Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We got admin access to Baseten's production GitHub

strix.ai

Post reply on HN
Print view View original

111–120 of 202 posts

Re: We got admin access to Baseten's production GitHub

#111

Post by nrmitchi »

kadoban wrote: post #47
stymaar wrote: post #42

Earlier quoted context omitted.

It's not, in most juridictions at least, but it would be insanely stupid for baseten to sue (and the hacker would probably not get much more than a slap on the wrist given that they weren't malicious).

> It's not, in most juridictions at least What did I miss they did that's illegal? It looked like it downloaded a public docker image, searched around inside, and verified that the key it found was still valid (without making any changes), and then immediately notified them about the issue.

They "validated that the key was valid" by iterating internal repositories and listing the contents of said repos and poking around at what they do/are-for, including, apparently, iterating through customer lists/information.

The white-hat line stops at "validated the key was valid". It does not extend to "poking around inside to extract business-confidential customer information".

Re: We got admin access to Baseten's production GitHub

#112

Post by scubbo »

sublinear wrote: post #104
scubbo wrote: post #98

Earlier quoted context omitted.

> The only reason to keep repeating that kind of worldview is to absolve companies behaving in shitty, toxic or downright evil ways. Or...to warn people away from ever expecting compassionate or empathetic behaviour from companies, and remind people not to trust them?

I think the only misleading part of this situation is your naive and self-centered definition of "trust", and the assumption that so many others think similarly enough that they need to be warned. I trust a business to fulfill their obligations as stated in writing for the money paid. I do not trust them in any other way. Nobody should "trust" or depend on undefined behavior. Common sense can only ever be as common a…

> your naive and self-centered definition of "trust"

I never gave one? For what it's worth, I agree with your second paragraph, despite your first being needlessly aggressive.

Re: We got admin access to Baseten's production GitHub

#113

Post by nrmitchi »

wpasc wrote: post #88
otterley wrote: post #74

Earlier quoted context omitted.

IAAL (not legal advice, consult a lawyer in your jurisdiction). You really do not want to pen-test a target without their permission. If you're identified as a culprit, the Feds will shove the CFAA so far up your ass you'll need a proctologist.

as a lawyer, can you speculate as to why anthropic/openai aren't facing many or any consequences for their agents? I'm not asking in a "grab the pitchforks" way. more out of genuine curiosity as my uninformed recollection of the CFAA is as you describe it.

There is also the big difference here between anthropic/openai maybe being negligent, but did not purposely instruct agents to go commit crimes.

The service that this whole thread is about is explicitly a "hacking agent", designed explicitly to try to hack things, and was then pointed at a third-party (seemingly without their permission).

Anthropic/OpenAI can reasonably claim that they had no intent and are trying to stop it. OP here did this explicitly and purposely.

Re: We got admin access to Baseten's production GitHub

#114

Post by aantoon »

Anton here from the baseten security team. I wanted to confirm that we collaborated with Strix on the remediation of the reported vulnerability. We thank Strix for their responsible disclosure. We took immediate steps to invalidate the leaked key and remove the public container image. Our logs confirm the vulnerability was never exploited and no customer data was exposed.

Re: We got admin access to Baseten's production GitHub

#115

Post by nrmitchi »

kadoban wrote: post #41
codemog wrote: post #28

Is this legal? I know I can’t try and break into my neighbors house even if I have no intent of going inside and stealing once I break the lock.

> I know I can’t try and break into my neighbors house even if I have no intent of going inside and stealing once I break the lock. They didn't break in. They found a key that their neighbor dropped and returned it. > Is this legal? Generally, yes (though ask a lawyer if you're going to do security work). Security researchers do occasionally get legal flak though, depending on which idiot they annoy by pointing out i…

> They didn't break in. They found a key that their neighbor dropped and returned it.

Ya, returned it after poking through all of the drawers and iterating through business information that they found.

There is a white-hat line that OP very clearly crossed here.

Re: We got admin access to Baseten's production GitHub

#116

Post by antonvs »

bearsyankees wrote: post #45
smallnix wrote: post #37

Earlier quoted context omitted.

The bot snippets talk claudish. I'd say Opus 5. But they must be Cyber Verification Program approved by Anthropic I suppose for the LLM not to block them.

Hate to burst your bubble but wasn't Claude......

Chinese Claude distillation.

Re: We got admin access to Baseten's production GitHub

#117

Post by antonvs »

icedchai wrote: post #97
hmokiguess wrote: post #24

Earlier quoted context omitted.

Given the build is from 2023 one would expect that at least the token would have been rotated, and I suspect some of these compliance checks do require rotation of tokens/passwords. That said, the whole compliance industry is a joke.

Box checking is an important business!

I can’t help noticing that an LLM can check boxes.

Re: We got admin access to Baseten's production GitHub

#118

Post by r_lee »

sublinear wrote: post #84
r_lee wrote: post #63

Earlier quoted context omitted.

> The follow up arguments will be that since billion dollar companies ultimately only care about their bottom line, so should we. so it should be fought by giving them free work in the hopes that they'll finally feel guilty and then start paying proper bounties? like to me that just seems funny, as if they'd change anything if we'd keep rewarding them for not doing the right thing like, there's a reason regulation ex…

At some point, you will realize two things. First, you're being petty and just fighting fire with fire. Second, most of this research is fairly trivial. What you're instead encouraging is a race to the bottom. You're not going to kill off the companies you hate by withholding information. You don't even have that power anyway because by its very nature, security research is not secret. You're really just encouraging…

[flagged]

Re: We got admin access to Baseten's production GitHub

#119

Post by fn-mote »

jiggawatts wrote: post #71
devy wrote: post #68

Earlier quoted context omitted.

This is probably still considered standard response timeline, not a rapid one. The time window allowing for CVEs + Vulnerabilities remediation has been collapsing to days and hours perhaps even minutes[1]. Anyone who has an OpenRouter account can start using Strix + GLM 5.3 Flash to do damages at frontier Mytho 5 level cyber capabilities. [2] This cyber patching race is on, won't stop until all the software created f…

Meanwhile I have customers running legacy web apps last compiled over five years ago on end-of-life operating systems… and it’s crickets chirping. Dead quiet, not even a hint of an attack, let alone a breach. I expected them to have been hacked to pieces by now, but even “maximally vulnerable” internet-facing apps seem to be relatively unmolested so far. Maybe it’s still too expensive to go after “boring” enterprise…

> it’s still too expensive to go after “boring” enterprise targets?

The economic argument seems convincing to me. I can’t tell what your stance on it is.

You’re the only one that knows the value of these targets, but “not worth it” seems likely to me.

Re: We got admin access to Baseten's production GitHub

#120

Post by lantry »

mschuster91 wrote: post #48

> So Strix enumerated hosts, looked through certificate logs, mapped the full surface. If there is anything that you should do while setting up infrastructure... it is getting rid of single-host SSL certificates. If you're on Amazon... just let it issue wildcard certificates and place an ALB in front of hosts that terminates the SSL connection. The very second a subdomain appears in any of the CT logs directly, you'v…

> Besides, one repository holding all the IaC stuff? That just sounds like hour long `terraform refresh` sessions.

If it is terraform, then typically it's split up into multiple "root modules" which get planned and applied separately, even though it's all in one repo.

Post reply on HN