DDoSing with ChatGPT  - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: January 20, 2025, 03:17:57 pm
content: ChatGPT has a lovely DDoS API.Feed it a URL as many times as you like and it will DDoS that URL. No restrictions or limits. OpenAI doesn't care.Media:OpenAI's ChatGPT crawler can be tricked into DDoSing sites, answering your queries (https://www.theregister.com/2025/01/19/openais_chatgpt_crawler_vulnerability/)Disclosure and PoC:OpenAI: ChatGPT Crawler Vulnerability (https://github.com/bf/security-advisories/blob/main/2025-01-ChatGPT-Crawler-Reflective-DDOS-Vulnerability.md)

author: SiliconWizard
author_rank: Super Contributor
timestamp: January 20, 2025, 09:53:51 pm
content: That's shocking.

author: Analog Kid
author_rank: Super Contributor
timestamp: January 20, 2025, 10:36:29 pm
content: Shocking? really?I find that right in line with what I expect of that whole fucking technology."Oh, boo-hoo, sob, sob: this marvelous machine that I created--strictly for the Good of Mankind--can be, and is being, used for nefarious purposes. Oh god, the humanity!"

author: golden_labels
author_rank: Super Contributor
timestamp: January 21, 2025, 06:56:45 am
content: As expected the world goes “omg AI evil.” Despite the attack style is not new, not limited to smortnets, and that technology plays no role in its execution.I can’t see it as anything more than a shameful, but honest mistake. How much I may dislike them, “the Scary BigTechs” are among the best in preventing this kind of an amplification attack. 25 years of experience under their belt. I doubt anybody would notice, if not that it was a low hanging fruit standing near letters ‘A’ and ‘I’.

author: rteodor
author_rank: Frequent Contributor
timestamp: January 21, 2025, 08:21:11 am
content: Quote from: SiliconWizard on January 20, 2025, 09:53:51 pmThat is sarcasm, right !?This issue is easy to fix. If anything this mishap can be submitted at the cost center as a minor "marketing expense".The true vulnerability that is still unfixed is the "move fast and break things" mentality.

author: magic
author_rank: Super Contributor
timestamp: January 21, 2025, 11:01:08 am
content: Knowing SiliconWizard I'm sure it was dead serious.

author: Siwastaja
author_rank: Super Contributor
timestamp: January 21, 2025, 03:30:05 pm
content: The defect itself isn't spectacular, stuff like that happens. What I find concerning, nearly shocking, is that apparently companies like OpenAI and Microsoft have absolutely no process in place to receive and handle vulnerability reports. For something as dysfunctional as Microsoft I'm notsurprised, but it's still shocking. This kind of defect is pretty easy to fix, so it makes very little sense to not do it.

author: SiliconWizard
author_rank: Super Contributor
timestamp: January 21, 2025, 08:15:06 pm
content: Shocking, but not surprising.

author: magic
author_rank: Super Contributor
timestamp: January 21, 2025, 09:18:51 pm
content: Quote from: Siwastaja on January 21, 2025, 03:30:05 pmMicro$oft has processes to handle defects, in some products. I guess it's a case of the general trend that AI companies don't care much about any rights of their "training datasets".Maybe people should just start IP-banning their crawlers on a mass scale. There are obvious benefits to being indexed by search engines, but what does AI have to offer?

author: SiliconWizard
author_rank: Super Contributor
timestamp: January 21, 2025, 09:41:27 pm
content: Quote from: magic on January 21, 2025, 09:18:51 pmPotentially the same when "AI" is used as a search engine, although one major issue is that due to its summaries (as opposed to just a sorted list of links), AI will just have a tendency to bias its results even more (if a link in Google is the 20th in the page, that gives it less chance, but people can still accesss it; if an information is not listed by "chatgpt", it's just not there at all; kinda big difference).But if we consider the ratio of benefit/damage, AI clearly has very little to offer in that regard comparatively.As to the problems due to "stealing" copyrighted material, they are still an open question.