1040
Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked (www.404media.co)
submitted 1 month ago by to c/technology@lemmy.world
131 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 258 points 1 month ago (10 children)

Why would the LLM tool have access to send recovery emails to non account verified emails at all?

That’s insane.

  • permalink
  • fedilink
  • source
  • hideshow 20 child comments
    •
  • [–] 74 points 1 month ago (3 children)

    should’ve asked it to delete the database instead, why else would it have that level of permissions.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 10 points 1 month ago

    Heh. Watched an old episode of Scorpion yesterday. The one with the armed hostage-takers who just had the one demand to the social media data mining company, to delete all the data they've mined. I amused myself a lot, by uttering "I like these guys".

  • permalink
  • fedilink
  • source
  • parent
  • [–] 42 points 1 month ago (2 children)

    Because one of the biggest companies on the planet that has issues with account takeovers clearly has no internal red team working on this stuff.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 27 points 1 month ago (1 child)

    I guarantee they do have a red team that most likely flagged this as an obvious and severe risk. It was ignored by suits experiencing AI psychosis.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 month ago*

    I don’t know, more and more of those teams these days are being headed up by the same folks. Most on the ground, in the weeds know what not to do but the ivory tower keeps building more and more floors without ever updating the foundation.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 13 points 1 month ago (1 child)

    This isn't even a hack, it's just poorly written endpoints.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 13 points 1 month ago (3 children)

    Would you consider phreaking equivalent to hacking? This is AI phreaking.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 4 points 1 month ago (2 children)

    It's not phreaking. Social engineering.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 0 points 1 month ago

    So, I'm currently developing a chatbot for my company. If an LLM needs to do something, a developer must build a tool. It just so happens that this tool that was built did not take traditional security into account. Really it should only be using the tools already built for users, but it seems the Jr. Devs that have been replacing seniors do not have the sensibilities yet.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 1 month ago (1 child)

    TIL about phreaking

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 1 month ago (1 child)

    Then this is also probably new to you

    The Anarchist Cookbook

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 month ago (2 children)

    I need to set aside some time to read that although I'm not an anarchist myself.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 7 points 1 month ago* (2 children)

    It was largely overblown due to it getting banned. It was also published in the height of the Vietnam War, when the big evil communists were coming to brainwash your children into eating each other. It has a lot of blatantly incorrect info, which could be outright “blow up in your face” dangerous to anyone attempting the things in it. It’s not all wrong, but certain recipes have incorrect info that could easily lead to accidents.

    Also fair warning, the UK will give people hard prison time simply for owning it. So maybe keep that shit onion-encrypted if you’re in the UK.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 5 points 1 month ago (4 children)

    Recently I had to cancel an order. The support for the company was an LLM bot. I accidentally mistyped a number in the order id. It accepted it anyways refunded every order on my account that includes the product I wished to cancel.

    I tired to get to a human to correct the mistake and couldn't their phone number is an LLM bot their only chat is an LLM bot.

    It use to not be. But now I'm sitting here the order in my hand cause the bot didn't cancel it. But like 30 orders from the last few years have all been refunded to me.

    I tried to reach em a few more times but couldn't and it's been like a month. I just have like 2 grand usd that I shouldn't and no way to give it back.

    So that's fun.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 1 point 1 month ago* (last edited 1 month ago)

    I hope you saved what you could from that exchange, as well the attempts to contact them. If they ever notice, their AI mistake will become your problem to deal with, (and the kind of news story to end up on a Steve Lehto video).

    If that happened to me, I'd have a chat with my bank, "please help me return this money to where it came from, it was payed in error. They have no way to contact a human and I don't want them to accuse me of fraud down the line".

  • permalink
  • fedilink
  • source
  • parent