5 ms·

For those of you who don't want to click into linked in, https://hackerone.com/reports/3125832 https://hackerone.com/reports/3125832 is the latest example of a

For those of you who don't want to click into linked in, https://hackerone.com/reports/3125832 https://hackerone.com/reports/3125832 is the latest example of a invalid curl report

nneonneo 1y ago
Good god did they hallucinate the segmentation fault and the resulting GDB trace too? Given that the diffs don’t even apply and the functions don’t even exist, I guess the answer is yes - in which case, this is truly a new low for AI slop bug reports.
- bluGill 1y ago
  An real report would have a GDB trace that looks like that, so it isn't hard to create such a trace. Many of us could create a real looking GDB trace just as well by hand - it would be tedious, boring, and pointless but we could.
  - nneonneo 1y ago
    Oh, I'm fully aware an LLM can hallucinate a GDB trace just fine. My complaint is: if you're trying to use an AI to help you find bugs, you'd sincerely hope that they would have *some* attempt to actually run the exploit. Having the LLM invent fake evidence that you have done so, when you haven't, is just evil, and should be resulting in these people being kicked straight off H1 completely.
    - bluGill 1y ago
      That means doing work. I can get a llm to write up a bugus report in minutes and then whatever value comes frome it. Checking the report is real would take time.
- terom 1y ago
  The git commit hashes in the diff are interesting: 1a2b3c4..d4e5f6a I think my wetware pattern-matching brain spots a pattern there.
  - mitchellpkt 1y ago
    Excellent catch! I had to go back and take a second look, because I completely missed that the first time.
  - terom 1y ago
    Going a bit further, it seems like there's a grain of truth here, HTTP/2 has a stream priority dependency mechanism [1] and this report [2] from Imperva describes an actual Dependency Cycle DoS in the nghttp implementation. Unfortunately that's where it seems to end... I'm not that familiar with QUIC and HTTP/2, but I think the closest it gets is that the GitHub repo exists and has a `class QuicConnection` [3]. Beyond that, the QUIC protocol layer doesn't have any concept of exchanging stream priorities [4] and HTTP/2 priorities are something the client sends, not the server? The PoC also mentions HTTP/3 and PRIORITY_UPDATE frames, but those are from the newer RFC 9218 [5] and lack the stream dependencies used in HTTP/2 PRIORITY frames. I should learn more about HTTP/3! [1] https://blog.cloudflare.com/adopting-a-new-approach-to-http-prioritization/ https://blog.cloudflare.com/adopting-a-new-approach-to-http-... [2] https://www.imperva.com/docs/imperva_hii_http2.pdf https://www.imperva.com/docs/imperva_hii_http2.pdf [3] https://github.com/aiortc/aioquic/blob/218f940467cf25d364890a602b8fc451ca635062/src/aioquic/quic/connection.py#L236 https://github.com/aiortc/aioquic/blob/218f940467cf25d364890... [4] https://datatracker.ietf.org/doc/html/rfc9000#name-stream-prioritization https://datatracker.ietf.org/doc/html/rfc9000#name-stream-pr... [5] https://www.rfc-editor.org/rfc/rfc9218.html#name-the-priority_update-frame https://www.rfc-editor.org/rfc/rfc9218.html#name-the-priorit...
  - 3abiton 1y ago
    This is a whole new problem open source project will be facing. AI slop PR and Vulnerability reports, which will be only solved using AI tools to filter through the unholy amount.
    - 1y ago
harrisi 1y ago
This is interesting because they've apparently made a couple thousand dollars reporting things to other companies. Is it just a case of a broken clock being right twice a day? Seems like a terrible use of everyone's time and money. I find it hard to believe a random person on the internet using ChatGPT is worth $1000.
- billyoneal 1y ago
  There are places that will pay bounties on even very flimsy reports to avoid the press / perception that they aren't responding to researchers. But that's only going to remain as long as a very small number of people are doing this. It's easy for reputational damage to exceed $1'000, but if 1000 people do this...
  - cratermoon 1y ago
    One might even call it reputational blackmail. "Give me $1000 for this invalid/useless bug report or I'll go to the most click-baity incompetent tech press outlets with how your product is the worst thing since ILUVYOU."
- bluGill 1y ago
  $1000 is cheap... The real question is when will companies become wise to this scam? Most companies make you fill in expense reports for every trivial purchase. It would be cheaper to just let employees take the cash - and most employees are honest enough. However the dishonest employee isn't why they do expense reports (there are other ways to catch dishonest employees). There used to be a scam where someone would just send a bill for "services" and those got paid often enough until companies realized the costs and started making everyone do the expense reports so they could track the little expenses.
Aachen 1y ago
Daniel posting about the LinkedIn post: https://mastodon.social/@bagder/114455578286549482 https://mastodon.social/@bagder/114455578286549482 Recent toots on account has the news as well
jasinjames 1y ago
Can someone explain the ip address in the hackerone profile[0]? I can't tell if 139.224.130.174 is a reference to something real or just hallucinated by the LLM to look "cool". Wikipedia says that this /8 is controlled by "MIX"[1] but my google-fu is failing me atm. [0] https://hackerone.com/evilginx?type=user https://hackerone.com/evilginx?type=user [1] https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...
- dpifke 1y ago
  Per WHOIS, it's assigned to Alibaba Cloud (could be a VM there): inetnum: 139.224.0.0 - 139.224.255.255 netname: ALISOFT descr: Aliyun Computing Co., LTD descr: 5F, Builing D, the West Lake International Plaza of S&T descr: No.391 Wen'er Road, Hangzhou, Zhejiang, China, 310099 country: CN admin-c: ZM1015-AP tech-c: ZM877-AP tech-c: ZM876-AP tech-c: ZM875-AP abuse-c: AC1601-AP status: ALLOCATED PORTABLE mnt-by: MAINT-CNNIC-AP mnt-irt: IRT-ALISOFT-CN last-modified: 2023-11-28T00:57:06Z source: APNIC
xk_id 1y ago
Not sure what timeline this is anymore where a tech website loads up a completely blank page on my mobile device.
- seanp2k2 1y ago
  Welcome to the web in 2025, where it takes 5MB of JS and everything else to load a blog post containing 640B of text.
darkoob12 1y ago
You can tell it's ChatGPT from the stupid icon. In one of the iterations they started using thses emojis which are disturbing for me. The answer to the first question has obvious ChatGPT writing style.

For those of you who don't want to click into linked in, https://hackerone.com/reports/3125832 https://hackerone.com/reports/3125832 is the latest example of a invalid curl report

nneonneo 1y ago

Good god did they hallucinate the segmentation fault and the resulting GDB trace too? Given that the diffs don’t even apply and the functions don’t even exist, I guess the answer is yes - in which case, this is truly a new low for AI slop bug reports.

bluGill 1y ago
An real report would have a GDB trace that looks like that, so it isn't hard to create such a trace. Many of us could create a real looking GDB trace just as well by hand - it would be tedious, boring, and pointless but we could.
- nneonneo 1y ago
  Oh, I'm fully aware an LLM can hallucinate a GDB trace just fine. My complaint is: if you're trying to use an AI to help you find bugs, you'd sincerely hope that they would have *some* attempt to actually run the exploit. Having the LLM invent fake evidence that you have done so, when you haven't, is just evil, and should be resulting in these people being kicked straight off H1 completely.
  - bluGill 1y ago
    That means doing work. I can get a llm to write up a bugus report in minutes and then whatever value comes frome it. Checking the report is real would take time.
terom 1y ago
The git commit hashes in the diff are interesting: 1a2b3c4..d4e5f6a I think my wetware pattern-matching brain spots a pattern there.
- mitchellpkt 1y ago
  Excellent catch! I had to go back and take a second look, because I completely missed that the first time.
- terom 1y ago
  Going a bit further, it seems like there's a grain of truth here, HTTP/2 has a stream priority dependency mechanism [1] and this report [2] from Imperva describes an actual Dependency Cycle DoS in the nghttp implementation. Unfortunately that's where it seems to end... I'm not that familiar with QUIC and HTTP/2, but I think the closest it gets is that the GitHub repo exists and has a `class QuicConnection` [3]. Beyond that, the QUIC protocol layer doesn't have any concept of exchanging stream priorities [4] and HTTP/2 priorities are something the client sends, not the server? The PoC also mentions HTTP/3 and PRIORITY_UPDATE frames, but those are from the newer RFC 9218 [5] and lack the stream dependencies used in HTTP/2 PRIORITY frames. I should learn more about HTTP/3! [1] https://blog.cloudflare.com/adopting-a-new-approach-to-http-prioritization/ https://blog.cloudflare.com/adopting-a-new-approach-to-http-... [2] https://www.imperva.com/docs/imperva_hii_http2.pdf https://www.imperva.com/docs/imperva_hii_http2.pdf [3] https://github.com/aiortc/aioquic/blob/218f940467cf25d364890a602b8fc451ca635062/src/aioquic/quic/connection.py#L236 https://github.com/aiortc/aioquic/blob/218f940467cf25d364890... [4] https://datatracker.ietf.org/doc/html/rfc9000#name-stream-prioritization https://datatracker.ietf.org/doc/html/rfc9000#name-stream-pr... [5] https://www.rfc-editor.org/rfc/rfc9218.html#name-the-priority_update-frame https://www.rfc-editor.org/rfc/rfc9218.html#name-the-priorit...
- 3abiton 1y ago
  This is a whole new problem open source project will be facing. AI slop PR and Vulnerability reports, which will be only solved using AI tools to filter through the unholy amount.
  - 1y ago

harrisi 1y ago

This is interesting because they've apparently made a couple thousand dollars reporting things to other companies. Is it just a case of a broken clock being right twice a day? Seems like a terrible use of everyone's time and money. I find it hard to believe a random person on the internet using ChatGPT is worth $1000.

billyoneal 1y ago
There are places that will pay bounties on even very flimsy reports to avoid the press / perception that they aren't responding to researchers. But that's only going to remain as long as a very small number of people are doing this. It's easy for reputational damage to exceed $1'000, but if 1000 people do this...
- cratermoon 1y ago
  One might even call it reputational blackmail. "Give me $1000 for this invalid/useless bug report or I'll go to the most click-baity incompetent tech press outlets with how your product is the worst thing since ILUVYOU."
bluGill 1y ago
$1000 is cheap... The real question is when will companies become wise to this scam? Most companies make you fill in expense reports for every trivial purchase. It would be cheaper to just let employees take the cash - and most employees are honest enough. However the dishonest employee isn't why they do expense reports (there are other ways to catch dishonest employees). There used to be a scam where someone would just send a bill for "services" and those got paid often enough until companies realized the costs and started making everyone do the expense reports so they could track the little expenses.

Aachen 1y ago

Daniel posting about the LinkedIn post: https://mastodon.social/@bagder/114455578286549482 https://mastodon.social/@bagder/114455578286549482 Recent toots on account has the news as well

jasinjames 1y ago

Can someone explain the ip address in the hackerone profile[0]? I can't tell if 139.224.130.174 is a reference to something real or just hallucinated by the LLM to look "cool". Wikipedia says that this /8 is controlled by "MIX"[1] but my google-fu is failing me atm. [0] https://hackerone.com/evilginx?type=user https://hackerone.com/evilginx?type=user [1] https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...

dpifke 1y ago
Per WHOIS, it's assigned to Alibaba Cloud (could be a VM there): inetnum: 139.224.0.0 - 139.224.255.255 netname: ALISOFT descr: Aliyun Computing Co., LTD descr: 5F, Builing D, the West Lake International Plaza of S&T descr: No.391 Wen'er Road, Hangzhou, Zhejiang, China, 310099 country: CN admin-c: ZM1015-AP tech-c: ZM877-AP tech-c: ZM876-AP tech-c: ZM875-AP abuse-c: AC1601-AP status: ALLOCATED PORTABLE mnt-by: MAINT-CNNIC-AP mnt-irt: IRT-ALISOFT-CN last-modified: 2023-11-28T00:57:06Z source: APNIC

xk_id 1y ago

Not sure what timeline this is anymore where a tech website loads up a completely blank page on my mobile device.

seanp2k2 1y ago
Welcome to the web in 2025, where it takes 5MB of JS and everything else to load a blog post containing 640B of text.

darkoob12 1y ago

You can tell it's ChatGPT from the stupid icon. In one of the iterations they started using thses emojis which are disturbing for me. The answer to the first question has obvious ChatGPT writing style.