Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we rooted Copilot

research.eye.security

Post reply on HN
Print view View original

91–100 of 147 posts

Re: How we rooted Copilot

#91

Post by stogot »

0xbadcafebee wrote: post #78
simonw wrote: post #8

OK, I think I understand what this is about: the vulnerability that they reported (and Microsoft fixed) is that there was a trick you could use to run your own code with root privileges inside the container - when the system was designed to have you only execute code as a non-root user. It turned out not to really matter, because the container itself was still secured - you couldn't make network requests from it and…

I have to give Microsoft props here. Most companies don't bother to lock things down well enough, but they were thorough.

I would give the one engineer the credit for doing things better, not Microsoft. Microsoft overall culture of security is terrible. Look at the CISA report.

Re: How we rooted Copilot

#92

Post by thfuran »

ajross wrote: post #90
thfuran wrote: post #26

Earlier quoted context omitted.

But a $5 wrench isn't a critical security vulnerability just because someone somewhere might one day find the right person to apply it to to extract important credentials.

Not really the right metaphor. A $5 wrench isn't a "vulnerability" because it's $5! Tools that are accessible to everyone are part of the threat model, not something you can eliminate or avoid. This trick is novel and new. Like, consider your personal cult was built around an "unopenable" bolt-tighted box. Then someone invents the wrench in an attempt to open it. That would be a clear "security vulnerability", right?

Not a serious one if all the wrench actually gets you is access to the room that contains the box that no known tool can open, which is a closer analogy to what happened.

Re: How we rooted Copilot

#93

Post by stevage »

simonw wrote: post #8

OK, I think I understand what this is about: the vulnerability that they reported (and Microsoft fixed) is that there was a trick you could use to run your own code with root privileges inside the container - when the system was designed to have you only execute code as a non-root user. It turned out not to really matter, because the container itself was still secured - you couldn't make network requests from it and…

It seems weird to me that copilot sometimes refuses to execute code but sometimes allows it. What exactly are they aiming for?

Re: How we rooted Copilot

#94

Post by blastonico »

MattGaiser wrote: post #84
blastonico wrote: post #71

Earlier quoted context omitted.

Oh boy, this really seems to be hallucination. Guys, chatbots are mostly token generators, they don't run programs e give you responses...it's not a simple shell program, it computes things in GPU and return tokens, in which are translated back to English.

This is very out of date. They now often trigger tooling and return the outputs of the tooling.

Not really. You're referring to agents, but the model doesn't always require agents, and the public chatbot is not connected to a shell freely evaluating arbitrary commands.

Re: How we rooted Copilot

#95

Post by kenjackson »

stogot wrote: post #91
0xbadcafebee wrote: post #78

Earlier quoted context omitted.

I have to give Microsoft props here. Most companies don't bother to lock things down well enough, but they were thorough.

I would give the one engineer the credit for doing things better, not Microsoft. Microsoft overall culture of security is terrible. Look at the CISA report.

What CISA report?

Re: How we rooted Copilot

#96

Post by ajross »

thfuran wrote: post #92
ajross wrote: post #90

Earlier quoted context omitted.

Not really the right metaphor. A $5 wrench isn't a "vulnerability" because it's $5! Tools that are accessible to everyone are part of the threat model, not something you can eliminate or avoid. This trick is novel and new. Like, consider your personal cult was built around an "unopenable" bolt-tighted box. Then someone invents the wrench in an attempt to open it. That would be a clear "security vulnerability", right?

Not a serious one if all the wrench actually gets you is access to the room that contains the box that no known tool can open, which is a closer analogy to what happened.

Again, though, you're taking "all that gets you" as a prior when (abandoning the metaphor) container and VM escapes are routine vulnerabilities. They just weren't the subject of this particular team who wanted to hack on AI. You don't do security analysis by presuming the absence of vulnerabilities!

Modern security is defense in depth. The AI pre-prompting setup was the first layer, and it was escaped. The UID separation inside the container was another, and it was broken. The container would have been next. And hopefully there are network firewalls and egress rules on top of that, etc... And all of those can and have failed in the past.

Re: How we rooted Copilot

#98

Post by simonw »

worik wrote: post #86
simonw wrote: post #18

Earlier quoted context omitted.

If they had found and reported a container breakout I expect they would've got a bug bounty from it! Are there any known unfixed container breakouts at the moment in the kind of systems Microsoft are likely to be using here?

> they would've got a bug bounty from it! Why do you think that, rather than get sued? I am curious

Microsoft have a bug bounty program which is credible and well run.

Suing people who responsibly disclose security issues to you is a disastrous thing to do. Word spreads instantly and now you won't get any responsibly disclosed bug reports in the future.

Microsoft are way too smart to make that mistake.

Re: How we rooted Copilot

#99

Post by aspenmayer »

kenjackson wrote: post #95
stogot wrote: post #91

Earlier quoted context omitted.

I would give the one engineer the credit for doing things better, not Microsoft. Microsoft overall culture of security is terrible. Look at the CISA report.

What CISA report?

I’m guessing they mean this one:

https://www.cisa.gov/news-events/bulletins/sb25-167

> Microsoft--Microsoft 365 Copilot

> Description Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

> Published 2025-06-11

> CVSS Score 9.3

> Source Info CVE-2025-32711

https://www.cve.org/CVERecord?id=CVE-2025-32711

And maybe they are referring to this engineer from the linked advisory notes?

https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

> Acknowledgements

> Arantes (@es7evam on X) with Microsoft Aim Labs (Part of Aim Security)

Re: How we rooted Copilot

#100

Post by [deleted] »

0xbadcafebee wrote: post #78
simonw wrote: post #8

OK, I think I understand what this is about: the vulnerability that they reported (and Microsoft fixed) is that there was a trick you could use to run your own code with root privileges inside the container - when the system was designed to have you only execute code as a non-root user. It turned out not to really matter, because the container itself was still secured - you couldn't make network requests from it and…

I have to give Microsoft props here. Most companies don't bother to lock things down well enough, but they were thorough.

[deleted]
Post reply on HN