Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anonymous GitHub account mass-dropping undisclosed 0-days

github.com

Post reply on HN
Print view View original

91–100 of 407 posts

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#91

Post by alwa »

justacrow wrote: post #65
jMyles wrote: post #50

Earlier quoted context omitted.

> It will naturally die down as the legitimate ones are fixed. Seems like we're already in the middle of this phase, but rather than dying down, the 'reports' have just gotten more noisy and obtuse, making it more difficult to establish the actual degree of threat / attack vector.

And if you are a state agency who'd like to keep the undisclosed zero-days you rely on secret, spamming maintainers with reports makes sense. As a bonus if you find any actual zero-days in your mass-generated ones you don't report it and get a new one to play with.

I mean. Makes sense until adversary states start walking through the same doors you’re using. At which point you might regret that maintainers are too flooded to deal with it.

Assuming, of course, said state agency is operating under sufficiently strategic governance and management…

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#92

Post by nicce »

jdw64 wrote: post #14
jdw64 wrote: post #6

I'm going through each one, and it's fascinating to see things like this. The UAF principle in c-ares is really interesting. The problem ultimately came from not being able to prevent stale pointers. The attack works by figuring out the size of the stale pointer, then spraying memory with data of the same size, and finally achieving RCE (Remote Code Execution). How do people even come up with ideas like this?

But do people actually find these vulnerabilities on their own, or are they using LLMs? I was curious about how these vulnerabilities work, so I tried asking my dear friend Mr. CLAUDE, but he immediately threw an error and ended the session because it was a cybersecurity question. Enterprise APIs block even the analysis itself, so it's amazing that people can actually pull this off in practice.

People have always used tools. Some people have better tools than others. I guess the line is thin whether they found on their own or not.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#93

Post by rogerrogerr »

ryandrake wrote: post #57
silversmith wrote: post #45

Earlier quoted context omitted.

Hang on, can you actually do something nefarious with just the bank account number?

If someone has your bank account and bank’s routing number (which is also not secret), they can make fraudulent ACH transfers and payments from your account. Of course it will most likely be caught as fraud some time after the fact, but just those two bits of not-secret info are enough to grief someone.

And both numbers, plus your name and address and a convenient sample of your signature, are on every check you’ve ever written.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#94

Post by esikich »

grayhatter wrote: post #44

> At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. I do this so to allure people into the field, and I've always found this is the most efficient way. I've been a skiddy, he would have believed this. Thankfully, I've grown a bit, and can see this for the transparent, "I'm angry and want to hurt others so I will feel a little less alon…

How bad are your security practices that these tiny obscure things matter? None of these findings that show up here on HN should even make you flinch. The alarmist takes on this stuff is fucking exhausting and I'm tired of security teams bugging me about it. Do your job and this shit doesn't matter AT ALL.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#96

Post by firefax »

Retr0id wrote: post #64
firefax wrote: post #60

Earlier quoted context omitted.

The bigger takeaway is someone that smart is pissed off and dropping their shit with zero warning... but hey, that's just like, my opinion man.

You don't need to be pissed off to decide that immediate public disclosure is the best option.

Ok, I don't know their emotional state. Fair point.

Maybe I'm projecting my own biases ;-)

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#98

Post by grayhatter »

merelydev wrote: post #69
grayhatter wrote: post #56

Earlier quoted context omitted.

> I don't know what methods where used to find these exploits but I am starting to think security through obscurity might not be a bad thing in this day and age, where someone can just let bots loose on your codebase. I'd love to hear why you think obscurity is bad, if you now think maybe it's good in the LLM age? I'd also be interested if you could describe exactly what or how you think security through obscurity wo…

"one ought to design systems under the assumption that the enemy will immediately gain full familiarity with them" - Claude Shannon https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

If you believe this, then why did you say?

> starting to think security through obscurity might not be a bad thing

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#99

Post by GTP »

grayhatter wrote: post #56
merelydev wrote: post #3

Most of the exploits are for opensource/free software. I don't know what methods where used to find these exploits but I am starting to think security through obscurity might not be a bad thing in this day and age, where someone can just let bots loose on your codebase.

> I don't know what methods where used to find these exploits but I am starting to think security through obscurity might not be a bad thing in this day and age, where someone can just let bots loose on your codebase. I'd love to hear why you think obscurity is bad, if you now think maybe it's good in the LLM age? I'd also be interested if you could describe exactly what or how you think security through obscurity wo…

Security through obscurity can make something a bit more secure in practice by annoying an attacker IF AND ONLY IF you're not relying on the hidden information remaining secret in order to the system remaining secure. E.g., if you're using a broken cipher and assume this is ok because no one knows which cipher you're using, you're gonna have a bad time.

In the case of FOSS software, it is generally recognized that the small advantage of keeping the source secret is far outweighted by the contributions and vuln reports you get if you publish the source.

Post reply on HN