Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keylogger discovered in image generator extension

old.reddit.com

Post reply on HN
Print view View original

61–70 of 102 posts

Re: Keylogger discovered in image generator extension

#61

Post by creata »

StressedDev wrote: post #58
tamimio wrote: post #25

Lesson for the people who run and execute stuff without looking at the code first.

Everyone runs code they have not inspected. For example, almost no one has read all of the code of in FreeBSD, Linux (kernel), MacOS, Open BSD, or Windows. I also doubt people are reading all of the code in their favorite Linux distribution. Even inspecting the code is not enough because a lot of security vulnerabilities are not obvious. Basically, security is hard, and often there are not a lot of good solutions. He…

> For open-source software, use software from popular projects which have a good reputation.

On this topic, how much should a person trust central repositories of well-known operating system distributions (e.g. Arch, Debian)? I know only trusted people can upload to them, and the only time I've ever heard of malware slipping past them was XZ, but I don't know how much care they take.

Re: Keylogger discovered in image generator extension

#62

Post by wisemang »

creata wrote: post #54

Why does there seem to be such a disregard for security in deep learning? There's examples like this post, but also, until recently, almost every deep learning model was literally distributed as a pickle file.

"Security is not my field, I'm a stats guy": a qualitative root cause analysis of barriers to adversarial machine learning defenses in industry [0]

[0] https://dl.acm.org/doi/abs/10.5555/3620237.3620448

Re: Keylogger discovered in image generator extension

#64

Post by creata »

nsingh2 wrote: post #17
Retr0id wrote: post #15

Earlier quoted context omitted.

Aside from not using passwords or using 2FA, sandboxing helps. A VM with GPU passthrough set up would be one example (although this is usually a pain to set up and I expect most people aren't doing it). As a more user-friendly example, if you install an iOS app (local-model LLM and image generation apps exist), the sandboxing provided by the OS ought to be more than enough to prevent keyloggers, short of 0day exploit…

Not as secure as VMs but GPU passthrough with Docker/Podman is much easier to set up, and you can even use the GPU on the host machine at the same time.

Are you giving it access to /dev/dri, or doing some fancier sandboxing?

(Would you even need anything fancier? I think /dev/dri is supposed to isolate users.)

Re: Keylogger discovered in image generator extension

#65

Post by chx »

creata wrote: post #54

Why does there seem to be such a disregard for security in deep learning? There's examples like this post, but also, until recently, almost every deep learning model was literally distributed as a pickle file.

It's not specific to deep learning, practically every industry will look at security as a cost just not worth it. When we start throwing the CEO into jail instead of making them pay a 18.5M fine for losing the data of 41 million customers that's when things will change. Until then, it's just the cost of doing business.

Re: Keylogger discovered in image generator extension

#66

Post by badrunaway »

what can be done to stop all this? We need some sort of OS level layer to validate these things. If we put a local LLM which checks the bytecode of things which are getting installed/running for security = will that solve all this? My heart goes out to those who must have lost their money due to this.

Re: Keylogger discovered in image generator extension

#67

Post by creata »

badrunaway wrote: post #66

what can be done to stop all this? We need some sort of OS level layer to validate these things. If we put a local LLM which checks the bytecode of things which are getting installed/running for security = will that solve all this? My heart goes out to those who must have lost their money due to this.

One basic measure (one part of a solution) would be to split Comfy into two parts: the part that does all the work (running plugins, generating images) should have access to nothing but read-only access to the files it needs, the GPU, and a socket to communicate with the other part.

Re: Keylogger discovered in image generator extension

#68

Post by KennyBlanken »

badrunaway wrote: post #66

what can be done to stop all this? We need some sort of OS level layer to validate these things. If we put a local LLM which checks the bytecode of things which are getting installed/running for security = will that solve all this? My heart goes out to those who must have lost their money due to this.

Well, for one, the keylogger is detected by antivirus programs.

I keep coming across various projects whose executables trigger antivirus programs, and I think that when those triggers happen, "it's fine, don't worry" claims need to be treated with more skepticism.

At the same time, antivirus vendors need to stop being so lazy and using strings and such that are clearly part of an open source program/library for their signatures.

Re: Keylogger discovered in image generator extension

#69

Post by belladoreai »

Seattle3503 wrote: post #63

How do people feel about using docker to prevent this sort of thing? Does it strike the right balance between usability and security?

Well, Docker is great for this as long as you're not one of the unlucky few whose machine is bricked because of Docker. So, mostly yes, I suppose.

Re: Keylogger discovered in image generator extension

#70

Post by FileSorter »

badrunaway wrote: post #66

what can be done to stop all this? We need some sort of OS level layer to validate these things. If we put a local LLM which checks the bytecode of things which are getting installed/running for security = will that solve all this? My heart goes out to those who must have lost their money due to this.

I think this is one of the use cases for a sandboxed WASM plugin system.
Post reply on HN