Thread

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

491 points · 208 comments · Handy-Man

kerenskiy · 1789703213 · focus · HN ↗
$6 500 bounty for this is a joke. The black market price would be smth like $6 500 000 or more
1. tptacek · 1789703827 · focus · HN ↗
  There is probably no black market for this at all.
  <a href="https://news.ycombinator.com/item?id=43025038">https://news.ycombinator.com/item?id=43025038
  1. [deleted] · 1789704275 · focus · HN ↗
    [deleted]
  2. parhamn · 1789704678 · focus · HN ↗
    > Valuations for server-side vulnerabilities are low, because vendors don't compete for them.
    Why don't they?
    devmor · 1789705902 · focus · HN ↗
    Because as soon as they are patched, they are worthless.
    People pay for vulnerabilities because they want to exploit them - if there’s a limited window, there’s limited demand.
    Even if there’s something worth a lot behind the exploit, a potential criminal would be better off obtaining whatever that is and selling it instead.
  3. kerenskiy · 1789704736 · focus · HN ↗
    Okay, then first download all their sources (perhaps with model weights?) and sell that. Not the bug itself
    tptacek · 1789705049 · focus · HN ↗
    Now you're not selling a vulnerability, you're planning a heist. That is a thing you can do!
  4. lbrandy · 1789709199 · focus · HN ↗
    You and I have both been here on HN nearing 20 years and you’ve been making this comment to that comment about bug bounties and the supposed black market value of exploits for the whole time. I suspect you’ll never run out of threads to correct. Thank you for your service.
  5. Mohansrk · 1789714965 · focus · HN ↗
    curious, the bug allows dumping private repositories of openai, that sure has black market right?
    akerl_ · 1789734837 · focus · HN ↗
    What criminal enterprise does getting private OpenAI repos fit into?

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.