Thread

Meta’s Muse has a serious 0-day

122 points · 49 comments · pavel_lishin

gavinray · 1790094641 · focus · HN ↗
The "zero day" is something they call a "ClickFix Attack"
Upon Googling "ClickFix":
```
  &gt; &quot;A ClickFix attack is a social engineering technique... It typically compromises devices by manipulating victims into copying and pasting malicious commands directly into system-level tools&quot;
```
I'm sorry, that's not a zero-day, that's idiocy that's as old as time.
1. failbuffer · 1790095123 · focus · HN ↗
  We filed a bug report but the original maintainer seems to have dropped offline. The community's had some success in correcting bugs with low-level hacking, but it's hard to make progress without the source code.
2. theultdev · 1790096806 · focus · HN ↗
  words don't seem to mean anything anymore.
  clickbait headline should be changed, not a 0-day.
  1. lirolero · 1790097614 · focus · HN ↗
    [dead]
3. bigfishrunning · 1790104588 · focus · HN ↗
  Reminds me of playing Runescape back in the late 90s, you could double your money by just pressing alt-F4
4. analog31 · 1790104872 · focus · HN ↗
  Well if nothing else, idiocy that's as old as time started on day zero.
5. bachittle · 1790105486 · focus · HN ↗
  The exploit is a local zero day exploit, meaning the machine needs to already be compromised. For it to be a remote zero day exploit you need to do the ClickFix attack. The idea is that it lets you access much more machines and resources if the one machine with Muse is compromised. More info here: <a href="https://x.com/dps/status/2102248329111634067" rel="nofollow">https://x.com/dps/status/2102248329111634067
6. dspillett · 1790106488 · focus · HN ↗
  > > It typically compromises devices by manipulating victims into copying and pasting malicious commands
  > […] that's idiocy that's as old as time.
  And constantly being reinvented: `curl -sL some.unverified.stuff.sh | bash`

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.