It feels like we hit an inflection point in the last week or so. Kind of a large tidal wave to crash on the coast, but likely not the tsunami yet. I hope.
If you are running services and don't yet have an easy way to react to these things with swift process defined, I hope you don't like to sleep.
Its really not that hard to secure your servers, especially if your not a high value target. If you are a high value target, you should have security professionals on staff.
I dont think my security posture is all that much different than it was last year. Use a Secret Manager and or encryption, have backups, strong firewall rules, use canaries of some kind.
If anything llms are making security worse because there's more people offloading their thinking on llms, or people that skipped some steps in their learning journey because they just ask the llm to do everything. I dont think its necessarily because attackers have llms now, but that contributes.
Edit:
Damn Im getting mega downvoted for saying this. So are people of just at a consensus that there's nothing you can do? That we're in security armagedon???
Have you ever thought to consider that security took hit along with the general degradation of software because of AI??
Wow, that isn't clear.
Is there an incident, or did they just become aware about MPTCP vuln?
Details on the mptcp are also pretty scarce as well right?
(Former akamai employee) Akamai have an incident process that handles both "things are bad for multiple customers" as well as "we need eyes on this from multiple departments/stakeholders asap". If you're hitting a wall debugging an issue on your own, especially if it's not overtly customer impacting, declaring an incident is an effective way of getting the attention needed to solve it.
Once you declare the incident, the process includes these status page updates, alongside equivalent internal status updates.
In this case, they probably wanted to maximise coordination, so used the process designed for that.
Yeah agreed. I actually only noticed because my two boxes are super slow and I've been troubleshooting for about an hour. Finally opened up the Customer Support page and this was the top incident.
All companies should at this point invest a lot of money into defensive AI. In ~July the AI hit crypto and bitcoin, where it's the easiest to extract the most money.
Now the AI powered attacks are hitting infra and SaaS. Next (~December), it will hit classic infrastructure, banks, small businesses, etc.
By mid next year, we will be over this hump with defensive AI being required part of everything.
Its already happening to classic infrastructure, small and medium size businesses. Absolutely anyone can summon a gremlin capable of exploiting stuff like this or the PHP thing last week. There are clankers probing this stuff all over the place within a day of it going public.
I find it breathlessly funny how people think it's going to be AIs vs AIs fighting it out with light sabers and plasma lasers in the cyber space or some shit.
Your intuition that this can be balanced out is wrong. When you have a CVE in your TCP stack, your vault unlocks and you're fucked, it's done. My dude, there is never going to be AIs scanning every incoming packet for signs of a 0day, and deciding whether to, uhh, cut it up with a lightsaber and shoot it with a laser pistol. Your options are to have a stack so secure that it can't be targeted, or to disconnect all network cables.
So it begins. The war against the abliterated AI models. Even at 1,000 TPS any service is a target.
Imagine swarms of abliterated frontier AI models that reach >20,000 TPS. As I said before [0] you are going to have to hire specialized security engineers or technical bodyguards from the senior to senior staff level using AI agents to protect your entire business.
"You got it. Corporate core data for Tessier-Ashpool S.A., and that ice is
generated by their two friendly AI's. On par with anything in the military
sector, looks to me. That's king hell ice, Case, black as the grave and slick
as glass. Fry your brain soon as look at you. We get any closer now, it'll
have tracers up our ass and out both ears, be tellin' the boys in the T-A
boardroom the size of your shoes and how long your dick is."
OpenClaw agents continuously scanning your prod infrastructure and applying config tweaks and package updates autonomously on the fly in response to viral CVE numbers trending on X.
Primeagen went over this in the last episode or two - apparently this sort of defense is costing ... one of the big models or companies hosting them ... $900k/day or something to constantly run the best model and monitor 24/7 to combat the attacks [0]
I don’t really have experience running anything like this so this is very much a comment front the peanut gallery but
Is that really the best way to do things? I’m not really sure what an agent offers here does it just look at logs and do actions? I would not really feel safe if that’s my service’s answer to security.
I could see it maybe as a really smart filter to block ips that are sending probing requests but I don’t really see that as a good reason to have an agent be sitting 24/7 looking at logs.
More likely we'll just see another shakeup of the layers of abstraction that the average company operates at. Why would you hire specialized people when AWS can do so for you?
Yeah it is, but everyone forgets this board was launched in the 90s for discussion of the 1995 movie "Hackers", not for discussion of hacking in general.
If you are running services and don't yet have an easy way to react to these things with swift process defined, I hope you don't like to sleep.
I dont think my security posture is all that much different than it was last year. Use a Secret Manager and or encryption, have backups, strong firewall rules, use canaries of some kind.
If anything llms are making security worse because there's more people offloading their thinking on llms, or people that skipped some steps in their learning journey because they just ask the llm to do everything. I dont think its necessarily because attackers have llms now, but that contributes.
Edit:
Damn Im getting mega downvoted for saying this. So are people of just at a consensus that there's nothing you can do? That we're in security armagedon???
Have you ever thought to consider that security took hit along with the general degradation of software because of AI??
Once you declare the incident, the process includes these status page updates, alongside equivalent internal status updates.
In this case, they probably wanted to maximise coordination, so used the process designed for that.
I left because I didn't like the pressure / pager duty, but I seriously respect how smooth and well thought out their operations were.
I never even heard of it.
Your intuition that this can be balanced out is wrong. When you have a CVE in your TCP stack, your vault unlocks and you're fucked, it's done. My dude, there is never going to be AIs scanning every incoming packet for signs of a 0day, and deciding whether to, uhh, cut it up with a lightsaber and shoot it with a laser pistol. Your options are to have a stack so secure that it can't be targeted, or to disconnect all network cables.
It is possible to write more secure software[0], companies just choose not to prioritize security.
[0] https://cr.yp.to/qmail/qmailsec-20071101.pdf
I think that was the joke.
Don't use MPTCP is the first mitigation, but my understanding is this might be exploitable without MPTCP.
I don't see how web services proceed like business is normal.
- Tell HNN: pets.com was *not* owned today
- Tell HNN: about:blank was safe, too
- Show HNN: my new gopher protocol project—no currently known CVE 10's
(archie and veronica are non-denumerable)
Imagine swarms of abliterated frontier AI models that reach >20,000 TPS. As I said before [0] you are going to have to hire specialized security engineers or technical bodyguards from the senior to senior staff level using AI agents to protect your entire business.
Otherwise you are cooked.
[0] https://news.ycombinator.com/item?id=50310312
I'm hoping goverments take stock of what is online that needn't be.
[0] https://www.youtube.com/watch?v=9OahTki4cPA
Is that really the best way to do things? I’m not really sure what an agent offers here does it just look at logs and do actions? I would not really feel safe if that’s my service’s answer to security.
I could see it maybe as a really smart filter to block ips that are sending probing requests but I don’t really see that as a good reason to have an agent be sitting 24/7 looking at logs.
Ask HN: Who didn't get hacked today.