1532
Hacking in 1980 vs Hacking in 2024 (lemmy.world)
submitted 2 years ago by to c/programmerhumor@lemmy.ml
113 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 356 points 2 years ago (24 children)

There’s some sort of cosmic irony that some hacking could legitimately just become social engineering AI chatbots to give you the password

  • permalink
  • fedilink
  • source
  • hideshow 24 child comments
    •
  • [–] 230 points 2 years ago (21 children)

    There's no way the model has access to that information, though.

    Google's important product must have proper scoped secret management, not just environment variables or similar.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 21 child comments
    •
  • [–] 113 points 2 years ago (16 children)

    There's no root login. It's all containers.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 16 child comments
    •
  • [–] 52 points 2 years ago (3 children)

    It's containers all the way down!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 12 points 2 years ago (8 children)

    The containers still run an OS, have proprietary application code on them, and have memory that probably contains other user's data in it. Not saying it's likely, but containers don't really fix much in the way of gaining privileged access to steal information.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 19 points 2 years ago (4 children)

    That's why it's containers... in containers

    It's like wearing 2 helmets. If 1 helmet is good, imagine the protection of 2 helmets!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 5 points 2 years ago (2 children)

    The OS in a container is usually pretty barebones though. Great containers usually use distroless base images. https://github.com/GoogleContainerTools/distroless

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 2 years ago (1 child)

    Ah, so there is something even more barebones than Alpine

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 2 years ago*

    Sure, there's also the scratch image, which is entirely empty... So if your app is just a single statically linked binary, your entire container contents can be a single binary.

    The busybox image is also more barebones than alpine, but still has a couple of basic tools.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 9 points 2 years ago (2 children)

    The containers will have a root login, but the ssh port won't be open.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 2 years ago

    Containers can be entirely without anything. Some containers only contain the binary that gets executed. But many containers do contain pretty much a full distribution, but I have yet to see a container with a password hash in its /etc/shadow file...

    So while the container has a root account, it doesn't have any login at all, no password, no ssh key, nothing.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 28 points 2 years ago (1 child)

    It will not surprise me at all if this becomes a thing. Advanced social engineering relies on extracting little bits of information at a time in order to form a complete picture while not arousing suspicion. This is how really bad cases of identity theft work as well. The identity thief gets one piece of info and leverages that to get another and another and before you know it they're at the DMV convincing someone to give them a drivers license with your name and their picture on it.

    They train AI models to screen for some types of fraud but at some point it seems like it could become an endless game of whack-a-mole.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 6 points 2 years ago

    While you can get information out of them pretty sure what that person meant was sensitive information would not have been included in the training data or prompt in the first place if anyone developing it had a functioning brain cell or two

    It doesn't know the sensitive data to give away, though it can just make it up

  • permalink
  • fedilink
  • source
  • parent