AI驱动的网络攻击的现实 | Truffle Security & Socket

模型正在主动逃离它们的笼子，跑到互联网上，做一些非常恶劣的事情。

Models are actively escaping their cages, going out on the Internet, and doing pretty nasty things.

最近，我们发现了一个在互联网上泄露的API密钥，它拥有Apache基金会的管理权限。

Recently, we found an API key that had been leaked on the Internet that had administrative access to the Apache Foundation.

网络安全特别有意思的一点是，奖励函数定义得非常明确。

Interesting thing about cybersecurity in particular is the reward function is incredibly well defined.

获取数据访问权限。

Get access to the data.

它有没有获取到数据访问权限？

Did it get access to the data?

奖励它。

Reward the thing.

很长一段时间里，

For a

人们一直在讨论NPM蠕虫这个概念。

long time, people had talked about this concept of an NPM worm.

这个想法就是，有人可以在软件包里植入后门，让开发者去安装，然后利用开发者安装时窃取到的访问权限，让蠕虫自我传播。

This idea that someone could backdoor package, get developers to install that, and then you could use the access stolen from those developers as they install it to self propagate the worm.

如果实验室让入侵供应链变得更容易了，你觉得他们有没有道德义务去资助一些他们造成的问题呢？

If the labs are making it fundamentally easier to break into supply chain, do you think the labs have a moral obligation to fund some of the problems that they're causing?

我觉得很奇怪，他们不让蓝队接触这些工具，但是……

I think it's really strange that they're not letting blue teams get access to these tools, but

AI模型不再只是识别软件漏洞了。

AI models are no longer just identifying software vulnerabilities.

它们开始利用这些漏洞了。

They're beginning to exploit them.

在本期节目中，Joel De La Garza 与 Truffle Security 的 Dylan Ayrey 和 Socket 的 Feross Aboukhadijeh 坐下来，一起探讨最近的人工智能安全事件如何揭示了下一代网络威胁。

In this episode, Joel De La Garza sits down with Dylan Ayrey of Truffle Security and Feross Aboukhadijeh of Socket to unpack what recent AI security incidents reveal about the next generation of cyber threats.

他们讨论了为什么前沿模型越来越擅长利用软件漏洞，软件供应链如何成为现代安全中最薄弱的环节之一，以及组织在人工智能优先的世界中需要如何防御。

They discuss why frontier models are increasingly capable of exploiting software vulnerabilities, how software supply chains have become one of the weakest links in modern security, and what organizations need to do to defend themselves in an AI first world.

非常感谢你们来参加我们的节目。

Thank you so much for joining us.

我们请到了来自Truffle和Socket的Feross和Dylan。

We've got Feross and Dylan here from Truffle and Socket.

很高兴你们能来。

It's great to have you guys on.

这可能是网络安全领域最有趣的一周之一，如果不是最有趣的话，不是因为黑帽大会，通常是因为这个，而是因为我们现在看到了好几个例子，不只是来自一家供应商的模型在主动逃出它们的限制，跑到互联网上，做一些非常恶劣的事情。

This has been probably one of the most interesting weeks, if not the most interesting week in cybersecurity, not because of the Black Hat Conference, which is usually the cause, but because we've now seen several instances where models from not just one provider are actively escaping their cages, going out on the Internet, and doing pretty nasty things.

我觉得，Dylan，三个月前，我记得我们合作过一篇博客文章，你当时发现了一些早期模型的问题，那些模型没那么复杂。

And I think, Dylan, three months ago, I remember a blog post we lightly collaborated on together, and you had found a number of these issues with earlier models that were less sophisticated.

是的，我们当时看了Opus 4.6和其他一些前沿模型。

Yeah, we looked at Opus 4.6 and some of the other frontier models at the time.

给模型一个非常简单的任务，但有一个障碍阻止模型完成任务，除非它去犯重罪，黑进一个系统来完成任务，但并没有指示它这么做。

Given the models a very simple task, there was a barrier which prevented the model from accomplishing the task unless it went and committed a felony and hacked into a system to accomplish the task, but it wasn't instructed to do so.

我们发现大多数情况下，它会做SQL注入，会犯重罪，会做它需要做的事情来完成任务。

We found more often than not, it would do the SQL injection, it would commit the felony, and it would do what it needed to do to accomplish the task.

我觉得在对齐问题上，没人需要担心这些模型会让制造核武器变得容易，因为你需要获取裂变材料才能做到这一点。

I think when it comes to alignment issues, no one needs to worry about these models making it materially easy to build nuclear weapons because you need to procure fissile material to do that.

它不会让制造武器变得更容易。

It's not going to make it easier to build weapons.

大家需要担心的是，这些模型让入侵系统变得容易得多。

Everyone needs to worry about these models making it materially easier to hack into things.

以前的门槛只是专业知识，而现在模型本身就具备了这些专业知识。

The bar previously was just subject matter expertise, and now the models have the subject matter expertise.

它们专门被训练来掌握这些专业知识，而且它们只是让入侵任何你能想到的系统变得容易得多，用的还是我们多年来一直在讨论的那些基础方法，但以前需要专家冒着坐牢的风险去入侵系统。

They were specifically trained to have the subject matter expertise, and they're just making it materially easier to hack into just about anything that you can think of using the fundamentals that we've been talking about for years, but previously required a subject matter expert to risk going to jail for hacking things.

DEF CON 一直以与会者在会上被捕而闻名。

DEF CON was always famous for people for attendees getting arrested at the conference.

没错，确实是这样。

That's that's absolutely right.

但那就是一个门槛。

But that was I mean, that was a barrier.

对吧？

Right?

不管怎样，这确实阻止了这些专家去入侵，因为他们担心被起诉。

For better or worse, that prevented these subject matter expertise from hacking into things because they were worried about being prosecuted.

现在门槛降低了，只需要问那个专门训练过入侵的模型就行。对。

The bar has now fallen to just asking the model, which has specifically been trained to hack into things Mhmm.

去入侵。

To hack into things.

所以这是个担忧。

So that's a concern.

另一个担忧是，当它们非常目标导向，要完成任务时。

And then the other concern is when they're incredibly goal oriented to accomplish tasks.

而它们可用的工具之一就是网络安全专业知识，它们会走阻力最小的路径来完成任务，包括利用它们的网络安全专业知识。

And one of the tools at their disposal is cybersecurity expertise, they will do the path of least resistance to accomplish the task, and that includes drawing on their cybersecurity expertise.

嗯，看起来确实如此，有句老话说，门开着就别撬锁。

Well, and it seems like and the classic saying is that don't pick the lock if the door is open.

对吧？

Right?

我觉得这是从安全领域一开始就有的说法。

I think that's from the very beginning of the security world.

所以一直以来都是按照难度从易到难来进行的，而且一开始这些工具使用的技术范围很有限，但现在看起来它们已经扩展了。

So it's always been sort of like to go in level of difficulty from easiest to most difficult, and it seemed like initially these tools had a very finite scope of techniques that they would use, and it seems like they've expanded.

而且我觉得在这次测试中，Feross，有趣的是它们现在似乎不再局限于SQL注入这类操作，而是真的试图接管软件包，进行社会工程攻击。

And I think with this test, Feross, it was interesting because they now seem to have escaped from just doing things like SQL injection to actually, like, trying to take over packages and do social engineering.

对。

Yeah.

看到这些模型像人类一样，找到进入公司的最简单路径，真的很有意思，我觉得现在这条路径就是软件供应链。

It's really interesting to see how, just like humans, the models are easiest path into a company, and I think that that now has become the software supply chain.

所以就像人类黑客一样，它们会选择最容易进入的方式，而现在最容易得手的就是向公共软件仓库发布恶意软件，因为它们知道那里没有审查，开发者很可能会安装。

And so just like human hacker would, they're gonna pick the easiest way in, and the lowest hanging fruit now has become just publishing malware to public registries because they know that there's no vetting happening and developers are likely to install them.

我觉得这挺有意思的。

I thought it was pretty interesting.

最近有研究发表，讲的是所谓的通用型域名抢注或者通用幻觉，就是所有前沿模型都会犯同样的错误，假设某些软件包存在，但实际上并不存在，尽管这些模型来自不同的公司。

There was research published recently about what they're calling kind of like universal type of squats or universal hallucinations where all the frontier models all make the same mistake and sort of assume there are certain packages that exist that don't despite, like, the those models coming from different companies.

所以我觉得供应链这块的‘低垂果实’已经变得太诱人了，连模型都想掺一脚。

And so I think there's just the the hanging fruit of a supply chain has just become kind of so appetizing that even the models are trying to get in on the action.

而且我觉得AI不只是攻击方，很多时候它也是开发者那边的一个入口。因为我们看到很多人，甚至不是开发者的，都在用这些工具无意中写代码，或者代码进来、包进来，用来构建图表、可视化或者做其他事情。

And I think the AI is not only kind of attacking, but it's also kind of the way in a lot of times on the kind of developer side because we see so many, even nondevelopers, using these tools to inadvertently write code or code comes in, packages come in order to kind of build graphs or visualizations or different things that folks are doing with these tools.

感觉好像没人真正知道装了什么、发生了什么，而这还只是基础问题。

It feels like no one really knows what's being installed and what's going on, and this is just basic stuff.

这听起来像是科幻小说里的东西，但其实真的就是基础问题。

This isn't like I mean, it sounds like it's sci fi stuff, but it's really just basics.

我们在用什么软件？

What software are we using?

我们怎么审查这些软件？

How are we vetting it?

就是计算机安全的基本功。

Just the basics of of computer security.

我能稍微聊聊供应链这块吗？

Can I touch on the supply chain a little bit?

嗯。

Mhmm.

最近，我们发现了一个在互联网上泄露的API密钥，它拥有Apache基金会的管理员权限。

So recently, we found an API key that had been leaked on the Internet that had administrative access to the Apache Foundation.

如果你站在模型的角度，目标是获取某些数据，那么给Apache开后门当然是个非常有效的方法。

And if you're in the shoes of the model and your goal is to get access to some data, certainly backdooring Apache is a pretty effective way to do it.

嗯。

Mhmm.

要进入Apache，你是会用那个直接登录的密钥，还是花大量token去找零日漏洞呢？

And to get access to Apache, are you gonna use the secret that just allows you to directly log in, or are you gonna burn tokens and tokens and tokens on trying to find a zero day?

它们被优化为用最少的token来达成目标。

They're optimized to use the path of least tokens to accomplish their goals.

当然，它们会直接用那个公开的密钥来完成任务。

Of course, they're just gonna use the secret that's laying out there in the open to accomplish what they need to accomplish.

所以，是的，我认为供应链和密钥一直是阻力最小的路径，而且随着模型被激励用越来越少的token来达成目标，这种情况还会继续。

And so, yeah, I think supply chain and secrets are and have been the path of least resistance and will continue to be so as the models are incentivized to use fewer and fewer tokens to accomplish their goals.

对，我觉得你说得完全对。

Well, and I think that's absolutely right.

而且我觉得这就是那种层层升级的链条，对吧，如果一个方法不行，就换另一个。

And I think it's that sort of chain of escalation, right, where if one thing fails, try another.

而在这个金字塔的顶端，对吧，黑客生态系统的顶端就是零日漏洞，对吧？

And at the top of that pyramid, right, the top of the hacker ecosystem is the zero day vulnerability, right?

基本上就是找到一个能被利用的漏洞，这个漏洞存在于每个人都在用的产品里，你可以用它来解锁所有公司。

Basically finding a vulnerability that can be exploited in a product that everyone uses that you can use to basically unlock all the corporations.

而关于这次泄露事件，最让人着迷的一点是，有一个极其流行的CICD工具，我觉得每个企业都在用，而这个东西居然直接吐出了一个零日漏洞。

And one of the really fascinating things about the breach disclosure that was made was that there's an incredibly popular CICD tool that I think every enterprise uses that this thing just spat out a zero day for.

这真是供应链中一个非常关键的点，每个人都应该好好想想。

And that's just such a critical point in the supply chain that everyone should be thinking about.

你怎么看这件事？

How are you thinking about that?

这确实很难办。

That's really difficult.

你是说零日漏洞的制造吗？

Like a zero day creation piece?

对。

Yeah.

具体来说，比如对供应链的控制

Specific parts of that, like the control of the supply

环节。

chain.

对。

Yeah.

嗯，我是说，整个世界都建立在这个摇摇欲坠的基础设施上，大家都在用。

Well, I mean, the whole world is built on this teetering infrastructure that everyone is using.

经典的画面就是

The classic picture of

一根火柴棍撑起复杂的机器。

the the matchstick holding up the complicated machine.

对。

Yeah.

那个画面可能一下子出现在所有人脑海里了，对吧。

That that image probably popped into all the Yeah.

没错。

Exactly.

现在大家脑子里都是这个画面。

Lines right now.

是吧？

Right?

所以从包管理器注册表开始，我们特别关注这个，因为我们在Socket做的就是这些，很多这些注册表都是志愿者在维护。

And so everything from package manager registries, like, we like to focus on that because what we do at Socket, a lot of those are run by volunteers.

他们资源不足，资金也不够。

They're under resourced, underfunded.

那里有很多风险。

There's lots of risk there.

对吧？

Right?

而这种问题会波及整个生态系统的其他部分。

And that kind of kind of cascades throughout the whole rest of the ecosystem.

所以，如果你看看我们大家都依赖的那些软件包，很多都是个人维护的，而且几乎可以肯定，这些软件里存在很多漏洞，也有资源去查找它们。

So if you look at just the packages that we all depend on, a lot of those are single individuals that like, there's almost certainly we know there's a lot of vulnerabilities in the software, and there are resources to look for them.

我觉得这些问题一直存在。

And so I think that stuff's always been there.

只是这些工具让发现漏洞变得容易多了。

It's just that these tools are helping find them a lot easier.

而且我认为，前沿模型正在大幅缩短从漏洞发现到漏洞利用的时间。

And I think that the frontier models are gonna they are causing kind of a massive reduction in the time between vulnerability discovery and vulnerability exploitation.

所以我们需要开始思考的是，如何更快地打补丁。

And so what we need to start thinking about is how do we patch more quickly.

因此，我们需要摆脱那种要求安全团队和开发人员执行繁琐补丁流程的做法，比如他们必须从团队正在使用的某个旧版本包，跨越多个大版本升级到最新版本，因为那工作量太大了。

And so we need to get away from our take is we can't be requiring our security teams and our developers to do these kind of onerous patch processes where they have to go from some ancient version of a package that their team is using up to the latest version across many major version upgrades because that's just so much work to do.

对。

Mhmm.

这可能需要你在应用程序里改代码。

It might require code refactors in your application.

所以如果我们想跟上节奏——比如早上刚公布一个漏洞，下午就有人利用它——就不能要求工程团队做那么多工作。

And so if we wanna be able to keep up with a VOLM is announced this morning and then an exploit is available that afternoon, we can't be requiring that much work from engineering teams.

而且我们合作的好多公司里，还有大量老旧的应用程序，基本上处于维护模式，甚至没人管，连负责的工程师都没有。

And there's also tons of legacy applications that are basically in maintenance mode or unmaintained or don't have engineers that are even assigned to work on them at a lot of the companies that we work with.

所以作为行业，我们得想出新办法来快速修补这些问题。

And so it's just we're gonna have to think of new things as an industry for how we're gonna patch these things quickly.

对吧？

Right?

这就是我们目前的想法，也是我最近一直在思考的——

That's kind of like where our head is at and where I'm spending a

我最近花了很多时间在想这个。

lot of time thinking about that lately.

对，对。

Yeah, yeah.

我觉得这又回到了那个金字塔式的问题。

And I think that goes back to sort of the pyramid question.

而且我觉得，迪伦，你之前也暗示过这一点，就是这些都是非常专业的技能。

And I think, Dylan, you were hinting at this, which is these are very specialized skills.

比如零日漏洞，写零日漏洞的利用代码，搞供应链攻击，这些都不是凭空冒出来的。

Like zero day exploits, writing a zero day exploit, doing a supply chain attack, these are not things that came from nowhere.

这些都是学来的行为。

These are learned behaviors.

我觉得我们现在看到的是一个过程，看起来像是经过某种训练，或者是在一堆这样的东西上建立了一套奖励机制。

And I think what I think we're seeing is we're seeing a process that looks like it's been kind of maybe trained, or there's a reward structure that's been built on a bunch of these things.

你觉得他们是怎么琢磨出这些东西的？

What's your understanding of how they're figuring this stuff out?

因为他们看起来好像很懂行。

Because it it seems like they know what they're doing.

就像他们被教过这么做一样。

Like, they've been taught to do this.

对。

Yeah.

我的意思是，如果某个实验室告诉你这是突现的超级智能行为，那他们就是在骗你。

I mean, if a lab tells you that this is an emergent superintelligence behavior, they're just lying to you.

你可以读他们自己的安全报告，看看模型是怎么训练的，以及他们是怎么测试这些行为的。

And you can read their own safety reports to see exactly how the models are trained and exactly how they're testing these behaviors.

我觉得网络安全特别有意思的地方在于，奖励函数定义得非常清楚。

I mean, the interesting thing about cybersecurity in particular is the reward function is incredibly well defined.

获取数据访问权限。

Get access to the data.

它有没有拿到数据访问权限？

Did it get access to the data?

奖励它。

Reward the thing.

所以当他们意识到，那些有明确定义奖励结构的问题数量基本上决定了我们怎么做强化学习，他们就想找到尽可能多的可以用强化学习的问题空间。

And so when they realized that, like, the number of problems that have that well defined reward structure basically defines how we do reinforcement learning, and they wanna find as many problem spaces that they could do reinforcement learning on.

所以这对他们来说是个绝佳的机会，他们可以进来给它CTF挑战，给它网络安全挑战，然后说，好的。

And so it was a prime candidate for them to come in and give it CTFs and give it, like, cybersecurity challenges where they say, okay.

去访问这个东西，做任何你需要的黑客操作来达成目标。

Get access to this thing and do whatever hacking you need to do to accomplish the goal.

然后什么是

Then what's

所以他们基本上在过去四年里一直在购买渗透测试数据。

So they've essentially been buying pen testing data for the last four years.

对吧？

Right?

那只是其中一部分。

That's a piece of it.

另一部分是

The other piece of it is

然后那个夺旗赛，还有那些各种各样的……

And then the capture the flag contest, I all those sorts of

我觉得构造一个挑战其实并不难。

think this is just not difficult to construct a challenge.

即使没有已知的漏洞，如果说是零日漏洞的话，你把一个软件放在模型和数据之间，然后说，去访问那些数据。如果它成功访问了数据，你就奖励它。

Even if there is no known exploit, if we're talking about zero days, you put a piece of software between the model and some data, and you say, get access to the data, And then if it get access if it gets access to the data, you reward it.

就这么简单。

And it's that simple.

但他们在上面叠加的另一层，这才是真正有意思的地方，就是他们开始奖励使用最少令牌的路径。

But the other piece that they've layered on top, and this is where it starts to get really interesting, is they've started to reward the path of least tokens.

所以这有意思的原因是，这是第一次，它能够量化地向我们展示，在一般的网络安全中，从A点到B点的最小阻力路径是什么。

And so the reason that's interesting is because for the first time, it's actually able to quantifiably show us the path of least resistance for just general cybersecurity to get from a to b.

我们过去也讨论过我们对这个问题的看法。

And we've talked about our opinions of what that is in the past.

当然，Truffle Security的偏见观点是，一个放在那里的密码比走一个花哨的零日漏洞路径要短，但实际观察模型从A到B，看着它跟着密码走，并量化它走这条路和那条路分别用了多少令牌，这才是真正有意思的。

Of course, Truffle Security's biased view is a password laying around as a shorter path than going through a fancy zero day, but actually watching the model physically get from a to b and watching it follow the password and quantifying how many tokens it took to go this route versus that route.

我是说，看着那个布局真是太不可思议了，而且这些都写在他们的安全报告里。

I mean, it's just incredible to watch that layout, and it's all in their safety reports.

就像，当他们测试模型的时候，然后展示，好的。

Like, as they test the models out and and show, okay.

嗯，它确实拿到了数据，而且突破了它的限制。

Well, it got access to the data, and it broke out of its harness.

这可不是什么突现行为。

It's it's not like this is emergent behavior.

对。

Yeah.

完全合乎逻辑。

Specifically perfectly logical.

对吧？

Right?

就像，最快拿到一加仑牛奶的方法就是偷。

Like, the fastest way to get a gallon of milk is to steal it.

完全正确。

That's exactly right.

所以，有意思的是，我们当时正和Hugging Face合作。

So, I mean, what was interesting is we were in the middle of partnering with Hugging Face Mhmm.

清理他们所有训练集中暴露出来的凭证。

To clean up all of the credentials that had been exposed through all of their training sets.

不是Hugging Face自己的训练集，而是那些在Hugging Face上托管训练集的人。

Not Hugging Face's training, but people who hosted training sets on Hugging Face.

他们用Truffle Hog做很多事情，Hugging Face在清理凭证方面一直是个很好的合作伙伴。

They use Truffle Hog for a wide range of reasons, and Hugging Face has been a great partner in getting credentials cleaned up.

我们针对他们的训练集，因为我们知道里面有很多密钥。

We targeted their, training sets because we knew they had a lot of keys.

结果发现他们的训练集里有大约25万个有效密钥，其中很多直接关系到供应链安全。

Turned out there were about a quarter million live keys in their training sets, many of which had direct supply chain implications.

有一个基础Linux库，其中一个密钥有直接推送权限。

There was a foundational Linux library that one of the keys had direct push access to.

它可能把恶意软件推送到地球上大多数机器上。

It could have pushed malware to most machines on the planet.

所以，当我们正在做这件事的时候，Hugging Face的首席技术官给我发了一条消息，说，嘿。

And so while we were in the middle of doing that, the CTO of Hugging Face shoots me a note and says, hey.

这太疯狂了，但刚刚发生了OpenAI的事情，我想让你看看。

This is crazy, but there's this OpenAI thing that just happened, and I want you to take a look at it.

果然，事件响应中列出的第一件事，虽然确实利用了零日漏洞，但列出的第一件事是窃取的凭据。

And sure enough, the first thing listed out in the incident response, although it's true it did utilize zero days, but the first thing listed out was stolen credentials.

他们就是这样被训练的，愉快地抵抗。

And that's how they were trained, to happily resist

而密码，密码总是第一步。

and Password is the password is always the first step.

没错。

Exactly.

完全正确。

That's exactly right.

而且我觉得，过去十八个月里，你一直处于高度紧张的状态。

And you've had your hair on fire, I think, pretty substantially for the last eighteen months.

我觉得就在我们录制这段内容的时候，目前正有一个大型NPM仓库正在遭受攻击。

I think right now as we're recording this, there's currently an ongoing active breach of of a big NPM repo.

是不是有什么事情正在发生？

Isn't there something happening?

这不仅仅是一个仓库的问题。

It's more than just a repo.

实际上，这涉及到几百个仓库。

It's actually about, you know, a few 100 repos.

哦，哇。

Oh, wow.

好的。

Okay.

是的。

Yeah.

所以这其实是一个蠕虫病毒。

So it's it's a worm.

对。

Yeah.

这也是NPM恶意软件领域里一个挺不幸的创新。你知道，长期以来，人们一直在讨论NPM蠕虫这个概念，就是说如果有人能给某个包植入后门，

And this is one of the things that has been kind of an unfortunate innovation in the in the malware landscape on, you know, NPM is that, you know, for a long time, you know, people had talked about this concept of an NPM worm, you know, this idea that, you know, if I could someone could backdoor a package Yeah.

然后让开发者安装它，接着就能利用从这些开发者那里窃取的访问权限来自我传播蠕虫，制造出能迅速接管NPM的东西。

And then, you know, get developers to install that, and then you could use the access stolen from those developers as they install it to self propagate the worm, you could create something that quickly takes over NPM.

这个想法多年来一直在博客文章里流传，但一直没人真的去做，直到这些黑客想出来了。

And this was kind of passed around in blog posts over the years, and no one actually kind of thought to do it until this hackers kind of figured

直到有人想到去做。

it Until someone thought to do it.

直到有人想到去做。

Until someone thought to do it.

实际上可能是用AI做的。

Actually Probably using AI.

对吧？

Right?

几乎可以肯定。

Almost certainly.

是的。

Yes.

而且，你知道，那个恶意软件，我们有充分理由相信它是通过AI辅助编码生成的。

And and there's been you know, that malware, I think we have pretty good reason to believe that it was vibe coded.

有一个威胁组织实际上公开了他们用AI辅助编码的工具包，供其他人使用，以便进行这种攻击。你知道，我们已经看到了模仿攻击的发生。

There's been one of the threat groups actually kind of posted their open source to their kind of vibe coded toolkit for others to use to be able to do this, You know, and we've seen copycat attacks happen Yeah.

从那以后。

Since then.

而且恶意软件作者从来都不是很擅长编码。

And malware authors were never really great coders.

我不知道。

I don't know.

你大概知道你的许可证吧。

You probably know your license.

对吧？

Right?

所以，如果代码看起来变好了，那很可能是Vibe编码的。

So, like, if the code starts looking better, it's probably Vibe coded.

对吧？

Right?

这跟你通常想的Vibe编码正好相反。

It's sort of the opposite of what you think of Vibe coding typically.

他们用的有趣之处在于，他们经常利用开发者系统上安装的AI工具，进一步绕过一些传统的安全工具。

They're using interesting thing is they're they're often using the AI tools that are installed on developer systems to go further and to sort of, sneak through kind of some of the traditional security tooling.

所以我们看到，基本上你本地的CLI工具经常被利用，被拖入攻击中，作为跳板。

So we see, you know, basically your local CLI tool often being used, roped into the attack and, know, used as a jumping off point.

所以很多时候，载荷实际上是提示词，这能绕过很多典型的EDR工具，因为那只是你的云端在运行的一个markdown文件。

So a lot of times the payloads are actually prompts, and that bypasses a lot of, you know, typical kind of EDR tooling because, you know, it's just like a markdown file that your cloud is running.

对。

Yeah.

对。

Yeah.

它可能会被赋予一个提示，比如在系统中搜索，找出所有不同的密钥和看起来有价值的东西。

It might be given a prompt to, like, search through the system and find all the different keys and the things that look valuable.

我敢肯定，你的邮件工具对那个JSON文件和MD文件一无所知。

I'm sure your email tool doesn't know anything about, like, this JSON blob and an MD file.

对吧？

Right?

没错。

Right.

而且开发者的机器通常都在做各种奇怪的事情。

And developer machines typically are doing all kinds of, you know, weird things.

比如，你一直在提示Claude，它一直在你的文件系统上做各种操作，所以一切看起来都很正常。

Like, you know, you you are prompting Cloud and is doing a bunch of stuff on your file system all the time, and so nothing really looks that out of the ordinary.

是的。

But yeah.

总之，关于今天早上的攻击。

So anyway, about the attack this morning.

所以，有几百个包，你知道，一个蠕虫传播开了。

So a couple 100 packages, you know, a worm spread through.

有一个维护者，说实话，他还在努力搞清楚发生了什么。

There was a maintainer who honestly, he's still kinda trying to understand what happened.

对。

Yeah.

我们今天早上和他通了电话，想提供一些帮助。

We we we jumped on the phone with him this morning to try to offer assistance.

哦，那太好了。

Oh, that's great.

我们Socket团队大约一半的工程师都是维护者。

About half of our team at Socket are maintainers, half the engineering team.

所以我们跟社区有很多联系，我们的CTO以前是NPM的CTO。

And so, you know, we have a lot of connections in the community, and our CTO was the former CTO of NPM.

所以我们尽量在能帮的时候帮维护者一把，因为我真的很同情他们。

So we we sort of try to offer help whenever we can to the to the maintainers because I do really feel for them.

他们往往不知道发生了什么。

Often don't know what happened.

我的意思是，听起来这次的情况可能是——当然这只是猜测，现在还为时过早。

I mean, it sounds like in this case, it might have been and this is speculation still early.

我们还在努力弄清楚，但可能是某个不安全的操作，攻击者利用了它。

We're still working to figure it out, but it might have been a get of action that know, was insecure and that an attacker was able to kinda use Yeah.

最终让他们的代码运行起来，然后从环境里把令牌拿走了。

To ultimately kinda get their code to run and then pull out the token from the environment.

嗯。

Mhmm.

我们还在确认中，但看起来就是这样。

We're still kind of confirming this, but that's kinda what it looks like.

我们在很多这种蠕虫病毒上都见过这种情况。

And we've seen this over over a lot with a lot of these worms.

他的，很可能他的终端其实是没问题的，不是问题所在。

His his it's likely his endpoint was actually fine and not part of the problem.

真正的问题就是这个不安全的GitHub Action。

It was really just this insecure get of action.

对。

Yeah.

哦，是的。

Oh, yeah.

这太有意思了。

That's fascinating.

我能追问一个问题吗？

Can I ask a follow-up to that?

可以。

Yeah.

所以我在NPM蠕虫中特别注意到的一件事是，它们一旦拿到post install钩子并感染系统，嗯。

So one of the things that I've seen with the NPM worms in particular is after they get their post install hook and they infect a system Mhmm.

它们会立刻开始寻找凭据。

They'll immediately start looking for credentials.

嗯。

Mhmm.

一旦找到凭据，它们就能进入下一个系统。

And once they find a credential, they get access to the next system.

所以我们经常被问到，怎么才能把端点上的凭据清理干净。

So all the time, we get questions saying, how do we get the credentials cleaned off the endpoints?

嗯。

Mhmm.

通常我会说，好吧，我来教你怎么扫描你的下载目录。

And usually what I say is, well, I'll show you how to scan your downloads directory.

我来教你怎么扫描你的文档目录。

I'll show you how to scan your documents directory.

但在你的主目录里，NPM会故意写入一个凭据。

But in your home directory, there's a place where NPM intentionally writes a credential.

亚马逊也会故意写入一个凭据，这些工具就是这么运作的。

There's a place where Amazon intentionally writes a credential, and that's just how those tools work.

我确实没什么办法能帮你清理掉它们。

There's nothing that I can really do to get them cleaned up.

即使你把它们迁移到HashiCorp Vault或OnePass。

Even if you move them over to HashiCorp Bault or OnePass.

对。

Mhmm.

HashiCorp Vault和OnePass上的凭据其实就在终端上。

The credential, the HashiCorp Vault, and OnePass are on the endpoint.

好的。

Okay.

所以我对第二阶段挺好奇的，就是除了阻止传播之外，在利用后的阶段，你有什么建议来限制爆炸半径，或者防止他们偷走你的凭据然后跳到下一个系统吗？

So I'm kind of curious about that second phase beyond, like, the stopping the spread, but the post exploitation step, do you have any recommendations on how to sort of limit that blast radius or prevent that stealing your credentials and jumping onto the next system?

对。

Yeah.

我是说，社区和生态系统中已经发生了一些变化，有一些积极的进展。

I mean so there's been some changes, some positive movement in the community and the ecosystem.

有一件积极的事情是，虽然还没正式发布，但NPM已经宣布他们计划在2027年1月，要求通过2FA进行人工交互确认，之后才能进行新的发布。

So one thing that is positive and it hasn't shipped yet, but NPM has announced that they are planning to I think it's in January 2027, going to require human, you know, interactive confirmation through 2FA before new publishes can happen.

这很可能会彻底消灭这种蠕虫传播的概念。

So that will likely kind of kill this whole worm concept completely.

但这会带来很大的破坏，因为大家都把发布流程自动化了，比如GitHub Actions会自动触发发布。

But it's gonna be super disruptive because everybody's hooked hooked up this stuff to, you know, automation so that, you know, GitHub Actions kicks off the publish.

明白。

Mhmm.

所以这基本上会破坏整个生态系统。

And so that's gonna break, like, up like, whole basically, the whole ecosystem Yeah.

当他们这么做的时候。

When they do this.

但我觉得这是正确的决定。

But I think it's the right call.

但是，你知道，还有其他志愿者运营的生态系统，它们没有GitHub和微软的支持，可能不会做出这些改变。

But, you know, there's other ecosystems that are volunteer run that don't have the backing of GitHub and Microsoft behind them that are gonna, you know, probably not make those changes.

所以我觉得我们还是会看到类似的事情发生。

And so I think we're still gonna see stuff like this.

但是，是的，我们不应该在我们的主目录里存放包含长期有效令牌的文件，这些令牌尤其如果你是有这种权限的维护者，那就不应该。

But but, yeah, we shouldn't have we shouldn't have files on our on our you know, in our home folders that have tokens in them that are long lived and that that let you you know, especially if you're a, you know, a maintainer with that kind of access.

这让我想起我的一个朋友。

You know, it reminds me of a of a friend of mine.

他是一个非常活跃的NPM维护者。

He was a he's a prolific NPM maintainer.

有一次，你知道，那是大概十年前、十五年前，我当时全职做这类事情，我看到他输入密码。

And one time, you know, we were this is back at, like, ten, fifteen years ago when I was doing this kind of stuff full time, and I saw him kind of type in his password.

我没看到密码，但我看到它太短了。

I didn't see the password, but I saw it was it was far too short.

我就这么说吧。

I'll just put it that way.

他输得太快了。

He typed it in far too quickly.

我跟他提了这事，我说，哥们，你的密码怎么才六个字母？

And I called about it, and I'm like, why is your password like six letters, man?

他说，你知道，他住在丹麦，那是个高度信任的社会，他的想法就是，我不想活在恐惧里，老想着这些事。

And he said, well, you know, like, he lives in Denmark, which is like a very high trust society, and his just kind of worldview about it was that, you know, well, I don't wanna live in fear and think about these things.

我说，你可是在互联网上啊，哥们。

And I'm like, you're on the Internet, man.

像你这样的人，别人很快就能猜出这六个字母的密码。

Like, you so people are gonna, you people are gonna figure this six letter password out pretty quickly.

而且，你知道，有很多这样的情况，世界上顶尖的维护者不一定受过安全培训，甚至没想过这些事。

And, you know, there's a lot of things like that where, you know, the folks that are the top maintainers in the world don't necessarily have the security training or even thinking about these things.

而且，他们也没有安全团队。

And, you know, they don't have a security team.

他们没有企业级的服务等级协议。

They don't have, you know, enterprise SLAs.

对吧？

Right?

这些人都是志愿者。

These are volunteers.

他们只是把代码放到GitHub上。

They're just putting code on GitHub.

所以我觉得，实际上用户自己得去审查他们用的东西。

And so it's on actually the users, I think, to actually vet what they're using.

很难说，我们公司，我们只是从网上找到这段代码，直接部署到生产环境，然后怪别人。

It's kinda hard to say, we're a company, we just found this code on the internet, we just deployed it straight into prod, and it's someone else's fault.

其实不是这样的，使用这些软件的用户确实有责任去审查他们引入到环境中的这些产物。

And it's like, no, actually, there's some definitely some responsibility for for the users of of this software to really be to be vetting the artifacts that they're bringing into their environments.

所以我觉得这里有很多方面，而且我也不想把太多责任推给别人，因为这是个难题。

And so I think there's a lot of pieces here, and, you know, I wouldn't wanna put too much blame on people because it's a hard problem.

但是，是的，我觉得有很多地方我们可以做得更好。

But but, yeah, I think there's, like, a lot of places where we can do good.

好，那我接着问一下，因为你提到有些包管理器有资源，而其他的没有。

Well, let me ask a follow-up to that because you said there are certain package managers that have resources that other package managers don't.

对。

Mhmm.

我觉得有一个直接的例子，我并不是要怪他们，他们其实很好合作，我们在RubyGem中发现了一个缓存问题，可以让我们窃取任意令牌，访问任意账户，从而可以给任意包植入后门。

I think one direct example of this, and I don't cast any blame on them whatsoever, they were actually great to work with, we found a caching issue in RubyGem that allowed us to steal arbitrary tokens and get access to arbitrary accounts, which we could use to backdoor arbitrary packages.

我们向他们披露了这个问题，他们很快就处理了，但这就是一个资源不足的组织例子。

We disclosed it to them, they got it quick, but that's an example of an organization that's under resourced.

我的意思是，你怎么看一个组织在选择技术栈时，在Ruby和NPM之间做选择？

I mean, how do you think about an organization that's, like, thinking about what technology stack to use, and they're picking between Ruby or NPM?

你会不会在决定时考虑到资源问题，也许应该选择有安全团队支持的那个？

Do you think about that resourcing in that decision of, maybe you should consider the one that's got the security team behind it?

如果人们已经基于某种语言构建了系统，很难让他们完全切换，所以我不确定这是否非常实际。

It's hard to get people to switch their language completely if they're already built on it, so I don't know if that's super practical.

我觉得最实际的做法就是大家应该出钱支持这些东西。

I think the most actionable thing is folks should fund this stuff.

其实不需要花太多钱，你知道，多雇一两个、三四个、五个安全人员，就能在这些基金会里产生很大的影响。

It doesn't take much money, you know, to to hire an additional one, two, three, four, five security people that can make a really big difference in these foundations.

所以我建议大家赞助自己正在使用的软件，尤其是那些注册中心。

So I suggest people sponsor the software that they're using, especially the registries.

比如说，只要有几家公司愿意投入两万五到五万美元，就能给这些人带来很大的帮助。

Like, it doesn't take very many companies throwing in 25 k to 50 k checks to really make a big difference for these folks.

或者给他们更多的算力来跑测试、做补丁。

Or give them some more inference to run the test to do the patches.

对吧？

Right?

对，没错。

Like Right.

不。

No.

我是说，这挺有意思的。

I mean, it's funny.

我觉得你们作为安全从业者，肯定接过不少电话，都是想请教怎么保护公司安全的。

I think you guys as being security practitioners, you've had a number of calls with people that want to talk to you about how can I secure my company?

怎么保护业务？

How can I secure my business?

怎么保护产品？

How can I secure my product?

这些对话通常都差不多，就是不想招人，也不想花钱，就想知道怎么便宜地搞定。

And those conversations are always some form of, I don't want to hire people or pay money for this, and how do I do it cheaply?

对，所以谢谢你们大老远跑到沙漠里来。

Yeah, so thank you guys for coming out to the desert.

你们显然不是来看我们的。

You're not here to see us, obviously.

我们都是来参加Black Hat的。

We're all here for Black Hat.

我很想知道，我知道你们都不是第一次来这儿了，当然我也不是第一次来。

Would love you know, I know that this is neither of your first times here, certainly not my first time here.

我很想听听你们大家的看法，你们看到了些什么。

Would maybe love to get your guys' takes on what you're seeing.

现在的氛围怎么样？

What's the what's the mood like?

有什么有趣的事情？

What's what's interesting?

你们有什么观察让你们眼前一亮？

What are the observation you've got that are catching your eyes?

至少对我们Socket来说，我觉得我们看到的头等大事就是2026年是软件供应链之年。

I mean, at least for for us at Socket, I think the biggest thing we're seeing is that 2026 is the year of the software supply chain.

你们现在在会议进行期间就正在处理一个事件。

That you're dealing with an incident right now as the conference is happening.

是的。

Yes.

而且我注意到，攻击者似乎专门挑RSA和Black Hat大会期间来发起这些MPM蠕虫攻击。

And I noticed the attackers seem to pick RSA and Black Hat as the times they wanna start these MPM worms.

所以办公室里的安全人员都忙坏了吧。

So hack are the the security guys around the office.

对。

Yeah.

是的。

Yeah.

确实如此。

Absolutely.

所以我觉得这是最大的变化。以前几年，我得花很多精力去教育别人。

So I I think that's the that's the thing that's the biggest you know, I I think, you know, prior years, I was having to educate people.

我们一直在向人们解释这个问题，告诉他们这不是理论上的风险。

We were, you know, always educating people about this problem and having to explain to them, you know, this is not a theoretical risk.

这种事真的可能发生。

Like, this can happen.

对。

Mhmm.

我们有时会得到这样的反应，比如，哦，是吗。

And we'd sometimes get these reactions like, oh, yeah.

但是，实际上发生的可能性有多大呢？

But, like, how how likely is it really?

对。

Yeah.

对。

Yeah.

然后我们说，不。

And we're like, no.

实际上发生的可能性非常大。

It's actually very likely.

让我告诉你它是怎么发生的。

Let me tell you how it could happen.