Dive Brief:
- AI dramatically sped up the process of finding vulnerabilities in embedded software that is widely used in critical infrastructure, the security firm Forescout said on Thursday.
- A specialized AI harness helped researchers find 99 vulnerabilities in 90 hours, a workload that they estimated would have taken nine months without the new technology, according to Forescout’s report.
- The research is the latest evidence that AI is revolutionizing the process of finding flaws in critical technology — for good and for ill.
Dive Insight:
Forescout researchers turned their AI harness loose on 10 popular TCP/IP stacks, seven from the company’s existing TCP/IP vulnerability research and three new ones. The stacks — most of them open-source — included Contiki, used in low-power internet of things devices such as street lights; Ethernut, used in Ethernet-based smart devices; lwIP, a similar lightweight implementation of the TCP/IP protocol; and wolfIP, used in real-time operating systems in safety-critical devices.
The AI harness, which used Claude models, rediscovered 33 vulnerabilities in the TCP/IP stacks that Forescout had previously tested, as well as 66 new vulnerabilities in both those stacks and the previously untested ones. Roughly half were memory-corruption bugs, 27% involved integer problems, 16% involved input validation failures and 8% were control flow or logic flaws.
“This shows how the harness is good at finding memory safety bugs in protocol parsing code but misses logic and design bugs,” Forescout researchers wrote. They described this finding as unsurprising, given the way they used “static analysis rules focused on generic code patterns” to task the AI harness.
“Memory safety issues are more amenable to these static analysis rules,” researchers said, “while logic bugs are implementation-specific and much harder to capture with a reasonable tradeoff between false positives and false negatives.”
The harness found the logic bugs by accident, according to the report.
Not only did the AI models find bugs much more quickly than a human would, Forescout said, but it did so far more economically. The company estimated that it spent between $1,200 and $2,300 on tokens, which it said was roughly one hundred times less than the salary of a senior vulnerability hunter reviewing code manually.
Forescout reported 54 of the 66 newly discovered vulnerabilities to the maintainers of the relevant products. (It did not report the remainder of the bugs, because it believed they were absent from the latest versions of the affected products.) Twenty-four of those bugs have been fixed, and maintainers are investigating another 29. The last bug involves the Ethernut project, whose developer did not respond to the vulnerability disclosure.
The findings highlight both AI’s power to find flaws and the continuing vulnerability of critical technology, Forescout said. Because the newly discovered bugs are present in software that is popular with IoT and industrial device makers, they could affect “hundreds of products across several industries,” according to the report.
Most worrisome, researchers said, is that many vulnerabilities are popping up in discontinued equipment that remains widespread. The AI harness found seven vulnerabilities in a TCP/IP stack used in an unsupported wireless access point, including hardcoded administrator credentials.
“Unsupported legacy products such as this access point abound,” Forecout warned, “and AI-enhanced research can now quickly and inexpensively uncover dangerous vulnerabilities for which no vendor will be able to provide a patch.”
Forescout also said it was worried about how many vulnerabilities its employees found in projects that they and other experts had already thoroughly reviewed.
“It was quite surprising to find that many foundational vulnerabilities on core networking protocol implementations survived for years in the re-analyzed targets,” the researchers wrote. “They were missed by us, other researchers, and the software vendors themselves.”
