Thread

1. LoganDark · 1789869728 · focus · HN ↗

   This article is AI generated, but I kinda reject the premise that it's "not all it cracked up to be" just because the agents had reasons to act the way they did & were a result of human error. The hack still happened, it should still be a wake up call, we are going to start seeing this more frequently, and learning to defend against it is going to become more important over time. None of that is challenged by any particular reason for it happening, it still happened and it's still going to happen again.

   Threat models are going to have to start including that IPv4 (or whatever) scanners aren't necessarily going to only be spray and pray anymore, they could have relentless automated models at the other end that will literally dig into the particulars of your infrastructure looking for novel vulnerabilities to exploit. Maybe people will finally start to understand why security by obscurity has never been very reliable.

   1. ozozozd · 1789879471 · focus · HN ↗

      You are not referring to a port scanner, right?

      1. LoganDark · 1789887325 · focus · HN ↗

         I guess. The IPv4 address space is small enough that it's been feasible to scan the entire thing exhaustively for a while now. Before LLMs, a public IPv4 would mostly get automated scripts that try the same things on every address, sometimes depending on what port scans find, yes. But we're going to start seeing more adversaries that have LLMs investigate each individual address to find novel or unique vulnerabilities. You can spray individualized reverse engineering without having to dedicate a real reverse engineer's time to each target. Avoiding the attention of attackers won't be enough to get away with mere security by obscurity.

         1. tancop · 1789905664 · focus · HN ↗

            You can use the same RE tools and run your own agents as a defender. Everything they find helps you harden your setup, to the point there might be no exploitable vulns at all after a couple days of intense red teaming.

            It's not completely bulletproof (unless you do formal verification, another thing LLMs are good at) but the network boundary stops a lot of attack vectors. You can't really do side channel or timing attacks over IP, so all that's left are easier to patch logic bugs.

            1. LoganDark · 1789910687 · focus · HN ↗

               > You can't really do side channel or timing attacks over IP

               Ehh, this has been disproven dozens of times but that's besides the point, I think.

               I absolutely agree that defenders should be using every tool at their disposal to harden their infrastructure. A lot of defenders simply don't do that, and that's always been a shame. I truly hope that this increasing threat leads to better defensive effort. People need to realize they can't just get away with it the same as before.

Unofficial Hacker News client; not affiliated with Y Combinator.