Today in InfoSec Job Security News:

Petr Tesařík

@etchedpixels Bug bounties? You know nothing about business…
You set up a giant scam tool, let venture capital pay for its development, then use it to hack the world and sell all of it:

license the tool,
hacked applications,
vulnerability scanning,
protection racket from affected companies.

That' how real capitalists do business.
@GossiTheDog

John Lusk

@etchedpixels @GossiTheDog

Gahhh. Takes a little effort to imagine LESS rewarding work.

Keith Lawson

@GossiTheDog This was literally the first major security mistake I made in my early days as a Perl developer and I don't imagine it's that uncommon. Claude has probably been trained with a truckload of code with these vulnerabilities.

That's okay because we run everything in single-purpose Docker containers now though, right? /s

Rachel

@GossiTheDog@cyberplace.social I wonder across the industry how common is it for orgs to skip static code analysis, or other code vulnerability scans as part of their pipelines? Even then how many of those scans are actually effective?

Looks like AI is potentially an insider threat, and code generated by it has to be treated accordingly, even in the case of it being generated by project members and "reviewed"

Bradley

@da_667 @GossiTheDog

spinnyspinlock

@GossiTheDog I see it, could probably start a threat intelligence business off the claude feed ‍️

Eric Likness

@GossiTheDog

That Claude is a "clod", and boy does Claude get around I tell ya'.

Claude is everywhere you want an exploit to be.

fuzzyfuzzyfungus

@draeath @badsamurai @da_667 @GossiTheDog That's what amazes me about the "hallucinated citations" stories. Making bots not hallucinate is certainly not readily feasible, quite possible infeasible in practice; but just checking citations one at a time for existence would have been cutting edge in maybe the 1960s. Why is anyone skipping such trivial cleanup steps when using a known-unreliable tool?

claudex

@GossiTheDog in a few months, the user creation and password management will be a solved problem, every software will have a semi-public backdoor that everybody will use

kpcyrd 🏴

@GossiTheDog what was the vulnerability you found in those search results over and over? I only get html and css stuff when I click that link.

B'ad Samurai 🐐🇺🇦

@draeath

These MFers yeet DIRFT (Do it right the first time) and TQM principles to play hooky on the plinko and demand you call them a genius.

@da_667 @GossiTheDog

Anthony

@GossiTheDog@cyberplace.social An instance of eating the seed corn, I'd say ( https://buc.ci/abucci/p/1705679109.757852 ).

Klaus Frank

@GossiTheDog can you please post this also over on LinkedIn for all of the corporate people and CEOs to see?

We can't highlight how much of a liability generator all of this is...

Ron Bowes

@badsamurai @da_667 @GossiTheDog Hey, as somebody writing a CTF, it's handy to get randomly introduced vulnerabilities!

Klaus Frank

@cR0w @GossiTheDog

Well I guess this must be what they meant by the saying "only idiots don't learn anything from their failures and smart people even learn from the failures of others, not just their own."

#quote

Dusk to Don :raccoon:

@fennix @GossiTheDog

I'd invite anyone to enjoy the collection of content at #directoryTraversalMemes

(with @cR0w being a delightful contributor)

E.g.
https://infosec.exchange/@cR0w/115663258594893751

Josh Bressers

@hughsie @GossiTheDog It’s the circle of life. Extra points if the fix has new vulnerabilities in it!

Manni

@draeath @nihkeys @DJGummikuh @GossiTheDog not if you want to understand the system.
https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does

Triv

@spinnyspinlock@infosec.exchange @GossiTheDog@cyberplace.social If github lists claude (or other LLMs) as one of the top contributors I consider that a red flag

Kyle

@GossiTheDog which framework?