Bitcoin Red Team and dami ng nakitang vulnerabilities gamit ang AI

[fullfitlarry]

Dahil sa insidente sa Coldcard hack nagkaroon ng volunteer security initiative at ito ay tinawag na Bitcoin Red Team.

Sa ngayon sila ay nakakita na ng:

We scanned 501 projects and produced 7,958 findings, of which 1,280 are rated high or critical (H+C) severity.

https://x.com/callebtc/status/2086220411084103707

Napaka gandang inisyatibo to at mukhang parami ng parami ang ang volunteer around the clock na tingnan lahat ang wallets, infrastructure at libraries. Ang ginamit nila ay Ang Kimi K3,  OpenAI's GPT Sol, Anthropic's Claude Fable at Opus models, at Z.ai's GLM 5.2, upang hanapin ang mga kahinaan at makabuo ng mga sumusuportang dokumentasyon.

[Ziskinberg]

So they are using AI pala. I think that is good since the process can be automated and they can scan more projects faster.

My only concern is, will all those findings really be confirmed exploitable vulnerabilities, or will some of them just turn out to be false alarms? If people only see thousands of reported issues without knowing how many are actually confirmed, it could easily cause unnecessary panic.

For me, the important part is still the verification after the AI finds something.

[SatsPH]

So they are using AI pala. I think that is good since the process can be automated and they can scan more projects faster.

My only concern is, will all those findings really be confirmed exploitable vulnerabilities, or will some of them just turn out to be false alarms? If people only see thousands of reported issues without knowing how many are actually confirmed, it could easily cause unnecessary panic.

For me, the important part is still the verification after the AI finds something.

Bitcoin news reports that security researcher Rob Hamilton of the Bitcoin Red Team had to switch to Chinese open-source AI models after losing access to OpenAI’s Trusted Access for Cyber tools. The team, which has already found nearly 5,000 potential security issues in 29.8 hours, relies on AI to prioritize code reviews. Hamilton claims the restrictions hurt defenders more than attackers. The Coldcard exploit in July, which stole 1,816 BTC, has made security a top priority. Altcoins to watch may also face similar risks if AI tools remain limited.

https://www.kucoin.com/news/flash/bitcoin-security-researchers-turn-to-chinese-ai-after-openai-restrictions

Gumagamit na din sila ng Chinese AI para maghanap ng vulnerabilities. So ang AI talaga sa ngayon at double edge standard. Pwede mong gamitin sa masama katulad sa Coldcard o gamitin sa mabuti katulad ng ginagawa ng Bitcoin Red team.

Sa findings naman sa tingin ko ibibigay nila to sa mga projects na nakitaan nila ng vulnerabilities at sila na ang mag access at syempre kung hindi ito false positive ay dapat nila i-patch na agad.

[julerz12]

~snip~

This is great. Prevention is always better than cure. Mas maigi na ma-audit lahat ng Bitcoin-related projects and platforms para hindi na maulit pa ang mga recent attacks and exploits.
BTW, if anybody here is willing to donate to their cause, you can do it here: https://opensats.org/funds/red

My only concern is, will all those findings really be confirmed exploitable vulnerabilities, or will some of them just turn out to be false alarms? If people only see thousands of reported issues without knowing how many are actually confirmed, it could easily cause unnecessary panic.

Verification is done by the members of that team; yung AI parang force multipliers lang. It helps them rapidly scan files, then when the AI flags something on the code, members of the Bitcoin Red Team verify it. They also check if the findings are false positives or not. From what I've read, they also share their findings with project owners/devs.

[lionheart78]

My only concern is, will all those findings really be confirmed exploitable vulnerabilities, or will some of them just turn out to be false alarms? If people only see thousands of reported issues without knowing how many are actually confirmed, it could easily cause unnecessary panic.

Verification is done by the members of that team; yung AI parang force multipliers lang. It helps them rapidly scan files, then when the AI flags something on the code, members of the Bitcoin Red Team verify it. They also check if the findings are false positives or not. From what I've read, they also share their findings with project owners/devs.

Yeah, I also think na ang Bitcoin Red Team ay gumagamit ang AI to flag possible vulnerabilities then icheck nila by running test kung ang finding ay totoo.  It would be very irresponsible of this team if they fully rely on AI at kapag natag ng  AI ay iannounce na agad without verifying them.

Ang ganda nito, maraming mga projects ang makikinabang sa inisyatibo ng Bitcoin Red Team, dahil maiiiwasan nila ang mga possible exploits dahil nadetect na ito agad bago pa man matuklsan ng mga taong may masamang intention.

[SatsPH]

My only concern is, will all those findings really be confirmed exploitable vulnerabilities, or will some of them just turn out to be false alarms? If people only see thousands of reported issues without knowing how many are actually confirmed, it could easily cause unnecessary panic.

Verification is done by the members of that team; yung AI parang force multipliers lang. It helps them rapidly scan files, then when the AI flags something on the code, members of the Bitcoin Red Team verify it. They also check if the findings are false positives or not. From what I've read, they also share their findings with project owners/devs.

Yeah, I also think na ang Bitcoin Red Team ay gumagamit ang AI to flag possible vulnerabilities then icheck nila by running test kung ang finding ay totoo.  It would be very irresponsible of this team if they fully rely on AI at kapag natag ng  AI ay iannounce na agad without verifying them.

Ang ganda nito, maraming mga projects ang makikinabang sa inisyatibo ng Bitcoin Red Team, dahil maiiiwasan nila ang mga possible exploits dahil nadetect na ito agad bago pa man matuklsan ng mga taong may masamang intention.

Sana nga maging precedent to sa ibang project developers na gumamit ng AI. Kahit nakalabas na ang project nila pwede pa naman silang gumamit nito. Lalo na siguro ang lalabas na mga projects pa. Bago i-released sa public at pwede sila na mismo ang mag run ng independent test.

Meron din naman nag a-audit ng mga projects na 3rd party. Pero mukhang sablay dahil sa daming mga exploits at loopholes na nakikita. Sa isang banda pwede rin magkaroon ng mga kumpanyang ganito ang expertise, ang gumamit ng AI pa arang 3rd party nga na i-hire ng mga project developers.

[abel1337]

-snip

-snip

Yeah, I also think na ang Bitcoin Red Team ay gumagamit ang AI to flag possible vulnerabilities then icheck nila by running test kung ang finding ay totoo.  It would be very irresponsible of this team if they fully rely on AI at kapag natag ng  AI ay iannounce na agad without verifying them.

Ang ganda nito, maraming mga projects ang makikinabang sa inisyatibo ng Bitcoin Red Team, dahil maiiiwasan nila ang mga possible exploits dahil nadetect na ito agad bago pa man matuklsan ng mga taong may masamang intention.

Sana nga maging precedent to sa ibang project developers na gumamit ng AI. Kahit nakalabas na ang project nila pwede pa naman silang gumamit nito. Lalo na siguro ang lalabas na mga projects pa. Bago i-released sa public at pwede sila na mismo ang mag run ng independent test.

Meron din naman nag a-audit ng mga projects na 3rd party. Pero mukhang sablay dahil sa daming mga exploits at loopholes na nakikita. Sa isang banda pwede rin magkaroon ng mga kumpanyang ganito ang expertise, ang gumamit ng AI pa arang 3rd party nga na i-hire ng mga project developers.

I believe na majority ng companies now is adapting to the AI technology. Halos wala na atang tech companies ngayon ang hindi pa gumagamit ng AI eh. Sobrang helpful ng AI to be honest at alam ng tech companies na hindi basta basta mawawala ang AI kaya need nila mag adapt. The common practice ng developers is bago sila mag labas ng projects is dadaan muna ito sa QA at isa sa layer of security nila for their code is hiring audit companies. I doubt na hindi gumagamit ng AI ang auditing companies in todays time. I believe na may mga automation tools sila both developers and auditors at of course may manual checking din sila.