Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we rooted Copilot

research.eye.security

Post reply on HN
Print view View original

61–70 of 147 posts

Re: How we rooted Copilot

#61

Post by dns_snek »

SoftTalker wrote: post #20
reaperducer wrote: post #13

Earlier quoted context omitted.

At most of the companies I've worked, low-grade managers love to hoard secrets. It makes them feel powerful. Someone gets promoted from Lower Level Manager Grade 4 to Lower Level Manager Grade 5 and they feel all "Oooh! Look at the new things I know!" My mother-in-law is like this with knowing what various relatives are doing. Being the gatekeeper of knowledge gives her imagined power. I guess it's just part of the h…

Why limit it to low-grade managers? I know sysadmins and programmers who behave exactly they same way. They could give you permission or a script to do the thing you need to do but they'd rather have you come to them and ask them to do it. Gives them a sense of purpose, I guess.

That has an awful lot to do with what "the thing" is. I'm sure there are a few people out there doing it just to feel more important, but often there's a good reason for denying someone access - either it's just a terrible idea to begin with or they don't know you well enough to trust you without someone else (i.e. their boss) specifically requesting it.

I could be off base here about your experience, but I know that some people made the same comments about me when I pushed back on sharing dangerous credentials with inexperienced coworkers. Damned if you do, damned if you don't.

Re: How we rooted Copilot

#62

Post by wkat4242 »

eastbound wrote: post #45
blendergeek wrote: post #31

Earlier quoted context omitted.

It's why I don't understand why people believe in "open source". Why would I contribute free dev work to a billion dollar corporation? I do believe in "Free Software" which is contributing free dev work to my fellow man for the benefit of all man mankind.

> Why would I contribute free dev work to a billion dollar corporation? The billion dollars company contributed more to your startup than you do to them. Microsoft provides: - VSCode, - Hosts all NPM repositories. You know, the ones small startups are too lazy to cache (also because it’s much harder to cache NPM repositories than Maven) and then you re-download them at each build, - Typescript

Meh it depends whether you use those things of course. There's other IDEs, other languages. And Microsoft isn't doing this out of charity. A lot of the really useful plugins are not working on the open source version, so people that use them provide telemetry which is probably valuable. Or they use it as a gateway to their services like GitHub Copilot.

If a mega corporation gives you something for free it's always more beneficial to them otherwise they wouldn't do it in the first place.

Re: How we rooted Copilot

#63

Post by tptacek »

bramhaag wrote: post #44
n2d4 wrote: post #10

Earlier quoted context omitted.

The important part: > Now what have we gained with root access to the container? > Absolutely nothing! > We can now use this access to explore parts of the container that were previously inaccessible to us. We explored the filesystem, but there were no files in /root, no interesting logging to find, and a container breakout looked out of the question as every possible known breakout had been patched. I'm sure there a…

> a container breakout looked out of the question as every possible known breakout had been patched This is the part that concerns me. It only encourages an attacker to sit on an exploit like this until a new container breakout is discovered.

Are you not concerned about all the other platforms that rely on containers as security boundaries between tenants? There are a lot of them.

Re: How we rooted Copilot

#64

Post by victorbjorklund »

blendergeek wrote: post #31
hombre_fatal wrote: post #27

Earlier quoted context omitted.

Could say the same thing about open source software.

It's why I don't understand why people believe in "open source". Why would I contribute free dev work to a billion dollar corporation? I do believe in "Free Software" which is contributing free dev work to my fellow man for the benefit of all man mankind.

Why do basic science which benefits everyone else for free?

Re: How we rooted Copilot

#65

Post by eastbound »

wkat4242 wrote: post #62
eastbound wrote: post #45

Earlier quoted context omitted.

> Why would I contribute free dev work to a billion dollar corporation? The billion dollars company contributed more to your startup than you do to them. Microsoft provides: - VSCode, - Hosts all NPM repositories. You know, the ones small startups are too lazy to cache (also because it’s much harder to cache NPM repositories than Maven) and then you re-download them at each build, - Typescript

Meh it depends whether you use those things of course. There's other IDEs, other languages. And Microsoft isn't doing this out of charity. A lot of the really useful plugins are not working on the open source version, so people that use them provide telemetry which is probably valuable. Or they use it as a gateway to their services like GitHub Copilot. If a mega corporation gives you something for free it's always mo…

So, no OSS contribution is valid unless you are using this very library?

Did Microsoft contribute more to the OSS world, or did the OSS world contribute more to Microsoft? I pardon Microsoft because they have donated Typescript, which is a true civilizational progress. You could say the OSS world has contributed to Microsoft because they’ve given them a real OS, which they didn’t have inner expertise to develop. We’re even.

Now you sound like you have a beef against large companies and would find any argument against them. Some guy once told me that I didn’t increase my employees by 30% out of benevolence, but because I must be an awful employer. See, why else would I increase employees.

This behavior is actively harmful to the rest of the world. You are depriving good actions from a “thank you” and hence you are depriving recipients of good actions from more of them. With this attitude, the world becomes exactly like you project it to be: Shitty.

Re: How we rooted Copilot

#66

Post by wkat4242 »

paulddraper wrote: post #36
bramhaag wrote: post #4

> We reported the vulnerability to Microsoft in April and they have since fixed it as a moderate severity vulnerability. As only important and critical vulnerabilities qualify for a bounty award, we did not receive anything, except for an acknowledgement on the Security Researcher Acknowledgments for Microsoft Online Services webpage. I guess it makes sense that a poor little indie company like Microsoft can't pay bu…

As you’ll see elsewhere, “root” got them literally nothing. They tried but there was nothing to be had.

They didn't find anything they could do with it but that container isn't there for no reason. I agree with the rating but it's nonetheless worrying. You don't leave the house you bought unlocked because there's nothing in it to steal yet.

Re: How we rooted Copilot

#67

Post by wkat4242 »

baxtr wrote: post #6
varispeed wrote: post #2

Earlier LLMs used to be a goldmine for company secrets (when it learned documents that shouldn't be on public internet). Most of it seem to be scrubbed now.

In my humble experience company secrets are mostly useless for other companies.

That's why corporate espionage is a really lucrative industry?

Of course it depends what secrets. 99% will just be internal process drivel and inter departmental bickering but there's some real important stuff in there too.

Re: How we rooted Copilot

#68

Post by wkat4242 »

SoftTalker wrote: post #7
baxtr wrote: post #6

Earlier quoted context omitted.

In my humble experience company secrets are mostly useless for other companies.

Then why are they secret?

Because its hard to define the parts that are really sensitive. At our work people must classify every document but a lot of people choose public for everything because it doesn't enforce any restrictions. So they can just dump it in a folder and share it with the whole company. This is not what we want them to do obviously but people are lazy, don't like to create access lists. But anyway it means we can't rely on the classification. And indicator detection like credit card and social security numbers is far from perfect. A lot of sensitive info will just be text, like about new products being developed. 3D models, code, strategy emails.

Also, if people start rooting around in everything they can take things out of context. If I send a message to my boss that I think that something we're doing is stupid, if that were public it could make some waves even though internally it's inconsequential because I'm a nobody. Also, many documents might have one or two bits that hint to really important information and having them can help finding those

As you probably know, there's tons of information in a multinational and the hardest part is finding the right stuff. This is one of the main tasks I use Copilot for. Also because outlook and SharePoint search are really terrible though. If those actually worked I wouldn't need copilot so much.

Re: How we rooted Copilot

#69

Post by trueismywork »

CharlesW wrote: post #41
blendergeek wrote: post #39

Earlier quoted context omitted.

Free software and open source are two ideologies for the same thing. Free Software is the ideology of developing the software for the benefit of mankind (it's sometimes termed a "political" stance but I see it as an ethical stance). Open source is the ideology of saving money at a corporation by not paying the developers. Sure open source can benefit mankind but will only develop corporate software for money. When de…

I applaud your choice! I just can't think of any free software examples that don't also benefit corporations.

You need to think it in a different manner. When you have AGPL code, then it benefits mankind more than corporations. There's a Harvard report on value of open source to society based on how much money corporations put in.

Today linux is working nicely on desktops (even though it's not the year of linux) and is heavily dominated by corporations. The parts where linux doesn't do well are exactly parts without corporate support.

Software is becoming complex enough that it's not possible for a single company to just even maintain a compiler let alone an office suite. Its perfect ground for either one company having monopoly or an free software (not open source) being a base for masses.

Post reply on HN