Hacker News Reader

Comment by gavinray | Hacker News Reader

The "zero day" is something they call a "ClickFix Attack"

Upon Googling "ClickFix":

  > "A ClickFix attack is a social engineering technique... It typically compromises devices by manipulating victims into copying and pasting malicious commands directly into system-level tools"

I'm sorry, that's not a zero-day, that's idiocy that's as old as time.

View on HN

The exploit is a local zero day exploit, meaning the machine needs to already be compromised. For it to be a remote zero day exploit you need to do the ClickFix attack. The idea is that it lets you access much more machines and resources if the one machine with Muse is compromised. More info here: https://x.com/dps/status/2102248329111634067

We filed a bug report but the original maintainer seems to have dropped offline. The community's had some success in correcting bugs with low-level hacking, but it's hard to make progress without the source code.

> > It typically compromises devices by manipulating victims into copying and pasting malicious commands

> […] that's idiocy that's as old as time.

And constantly being reinvented: `curl -sL some.unverified.stuff.sh | bash`

Reminds me of playing Runescape back in the late 90s, you could double your money by just pressing alt-F4

Well if nothing else, idiocy that's as old as time started on day zero.

words don't seem to mean anything anymore.

clickbait headline should be changed, not a 0-day.

Reply on news.ycombinator.com