Meta’s Muse has a serious 0-day(arstechnica.com)
82 pointsby pavel_lishin3 hours ago9 comments
  • gavinrayan hour ago
    The "zero day" is something they call a "ClickFix Attack"

    Upon Googling "ClickFix":

      > "A ClickFix attack is a social engineering technique... It typically compromises devices by manipulating victims into copying and pasting malicious commands directly into system-level tools"
    I'm sorry, that's not a zero-day, that's idiocy that's as old as time.
    • failbufferan hour ago
      We filed a bug report but the original maintainer seems to have dropped offline. The community's had some success in correcting bugs with low-level hacking, but it's hard to make progress without the source code.
    • theultdevan hour ago
      words don't seem to mean anything anymore.

      clickbait headline should be changed, not a 0-day.

  • willtemperley3 hours ago
    Who in their right mind would install a Meta AI with near admin privileges?
    • josefresco2 hours ago
      "Normies" aka the average user on Meta. They have no concept of what "admin privileges" means and don't really care. I still have a hard time convincing my clients to use secure passwords. I have clients who were phished for substantial amounts of money and STILL don't implement proper security measures.
      • 2 hours ago
        undefined
    • sandeepkd2 hours ago
      Almost everyone who is struggling with AI insecurity and is afraid of being left behind
      • shimman2 hours ago
        No, most workers don't really say this in surveys and polling. They tend to hate LLM tools because it makes their jobs worse, nothing about being left behind.

        The only people pushing the "left behind" narrative is SV + SF + VC since their previous narratives have failed to persuade the public (thank fuck).

        • dgellow2 hours ago
          I’m pretty sure you misread the comment you responded to
    • imagetic3 hours ago
      We all fear the true answer to that question.
    • apazzolinian hour ago
      > Who in their right mind would install a Meta AI

      I fixed it for ya

    • john_strinlai2 hours ago
      most people don't know or care what "admin privileges" even means, or why they wouldn't want ai to have them
    • snapcaster2 hours ago
      almost every normal person
    • jsbisviewtiful2 hours ago
      Normally I’m not one to blame the victims but, uh, yeah who in the world is dumb enough to trust Meta at this point?
    • sick_of_slop2 hours ago
      “They trust me, dumb fucks”.
      • alex11382 hours ago
        And before this gets flagged or downvoted or "he was young" or "he was joking" or "he was making a point: he was saying 'I could be anyone', not that he can't be trusted" answer me what other tech people say this, ever, along with all the other charges ("I'm going to fuck them [the Winklevoss twins] in the ear", "You can be unethical and legal and that's how i live my life haha", hacking Crimson reporters, and that's just at Harvard, let alone when Facebook became available to the public
        • matroxmemoriesan hour ago
          Honestly, a lot of people start using this line of humor when their peers do. Add in that he was young, and this was before people’s private messages being released easily to the masses was common, Im not really surprised.
        • alex1138an hour ago
          Yeah - I just went from +1 to -2

          It is clear some of you are brigading. And I don't care if my comment 'breaks site rules'. It happens a lot here. I know you're from industry and you're brigading to protect your industry

  • yalok2 hours ago
    > macOS has long provided a simple means for apps to handle dictation and transcription in processes that stay securely on the device

    Not sure these guys realize that the quality and latency of those Apple services in MacOS is way lower than SOTA and not too many people use them because of that…

  • il2 hours ago
    How is this a serious zero day if it requires local code execution to run?
  • sippingabonedry2 hours ago
    Maybe they should have spent the money used to buy its stupid name from a band on additional testing instead.
    • NDlurker6 minutes ago
      Why would they pay Muse? Muse the band doesn't have a monopoly on the word muse
    • axus2 hours ago
      Did the band end up getting money for that?
      • echelon2 hours ago
        Presumably. They changed their handle on non-Meta social networks to match at around the same time as the Meta handle change.
  • adamsb6an hour ago
    Is 12 hours to deliver a local privilege escalation fix not a good response time?
  • peri-cl3 hours ago
    I'm confused what the vulnerability is. Does macOS have some specific function for protecting key material, that it's unexpected that if you execute user-privileged code locally, outside of a sandbox, it gets full read access?
    • voxic113 hours ago
      Yeah macOS security is capability based rather than purely identity based. So if you don't pass the required entitlements to an application then it cannot do stuff like read from the system keychain even if its running as your user.
  • chews21 minutes ago
    I love that when you open a web inspection console on facebook, it says "Stop! This is a browser feature intended for developers. If someone told you to copy-paste something here to enable a Facebook feature or "hack" someone's account, it's a scam and will give them access to your Facebook account. See https://www.facebook.com/selfxss for more information."
  • SoftTalker2 hours ago
    A zero day? Of course it does. It likely has many. Given the history of software, it's impossible to think it wouldn't.
    • tcdent2 hours ago
      You would think a website dedicated to talking about software engineering would agree with this sentiment wholeheartedly.
      • dgellow2 hours ago
        A zero day generally means a vulnerability and associated exploit have been identified and the vendor didn’t yet provide a patch. It doesn’t just mean “there is a vulnerability”. To say that every software has vulnerabilities is just not a useful comment
        • Caracas28830 minutes ago
          The difference between

          "We found aliens!"

          And

          "Aliens are out there!"