I'd call Docker out on this. Why the hell is it recording
We got admin access to Baseten's production GitHub
151–160 of 202 posts
Re: We got admin access to Baseten's production GitHub
#152Hey all Philip from Baseten here. Posting this on behalf of our security team. I wanted to confirm that we collaborated with Strix on the remediation of the reported vulnerability. We thank Strix for their responsible disclosure. We took immediate steps to invalidate the leaked key and remove the public container image. Our logs confirm the vulnerability was never exploited and no customer data was exposed.
+1 -- kudos to the Baseten team for their super professional response to all of this, it is clear why they are a generational company (-- Alex from Strix)
What distinguishes their response from non-generational companies? Do others fail to rotate their exposed github secrets that have admin access?
Re: We got admin access to Baseten's production GitHub
#153I wonder what model was used for this. Also as far as I know Baseten does not have any abliterated models in their repertoire.
It's odd personifying Strix as the thing that found these when it's whatever model they use doing the hard work.
Nobody says Claude Code hacked a company, it's Fable.
Re: We got admin access to Baseten's production GitHub
#154Earlier quoted context omitted.
In which cases wouldn’t it make sense?
In cases where the user is not asking the agent to hack anything specifically, but a poor or ambiguous query sets the agent off. I've seen plenty of cases of Claude having an action blocked so trying tons of workarounds to accomplish its goal, I could easily see it doing this on something more broad.
Depending on the circumstances, failure to control your agent could be considered gross negligence and put you at risk of criminal or civil liability. Be mindful!
Re: We got admin access to Baseten's production GitHub
#155Earlier quoted context omitted.
+1 -- kudos to the Baseten team for their super professional response to all of this, it is clear why they are a generational company (-- Alex from Strix)
What distinguishes their response from non-generational companies? Do others fail to rotate their exposed github secrets that have admin access?
see, non-generational companies often miss the chance to turn penetration testing into a marketing opportunity
Re: We got admin access to Baseten's production GitHub
#156Hey all Philip from Baseten here. Posting this on behalf of our security team. I wanted to confirm that we collaborated with Strix on the remediation of the reported vulnerability. We thank Strix for their responsible disclosure. We took immediate steps to invalidate the leaked key and remove the public container image. Our logs confirm the vulnerability was never exploited and no customer data was exposed.
> Our logs confirm
You retain all logs back through to (at least) March 2023?
Re: We got admin access to Baseten's production GitHub
#157So often recent breaches involve Github in one way or another. How is it still considered a sane choice to host anything proprietary there? If your business is built around open source, ok, put a mirror on Github. But CI/CD, gitops, FDEs' stuff have no place on a public cloud. C-level execs may not know bits from bytes, but by now they should've understood that this is akin to storing ammonium nitrate in the open air…
This wasn't GitHub's fault in any way.
Github personal access tokens are security footguns. This is an apparently old and forgotten image containing a token from 2023 and it the token gets you admin acces to their repos.
Re: We got admin access to Baseten's production GitHub
#158> So Strix enumerated hosts, looked through certificate logs, mapped the full surface. If there is anything that you should do while setting up infrastructure... it is getting rid of single-host SSL certificates. If you're on Amazon... just let it issue wildcard certificates and place an ALB in front of hosts that terminates the SSL connection. The very second a subdomain appears in any of the CT logs directly, you'v…
> A human, you can hold accountable, and you can keep them at a good security posture with short-lived session tokens. You can do this too (and better) with a repo: OIDC/Workload identity trust relationship between github and aws for short lived tokens + a github environment setup that requires manual approval. Bonus: It also gives you an audit trail with a github action log as opposed to a sysadmin running something…
The audit log for the sysadmin is in Cloudtrail, so nothing is lost there.
Re: We got admin access to Baseten's production GitHub
#159Earlier quoted context omitted.
They probably negotiated a "permission to attack" before letting Strix off the leash, as pentesters usually do.
The fact that they don’t seem to explicitly state this fact but do go to lengths to explain how the agent didn’t do anything malicious while confirming how alive the token was makes me doubt they asked for permission to run the agent in the first place.
That's highly unlikely since it's standard practice in the industry, thus it's unnecessary to state it. Also, they didn't hack a hobby developer's website, but a prospective business partner who has enough money to sue them into oblivion. No way this wasn't announced.
Announcing that their agent restrained itself even though it got hold of a live token is necessary to convince prospective clients. You don't want a pentester that doesn't show this kind of reserve!
Re: We got admin access to Baseten's production GitHub
#160Hey all Philip from Baseten here. Posting this on behalf of our security team. I wanted to confirm that we collaborated with Strix on the remediation of the reported vulnerability. We thank Strix for their responsible disclosure. We took immediate steps to invalidate the leaked key and remove the public container image. Our logs confirm the vulnerability was never exploited and no customer data was exposed.
> Our logs confirm You retain all logs back through to (at least) March 2023?
You don't?
For some stuff, I've got logs going back to 1993...