Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kimi K3 exploited the latest Redis server

twitter.com

Post reply on HN
Print view View original

71–80 of 106 posts

Re: Kimi K3 exploited the latest Redis server

#71

Post by busssard »

throwaway27448 wrote: post #70
btown wrote: post #6

> this is the first llm that is capable and willing to write an exploit An open-source Kimi is going to have real economic impact (and not only because of its forcing function on frontier labs to indefinitely subsidize their models to meet a race-to-the-bottom market price). Because it's also putting sophisticated zero-day-seeking tools in the hands of script kiddies who can develop and run novel exploits against arb…

Open weight, not open source. There is no way to reproduce the model.

you dont need to reproduce it, if you can finetune it. The alignment in these models is really narrow, it doesnt take many finetuning steps to get out of the alignment basin.

the alignment is not data centric but done after the fact using RL...

Re: Kimi K3 exploited the latest Redis server

#72

Post by [deleted] »

sigmoid10 wrote: post #67
himata4113 wrote: post #31

As wild as this sounds, redis should not exposed to the internet and this appears to be an authenticated RCE. This is similar to claiming that a PSQL query grants code execution when its actually a feature. These systems are typically not tested as aggressively against vulnerabilities of that nature since 10 times out of 10 you have to have access to these systems already. Issues like these are only really an issue i…

>There is a way more interesting telegram RCE that kimi k3 allegedly discovered. Telegram server or client? The client is open source, so I expect any reasonably capable model to find things there sooner or later. But the sever is closed source. Finding an RCE there would be wild for such a model, since it would have to solve a whole bunch of adjacent problems instead of just digesting tons of code.

[deleted]

Re: Kimi K3 exploited the latest Redis server

#73

Post by angry_octet »

illliillll wrote: post #56
angry_octet wrote: post #43

Earlier quoted context omitted.

Sorry but this is simply delusional. We're in an era where creds can be bought in online markets, and redis open source has no default requirement for password complexity. If you can 'shit out endless bugs like this with AFL' then maybe redis isn't fit for purpose. But I think it more likely that it just needs hardening and an end to these laissez faire attitudes.

Maybe share with us one good reason to not treat redis credentials like SSH credentials? > and redis open source has no default requirement for password complexity. Loudly Crying Face Emoji

You mean, like uncontrolled keys that can be used from anywhere and have no lifecycle care? Well at least SSH keys can't be guessed.

Redis suffers from security gatekeeping, where essential features are kept in the paid Enterprise fork, and community security efforts are blocked. So you can use x.509 mutual TLS certificate auth, but the setup is entirely manual. Which means you use long lived certificates, which is worse than hard passwords.

It needs short lived certificates and pinning against endpoints, and logging of endpoints against queries, and logging auth events/origins to the SIEM. If you have that setup then post-auth compromise is more manageable.

Re: Kimi K3 exploited the latest Redis server

#74

Post by throwaway27448 »

busssard wrote: post #71
throwaway27448 wrote: post #70

Earlier quoted context omitted.

Open weight, not open source. There is no way to reproduce the model.

you dont need to reproduce it, if you can finetune it. The alignment in these models is really narrow, it doesnt take many finetuning steps to get out of the alignment basin. the alignment is not data centric but done after the fact using RL...

You can also modify binaries. This doesn't address the benefits of reproduction more than a smidgeon. How can you answer "why the fuck does it work like this" if you can't inspect the process that built it? There's no replacement for "what was this built from?"

Of course, corporate/national investments need some moat, so I don't expect open source models to be competitive for a few years

Re: Kimi K3 exploited the latest Redis server

#76

Post by pixl97 »

sigmoid10 wrote: post #67
himata4113 wrote: post #31

As wild as this sounds, redis should not exposed to the internet and this appears to be an authenticated RCE. This is similar to claiming that a PSQL query grants code execution when its actually a feature. These systems are typically not tested as aggressively against vulnerabilities of that nature since 10 times out of 10 you have to have access to these systems already. Issues like these are only really an issue i…

>There is a way more interesting telegram RCE that kimi k3 allegedly discovered. Telegram server or client? The client is open source, so I expect any reasonably capable model to find things there sooner or later. But the sever is closed source. Finding an RCE there would be wild for such a model, since it would have to solve a whole bunch of adjacent problems instead of just digesting tons of code.

I mean having the client source code can show you a vast number of the API's and their fields which allows you to fuzz the server quite a bit more easily.

Re: Kimi K3 exploited the latest Redis server

#77

Post by alightsoul »

johndough wrote: post #61
walrus01 wrote: post #55

Earlier quoted context omitted.

Kimi K3 is in no way going to fit in 96GB RAM * 16 units (1536GB) unless badly quantized and with a small amount of context.

Why not? The model is 2.8T parameters with native MXFP4, which is 1400GB.

I would figure it needs a lot of kV cache and context size which can be much bigger than the model itself

Re: Kimi K3 exploited the latest Redis server

#78

Post by inigyou »

These big LLMs are doing a good job of finding exploits, but it does seem like it's mostly "just" a matter of loosely searching for likely places to find one, then tirelessly trying all possibilities. They are mostly finding things that a human would find it a human looked at that section of code, but humans don't have time to review the whole code 24/7. I wonder if there are more intelligent ways to scan that would find even more.

Re: Kimi K3 exploited the latest Redis server

#79

Post by inigyou »

busssard wrote: post #71
throwaway27448 wrote: post #70

Earlier quoted context omitted.

Open weight, not open source. There is no way to reproduce the model.

you dont need to reproduce it, if you can finetune it. The alignment in these models is really narrow, it doesnt take many finetuning steps to get out of the alignment basin. the alignment is not data centric but done after the fact using RL...

Yeah, but don't call it open source if it's not.

Re: Kimi K3 exploited the latest Redis server

#80

Post by inigyou »

tough wrote: post #59
yjftsjthsd-h wrote: post #22

Earlier quoted context omitted.

I'm pretty sure the difference is, by definition, whether they're just using tools other people built or they actually understand things and can do it themselves. The script kiddie can be incredibly dangerous if the tool they grabbed off the shelf works.

a script kiddie of the vibe coding present could very well start modifying code without ever reading it when that wasnt true in the past

Yes. Script kiddy capabilities have increased, but the classification still works.
Post reply on HN