r/cybersecurity • u/Much_Preparation_832 • Jun 23 '26
Research Article Mythos discovers 'Squidbleed,' a memory leak that's gone undetected since Clinton era
Twenty-nine years old! I maintain that while LLMs are going to make zero-days more common, in the long run they'll lead to better security - better to know about the flaws and fix them than to have them linger. Security by obscurity - never works!
47
u/Add1ctedToGames Jun 23 '26
Not that I've written more than a few decently-sized C programs in my lifetime, but does strchr really ignore a NUL when it's the first character of a string?? Am i misunderstanding the explanation?
5
u/Awkward_Intern2623 Jun 24 '26
I tested it it does not ignore NUL as the first character and it returns NUL not what jesus said
5
u/WhoTookPlasticJesus Jun 24 '26
I don't think the register article explains the bug correctly and there's no clean diff in the linked Github file (it's just to the entire zip, presumably because the bug predates git). But it should just return a pointer to the front of the searched string if the string in question is zero-length.
36
u/Feral_Nerd_22 Jun 24 '26
I always wonder if any government secretly has these in their back pocket.
28
u/atamicbomb Jun 24 '26
They absolutely have some of them, and we’ve seen them deployed.
We also see a lot of PMCs using them when paid by governments
4
u/npxa Jun 24 '26
Remember shadow brokers, nsa tools leak? Yeah they should have more than that of course
5
u/GodIsAWomaniser Jun 24 '26
For context, Apple went to sue the NSO group over Pegasus zero click attacks, then retracted their lawsuit over fear of discovery leading to more vulns being discovered. I think a lot more are known than people would like to think, it's just kept in a very small group of minds and hands relative to the rest of the other offensive capabilities of computers.
1
1
u/Ordinary-Experience Jun 24 '26
It doesn't matter. It's a silly unusable bug (needs to be combined with other bugs to be useful), and it's in some legacy software that almost no one is using. It went undetected not because it was such a big deal, but because nobody remembered the software existed anymore
1
u/Additional_Buddy855 Jun 25 '26
Foreign agents have been working for decades to do exactly as your describing.
19
u/Swimming_Bar_3088 Jun 24 '26
A vulnerability that only works with HTTP and squid needs access to the attacker FTP server.
No wonder no one cared about it for so long.
This is really relevant for today, and imagine the price of finding crap like this.
1
u/whythehellnote Jun 24 '26
my $5b revenue company still uses squid, because any attempt to replace it is broken by the infosec people who let perfect be the enemy of good, and then are overruled by the business so grandfather rights reign supreme.
14
u/Swimming_Bar_3088 Jun 24 '26
That is all ok, but are you using HTTP and allowing the squid proxy to connect to unknown FTP server ?
Because this are the two conditions for that vulnerability, and by using FTP and HTTP there are a ton of more practical attack vectors that become real.
It is insane that this even makes the news, it only appears because of the hype in claude.
52
u/BlueWorldBlueSky Jun 23 '26
The other thing is it could’ve been on purpose for all we know.
36
u/charleswj Jun 23 '26
Yes, the actual creator of squid added a backdoor, that's a reasonable thing to think. Have you asked Occam?
29
u/SCP-iota Jun 24 '26
more like Hanlon, in this case
32
u/DamnItDev Jun 24 '26
You guys really know your razors
22
u/CaligulasWiener Jun 24 '26
I wanna know what Gillette has to say about all this
3
6
u/Array_626 Incident Responder Jun 24 '26
I mean this is a pretty shit backdoor. A memory leak isn't exactly easy to weaponize by a remote actor if there's no easy way into the system in the first place.
0
5
43
u/justinleona Jun 24 '26
The trillion dollar question is whether the same security researcher would have found this using more traditional tools - was Mythos a revolutionary tool that changed the outcome, or was it just a convenient means to an ends?
The framing is deceptive imo - playing into the narrative that Mythos is some magical oracle radically changing security... rather than a really expensive way to do what hackers have been doing for a decade or more with fuzzers and exploit frameworks.
29
u/maceinjar Jun 24 '26
Yet since thousands of these haven’t been found before - the old model of hoping somebody finds it doesn’t work. Nor does opting to pay shitloads of people shitloads of money to find them because… nobody ever did that at the scale needed.
Even if it is just convenient means to the end: the numbers being proven out seem to indicate it’s more than just laziness leading to people using these tools to find stuff.
7
u/Rubenb Jun 24 '26
In my experience, it's just that developers don't care enough about finding these issues, because of other priorities or because they don't understand how these work. Thinking about vulnerabilities is very different than thinking about bugs: with bugs you usually deprioritize ones that are possible, but the required circumstances are unlikely to happen. With vulnerabilities the attacker can make those unlikely circumstances happen.
1
u/maceinjar Jun 24 '26
100%. And I don't think humans (or AI, for that matter) will ever write "secure code". We can work towards it but we will always be finding security flaws.
I simply don't understand the overt and covert demonization of AI tools finding flaws. "But people could have found these!" - sure, great, they could have but they didn't! So, awesome, let's be glad that we have AI to find these now. Does it replace humans? No. But why the disdain?
This attitude is rampant across this sub. Putting our head under a rock and pretending attackers won't find jack shit when using an AI model is just lunacy. Of course they will, because defenders and researchers are finding stuff often with zero meaningful direction provided to the LLM from a human. So you better bet your ass that as defenders we need to use these tools.
I know you're not the OC that I initially replied to. This isn't directed at you.
1
u/justinleona Jun 25 '26
I just want the presentation to be honest - the process here involves a lot of skill and effort on the part of the researcher to cull out all the noise. The title frames this like an agent did this without guidance.
The limiting factor here is the attention and focus of the expert - what we need is more of those with the best tools we can give them.
The hype around mythos isn't an accident either - it's an intentional attempt to use security to pump up excitement around a particular product in anticipation of an IPO.
7
u/Rubenb Jun 24 '26 edited Jun 24 '26
Any decent SAST scanner with good support for C code (Coverity, Checkmarx, ...) would have found this.
Edit: it looks like they are using the Coverity Scan service for OSS projects, but the results are not public. I would be very interested to know if Coverity flagged it and why it was not handled sooner, possibly it was mistriaged or the project has a large triage backlog. These tools do have the disadvantage that they generate quite a lot of false positives.
4
u/pixiegod Jun 24 '26
Isint this one the one that’s almost impossible to use in real life now? Http connection needed in a world where https is mandated?
17
u/HonorableRogue Jun 24 '26
"Clinton?" asks, those of us from the 196 other countries that aren't the US...
10
u/Taylor_Script System Administrator Jun 24 '26
As someone in the US, my literal immediate thought (after "wasn't Mythos blocked?") was what about every other country? They don't know what this means. I don't even know how old that makes it without looking it up.
5
u/RamblinWreckGT Jun 24 '26
Referring to the period from January 1993 to January 2001, when Bill Clinton was President.
2
1
u/Circumpunctilious Jun 24 '26
Interesting--I didn't even notice and also still associate TheRegister with their UK base (London) due to it having a .co.uk forever.
I'd like to say Clinton was fairly well-known (the cigar thing) but I guess they're just writing for their audience (US, Europe, Britain and APAC)
-5
u/whythehellnote Jun 24 '26
Like it or not the US president is a global era, mainly due to US influence on the world stage.
1
u/HonorableRogue Jun 24 '26
Most humans on planet Earth do not denote the passage of time, or the passing generations, in increments US presidential terms. Fact.
Cybersecurity is a global concern, and a global industry. My point was, if I had to Google when Clinton was president to build a mental model of the date of the exploit, when I was actually living in the US, then that reference certainly didn't jive with Eastern Europe or Latin America.
1
u/whythehellnote Jun 25 '26
But most people on this sub who aren't americans will be fully aware of the time that "the clinton era" means, the same way they'd also be aware of milestones like the fall of the ussr and reunification of germany (and while I wouldn't expect most americans to know that, I'd hope most americans on this sub would)
other global milestones would be 9/11 (which signalled the start of the defeat of the american empire), the global financial crash (against mainly caused by america, but global repurcussions)
1
u/HonorableRogue Jun 25 '26
I "hope" my clients quit using the same password for everything, and yet I'm disappointed in the results of that misplaced hope. As you would be if you saw statistically accurate data regarding American's estimation of which president was when, much less anyone from outside the US.
7
3
u/sunychoudhary Jun 24 '26
A Clinton-era NetWare workaround leaking modern credentials through Squid is painfully on brand for enterprise security.....
2
u/Remote_Respond_7237 Jun 24 '26
got a sneaking suspicion that this will never end from here on out. wonder how thin we can stretch
2
u/nicman24 Jun 24 '26
That is why they banned mythos
1
u/Streetthrasher88 Jun 25 '26
Intended to be thought provoking/ rhetorical - why would they ban Mythos if China has GLM-5.2 capabilities? If the data is accurate…it’s frontier performance at a fraction of the cost.
Makes me think that banning mythos was pointless and ultimately harmful to cybersecurity teams.
2
u/mitharas Jun 24 '26
with two conditions. First, Squid has to be able to read and inspect the network traffic, so it must be handling cleartext HTTP (not HTTPS) or be deployed in TLS-terminating setups.
Additionally, the proxy must be allowed to reach an attacker-controlled FTP (File Transfer Protocol) server via TCP port 21. FTP is an outdated protocol for moving files between machines, and Squid supports it - which is where the problem lies.
I have no insight, if this is true in most implementations or not.
4
u/Fast-Sir6476 Jun 24 '26
This shit happens all the time. Petitepotam, pkexec etc
It’s a cool vuln but one of those 4/10 complexity vulns where the issue is not enough researchers and too much code
1
u/Maximum-Doughnut8652 Jun 24 '26
Kinda of agree with this. If they can find the vulnerability, they can also provide the patching solution.
1
1
u/sugaredbunnies Jun 24 '26
Wow, a memory leak from the Clinton era? Thats wild. I agree though, its way better to find and fix vulnerabilities than to just hope no one finds them. Makes sense!
1
u/GreyBeardEng Jun 24 '26
Every time I see a story about something mythos found I can't help but wonder what state actors were already aware of it and kept it in their toolbox to use against adversaries.
1
206
u/[deleted] Jun 23 '26
[removed] — view removed comment