Comment

Comment on GPUs from all major suppliers are vulnerable to new pixel-stealing attack

db2@sopuli.xyz ⁨1⁩ ⁨year⁩ ago

And it left out possibly the most important piece of information:

For GPU.zip to work, a malicious page must be loaded into the Chrome or Edge browsers. Under-the-hood differences in the way Firefox and Safari work prevent the attack from succeeding when those browsers process an attack page.

source

Sort:hotnew top

d3Xt3r@lemmy.nz ⁨1⁩ ⁨year⁩ ago
Once again, this is another example of how poor these TLDR bots are. I asked a popular LLM (which people here love to hate) to summarize the article, and not only did I get an actual TLDR (< 150 words), it also included the most important piece of information:

GPUs from major suppliers including Apple, Intel, AMD, Qualcomm, Arm, and Nvidia are vulnerable to an attack allowing malicious websites to read sensitive visual data from other websites. The exploit, named GPU.zip, violates the “same origin policy”, a fundamental internet security boundary. The vulnerability starts when a malicious site places a link in an iframe, an HTML element. While normally this policy prevents content interaction between sites, the data compression used by GPUs for performance optimization creates a side channel that can be exploited. To succeed, the attack requires loading a malicious page in Chrome or Edge; Firefox and Safari’s operational differences protect them. Furthermore, the targeted page in the iframe should allow cross-origin embedding. Although many sites block this embedding using X-Frame-Options or Content-Security-Policy headers, some, like Wikipedia, don’t. The current risk posed by GPU.zip is considered low, but the discovery emphasizes potential hardware-based side channels in security.

source
- bassomitron@lemmy.world ⁨1⁩ ⁨year⁩ ago
  It’s because many TLDR bots are using relatively basic algorithms to summarize versus incredibly complex language models that have been trained on billions of data points. No rational person would disagree with you that ChatGPT is vastly more sophisticated than a common bot.
  
  source
- theterrasque@infosec.pub ⁨1⁩ ⁨year⁩ ago
  I’ve been toying with the idea of making a bot similar to autotldr, but using an llm to summarize the data for some time now.
  
  source