Will this work on iphones as well.
Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
21–30 of 38 posts
Re: Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
#22The following rant is not against the owner/project - but... What an irony. I cant publish a attack surface mapping / pentesting tool i wrote which runs fully deterministic and really controlable due to "dual use" legal problems - but llm driven tools hit public space...... sorry for the rant....
Completely understand, the legal landscape has really shifted around AI/LLM tools. I see tools drop everyday that spit in the face of DMCA/Copyright law but they skirt by mainly because they leverage AI
That has nothing to do with LLMs or not. If they were to "code" the same tool with an LLM, or build a LLM version of it, in Germany (where rthey are residing) they would face the same consequences.
Our legal system in that regard is total BS, when it comes to the so called "Hacker Paragraph". This comes with a sentence tht can range from a fine to up to one year prison time, just for producing such a tool. So if the police would actually - even if they had not published it - computer... well. They could be potentially "f**ed" (depending on how a judge would decide).
Re: Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
#23Earlier quoted context omitted.
No im referring to the legal terms of germany, the country im residing at. Our laws regarding "hacking" are arguable the strictest and worst. The problem is that they are formulated in a way that it is super easy to have your software being possible "dual use" and that a judge has to decide if its fine or not. Making it worse it also states your "intention" which well is impossible to proof - if the judge says he doe…
Really? Have there been any cases yet? I'm asking cuz I started devloping a c2+agent+BOF kind of thing with custom bytecode vm for the lulz (to learn how stuff works nowadays) and it's on tangled and github :/
Yes. More than one. This one was especially "interesting", a security researcher was tasked by a company to evaluate the ERP (I believe would be the acronym) software. Diiscovered an external database connection, looked at it, discovered this external DB contained sensitive information from other clients of that vendor - reported it, got sued, lost.
In German: https://ht-strafrecht.de/blog/strafrecht/it-sicherheitslueck...
Re: Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
#24[flagged]
Re: Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
#25Earlier quoted context omitted.
No im referring to the legal terms of germany, the country im residing at. Our laws regarding "hacking" are arguable the strictest and worst. The problem is that they are formulated in a way that it is super easy to have your software being possible "dual use" and that a judge has to decide if its fine or not. Making it worse it also states your "intention" which well is impossible to proof - if the judge says he doe…
Intentions are very often a factor when it comes to law, and rightfully so. The problems come when you classify some category of software as "dangerous" by default. Software is special in that it can't be a "controlled substance". So everyone needs to have the tools to increase their security. That includes access to "offensive tools" to study what they do. A recent example was the Huggingface attack.
As I understand the hole shebang, the German law is about "does the court think you are `hacking` something?" -- this is against the law.
Yes, there was one German pentester that got sued, because he reported a BASE64 encoded, hardcoded authentication token in an application. Not that I would wish him anything like that and am ashamed by the outcome, I also recall that he might have tried to put pressure on the vendor by doing an interview with a blogger or so?
On the other hand, I do not know of any cases regarding publication of dual-use tools as OSS.
Re: Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
#26little bit unrelated, but I watched the IG video and I thought the visual design of the app was cool af! what inspired the style?
Re: Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
#27This looks interesting. My current phone is an Asus ROG Phone 3, which I think suffices (Snapdragon 865+ plus 12Gb RAM) but isn't rooted. Even on outdated Android 12 this phone covers everything I could possibly need as-is, and I don't intend to replace it. But, this might be the final push to upgrade ROM to something newer. I saw crDroid 16.0 still supports this ROG variant.
Will this work with Nethunter Rootless, or ir Magisk support w/root imperative?
Re: Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
#28Earlier quoted context omitted.
Are you referring to GitHub policies? I haven’t seen issues like that from people publishing security tools before. Metasploit is one example: https://github.com/rapid7/metasploit-framework
No im referring to the legal terms of germany, the country im residing at. Our laws regarding "hacking" are arguable the strictest and worst. The problem is that they are formulated in a way that it is super easy to have your software being possible "dual use" and that a judge has to decide if its fine or not. Making it worse it also states your "intention" which well is impossible to proof - if the judge says he doe…
If getting it out there in the world is more important to you than stamping your name on it, pass it out to a friend who can publish it. Continue any related development in private. They can't stop you from distributing something they don't know you're developing.
Re: Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
#29Earlier quoted context omitted.
No im referring to the legal terms of germany, the country im residing at. Our laws regarding "hacking" are arguable the strictest and worst. The problem is that they are formulated in a way that it is super easy to have your software being possible "dual use" and that a judge has to decide if its fine or not. Making it worse it also states your "intention" which well is impossible to proof - if the judge says he doe…
So would it be fair to say this is less about deterministic vs. LLM-driven tools, and more about software published out of New York vs. software published out of Germany?
Yes and no. I have seen (not wanne name them now to not bring them into a bad context) several tools coming from germany which are well in questionable contexts but due to basically beein advertised as full LLM/AI driven its somehow not on anyones radar. So that is kinda a thing.
But sure location itself also plays a role no question.
Re: Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
#30Earlier quoted context omitted.
No im referring to the legal terms of germany, the country im residing at. Our laws regarding "hacking" are arguable the strictest and worst. The problem is that they are formulated in a way that it is super easy to have your software being possible "dual use" and that a judge has to decide if its fine or not. Making it worse it also states your "intention" which well is impossible to proof - if the judge says he doe…
If getting it out there in the world is more important to you than stamping your name on it, pass it out to a friend who can publish it. Continue any related development in private. They can't stop you from distributing something they don't know you're developing.
Well its not like i didn't consider it, but it heavily relies on stuff that i have written and that is well only used by me till this day. So arguably, publishing it this way it would still have like "points" which make it extremely related to only me.
Also asked the lawyer in consulted about it... i would be a heavy gamble