Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we rooted Copilot

research.eye.security

Post reply on HN
Print view View original

51–60 of 147 posts

Re: How we rooted Copilot

#51

Post by pinoy420 »

ChuckMcM wrote: post #43

So am I just missing something or could you create a network connection to the "outside" world (clearly by finding your way around the local network? Start fuzzing the router endpoint, Etc. Or is Microsoft able to provide these containers where their customers can get root access to them without them having any risk of exfiltration or exploitation?

Back when openai released python interpretation it was trivial to do what they did there. There was no open network access, the only thing of interest was a little insight in to how their developers program. A couple of internal configuration files.

This is literally the same.

Re: How we rooted Copilot

#54

Post by nicce »

n2d4 wrote: post #10
bramhaag wrote: post #4

> We reported the vulnerability to Microsoft in April and they have since fixed it as a moderate severity vulnerability. As only important and critical vulnerabilities qualify for a bounty award, we did not receive anything, except for an acknowledgement on the Security Researcher Acknowledgments for Microsoft Online Services webpage. I guess it makes sense that a poor little indie company like Microsoft can't pay bu…

The important part: > Now what have we gained with root access to the container? > Absolutely nothing! > We can now use this access to explore parts of the container that were previously inaccessible to us. We explored the filesystem, but there were no files in /root, no interesting logging to find, and a container breakout looked out of the question as every possible known breakout had been patched. I'm sure there a…

Severity is based on impact. What was the impact here beyond single container and that specific user instance? Feels like moderate was okay, or even too high.

Re: How we rooted Copilot

#55

Post by Disposal8433 »

hombre_fatal wrote: post #27
citizenpaul wrote: post #21

Earlier quoted context omitted.

I'll never understand why people do free dev work for multinational trillion dollar conglomerates.

Could say the same thing about open source software.

No, we can't say. I'm not an asshole, it helps people, and companies shun GPL licenses. That's not a valid comparison. Microsoft can go fuck itself, people around me love my software and it improves their lives.

Re: How we rooted Copilot

#56

Post by jimbokun »

citizenpaul wrote: post #21
bramhaag wrote: post #4

> We reported the vulnerability to Microsoft in April and they have since fixed it as a moderate severity vulnerability. As only important and critical vulnerabilities qualify for a bounty award, we did not receive anything, except for an acknowledgement on the Security Researcher Acknowledgments for Microsoft Online Services webpage. I guess it makes sense that a poor little indie company like Microsoft can't pay bu…

I'll never understand why people do free dev work for multinational trillion dollar conglomerates.

Well a lot of people do this kind of work to be able to commit crimes.

Re: How we rooted Copilot

#57

Post by tptacek »

Disposal8433 wrote: post #55
hombre_fatal wrote: post #27

Earlier quoted context omitted.

Could say the same thing about open source software.

No, we can't say. I'm not an asshole, it helps people, and companies shun GPL licenses. That's not a valid comparison. Microsoft can go fuck itself, people around me love my software and it improves their lives.

It's... 100% a valid comparison? The point is that doing free vulnerability research isn't irrational, not that doing open source work is bad. You're twisting yourself into a pretzel trying to keep the original argument alive.

Re: How we rooted Copilot

#58

Post by tptacek »

simonw wrote: post #18
ajross wrote: post #15

Earlier quoted context omitted.

In the modern world vulnerabilities are stacks. Asserting that "the container itself was still secured" is just a statement that the attackers didn't find anything there. But container breakouts and VM breakouts are known things. All it takes is a few mistakes in configuration or a bug in a virtio driver or whatever. This is a real and notable result.

If they had found and reported a container breakout I expect they would've got a bug bounty from it! Are there any known unfixed container breakouts at the moment in the kind of systems Microsoft are likely to be using here?

Almost certainly yes, since at that point all you're looking for is a Linux kernel LPE.

Re: How we rooted Copilot

#59

Post by tptacek »

hayleox wrote: post #30

It's wild how easy this was. I feel like we're really in the wild west era of security with these AI tools -- reminds me of early Web 2.0 days, like when "samy is my hero" hit and Myspace didn't even have a security team. I anticipate many high-profile incidents before they figure out how to tame this beast.

I don't think there's really much "AI" involved in this; this is basically like breaking any hosted code IDE. I get that an LLM was the direct vector, but the underlying security issue is common to everything that runs remote code.

Re: How we rooted Copilot

#60

Post by nicce »

hnthrow90348765 wrote: post #32
citizenpaul wrote: post #21

Earlier quoted context omitted.

I'll never understand why people do free dev work for multinational trillion dollar conglomerates.

It's still good for reputation. This is by a researcher at a company, so a benefit for both of them. Plus if we didn't have bug bounty programs, they'd have to willingly work at Microsoft to do this research.

This could have turned badly in terms of reputation if they had tried to complain that the vulnerability should be critical, e.g. or using other ways to seek attention for not getting bounty, but current way was rather neutral way.
Post reply on HN