Hacker News

Likely referencing https://www.crowdfense.com/exploit-acquisition-program/

Zerodium used to offer up to 300k in 2021 https://www.securityweek.com/sites/default/files/images/Zero...

These brokers usually don't pay the bulk sum - they sell access to nation actors and you get payed out over time as long as the bug is not patched to discourage reselling and burning it. I doubt anyone would confirm if they got the full payment or not for something similar.

What do you think the venn diagram looks like for people willing and able to find things like that prior to LLMs and also sell them to a broker, and are also stupid enough to flaunt a massive flashing "arrest me!!!" sign

Closest you're going to get is something like those kids in florida who just got wrapped for putting malware into steam games and draining peoples accounts. They were going to get caught anyways but it would have taken a lot longer to build a case against them if they weren't flaunting it on socials

"People paid $5,000 for a Macintosh computer when they were new. I found one at a yard sale for $25."

Ok, we've taken $500k out of the title above.

> modified like they are holy scripture

So never modified at all, even if plainly contradictory and/or ethically and morally compromised?

sloptimists are liars

not big surprise

Oh it's even worse: https://developer.wordpress.org/plugins/creating-tables-with...

>Rather than executing an SQL query directly, we’ll use the dbDelta function

>Note that the dbDelta function is rather picky, however. For instance:

>You must put each field on its own line in your SQL statement.

>You must have two spaces between the words PRIMARY KEY and the definition of your primary key.

>You must use the key word KEY rather than its synonym INDEX and you must include at least one KEY.

>KEY must be followed by a SINGLE SPACE then the key name then a space then open parenthesis with the field name then a closed parenthesis.

>You must not use any apostrophes or backticks around field names.

>Field types must be all lowercase.

>SQL keywords, like CREATE TABLE and UPDATE, must be uppercase.

>You must specify the length of all fields that accept a length parameter. int(11), for example.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

What an awful fix. Does WordPress seriously still use basic string concatenation (edit: and sprintf) to build SQL queries?

Ahhh very interesting! Thanks for pointing this out, I saw an attack against one of our sites this weekend using this exploit.

> data: {'requests': [{'method': 'POST', 'path': 'http://:'}, {'body': {'requests': [{'method': 'GET', 'path': 'http://:'}, {'method': 'GET', 'path': '/wp/v2/widgets?author_exclude=1%29+AND+1%3D0+UNION+ALL+SELECT+0%2C1%2C0x323...

>>Principal Software Engineer @ Bluehost. WordPress Core Committer. Baseball fan.

hmm yes, definitely. You are the principal.

I agree. This is so toxic! It feels like the Instagram of articles. "Look how my life is great" - yeah sure, you're posting only happy moments.

Not only $25 is not accounting the years of experience, but also all the failed attempts.

Should also note the math done on the token costs. $25 of subsidized tokens because he's on a subscription plan.

I can't agree with this more. May cooler, more compassionate minds prevail.

And nobody would post "I did it for free!" if they had done it themselves, but somehow spending $25 on tokens changes how we're supposed to look at it

I still don't understand why, for a blog, a static page isn't enough - especially since most of the WordPress issues are "solved" by adding caching.

I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in the core or on the thousands of plugins) in order to unlock its RCE-as-a-service functionality.

Propably untrue, the only way to know is to do threat intelligence, and inflitrate those telegram groups where these brokers operate, I doubt the writer of the article did that. Maybe he conflated any vulnerability with a 0-day one?

  WordPress is one of the most hardened targets of all time

some statistics point to almost 50% of all websites on the internet running on Wordpress, $500k for an undisclosed 0day unauthenticated RCE doesn't seem so unrealistic to me

This might help https://chatgpt.com/cyber ease the guardrails a bit.

They would not catch it, it requires combining multiple vulns.

They are placeholders, their meanings are spelled out in the post:

    O: publish/oembed_cache, empty content, stale timestamp with parent C
    C: future/customize_changeset, changeset JSON with parent C
    P: draft/page, with parent D
    D: parse/request with itself as its parent
    S: publish/post, for providing embed data
    T: publish/post, containing the outer embed

Then why didn't we see the same writeup earlier? If you look through the writeup, you still need the skills to go through what the LLM gives you and actually create a valid proof of concept.

I've been using LLMs to find security vulnerabilities and there is no way I can just submit what I found and call it a day (many try).

You read articles regularly about how X authority is provided cloud LLM history and uses it as evidence to prosecute a defendant.

Yet you think professional criminals are too stupid to launder their activities through an unscrupulous yet legal intermediary?

People who make the money are not necessarily the people who can write the best code.

Elon Musk didn't write code for a rocket, he hired people who could.

> Computers have been superhuman at playing chess for decades now.

And at doing arithmetic for even longer /i

Historically, a lot vulnerabilities in PHP projects were because of PHP itself. Things like register_globals, remote includes/reads using functions that supposed to read local data and so on.

| We will all benefit from more secure systems

the people that can afford it, sure.

The market will quickly adjust to the point where spending $50 on tokens will on average give you a vulnerability valued at $50. Maybe $100 to account for your edge in having a better prompt and the risk of prison time you take in selling the exploit

In fact that may well be true today. OP didn't try to sell it to discover the true price the market is willing to pay. And we all know that "somebody paid $$$ for something similar in the past" is no guarantee that somebody else is willing to pay any significant sum for your thing today. If it was, startups would be a lot easier

I don't think OP got $500k , it's only clickbait in the title.

One LLM prompt can't get you $500K. Why would someone spend $500k instead of just prompting themselves?

Don't get all starry-eyed, the people owning those sites also have access to LLMs, so both the hacks and paydays are rare.

| in today's world software needs continuous pen testing and scanning

points to a bigger problem perhaps; software design, construction and distribution is fundamentally flawed.

https://github.com/WordPress/WordPress/commit/c474dc6051dd60...

Unquestionably they did not.

Their listed pricing was up to $50k.

https://cyber-peace.org/wp-content/uploads/2017/09/ZERODIUM-...

And that was before LLMs could produce these at volume.

The demand (dollars) does not go up commensurately with the supply. So today maybe $500 or a few thousand. Maybe not even that.

Probably not. The Wordpress Bug Bounty program pays very little. Exploit brokers will pay 500K, but we wouldn't be seeing it here if it was sold.

Thanks

So people coding with LLMs shouldn't get paid then, right?

It baffles me how this can be said without concern for first order consequences.

I agree! We should go all the way though and credit the authors of the data the LLM was trained on. People who just run LLMs training scripts should never get a reward or credit.

You can run Wordpress locally in your own sandbox to test these vulnerabilities, you don’t have to break any laws.

I have not yet seen an alternative for Wordpress + woocommerce for a simple e-commerce site that is not more expensive. I am open for alternatives tho if anyone knows any

does Astro do WYSWIYG?

lol. Simple case of if you have to ask, you probably shouldn't.