To try everything Brilliant has to offer -free- for a full 30 days, visit 👉 brilliant.org/DanielBoctor/. You'll also get 20% off an annual premium subscription! THANKS FOR WATCHING ❤ JOIN THE DISCORD! 👉 discord.gg/WYqqp7DXbm 👇 Let me know what type of content you would like to see next! 👇 Thank you for all of the support, I love all of you
Does BRILLIANT teach all the technical and cognitive methods that programmers MUST USE to stop themselves from making these continual stupid programming errors? If so, then a proper course of BRILLIANT lessons should be REQUIRED as PREREQUISITES for all programmers seeking jobs, as well as those already employed. How's that for progress?
@@ecMathGeek yo, they started rolling out recall in beta and I immediately transitioned 100% to Linux. I do not play with Microsoft, and as little as humanly possible with Google (Android).
Honestly, this is negligible to the real issue with them having all your personal data. They create psychology profiles on you and force feed you propaganda that aligns with their political interest in order to sway elections.
@@Peaches-i2i Well in this instance this was by more than one health provider, these cloud offerings abstract everything from the clients consuming, they might be forced by management to integrate AI in their offerings and contracted an “enterprise” solution to not have to deal with exactly this kind of bs that is not hard but tedious to setup and maintain.
Why on earth would a health application need to execute remote JavaScript from client to server? Most of these bugs wouldn't exist if this feature hadn't been implemented in the first place
🎉 well, I got on the "path traversal" was the most complicated one, really? Exactly this Input would be caught by any proper pentesting/fuzzy program. All exploits are basic (at most) compared to the state of the art. Thus, I have to expect that they deployed a service with access to health data without any proper testing (?) Fix in production mentally 😂🎉
Surprisingly humans make 'errors' now and then. Assembling a complex thing leaves lot of space over time. "American telephone is hacked...." How that?? :))
As an old Medical Software developer, requests to have an ability to execute arbitrary code is pretty common unfortunately. The best we do is to prevent WHO can do that, is to limit it to sysadmins, but ya.
200k is not a fair price. Even if microsoft stock only fell down 5% after leaking 100 million *medical* data, this would cost them 162 billion. This is equivalent to paying someone a dollar for protecting your millions... after you mess up.
@@YT7mcThe problem is less capitalism and more that companies are allowed to pay to change the laws. They've slowly, insudiously, obliterated all protections for customers and the public in general.
Heck we have a saying in our team, as long as it’s data being managed by vendor, it’s not our responsibility. (Password managed in self hosted open source key manager with compliant encryption and security - not OK, password stored in OneNote in plaintext - not so good but OK)
Well, (chuckles to self), your using microsoft products so of course its unsafe! This includes the entirety of the medical industry so idk. Were all doomed.
Microsoft CEO even announced last week that they would replace the entire azure product line with only ai "agents" where the bots would be able to create, update and delete all data on your services on azure...
@@nateh379 I'm sorry man but anyone that says that either can't code for sh1t or doesn't realize that if human ingenuity is replaced by AI then all engineers can be replaced by AI, not just the software ones...
@@nateh379 That's all that you can do, imagine. Extrapolating technological breakthroughs doesn't make sense, they don't follow some linear or exponential timeline, they are breakthroughs.
Probably was due to AI code being used for the backend! People don’t understand how many security vulnerabilities are to come out from all the AI code being written!
Yup! I work in the HIPPA field and it's surprising how many people want to use AI code, luckily in my business we can't, so it's easy for me to say no, as i can't validate a black box, which step by step validation is required for our data since it directs health decisions, but other fields can and it will continue to produce large vulnerabilities. It's honestly scary
Its just so much faster to do my own coding then try and catch all of the insane things and ai code might do. Like 95% of the time it's fine 4% it's broken and the last 1% it's doing something genuinely insane. I know what mistakes I tend to make and where to look for them. I've spent a long time learning good practise. The ai has every mistake in recorded history at it's finger tips and usually it's the stuff reviewed enough to not immediately be obvious. Ai coding is a big gamble.
Selling "insights" about people to ad networks. It's not just knowing what people like anymore. It's knowing all medical conditions to better target them.
@@pseudomemes5267 At which point during my doctor visit did I agree to such a thing? How does it go from a doctor visit to building artificial intelligence? So they're benefiting from my interaction. How much value does MY MEDICAL RECORDS generate for THEIR product?
@@lopiklop it's probably included as part of the Windows EULA, something like "if you have ever used windows for any reason we have the right to gather and sell any information about you" this is obviously a joke, but also not out of the scope of what mega corps think they can get away with through their EULAs (remember that Disney tried to say the EULA for a free trial of their streaming service ment they couldn't be sued for a lethal allergic reaction at one of their parks)
Running arbitrary code on a machine with sensitive data sounds like a recipe for disaster, even when sandboxed... They should definitely give the "running javascript" bit to some other server that only does this. That server can then be isolated from the rest, making any breach somewhat useless.
if you take the time to do that stuff right then minimum viable product move-fast-and-break-stuff crowd will eat your lunch with their rapid results and problems that don't show up until later down the line. And since you've now sold a product that constantly breaks you can now as a bonus get even more money out of expensive maintenance/support contracts! how's that for a win-win! disruptive capitalist innovation at its finest
MS developers are generally a different flavour today. Same goes for Google. I'd expect less and less from them going forward, as they continue to hire based on "appearance" rather than talent. Maybe I'm a bit salty, but it's true nonetheless.
In a way it has always been like that in the business. In the old days of software, there wasn't so much competition on the market, so you could've focused a bit more on quality, but every established market with competition sooner or later reaches a stage, where you can't spend too much money on perfection and need to earn income ASAP. Software has reached this milestone about a decade or two ago.
Medical institutions use 3rd-party developers for their apps, and hire vendors to upload or stream data to cloud services for them to load. There are more rules and paperwork than you can imagine to keep things compartmentalized and "safe", theoretically, but current dev culture attitudes and perverse corporate incentives undermine it daily. My anxiety level has dropped substantially since leaving that industry, cuz you either fight your conscience or fight literally everyone on the call over obvious stuff like this, every day.
Simple , it's Microsoft.... they write their programs to just do things... security, safety and non-crashing come later... I went to a MS conference once with their programming team... where they outlined their programming development and internal "mantra" when i left I was completly shocked at how lax they were... They basically write software with as few checks and balances as possible, it just matches the spec & that is it.. when they have to modify the systems for other uses.. they just make changes & fix what visibly breaks
Honestly, I wouldn't go that often even if it was free. All they do is try to push pills on me and do a crappy job of finding potential problems. The best medicine is not eating trash, getting some exercise, and enjoying time with friends. That stuff doesn't net piles of money though, so they never bring it up.
Data breaches are often the result of errors in system management or configuration, not “automated” AI. More importantly, the responsibility lies with the humans who design, deploy, and monitor the system, not the AI itself.
Say more on this. And WHICH versions and variants of Copilot? Only the web versions? If so, in which browser(s) does these TOTAL BS exploits occur? Does it also affect the Copilot running inside Skype?
@@YodaWhat Been a while ago, but i think its just ordinary copilot. the same that comes with windows 11. Its not really an exploit, its how microsoft desinged it. And it sparked quite the contreversy when word got out, a few years ago.
@@arkorat3239 - Ah, thanks. I don't use Windows 11 or any of that extra crap even in Windows 10. First thing I do with a new Windows machine is turn that $hit off as much as possible.
Personally I would never ask AI for any serious health issues, even if they were 100% private and 100% secure because if AI happens to hallucinate then I can easily end up on 10x worse situation than I started with. If there is something I don't know how to deal with I would rather go to doctor and get some real advice than for example trying to heal flu by standing uv light and drinking mercury.
But this story is not about AI anyway.... AI bot not leak anything, stupid platform architecture and stuipd developers (who maybe were expert in AI but not not in other areas)
The omniscient AI has certified that the code was secure. Oops that was a hallucination. Okay delete/ fire that AI and try uploading a new one… which is almost identical, and trained on the same data set. It’s just good business.
hackers are such nice people, that hacker could have made everyone's medical records say they tested positive for aids. it's wonderful we have bug bounties and they are paid, hard work was do to earn that small sum of money and the whole world benefits.
Anyone else notice that bug bounties often have a habit of not paying? You'll find the bug and they'll say "Oh we already knew about that" then patch it and act like its no big deal.
My take away from this is that nodejs is not secure by default, and needs some careful design and hardening to make it production grade. Compounded with dynamic and super flexible JIT nature of node, it sounds like a nightmare.
Whoever worked on this must be borderline non-functional. Was this whole project just 1 dude? How did not a single person on the team call out this insanity? Insane.
So once again, the super smart programmers of Microsoft allowed direct access to data, rather than buffering it, ensuring encrypted connection between intermediate server & data, as well as not keeping the AI software isolated from important data. Also, adding directory capabilities within a URL, rather than having the server or data server do the searching has been a known exploit/issue for decades. You never allow directory level execution or maneuvering at the URL level AND we have become so dependent on showing URL data, that this type of thing will happen due to sloppiness. as the old adage goes: it isn't the new guy that gets hurt (makes serious errors), it is the experienced person because he becomes so confident in his experience
Why is the back-end in JS instead of a strongly typed language which would reject input and help require data be properly sanitized? Why is the database input not properly sanitized?
@5:55 I think you've either misinterpreted how the query injection works or the exploit you copied from wasn't documented correctly. Unless MS has made a mistake with implementation of building a quert. If this is even actually a reality. I feel like it's not. But first the query needs to be completed by providing an escaped ' and ) and then you can initiate the other escaping to insert the transversal and allow the query to be completed again.
The First exploit was already quite easy, it's like going to a final test about history, putting "it al begun in 1942... ... And that's how Nazi Germany fell" and getting an A+
AI is imprecise. It's not a bad tool for thinking through ideas, but using it to write code is rarely reliable and using it for healthcare should be illegal. Not that we have humane healthcare anyways, so I guess it makes sense they wouldn't care about ethics.
I wish all of my data was in paper files in my closet, even passwords, because its always getting "found online". Meanwhile Im unable to access websites because I forget my password or questions, hackers have more access than I do...
Hackers? Try said websites not accepting right password just because, had to change a couple over absolutely nothing (the password and name were actually correct, it just refused to accept them).
Maybe we shouldn't build such things on stacks upon stacks of libraries and frameworks. A JS runtime environment running on a JS engine importing modules to implement an "indexof"... What the hell happened to writing software that compiles to machine code, instead of relying on dozens of layers that can each have vulnerabilities?
If you can't understand the difference between - users- and -users'- then what else does it tell about your IQ? I am going to consult my dog next time.
I always wonder what society is supposed to do in these situations, when mega corporations incompetence and greed hurts millions. Give up? Continue as normal like nothing happened despite the damage? or... perhaps call Luigi?
Hunters need to start demanding more for information on these exploit bounties, I'm saving you millions or potentially billions of dollars I want a least a mill
To try everything Brilliant has to offer -free- for a full 30 days, visit 👉 brilliant.org/DanielBoctor/. You'll also get 20% off an annual premium subscription!
THANKS FOR WATCHING ❤
JOIN THE DISCORD! 👉 discord.gg/WYqqp7DXbm
👇 Let me know what type of content you would like to see next! 👇
Thank you for all of the support, I love all of you
Does BRILLIANT teach all the technical and cognitive methods that programmers MUST USE to stop themselves from making these continual stupid programming errors? If so, then a proper course of BRILLIANT lessons should be REQUIRED as PREREQUISITES for all programmers seeking jobs, as well as those already employed. How's that for progress?
"Why are you so worried about Microsoft and Google having all your personal data?"
Me:
Well you don't have anything to hide, right? What do you care? 😂 (sarcasm)
Yeah, I see this and I think "And they expect us to believe Recall AI is going to be secure?"
@@ecMathGeek yo, they started rolling out recall in beta and I immediately transitioned 100% to Linux. I do not play with Microsoft, and as little as humanly possible with Google (Android).
In Germany they started an opt-out solution to putting all private health data into the cloud. They are proud that only few citizens actually opt out.
Honestly, this is negligible to the real issue with them having all your personal data. They create psychology profiles on you and force feed you propaganda that aligns with their political interest in order to sway elections.
The real question is "who trusted Microsoft with healthcare data"
The average person who barely understands the magic box they hold in their hands.
@@Peaches-i2i Well in this instance this was by more than one health provider, these cloud offerings abstract everything from the clients consuming, they might be forced by management to integrate AI in their offerings and contracted an “enterprise” solution to not have to deal with exactly this kind of bs that is not hard but tedious to setup and maintain.
Pretty much and all HR executives in any corporation if it was offered to reduce costs.
Those last 3 words were unnecessary.
Amazon bought the second largest healthcare provider in the US two years ago. Doom.
Why on earth would a health application need to execute remote JavaScript from client to server? Most of these bugs wouldn't exist if this feature hadn't been implemented in the first place
My question exactly. It's literally a health bot (which I presume you ask about health concerns and such), not a programming assistant.
🎉 well, I got on the "path traversal" was the most complicated one, really? Exactly this Input would be caught by any proper pentesting/fuzzy program.
All exploits are basic (at most) compared to the state of the art.
Thus, I have to expect that they deployed a service with access to health data without any proper testing (?)
Fix in production mentally 😂🎉
Surprisingly humans make 'errors' now and then. Assembling a complex thing leaves lot of space over time. "American telephone is hacked...." How that?? :))
ran out of money for hiriny offsecs
As an old Medical Software developer, requests to have an ability to execute arbitrary code is pretty common unfortunately. The best we do is to prevent WHO can do that, is to limit it to sysadmins, but ya.
200k is not a fair price. Even if microsoft stock only fell down 5% after leaking 100 million *medical* data, this would cost them 162 billion.
This is equivalent to paying someone a dollar for protecting your millions... after you mess up.
such is fair market 🤷♂️ it all comes down to capitalism and end of the day this makes them the most money.
I agree...
@@YT7mcThe problem is less capitalism and more that companies are allowed to pay to change the laws. They've slowly, insudiously, obliterated all protections for customers and the public in general.
200k is not enough for a bug like this, but a guy who can do this casually, four times in a row, is probably making that a year already
Class... Action... Lawsuit!
Should have gotten way more than 200k for something this severe…
Personal data is only valuable when databrokers gets their greasy hands on it.
200M would be fitting given the situation.
@ imagine the damages if those records got out, would be in the tens of billions easily
Goes to show much value they assign to people's privacy compared to how much they make selling our data
@@coletcyre puts the $ in M$
tHErE wiLL Be nO SuCH thINg aS teCH joBS BY 2030!!!
There will be no people left by 2030
Wow, giving user interactive chat robots Root Privileges hasn't worked out well. Who would have thought. Please, let us hold hands in stunned silence.
is this azure even Linux?
@@RickySupriyadiit’s a hypervisor dude, can run anything
@@DaveEeEeE-hu7gu ok thanks
I'm out of stunned silence. Can I use bewildering contempt instead?
Leave it to Microsoft to do something so stupid it boggles the mind.
Heck we have a saying in our team, as long as it’s data being managed by vendor, it’s not our responsibility. (Password managed in self hosted open source key manager with compliant encryption and security - not OK, password stored in OneNote in plaintext - not so good but OK)
Well, (chuckles to self), your using microsoft products so of course its unsafe!
This includes the entirety of the medical industry so idk. Were all doomed.
Microsoft CEO even announced last week that they would replace the entire azure product line with only ai "agents" where the bots would be able to create, update and delete all data on your services on azure...
Nuclear ROLF!
what could go wrong? :3
"AI WiLl RePlAcE SoFtWaRe EnGiNeErS!"
the biggest lie of the recent years
YoU aRe veRy ShOrt siGhtEd
At the same time, Alexnet was just 2012. And ChatGPT was just 2022. Imagine what another 10 years will do.
@@nateh379 I'm sorry man but anyone that says that either can't code for sh1t or doesn't realize that if human ingenuity is replaced by AI then all engineers can be replaced by AI, not just the software ones...
@@nateh379 That's all that you can do, imagine. Extrapolating technological breakthroughs doesn't make sense, they don't follow some linear or exponential timeline, they are breakthroughs.
Probably was due to AI code being used for the backend! People don’t understand how many security vulnerabilities are to come out from all the AI code being written!
Yup! I work in the HIPPA field and it's surprising how many people want to use AI code, luckily in my business we can't, so it's easy for me to say no, as i can't validate a black box, which step by step validation is required for our data since it directs health decisions, but other fields can and it will continue to produce large vulnerabilities. It's honestly scary
And yet google openly says something like 60%+ of its code now is ai generated...
AI code is fine but it needs an experienced reviewer
@@daveb3910 wdym, validate a blackbox. AI code means code you generated via AI, not using AI to write code live?
The generated code isn't a black box
Its just so much faster to do my own coding then try and catch all of the insane things and ai code might do. Like 95% of the time it's fine 4% it's broken and the last 1% it's doing something genuinely insane.
I know what mistakes I tend to make and where to look for them. I've spent a long time learning good practise. The ai has every mistake in recorded history at it's finger tips and usually it's the stuff reviewed enough to not immediately be obvious.
Ai coding is a big gamble.
Why the hell was it connected to the medical data in the first place?
Selling "insights" about people to ad networks. It's not just knowing what people like anymore. It's knowing all medical conditions to better target them.
Thank YOU! Yes. Hello. These are private medical records.
@@pseudomemes5267 You say that as if they have the right.
@@pseudomemes5267 At which point during my doctor visit did I agree to such a thing? How does it go from a doctor visit to building artificial intelligence? So they're benefiting from my interaction. How much value does MY MEDICAL RECORDS generate for THEIR product?
@@lopiklop it's probably included as part of the Windows EULA, something like "if you have ever used windows for any reason we have the right to gather and sell any information about you"
this is obviously a joke, but also not out of the scope of what mega corps think they can get away with through their EULAs (remember that Disney tried to say the EULA for a free trial of their streaming service ment they couldn't be sued for a lethal allergic reaction at one of their parks)
I’m surprised the microsoft patch wasnt to just ban his ip and then have bugfixes to add his new ip every time
Sound like a HIPPA violation!
Nah doesn't apply if you have enough money
Don’t be a hippo, it’s HIPAA.
What i was thinking too
Running arbitrary code on a machine with sensitive data sounds like a recipe for disaster, even when sandboxed...
They should definitely give the "running javascript" bit to some other server that only does this. That server can then be isolated from the rest, making any breach somewhat useless.
It seems like QA and security is irrelevant today. The only thing that matters is getting out a semi-broken thing as fast as possible
if you take the time to do that stuff right then minimum viable product move-fast-and-break-stuff crowd will eat your lunch with their rapid results and problems that don't show up until later down the line. And since you've now sold a product that constantly breaks you can now as a bonus get even more money out of expensive maintenance/support contracts! how's that for a win-win! disruptive capitalist innovation at its finest
MS developers are generally a different flavour today. Same goes for Google. I'd expect less and less from them going forward, as they continue to hire based on "appearance" rather than talent. Maybe I'm a bit salty, but it's true nonetheless.
@@TheGreatNoticing00 They are too busy "doing the needful"
In a way it has always been like that in the business. In the old days of software, there wasn't so much competition on the market, so you could've focused a bit more on quality, but every established market with competition sooner or later reaches a stage, where you can't spend too much money on perfection and need to earn income ASAP. Software has reached this milestone about a decade or two ago.
Microsoft removed all QA teams years ago.
I think a better question is why does Microsoft AI have access to private medical records.
Medical institutions use 3rd-party developers for their apps, and hire vendors to upload or stream data to cloud services for them to load. There are more rules and paperwork than you can imagine to keep things compartmentalized and "safe", theoretically, but current dev culture attitudes and perverse corporate incentives undermine it daily. My anxiety level has dropped substantially since leaving that industry, cuz you either fight your conscience or fight literally everyone on the call over obvious stuff like this, every day.
Simple , it's Microsoft....
they write their programs to just do things... security, safety and non-crashing come later...
I went to a MS conference once with their programming team... where they outlined their programming development and internal "mantra"
when i left I was completly shocked at how lax they were...
They basically write software with as few checks and balances as possible, it just matches the spec & that is it..
when they have to modify the systems for other uses.. they just make changes & fix what visibly breaks
Are you suggesting that is any different from how ALL big companies write the CRAP they pass off as software?
One of the great things about being American:
I ain't been to a doctor in decades, you got nothin on me
Honestly, I wouldn't go that often even if it was free. All they do is try to push pills on me and do a crappy job of finding potential problems. The best medicine is not eating trash, getting some exercise, and enjoying time with friends. That stuff doesn't net piles of money though, so they never bring it up.
Couldn’t afford to visit a doctor, same as the rest of us? That can only last so long…
Data breaches are often the result of errors in system management or configuration, not “automated” AI. More importantly, the responsibility lies with the humans who design, deploy, and monitor the system, not the AI itself.
as if i wasnt already worried by the whole "copilot takes screenshots of your computer"
Say more on this. And WHICH versions and variants of Copilot? Only the web versions? If so, in which browser(s) does these TOTAL BS exploits occur? Does it also affect the Copilot running inside Skype?
@@YodaWhat Been a while ago, but i think its just ordinary copilot. the same that comes with windows 11.
Its not really an exploit, its how microsoft desinged it. And it sparked quite the contreversy when word got out, a few years ago.
@@arkorat3239 - Ah, thanks. I don't use Windows 11 or any of that extra crap even in Windows 10. First thing I do with a new Windows machine is turn that $hit off as much as possible.
4:50 - using query code that is not read-only / execute is a security issue
In Germany the Bug Hunter would have been sent to jail because of the Hackerparagraph and the bugs would persist.
Personally I would never ask AI for any serious health issues, even if they were 100% private and 100% secure because if AI happens to hallucinate then I can easily end up on 10x worse situation than I started with. If there is something I don't know how to deal with I would rather go to doctor and get some real advice than for example trying to heal flu by standing uv light and drinking mercury.
Imagine if a certain legend asked for help removing a specific cylinder…
Amazing reference
seems rather imperative that it remains unharmed.
"Can't fix stupid" theory confirmed
AI and nodejs. Name a more iconic duo of security terribleness.
These Lawsuits need to be far more punitive, there needs to be drastic consequences for exposing and harming so many people!
I can't wait to cash my $2.49 check after the lawyers suck all the value out of the class action data breach lawsuit.
But this story is not about AI anyway.... AI bot not leak anything, stupid platform architecture and stuipd developers (who maybe were expert in AI but not not in other areas)
Imagine how dumb AI is if leading AI expert developers, engineers and architects are this dumb.
That's why I don't use gadets to monitor my health, our data is incredibly valuable.
This makes me just think about co-pilot. Microsoft is getting greedy with their data stealing.
Node js is a menace, dude
Been saying it for years, JavaScript on the server was web development's original sin
@@skyrimax JavaScript was the original sin. Running it on servers was when we said screw it and let the devil take over.
The omniscient AI has certified that the code was secure. Oops that was a hallucination. Okay delete/ fire that AI and try uploading a new one… which is almost identical, and trained on the same data set. It’s just good business.
while the services of M$ have been becoming broader and more sophisticated, the quality really keeps going down the toilet.
What medical records? Most of us can't afford healthcare to begin with.
Your birth certificate did not write itself.
"Little Bobby Tables we call him"
My name is "help im stuck in a drivers license factory"
hackers are such nice people, that hacker could have made everyone's medical records say they tested positive for aids. it's wonderful we have bug bounties and they are paid, hard work was do to earn that small sum of money and the whole world benefits.
not at all a huge potential conflict of interest down the line if not already...
they should've added "tested positive for nothing" to all records
Apostrophe fail.
Total Recall and CopePilot+
Anyone else notice that bug bounties often have a habit of not paying? You'll find the bug and they'll say "Oh we already knew about that" then patch it and act like its no big deal.
So, it's basically like hunting for open folders, in 1997, to dump MP3's on unsecured FTP servers in order to share music. Gotcha.
this... this is why everyone hates JavaScript
😑
This is why we shouldn’t be using JavaScript for non-UI purposes.
Can’t help but think the term “updationing” was part of conversations during development of this.
My take away from this is that nodejs is not secure by default, and needs some careful design and hardening to make it production grade.
Compounded with dynamic and super flexible JIT nature of node, it sounds like a nightmare.
All doctors that dared to upload personal info were compelled. Who is going to pay for this? I would say all corporations and doctors must pay.
god these companies are stupid. they want AI to be a thing so bad that consequences be damned
In case you forget, Microsoft will help you Recall this instantly!
hearing the words nodejs backend sealed it for me
that wild bc most basic thing for sql is to prevent the moving of going back .. as well as doing a ls of a dir row colm etc. failed huge.
Whoever worked on this must be borderline non-functional. Was this whole project just 1 dude? How did not a single person on the team call out this insanity? Insane.
Its not an accident.
Wake up fools
So once again, the super smart programmers of Microsoft allowed direct access to data, rather than buffering it, ensuring encrypted connection between intermediate server & data, as well as not keeping the AI software isolated from important data. Also, adding directory capabilities within a URL, rather than having the server or data server do the searching has been a known exploit/issue for decades.
You never allow directory level execution or maneuvering at the URL level AND we have become so dependent on showing URL data, that this type of thing will happen due to sloppiness. as the old adage goes: it isn't the new guy that gets hurt (makes serious errors), it is the experienced person because he becomes so confident in his experience
I know little about software engineering n this kind of crap, but god I love your vids explaining it so clearly. Keep up the amazing work m8!
much appreciated, will do
Welcome back!
Somehow all these big tech companies don't pentest their products...
Good for bughunters and black hats
Very interesting. Underrated channel, you earned a new sub!
How was the underscore module modified remotely??
Why is the back-end in JS instead of a strongly typed language which would reject input and help require data be properly sanitized? Why is the database input not properly sanitized?
Brilliant video, thanks!
@5:55 I think you've either misinterpreted how the query injection works or the exploit you copied from wasn't documented correctly. Unless MS has made a mistake with implementation of building a quert. If this is even actually a reality. I feel like it's not. But first the query needs to be completed by providing an escaped ' and ) and then you can initiate the other escaping to insert the transversal and allow the query to be completed again.
since ur name is Boctor i thought this would be a medical channel first most that was just covering tech news 😅
Please make more videos, I'm getting addicted to your explanations
Microsoft does dumb shit
If only Microsoft would not always hurry tihings in their try to be the first maybe they would not have so shitty products.
Well explained!
Thanks for watching!
Where do we sign up for the class action suit?
Excellent video, editing, sound design. You deserve more views (:
glad you liked it!
Who tf gave Microshaft their medical data???
Omg the vids are back!!!
This must be why my organization sprang new AI rules on us recently regarding using AI with any sensitive medical or org info.
This is why I don't use ANY Microsoft products anymore. Including Windows.
The First exploit was already quite easy, it's like going to a final test about history, putting "it al begun in 1942... ... And that's how Nazi Germany fell" and getting an A+
No way the legend is uploading again!!!
no way people make some unrelated remark about the video.
we back
sooo, they wernt sanitisign inputs? still watchign,.t hats A ENTRY LEVEL SECIURITY ISSUE and bug
AI is imprecise. It's not a bad tool for thinking through ideas, but using it to write code is rarely reliable and using it for healthcare should be illegal. Not that we have humane healthcare anyways, so I guess it makes sense they wouldn't care about ethics.
holy, javascript is so insecure. Im still shocked it's so wide-spread on the backend
People: Why don’t you trust AI tools?
Me:
That is...certainly a way to pronounce "JavaScript" that I haven't heard before.
0:57 what's the background music?
It sounds to me like Firecracker from LEMMiNO, but I'm not sure. Also, the music used in the video is in the video description
this is why not every damn thing needs AI ffs.
sounds like they are doing commands that microsoft does automated
meaning microsoft is probably already selling that data
I wish all of my data was in paper files in my closet, even passwords, because its always getting "found online".
Meanwhile Im unable to access websites because I forget my password or questions, hackers have more access than I do...
Hackers? Try said websites not accepting right password just because, had to change a couple over absolutely nothing (the password and name were actually correct, it just refused to accept them).
Guy is making exploiting Azure into a career path 😂
Note to self
cl - Vulnerabilities in Microsoft's Healthcare"
Brilliant won't teach you that stuff but get your bag bro
Seems very similar to a modern version of SQL injection
Maybe we shouldn't build such things on stacks upon stacks of libraries and frameworks. A JS runtime environment running on a JS engine importing modules to implement an "indexof"... What the hell happened to writing software that compiles to machine code, instead of relying on dozens of layers that can each have vulnerabilities?
I wonder if they could have made more then 200k if they would have placed a short position on the stock and informed an hacker group about the holes.
And also sell the data separately cause more money is always better.
how did they get 100 million records?
I hope AI dies off like the virtual reality glasses did a few years back
How does an attacker override the _indexOf function though?
Javascript allows you to simple reattribute functions. _.indexOf = () => 10;
@avalonwmii3687 okay, but that implies that attacker already has ability to execute some code on the backend. I don't get how
@@illochese It's explained in the video. Azure Health Bot instances allowed you to setup your own code in them. 7:08
My guess is that if underscore is in the packagesAllowedList you can just require it and change it
@@ThisIsTheInternet oh, now I see, what a wonderful attack vec... feature
If you can't understand the difference between - users- and -users'- then what else does it tell about your IQ? I am going to consult my dog next time.
These are rookie bugs!😄
how much DEDOTADED wam for the serwor..
I always wonder what society is supposed to do in these situations, when mega corporations incompetence and greed hurts millions. Give up? Continue as normal like nothing happened despite the damage? or... perhaps call Luigi?
In this video??? GREAT! Thought it would be in a different video.
Hunters need to start demanding more for information on these exploit bounties, I'm saving you millions or potentially billions of dollars I want a least a mill