desenvolvedor conferiu tudo tr\u00eas vezes e n\u00e3o encontrou nenhum problema, mas como o relat\u00f3rio foi escrito de forma convincente e at\u00e9 continha uma corre\u00e7\u00e3o, havia a impress\u00e3o de que algo estava sendo ignorado. A tentativa de esclarecer como o pesquisador conseguiu contornar a verifica\u00e7\u00e3o expl\u00edcita de tamanho antes da chamada da fun\u00e7\u00e3o strcpy e como o tamanho do buffer keyval era menor que o tamanho dos dados lidos, levou a explica\u00e7\u00f5es detalhadas, mas sem informa\u00e7\u00f5es adicionais, que apenas discutiam as causas gerais do estouro de buffer, n\u00e3o relacionadas ao c\u00f3digo espec\u00edfico do Curl. As respostas lembravam uma intera\u00e7\u00e3o com um assistente de IA e, ap\u00f3s passar meio dia em tentativas in\u00fateis de descobrir como exatamente o problema se manifestava, o desenvolvedor ficou convencido de que n\u00e3o havia de fato nenhuma vulnerabilidade.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u044d\u043d\u0438\u0435\u043b C\u0442\u0435\u043d\u0431\u0435\u0440\u0433 (Daniel Stenberg), \u0430\u0432\u0442\u043e\u0440 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 curl, \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u043a\u0440\u0438\u0442\u0438\u043a\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f AI-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043e\u0442\u0447\u0451\u0442\u044b \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u043c \u044f\u0437\u044b\u043a\u043e\u043c \u0438 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c\u0438, \u043d\u043e \u0431\u0435\u0437 \u0432\u0434\u0443\u043c\u0447\u0438\u0432\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043d\u0430 \u0434\u0435\u043b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043b\u0438\u0448\u044c \u0432\u0432\u043e\u0434\u0438\u0442\u044c \u0432 \u0437\u0430\u0431\u043b\u0443\u0436\u0434\u0435\u043d\u0438\u0435, \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u044f \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0449\u0438\u043c \u043c\u0443\u0441\u043e\u0440\u043d\u044b\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u044b\u043c. \u041f\u0440\u043e\u0435\u043a\u0442 Curl […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112715","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Problemas devido a relat\u00f3rios sobre vulnerabilidades elaborados por ferramentas de IA | ProHoster","description":"Daniel Stenberg, criador da ferramenta de transfer\u00eancia de dados pela rede curl, criticou o uso de ferramentas de IA na elabora\u00e7\u00e3o de relat\u00f3rios sobre vulnerabilidades.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/problemy-iz-za-podgotovlennyh-ai-instrumentami-otchyotov-ob-uyazvimostyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438\u0437-\u0437\u0430 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 AI-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 | ProHoster","og:description":"\u0414\u044d\u043d\u0438\u0435\u043b C\u0442\u0435\u043d\u0431\u0435\u0440\u0433 (Daniel Stenberg), \u0430\u0432\u0442\u043e\u0440 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 curl, \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u043a\u0440\u0438\u0442\u0438\u043a\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f AI-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/problemy-iz-za-podgotovlennyh-ai-instrumentami-otchyotov-ob-uyazvimostyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-05T19:10:15+00:00","article:modified_time":"2024-01-05T19:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/112715","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=112715"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/112715\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=112715"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=112715"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=112715"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}