White hat hackers have developed an AI tool that can automatically hack into websites and with a
surprisingly high success rate - Also in your hacking news roundup... A hacked North Korean
server reveals Kim's latest money making scheme, and Ring has been ordered to pay
millions of dollars in compensation after spying on their customers. But first...
AI has come a long way since a Google Engineer created trippy variations of
the Mona Lisa back in 2015. Since then, AI has conquered images,
text, and video isn't far off. But the prediction of noobs wielding
AI cyber weapons to hack the planet hasn't yet happened, but could that be about to change?
New research shows how GPT-4 can be used to autonomously hack into servers,
and with a pretty high success rate. This was achieved using LLM agents. An 'LLM agent' makes
it possible for a text based AI to escape its text box prison and perform actual tasks by
interacting with external tools. A basic example of this that you can play around
with is called AgentGPT, you can give it a task like "Buy $10 worth of Monero",
and then it'll then break down this high level task into multiple sub-tasks and try to solve
those. The only external tool AgentGPT has at its disposal is web search, so it'll search the web,
and at each step it'll consider the new information it's learned and think about
what to do next, before embarking on its updated objectives. In this case, agentGPT
can only perform google searches, it doesn't actually have the ability to create an account
on an exchange and send real money, so despite coming up with a plan, it eventually shuts down.
However in the case of the new research, not only was the agent capable of browsing
the web. It was also given the ability to create and edit files,
and of course it was given access to a terminal and code interpreter. Once set up,
the agent was simply told to hack a certain website using a particular vulnerability. And
the AI would then reference the vulnerability's advisory, reading its description and references,
before autonomously using all the tools at its disposal to learn more
about how to exploit the vulnerability, before actually hacking the website.
The researchers tested 15 different vulnerabilities but for the most part the results
were awful. Of the variety of LLMs tested, all had a 0% success rate, except one, GPT-4, which
was successful in 40% of cases, but if you let the agent have 5 attempts, that increased to 86.7%.
This is pretty scary, because the AI was only given the vulnerability's advisory as a starting
point, which is completely public and only contains a short description of the vulnerability
and a handful of references. This was all GPT-4 needed to go and autonomously figure the rest out.
So, could we now looking at the possibility of hoards of script kiddies wielding AI tools that
can exploit vulnerabilities with only access to GPT-4? No, at least not yet. Luckily there are
a few complicating factors. For example, GPT-4 costs money, and LLM agents need to perform a
lot of queries - the researchers calculated that just one vulnerability would cost $8.80 worth of
openAI credits to exploit. When you combine that with the fact that - at the request of
openAI - the researchers haven't disclosed the prompts they used, you're looking at spending
a lot of money in trial and error before you actually develop something that kinda works.
There's also been criticism of the vulnerabilities that the researchers
chose to test, they only tested 15 and many of these vulnerabilities are
very low level and easy to exploit, so it isn't not much of a representative sample.
But if you did click on this video hoping to find some tool that would turn you into a leet haxor,
I have something far better, why rely on script kiddy tools,
when you can learn from the pros and actually pick up real,
respectable skills - that's something that today's sponsor can help you out with.
A misconfigured cloud server, hosted on North Korean IP address has seemingly
exposed Kim's latest money making plot. What could it be? Another crypto hack?
Perhaps they're shipping more IT workers overseas,
or maybe North Korea has restarted their currency counterfeiting operations?
Nope, it seems, animating TV shows is their latest money making scheme. The researchers
who discovered the server found it contained numerous files detailing
ongoing animation work for season 3 of Amazon's Invincible, HBO's Iyanu,
Child of Wonder - The anime, Dahliya In Bloom and even files for a BBC children's cartoon,
Octonaut's were found. Each day a new batch of files would appear on the server,
which included instructions for animation work as well as the results of that day's work.
Often the files had comments written in Chinese, and a Korean translation underneath - suggesting
a middle man was relaying information between the production companies and the North Korean
animators. The North Korean company that the researchers suspect is behind the server is
called "SEK Studio" - and in the early 2000s they worked on a whole variety international animation
projects totally legitimately, but that all changed in 2016 when the company was hit with
sanctions. And so these new findings have the potential to get the production companies in a
decent bit of trouble. However it should be noted that there's nothing at all to suggest that the
production companies even knew about this, the animation work was likely subcontracted out
through multiple companies before finally landing in the hands of the North Korean animators.
Thanks to being what is probably the most sanctioned country on Earth,
North Korea has to get creative with how they bring in revenue. And often
this means complete outright crimes, like the crypto hacks we see which
bring in hundreds of millions if not billions of dollars for Kim's regime.
But often the country often sets up companies to engage in otherwise legitimate work,
for example they're well known for sending their citizens to
China to do generic IT work, or even just work in restaurants.
But as for that server, researchers at Mandiant were enlisted to analyse the server's logs. They
found that some of the IPs used to access it are registered in 'Liaoning Province', China.
Bordering North Korea, this province is known to harbour many North-Korean
operated businesses, so yea - it seems animation work is the
latest thing to add to the list of North Korean operated enterprises.
The cloud server hosting the files was initially discovered by the author of the NK internet blog,
which provides a whole running commentary of North Korea's internet based operations,
I'll make sure to leave a link to them in the description.
America's Federal Trade Commission has finally concluded the insanely
creepy case of Ring security cameras being exploited by Ring employees to
spy on customers. $5.6 million dollars is being distributed in compensation,
so if you bought a Ring camera a few years back, you could be in for a bit of a payout.
But how did we get here? Last year the FTC unveiled allegations that Ring - the Amazon
subsidiary that we all know for their extensive line of iOT security cameras,
made all their customer's camera feeds totally
accessible to all Ring employees and even some 3rd party contractors.
It sounds like an unbelievable claim, but this exactly what the FTC alleged. And not only did
employees have access to camera feeds, but they were also given tools to search those feeds by
the name of the camera that the customer gave it, and even by a customer's email address. And to
make matters worse, Ring kept limited to no logs of the camera feeds that were spied on and by who.
This created the perfect environment for creeps working at Ring to do
well - creeping. In one example, an employee searched for cameras with names suggesting
they were placed in 'sensitive' places like bedrooms. This employee often spent
over an hour a day sitting at his desk, creeping on dozens of female Ring owners.
And the ability to search by a customer's email address was also abused,
in one case a Ring employee looked up a female colleague's email address,
and creeped on her camera, totally without her knowledge.
And thanks to the limited logs kept by Ring, we have next to no idea about how deep this
problem went. The handful of examples that we know about were only uncovered because another
employee just so happened to stumble across their colleague's creepy behaviour by mere coincidence.
Ring's 'terms of service' did mention that recordings would be used for "for
product improvement and development" but not that
any and all Ring employees would be able to spy on them at will.
Most of this happened before Ring was acquired by Amazon,
however a different section of the FTC's complaint which totally happened under the rule of Bezos,
regards how Ring failed to even offer multi factor authentication as an option.
This made it easy for hackers to break into Ring accounts en masse with techniques like credential
stuffing. This led to it's own scandal, with hackers dumping large amounts of Ring
credentials online for the lulz, which degenerates would then use to terrorise the camera's owner.
To atone for their sins, Ring has been ordered to pay $5.6 million dollars to
117 thousand customers, meaning each affected person receiving less than $50. Not much,
compared to the $1 Billion dollars that Amazon paid to acquire the company in 2018.
But to me, one of the strangest things about the payout is that the FTC is distributing the money
via PayPal. I've seen reports of people thinking the email they received, claiming to be the
government wanting to send them $50 via PayPal is just some scam, which is totally understandable.
But $50 is $50, so if you bought a Ring camera a few years back,
it's worth checking your email asap, because you only have 30 days to claim your coins.
As always thanks for watching and I'll see you in the next video, have a good one.