400
Low-skilled attacker used Claude, Codex to breach 14 companies (www.helpnetsecurity.com)
submitted 3 months ago by to c/technology@lemmy.world
85 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 44 points 3 months ago (6 children)

And no-skilled attackers can buy exploits.

Claude helping is insignificant to the story.

The real headline should be:

At least 14 companies' IT security is practically non-existent

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 7 points 3 months ago (4 children)

    It is significant because a random teenager can't google "download exploits" and have them available 5mins later.

    Powerful AI models and agents though are on your fingertips without you even asking.

    Sure, people can buy guns. But what if every person could materialize a chainsaw instead regardless of their skill, maturity, age, or criminal record? 🤔

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 22 points 3 months ago (1 child)

    Random teenagers can absolutely google "download exploits" and have them available, that's pretty much always been the case..

    https://www.exploit-db.com/

    Full disclosure was a thing once upon a time, where exploits and proofs of concept were dumped publicly, forcing companies to fix the issue or be compromised. That's mostly been moved away from in favor of responsible disclosure, giving companies time to patch the issue before it's known publicly.

    Maybe we should be moving back to full disclosure to force these companies to take data security seriously. Or at least then we could point to a known vulnerability as proof the company is shitty and is neglecting their infrastructure.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 3 months ago

    Sometimes I read stories of how reading web page source code is tried to be presented as hacking in order to not actually do anything for security, and of white hats sued for doing their job, and think that there are plenty of targets even for someone without exploits or LLMs

  • permalink
  • fedilink
  • source
  • parent
  • [–] 5 points 3 months ago (1 child)

    Teenagers are definitely able to find exploits via google in 5 if they're motivated.

    Buying a disassembled ak-47 on post order and having it shipped to your address anywhere in the world is also possible.

    Rules only apply to people that care about them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •