11 ms·

This year’s insane timeline of hacks

345 points by laurex 6mo ago

ArekDymalski 6mo ago
>Stacked on top of each other across roughly a hundred days, these events are something a historian of computing security writing in 2050 will probably file as a turning point, regardless of what else happens between now and then. And yet, the public conversation around them has been quiet to the point of being strange. There's a lot current events that once would have been considered historical: trip around the Moon, war out of nowhere, unprecedented explosion of kleptocracy l, enormously scandals and so long. Noone of these are moving much of the needle among general public. Why? I think such indifference or rather apathy/torpor is a result of people becoming tired of constant stream of crises (either imaginary or real) that we're being flooded by. The capacity to react with something more than a shrug is finite. And I think we are being drained.
- mwigdahl 6mo ago
  Agreed, call it future shock or the Singularity or just overall outrage fatigue, people just aren't reacting to these kinds of things at a level commensurate with their risk or danger.
- titzer 6mo ago
  The idiocy out of the Whitehouse is an intentional strategy to flood the zone with crap that sucks all the air out of the room. They have intentionally broken the ability of the public to become informed through a number of means: attention atrophy, lowest-common-denominator mudslinging, and massive, manufactured, stupid global crises. People have become deaf and desensitized. The fact that humanity sent people back to the moon barely even registered. Crazy times.
  - CoastalCoder 6mo ago
    > The fact that humanity sent people back to the moon barely even registered. Are you sure that people would have cared much even in better times? Although I'm just as subject to the fatigue as everyone else, this just isn't a pursuit that I see as important. TBH I think dealing with global warming, cancer, homelessness, AI impact on human cognitive development, and the loneliness epidemic are far higher priorities.
    - nemomarx 6mo ago
      If I recall correctly opinion polling on the original Apollo program wasn't universally positive either. Space missions don't impress people who want money spent on the ground, it etc
      - fhdkweig 6mo ago
        The famous spoken word poem Whitey on the Moon was on exactly this topic. "Accompanied by conga drums, Scott-Heron's narrative tells of medical debt, high taxes and poverty experienced at the time of the Apollo Moon landings. The poem critiques the resources spent on the space program while Black Americans were experiencing social and economic disparities at home." https://en.wikipedia.org/wiki/Whitey_on_the_Moon https://en.wikipedia.org/wiki/Whitey_on_the_Moon
      - deleted 6mo ago
        [deleted]
      - deleted 6mo ago
        [deleted]
  - RGamma 6mo ago
    "Amusing ourselves to death" was eerily prescient. Now that the amusement stopped, what might happen next? Not the metaverse, that's for sure.
  - lamasery 6mo ago
    I think nobody cares about the moon thing because 1) they aren't landing, and (this one's more for people who are paying some attention to this stuff to begin with) 2) it's basically the same mission they already ran on auto-pilot, but with people on board, so... I dunno, hard to get excited about some very-expensive passengers on an automated ride. I mean, part of why they cut the Apollo program short was because nobody cared back then either, after the first ~2 landings, so they muddled on a while longer but support simply vanished in a hurry. It'd be surprising if people started caring more now. I suppose if we land people on the moon it'll be a bit more of an event than this one (the landing, not the launch) but I'd expect interest to plummet again after that. Hopefully they have better-selected video feeds for the landing than they did for this launch, I had my kids watch it and it was bad enough I think I'll have trouble getting them to sit down for another NASA launch stream.
    - fhdkweig 6mo ago
      I'm interested in it as a means to an end. Supposedly this is to get ready for a lunar base. I would love to see that in my lifetime. Also, while it is not a mission objective, I want to see a space elevator which currently we can only do on the moon. Due to the lower gravity and slower spin, it is possible to make a space elevator out of Kevlar rope, which we can reliably make in bulk.
- TacticalCoder 6mo ago
  [flagged]
- SoftTalker 6mo ago
  > people becoming tired of constant stream of crises They aren't tired, they're distracted. X/TikTok/et. al. are all fire and motion mechanisms.
- energy123 6mo ago
  The precipitous drop in fertility even in low income countries. The rise in populism and fear. It's the phones, humans are being DDoSd. We need government intervention against many aspects of modern technology. The profit motive works when it comes to reducing manufacturing costs and passing some of that on to consumers through the beauty of competition. It doesn't work so great when it's X training a transformer model to maximize the amount of time you spend doom scrolling so they can feed you gambling advertisements.
  - gulfofamerica 6mo ago
    [dead]
  - scottyah 6mo ago
    Well society had to go and get rid of religion, so people needed another opiate.
    - rootusrootus 6mo ago
      Considering how attached to his phone my hyper religious evangelical father-in-law is ... I don't buy it. If there is a causal relationship between those things, it goes the other way.
  - lotsofpulp 6mo ago
    Total fertility rates dropped long before smartphones.
- phil21 6mo ago
  > Why? I think such indifference or rather apathy/torpor is a result of people becoming tired of constant stream of crises (either imaginary or real) that we're being flooded by. The capacity to react with something more than a shrug is finite. And I think we are being drained. I think it's more that the impact of all these constant string of "crises" ends up having very little impact on the average American's lifestyle. Groceries a bit more expensive, gas higher, rent continues to creep up. Some giant incomprehensible national debt number gets higher. Those all suck and people complain about them - but they are complaining about them in packed bars while they drink $7 beers and eat $30 burgers and fries. You can only yell so many times that the world is ending before people tune it out since their day to day lives are largely unchanged. Just look at the focus on complaining about almost irrelevant things like the price of eggs or whatever totally irrelevant culture war topic of the day. It's societal bike shedding. I am firmly of the belief (and have been for quite some time) that the "average" middle class American is going to need severe pain - as in widespread great depression level pain - before anything really changes at all at the ground level. Americans have simply become so used to living the lifestyle being part of an insulated hegemonic superpower empire that they have taken that for granted as how things generally will always be no matter what happens. There is zero consideration for the amount of sheer effort, will, and constant vigilance it took to build and maintain such a state of being. Or put another way: Inertia is a hell of a drug.
- jmcqk6 6mo ago
  Yeah, it's not indifference or apathy. It is overwhelm. There are too many things that need attention and not enough attention.
- atkrista 6mo ago
  One word, Hypernormalization.
- yoyohello13 6mo ago
  I know for my part I am so tired of the constant crises. At this point I just want the inevitable collapse to hurry up and happen already so we can just focus on picking up the pieces and move the fuck on.
- tokioyoyo 6mo ago
  Because it doesn't really matter and has no legs? Over the past 15 years, we had a lot of data exfiltrations, lots of breaches, hacks, and etc. Nothing really happened, world moved on, people figured out a way to live around it. People who work at those companies get affected, but in general, unless the entirety of banking system collapses because of the hacks... nobody will really care. Even during the hay days of Equifax hack people were chatting how things will "happen this time". Nothing did.
john_strinlai 6mo ago
>And yet, the public conversation around them has been quiet to the point of being strange. i dont think its that strange. there are multiple wars raging on, with many people fearing the breakout of a global conflict. a giant pedophile ring has been exposed that no one in power seems interested in doing anything about. prices for everything are haywire. markets are an absolute rollercoaster, hinging completely on one mans late night tweets. and so on. people just dont have the bandwidth to also learn about what an npm or github is, and why a hack of it is important. news stations are going to pick the news that results in the most people tuning in to watch. that is war, not whatever a mercor is. the non-tech (and many of the tech) people in my life are also just plain tired of hearing about hacks. they have heard that their information has been stolen 10 times or whatever in the last 5 years. they have heard 100s of "this company was hacked" stories. "another hack? who cares?".
- tokai 6mo ago
  Its the tech worlds equivalent to eating X causes cancer.
- ifwinterco 6mo ago
  HN is a bit of a bubble in that people here tend to be quite privacy focused and would be horrified at the prospect of their details being leaked. For a lot of normal people that's not the case and as long as they don't get someone actually stealing their identity etc. they aren't really concerned about these kind of things
- hydrogen7800 6mo ago
  Frustratingly, I have my foot in both worlds to a degree. I'm interested enough in tech to pay attention and often lurk the tech bubble that is HN and hear about the raging dumpster fires from the folks who live and work in that domain. But I exist in a mostly non-tech world IRL where this exists among the other burning dumpster fires to the point that I can't care about another data hack, and i hate that I don't have the bandwidth to care. To a more acute degree, my mother was nearly wiped of half her life savings by "hackers"/fraudsters posing as employees of her bank. Being "hacked" is a part of life now, and outrage fatigue is real.
titzer 6mo ago
> Cisco’s private GitHub was cloned. From this, https://www.sdxcentral.com/news/cisco-source-code-breach-leaks-ai-projects-and-aws-credentials/ https://www.sdxcentral.com/news/cisco-source-code-breach-lea... It sounds like they were/are using GitHub to host company-private source code, presumably of high-value. While it's hard to know exactly the setup (e.g. maybe they are running their own instance of GitHub internally), this is your reminder that public clouds are not secure, no matter how much you pay the maintainers of said clouds. Internal network compromise is of course always possible, but sheesh, it sounds like this list has lots of public cloud failures.
- deleted 6mo ago
  [deleted]
  - deleted 6mo ago
    [deleted]
deleted 6mo ago
[deleted]
jjmarr 6mo ago
> In August 2025, three of the most notorious financially-motivated crews on the planet, ShinyHunters, Scattered Spider, and LAPSUS$, formally combined into a coordinated alliance widely tracked as Scattered LAPSUS$ Hunters (SLH), sometimes called “the Trinity of Chaos” (Resecurity; Cyberbit; Infosecurity Magazine; The Hacker News; Computer Weekly; ReliaQuest). Scattered Spider provides initial access through highly-effective social engineering and vishing. ShinyHunters handles exfiltration, leak-site management, and extortion. LAPSUS$ contributes its own brand of identity-system compromise. Lmao that cybercriminals are closing M&A deals to create vertically integrated SaaS companies. Do you think anyone was made redundant through kinetic means?
- deleted 6mo ago
  [deleted]
- alephnerd 6mo ago
  These kinds of groups operate as businesses and in some cases government agencies. It would be the same experience as working for any other tech company.
  - jjmarr 6mo ago
    I know. There's a sense of schadenfreude that the Russian hackers are suffering through a big re-org right now.
    - alephnerd 6mo ago
      Yep, but they'll land on their feet. Probably negotiate an ML Infra or SecEng role at Yandex.
nirav72 6mo ago
Not too long ago, a few gigabytes of data being stolen was a big friggin deal. Now they're swiping data in the terabytes or even petabytes.
- RajT88 6mo ago
  Bad news: All your data with data brokers will be public soon. Good news: All the data of elected officials will be public soon, and we may finally get some regulation.
deleted 6mo ago
[deleted]
cols 6mo ago
Add to this the Rockwell Automation attack and you get a beautiful Chickens-Coming-Home-To-Roost stew! https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a https://www.cisa.gov/news-events/cybersecurity-advisories/aa...
jrm4 6mo ago
[flagged]
- ryandrake 6mo ago
  > And then, we still have yet to punish or hold accountable any large party who made things this way. Until we do that, keep expecting this. This is the key. No incentive to change. It's always "the hacker's fault" and never "the manufacturer's negligence" or "the developer's carelessness" or "the user's gullibility." Combine this with the currently-prevailing Don't Blame The Victim mentality, and it's the perfect environment for never improving cybersecurity.
  - myself248 6mo ago
    But yet, the pigs who built the houses of straw and sticks got eaten. The pig who built the house of bricks is seen as responsible, even though it took longer and cost more; he made the right choice. The wolf is seen as ever-present. Failure to consider the wolf when choosing building materials has consequences. It blows my mind that this story has been part of our culture for centuries, yet we apply exactly the opposite model to cybersecurity.
    - IsTom 6mo ago
      But have you thought about the bonus you can get by reducing house building costs in Q3?
      - stackskipton 6mo ago
        Yea, CyberSecurity will get fixed when companies are held responsible to the point that data breaches have severe impact on bottom line.
- john_strinlai 6mo ago
  >As someone who's older, and is just generally gobsmacked all the time by the sloppiness in cybersecurity, all of this is just not surprising. as someone who used to work in cybersec (and is also older), most of the time (in my experiences) it isnt sloppiness. 1) people fight tooth and nail against anything that inconveniences them. security is almost always going to be an inconvenience tradeoff, so it is always fought against. from every person and every department. rolling out 2fa was worse than pulling teeth, despite it being a single button press ("approve") on the phone, once or twice a day (or less). c-suite is the worst, demanding exclusions and bypasses. its hard to say no to your bosses boss when they refuse to use a password manager, refuse to setup 2fa, or whatever the case is. 2) security offers no immediate or visible return on investment. so, it gets little to no positive attention by c-suite and even less budget. you end up with underpaid, under-qualified, over-worked people trying to figure out which thing they might be able secure out of the 10 things that need securing. half of them will be tied up trying to explain to someone why they cant use the company name as their password or begging someone to use the password manager. even here, a forum of hackers, security is often put in scare quotes and almost always mentioned beside the word "theater". people brag about still running windows 7, because it was the last good windows. antiviruses arent needed. X security feature is just a lie so that company Z can control my device. people get big mad when a company rolls out mandatory 2fa. and so on. edit: case in point, on this thread a comment was just posted with "I think you can argue that cybersecurity doesn't really matter, in the grand scheme of things."
iJohnDoe 6mo ago
[dead]
stalfie 6mo ago
If I can play devils advocate in favor of public disinterest about these events, I think you can argue that cybersecurity doesn't really matter, in the grand scheme of things. At least data exfiltration. What would the consequences for humanity be if every single electronic patient record was leaked onto the internet? Immediately hugely bad for some groups, unfortunately. After a good deal of embarrassment and drama however, some severe, perhaps the net effect is positive. It would most likely facilitate a lot of scientific inquiry. A lot of people, especially in medical deserts, also use Chatgpt as an md. Providing AI companies with high quality medical data is actually a public service. So it goes for many things in life, and except for financial and destructive wipe attacks, data security is mostly about protecting the IP of incumbents, which is somewhere between irrelevant and a net negative. It's hard to say what the long term consequences of the IP system breaking down would be, but there is a good argument to be made that it's not necessarily bad. As for individual people, most don't really care or are resigned to the fact that Google already knows everything about them, and probably abstractly enjoy the fact that a major company gets brought down to their reality. Plenty of societies have extremely collectivistic mindsets of public info being shared, like Scandinavian countries having public tax filings, and they work just fine. I think most people would secretly relish the outcomes of everything leaking everywhere. Just like people relish the Epstein files being released, and probably would have loved an unredacted version being leaked. Secrets are something human beings naturally gravitate towards to dig up and sharing, and this is actually for good, sensible reasons. Evolution has simply favored groups that did not hoard knowledge, at least not internally. There is a reason the scientific method has openness as a virtue, and is arguably one of the pillars that has carried humanity out of the dark ages.
- bradishungry 6mo ago
  It would be terrible, I don’t think you’re thinking about what kinds of discrimination can happen due to things like medical records. You can have laws in place to prevent it but if someone can freely see your entire medical history then people WILL take advantage of that. Not to mention how things like citizens traveling to states where abortion is legal, or if a parent disagrees with an operation could affect someone if things are public. This is only talking about medical records, too, the implications of other kinds of espionage have significant repercussions as well. Cybersecurity absolutely does matter
ckcheng 6mo ago
The strangest thing I found is: > on April 7, 2026 … U.S. Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell convened an urgent, in-person meeting in Washington with the chief executives of [major US banks] to brief them directly on the cyber risks posed by [Anthropic’s] Mythos Then a similar meeting happened with the Canadian Financial Sector Resiliency Group (i.e. the Bank of Canada, the Canadian government’s Department of Finance, the Canadian Deposit Insurance Corporation (Canada’s FDIC) and Canada’s six major banks). Multiple central banks don’t usually do that right? https://www.ctvnews.ca/sci-tech/article/anthropics-new-ai-model-is-too-dangerous-to-release-to-public-developers-say/ https://www.ctvnews.ca/sci-tech/article/anthropics-new-ai-mo...
- sybercecurity 6mo ago
  Two possibilities: 1. Fear that a major vulnerability is found in a commonly used software package that puts multiple major banks and e-commerce sites at risk 2. Fear that major vulnerabilities are found in multiple, widely used software packages that lead to market downturn as IT company stocks crash. Probably others as well. Sounds more like a brief on worst-case scenarios that may happen and how they would effect the US banking sector. This is an important mid-year election this year too, so any big economic shock would be bad for the GOP.
  - iugtmkbdfil834 6mo ago
    That, or, not completely unlikely, he was shown all the vulnerabilities across all old software that banking, finance et al use daily and are unlikely to ever update. I am only half joking. There is a reason I think some people should stick to their areas of expertise.
    - eastbound 6mo ago
      It currently works because those vulnerabilities are not exploited en masse. With AI, they can. It does change the game.
      - 6mo ago
iainctduncan 6mo ago
As part of my work in technical diligence, I create medium-long form content marketing material on topics germane to PE investment in tech. In the last six months I did a series (not yet published) on the state of security in the age of gen-AI. Basically, we are entering the ransomware apocalypse. It is insane what a godsend gen-AI has been to the cybercrime sector. When all you need to do is make something good enough to fool some of the people some of the time, genAI is perfect. Things that used to work reliably - like trusting google ads or sponsored links not to be malvertizing sites - are meaningless now that gangs can trivially spin up networks of thousands of fake interacting sites and linked profiles to sneak by fraud detection. Phishing attacks are ridiculously sophisticated, combining voice, text, and video impersonation. Supply chain attacks are going to mean package managers are handgrenades. Ransomware gangs are running full on SaSS services allowing script kiddies access to big gun material. Attacks that were previously only in reach of nation-state-sponsored actors are now available for peanuts. And all of this is going to worse because of everyone and their dog using gen-AI to pump out huge amounts of vulnerable code. And then there is the world of prompt engineering for data exfiltration... If you are young and wanting a promising trade in tech, security would absolutely be a good choice. Shit is going to get CRAZY.
- alephnerd 6mo ago
  > If you are young and wanting a promising trade in tech, security would absolutely be a good choice. Shit is going to get CRAZY. Yes, but you can't be a CISSP or SOC monkey - that has no future. You need to be an actual Software Engineer who understands development fundamentals, OS internals, web dev fundamentals, algorithms, etc as well as offensive and defensive concepts. To many "cybersecurity" graduates in North America aren't even qualified to do L1 IT Helpdesk, which is a shame because the IT to Security talent pipeline is critical (along with the SRE, SWE, and ML to security pipeline).
  - iainctduncan 6mo ago
    Definitely agree. I guess I should have specified I meant "real programmer who wants a career". ;-)
  - 6mo ago
lubujackson 6mo ago
I have this mental model that the natural state of the web is to act like an organism that is continuously assaulted by viruses - sometimes that is SEO spam, sometimes actual viruses, sometimes a game-changing shift like AI vulnerability scanning. The pattern is the organism gets assaulted, digests the virus and comes back a bit tougher with more layers of complexity and defensiveness. I think right now we are waiting for the Morris worm (https://en.wikipedia.org/wiki/Morris_worm https://en.wikipedia.org/wiki/Morris_worm) equivalent shock to the system, but it is likely to be much, much worse and much more specific. I expect something that will make DOGE stealing SSNs look kind of tame. Something like every private GitHub exposed, every Visa card data and history exposed, every Mac injected with a rootkit, etc. It's like waiting for the plot from Sneakers to manifest. For all the security we have built over the last 50 years, it has been impossible (or nearly so) to lock down any web-accessible content. It is a structural issue at a certain level of complexity, the surface area is just far too wide for any focused effort. Aside from direct 0 day vulnerabilities in software there are vulnerabilities in core libraries, frameworks, CI/CD, cloud services, hardware bugs, gaps between services, permission vectors, etc. The U.S. has relied on the legal system to allow our insane credit card system to persist, where security by obscurity (knowing someone's CC#) is the main deterrent to abuse. I need a complex password to access any website, but CC#s are flying free. I think the combination of easy worldwide vulnerability scanning and U.S.'s focus on pissing every country off is going to lead to significant and unending asymmetrical warfare. If our gov't has been co-opted by big business, big business is going to become the target. As we have seen with Iran with Hormuz and Ukraine with drone strikes, it isn't so hard for small countries to fuck up global systems. We are entering a 90s-style phase where any script kiddie can cause massive disruptions. Trump likes to threaten NUCLEAR but security issues could potentially cause even more death and destruction - overwhelm the energy grid, open dams, crash air traffic control communications, etc. There is lots of concern over the oligarchy owning AI and keeping it for themselves, but the more immediate risk is that any country can potentially lash out with disruptive actions. There has been a retreat from globalization since COVID. I wouldn't be surprised if that extends to global internet communications as well. Internet traffic between countries might soon be severely restricted, that's the last line of defense we actually have if this goes as badly as Anthropic is implying.
mring33621 6mo ago
Or not
__alexs 6mo ago
Anthropic's marketing team are terrifyingly good. I wonder if Opus came up with this plan?
- 0xdeadbeefbabe 6mo ago
  This AI and security genre really has legs.
- theincredulousk 6mo ago
  Cultivating and leveraging fear is truly a cornerstone of Security™. I don't think the claims about capability are ridiculous. The idea that the general capability is proprietary and that it will be exclusive to the trusted partners of one company is ridiculous.
- HDThoreaun 6mo ago
  All the big tech companies are getting access to mythos. If anthropic is blowing smoke with regards to its ability to find vulnerabilities it will leak very soon.
  - lelanthran 6mo ago
    > All the big tech companies are getting access to mythos. If anthropic is blowing smoke with regards to its ability to find vulnerabilities it will leak very soon. Will it? All the big companies are invested in AI anyway; the people getting exclusive access to this are going to be under an NDA anyway. It will leak eventually, but the news that is isn't much better than current models news may not be enough to dispel the original claims.
  - attentive 6mo ago
    No need to leak. If we don't see a very public flow of various CVE's across the industry then it was a nothing-burger.
gcr 6mo ago
If cybersecurity is slowly ramping up in complexity, isn’t the statement “we’re living through the most consequential hundred days in history” always trivially true?
- tptacek 6mo ago
  Yep.
semiquaver 6mo ago
I know this ship has sailed but the modern term “cyber” usually referring to offensive or defensive software technology (presumably short for cybersecurity) drives me up a wall. It’s even worse than “crypto”. I find that people who use this term are, ceteris paribus, likelier to be full of crap.
- jjtheblunt 6mo ago
  "order of magnitude" seems to also be silly-speak very often, trying to sound more technical than "ten times". i suppose it is similar to "exponentially" being used when it doesn't mean exponentially.
  - dvfjsdhgfv 6mo ago
    > "order of magnitude" seems to also be silly-speak very often, trying to sound more technical than "ten times". But these are two different things. If I hear "ten times" I assume the person actually means ten times; when they say "an order of magnitude", I'm aware they might mean 8 or 12.
    - jjtheblunt 6mo ago
      agreed...thought of that after writing it, and thanks for noting it too. i thought the order of magnitude is often hipster phrasing, even on HN at times, but, when actually intended, it's like saying floor(log_base10( whatever )), so the ten times thing would have to be "roughly ten times" for example, to be comparable. Also, in some contexts the base isn't presumed to be 10, of course, though around here in loose jargon that's usually what folks are saying.
- tptacek 6mo ago
  It's so firmly established that, just like crypto, making a stink about it says more about the objector. I don't like it either! "Cyber" is cringe, and "crypto" should mean "cryptography". But I'm not the king of usage, and both those terms have new meanings.
tosser12344321 6mo ago
I'm a head of security, great career, did engineering into management, made a tidy living doing advanced work as a risk plumber across companies that have been relevant. I've built great teams, met and solved hard IR, delved into the real reaches of vuln research, other neckbeard things, got paid very well along the way. Seen and worked on the APT issues. More or less, I am the attractive resume, and: the game has changed folks. For what it is worth, I am taking my ball and going home in about 12 months. I've saved enough, locked in a perma-middle class lifestyle in a great nondescript city, and swapping over to offensive consulting and a AI-free, non-tech trade that won't take too long to get into - think a PA, nurse, plumber, etc. I'm not quite old enough and with the end of responsibilities as to FIRE, but I can read the writing on the wall enough to understand an AI-proof FI needs to be locked in before everyone else realizes the same. Many others in sec are feeling this. I think tech will find security pros willing to throw themselves into the fray for pay and optimism. There are others like me who are extracting their final nuts. There are others who have golden-handcuffed themselves into this ride with their mortgages and private school tuitions. And I'm sure some others will stick it out. There will also be an AI-enabled version of sec eng soon enough. But if private sector doesn't wake up to AI integrations - internal doc rollouts hoovering up PII that wasn't supposed to be stored there, externally-facing customer support portals social engineered and pivoted into, PRs via Slack comment via marketing hires who are ATO'd - this is going to be a 1990's-style BBQ where 0days on critical systems are dropped at happy hours at conferences nightly. And: your security teams are going to be burned out, banking up, and quitting. The risk acceptances, the double-speak, the slow-rolling, the half-baked risk thinking for engineering and product leads, the corners cut, the public endpoints opened up just this one time - that's going to be enough rope, and already is enough, to hang yourself in this offensive context that's building now. It is deeply humorous that SWE and engineering leadership has worked itself into this position via its AI push to unemploy itself while thinking it's the 1x white collar job exempt from automation threats. All it'll take is another recession like '08, and the leaves get shaken off the trees finally. Thankfully there is only one (wait, there are two probably), thankfully there are only two-to-three (wait, there are like 10) systemic market threats right now.
- theturtlemoves 6mo ago
  > a AI-free, non-tech trade that won't take too long to get into - think a PA, nurse, plumber, etc. I'm not sure if personal assistant or nurse are going to be AI-free. Plumber, welder, bricklayer, pest exterminator, sure. Don't underestimate the downsides of physical labor, though. Low pay and backbreaking. What writing on the wall? If anything, I think you'll be more needed, not less, in times to come.
myth_drannon 6mo ago
Looking at the Israeli startup scene, there is a huge surge in cybersecurity investments (especially agentic security) in the last couple of months, looks very abnormal. https://www.calcalistech.com/ctechnews/article/hy8t7fcobe https://www.calcalistech.com/ctechnews/article/hy8t7fcobe
- alephnerd 6mo ago
  There's nothing abnormal about that. These were all funded 2-3 years ago (heck I participated in some of these). Companies only go out of stealth when they are publicly announcing their Series A (usually right around the time of a major buyer event like BSides/RSA or DEFCON/Blackhat. Funding rounds usually happen around 5-6 months before they get announced on TechCrunch or Calcalistech becuase such information are a signal to competition about a specific approach. It's also a massive distraction from building, because then you have to deal with media, press releases, and actually have a product marketing team. You don't want to do this until you can hire a couple PMs and PMMs (which is usually around the seed-to-series A transition becuase you will have hit the $5M ARR mark by then). This how stuff is done here in SV as well and has been for decades.
KIFulgore 6mo ago
I miss the days when the big security concern was quantum breaking contemporary encryption. Air gaps and local stacks are overdue for a comeback.
- Animats 6mo ago
  Even that may not work. See Stuxnet.[1] [1] https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
  - KIFulgore 6mo ago
    Yep, there is always the human factor. Leave a USB drive in a parking lot, someone will insert it. You don't even need an obvious drive anymore, a malicious cable will suffice.
Animats 6mo ago
Almost all those events were on Hacker News. This hasn't been a secret. Companies need to get serious about levels of security. Only some things need to be protected, and you have to accept a substantial level of inconvenience and cost for those items. In my aerospace days, we had a bidding rule of thumb that running a project at SECRET doubled the cost. Running a project at TOP SECRET had an even bigger cost multiplier. A surprising amount of material was not classified at all, for cost reasons. Banks and credit card processors get this. Most other businesses don't.
- halJordan 6mo ago
  They've been on HN, but that's the author's point. Even this article on HN- the top comment is a series of complaints about "hurr durr ai needs to get off muh lawn" The point is that the people, who self-identify as the ones the author is supposedly asking for help, are the ones who are refusing to acknowledge the elephant in the room so they can feel smug. Just like your "but i read about every incident mentioned, where's my cookie"
  - culi 6mo ago
    I don't think the author is asking HN for help. Just pointing out that the sky is falling
- UltraSane 6mo ago
  The most effective security practice you can do is to strictly isolate any internet connected PC from computers handling important data. But this requires that people have two (or more!) different computers and is rather annoying. More convenient is to only allow internet access from ephemeral VMs connected to via RDP or similar protocol.
themafia 6mo ago
> And yet, the public conversation around them has been quiet to the point of being strange. These events aren't new or novel anymore. The fact that the news does or does not report on something is indicative of editorial prerogatives and nothing more. > This is a curious observation more than a complaint. We went from 25% of the world population using the internet to now more than 80% are on the internet. More people understand the fundamental issue, and so are uninterested by it, so for-profit publications will not cover it.
CoryOndrejka 6mo ago
Combine every attack being a social engineering attack plus foundational model hacking-fu and we're in a shocking interesting place. Identity itself becomes a pretty interesting opportunity/threat. Wrote an oped [1] with friends from Badge on this topic 6 months ago. [1]: https://idtechwire.com/opinion-in-an-ai-world-every-attack-is-a-social-engineering-attack/ https://idtechwire.com/opinion-in-an-ai-world-every-attack-i...
thordenmark 6mo ago
Yes, AI is getting better at finding exploits and cracking software, but it will also get just as adept at defense. It will all escalate, but mostly maintain parity.
- fzzzy 6mo ago
  An attacker only has to win once. A defender must win every time
xtracto 6mo ago
A couple of days ago I was thinking about something related to this: How would the "computing" space look like once we get to the ultimate evolution/development of the AI/LLMs or whatever comes after it? Say in 10 years, once we have things like a Claude Mythos (or better) model running on "real time" at the speed of how Taalas runs ollama now. I have a feeling that "cyberspace" (however we want to call it) won't matter anymore. "Computing" won't matter anymore. Say, I want to implement a Massive Multiplayer Lemmings like game, it's done at the snap of my fingers. Say I want to find a way to "crack" X software? done. Say I want to find a vulnerability in Y website? easy peasy. Say I want to build a "Powerpoint" clone, done (not that it matters, as making a presentation will be as simple as saying "Mythos5, make a presentation about X,Y,Z with nice and meaningful transitions". Same with music, video, images, etc. Once everything can be created automagically... what happens? (say, "Make me a film like the original John Wick but with the wit and style of Kingsman, make a young Sean Connery the main actor). So, ultimately cyberspace will be so chaotic with the current "rails", that it will be completely different to what we know now. At the risk of being booed here in HN, I also have a hunch that the more we go there, the more stuff like "trustless computing" or "proof of N" (having to SPEND something, some real life, finite effort, to do things online) will gain more force. Somehow, Hashcash was conceived to deal with spam/automation type of attacks, so I assume a version of that will have to be used to "structure" Cyberspace in the future. My hypothesis is that this will take us back to "the real world" due to "surfeit": Kind of what happens once you add a "trainer" to a game and suddenly you have all the money/resources, and then it becomes boring. Once the "digital" stuff is solved, we will go back to the real world. Very exciting times.
- levek 6mo ago
  > Say I want to find a way to "crack" X software? done. Say I want to find a vulnerability in Y website? easy peasy. OTOH, such a powerful model might be able to do formal verification practical, too. So your model might say "Can't get RCE on that software because the model that developed it also created a proof that that's impossible". > Once everything can be created automagically... what happens? The people who can come up with novel concepts would matter a lot more then than they do now. Like how image models can create pictures in the style of van Gogh, but they wouldn't if van Gogh hadn't existed. So we'd need "van Goghs" to come up with the new things that the models would create a thousand varieties of. > Somehow, Hashcash was conceived to deal with spam/automation type of attacks, so I assume a version of that will have to be used to "structure" Cyberspace in the future. "Proof of N" doesn't need to involve spending something. It could be "proof of citizenship" (or some other "proof of offline identity") combined with rate-limiting per identity. The right cryptographic protocols could do it without revealing your identity to the service you're interacting with.
xtracto 6mo ago
I wonder, how long until that certain CrowdStrike kernel level plugin that brought down a third of the world's Windows comptuers gets hijacked by a malicious actor.
sdevonoes 6mo ago
Finally we know what AI is good for! And It’s not about make mundane developers more productive
angry_octet 6mo ago
It really hasn't been insane, that is just recency bias. Better spam, some niche capabilities like voice cloning, some scalability to applying an exploit to more targets at once. Anthropic et al having better exploit dev is a capability which aids both sides. But regardless, most exploits use n-days not 0-days.
croemer 6mo ago
Hard to read due to LLMisms (it's not x, it's y), just a few examples: > The silence has not broken in mainstream public discourse. It has clearly broken in private, at the top of the U.S. government, in classified briefings and emergency convenings the public is mostly not seeing. > The historian’s question is no longer whether the cyber community is being quiet. The historian’s question is why the public conversation is so thoroughly out of sync with what is clearly being discussed behind closed doors at the level of the Treasury and the Federal Reserve. > That obscurity is the part of this section that matters most. It is not the AI numbers. It is the silence around them.
0rbiter 6mo ago
> Mythos had identified thousands of previously-unknown zero-day vulnerabilities in every major operating system and every major web browser, along with a range of other critical software. I think we can assume that the alphabet agencies already got their hands on this and are working to use it. No more backdoors necessary, they can crack open every computer on earth with this. Did OS/software vendors get a list of their vulnerabilities? Will they ever?

345 points by laurex 6mo ago

>Stacked on top of each other across roughly a hundred days, these events are something a historian of computing security writing in 2050 will probably file as a turning point, regardless of what else happens between now and then. And yet, the public conversation around them has been quiet to the point of being strange. There's a lot current events that once would have been considered historical: trip around the Moon, war out of nowhere, unprecedented explosion of kleptocracy l, enormously scandals and so long. Noone of these are moving much of the needle among general public. Why? I think such indifference or rather apathy/torpor is a result of people becoming tired of constant stream of crises (either imaginary or real) that we're being flooded by. The capacity to react with something more than a shrug is finite. And I think we are being drained.

mwigdahl 6mo ago
Agreed, call it future shock or the Singularity or just overall outrage fatigue, people just aren't reacting to these kinds of things at a level commensurate with their risk or danger.
titzer 6mo ago
The idiocy out of the Whitehouse is an intentional strategy to flood the zone with crap that sucks all the air out of the room. They have intentionally broken the ability of the public to become informed through a number of means: attention atrophy, lowest-common-denominator mudslinging, and massive, manufactured, stupid global crises. People have become deaf and desensitized. The fact that humanity sent people back to the moon barely even registered. Crazy times.
- CoastalCoder 6mo ago
  > The fact that humanity sent people back to the moon barely even registered. Are you sure that people would have cared much even in better times? Although I'm just as subject to the fatigue as everyone else, this just isn't a pursuit that I see as important. TBH I think dealing with global warming, cancer, homelessness, AI impact on human cognitive development, and the loneliness epidemic are far higher priorities.
  - nemomarx 6mo ago
    If I recall correctly opinion polling on the original Apollo program wasn't universally positive either. Space missions don't impress people who want money spent on the ground, it etc
    - fhdkweig 6mo ago
      The famous spoken word poem Whitey on the Moon was on exactly this topic. "Accompanied by conga drums, Scott-Heron's narrative tells of medical debt, high taxes and poverty experienced at the time of the Apollo Moon landings. The poem critiques the resources spent on the space program while Black Americans were experiencing social and economic disparities at home." https://en.wikipedia.org/wiki/Whitey_on_the_Moon https://en.wikipedia.org/wiki/Whitey_on_the_Moon
    - deleted 6mo ago
      [deleted]
    - deleted 6mo ago
      [deleted]
- RGamma 6mo ago
  "Amusing ourselves to death" was eerily prescient. Now that the amusement stopped, what might happen next? Not the metaverse, that's for sure.
- lamasery 6mo ago
  I think nobody cares about the moon thing because 1) they aren't landing, and (this one's more for people who are paying some attention to this stuff to begin with) 2) it's basically the same mission they already ran on auto-pilot, but with people on board, so... I dunno, hard to get excited about some very-expensive passengers on an automated ride. I mean, part of why they cut the Apollo program short was because nobody cared back then either, after the first ~2 landings, so they muddled on a while longer but support simply vanished in a hurry. It'd be surprising if people started caring more now. I suppose if we land people on the moon it'll be a bit more of an event than this one (the landing, not the launch) but I'd expect interest to plummet again after that. Hopefully they have better-selected video feeds for the landing than they did for this launch, I had my kids watch it and it was bad enough I think I'll have trouble getting them to sit down for another NASA launch stream.
  - fhdkweig 6mo ago
    I'm interested in it as a means to an end. Supposedly this is to get ready for a lunar base. I would love to see that in my lifetime. Also, while it is not a mission objective, I want to see a space elevator which currently we can only do on the moon. Due to the lower gravity and slower spin, it is possible to make a space elevator out of Kevlar rope, which we can reliably make in bulk.
TacticalCoder 6mo ago
[flagged]
SoftTalker 6mo ago
> people becoming tired of constant stream of crises They aren't tired, they're distracted. X/TikTok/et. al. are all fire and motion mechanisms.
energy123 6mo ago
The precipitous drop in fertility even in low income countries. The rise in populism and fear. It's the phones, humans are being DDoSd. We need government intervention against many aspects of modern technology. The profit motive works when it comes to reducing manufacturing costs and passing some of that on to consumers through the beauty of competition. It doesn't work so great when it's X training a transformer model to maximize the amount of time you spend doom scrolling so they can feed you gambling advertisements.
- gulfofamerica 6mo ago
  [dead]
- scottyah 6mo ago
  Well society had to go and get rid of religion, so people needed another opiate.
  - rootusrootus 6mo ago
    Considering how attached to his phone my hyper religious evangelical father-in-law is ... I don't buy it. If there is a causal relationship between those things, it goes the other way.
- lotsofpulp 6mo ago
  Total fertility rates dropped long before smartphones.
phil21 6mo ago
> Why? I think such indifference or rather apathy/torpor is a result of people becoming tired of constant stream of crises (either imaginary or real) that we're being flooded by. The capacity to react with something more than a shrug is finite. And I think we are being drained. I think it's more that the impact of all these constant string of "crises" ends up having very little impact on the average American's lifestyle. Groceries a bit more expensive, gas higher, rent continues to creep up. Some giant incomprehensible national debt number gets higher. Those all suck and people complain about them - but they are complaining about them in packed bars while they drink $7 beers and eat $30 burgers and fries. You can only yell so many times that the world is ending before people tune it out since their day to day lives are largely unchanged. Just look at the focus on complaining about almost irrelevant things like the price of eggs or whatever totally irrelevant culture war topic of the day. It's societal bike shedding. I am firmly of the belief (and have been for quite some time) that the "average" middle class American is going to need severe pain - as in widespread great depression level pain - before anything really changes at all at the ground level. Americans have simply become so used to living the lifestyle being part of an insulated hegemonic superpower empire that they have taken that for granted as how things generally will always be no matter what happens. There is zero consideration for the amount of sheer effort, will, and constant vigilance it took to build and maintain such a state of being. Or put another way: Inertia is a hell of a drug.
jmcqk6 6mo ago
Yeah, it's not indifference or apathy. It is overwhelm. There are too many things that need attention and not enough attention.
atkrista 6mo ago
One word, Hypernormalization.
yoyohello13 6mo ago
I know for my part I am so tired of the constant crises. At this point I just want the inevitable collapse to hurry up and happen already so we can just focus on picking up the pieces and move the fuck on.
tokioyoyo 6mo ago
Because it doesn't really matter and has no legs? Over the past 15 years, we had a lot of data exfiltrations, lots of breaches, hacks, and etc. Nothing really happened, world moved on, people figured out a way to live around it. People who work at those companies get affected, but in general, unless the entirety of banking system collapses because of the hacks... nobody will really care. Even during the hay days of Equifax hack people were chatting how things will "happen this time". Nothing did.

john_strinlai 6mo ago

>And yet, the public conversation around them has been quiet to the point of being strange. i dont think its that strange. there are multiple wars raging on, with many people fearing the breakout of a global conflict. a giant pedophile ring has been exposed that no one in power seems interested in doing anything about. prices for everything are haywire. markets are an absolute rollercoaster, hinging completely on one mans late night tweets. and so on. people just dont have the bandwidth to also learn about what an npm or github is, and why a hack of it is important. news stations are going to pick the news that results in the most people tuning in to watch. that is war, not whatever a mercor is. the non-tech (and many of the tech) people in my life are also just plain tired of hearing about hacks. they have heard that their information has been stolen 10 times or whatever in the last 5 years. they have heard 100s of "this company was hacked" stories. "another hack? who cares?".

tokai 6mo ago
Its the tech worlds equivalent to eating X causes cancer.
ifwinterco 6mo ago
HN is a bit of a bubble in that people here tend to be quite privacy focused and would be horrified at the prospect of their details being leaked. For a lot of normal people that's not the case and as long as they don't get someone actually stealing their identity etc. they aren't really concerned about these kind of things
hydrogen7800 6mo ago
Frustratingly, I have my foot in both worlds to a degree. I'm interested enough in tech to pay attention and often lurk the tech bubble that is HN and hear about the raging dumpster fires from the folks who live and work in that domain. But I exist in a mostly non-tech world IRL where this exists among the other burning dumpster fires to the point that I can't care about another data hack, and i hate that I don't have the bandwidth to care. To a more acute degree, my mother was nearly wiped of half her life savings by "hackers"/fraudsters posing as employees of her bank. Being "hacked" is a part of life now, and outrage fatigue is real.

titzer 6mo ago

> Cisco’s private GitHub was cloned. From this, https://www.sdxcentral.com/news/cisco-source-code-breach-leaks-ai-projects-and-aws-credentials/ https://www.sdxcentral.com/news/cisco-source-code-breach-lea... It sounds like they were/are using GitHub to host company-private source code, presumably of high-value. While it's hard to know exactly the setup (e.g. maybe they are running their own instance of GitHub internally), this is your reminder that public clouds are not secure, no matter how much you pay the maintainers of said clouds. Internal network compromise is of course always possible, but sheesh, it sounds like this list has lots of public cloud failures.

deleted 6mo ago
[deleted]
- deleted 6mo ago
  [deleted]

deleted 6mo ago

[deleted]

jjmarr 6mo ago

> In August 2025, three of the most notorious financially-motivated crews on the planet, ShinyHunters, Scattered Spider, and LAPSUS$, formally combined into a coordinated alliance widely tracked as Scattered LAPSUS$ Hunters (SLH), sometimes called “the Trinity of Chaos” (Resecurity; Cyberbit; Infosecurity Magazine; The Hacker News; Computer Weekly; ReliaQuest). Scattered Spider provides initial access through highly-effective social engineering and vishing. ShinyHunters handles exfiltration, leak-site management, and extortion. LAPSUS$ contributes its own brand of identity-system compromise. Lmao that cybercriminals are closing M&A deals to create vertically integrated SaaS companies. Do you think anyone was made redundant through kinetic means?

deleted 6mo ago
[deleted]
alephnerd 6mo ago
These kinds of groups operate as businesses and in some cases government agencies. It would be the same experience as working for any other tech company.
- jjmarr 6mo ago
  I know. There's a sense of schadenfreude that the Russian hackers are suffering through a big re-org right now.
  - alephnerd 6mo ago
    Yep, but they'll land on their feet. Probably negotiate an ML Infra or SecEng role at Yandex.

nirav72 6mo ago

Not too long ago, a few gigabytes of data being stolen was a big friggin deal. Now they're swiping data in the terabytes or even petabytes.

RajT88 6mo ago
Bad news: All your data with data brokers will be public soon. Good news: All the data of elected officials will be public soon, and we may finally get some regulation.

deleted 6mo ago

[deleted]

cols 6mo ago

Add to this the Rockwell Automation attack and you get a beautiful Chickens-Coming-Home-To-Roost stew! https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a https://www.cisa.gov/news-events/cybersecurity-advisories/aa...

jrm4 6mo ago

[flagged]

ryandrake 6mo ago
> And then, we still have yet to punish or hold accountable any large party who made things this way. Until we do that, keep expecting this. This is the key. No incentive to change. It's always "the hacker's fault" and never "the manufacturer's negligence" or "the developer's carelessness" or "the user's gullibility." Combine this with the currently-prevailing Don't Blame The Victim mentality, and it's the perfect environment for never improving cybersecurity.
- myself248 6mo ago
  But yet, the pigs who built the houses of straw and sticks got eaten. The pig who built the house of bricks is seen as responsible, even though it took longer and cost more; he made the right choice. The wolf is seen as ever-present. Failure to consider the wolf when choosing building materials has consequences. It blows my mind that this story has been part of our culture for centuries, yet we apply exactly the opposite model to cybersecurity.
  - IsTom 6mo ago
    But have you thought about the bonus you can get by reducing house building costs in Q3?
    - stackskipton 6mo ago
      Yea, CyberSecurity will get fixed when companies are held responsible to the point that data breaches have severe impact on bottom line.
john_strinlai 6mo ago
>As someone who's older, and is just generally gobsmacked all the time by the sloppiness in cybersecurity, all of this is just not surprising. as someone who used to work in cybersec (and is also older), most of the time (in my experiences) it isnt sloppiness. 1) people fight tooth and nail against anything that inconveniences them. security is almost always going to be an inconvenience tradeoff, so it is always fought against. from every person and every department. rolling out 2fa was worse than pulling teeth, despite it being a single button press ("approve") on the phone, once or twice a day (or less). c-suite is the worst, demanding exclusions and bypasses. its hard to say no to your bosses boss when they refuse to use a password manager, refuse to setup 2fa, or whatever the case is. 2) security offers no immediate or visible return on investment. so, it gets little to no positive attention by c-suite and even less budget. you end up with underpaid, under-qualified, over-worked people trying to figure out which thing they might be able secure out of the 10 things that need securing. half of them will be tied up trying to explain to someone why they cant use the company name as their password or begging someone to use the password manager. even here, a forum of hackers, security is often put in scare quotes and almost always mentioned beside the word "theater". people brag about still running windows 7, because it was the last good windows. antiviruses arent needed. X security feature is just a lie so that company Z can control my device. people get big mad when a company rolls out mandatory 2fa. and so on. edit: case in point, on this thread a comment was just posted with "I think you can argue that cybersecurity doesn't really matter, in the grand scheme of things."

iJohnDoe 6mo ago

[dead]

stalfie 6mo ago

If I can play devils advocate in favor of public disinterest about these events, I think you can argue that cybersecurity doesn't really matter, in the grand scheme of things. At least data exfiltration. What would the consequences for humanity be if every single electronic patient record was leaked onto the internet? Immediately hugely bad for some groups, unfortunately. After a good deal of embarrassment and drama however, some severe, perhaps the net effect is positive. It would most likely facilitate a lot of scientific inquiry. A lot of people, especially in medical deserts, also use Chatgpt as an md. Providing AI companies with high quality medical data is actually a public service. So it goes for many things in life, and except for financial and destructive wipe attacks, data security is mostly about protecting the IP of incumbents, which is somewhere between irrelevant and a net negative. It's hard to say what the long term consequences of the IP system breaking down would be, but there is a good argument to be made that it's not necessarily bad. As for individual people, most don't really care or are resigned to the fact that Google already knows everything about them, and probably abstractly enjoy the fact that a major company gets brought down to their reality. Plenty of societies have extremely collectivistic mindsets of public info being shared, like Scandinavian countries having public tax filings, and they work just fine. I think most people would secretly relish the outcomes of everything leaking everywhere. Just like people relish the Epstein files being released, and probably would have loved an unredacted version being leaked. Secrets are something human beings naturally gravitate towards to dig up and sharing, and this is actually for good, sensible reasons. Evolution has simply favored groups that did not hoard knowledge, at least not internally. There is a reason the scientific method has openness as a virtue, and is arguably one of the pillars that has carried humanity out of the dark ages.

bradishungry 6mo ago
It would be terrible, I don’t think you’re thinking about what kinds of discrimination can happen due to things like medical records. You can have laws in place to prevent it but if someone can freely see your entire medical history then people WILL take advantage of that. Not to mention how things like citizens traveling to states where abortion is legal, or if a parent disagrees with an operation could affect someone if things are public. This is only talking about medical records, too, the implications of other kinds of espionage have significant repercussions as well. Cybersecurity absolutely does matter

ckcheng 6mo ago

The strangest thing I found is: > on April 7, 2026 … U.S. Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell convened an urgent, in-person meeting in Washington with the chief executives of [major US banks] to brief them directly on the cyber risks posed by [Anthropic’s] Mythos Then a similar meeting happened with the Canadian Financial Sector Resiliency Group (i.e. the Bank of Canada, the Canadian government’s Department of Finance, the Canadian Deposit Insurance Corporation (Canada’s FDIC) and Canada’s six major banks). Multiple central banks don’t usually do that right? https://www.ctvnews.ca/sci-tech/article/anthropics-new-ai-model-is-too-dangerous-to-release-to-public-developers-say/ https://www.ctvnews.ca/sci-tech/article/anthropics-new-ai-mo...

sybercecurity 6mo ago
Two possibilities: 1. Fear that a major vulnerability is found in a commonly used software package that puts multiple major banks and e-commerce sites at risk 2. Fear that major vulnerabilities are found in multiple, widely used software packages that lead to market downturn as IT company stocks crash. Probably others as well. Sounds more like a brief on worst-case scenarios that may happen and how they would effect the US banking sector. This is an important mid-year election this year too, so any big economic shock would be bad for the GOP.
- iugtmkbdfil834 6mo ago
  That, or, not completely unlikely, he was shown all the vulnerabilities across all old software that banking, finance et al use daily and are unlikely to ever update. I am only half joking. There is a reason I think some people should stick to their areas of expertise.
  - eastbound 6mo ago
    It currently works because those vulnerabilities are not exploited en masse. With AI, they can. It does change the game.
    - 6mo ago

iainctduncan 6mo ago

As part of my work in technical diligence, I create medium-long form content marketing material on topics germane to PE investment in tech. In the last six months I did a series (not yet published) on the state of security in the age of gen-AI. Basically, we are entering the ransomware apocalypse. It is insane what a godsend gen-AI has been to the cybercrime sector. When all you need to do is make something good enough to fool some of the people some of the time, genAI is perfect. Things that used to work reliably - like trusting google ads or sponsored links not to be malvertizing sites - are meaningless now that gangs can trivially spin up networks of thousands of fake interacting sites and linked profiles to sneak by fraud detection. Phishing attacks are ridiculously sophisticated, combining voice, text, and video impersonation. Supply chain attacks are going to mean package managers are handgrenades. Ransomware gangs are running full on SaSS services allowing script kiddies access to big gun material. Attacks that were previously only in reach of nation-state-sponsored actors are now available for peanuts. And all of this is going to worse because of everyone and their dog using gen-AI to pump out huge amounts of vulnerable code. And then there is the world of prompt engineering for data exfiltration... If you are young and wanting a promising trade in tech, security would absolutely be a good choice. Shit is going to get CRAZY.

alephnerd 6mo ago
> If you are young and wanting a promising trade in tech, security would absolutely be a good choice. Shit is going to get CRAZY. Yes, but you can't be a CISSP or SOC monkey - that has no future. You need to be an actual Software Engineer who understands development fundamentals, OS internals, web dev fundamentals, algorithms, etc as well as offensive and defensive concepts. To many "cybersecurity" graduates in North America aren't even qualified to do L1 IT Helpdesk, which is a shame because the IT to Security talent pipeline is critical (along with the SRE, SWE, and ML to security pipeline).
- iainctduncan 6mo ago
  Definitely agree. I guess I should have specified I meant "real programmer who wants a career". ;-)
- 6mo ago

lubujackson 6mo ago

I have this mental model that the natural state of the web is to act like an organism that is continuously assaulted by viruses - sometimes that is SEO spam, sometimes actual viruses, sometimes a game-changing shift like AI vulnerability scanning. The pattern is the organism gets assaulted, digests the virus and comes back a bit tougher with more layers of complexity and defensiveness. I think right now we are waiting for the Morris worm (https://en.wikipedia.org/wiki/Morris_worm https://en.wikipedia.org/wiki/Morris_worm) equivalent shock to the system, but it is likely to be much, much worse and much more specific. I expect something that will make DOGE stealing SSNs look kind of tame. Something like every private GitHub exposed, every Visa card data and history exposed, every Mac injected with a rootkit, etc. It's like waiting for the plot from Sneakers to manifest. For all the security we have built over the last 50 years, it has been impossible (or nearly so) to lock down any web-accessible content. It is a structural issue at a certain level of complexity, the surface area is just far too wide for any focused effort. Aside from direct 0 day vulnerabilities in software there are vulnerabilities in core libraries, frameworks, CI/CD, cloud services, hardware bugs, gaps between services, permission vectors, etc. The U.S. has relied on the legal system to allow our insane credit card system to persist, where security by obscurity (knowing someone's CC#) is the main deterrent to abuse. I need a complex password to access any website, but CC#s are flying free. I think the combination of easy worldwide vulnerability scanning and U.S.'s focus on pissing every country off is going to lead to significant and unending asymmetrical warfare. If our gov't has been co-opted by big business, big business is going to become the target. As we have seen with Iran with Hormuz and Ukraine with drone strikes, it isn't so hard for small countries to fuck up global systems. We are entering a 90s-style phase where any script kiddie can cause massive disruptions. Trump likes to threaten NUCLEAR but security issues could potentially cause even more death and destruction - overwhelm the energy grid, open dams, crash air traffic control communications, etc. There is lots of concern over the oligarchy owning AI and keeping it for themselves, but the more immediate risk is that any country can potentially lash out with disruptive actions. There has been a retreat from globalization since COVID. I wouldn't be surprised if that extends to global internet communications as well. Internet traffic between countries might soon be severely restricted, that's the last line of defense we actually have if this goes as badly as Anthropic is implying.

mring33621 6mo ago

Or not

__alexs 6mo ago

Anthropic's marketing team are terrifyingly good. I wonder if Opus came up with this plan?

0xdeadbeefbabe 6mo ago
This AI and security genre really has legs.
theincredulousk 6mo ago
Cultivating and leveraging fear is truly a cornerstone of Security™. I don't think the claims about capability are ridiculous. The idea that the general capability is proprietary and that it will be exclusive to the trusted partners of one company is ridiculous.
HDThoreaun 6mo ago
All the big tech companies are getting access to mythos. If anthropic is blowing smoke with regards to its ability to find vulnerabilities it will leak very soon.
- lelanthran 6mo ago
  > All the big tech companies are getting access to mythos. If anthropic is blowing smoke with regards to its ability to find vulnerabilities it will leak very soon. Will it? All the big companies are invested in AI anyway; the people getting exclusive access to this are going to be under an NDA anyway. It will leak eventually, but the news that is isn't much better than current models news may not be enough to dispel the original claims.
- attentive 6mo ago
  No need to leak. If we don't see a very public flow of various CVE's across the industry then it was a nothing-burger.

gcr 6mo ago

If cybersecurity is slowly ramping up in complexity, isn’t the statement “we’re living through the most consequential hundred days in history” always trivially true?

tptacek 6mo ago
Yep.

semiquaver 6mo ago

I know this ship has sailed but the modern term “cyber” usually referring to offensive or defensive software technology (presumably short for cybersecurity) drives me up a wall. It’s even worse than “crypto”. I find that people who use this term are, ceteris paribus, likelier to be full of crap.

jjtheblunt 6mo ago
"order of magnitude" seems to also be silly-speak very often, trying to sound more technical than "ten times". i suppose it is similar to "exponentially" being used when it doesn't mean exponentially.
- dvfjsdhgfv 6mo ago
  > "order of magnitude" seems to also be silly-speak very often, trying to sound more technical than "ten times". But these are two different things. If I hear "ten times" I assume the person actually means ten times; when they say "an order of magnitude", I'm aware they might mean 8 or 12.
  - jjtheblunt 6mo ago
    agreed...thought of that after writing it, and thanks for noting it too. i thought the order of magnitude is often hipster phrasing, even on HN at times, but, when actually intended, it's like saying floor(log_base10( whatever )), so the ten times thing would have to be "roughly ten times" for example, to be comparable. Also, in some contexts the base isn't presumed to be 10, of course, though around here in loose jargon that's usually what folks are saying.
tptacek 6mo ago
It's so firmly established that, just like crypto, making a stink about it says more about the objector. I don't like it either! "Cyber" is cringe, and "crypto" should mean "cryptography". But I'm not the king of usage, and both those terms have new meanings.

tosser12344321 6mo ago

I'm a head of security, great career, did engineering into management, made a tidy living doing advanced work as a risk plumber across companies that have been relevant. I've built great teams, met and solved hard IR, delved into the real reaches of vuln research, other neckbeard things, got paid very well along the way. Seen and worked on the APT issues. More or less, I am the attractive resume, and: the game has changed folks. For what it is worth, I am taking my ball and going home in about 12 months. I've saved enough, locked in a perma-middle class lifestyle in a great nondescript city, and swapping over to offensive consulting and a AI-free, non-tech trade that won't take too long to get into - think a PA, nurse, plumber, etc. I'm not quite old enough and with the end of responsibilities as to FIRE, but I can read the writing on the wall enough to understand an AI-proof FI needs to be locked in before everyone else realizes the same. Many others in sec are feeling this. I think tech will find security pros willing to throw themselves into the fray for pay and optimism. There are others like me who are extracting their final nuts. There are others who have golden-handcuffed themselves into this ride with their mortgages and private school tuitions. And I'm sure some others will stick it out. There will also be an AI-enabled version of sec eng soon enough. But if private sector doesn't wake up to AI integrations - internal doc rollouts hoovering up PII that wasn't supposed to be stored there, externally-facing customer support portals social engineered and pivoted into, PRs via Slack comment via marketing hires who are ATO'd - this is going to be a 1990's-style BBQ where 0days on critical systems are dropped at happy hours at conferences nightly. And: your security teams are going to be burned out, banking up, and quitting. The risk acceptances, the double-speak, the slow-rolling, the half-baked risk thinking for engineering and product leads, the corners cut, the public endpoints opened up just this one time - that's going to be enough rope, and already is enough, to hang yourself in this offensive context that's building now. It is deeply humorous that SWE and engineering leadership has worked itself into this position via its AI push to unemploy itself while thinking it's the 1x white collar job exempt from automation threats. All it'll take is another recession like '08, and the leaves get shaken off the trees finally. Thankfully there is only one (wait, there are two probably), thankfully there are only two-to-three (wait, there are like 10) systemic market threats right now.

theturtlemoves 6mo ago
> a AI-free, non-tech trade that won't take too long to get into - think a PA, nurse, plumber, etc. I'm not sure if personal assistant or nurse are going to be AI-free. Plumber, welder, bricklayer, pest exterminator, sure. Don't underestimate the downsides of physical labor, though. Low pay and backbreaking. What writing on the wall? If anything, I think you'll be more needed, not less, in times to come.

myth_drannon 6mo ago

Looking at the Israeli startup scene, there is a huge surge in cybersecurity investments (especially agentic security) in the last couple of months, looks very abnormal. https://www.calcalistech.com/ctechnews/article/hy8t7fcobe https://www.calcalistech.com/ctechnews/article/hy8t7fcobe

alephnerd 6mo ago
There's nothing abnormal about that. These were all funded 2-3 years ago (heck I participated in some of these). Companies only go out of stealth when they are publicly announcing their Series A (usually right around the time of a major buyer event like BSides/RSA or DEFCON/Blackhat. Funding rounds usually happen around 5-6 months before they get announced on TechCrunch or Calcalistech becuase such information are a signal to competition about a specific approach. It's also a massive distraction from building, because then you have to deal with media, press releases, and actually have a product marketing team. You don't want to do this until you can hire a couple PMs and PMMs (which is usually around the seed-to-series A transition becuase you will have hit the $5M ARR mark by then). This how stuff is done here in SV as well and has been for decades.

KIFulgore 6mo ago

I miss the days when the big security concern was quantum breaking contemporary encryption. Air gaps and local stacks are overdue for a comeback.

Animats 6mo ago
Even that may not work. See Stuxnet.[1] [1] https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
- KIFulgore 6mo ago
  Yep, there is always the human factor. Leave a USB drive in a parking lot, someone will insert it. You don't even need an obvious drive anymore, a malicious cable will suffice.

Animats 6mo ago

Almost all those events were on Hacker News. This hasn't been a secret. Companies need to get serious about levels of security. Only some things need to be protected, and you have to accept a substantial level of inconvenience and cost for those items. In my aerospace days, we had a bidding rule of thumb that running a project at SECRET doubled the cost. Running a project at TOP SECRET had an even bigger cost multiplier. A surprising amount of material was not classified at all, for cost reasons. Banks and credit card processors get this. Most other businesses don't.

halJordan 6mo ago
They've been on HN, but that's the author's point. Even this article on HN- the top comment is a series of complaints about "hurr durr ai needs to get off muh lawn" The point is that the people, who self-identify as the ones the author is supposedly asking for help, are the ones who are refusing to acknowledge the elephant in the room so they can feel smug. Just like your "but i read about every incident mentioned, where's my cookie"
- culi 6mo ago
  I don't think the author is asking HN for help. Just pointing out that the sky is falling
UltraSane 6mo ago
The most effective security practice you can do is to strictly isolate any internet connected PC from computers handling important data. But this requires that people have two (or more!) different computers and is rather annoying. More convenient is to only allow internet access from ephemeral VMs connected to via RDP or similar protocol.

themafia 6mo ago

> And yet, the public conversation around them has been quiet to the point of being strange. These events aren't new or novel anymore. The fact that the news does or does not report on something is indicative of editorial prerogatives and nothing more. > This is a curious observation more than a complaint. We went from 25% of the world population using the internet to now more than 80% are on the internet. More people understand the fundamental issue, and so are uninterested by it, so for-profit publications will not cover it.

CoryOndrejka 6mo ago

Combine every attack being a social engineering attack plus foundational model hacking-fu and we're in a shocking interesting place. Identity itself becomes a pretty interesting opportunity/threat. Wrote an oped [1] with friends from Badge on this topic 6 months ago. [1]: https://idtechwire.com/opinion-in-an-ai-world-every-attack-is-a-social-engineering-attack/ https://idtechwire.com/opinion-in-an-ai-world-every-attack-i...

thordenmark 6mo ago

Yes, AI is getting better at finding exploits and cracking software, but it will also get just as adept at defense. It will all escalate, but mostly maintain parity.

fzzzy 6mo ago
An attacker only has to win once. A defender must win every time

xtracto 6mo ago

A couple of days ago I was thinking about something related to this: How would the "computing" space look like once we get to the ultimate evolution/development of the AI/LLMs or whatever comes after it? Say in 10 years, once we have things like a Claude Mythos (or better) model running on "real time" at the speed of how Taalas runs ollama now. I have a feeling that "cyberspace" (however we want to call it) won't matter anymore. "Computing" won't matter anymore. Say, I want to implement a Massive Multiplayer Lemmings like game, it's done at the snap of my fingers. Say I want to find a way to "crack" X software? done. Say I want to find a vulnerability in Y website? easy peasy. Say I want to build a "Powerpoint" clone, done (not that it matters, as making a presentation will be as simple as saying "Mythos5, make a presentation about X,Y,Z with nice and meaningful transitions". Same with music, video, images, etc. Once everything can be created automagically... what happens? (say, "Make me a film like the original John Wick but with the wit and style of Kingsman, make a young Sean Connery the main actor). So, ultimately cyberspace will be so chaotic with the current "rails", that it will be completely different to what we know now. At the risk of being booed here in HN, I also have a hunch that the more we go there, the more stuff like "trustless computing" or "proof of N" (having to SPEND something, some real life, finite effort, to do things online) will gain more force. Somehow, Hashcash was conceived to deal with spam/automation type of attacks, so I assume a version of that will have to be used to "structure" Cyberspace in the future. My hypothesis is that this will take us back to "the real world" due to "surfeit": Kind of what happens once you add a "trainer" to a game and suddenly you have all the money/resources, and then it becomes boring. Once the "digital" stuff is solved, we will go back to the real world. Very exciting times.

levek 6mo ago
> Say I want to find a way to "crack" X software? done. Say I want to find a vulnerability in Y website? easy peasy. OTOH, such a powerful model might be able to do formal verification practical, too. So your model might say "Can't get RCE on that software because the model that developed it also created a proof that that's impossible". > Once everything can be created automagically... what happens? The people who can come up with novel concepts would matter a lot more then than they do now. Like how image models can create pictures in the style of van Gogh, but they wouldn't if van Gogh hadn't existed. So we'd need "van Goghs" to come up with the new things that the models would create a thousand varieties of. > Somehow, Hashcash was conceived to deal with spam/automation type of attacks, so I assume a version of that will have to be used to "structure" Cyberspace in the future. "Proof of N" doesn't need to involve spending something. It could be "proof of citizenship" (or some other "proof of offline identity") combined with rate-limiting per identity. The right cryptographic protocols could do it without revealing your identity to the service you're interacting with.

xtracto 6mo ago

I wonder, how long until that certain CrowdStrike kernel level plugin that brought down a third of the world's Windows comptuers gets hijacked by a malicious actor.

sdevonoes 6mo ago

Finally we know what AI is good for! And It’s not about make mundane developers more productive

angry_octet 6mo ago

It really hasn't been insane, that is just recency bias. Better spam, some niche capabilities like voice cloning, some scalability to applying an exploit to more targets at once. Anthropic et al having better exploit dev is a capability which aids both sides. But regardless, most exploits use n-days not 0-days.

croemer 6mo ago

Hard to read due to LLMisms (it's not x, it's y), just a few examples: > The silence has not broken in mainstream public discourse. It has clearly broken in private, at the top of the U.S. government, in classified briefings and emergency convenings the public is mostly not seeing. > The historian’s question is no longer whether the cyber community is being quiet. The historian’s question is why the public conversation is so thoroughly out of sync with what is clearly being discussed behind closed doors at the level of the Treasury and the Federal Reserve. > That obscurity is the part of this section that matters most. It is not the AI numbers. It is the silence around them.

0rbiter 6mo ago

> Mythos had identified thousands of previously-unknown zero-day vulnerabilities in every major operating system and every major web browser, along with a range of other critical software. I think we can assume that the alphabet agencies already got their hands on this and are working to use it. No more backdoors necessary, they can crack open every computer on earth with this. Did OS/software vendors get a list of their vulnerabilities? Will they ever?