Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we rooted Copilot

research.eye.security

Post reply on HN
Print view View original

41–50 of 147 posts

Re: How we rooted Copilot

#41

Post by CharlesW »

blendergeek wrote: post #39
CharlesW wrote: post #37

Earlier quoted context omitted.

This may be a misconception. "Free software" (e.g. Linux) also benefits billion-dollar corporations and "open source" also benefits all mankind.

Free software and open source are two ideologies for the same thing. Free Software is the ideology of developing the software for the benefit of mankind (it's sometimes termed a "political" stance but I see it as an ethical stance). Open source is the ideology of saving money at a corporation by not paying the developers. Sure open source can benefit mankind but will only develop corporate software for money. When de…

I applaud your choice! I just can't think of any free software examples that don't also benefit corporations.

Re: How we rooted Copilot

#42

Post by dylan604 »

hombre_fatal wrote: post #27
citizenpaul wrote: post #21

Earlier quoted context omitted.

I'll never understand why people do free dev work for multinational trillion dollar conglomerates.

Could say the same thing about open source software.

I know maintainers of projects have been hired directly by companies using their code as it is the most expedient way forward. Others might just offer up enough money to get the maintainer to take up a few of their specific issues/requests in a way that makes it worth their while. Just because someone is working on a project that is open source does not mean that money cannot be involved in the development. The company paying that money knows that the updates released as a normal part of the project will be available to anyone else using it as well.

Re: How we rooted Copilot

#43

Post by ChuckMcM »

So am I just missing something or could you create a network connection to the "outside" world (clearly by finding your way around the local network? Start fuzzing the router endpoint, Etc. Or is Microsoft able to provide these containers where their customers can get root access to them without them having any risk of exfiltration or exploitation?

Re: How we rooted Copilot

#44

Post by bramhaag »

n2d4 wrote: post #10
bramhaag wrote: post #4

> We reported the vulnerability to Microsoft in April and they have since fixed it as a moderate severity vulnerability. As only important and critical vulnerabilities qualify for a bounty award, we did not receive anything, except for an acknowledgement on the Security Researcher Acknowledgments for Microsoft Online Services webpage. I guess it makes sense that a poor little indie company like Microsoft can't pay bu…

The important part: > Now what have we gained with root access to the container? > Absolutely nothing! > We can now use this access to explore parts of the container that were previously inaccessible to us. We explored the filesystem, but there were no files in /root, no interesting logging to find, and a container breakout looked out of the question as every possible known breakout had been patched. I'm sure there a…

  > a container breakout looked out of the question as every possible known breakout had been patched
This is the part that concerns me. It only encourages an attacker to sit on an exploit like this until a new container breakout is discovered.

Re: How we rooted Copilot

#45

Post by eastbound »

blendergeek wrote: post #31
hombre_fatal wrote: post #27

Earlier quoted context omitted.

Could say the same thing about open source software.

It's why I don't understand why people believe in "open source". Why would I contribute free dev work to a billion dollar corporation? I do believe in "Free Software" which is contributing free dev work to my fellow man for the benefit of all man mankind.

> Why would I contribute free dev work to a billion dollar corporation?

The billion dollars company contributed more to your startup than you do to them. Microsoft provides:

- VSCode,

- Hosts all NPM repositories. You know, the ones small startups are too lazy to cache (also because it’s much harder to cache NPM repositories than Maven) and then you re-download them at each build,

- Typescript

Re: How we rooted Copilot

#46

Post by dataviz1000 »

baxtr wrote: post #6
varispeed wrote: post #2

Earlier LLMs used to be a goldmine for company secrets (when it learned documents that shouldn't be on public internet). Most of it seem to be scrubbed now.

In my humble experience company secrets are mostly useless for other companies.

This reminds me of that one time after working at a company for 4 months they informed me they were in a middle of an IP lawsuit which is part of the reason they hired me to rewrite the front end without knowing that was going on. That was f*(ked for reasons.

Whatever the case, the only time people look at your social media history is to look for attacks and the only reason they will look at a company's slack messages and emails are to look for attacks during discovery.

I would argue that company secrets are mostly useless for the company but very, very useful to other companies. For this reason, there should be retention policy of a day or two for almost all communication unless it is important, required by law, or documentation. And, definitely do not share that information with the public without good reason.

Re: How we rooted Copilot

#48

Post by pastage »

SoftTalker wrote: post #20
reaperducer wrote: post #13

Earlier quoted context omitted.

At most of the companies I've worked, low-grade managers love to hoard secrets. It makes them feel powerful. Someone gets promoted from Lower Level Manager Grade 4 to Lower Level Manager Grade 5 and they feel all "Oooh! Look at the new things I know!" My mother-in-law is like this with knowing what various relatives are doing. Being the gatekeeper of knowledge gives her imagined power. I guess it's just part of the h…

Why limit it to low-grade managers? I know sysadmins and programmers who behave exactly they same way. They could give you permission or a script to do the thing you need to do but they'd rather have you come to them and ask them to do it. Gives them a sense of purpose, I guess.

Being such a person that fixes lots of stuff for other people nothing I do is secret but learning to do it seems too hard for most. What I do is try to delegate if I find people that do want to learn.

If someone shows me they are good at something they are going to have to expect being sent trickier problems.

Sometimes it might seem like I keep things a secret. I am probably just having a bad day.

Re: How we rooted Copilot

#50

Post by pharrington »

hombre_fatal wrote: post #27
citizenpaul wrote: post #21

Earlier quoted context omitted.

I'll never understand why people do free dev work for multinational trillion dollar conglomerates.

Could say the same thing about open source software.

It's called "I use the software, I already want to improve the software I'm using, so after I improve it I'll contribute the improvements I've already made to the broader community."

Granted, I myself have been guilty of not giving back to the open source community this way in the past, but I won't pretend that was reasonable or ethical of me!

edit: after reading some commemnts, i realize i may have meant to say "free software" instead of "open source"

Post reply on HN