[deleted]
Anonymous GitHub account mass-dropping undisclosed 0-days
61–70 of 407 posts
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#62I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1... The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise. The second, idk, I'm not familiar with TraceRMI (but it's probably worth noting that "RMI"…
> Yes, if you overwrite binaries executed by ghidra, you can trigger code execution.
> but it's probably worth noting that "RMI" stands for Remote Method Invocation
This reminds me of someone submitting a (clearly vibecoded) vulnerability report claiming to have found a way to execute arbitrary SQL. The project in question? An SQL server... https://github.com/tursodatabase/turso/pull/4322
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#63Earlier quoted context omitted.
Repo claims > A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. Please do not abuse these. I do this so to allure people into the field, and I've always found this is the most efficient way. Which is roughly the definition of zero day. Whether the contents of…
> Please do not abuse these. Reminds me of Jamie Wolf's joke about bestiality laws. Who are those for? What stops most people from bestiality is… not wanting to have sex with animals! For people who do want to, what, they won't because of… the law?? Who will this comment stop??
The laws are to punish the act once discovered. Not to inhibit it, primarily. Which I suppose cuts down on the incidence of the act in the long run,
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#64I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1... The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise. The second, idk, I'm not familiar with TraceRMI (but it's probably worth noting that "RMI"…
The bigger takeaway is someone that smart is pissed off and dropping their shit with zero warning... but hey, that's just like, my opinion man.
You don't need to be pissed off to decide that immediate public disclosure is the best option.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#65There is going to be a flurry of this sort of stuff as the AIs get smart enough to find them. It will naturally die down as the legitimate ones are fixed. Yes, there will always be some level of this, but I’d expect it to be low and the exploits found to be increasingly complex. This is a time of transition.
> It will naturally die down as the legitimate ones are fixed. Seems like we're already in the middle of this phase, but rather than dying down, the 'reports' have just gotten more noisy and obtuse, making it more difficult to establish the actual degree of threat / attack vector.
And if you are a state agency who'd like to keep the undisclosed zero-days you rely on secret, spamming maintainers with reports makes sense.
As a bonus if you find any actual zero-days in your mass-generated ones you don't report it and get a new one to play with.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#66Earlier quoted context omitted.
Repo claims > A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. Please do not abuse these. I do this so to allure people into the field, and I've always found this is the most efficient way. Which is roughly the definition of zero day. Whether the contents of…
> Please do not abuse these. Reminds me of Jamie Wolf's joke about bestiality laws. Who are those for? What stops most people from bestiality is… not wanting to have sex with animals! For people who do want to, what, they won't because of… the law?? Who will this comment stop??
Either the fear of the consequences of breaking the law, or that the most effective way to reduce crime is to remove criminals from the population so over time these people being in jail or worse decreases the crime rate. They don't have to care about breaking laws in the abstract for the law, properly enforced, to reduce crime.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#67Earlier quoted context omitted.
Repo claims > A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. Please do not abuse these. I do this so to allure people into the field, and I've always found this is the most efficient way. Which is roughly the definition of zero day. Whether the contents of…
> Please do not abuse these. Reminds me of Jamie Wolf's joke about bestiality laws. Who are those for? What stops most people from bestiality is… not wanting to have sex with animals! For people who do want to, what, they won't because of… the law?? Who will this comment stop??
Those seem like two different scenarios though, right?
The point of beastiality laws are to give society some recourse to punish people who abuse animals.
There was a very famous case back in Washington state back in the early 2000s where a group of men were sexually abusing horses. It was uncovered because one of them died, and the other could only be charged with trespassing because it wasn't illegal at the time to sexually abuse animals.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#68There is going to be a flurry of this sort of stuff as the AIs get smart enough to find them. It will naturally die down as the legitimate ones are fixed. Yes, there will always be some level of this, but I’d expect it to be low and the exploits found to be increasingly complex. This is a time of transition.
> a flurry of this sort of stuff as the AIs get smart enough to find them. I really think this characterization is misleading. It's not "getting smart", only more tailored toward a specific usage, better curated dataset, better harness, better prompts, better labeling of results, documentation of failures and success, etc. The outcome is (hopefully) overall better but this anthropomorphized wording makes it sound lik…
Yes, of course. I’m definitely anthropomorphizing as a shorthand. I’m the first one to say that these models are just a lot of matrix math.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#69Most of the exploits are for opensource/free software. I don't know what methods where used to find these exploits but I am starting to think security through obscurity might not be a bad thing in this day and age, where someone can just let bots loose on your codebase.
> I don't know what methods where used to find these exploits but I am starting to think security through obscurity might not be a bad thing in this day and age, where someone can just let bots loose on your codebase. I'd love to hear why you think obscurity is bad, if you now think maybe it's good in the LLM age? I'd also be interested if you could describe exactly what or how you think security through obscurity wo…
"one ought to design systems under the assumption that the enemy will immediately gain full familiarity with them" - Claude Shannon
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#70> At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. I do this so to allure people into the field, and I've always found this is the most efficient way. I've been a skiddy, he would have believed this. Thankfully, I've grown a bit, and can see this for the transparent, "I'm angry and want to hurt others so I will feel a little less alon…
While i can follow your path, maybe because i see the same, i sadly have seen in groups of friends how this can go sideways very fast. If you report things, some companies gone treat you as a criminal/offensive actor and even go legal actions against you even you just tellem here you got this vuln.
Sure you than can do it anonymous and so on but point is : its not like every actor that gets notified will react thankful to it. Some even just ignore it.