Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kimi K3 exploited the latest Redis server

twitter.com

Post reply on HN
Print view View original

81–90 of 106 posts

Re: Kimi K3 exploited the latest Redis server

#81

Post by inigyou »

baby_souffle wrote: post #41
NorwegianDude wrote: post #38

Earlier quoted context omitted.

While most don't, there are developers who actually do understand systems from end to end. Most developers are terrible developers, compared to the really good ones.

> While most don't, there are developers who actually do understand systems from end to end The last time intel made a CPU where the entire thing could fit in one persons head was probably the 8086 or thereabounts. There is no one developer or engineer at apple that understands everything going on from key press to bits moving around to print the characters I see when I type in this text box.

Correct. There are people who understand more and less and none of it. The latter are called script kiddies.

Re: Kimi K3 exploited the latest Redis server

#82

Post by inigyou »

cynicalsecurity wrote: post #62
justinhj wrote: post #45

Earlier quoted context omitted.

If the AI tools can easily find exploits, cannot those same tools be used to harden security? In fact the companies have an advantage over script kiddies: access to more expensive models and compute time as well as professional security engineers

Companies are full of idiot managers who still prioritise new features over security. Security doesn't get your promoted, new features do. New features can be shoved in customers' faces and sold. Security is invisible. The idiocy in companies runs all the way from the top to middle managers. This feels a lot like Titanic.

Plumbing companies prioritize getting pipes installed over not leaking. Each individual plumber is responsible for his pipes not leaking.

Re: Kimi K3 exploited the latest Redis server

#83

Post by gregoriol »

theplumber wrote: post #37
pizza234 wrote: post #26

Earlier quoted context omitted.

No, that’s a flawed analogy, because this is an RCE. It's (like) having credentials for a network service, then exploiting that service to execute arbitrary code on the Windows host (of course the blast radius depends on the underlying permissions). Access to Redis is not access to the underlying server.

You are right but running Redis or any database without a firewall in 2026 is already a quite bad posture. Now with credentials as well that’s pretty much as bad as it can be. >> Access to Redis is not access to the underlying server. Then you should make sure you run it with the right privilege and consider it potential rogue so when it gets hacked you don’t have to worry about the blast radius because it’s containe…

The reason this is interesting is that it allows to go further into the target system if you already have a frontend vulnerability

Re: Kimi K3 exploited the latest Redis server

#84

Post by inigyou »

angry_octet wrote: post #73
illliillll wrote: post #56

Earlier quoted context omitted.

Maybe share with us one good reason to not treat redis credentials like SSH credentials? > and redis open source has no default requirement for password complexity. Loudly Crying Face Emoji

You mean, like uncontrolled keys that can be used from anywhere and have no lifecycle care? Well at least SSH keys can't be guessed. Redis suffers from security gatekeeping, where essential features are kept in the paid Enterprise fork, and community security efforts are blocked. So you can use x.509 mutual TLS certificate auth, but the setup is entirely manual. Which means you use long lived certificates, which is w…

Here's a thought: if you want something to exist, create it instead of begging a for-profit company to let you use their work for free.

Re: Kimi K3 exploited the latest Redis server

#86

Post by inigyou »

Bombthecat wrote: post #69
walrus01 wrote: post #7

Earlier quoted context omitted.

This is a concern but given its size, it's also going to cost a potential user $500-600k in hardware to self host and run Kimi K3 at any useful speed with full context size. It's not something that just anyone interested in attacking a system can use. The size/cost of hardware is far beyond even something like a self-hosted GLM5.2 Q8 at approx. 850GB GGUF file on disk size, which can run at a slow tok/s rate on a ser…

Why would they need to selfhost? They can run it via API ala openrouter or runware or whatever. Or on runpod with rented gpus or inference.

Outsourced LLMs are usually censored. It's presumed if you want uncensored, you have to run it yourself.

Re: Kimi K3 exploited the latest Redis server

#87

Post by inigyou »

fragmede wrote: post #36
mohsen1 wrote: post #30

Earlier quoted context omitted.

Do you think any programmer really understands how their program works end-to-end? At some abstraction layer, we're all clueless. There are many layers between what you type into the text editor and the actual CPU ticks that make your program work. I bet nobody fully understands the whole stack. Now that that text editor accepts English, we're all calling each other names, etc.

Used to be, knowing a ret from a nop (90) meant something. If you can just load up a model and say "hack teh NSA.gov" while not actually knowing anything about even DNS, what are we even doing?

LOIC (a DDoS tool) worked that way. Xbox voice chat kids would just agree to open up LOIC, type nsa.gov and all hit start at the same time.

Re: Kimi K3 exploited the latest Redis server

#88

Post by inigyou »

gerdesj wrote: post #40
sureglymop wrote: post #18

Earlier quoted context omitted.

What makes someone a script kiddie or not a script kiddie? Imo this differentiation is totally pointless now. It gives everyone with access to AI the ability to use it as intended but also otherwise. But that is true for the defensive side also.

Scraipt kiddie, script kiddlmie. Needs some work!

Script kiddai

Re: Kimi K3 exploited the latest Redis server

#90

Post by inigyou »

pylua wrote: post #39
treesknees wrote: post #16

Earlier quoted context omitted.

One where customers have their own scanners, and their unfounded panic overrides logical analysis by the engineers and admins. We’ve had to patch plenty of stupid “security” bugs just to satisfy a paying customer.

This is the real answer to the op. It’s incredible how overblown these sorts of things can become

If the customer can run the scanner and find the vuln, that means they can log in, right? Which means they can RCE.
Post reply on HN