A Disney Worker Downloaded an AI Tool. It Led to a Hack That Ruined His Life | Hacker News Reader

A Disney Worker Downloaded an AI Tool. It Led to a Hack That Ruined His Life

wsj.com

25 pointsimpish920816 comments

Gift link: https://www.wsj.com/tech/cybersecurity/disney-employee-ai-to...

The article glossed over a key detail. He stored his work credentials on his personal 1Password password vault which no one should ever write down nor take passwords home with you. This could have been just a personal thing between him and this hacking group and not involved Disney.

On top of that, it seems Disney was allowing single sign on to Slack. My guess it works sort of like LucidChart where it redirects to like Corporate ADFS or single sign on systems.

I am not clear if Disney has MFA setup for their employees. My work uses ID Authenticator and it’s on my mobile phone.

I don’t know why Disney isn’t using something like Teams.

Anyways just guesses on my part

Would using Teams have made a difference? Other than making it harder to find anything (for users and bad guys)

Yes, Teams integrates with Office 365 which gets you DLP.

Teams provides stronger security and better security compliance.

There a bunch of other “killer” features that Slack is really not equipped for in an Enterprise environment.

It's one thing to go after Disney as a whole but going after one guy specifically feels like a whole different level of evil.

It's all good, the fine print establishes the real culprit as "free software from popular code-sharing site GitHub"

I meant the hacker(s)

Can't believe that 1password doesn't enforce multi-factor by default for the online account. They have a secret key which more or less acts a 2nd factor but it looks like in this case they stole the victim's web session which held the key. Could have happened if they had stole the multi-factor session too I guess.

They have conditional access capabilities.

https://support.1password.com/firewall-rules/

(have implemented to attempt to mitigate this vulnerability, but if there is malware active on the device, it will eventually have access to the clipboard or otherwise unencrypted secret)

I believe that this is the hack that is being discussed: https://cybersecuritynews.com/comfyui-users-targeted-by-mali...

Discussion about the breach at the time last year:

Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data

https://news.ycombinator.com/item?id=40955693

Does anyone know which repo they’re referring to in the article?

ComfyUI

Maybe ComfyUI_LLMVISION[1] malicious extension then (my speculation based purely on the date of hack).

Edit: yes, probably it was ComfyUI_LLMVISION[2]

[1] https://www.reddit.com/r/comfyui/comments/1dbls5n/psa_if_you...

[2] https://news.ycombinator.com/item?id=40960666

even though it sounds like he was using the AI tool for personal reasons, this highlights the worst case scenario for shadow AI and using free tools.

no paywall: https://archive.is/LY290

Reply on news.ycombinator.com