Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kimi K3 exploited the latest Redis server

twitter.com

Post reply on HN
Print view View original

101–106 of 106 posts

Re: Kimi K3 exploited the latest Redis server

#101

Post by JonTarg »

inigyou wrote: post #80
tough wrote: post #59

Earlier quoted context omitted.

a script kiddie of the vibe coding present could very well start modifying code without ever reading it when that wasnt true in the past

Yes. Script kiddy capabilities have increased, but the classification still works.

Then might as well put them in the vibe coder definition. I believe he has a point though: a script kiddy needed the tools someone else built. The person who built that was someone anywhere in the range of "knows enough to reason about attack vectors and can program something to help him/others" to "people deep in the industry with knowledge and skills very few people have, creating a harness dedicated to cybersec, for better or worse".

Now that script kiddy has access to the second kind, on demand, at perhaps, a very accessible cost. Things are about to get really wild, assuming uncensored k3 models that allow this sort of prompting exists.

Re: Kimi K3 exploited the latest Redis server

#102

Post by JonTarg »

yjftsjthsd-h wrote: post #97
phoghed wrote: post #93

Earlier quoted context omitted.

I can’t believe the nerve of that guy to straw man your no true Scotsman like that

That is... also a strawman. There are less skilled bad actors. There are more skilled bad actors. The bottom rung is script kiddies, so named because they just run other people's scripts. They are not Scottish.

Reddit tier garbage thread ngl.

Re: Kimi K3 exploited the latest Redis server

#103

Post by pylua »

inigyou wrote: post #90
pylua wrote: post #39

Earlier quoted context omitted.

This is the real answer to the op. It’s incredible how overblown these sorts of things can become

If the customer can run the scanner and find the vuln, that means they can log in, right? Which means they can RCE.

Not always, it can be run at static code analysis or the container repository (not the prod one)?

Re: Kimi K3 exploited the latest Redis server

#104

Post by tough »

JonTarg wrote: post #101
inigyou wrote: post #80

Earlier quoted context omitted.

Yes. Script kiddy capabilities have increased, but the classification still works.

Then might as well put them in the vibe coder definition. I believe he has a point though: a script kiddy needed the tools someone else built. The person who built that was someone anywhere in the range of "knows enough to reason about attack vectors and can program something to help him/others" to "people deep in the industry with knowledge and skills very few people have, creating a harness dedicated to cybersec, f…

any open weights model can be stripped off of guardrails with seemingly pretty simple techniques and there's several already made libraries or tools to do so.

Running K3 on your own infra is still not "cheap" tho, but we'll get there maybe.

but yeah to my point, we're making "intelligence" a commodity, with all the ramifications that entails.

Re: Kimi K3 exploited the latest Redis server

#105

Post by angry_octet »

inigyou wrote: post #84
angry_octet wrote: post #73

Earlier quoted context omitted.

You mean, like uncontrolled keys that can be used from anywhere and have no lifecycle care? Well at least SSH keys can't be guessed. Redis suffers from security gatekeeping, where essential features are kept in the paid Enterprise fork, and community security efforts are blocked. So you can use x.509 mutual TLS certificate auth, but the setup is entirely manual. Which means you use long lived certificates, which is w…

Here's a thought: if you want something to exist, create it instead of begging a for-profit company to let you use their work for free.

Maybe for-profit companies shouldn't be gatekeeping core security features in open source products, and should instead deliver value in terms of debugging and performance, that are highly valued by enterprise customers.

Re: Kimi K3 exploited the latest Redis server

#106

Post by yencabulator »

himata4113 wrote: post #31

As wild as this sounds, redis should not exposed to the internet and this appears to be an authenticated RCE. This is similar to claiming that a PSQL query grants code execution when its actually a feature. These systems are typically not tested as aggressively against vulnerabilities of that nature since 10 times out of 10 you have to have access to these systems already. Issues like these are only really an issue i…

> This is similar to claiming that a PSQL query grants code execution when its actually a feature.

Why do you claim that remote code execution is a feature of Postgres? That'd be just as much an RCE in Postgres as it is in Redis.

This RCE bug in Redis e.g. made it possible to avoid any within-tenant access control. Don't diminish its importance.

Post reply on HN