Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anonymous GitHub account mass-dropping undisclosed 0-days

github.com

Post reply on HN
Print view View original

81–90 of 407 posts

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#81

Post by GTP »

yjftsjthsd-h wrote: post #18
merelydev wrote: post #10

Earlier quoted context omitted.

Fair point but it assumes we all have access to LLMs with the same capabilities.

I don't think that's exactly it. OSS only needs someone to have a strong LLM to check for bugs. If your software is proprietary, it's a competition between just you and whatever model you have vs any attacker and whatever model they can lay hand to.

I don't see the difference.

> OSS only needs someone to have a strong LLM to check for bugs.

The same applies to propietary, closed-source code. It being closed-source means that the source isn't generally available, but the executable is. Hence, someone with a strong model can still reverse it and find vulns.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#82

Post by raesene9 »

jdw64 wrote: post #14
jdw64 wrote: post #6

I'm going through each one, and it's fascinating to see things like this. The UAF principle in c-ares is really interesting. The problem ultimately came from not being able to prevent stale pointers. The attack works by figuring out the size of the stale pointer, then spraying memory with data of the same size, and finally achieving RCE (Remote Code Execution). How do people even come up with ideas like this?

But do people actually find these vulnerabilities on their own, or are they using LLMs? I was curious about how these vulnerabilities work, so I tried asking my dear friend Mr. CLAUDE, but he immediately threw an error and ended the session because it was a cybersecurity question. Enterprise APIs block even the analysis itself, so it's amazing that people can actually pull this off in practice.

If you want to chat with Claude about this, I'd recommend using Opus 4.6. IME it's happy to talk about (and even write) PoC exploits

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#83

Post by Barbing »

tyre wrote: post #54
doe88 wrote: post #40

0-days-vibes-vulns ? There should be a new category, for spotting and handling the em-dashes of this brave new world of vulns and making the old fossils like me only picking my head up for the old painfully still hand-crafted artisanal ones instead. A kind of label, like free-range for eggs, in sum.

Yes, big pet peeve of the new world. Every em dash is apparently an AI trigger. Back in my day, they were a sign of great respect within my people.

I might like to see a collection of pre-2022 em-dash usage—a subset I suppose of the Low Background Steel category (https://lowbackgroundsteel.ai).

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#85

Post by sureMan6 »

tyre wrote: post #54
doe88 wrote: post #40

0-days-vibes-vulns ? There should be a new category, for spotting and handling the em-dashes of this brave new world of vulns and making the old fossils like me only picking my head up for the old painfully still hand-crafted artisanal ones instead. A kind of label, like free-range for eggs, in sum.

Yes, big pet peeve of the new world. Every em dash is apparently an AI trigger. Back in my day, they were a sign of great respect within my people.

You completely misunderstanding the comment feels like an AI trigger

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#86

Post by rogerrogerr »

tyre wrote: post #54
doe88 wrote: post #40

0-days-vibes-vulns ? There should be a new category, for spotting and handling the em-dashes of this brave new world of vulns and making the old fossils like me only picking my head up for the old painfully still hand-crafted artisanal ones instead. A kind of label, like free-range for eggs, in sum.

Yes, big pet peeve of the new world. Every em dash is apparently an AI trigger. Back in my day, they were a sign of great respect within my people.

I used to be an em-dash user, but now my opinion is that I’d rather be perceived as someone who does not want to be confused with an LLM. So I’ve changed my writing style.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#87

Post by 0123456789ABCDE »

Retr0id wrote: post #33
tliltocatl wrote: post #15

A friendly reminder that a 0-day is a vulnerability that wasn't known until after a malicious actor exploited it. If someone publishes a PoC, it is not a 0-day, just a vulnerability.

No, the days start counting from the availability of a patch.

what if a path is never released?

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#88

Post by woodruffw »

Retr0id wrote: post #17

I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1... The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise. The second, idk, I'm not familiar with TraceRMI (but it's probably worth noting that "RMI"…

The Gitea one looks marginally interesting, but is probably not exploitable in practice (unless Gitea or whoever else isn’t properly isolating jobs on dedicated VMs). I suspect GitHub Actions has similar behavior and is not considered exploitable because the user is assumed to already have local, non-namespaced root access.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#90

Post by trinari »

ryukoposting wrote: post #74
Retr0id wrote: post #17

I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1... The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise. The second, idk, I'm not familiar with TraceRMI (but it's probably worth noting that "RMI"…

I'm no expert on any of these programs, but that's kinda the problem, isn't it? No single person is an expert on every codebase supposedly exploited in this repo. After a bit of research, the Firefox one seems plausible to me. But, I haven't actually tried the POC. The explanation about the private-data and untrusted-input flags is plausible but I'm not an expert on Firefox's internals, maybe that's not actually how…

I actually prefer them being public than in some governments or corporations toolbox
Post reply on HN