Thread

I asked Meta’s Muse for its filesystem and it sent me 6.8GB

356 points · 170 comments · Aeroi

rwmj · 1790091370 · focus · HN ↗
Seriously, no bug bounty for that? For exfiltrating the entire content of the system?
1. amluto · 1790091648 · focus · HN ↗
  This seems like it’s barely a bug. Of course the files in the agent environment are not secret.
  1. rwmj · 1790091874 · focus · HN ↗
    It's also the files and utilities, which tells you the versions, if they contain CVEs, if there are undocumented services running which could be exploited and so on, and as he mentioned also SSH keys (unclear if the private keys, but even public keys are interesting because they can tell you the names of internal developer machines).
    athrowaway3z · 1790094606 · focus · HN ↗
    Its vastly more likely these contain SSH keys of the VM - generated when the user first starts the machine, for just that machine.
    lxgr · 1790197941 · focus · HN ↗
    It's not even running an SSH server unless you ask it to install one. It does seem to come with an SSH client by default and can of course generate its own keypair for that.

Unofficial Hacker News client; not affiliated with Y Combinator.