The article reads like it was written by a child. I imagine their company is run the same way.
We got admin access to Baseten's production GitHub
131–140 of 202 posts
Re: We got admin access to Baseten's production GitHub
#132> Baseten handled this well. The timeline was: > July 13, 11:10 PM: I reported the live basetenbot token, the public Harbor project, and the repository permissions. > July 14, morning: Baseten made the Harbor project private. I flagged that the token itself still worked. > July 14, 4:34 PM: Anton from Baseten Security confirmed the issue as critical and said they had made the Harbor project private and rotated the to…
Good in terms of prompt communication and fix. Absurdly bad in terms of reward. Earlier in the article, it mentions that Baseten is valued at $13B. They can't dig into their couch cushions to give a few thousand dollars to the researcher privately disclosing a bug that let an attacker escalate to admin in their GitHub org? This sends the message that honest researchers should not waste their time looking for vulnerab…
> Absurdly bad in terms of reward
This is two companies working together. Most of the comments below are assuming this was an independent security researcher doing work on their own time. This was professionals doing work for their companies on both sides.
> This sends the message that honest researchers should not waste their time looking for vulnerabilities in Baseten, but it's a good target for criminals who want to monetize these vulnerabilities.
The reason they were looking for bugs was in the context of a B2B relationship, not as a someone independent on their nights and weekends.
If they give them any additional compensation it would probably be in some amount of free or discounted services, which is what they’d want anyway.
Re: We got admin access to Baseten's production GitHub
#133Earlier quoted context omitted.
In Perplexity's case everything is getting routed through the user's browser, so there is no server to server communication between Perplexity and Amazon, thus no CFAA unauthorized access was established. However, Anthropic and OpenAI did not use the pattern of routing through authorized parties, so I don't think this opinion gives them any cover.
The important bit to me is that they consider the agent running as an extension of the user. So the user is visiting Amazon, not Perplexity. From that lens, that feels like users could be held liable for what these hacking agents are doing. Which in some cases probably makes sense, but certainly not all.
In which cases wouldn’t it make sense?
Re: We got admin access to Baseten's production GitHub
#134Earlier quoted context omitted.
The important bit to me is that they consider the agent running as an extension of the user. So the user is visiting Amazon, not Perplexity. From that lens, that feels like users could be held liable for what these hacking agents are doing. Which in some cases probably makes sense, but certainly not all.
In which cases wouldn’t it make sense?
In cases where the user is not asking the agent to hack anything specifically, but a poor or ambiguous query sets the agent off.
I've seen plenty of cases of Claude having an action blocked so trying tons of workarounds to accomplish its goal, I could easily see it doing this on something more broad.
Re: We got admin access to Baseten's production GitHub
#135That is great marketing for strix, pretty bad for baseten. I don't think someone can have a better story to advertise their own security product. Did not know about strix but I am going to look it up now. Might add it to my stack.
They are a great team! You will defacto also use Caido if you add it to your stack
Re: We got admin access to Baseten's production GitHub
#136Earlier quoted context omitted.
It's not, in most juridictions at least, but it would be insanely stupid for baseten to sue (and the hacker would probably not get much more than a slap on the wrist given that they weren't malicious).
Suing is not what you do when someone commits a crime against you. You're confusing civil law and criminal law.
Yes, or more precisely I don't confuse the concepts but the terminology since English isn't my first language.
Re: We got admin access to Baseten's production GitHub
#137Whether it's valid or not, there is something that rubs me the wrong way about a security tools company using a real customer/vendor as a marketing campaign. This "story" could have been told without naming, bluntly, their "victim". It would be different if it was some complex, multi-step exploit, but the tone is closer to "look how much Baseten fucked up!". Strix also crossed the line at this point: > Strix decided…
shaming people for bad security practices is probably net good, whether we like it or not
There is a big difference between "bad security practices" and "someone made a mistake 2.5 years ago"
Re: We got admin access to Baseten's production GitHub
#138Earlier quoted context omitted.
Meanwhile I have customers running legacy web apps last compiled over five years ago on end-of-life operating systems… and it’s crickets chirping. Dead quiet, not even a hint of an attack, let alone a breach. I expected them to have been hacked to pieces by now, but even “maximally vulnerable” internet-facing apps seem to be relatively unmolested so far. Maybe it’s still too expensive to go after “boring” enterprise…
> it’s still too expensive to go after “boring” enterprise targets? The economic argument seems convincing to me. I can’t tell what your stance on it is. You’re the only one that knows the value of these targets, but “not worth it” seems likely to me.
It's a risk-reward ratio, same as anything else, whether legal or illegal.
You wouldn't organise the equivalent of an elaborate bank heist to break into a child's piggy bank, it's just not worth it.
I have heard of a few high profile crypto heists that appear to be AI-assisted, some as far back as the GPT 3.5 era. There was an article I can't find any more about someone accidentally pushing a security fix to a public repo and getting their wallets drained via that specific mechanism within something like an hour.
Malicious actors are watching crypto like a cat in front of a mouse hole, because a "success" can net them the equivalent of hundreds of millions of USD that they can instantly transfer, launder, and spend.
For comparison, what would they achieve by hacking the web site of a local council or public library? Cause some embarrassment? Attempt to crypto-locker them? What are the chances of a payout? Certainly not a 100%, and you're also certain to get the attention of the local equivalent of the FBI or Homeland Security.
Re: We got admin access to Baseten's production GitHub
#139> So Strix enumerated hosts, looked through certificate logs, mapped the full surface. If there is anything that you should do while setting up infrastructure... it is getting rid of single-host SSL certificates. If you're on Amazon... just let it issue wildcard certificates and place an ALB in front of hosts that terminates the SSL connection. The very second a subdomain appears in any of the CT logs directly, you'v…
> A human, you can hold accountable, and you can keep them at a good security posture with short-lived session tokens.
You can do this too (and better) with a repo: OIDC/Workload identity trust relationship between github and aws for short lived tokens + a github environment setup that requires manual approval. Bonus: It also gives you an audit trail with a github action log as opposed to a sysadmin running something on a laptop.
The problem here was mostly that they (for some reason) happened to use (and leak) a PAT.
Re: We got admin access to Baseten's production GitHub
#140Earlier quoted context omitted.
> The front page post in HN here is worth far more than few thousand dollars , don’t think either organization is operating under purely financial transactional nature . not always, especially if its just someone independent. iirc there was a guy here not too long ago who started dropping Windows 0days because Microsoft couldn't be assed to process his bug reports
> iirc there was a guy here not too long ago who started dropping Windows 0days because Microsoft couldn't be assed to process his bug reports Did that ever actually happen? I remember him threatening to start dropping 0days and getting a lot of press coverage for it. When I tried to look it up I didn’t find anything at the time.
> New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access
https://bleepingcomputer.com/news/security/new-microsoft-def...
“Nightmare Eclipse released these zero-day exploits as part of an ongoing dispute with Microsoft over the company's bug bounty and vulnerability disclosure practices. […] Since April, the anonymous security researcher has disclosed a long list of zero-day flaws, including ShieldBreak, LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, targeting Microsoft Defender, BitLocker, and other Windows components.”