One example they use in the blog post is curl. Not maintained or developed by a billion dollar company.

I suspect open source projects are better off than proprietary software - they already have many eyes on them, whereas commercial software that’s not a prominent and profitable target (e.g. windows, ios) hasn’t had much attention until LLMs made attacking them significantly easier

The average enterprise software is swiss cheese. It seems the hacker news type that likes to post just doesn't realize how much business/enterprise software exists out there. An F100 company has thousands, maybe tens of thousands of applications that you've never heard of and never will unless you work for them. Industry has applications ran by relatively few people, but it's keeping processes that make the modern world work alive.

Worse is everyone is like "Well, this stuff is protected or air gaped". Yea, it's behind firewall, or even private networks commonly, but the moment you get inside that network you have tons of lateral movement and could cause unbelievable damage in minutes.

    > Not maintained or developed by a billion dollar company.

Directly? No. Indirectly? Yes. They are mostly funded by billion dollar companies.

Mostly funded is different from “maintained” or “developed”.

Afaik everyone working on curl has a day job.

> I suspect open source projects are better off than proprietary software - they already have many eyes on them

This has been disproven by the sordid history of OpenSSL. It was open source, critical, and full of holes.

https://www.mend.io/blog/how-the-heartbleed-vulnerability-sh...

Single datapoint does not prove anything at all, but it is a data point.

That infrastructure is air-gapped, or should be. Im not worried.

Just like the European freezers and refrigerators.

we've already had water treatment plants hacked and the amount of chlorine in the water changed. Florida ended up with dangerous amounts of lye being added to the water and was saved by an employee that noticed the change...I am worried, no airgaps to be found..

https://www.controleng.com/throwback-attack-hackers-attempt-...

https://esemag.com/water/russian-hackers-breached-quebec-wat...

https://www.cbsnews.com/news/us-water-systems-cyberattacks-i...

https://www.bbc.com/news/world-us-canada-55989843

edit: formatting urls

> I am worried, no airgaps to be found..

Reminder that Stuxnet managed to jump an air gap (via USB keys):

* https://en.wikipedia.org/wiki/Stuxnet

oh great..I'd almost forgotten about that... what I found really funny was they just infected every USB key that vending machine had until a worker bought one...No fancey targeting, just cheap usb keys and patience.

Have you tasted Florida water, it could probably use some extra chlorine. They dont exactly invest that much in public health/infrastructure, im not surprised this happened in Florida. Its a careless state with careless politicians.

Im still not worried about it. There's thousands of water treatment facilities in the USA and you've surfaced two occasions.

Ya'll should try actually breaking into something semi secure with an LLM, its not as easy as you might think. Seriously go try it, if you think its so easy there's millions of dollars to pick up off the floor on bugcrowd or h1. Seriously, please go give it a go.

Secondly, maybe the USA should stop committing mass murder across the globe if we don't want to be the subject of retaliatory attacks.

I actually 'surfaced' attacks in 5 states, and you only read two of them...not to mention Canada and Israel. Also, you're acting like you think its some script kiddies gonna try this stuff. It will be state actors, and was mentioned upstream in the stuxnet comment.

And you think state actors are only capable of harming you now because of llms??? They don't need llms lol.

I would argue that systems were largely more vulnerable 5 years ago than they are now. Esepcially at a municiple level.

There seems to be a lot of "strategy of tension" being employed in these news cycles surrounding security and AI. Dont fall for it. You're fine. Systems are more secure now than they ever have been in the past.

But on the Israel note, thats awesome I hope more of that comes their way.

I never mentioned LLMS, a bunch of the attacks I listed pre-date LLMS, what makes you think I care about LLMS ?

Maybe learn to read and see the parent comment.

LOL - funny comment coming from you... you said "That infrastructure is air-gapped, or should be. Im not worried." I responded with a number of news stories showing that is false, and its not air gapped. You then started harping on LLMs ??

Please don't respond to a bad comment by breaking the site guidelines yourself. That only makes things worse.

https://news.ycombinator.com/newsguidelines.html

We've banned this account for repeatedly breaking the site guidelines.

https://news.ycombinator.com/newsguidelines.html

My sweet summer child....

Please omit snark and internet tropes on HN. The guidelines make it clear we're trying for something better here. https://news.ycombinator.com/newsguidelines.html

"should be" is doing a lot of work here.

Airgaps don't solve everything either. Stuxnet was successful at destroying air-gapped machines.

Airgaps still should be bare minimum though?

Do you know what a modern water/waste processing facility looks like? Cursed controls on Youtube is a good channel to look at. He deals with the electrical parts of the system, but you can see how many of these systems have ethernet ports and are programmable. They also report back to centralized locations so they know when to send this guy out when something is acting up. Once/If you get in the centralized system you can take everything down.

> The broad issue is that you can turn DeepSeek-v6-unhinged loose on an arbitrary IP and exploit ~everything that is not developed and actively maintained by a billion-dollar company

Agreed. My fairly obscure company got hit by something like this last weekend. What stood out was the speed of the loop: it found something small, used it to uncover something else, and pivoted to clever exploits for the new thing within minutes. It hit a dozen of our apps in parallel across within the span of a day, from a rotating pool of residential proxies, Tor, GCP and Cloudflare IPs.

I'm fairly confident it was LLM-driven. The payloads and throwaway accounts had names like "PT59553 TEST IGNORE" and "PocCorp1659r2", and it adapted to error messages the way a person reading them would, just never sleeping. A non-tech company with 1000x the surface area and less monitoring could be in big trouble.

Of course I used LLMs for the defense too, and they were amazing at log forensics and fixes. The annoying part: when I asked Opus 5.5 for clear repro cases of exactly what the attackers did, I hit the cyber safeguards. It felt like Opus was intentionally trying to keep the exact exploits for my own bespoke applications away from me, though it was happy to point out how to fix it.

the broad issue is actually that those are connected to the internet at all and there is no real enforcement or penalties for it

billion dollar companies are not exempt from this, in fact they tend to be the worst offenders