Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft's open source tools were hacked to steal passwords of AI developers

techcrunch.com

Post reply on HN
Print view View original

161–170 of 211 posts

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#161

Post by ashishb »

pritambaral wrote: post #56
ashishb wrote: post #51

Nobody should do 'npm install' or 'pip install' on their machine. Using a proper sandboxing( https://github.com/ashishb/amazing-sandbox ) regularly will drastically limit the blast radius of these attacks.

> https://github.com/ashishb/amazing-sandbox Does your Docker backend run commands in rootless containers? I skimmed the code but didn't see anything to confirm this.

Right now, not. Eventually, they will.

You can pass your favorite rootless Docker image using `--custom-docker-image` CLI parameter.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#162

Post by rswail »

black_knight wrote: post #42
_pdp_ wrote: post #13

What follows next is purely speculation and it is based on my own observations and thoughts but based on what I've seen the old RBAC models, while being almost broken before, now it is fully broken, with the fact that now coding assistants and engineers are working on multiple unrelated projects simultaneously - especially working on wild experiments they had no time for previously. The risk of supply chain issue has…

Do you mean that role based access control (RBAC) should be replaced by something else? Or that just the specific RBAC models in use are broken? I personally think the, perhaps confusingly named, capability based security models are the way of The Future.

ABAC/Capability and very granular policies for both actions and actions on behalf of others with the right sort of resource-based policies as well. And the apps need to be capability constrained and sandboxed.

Gonna be a hard nut to crack to implement this across the supply chain.

Transitive dependencies are a bitch.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#163

Post by yoyohello13 »

rspijker wrote: post #155
yoyohello13 wrote: post #146

I had to reset my personal Microsoft account password yesterday because I got a two factor alert about a log in attempt from Romania. I can’t figure out how they got my password though because the only Microsoft product I own is an Xbox. Even before ai though Microsoft leaks like a sieve. I wish my company would move off them, but we are locked in.

It is almost impossible to set up personal Microsoft accounts that does not allow passwordless login. So what is more likely to have happened is that your account is set up like this and you are just getting MFA requests that are not a second factor, but simply an attempt to get access to your account. I was getting multiple of these a day and found that if you set up the Microsoft Authenticator app from a phone, it…

Thank you! I have a very strong password so I was worried about how this could happen, but your scenario makes sense. Especially since it only seems to be my Microsoft account having this problem.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#164

Post by romaniv »

giancarlostoro wrote: post #159
yifanl wrote: post #157

Earlier quoted context omitted.

AI harnesses were exploited, here's why it's actually good for AI.

Not what I'm saying at all, but okay. More like "don't sleep on cyber security" more than anything. I don't care if you use AI, though it can definitely be useful for security auditing. Red teams are going to become more invaluable these days.

You can post any number of snarky booster comments, but at the end of the day they are the opposite of insightful. They are an obfuscation.

What I'm seeing is that the whole security model built around endless code re-evaluation and continuous (usually online) updates is collapsing in a spectacular fashion. This is not "good for red teams" or "good for security AI". This is not good for anyone except malicious actors.

I rarely do these, but here is my prediction: doing more of the same but faster is not going to work. No matter how much AI compute people will throw at security scans and patching, the number of security incidents and the overall instability will keep going up until the underlying security model is fundamentally changed.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#165

Post by giancarlostoro »

yifanl wrote: post #160
giancarlostoro wrote: post #159

Earlier quoted context omitted.

Not what I'm saying at all, but okay. More like "don't sleep on cyber security" more than anything. I don't care if you use AI, though it can definitely be useful for security auditing. Red teams are going to become more invaluable these days.

You're talking about living in a world where we have to take entirely preventative steps, not reactive because hacking is going to be that much more prevalent. AI can tell you you're being zero-day'd, but that isn't much comfort - you're already expecting everyone to always be zero-day'd at all times!

What I'm suggesting is that AI and security tooling can help you minimize attack vectors.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#166

Post by giancarlostoro »

romaniv wrote: post #164
giancarlostoro wrote: post #159

Earlier quoted context omitted.

Not what I'm saying at all, but okay. More like "don't sleep on cyber security" more than anything. I don't care if you use AI, though it can definitely be useful for security auditing. Red teams are going to become more invaluable these days.

You can post any number of snarky booster comments, but at the end of the day they are the opposite of insightful. They are an obfuscation. What I'm seeing is that the whole security model built around endless code re-evaluation and continuous (usually online) updates is collapsing in a spectacular fashion. This is not "good for red teams" or "good for security AI". This is not good for anyone except malicious actors…

Booster comments? What? Since when is routine security auditing bad? A lot of people sleep on it, and have insanely obvious (in hindsight) security issues that could have been avoided by a simple audit.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#167

Post by skinfaxi »

yoyohello13 wrote: post #146

I had to reset my personal Microsoft account password yesterday because I got a two factor alert about a log in attempt from Romania. I can’t figure out how they got my password though because the only Microsoft product I own is an Xbox. Even before ai though Microsoft leaks like a sieve. I wish my company would move off them, but we are locked in.

In some organizations I've worked at, the multi-factor prompt would occur regardless of the password validity (wastes more of the attacker's time). Is that the case with Microsoft? I'm not sure.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#168

Post by bingo-bongo »

doubled112 wrote: post #141
renegade-otter wrote: post #121

Earlier quoted context omitted.

"MongoDB is the hottest thing! No default creds, who cares about that! ONWARD TO PRODUCTION, SOLDIERS!"

Instead of learning from past mistakes, it seems we need to keep making the same ones over and over.

..and with faster and faster iterations :|

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#169

Post by rcxdude »

wolfi1 wrote: post #58
hsbauauvhabzb wrote: post #49

Earlier quoted context omitted.

But now he needs to develop, test and maintain that code. Left pad is easily hand coded, react framework not so much.

his projects were GUIs for machines (HMI)

Embedded software already has a pretty strong culture of rarely using libraries and vendoring them if they do (for better and for worse). This kind of worm just doesn't really make sense in that kind of environment anyway.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#170

Post by whattheheckheck »

johnisgood wrote: post #133
Grimburger wrote: post #83

Earlier quoted context omitted.

You can vibecode docs and tests also but I'm truly not seeing more of those. In the end it can just be a culture thing. A dev who was going to write docs and tests before is going to have a LLM generate docs and tests today. Same with safe practices and defensive coding. The machine does whatever you want from it, for most that's "just get the job done I don't care". So that's the output.

If I vibe code a project, that involves docs and tests as well. Obviously I do not, at any point, do anything blindly and there are some iterations for everything. I always double-check, and I do not use "agents", I do everything manually. I always check what the LLM is thinking, in real-time. I might be old school, but that allows me to write code that is not a pile of shit. :P I am still conscious about quality.

Anecdotal.

13 million swe roles with .01% is 130,000 compromised devices.

Process problem

Post reply on HN