Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keylogger discovered in image generator extension

old.reddit.com

Post reply on HN
Print view View original

91–100 of 102 posts

Re: Keylogger discovered in image generator extension

#91

Post by ASalazarMX »

belladoreai wrote: post #90
jiggawatts wrote: post #89

Earlier quoted context omitted.

Wait… what!? This is the first I’m hearing of this. Do you have any references?

You can find many references by googling some variations of keywords Docker, Windows, brick

Googled that, thanks for not providing clear references to your claims, and found that docker can crash Windows on boot, but not "brick" it. People are still able to safe boot, run system recovery/restore, or even reinstall Windows if they choose.

Besides, bricking software is impossible, bricking refers to physical devices unable to bootstrap anymore.

Re: Keylogger discovered in image generator extension

#92

Post by orbital-decay »

aintnolove wrote: post #76

I peered down the ComfyUI rabbit hole [1] and it is shockingly powerful. Did Adobe drop the ball on image generation? What are they doing over there? There has to be a better, more secure way to bundle up all this imagegen logic. [1] https://learn.thinkdiffusion.com/bria-ai-for-background-remo...

Adobe makes practical pipelines for creatives, not prototyping tools. ComfyUI is mostly for prototyping and ML nerds (I don't mean this in a bad way). There are more practical interfaces to get things done built on top of it, such as Krita Diffusion [1] and many others.

[1] https://github.com/Acly/krita-ai-diffusion

Re: Keylogger discovered in image generator extension

#93

Post by Latty »

microtonal wrote: post #30
Latty wrote: post #11

Earlier quoted context omitted.

Ideally, don't use passwords: Passkeys where supported, SSH Keys, client certificates, social login via a service that does support one of these methods. Magic link emails can also work, but are potentially vulnerable if you copy/pasted it rather than clicking depending on the keylogger's capability and clipboard visibility, although the window for attack is small, it's a much more sophisticated attack that leaves mo…

Ideally, don't use passwords: Passkeys where supported, SSH Keys, client certificates, social login via a service that does support one of these methods. If a process has the privileges to run as a keylogger, it can also grab your local SSH private keys and possibly harvest passwords and passkeys from your local password manager vault [1]. The process has local access and since it is a key logger presumably your mast…

When I talk Passkeys, I definitely mean hardware by default, which is how most websites position it: it's normally described as "set up a passkey for this device" and in practice the vast majority of people using them will be using a fingerprint reader in a laptop or on their phone, because most people don't set up password managers with passkeys.

To me, using a software for passkeys is a hack only power users will do, and yes, I see it as a bad idea.

Right now I believe Yubikeys can do 25 passkeys, which is a pretty low limit, but it offers enough to protect your most important accounts, and right now I doubt many people have more than 25 sites they use that support passkeys (of course, hopefully that goes up quickly).

Re: Keylogger discovered in image generator extension

#94

Post by asveikau »

KennyBlanken wrote: post #68
badrunaway wrote: post #66

what can be done to stop all this? We need some sort of OS level layer to validate these things. If we put a local LLM which checks the bytecode of things which are getting installed/running for security = will that solve all this? My heart goes out to those who must have lost their money due to this.

Well, for one, the keylogger is detected by antivirus programs. I keep coming across various projects whose executables trigger antivirus programs, and I think that when those triggers happen, "it's fine, don't worry" claims need to be treated with more skepticism. At the same time, antivirus vendors need to stop being so lazy and using strings and such that are clearly part of an open source program/library for thei…

If you compile a benign binary yourself which has no malware, Chrome and Windows Defender will flag it as suspicious.

I was hacking on some open source stuff targeting win32, I posted some binaries on GitHub releases, I try to share with others... People tell me it's flagged as malware. It isn't malware. What do I tell them?

I hear code signing helps the heuristics to not get it flagged, but doesn't remove it.

If people working on said software want the warnings to be taken seriously, they should work on reducing false positives.

Re: Keylogger discovered in image generator extension

#95

Post by Timber-6539 »

ASalazarMX wrote: post #91
belladoreai wrote: post #90

Earlier quoted context omitted.

You can find many references by googling some variations of keywords Docker, Windows, brick

Googled that, thanks for not providing clear references to your claims, and found that docker can crash Windows on boot, but not "brick" it. People are still able to safe boot, run system recovery/restore, or even reinstall Windows if they choose. Besides, bricking software is impossible, bricking refers to physical devices unable to bootstrap anymore.

Not exactly. Hard brick is what you are referring to where you need to repair/reset the hardware OEM after corruption.

A soft brick is the actual reference here where you can easily recover from software/re-install.

Re: Keylogger discovered in image generator extension

#96

Post by m463 »

Seattle3503 wrote: post #63

How do people feel about using docker to prevent this sort of thing? Does it strike the right balance between usability and security?

doesn't docker have this weird property where it bypasses your firewall?

https://www.techrepublic.com/article/how-to-fix-the-docker-a...

Re: Keylogger discovered in image generator extension

#97

Post by 8fingerlouie »

m463 wrote: post #96
Seattle3503 wrote: post #63

How do people feel about using docker to prevent this sort of thing? Does it strike the right balance between usability and security?

doesn't docker have this weird property where it bypasses your firewall? https://www.techrepublic.com/article/how-to-fix-the-docker-a...

What about second firewalls ?

Hobbit jokes aside, yes, it pokes holes in the firewall on the machine hosting docker. It generally creates a lot of firewall rules to isolate or permit traffic to/from containers and expose ports.

Your "safest" bet is probably to only expose docker containers on the localhost interface, and use a reverse proxy (Nginx/Traefik/etc) to expose services. At least that's how i did it when i last ran Docker a few years ago.

Re: Keylogger discovered in image generator extension

#98

Post by 486sx33 »

chx wrote: post #65
creata wrote: post #54

Why does there seem to be such a disregard for security in deep learning? There's examples like this post, but also, until recently, almost every deep learning model was literally distributed as a pickle file.

It's not specific to deep learning, practically every industry will look at security as a cost just not worth it. When we start throwing the CEO into jail instead of making them pay a 18.5M fine for losing the data of 41 million customers that's when things will change. Until then, it's just the cost of doing business.

Really? Throw a CEO in jail? This is just as crazy as the whole throw the supervisor in jail if the worker dies mantra in construction.

#1 users are responsible to look after their privacy. If you are using applications that don’t allow this - you need to reject the use of those applications.

#2 this needs to start happening in mass numbers. People need to rise up against these crazy corporate tech companies and their bull

Re: Keylogger discovered in image generator extension

#99

Post by chx »

486sx33 wrote: post #98
chx wrote: post #65

Earlier quoted context omitted.

It's not specific to deep learning, practically every industry will look at security as a cost just not worth it. When we start throwing the CEO into jail instead of making them pay a 18.5M fine for losing the data of 41 million customers that's when things will change. Until then, it's just the cost of doing business.

Really? Throw a CEO in jail? This is just as crazy as the whole throw the supervisor in jail if the worker dies mantra in construction. #1 users are responsible to look after their privacy. If you are using applications that don’t allow this - you need to reject the use of those applications. #2 this needs to start happening in mass numbers. People need to rise up against these crazy corporate tech companies and thei…

Well, we are currently at the "we tried nothing and we are out of ideas" stage so something needs to change.

Re: Keylogger discovered in image generator extension

#100

Post by creata »

486sx33 wrote: post #98
chx wrote: post #65

Earlier quoted context omitted.

It's not specific to deep learning, practically every industry will look at security as a cost just not worth it. When we start throwing the CEO into jail instead of making them pay a 18.5M fine for losing the data of 41 million customers that's when things will change. Until then, it's just the cost of doing business.

Really? Throw a CEO in jail? This is just as crazy as the whole throw the supervisor in jail if the worker dies mantra in construction. #1 users are responsible to look after their privacy. If you are using applications that don’t allow this - you need to reject the use of those applications. #2 this needs to start happening in mass numbers. People need to rise up against these crazy corporate tech companies and thei…

I would love to live in a world where everyone did that. But that's (currently) a utopian pipe dream.

I don't know if throwing CEOs in jail is the answer, but neither is putting all the responsibility on people to make tough choices like "give up my privacy or fall out of touch with my friends" or "give up my privacy or give up the chance to get this job".

Post reply on HN