• Search for:
    13Apr, 2023
    OpenAI launches bug bounty program with rewards up to $20K

    AI research company OpenAI announced today the launch of a new bug bounty program to allow registered security researchers to discover vulnerabilities in its product line and get paid for reporting them via the Bugcrowd crowdsourced security platform.

    As the company revealed today, the rewards are based on the reported issues’ severity and impact, and they range from $200 for low-severity security flaws up to $20,000 for exceptional discoveries.

    “The OpenAI Bug Bounty Program is a way for us to recognize and reward the valuable insights of security researchers who contribute to keeping our technology and company secure,” OpenAI said.

    “We invite you to report vulnerabilities, bugs, or security flaws you discover in our systems. By sharing your findings, you will play a crucial role in making our technology safer for everyone.”

    However, while the OpenAI Application Programming Interface (API) and its ChatGPT artificial-intelligence chatbot are in-scope targets for bounty hunters, the company asked researchers to report model issues via a separate form unless they have a security impact.

    “Model safety issues do not fit well within a bug bounty program, as they are not individual, discrete bugs that can be directly fixed. Addressing these issues often involves substantial research and a broader approach,” OpenAI said.

    “To ensure that these concerns are properly addressed, please report them using the appropriate form, rather than submitting them through the bug bounty program. Reporting them in the right place allows our researchers to use these reports to improve the model.”

    Other issues that are out of scope include jailbreaks and safety bypasses that ChatGPT users have been exploiting to trick the ChatGPT chatbot into ignoring the safeguards implemented by OpenAI engineers.

    ​Last month, OpenAI disclosed a ChatGPT payment data leak the company blamed on a bug in the Redis client open-source library bug used by its platform.

    Because of the bug, ChatGPT Plus subscribers began seeing other users’ email addresses on their subscription pages. Following an increasing stream of user reports, OpenAI took the ChatGPT bot offline to investigate an issue.

    In a post-mortem published days later, the company explained that the bug caused the ChatGPT service to expose chat queries and personal information for roughly 1.2% of Plus subscribers.

    The exposed info included subscriber names, email addresses, payment addresses, and partial credit card information.

    “The bug was discovered in the Redis client open-source library, redis-py. As soon as we identified the bug, we reached out to the Redis maintainers with a patch to resolve the issue,” OpenAI said.

    While the company didn’t link today’s announcement with this recent incident, the issue would’ve potentially been discovered earlier, and the data leak might’ve been avoided if OpenAI already had a running bug bounty program to allow researchers to test its products for security flaws.

    Resource : https://www.bleepingcomputer.com/news/security/openai-launches-bug-bounty-program-with-rewards-up-to-20k/

    3Mar, 2023
    AMD Ryzen Master has a bug that can let someone take full control of your PC

    AMD has just revealed that it spotted a new vulnerability in its Ryzen Master software. The bug sounds pretty dangerous — it could potentially allow an attacker to take full control of your PC.

    Here’s everything we know about the vulnerability and the steps you need to take to secure your computer.

    AMD Ryzen Master is a useful piece of software if you’re using an AMD processor. It lets you monitor your CPU in real time as well as alter the clock speeds and the voltage. While it’s definitely handy, if it falls into the wrong hands, you could be in trouble — and it seems that the tool has been hit with a pretty severe vulnerability.

    The vulnerability was spotted by Conor McNamara and later disclosed by AMD itself. Its severity was ranked high, and AMD described the potential impact as “privilege escalation.”

    “Failure to validate privileges during installation of AMD Ryzen Master may allow an attacker with low privileges to modify files potentially leading to privilege escalation and code execution by the lower privileged user,” said AMD.

    According to what AMD said, this means that users with low privilege levels could use Ryzen Master to gain control of the system. It’s unclear if this would be possible without administrator access, though, and it does sound like the user would need to be able to access the computer in person in order to carry out an attack.

    This is one of those vulnerabilities that are unlikely to affect a whole lot of users, but once someone is affected, the impact could be severe. Another example of this type of vulnerability in the last year is Hertzbleed, which is thought to affect most of the best processors on the market.

    Even if you feel like you’re not at risk, it’s best to update Ryzen Master to the latest version of the software (2.10.1.2287). You’ll be protected from the vulnerability and also get a few new features, such as the ability to set a maximum temperature for your CPU. You can also set the voltage of the processor above 5.2V, but you shouldn’t do this unless you’re an expert at overclocking your CPU.

    Resource : https://www.digitaltrends.com/computing/amd-ryzen-master-vulnerability-patch/