- wewbull@feddit.ukEnglish4 hours
My takeaway from stories like this is that it was always really easy to crack in to companies, but most knowledgeable people had better things to do.
- FlashMobOfOne@lemmy.worldEnglish6 hours
I would love to see the term ‘low-skilled’ used more often within the context of LLM’s and the manner in which people use them.
- Tollana1234567@lemmy.todayEnglish11 hours
they fired hordes of tech people, and neglected cybersecurity in many companies. this was bound to happen.
- Croquette@sh.itjust.worksEnglish5 hours
The IT Paradox :
- “Why am I paying IT if everything works”
- “Why am I paying IT if nothing works”
- hayvan@piefed.worldEnglish13 hours
Alternative title: the ubiquitous race for cheapest developers and fastest time to maket leaves everything insecure.
16 hoursscript kiddies wrecking corporate security is funny
prompt kiddies doing it is just depressingAnd no-skilled attackers can buy exploits.
Claude helping is insignificant to the story.
The real headline should be:
At least 14 companies’ IT security is practically non-existent
- eldebryn@lemmy.worldEnglish8 hours
It is significant because a random teenager can’t google “download exploits” and have them available 5mins later.
Powerful AI models and agents though are on your fingertips without you even asking.
Sure, people can buy guns. But what if every person could materialize a chainsaw instead regardless of their skill, maturity, age, or criminal record? 🤔
- 0x0@infosec.pubEnglish15 minutes
Teenagers are definitely able to find exploits via google in 5 if they’re motivated.
Buying a disassembled ak-47 on post order and having it shipped to your address anywhere in the world is also possible.
Rules only apply to people that care about them.
- 9 minutes
- nomy@lemmy.zipEnglish6 hours
Random teenagers can absolutely google “download exploits” and have them available, that’s pretty much always been the case…
Full disclosure was a thing once upon a time, where exploits and proofs of concept were dumped publicly, forcing companies to fix the issue or be compromised. That’s mostly been moved away from in favor of responsible disclosure, giving companies time to patch the issue before it’s known publicly.
Maybe we should be moving back to full disclosure to force these companies to take data security seriously. Or at least then we could point to a known vulnerability as proof the company is shitty and is neglecting their infrastructure.
- LiveLM@lemmy.zipEnglish15 hours
Didn’t think I’d ever side with no script kiddie but at this point fuck it.
If your company can’t be bothered to do the bare minimum in security then yeah I hope the least skilled hacker ever comes along and wrecks it.Thing is, with the latest frontier models, the least skilled person can find a crack in the most secure company around, as long as they can string a few sentences together.
It isn’t about “bare minimum” anymore. All it takes is a single lapse in vigilance from a single employee, and they’re in… and the LLM doesn’t have to pause to figure out what to do next.
- Mika@piefed.caEnglish9 hours
some hacker unleashes malicious AIs to the internet, breaking it apart cause AI keeps finding vulnerabilities in everything and break things faster than humans can fix
corporates build corporate internet and the blackwall, which is AI to fight malicious AIs
Gooooood morning Night City!
Yeah, but an LLM’s arms race isn’t “doing the bare minimum in security”, which is what the poster before was saying.
This is a genuine concern, where whoever has access to the best/most recent/most expensive models can unleash chaos - I’m talking state-sponsored attacks, mega-corp espionage, bored billionaires,…
- MagicShel@lemmy.zipEnglish6 hours
The people you listed were already doing this. The problem is Darrell, the guy who thinks Earth is flat, can also do this.
Meh. When you’re expecting to have to defend against an army battalion, how much of a thread is Darrell the flat-earther and his AR-15?
Because if Darrell is doing damage, you’ve been conquered and didn’t even noticed.
- minfapper@piefed.socialEnglish2 hours
In this analogy Darrell fires an ICBM, because everyone has access to a ton of those for $20/mo.
The overall point is that doing (what used to be) the bare minimum is no longer even close to enough. To be considered adequate, you need super ironclad defense, because even low skilled attackers have access to very powerful weapons.
- Pennomi@lemmy.worldEnglish15 hours
Only for a year or so. Any company still vulnerable after these tools have been out long enough deserve it.
- 13 hours
Most people on lemmy seem to condemn use of LLMs in any way for anything, I wonder what those folks opinion of this stance is - should companies use the tools or not?
- marzhall@lemmy.worldEnglish4 hours
Finding holes in software has employed “fuzzing”, where you send completely random payloads, as a research tactic for quite a while (and it has found exploits). LLMs just seem like “educated” fuzzing, I don’t see why anyone would complain about updating your suite with them.
- ozymandias117@lemmy.worldEnglish7 minutes
As long as they produce a PoC like fuzzing tools, I don’t think anyone is complaining
It’s the theoretical attacks that nearly always turn out to be impossible, wasting time, and making it harder to find the real issues that need investigation that’s the problem with slop reports
- village604@adultswim.fanEnglish13 hours
Cybersecurity is actually one of the few fields that can benefit from AI. There are companies like Horizon3 who are using it alongside their other threat models to do continuous pen testing.
- Chronographs@lemmy.zipEnglish13 hours
Yeah imo the one thing ai is legitimately useful for is finding answers to difficult problems that can be trivially verified as correct.
- 🦄🦄🦄@feddit.orgEnglish10 hours
Gonna take a guess here that what is used in cybersecurity is not LLMs but one of the more useful machine learning applications. Just a nitpick cause today “ai” and “LLM” are sadly synonymous.
- boonhet@sopuli.xyzEnglish9 hours
No, LLMs can definitely be useful for cyber too. It’s the whole reason the US government banned Claude Fable for export.
An LLM can not just try existing exploits like a script kiddy, but with iteration it can try variations and if you know what runs on the server, inspect the source for potential exploits.
They can also look at your setup and say what issues they see (reverse proxy config, etc).
Doesn’t replace an expert, but can be useful for a first pass before you get the highly paid people involved.
- 🦄🦄🦄@feddit.orgEnglish9 hours
You know what, fair enough. I don’t know enough about that particular one.
- DeadDigger@lemmy.zipEnglish13 hours
Well the problem is that for example curl got flooded with generated security reports where only 5% had some true security potential. So your llm will basically flood you with false positives
If 5% of the reports are genuine security vulnerabilities that they wouldn’t have found otherwise, that’s looking like a big win to me, not sure how you see it differently.
- frongt@lemmy.zipEnglish11 hours
The problem is identifying which 5%. Nobody wants to filter that much AI slop.
- 11 hours
If you’re working for a company’s cybersec, that’s your job. And a much preferable one to waiting for an attacker to do it for you.
- frongt@lemmy.zipEnglish36 minutes
Sure, but nobody wants to do that, even at fair pay. Unpaid open source volunteer projects REALLY don’t want to do that, and risk burning out what is typically a solo main dev.
Exactly. If you go through 100 tickets and find 5 real vulnerabilities to patch, that sounds incredibly good…
Bad look for Claude after their vigorous insistence their model can’t be used this way.
Also bad look for the 50 people I get in my inbox telling me AI is completely useless every time I talk about it. These arguments were worthy of entertainment a few years ago but not in 2026.
- Carnelian@lemmy.worldEnglish14 hours
What’s the use here? A random Ethiopian kid doxxing himself while “breaching companies”?
This article reads like yet another sensationalist advertisement for ai. How many people have supposedly now gained the ability to “breach dozens of companies” simply by typing “please” into a text box? Hundreds of millions? How is society still functioning if this is going on?
The reason things haven’t fallen apart is because there’s a lot of devs working a lot more than they used to making sure they’re patching vulnerabilities. Last year if you asked me what portion of my time was spent updating dependencies and responding to reports of vulnerabilities I’d say like 5-10%, this year that’s easily more like 30%
I’m sure not every company is doing this, but depending on the sensitivity of the data the company is holding I’d imagine you’d see similar patterns elsewhere
- richmondez@lemdro.idEnglish10 hours
AI (specifically LLM) isn’t unless unless you need it to be accurate. You don’t need to be accurate to find software vulnerabilities for example, you just need to be able to sift enough of the false positives to be able to identify the real bugs for example.
LLMs are over hyped and being given away below the cost of training and running the models in the hope of getting entrenched then ramping up the costs though.
Fair I agree it’s overhyped. But to be honest the amount I think it’s overhyped continues to decline as its capabilities continue to advance. And we’re at a point now where it is clearly useful for many tasks, even if it’s not appropriate for anything.
Exploit scripts can be bought on the darknet. Or possibly just googled. Claude’s role in this is close to insignificant.
- minorkeys@sh.itjust.worksEnglish13 hours
And this is why they want to know everything we’re doing online at all times.
