we have got to stop putting our bank accounts and SSNs on computers
... support cash, tell your neighbors
And Monero for online.
Anonymous GitHub account mass-dropping undisclosed 0-days
31–40 of 407 posts
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#32A surprising amount of documentation if the actor was just LLM-dropping these..
That seems trivial for an llm to provide.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#33A friendly reminder that a 0-day is a vulnerability that wasn't known until after a malicious actor exploited it. If someone publishes a PoC, it is not a 0-day, just a vulnerability.
No, the days start counting from the availability of a patch.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#34I'm going through each one, and it's fascinating to see things like this. The UAF principle in c-ares is really interesting. The problem ultimately came from not being able to prevent stale pointers. The attack works by figuring out the size of the stale pointer, then spraying memory with data of the same size, and finally achieving RCE (Remote Code Execution). How do people even come up with ideas like this?
le sigh, c-ares. Very predictable outcome. If you ever find yourself entertaining the idea that you will simply write non-blocking network protocol stacks in C with manual lifetime management, slap yourself. It doesn't matter if you think you are a super genius of unimpeachable taste. The job is impossible.
Thank goodness I use a GC language
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#35That's one way to do it.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#36Most of the exploits are for opensource/free software. I don't know what methods where used to find these exploits but I am starting to think security through obscurity might not be a bad thing in this day and age, where someone can just let bots loose on your codebase.
Presumably, one could let the bots loose on your own codebase first. The question is one of financing of course. If your end users are enterprises willing to pay for a support contract, they probably care enough about not getting hacked to endure the higher prices that would let you throw enough tokens at the problem. Other open-source projects might have a harder time.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#37Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#38we have got to stop putting our bank accounts and SSNs on computers
We need our infrastructure to stop treating bank account numbers and social security numbers as secrets. At least in the US, bank account numbers appear on physical checks and are required to be shared in order to do an ACH transfer, and a social security number is not supposed to be used as an identifier (unless to the Social Security Administration itself) or as a secret password. Ideally, nothing nefarious should…
It’s quite ridiculous that we haven’t been able to build a modern identification system capable of replacing SSNs in the last 30 years.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#39What if this person is from an AI lab that really wants the govt to keep suppressing Mythos/Fable & GPT5.6? It's what I would do, the timing couldn't be any better.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#400-days-vibes-vulns? There should be a new category, for spotting and handling the em-dashes of this brave new world of vulns and making the old fossils like me only picking my head up for the old painfully still hand-crafted artisanal ones instead. A kind of label, like free-range for eggs, in sum.