One wrong word in a sizeof() call can reduce GoAhead's 2048-bit Diffie-Hellman modulus to a single byte. GoAhead is a web server found in IoT devices.
The bug, flagged by Prof. Bill Buchanan, is a typo.
According to Buchanan, with g = 2 the key exchange is left with only 3 bits of entropy. So we can assume that he TLS handshake can still complete, and every functional test can pass.
Human error is one thing. AI makes mistakes too, despite the disclaimer: something people tend to forget.
SecRepoBench (University of Maryland) tested LLMs on real-world C/C++ code without telling them to look for security issues. The best standalone model produced code that was both correct and secure on 39% of tasks.
Columbia's CWEval measured about 30 points between code that passes functional tests and code that passes both functional and security tests.
Ultimately, this is a reminder to stay vigilant and use common sense when writing code, whether we write the code ourselves or rely on an LLM, we still need to stay vigilant and use common sense.
#AISecurity #IoTSecurity #securecoding
Sources:
SecRepoBench https://arxiv.org/abs/2504.21205
CWEval https://arxiv.org/abs/2501.08200
arXiv.orgSecRepoBench: Benchmarking Code Agents for Secure Code Completion in Real-World RepositoriesThis paper introduces SecRepoBench, a benchmark to evaluate code agents on secure code completion in real-world repositories. SecRepoBench has 318 code completion tasks in 27 C/C++ repositories, covering 15 CWEs. We evaluate 29 standalone LLMs and 15 code agents across 3 state-of-the-art agent frameworks using our benchmark. We find that state-of-the-art LLMs struggle with generating correct and s