Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anonymous GitHub account mass-dropping undisclosed 0-days

github.com

Post reply on HN
Print view View original

11–20 of 407 posts

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#11

Post by gpm »

spongebobstoes wrote: post #7
serf wrote: post #4

Earlier quoted context omitted.

llms are fantastic disassembly partners, they're quite good at labeling functions from various dissassemblers -- the net losses from losing the benefits of open source , imo , outweigh the protection afforded by hiding your source code in yet another layer that is more and more easily unrolled through automated procedures.

disassembly only applies to client side software something like nginx could arguably be more secure if it was closed source (I am a proponent of and contributor to open source)

Only until a single server running nginx is hacked and the binary leaked though...

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#13

Post by tempest_ »

Tiberium wrote: post #5

Are they all actually 0-day? I think a lot of them are from disclosed CVEs/code that were already fixed upstream. It often seems like the term "0-day" has lost most of its meaning today and people often use it to refer to any exploits.

Repo claims

> A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. Please do not abuse these. I do this so to allure people into the field, and I've always found this is the most efficient way.

Which is roughly the definition of zero day. Whether the contents of the repo reflect the above claim is something else entirely.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#14

Post by jdw64 »

jdw64 wrote: post #6

I'm going through each one, and it's fascinating to see things like this. The UAF principle in c-ares is really interesting. The problem ultimately came from not being able to prevent stale pointers. The attack works by figuring out the size of the stale pointer, then spraying memory with data of the same size, and finally achieving RCE (Remote Code Execution). How do people even come up with ideas like this?

But do people actually find these vulnerabilities on their own, or are they using LLMs? I was curious about how these vulnerabilities work, so I tried asking my dear friend Mr. CLAUDE, but he immediately threw an error and ended the session because it was a cybersecurity question. Enterprise APIs block even the analysis itself, so it's amazing that people can actually pull this off in practice.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#16

Post by Hizonner »

spongebobstoes wrote: post #7
serf wrote: post #4

Earlier quoted context omitted.

llms are fantastic disassembly partners, they're quite good at labeling functions from various dissassemblers -- the net losses from losing the benefits of open source , imo , outweigh the protection afforded by hiding your source code in yet another layer that is more and more easily unrolled through automated procedures.

disassembly only applies to client side software something like nginx could arguably be more secure if it was closed source (I am a proponent of and contributor to open source)

Um, the nginx binary would have to be in the hands of hundreds of thousands of server operators. And the set of server operators is rich in the kind of person who would attack it. Not to mention the huge number of leaks you'd get.

Maybe if it's some server-side software that you only use yourself...

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#17

Post by Retr0id »

I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1...

The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise.

The second, idk, I'm not familiar with TraceRMI (but it's probably worth noting that "RMI" stands for Remote Method Invocation).

The third is not a vulnerability in the slightest, they just demonstrate that native 7zip parsing code is reachable. Maybe there is a bug in the 7zip parser, but without that it's meaningless.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#18

Post by yjftsjthsd-h »

merelydev wrote: post #10
blensor wrote: post #9

Earlier quoted context omitted.

And isn't it also mostly a transitioning issue. Those open codebases will be constantly scanned for potential security issues and getting more and more hardened. There are probably a lot of easy wins that are going to be discovered over the next few years but it should taper out after a while.

Fair point but it assumes we all have access to LLMs with the same capabilities.

I don't think that's exactly it. OSS only needs someone to have a strong LLM to check for bugs. If your software is proprietary, it's a competition between just you and whatever model you have vs any attacker and whatever model they can lay hand to.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#20

Post by maxloh »

merelydev wrote: post #3

Most of the exploits are for opensource/free software. I don't know what methods where used to find these exploits but I am starting to think security through obscurity might not be a bad thing in this day and age, where someone can just let bots loose on your codebase.

Open source is a good thing, but I don't think what you are proposing is accurate.

A different way to frame this would be that those bugs would never be surfaced or exploited if the software were proprietary.

Post reply on HN