DDoSing with ChatGPT

[madires]

ChatGPT has a lovely DDoS API. Feed it a URL as many times as you like and it will DDoS that URL. No restrictions or limits. OpenAI doesn't care.

Media:
OpenAI's ChatGPT crawler can be tricked into DDoSing sites, answering your queries (https://www.theregister.com/2025/01/19/openais_chatgpt_crawler_vulnerability/)

Disclosure and PoC:
OpenAI: ChatGPT Crawler Vulnerability (https://github.com/bf/security-advisories/blob/main/2025-01-ChatGPT-Crawler-Reflective-DDOS-Vulnerability.md)

[SiliconWizard]

That's shocking.

[Analog Kid]

Shocking? really?
I find that right in line with what I expect of that whole fucking technology.
"Oh, boo-hoo, sob, sob: this marvelous machine that I created--strictly for the Good of Mankind--can be, and is being, used for nefarious purposes. Oh god, the humanity!"

[golden_labels]

As expected the world goes “omg AI evil.” Despite the attack style is not new, not limited to smortnets, and that technology plays no role in its execution.

I can’t see it as anything more than a shameful, but honest mistake. How much I may dislike them, “the Scary BigTechs” are among the best in preventing this kind of an amplification attack. 25 years of experience under their belt. I doubt anybody would notice, if not that it was a low hanging fruit standing near letters ‘A’ and ‘I’.

[rteodor]

That's shocking.

That is sarcasm, right !?

This issue is easy to fix. If anything this mishap can be submitted at the cost center as a minor "marketing expense".
The true vulnerability that is still unfixed is the "move fast and break things" mentality.

[magic]

Knowing SiliconWizard I'm sure it was dead serious.

[Siwastaja]

The defect itself isn't spectacular, stuff like that happens. What I find concerning, nearly shocking, is that apparently companies like OpenAI and Microsoft have absolutely no process in place to receive and handle vulnerability reports. For something as dysfunctional as Microsoft I'm not surprised, but it's still shocking. This kind of defect is pretty easy to fix, so it makes very little sense to not do it.

[SiliconWizard]

Shocking, but not surprising.

[magic]

The defect itself isn't spectacular, stuff like that happens. What I find concerning, nearly shocking, is that apparently companies like OpenAI and Microsoft have absolutely no process in place to receive and handle vulnerability reports. For something as dysfunctional as Microsoft I'm not surprised, but it's still shocking. This kind of defect is pretty easy to fix, so it makes very little sense to not do it.

Micro$oft has processes to handle defects, in some products. I guess it's a case of the general trend that AI companies don't care much about any rights of their "training datasets".

Maybe people should just start IP-banning their crawlers on a mass scale. There are obvious benefits to being indexed by search engines, but what does AI have to offer?

[SiliconWizard]

Maybe people should just start IP-banning their crawlers on a mass scale. There are obvious benefits to being indexed by search engines, but what does AI have to offer?

Potentially the same when "AI" is used as a search engine, although one major issue is that due to its summaries (as opposed to just a sorted list of links), AI will just have a tendency to bias its results even more (if a link in Google is the 20th in the page, that gives it less chance, but people can still accesss it; if an information is not listed by "chatgpt", it's just not there at all; kinda big difference).

But if we consider the ratio of benefit/damage, AI clearly has very little to offer in that regard comparatively.

As to the problems due to "stealing" copyrighted material, they are still an open question.