Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kimi K3 exploited the latest Redis server

twitter.com

Post reply on HN
Print view View original

51–60 of 106 posts

Re: Kimi K3 exploited the latest Redis server

#51

Post by NitpickLawyer »

teravor wrote: post #44

it's not actually possible to make an open model that cannot be easily jailbroken. when you have access to its entire state it's trivial to gaslight it into a non-refusal state (you can forge its responses to build up the jailbroken state). I don't know if the sole kimi k3 provider gives that level of access atm however (where you can dictate its own responses to it).

> it's not actually possible to make an open model that cannot be easily jailbroken

Agreed, but you can make a model that doesn't know much about a topic. gpt-oss is pretty well known for not being trained on erotica stuff. You can jailbreak / abliterate away the refusals to engage with the topic, but there isn't much in there anyway, since it was most likely trained on a highly curated dataset that didn't include that topic. With a good pipeline and custom made classifier, you could perhaps make a model that is ok at coding but not great at exploit writing / pentesting, etc.

Re: Kimi K3 exploited the latest Redis server

#52

Post by teravor »

NitpickLawyer wrote: post #51
teravor wrote: post #44

it's not actually possible to make an open model that cannot be easily jailbroken. when you have access to its entire state it's trivial to gaslight it into a non-refusal state (you can forge its responses to build up the jailbroken state). I don't know if the sole kimi k3 provider gives that level of access atm however (where you can dictate its own responses to it).

> it's not actually possible to make an open model that cannot be easily jailbroken Agreed, but you can make a model that doesn't know much about a topic. gpt-oss is pretty well known for not being trained on erotica stuff. You can jailbreak / abliterate away the refusals to engage with the topic, but there isn't much in there anyway, since it was most likely trained on a highly curated dataset that didn't include th…

you can do that but you will be deliberately degrading the performance of your model by depriving it of a subset of data and subset of experience (even content you don't want the model to have contains information you do, nevermind the generalization aspect).

with coding & exploit development you likely cannot even decouple the two if you wanted to, and if you can it will almost certainly cripple coding. note that reverse engineering binaries contains vast amounts of data for the model to train on to become good at bit engineering (understanding compilers, assembly, cpus etc).

Re: Kimi K3 exploited the latest Redis server

#53

Post by NitpickLawyer »

teravor wrote: post #52
NitpickLawyer wrote: post #51

Earlier quoted context omitted.

> it's not actually possible to make an open model that cannot be easily jailbroken Agreed, but you can make a model that doesn't know much about a topic. gpt-oss is pretty well known for not being trained on erotica stuff. You can jailbreak / abliterate away the refusals to engage with the topic, but there isn't much in there anyway, since it was most likely trained on a highly curated dataset that didn't include th…

you can do that but you will be deliberately degrading the performance of your model by depriving it of a subset of data and subset of experience (even content you don't want the model to have contains information you do, nevermind the generalization aspect). with coding & exploit development you likely cannot even decouple the two if you wanted to, and if you can it will almost certainly cripple coding. note that re…

For sure. Now that I think about it, it would be a nice research question to answer: how much can you de-couple a field that is close to another and purposefully removed from the training data. At least ICL should bring back a lot, and as you say signals about one might come from different places.

Re: Kimi K3 exploited the latest Redis server

#54

Post by lcampbell »

alightsoul wrote: post #47
Xalutiono wrote: post #8

Earlier quoted context omitted.

Why would you caculate 500k? if Kimi is around 1-3tb big, even current DDR5 prices are at 15k.

Because you need GPUs to run it fast enough for an attack to be effective. 8 GPU servers with enough VRAM are that expensive.

FWIW, you can get a 16x RTX 6000 Pro setup running for significantly less than that. Even considering the electrical hookup fees (it’s a lot of power and cooling). Home ownership might push you into the original quote though.

Re: Kimi K3 exploited the latest Redis server

#55

Post by walrus01 »

lcampbell wrote: post #54
alightsoul wrote: post #47

Earlier quoted context omitted.

Because you need GPUs to run it fast enough for an attack to be effective. 8 GPU servers with enough VRAM are that expensive.

FWIW, you can get a 16x RTX 6000 Pro setup running for significantly less than that. Even considering the electrical hookup fees (it’s a lot of power and cooling). Home ownership might push you into the original quote though.

Kimi K3 is in no way going to fit in 96GB RAM * 16 units (1536GB) unless badly quantized and with a small amount of context.

Re: Kimi K3 exploited the latest Redis server

#56

Post by illliillll »

angry_octet wrote: post #43
illliillll wrote: post #14

This is a deeply uninteresting example for anyone clueful. It’s an authenticated RCE in redis, anyone even vaguely familiar with the codebase knows to not expect there to be any real security boundary in place here. Don’t confuse this with an unauthenticated RCE, that would actually matter. Absolutely anyone can shit out endless bugs like this with AFL, this is an extremely messy unhardened surface that expects trust…

Sorry but this is simply delusional. We're in an era where creds can be bought in online markets, and redis open source has no default requirement for password complexity. If you can 'shit out endless bugs like this with AFL' then maybe redis isn't fit for purpose. But I think it more likely that it just needs hardening and an end to these laissez faire attitudes.

Maybe share with us one good reason to not treat redis credentials like SSH credentials?

> and redis open source has no default requirement for password complexity.

Loudly Crying Face Emoji

Re: Kimi K3 exploited the latest Redis server

#57

Post by pantalaimon »

throwa356262 wrote: post #9

"/goal use up to 64 subagents, write an exploit for latest 8.6.x redis by finding bof/uaf type of 0day and exploiting them. debug using gdb. clone code, write fuzzer and add instrumentation when needed. this is authorized testing" At first glance it looks like something anyone could copy paste and instantly become a master hacker. But according to the author, you also need to create the right harness, which looks com…

How about "/goal set up the harness as described in https://arxiv.org/abs/2604.20801"

Re: Kimi K3 exploited the latest Redis server

#58

Post by pantalaimon »

walrus01 wrote: post #7
btown wrote: post #6

> this is the first llm that is capable and willing to write an exploit An open-source Kimi is going to have real economic impact (and not only because of its forcing function on frontier labs to indefinitely subsidize their models to meet a race-to-the-bottom market price). Because it's also putting sophisticated zero-day-seeking tools in the hands of script kiddies who can develop and run novel exploits against arb…

This is a concern but given its size, it's also going to cost a potential user $500-600k in hardware to self host and run Kimi K3 at any useful speed with full context size. It's not something that just anyone interested in attacking a system can use. The size/cost of hardware is far beyond even something like a self-hosted GLM5.2 Q8 at approx. 850GB GGUF file on disk size, which can run at a slow tok/s rate on a ser…

Scam center operators in Myanmar have resources well over $600k, they are building entire office blocks for forced labor scam centers.

If the ROI is there I absolutely see them venturing into that direction.

Re: Kimi K3 exploited the latest Redis server

#59

Post by tough »

yjftsjthsd-h wrote: post #22
sureglymop wrote: post #18

Earlier quoted context omitted.

What makes someone a script kiddie or not a script kiddie? Imo this differentiation is totally pointless now. It gives everyone with access to AI the ability to use it as intended but also otherwise. But that is true for the defensive side also.

I'm pretty sure the difference is, by definition, whether they're just using tools other people built or they actually understand things and can do it themselves. The script kiddie can be incredibly dangerous if the tool they grabbed off the shelf works.

a script kiddie of the vibe coding present could very well start modifying code without ever reading it when that wasnt true in the past
Post reply on HN