cross-posted from: https://lemmy.bestiver.se/post/1434334
You must log in or register to comment.
If anybody is interested: distros like Secureblue and Kicksecure (and Kicksecure-based ones like Whonix) reduce attack surface by disabling a bunch of kernel modules, and further harden the kernel via sysctl settings and kernel arguments. Secureblue also sends a notification whenever a system update fixes a vulnerability.
https://secureblue.dev/features
https://www.kicksecure.com/#securityDiscovering nearly one thousand local privilege escalation vulnerabilities consumed $1.2 million USD in API credits.
😅
- 3 days
How can you talk? You’re a sandwich! Clearly these bugs run deeper than we thought…
3 daysit’s a bit odd how openai’s blog post makes it sound like security bugs in Linux fall in two categories, info leak and local privilege escalation. i would guess that they probably did also ask their model to find some RCEs, but they’re selling those to exploit vendors (or perhaps to intelligence agencies directly?) rather than blogging about fixing them.
Alternatively, many of these exploits are dependent on extremely niche situations that are mostly handled by existing safeguards.
I’d be interested to see the actual real world severity of these - are they actually things that could be used in an exploit in any meaningful way?
RCE is substantially more severe, it’s possible there just aren’t as many, as they aren’t as applicable to highly contrived scenarios
- 2 days
If you have ever actually seen the discovery process, you’ll understand that bugs and rce’s don’t just popup on a list from a computer. Sure, you can generate a list of places to start testing, but each of those has to be validated, reproduced, documented and understood before it’s confirmed. It’s not just the discovery of a starting point that constitutes an rce or other vuln, there’s a ton of work that needs to be done by humans also.
So a few bad ones in the news? Sure. A list of 1500 non-validated rces? I’m not holding my breath.
You really have to think critically and let go of the “hacker” sensationalism in infosec, it’s easy to fall into.
Sure, you can generate a list of places to start testing, but each of those has to be validated, reproduced, documented and understood before it’s confirmed
i guess you didn’t actually read the blog post this article links to? The number in the headline (948) is the number of LPE bugs which they say they validated and reproduced and developed exploits (and patches) for.
- 2 days
I did. The article is scant, and the source report is everything bad about ai in the vuln world; high drama, low info. LPEs are not RCEs!
And we don’t know what the exploits are. If it’s a bunch of local jvm consoles or vi escapes into shell where it’s like “oh this could give you root!”, that’s not super useful without knowing if it’s a dumb initial config or an actual use-after-free or other memory exploit.
That’s why we don’t classify manufacturers with bad/no default creds as CVEs, that’s just bad
Like I said, there is a lot of work to do before these become legit, and it almost certainly won’t be 958 exploits after actual professionals review them properly.
And again, stop taking OpenAI at their word about security.
LPEs are not RCEs
They didn’t say they were, the post is very clear about the the 948 vulns they’re talking about being LPE.
If it’s a bunch of local jvm consoles or vi escapes into shell
if it was that, they wouldn’t be “Linux LPEs”. These are clearly kernel bugs they’re talking about.
And again, stop taking OpenAI at their word about security.
OpenAI is full of shit about a lot of things but I doubt they’re lying about having working exploits for these Linux bugs.
- 2 days
I don’t want to belabour the point, but openai also said it’s agents “hacked” hugging face, but that is now documented as very ‘helped along’, so take their claims however you like.
What that tells me is that LLM agents can augment human hackers to perform feets neither could do on their own.
I don’t know why I would then conclude OpenAI is simply lying about even finding exploits. It’s believable that human programmers, using LLMs, have been able to find exploits. They’re going to lie and give more credit to the Wizard than to the man behind the curtain, but that doesn’t mean the exploits themselves aren’t real.
The amount of people who will speak confidently without knowing the full picture is astounding.
- 2 days
948 is an absurd number to bugs to find at one time. i bet most of them are fake. i’ve seen the “bugs” AI likes to find
Tell me you haven’t read the article without telling me you haven’t read the article.
- 16 hours
indeed i haven’t, because the title is such absolute bullshit and AI propaganda that there’s no point entertaining it.
- 2 days
I do not trust AI. We’ve seen too many mishaps from it. That technology is too early for us to truly comprehend. And now… AI is finding all sort of things wrong with Linux which has been running darn near perfect for how many years now not counting system upgrades over hat is. Then again…I’m no programmer so I could be out in left field.
- 2 days
Pretty much finding these kind of errors ARE what vibecoding is good for, AI is pretty good at repetitive tasks like reimplementations,de/recompilations and similar which needs dinamic automation,cybersecurity is one of those matters where AI is pretty good at.
- 21 hours
My apologies if I have insulted your deep professional knowledge in this matter…
Something else AI’s ruining…
can you explain what you mean by this? are they ruining linux by revealing its bugs at a much faster rate? or ruining the security research field by depriving researchers of the challenge and enjoyment of finding these bugs themselves?
repeating myself from a previous thread: of all the things i hate about LLMs, getting vulnerabilities in important software like linux discovered and fixed is not one of them
(although, as i said elsewhere in this thread, i find it unlikely that openai is actually disclosing all of the bugs they find 😬)
