6 ms·
200k Compromised OpenAI Credentials Available for Purchase on the Dark Web
- jacknews 3y agoOpenAI is STILL "not available" from many countries, so what do they expect - it's not like the latest movie or whatever, it's actually career-limiting not to have access at this point for some professions.
- lee101 3y ago[dead]
- ihaveabeardnow 3y agoI finally created an account today, so I'm probably good
- vuln 3y agoYou’re probably good as long as you don’t install commodity malware on your system.
- deleted 3y ago[deleted]
- heyzk 3y agoI'm curious about the logistics here, what's preventing OAI from obtaining a copy and invalidating those credentials?
- jazzkingrt 3y agowouldn't that reward the seller, and still be potentially costly for OpenAI?
- cafeinux 3y agoAny security researcher wanting to analyze the data (or Troy Hunt wanting to add it to haveibeenpwnd.com) will imply someone rewarding the seller, that's inevitable. The sooner, the less the seller can make on this data.
- jackdh 3y agoLikely cheaper just to force everyone to change their password on login.
- Gigachad 3y agoThat would be pointless since the malware could just grab the new credentials.
- I_am_tiberius 3y agoOpenAI is run like a YC company. That means they do everything not to distract the user from the core workflow. I think privacy and security are just very low priority to them.
- febed 3y agoThis is the only reason I’m hesitant to use GPT4. I’m not sure how safe they can keep my credit card details.
- nickthegreek 3y agoSounds like it wasn’t on openai’s side.
- Eisenstein 3y ago> The stolen OpenAI credentials were stolen using Raccoon Infostealer (78,348), Vidar (12,984), and RedLine (6,773) malware variants. Correct. The credentials were stolen off the client's side and then they were all aggregated into a dump.
- wging 3y agoThis doesn't seem to be a breach of OpenAI at all, though; the article is pretty clear about that.
- fragmede 3y agoOpenAI doesn't ever see your CC number. They use Stripe and so your credit card number is stored with them, not OpenAI. But if you're worried and in the US, a privacy.com card could be used to protect you regardless.
- omeze 3y agoI seriously wonder why, given the Microsoft deal, OpenAI didn't just cede all product development and production-izing of their models to MS while they focus on research. I know smart people work there, some friends included, but OpenAI was never a product-led startup, they were a research org. Ignoring the closed vs open debate for a moment: for all the talk of focus, focus, focus from YC, it seems unfocused to ship their models from a home-rolled platform when they could just get MS to foot the engineering and infra work. Is any of their platform stuff a real asset to OpenAI proper? Have MS do the cloud stuff, just pass them product design. just my 2c from the outside.
- justapassenger 3y agoOpenAI doesn’t make money from research.
- droopyEyelids 3y agoThey dont make money from authentication systems either
- omeze 3y agoYes, hence the MS deal (they had trouble raising money as a pure research org). Their research can be turned into a product people pay for -- they've done it! My question is: why did the engineers at OpenAI have to do that? Why couldn't they "toss it over the fence" to MS's Azure team and be happy with a revenue share, for example.
- justapassenger 3y agoMS didn’t buy them, just invested shit ton of money and got a close partnership. Don’t outsource your money making department to a big tech company. They’ll screw you over, even if they don’t mean to.
- vimy 3y agoChatgpt is programmer art. I don’t think they have actual designers or frontend devs working there. I accidentally deleted my chat history because of the confusing UX.
- mikeodds 3y agoI mean I’d love to be able to actually get access to the GPT4 API
- Ronsenshi 3y agoGPT4 API should be available to all paying customers since early July: https://openai.com/blog/gpt-4-api-general-availability https://openai.com/blog/gpt-4-api-general-availability
- taosx 3y agoTalking about credentials I'm wondering how much they spend on auth0 with their current MAU.
- Eisenstein 3y ago> The stolen OpenAI credentials were stolen using Raccoon Infostealer (78,348), Vidar (12,984), and RedLine (6,773) malware variants. Nothing to worry about unless you had malware on your computer -- sniffing all your data, OpenAI credentials included. It is only news because ChatGPT logs potentially have exploitable data in them. Another misleading headline -- OpenAI has not been compromised.
- vineyardmike 3y ago> It is only news because ChatGPT logs potentially have exploitable data in them. Can you access logs of the chat over the API? I assume it’s just news because it’s a popular business (and everyone was using the API to recreate chatgpt so there were a million projects that could be exploited).
- canadaduane 3y agoIt's kind of vague about how these malware work. Are they keylogging (recording keystrokes as you type the password)?
- cerved 3y agomisleading headline
- bonestamp2 3y agoOut of an abundance of caution, I just went to change my password... and I didn't see a way to change my password. I googled it and you have to log out and then choose "Forgot password?". Hope that saves someone some time.
- midnitewarrior 3y agoThank you very much! I just spent the last 5 minutes in wtf mode trying to find an option to change my password.
- selcuka 3y agoYes, that seems to be auth0's default password change story [1]. It's annoying and not expected from the so-called leader in authentication. [1] https://auth0.com/docs/authenticate/database-connections/password-change https://auth0.com/docs/authenticate/database-connections/pas...
- bonestamp2 3y agoFair enough, but from a usability standpoint they could also have a "Change Password" link in your profile that just sends the same "Forgot Password" email and logs you out.
- I_am_tiberius 3y agoIt's unbelievable.
- uses 3y ago> The stolen OpenAI credentials were stolen using Raccoon Infostealer (78,348), Vidar (12,984), and RedLine (6,773) malware variants. > India occupied the top spot with 12,632 OpenAI credentials listed on the dark web, followed by Pakistan (9,217), Brazil (6,531), Vietnam (4,771), and Egypt (4,588), while the United States was sixth with 2,995 compromised accounts.
- nosmokewhereiam 3y agoSuper botnet ballet. A few dozen could be an annoyance, a thousand could represent enough compute to worry netd. Has anyone written any infosec articles discussing this? Has assimov or the Simpsons poked fun at this as a danger yet?
- riwsky 3y agoDamn. I didn’t even have access to the 32k beta, and now you’re telling me there’s a 200k some folks can access?
- lolinder 3y agoIs there anything interesting about this story besides that it has OpenAI in the headline? I assumed there was a data breach, but no, this is just 200k credentials stolen from people's computers with normal malware. There are billions of credentials available for sale on the dark web. This particular set doesn't seem significant at all besides that anything with OpenAI gets extra clicks these days.
- jmye 3y agoI’m assuming that part of the issue is the crazy amount of internal company data people have been feeding into the thing. Finding your email password might let me see some memos, but if you’re not very thoughtful, you might’ve pushed all sorts of sensitive data into chat prompts. I don’t disagree with your premise otherwise, and grant that I might be racing to begin with.
- werrett 3y agoErr, no. Compromising your email account will for sure be the worst outcome. Everything else, including your OpenAI account, are accessible via that email account + a password reset.
- crimsontech 3y agoBut the credentials are for stolen OpenAI logins, not stolen email logins. While there will be some people using the same password (I doubt many) the people selling them will no doubt have already validated and removed these from the set as they are obviously much more valuable.
- lolinder 3y agoI think they were just responding to OP's dismissal of leaked email credentials as a major threat vector: > Finding your email password might let me see some memos, but ...
- deleted 3y ago
- consumer451 3y agoThis likely explains why I just got a fake "Geek Squad" invoice which claims to have been paid by "auto deduction" to an email account which has never received one single spam email in the 10 years that I have had it.
- fragmede 3y agoGiven that the credentials were stolen by locally running malware, and basically nothing to do with OpenAI, I would.be very worried if I were you right now.
- consumer451 3y agoThat seems unlikely, but I should have read TFA. Hmm, well the only other recent event regarding that email account was that I used it to register on a discord server.