Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anonymous GitHub account mass-dropping undisclosed 0-days

github.com

Post reply on HN
Print view View original

361–370 of 407 posts

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#361

Post by blincoln »

TallGuyShort wrote: post #288

This is common in the hype era of AI models that can look for security bugs. An open-source project I used to work on that is basically "distributed code execution as a service" keeps getting reports that the job submission function is a vulnerability. The reporters don't even understand what the project does.

Is the job submission handled securely?

I've seen plenty of systems along the lines of what you're describing where unauthenticated clients can submit jobs. Sometimes the developers even claim that's intentional. Either way, it's a vulnerability, because it compromises the underlying hosts.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#362

Post by blincoln »

bassiee wrote: post #47

I also have a library of bugs I found using Claude Opus 4.8 through the Customer Verification Program. Undisclosed, Atp I dont even know if they have been found by someone else. But just like this repo Theres a bunch of very specific scenario DoS bugs, buffer over/ underflows, that will get caught by ASLR and whatnot When I report serious ones, mostly the devs will respond with something like, yeah, thats how we desi…

> When I report serious ones, mostly the devs will respond with something like, yeah, thats how we designed it in a dangerous way, so that the layer above or below can solve the issues, and other footgun stuff.

This is one of the reasons that responsible disclosure exists. Their tune will likely change after sufficient bad publicity.

If the Apache Solr devs can be convinced to add authentication to their product instead of hand-waving about reverse proxies or other add-ons, anyone can.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#363

Post by wavemode »

unnouinceput wrote: post #71
ok123456 wrote: post #46

Pretty unimpressive as security vulnerabilities. It would be better to just say these are simple bugs for the most part.

all vulnerabilities are just bugs.

No, not all vulnerabilities are bugs. "Bug" implies a system working in a way its creators did not intend, but a system can be working exactly as intended yet have a vulnerability.

For example, if you allow weak passwords, then you have a trivial vulnerability to people guessing other people's passwords. But nothing about the login system is working differently from how anyone intended. It's just that the intentions themselves were naïve.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#364

Post by iamnothere »

zahlman wrote: post #290
jeffbee wrote: post #152

Earlier quoted context omitted.

I mean, that's how people get hacked. If vlc crashed on my computer, and every day I should raise thanks to my gods that I do not use vlc, I would immediately unplug it and thoughtfully consider the circumstances under which it would be safe to turn it back on.

Do you feel the same way about seeing "Segmentation fault (core dumped)" in the terminal from some other arbitrary program? If not, why not?

Because people often use VLC to view untrusted content.

Video is a great vector for distributing malware, especially sought-after grey area content like porn, conflict videos, celebrity leaks, pirated films, etc. Not enough people pay attention to the impact of video as a vector for compromise. All downloaded video should be sandboxed!

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#365

Post by Aurornis »

Manishearth wrote: post #340

I recently used a pretty well-tuned LLM to find ~500 safety bugs across the Rust ecosystem. Most of them are minor, and even major safety issues in Rust usually mean "it's possible to accidentally use this API in a way that is broken" not "this is directly exploitable", but I didn't want to just file LLM output as issues on these repos. I very briefly considered doing something like this: if I just post the results o…

Can you at least provide some links to examples of the issues you’re filing?

I’ve seen so many claims of people who used LLMs to generate hundreds of issues that turned out to be full of hallucinations or non-bugs being described as bugs that any claim like this needs some real evidence. Saying you found 500 safety bugs in Rust but that you’re casually only filing a couple of them makes this hard to believe.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#367

Post by sroussey »

necovek wrote: post #312
midtake wrote: post #146

Earlier quoted context omitted.

You can just download the zip over HTTPS

What if it's leveraging a zero day in your zip or https library?

That would be super interesting to have such a large repo when zipped by GitHub then turn into a malicious file. It would be its own front page story.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#368

Post by sheept »

nonethewiser wrote: post #266
tyre wrote: post #54

Earlier quoted context omitted.

Yes, big pet peeve of the new world. Every em dash is apparently an AI trigger. Back in my day, they were a sign of great respect within my people.

The thing is, in lots of contexts you cant easily type em dashes. Google docs will convert “—-“ to an emdash but simple text inputs wont. So when you see one in that context you have to consider the explanation. They copy pasted an em dash specifically, they drafted in Google docs, they know the unicode keyboard shortcut, etc. None of these are safe assumptions. And if it’s markdown you know it wasnt drafted in Googl…

On Windows and Mac you can input an em dash anywhere with shift+windows+hyphen / shift+option+hyphen, respectively

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#369

Post by cindyllm »

cucumber3732842 wrote: post #358
GTP wrote: post #346

Earlier quoted context omitted.

Nope, it reduces the issue even if it isn't solving it entirely. Without laws and law enforcement, anyone with bigger muscles than you could break your nose just because they feel you looked at them the wrong way.

Physical violence is just about the last area we "need" laws because people really hate violence and will go well out of their way to avoid even the chance being subject to it. No matter how big you are you can't go around breaking noses without a good reason we all agree on because if you do that for very long a bunch of other people will gang up and break yours or worse. To a first order, laws basically just codify…

[dead]

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#370

Post by Folcon »

Retr0id wrote: post #17

I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1... The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise. The second, idk, I'm not familiar with TraceRMI (but it's probably worth noting that "RMI"…

So I've been wondering about whether there's a new vector that can come out of this? Or perhaps new vector isn't the right way of putting it, not a security expert :)

By mass sharing these kinds of gaps and utilising mythos tier LLM's ability to find and combine multiple disparate bits of information together, are we increasing it's capabilities and versatility?

Post reply on HN