Comment by unsnap_biceps

6 months ago

For those of you who don't want to click into linked in, https://hackerone.com/reports/3125832 is the latest example of a invalid curl report

20 comments

unsnap_biceps

Reply
harrisi  6 months ago

This is interesting because they've apparently made a couple thousand dollars reporting things to other companies. Is it just a case of a broken clock being right twice a day? Seems like a terrible use of everyone's time and money. I find it hard to believe a random person on the internet using ChatGPT is worth $1000.

  • billyoneal  6 months ago

    There are places that will pay bounties on even very flimsy reports to avoid the press / perception that they aren't responding to researchers. But that's only going to remain as long as a very small number of people are doing this.

    It's easy for reputational damage to exceed $1'000, but if 1000 people do this...

    • cratermoon  6 months ago

      One might even call it reputational blackmail. "Give me $1000 for this invalid/useless bug report or I'll go to the most click-baity incompetent tech press outlets with how your product is the worst thing since ILUVYOU."

  • bluGill  6 months ago

    $1000 is cheap... The real question is when will companies become wise to this scam?

    Most companies make you fill in expense reports for every trivial purchase. It would be cheaper to just let employees take the cash - and most employees are honest enough. However the dishonest employee isn't why they do expense reports (there are other ways to catch dishonest employees). There used to be a scam where someone would just send a bill for "services" and those got paid often enough until companies realized the costs and started making everyone do the expense reports so they could track the little expenses.

jasinjames  6 months ago

Can someone explain the ip address in the hackerone profile[0]? I can't tell if 139.224.130.174 is a reference to something real or just hallucinated by the LLM to look "cool". Wikipedia says that this /8 is controlled by "MIX"[1] but my google-fu is failing me atm.

[0] https://hackerone.com/evilginx?type=user [1] https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...

  • dpifke  6 months ago

    Per WHOIS, it's assigned to Alibaba Cloud (could be a VM there):

      inetnum:        139.224.0.0 - 139.224.255.255
  netname:        ALISOFT
  descr:          Aliyun Computing Co., LTD
  descr:          5F, Builing D, the West Lake International Plaza of S&T
  descr:          No.391 Wen'er Road, Hangzhou, Zhejiang, China, 310099
  country:        CN
  admin-c:        ZM1015-AP
  tech-c:         ZM877-AP
  tech-c:         ZM876-AP
  tech-c:         ZM875-AP
  abuse-c:        AC1601-AP
  status:         ALLOCATED PORTABLE
  mnt-by:         MAINT-CNNIC-AP
  mnt-irt:        IRT-ALISOFT-CN
  last-modified:  2023-11-28T00:57:06Z
  source:         APNIC

darkoob12  6 months ago

You can tell it's ChatGPT from the stupid icon. In one of the iterations they started using thses emojis which are disturbing for me. The answer to the first question has obvious ChatGPT writing style.

nneonneo  6 months ago

Good god did they hallucinate the segmentation fault and the resulting GDB trace too? Given that the diffs don’t even apply and the functions don’t even exist, I guess the answer is yes - in which case, this is truly a new low for AI slop bug reports.

  • terom  6 months ago

    The git commit hashes in the diff are interesting: 1a2b3c4..d4e5f6a

    I think my wetware pattern-matching brain spots a pattern there.

  • bluGill  6 months ago

    An real report would have a GDB trace that looks like that, so it isn't hard to create such a trace. Many of us could create a real looking GDB trace just as well by hand - it would be tedious, boring, and pointless but we could.

    • nneonneo  6 months ago

      Oh, I'm fully aware an LLM can hallucinate a GDB trace just fine.

      My complaint is: if you're trying to use an AI to help you find bugs, you'd sincerely hope that they would have *some* attempt to actually run the exploit. Having the LLM invent fake evidence that you have done so, when you haven't, is just evil, and should be resulting in these people being kicked straight off H1 completely.

      1 reply →

xk_id  6 months ago

Not sure what timeline this is anymore where a tech website loads up a completely blank page on my mobile device.

  • seanp2k2  6 months ago

    Welcome to the web in 2025, where it takes 5MB of JS and everything else to load a blog post containing 640B of text.