3 ms·
A Disney Worker Downloaded an AI Tool. It Led to a Hack That Ruined His Life
- impish9208 2y agoGift link: https://www.wsj.com/tech/cybersecurity/disney-employee-ai-tool-hacker-cyberattack-3700c931?st=8WJAEt https://www.wsj.com/tech/cybersecurity/disney-employee-ai-to...
- ChrisArchitect 2y agoDiscussion about the breach at the time last year: Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data https://news.ycombinator.com/item?id=40955693 https://news.ycombinator.com/item?id=40955693
- Karawebnetwork 2y agoI believe that this is the hack that is being discussed: https://cybersecuritynews.com/comfyui-users-targeted-by-malicious/ https://cybersecuritynews.com/comfyui-users-targeted-by-mali...
- sam345 2y agono paywall: https://archive.is/LY290 https://archive.is/LY290
- sam345 2y agoCan't believe that 1password doesn't enforce multi-factor by default for the online account. They have a secret key which more or less acts a 2nd factor but it looks like in this case they stole the victim's web session which held the key. Could have happened if they had stole the multi-factor session too I guess.
- toomuchtodo 2y agoThey have conditional access capabilities. https://support.1password.com/firewall-rules/ https://support.1password.com/firewall-rules/ (have implemented to attempt to mitigate this vulnerability, but if there is malware active on the device, it will eventually have access to the clipboard or otherwise unencrypted secret)
- mango7283 2y agoIt's one thing to go after Disney as a whole but going after one guy specifically feels like a whole different level of evil.
- xkcd-sucks 2y agoIt's all good, the fine print establishes the real culprit as "free software from popular code-sharing site GitHub"
- mango7283 2y agoI meant the hacker(s)
- alphan0n 2y agoDoes anyone know which repo they’re referring to in the article?
- anxman 2y agoComfyUI
- Lockal 2y agoMaybe ComfyUI_LLMVISION[1] malicious extension then (my speculation based purely on the date of hack). Edit: yes, probably it was ComfyUI_LLMVISION[2] [1] https://www.reddit.com/r/comfyui/comments/1dbls5n/psa_if_youve_used_the_comfyui_llmvision_node_from/ https://www.reddit.com/r/comfyui/comments/1dbls5n/psa_if_you... [2] https://news.ycombinator.com/item?id=40960666 https://news.ycombinator.com/item?id=40960666
- firesteelrain 2y agoThe article glossed over a key detail. He stored his work credentials on his personal 1Password password vault which no one should ever write down nor take passwords home with you. This could have been just a personal thing between him and this hacking group and not involved Disney. On top of that, it seems Disney was allowing single sign on to Slack. My guess it works sort of like LucidChart where it redirects to like Corporate ADFS or single sign on systems. I am not clear if Disney has MFA setup for their employees. My work uses ID Authenticator and it’s on my mobile phone. I don’t know why Disney isn’t using something like Teams. Anyways just guesses on my part
- pwarner 2y agoWould using Teams have made a difference? Other than making it harder to find anything (for users and bad guys)
- firesteelrain 2y agoYes, Teams integrates with Office 365 which gets you DLP. Teams provides stronger security and better security compliance. There a bunch of other “killer” features that Slack is really not equipped for in an Enterprise environment.
- jmchugh9 2y agoeven though it sounds like he was using the AI tool for personal reasons, this highlights the worst case scenario for shadow AI and using free tools.