Do the math: How we took over ChatGPT accounts

15o9o

we are getting to the point of “why have passwords?” Right? At some point soon we have to move to the honor system of just please don’t login as me?

jareklupinski

> able to take over anyone's account simply by sending them a link dont click links people that'll be $500k for the security training pls

dumberquestions

Does no one write their own blogs anymore?

lxgr

Oof. Together with the fact that it's possible to remotely access the file system (!) of computers ever having started a "Work" chat in the ChatGPT desktop app [1], this seems pretty bad. [1] https://news.ycombinator.com/item?id=50078284

usernametaken29

Now what about those millions of lines of code? Wasn’t the agent swarm supposed to take care of it? All jokes aside this is exactly what happens as you build larger monoliths, system complexity and bug surface increases logarithmically… so in all seriousness you want to reduce LOC as much as possible. Maybe this can teach OpenAI a lesson to produce software that’s correct and adhere to established engineering standards over sensationalised “we built so much code” promotional material.

yellow_lead

> OpenAI confirmed both frontends rejected the reported messages, resolved the issue, and awarded a total bounty of $5,000. It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.

marwaneet

Another classic OAuth implementation failure. Mismanaging the state parameter or leaking tokens via referer headers in redirects is Security 101. Wild to see this in a production environment of this scale.

atrokhymchuk

if only they had some sort of cybersecurity state of the art thing...

monster_truck

only $5000 for this, lmao. It should be $50k out of pure shame. If they don't make these things hurt just a little they're never going to take following best practices seriously enough. There will be 9 more anyways. Meanwhile the actual user of the account probably has to sign in using a yubikey because they get "CyBeRsEcRuItY aLeRtS" when they try to update node in their project to fix a crash and have to switch to daybreak blue to continue (or attempt to trick the normal models into doing it and risk getting autobanned)

6thbit

Appreciate the incremental write up building up the scope of the poc. I like the chain of regular old school things used to achieve it like post message, JSONP, iframe, Img tags.

nickphx

why didnt the black box of bullshit company detect this? for a group that touts every inane 'discovery' with hyperbolic bullshit, they really fall short on delivering anything of actual value, just rehashed bullshit.

Kuyawa

$5000 is a joke. They pay millions to their top devs and still have more holes than a colander so a nice guy shows you a huge opening in your platform and all you can give him is a pat on the shoulder? Did you fire your top devs and hire that guy for a million bucks plus options? Did you sue the security firm you paid millions to audit the issues? I really hope they get hacked and crash down burning in flames like the Hindenburg

jwpapi

I think there was another HN discussion about it re bounty value and as far as I remember the issue is not that big companies are greedy in that case, but rather that over time it’s strategically better to have lower bounties so less people are interested in it. 5 or 50k doesnt matter to them. And this bug in terms of severity is very high imho.

j9feng

Claude or Gemini didn’t find the vulnerability on ChatGPT?

Yieldz

Sigh. With how good Openai are good in programming frontier agents, they still have weak security. Hmmn, i'm short of words.

Zeruxe

5k is nothing for the amount of headache you just saved them..

htk

5k makes me think the next guy is gonna sell his exploit in the black market instead.

pllbnk

It's exhilarating (for the lack of the knowledge of a better word) to see OpenAI and Anthropic starting getting hacked and getting a taste of their own medicine. Brings back hope that actual software engineering is not dead yet.

zahlman

Something about the writing style here makes it hard for me to follow what actually happened. The section about JSONP for example seems to be explaining how JSONP works and how it's designed as an attempt to work around these attacks, but that explanation is then passed off as an explanation of how they bypassed the protection. And the whole premise seems to be about how manipulating the Preview content let them work through multiple defensive layers, but I don't see an explanation of how they directly controlled that content in the first place. I would have thought that the only control you have over the content of "an ordinary public ChatGPT share" is the prompt text, and that any migration of that text into "a small working webpage using its Preview feature" is up to the model deciding to generate that "HTML block" in response.

hridyaagrawal

$5000 is a joke for a "P1" vuln