Ben Nassi

Ooh, I never considered the rolling shutter effect. That's amazing. The paper is called "Video-Based Cryptanalysis: Extracting Cryptographic Keys from Video Footage of a Device’s Power LED" [0]. Edit: Also, worth viewing the video [1] on the author's post [2]. [0] https://eprint.iacr.org/2023/923 [1] https://youtu.be/ITqBKRZvS3Y [2] https://www.nassiben.com/video-based-crypta

Ah come on, guys, let's talk pragmatically. "Malleable editor as an OS layer" has benefits beyond subjective reasoning. Emacs has had M-x shell-command and arbitrary elisp eval forever. A metacircular MCP isn't some new capability class. Even if I didn't use Emacs - my shell, my editor, my browser extensions, my npm install, my VSCode plugins, my curl | bash from yesterday - they all have the same access. Singling out the LLM in this context is like selection bias. Of course, reasonable mitigations are a must - just like for any other tool. Narrowing MCP scope - tool routing rules, read-only git defaults, etc. "Docker or nothing" is a lazy answer - Docker-for-everything has real costs: friction, broken integrations, worse ergonomics. Practical security is all about staying in the goldilocks zone. You shouldn't get relaxed about the basics - sandboxing, 2FA, password managers - they are worth doing, and you can get so paranoid about so many things, and yet against a targeted, well-resourced attacker, your sandboxing posture is mostly irrelevant. The interesting attacks bypass the threat model entirely. Read about Ben Nassi's team research¹ - pretty cool example. There are multitudes of other ways and your Docker container won't stop them. Defend against the boring 99%, and accept that the 1% is someone else's problem (or a much bigger problem than your dev environment) — ¹ https://www.nassiben.com/video-based-crypta TLDR LLM Summary: Researchers showed that a device's…

It doesn't even have to be installed, you can project a fake speed limit for a few milliseconds and the systems will accept that. https://www.nassiben.com/phantoms

If it has a camera, it can be used to steal your security keys if it can see the power LED on your device (or potentially even just if something connected to your device has a power LED). https://www.nassiben.com/video-based-crypta

Better article: https://www.wired.com/story/tesla-model-x-autopilot-phantom-images/ Original research: https://www.nassiben.com/phantoms

This appears to be the actual research: https://www.nassiben.com/phantoms

Please read the whole thread I really wish people on HN would stop with the "I disagree, so you must have not read everything" comments. I keep seeing these recently, but they are unconstructive, and they are insulting to other participants in the discussion. You might like to consider the alternative possibilities that you weren't clear in your earlier comments and people are responding to what you actually wrote and not what you thought you wrote, or that you might not be fully informed and someone who disagrees with you might simply know something you don't. The original claim was that vehicles should never be connected to any network because of unspecified online attacks that could actuate brakes or steering. I explained why this was unfounded. Actually, what you have repeatedly said is that you aren't aware of any vehicles (except the infamous Jeep case) that don't fully isolate infotainment from safety critical systems, which is not the same thing at all. You also said that the Jeep case was due to a poor architecture that came from the 90s. Even if this is true, the exploit using it to trigger multiple dangerous behaviours remotely was demonstrated in 2015, so apparently the manufacturer was a bit slow on the uptake of what you think they should have been doing for the last 20 years. Moreover, at least one well-known auto manufacturer is (in)famous for performing OTA updates that can change fundamental car behaviour, so evidently there are still networked…

Yep https://www.nassiben.com/lamphone

Well, that analogy doesn’t hold. In this case the exploit is introducing something to your visual field that looks like an obstacle. Both humans and robots mimicking human vision will be susceptible to it. If you look at the video in the article, they don’t just show line markings, but project a life-sized person on the road in the correct perspective for the driver eye height. Of course brightness is off, it has no volume, but I bet a horse 90% of drivers would stop if that projection showed up in front of them. In fact, it would be so easy to test this, that one wonders why they didn’t do just that in the study. A lot of people would even fall for the fake markings. The real interesting bit in the study is the reaction time, which is only shown at the end of the video. Humans will not react to a stop sign that blinks in and out of existence, while for the computer it was there for long enough. Sounds totally fixable in software by introducing some kind of persistence parameters. And in the end, it only makes it harder to detect, but is fundamentally still the same attack as drawing STOP in chalk. https://www.nassiben.com/phantoms