Inspired by a spate of supply chain attacks (like Mini Shai-Hulud-style worms, which culminated in headlines like Microsoft's Azure tools themselves being compromised), earlier this year I wrote on my blog (which I have taken down as dust settles around recent RCEs) about the Kessler Syndrome, applied to software. Ie: the rising likelihood that, because of how bad actors with agentic AI can do far more damage, more quickly with the secrets they exfiltrate from penetrated networks, we could get into a situation where essentially every network of medium or greater complexity would become permanently "tainted" (never fully clean).Basically, can a swarm of agents 1) penetrate networks and exfiltrate secrets and 2) successfully install deeply embedded malware/rootkits, faster than hugops teams can rotate secrets and restore servers cleanly? For basically the entire existence of networked computers, this would have seemed a fantastical notion. But, throw in the current AI-fueled exploit discoveries and the countless servers vulnerable to RCEs across several stacks: I feel like the probability just keeps rising.Here are excerpts from my blog post, June 10:"'The Kessler Syndrome is a scenario where the density of objects and space debris in low Earth orbit becomes so high that collisions between them trigger a runaway chain reaction. Each crash generates thousands of new fragments, exponentially increasing the risk of further impacts and potentially rendering Earth’s orbit unusable.'"Just counting some of the high profile examples of public repos being laced with malware lately: Microsoft just disabled 70+ of their own repos, including Azure building tools. Repos from RedHat, tanstack, axios, Mistral, UiPath, and many other lower profile targets have been hacked. The list is long, and is much longer if you count companies (not just public repos for devs) that have been bitten, including names like GitHub, Cisco, OpenAI, and more."...AIs or fancy new systems, probably made with AI appear to have dramatically lowered the amount of time to first utilization of stolen credentials."It takes too long to clean an infected system/network (and the malware is getting much smarter/vindictive about detecting its removal, further complicating things), and it takes almost no time for a batch of stolen credentials to be exploited -> new networks traversed, leading to more secrets (that likely compromise more projects, rinse and repeat)."I think there is the very real possibility that we reach a Kessler Syndrome situation for shared/open source software, where the success of continued credential stealing campaigns permanently compromises medium, large, and even small networks, and lowers trust in shared software to a crippling degree."In just October:

Railway - customer secrets exposure LiteLLM - malicious PyPI + Docker releases Zeabur - infrastructure breached OpenCode - AI API keys exposed OVHcloud CLI - official binaries backdoored Rank Math PRO - malware in official plugin TeamUpdraft - customer data compromised ConnectWise - cloud backup identities compromised Tensorlake - npm package infected PingCap - alleged major breach SubQuery - backdoored npm package GhostAction - GitHub repos with malicious workflows PHP - critical RCE flaws Node.js - security flaws patched eMudhra - certificate authority keys compromised Tailscale - eMudhra incident Comments URL: https://news.ycombinator.com/item?id=50189771 Points: 2

Comments: 0