[flagged]
Anonymous GitHub account mass-dropping undisclosed 0-days
21–30 of 407 posts
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#22Most of the exploits are for opensource/free software. I don't know what methods where used to find these exploits but I am starting to think security through obscurity might not be a bad thing in this day and age, where someone can just let bots loose on your codebase.
[dead]
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#23I'm going through each one, and it's fascinating to see things like this. The UAF principle in c-ares is really interesting. The problem ultimately came from not being able to prevent stale pointers. The attack works by figuring out the size of the stale pointer, then spraying memory with data of the same size, and finally achieving RCE (Remote Code Execution). How do people even come up with ideas like this?
le sigh, c-ares. Very predictable outcome. If you ever find yourself entertaining the idea that you will simply write non-blocking network protocol stacks in C with manual lifetime management, slap yourself. It doesn't matter if you think you are a super genius of unimpeachable taste. The job is impossible.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#24Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#25I'm going through each one, and it's fascinating to see things like this. The UAF principle in c-ares is really interesting. The problem ultimately came from not being able to prevent stale pointers. The attack works by figuring out the size of the stale pointer, then spraying memory with data of the same size, and finally achieving RCE (Remote Code Execution). How do people even come up with ideas like this?
But do people actually find these vulnerabilities on their own, or are they using LLMs? I was curious about how these vulnerabilities work, so I tried asking my dear friend Mr. CLAUDE, but he immediately threw an error and ended the session because it was a cybersecurity question. Enterprise APIs block even the analysis itself, so it's amazing that people can actually pull this off in practice.
I imagine this is a large open model like GLM5.2 etc
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#26Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#27we have got to stop putting our bank accounts and SSNs on computers
We need our infrastructure to stop treating bank account numbers and social security numbers as secrets. At least in the US, bank account numbers appear on physical checks and are required to be shared in order to do an ACH transfer, and a social security number is not supposed to be used as an identifier (unless to the Social Security Administration itself) or as a secret password.
Ideally, nothing nefarious should happen if both of them were listed and queryable publicly.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#28A surprising amount of documentation if the actor was just LLM-dropping these..
Why is that surprising? LLMs can churn out arbitrary volumes of "documentation" in an instant.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#29trying something new? this is interesting. the problem is that submitting reports is too slow. if you find one then your not supposed to share. but then over the next 90 days you learn no one cares and 13 other people submitted it before you, 43 after. maybe better that we just know. so we can run code we can trust sooner. zero is the proper number of dependencies. otherwise assume its broken.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#30There is going to be a flurry of this sort of stuff as the AIs get smart enough to find them. It will naturally die down as the legitimate ones are fixed. Yes, there will always be some level of this, but I’d expect it to be low and the exploits found to be increasingly complex. This is a time of transition.